Commit Graph

28 Commits

Author SHA1 Message Date
Hans Hasselberg 1be90e0fa1
agent: don't let left nodes hold onto their node-id (#7747) 2020-05-04 18:39:08 +02:00
R.B. Boyer a7fb26f50f
wan federation via mesh gateways (#6884)
This is like a Möbius strip of code due to the fact that low-level components (serf/memberlist) are connected to high-level components (the catalog and mesh-gateways) in a twisty maze of references which make it hard to dive into. With that in mind here's a high level summary of what you'll find in the patch:

There are several distinct chunks of code that are affected:

* new flags and config options for the server

* retry join WAN is slightly different

* retry join code is shared to discover primary mesh gateways from secondary datacenters

* because retry join logic runs in the *agent* and the results of that
  operation for primary mesh gateways are needed in the *server* there are
  some methods like `RefreshPrimaryGatewayFallbackAddresses` that must occur
  at multiple layers of abstraction just to pass the data down to the right
  layer.

* new cache type `FederationStateListMeshGatewaysName` for use in `proxycfg/xds` layers

* the function signature for RPC dialing picked up a new required field (the
  node name of the destination)

* several new RPCs for manipulating a FederationState object:
  `FederationState:{Apply,Get,List,ListMeshGateways}`

* 3 read-only internal APIs for debugging use to invoke those RPCs from curl

* raft and fsm changes to persist these FederationStates

* replication for FederationStates as they are canonically stored in the
  Primary and replicated to the Secondaries.

* a special derivative of anti-entropy that runs in secondaries to snapshot
  their local mesh gateway `CheckServiceNodes` and sync them into their upstream
  FederationState in the primary (this works in conjunction with the
  replication to distribute addresses for all mesh gateways in all DCs to all
  other DCs)

* a "gateway locator" convenience object to make use of this data to choose
  the addresses of gateways to use for any given RPC or gossip operation to a
  remote DC. This gets data from the "retry join" logic in the agent and also
  directly calls into the FSM.

* RPC (`:8300`) on the server sniffs the first byte of a new connection to
  determine if it's actually doing native TLS. If so it checks the ALPN header
  for protocol determination (just like how the existing system uses the
  type-byte marker).

* 2 new kinds of protocols are exclusively decoded via this native TLS
  mechanism: one for ferrying "packet" operations (udp-like) from the gossip
  layer and one for "stream" operations (tcp-like). The packet operations
  re-use sockets (using length-prefixing) to cut down on TLS re-negotiation
  overhead.

* the server instances specially wrap the `memberlist.NetTransport` when running
  with gateway federation enabled (in a `wanfed.Transport`). The general gist is
  that if it tries to dial a node in the SAME datacenter (deduced by looking
  at the suffix of the node name) there is no change. If dialing a DIFFERENT
  datacenter it is wrapped up in a TLS+ALPN blob and sent through some mesh
  gateways to eventually end up in a server's :8300 port.

* a new flag when launching a mesh gateway via `consul connect envoy` to
  indicate that the servers are to be exposed. This sets a special service
  meta when registering the gateway into the catalog.

* `proxycfg/xds` notice this metadata blob to activate additional watches for
  the FederationState objects as well as the location of all of the consul
  servers in that datacenter.

* `xds:` if the extra metadata is in place additional clusters are defined in a
  DC to bulk sink all traffic to another DC's gateways. For the current
  datacenter we listen on a wildcard name (`server.<dc>.consul`) that load
  balances all servers as well as one mini-cluster per node
  (`<node>.server.<dc>.consul`)

* the `consul tls cert create` command got a new flag (`-node`) to help create
  an additional SAN in certs that can be used with this flavor of federation.
2020-03-09 15:59:02 -05:00
Sarah Christoff 9b93dd93c9
Prune Unhealthy Agents (#6571)
* Add -prune flag to ForceLeave
2019-10-04 16:10:02 -05:00
Jeff Mitchell b43800125c
Update vendoring from go mod. (#5566) 2019-03-26 17:50:42 -04:00
Matt Keeler a2fb5eafdd
Revendor serf to pull in keyring list truncation changes. (#5251) 2019-01-22 16:07:04 -05:00
R.B. Boyer 7f30950060
update github.com/hashicorp/{serf,memberlist,go-sockaddr} (#5189)
This activates large-cluster improvements in the gossip layer from
https://github.com/hashicorp/memberlist/pull/167
2019-01-07 15:00:47 -06:00
Paul Banks 3adfe86f03 Update Serf and memberlist (#4511)
This includes fixes that improve gossip scalability on very large (> 10k node) clusters.

The Serf changes:
 - take snapshot disk IO out of the critical path for handling messages hashicorp/serf#524
 - make snapshot compaction much less aggressive - the old fixed threshold caused snapshots to be constantly compacted (synchronously with request handling) on clusters larger than about 2000 nodes! hashicorp/serf#525

Memberlist changes:
 - prioritize handling alive messages over suspect/dead to improve stability, and handle queue in LIFO order to avoid acting on info that 's already stale in the queue by the time we handle it. hashicorp/memberlist#159
 - limit the number of concurrent pushPull requests being handled at once to 128. In one test scenario with 10s of thousands of servers we saw channel and lock blocking cause over 3000 pushPulls at once which ballooned the memory of the server because each push pull contained a de-serialised list of all known 10k+ nodes and their tags for a total of about 60 million objects and 7GB of memory stuck. While the rest of the fixes here should prevent the same root cause from blocking in the same way, this prevents any other bug or source of contention from allowing pushPull messages to stack up and eat resources. hashicorp/memberlist#158
2018-08-09 13:16:13 -04:00
Preetha Appan 98a04a0af9
Update serf to pick up clean leave fix 2018-05-04 15:51:55 -05:00
James Phillips 503e01774b
Updates Serf to pickup fix for spammy zero RTT log messages.
Fixes #3789.
2018-01-19 14:47:12 -08:00
James Phillips 3ac47e3b1c
Updates Serf to pull in new queue depth controls. 2017-12-06 17:06:08 -08:00
Preetha Appan ad8b9171d6 Update serf library to pick up coordinate persistence fix 2017-10-21 21:19:43 -05:00
Preetha Appan d206639f83 REbase master serf 2017-10-20 10:33:59 -05:00
Preetha Appan 09c51e3119 Vendor update serf to pick up fix for out of range ping periods in coordinate subsystem 2017-10-20 10:14:15 -05:00
Frank Schroeder 1530f12f56
serf: monkey patch https://github.com/hashicorp/serf/pull/486 2017-09-26 13:40:26 +02:00
Preetha Appan 040f8ae775 Update serf to pick up fixes for fsyncing snapshots and panic when coordinates are disabled 2017-08-17 16:35:06 -05:00
Frank Schroeder 4322b7217c serf: monkey patch data race in github.com/hashicorp/serf
https://github.com/hashicorp/serf/pull/476

This should be replaced when the patch is merged upstream
and the library is upgraded.
2017-07-07 09:22:34 +02:00
Preetha Appan bb0e0bdff9 Update serf to pull in disk space failure recovery changes 2017-07-06 08:58:42 -05:00
Kyle Havlovitz 5e45aec642 Add an option to disable keyring file (#3145)
Also disables keyring file in dev mode.
2017-06-15 15:24:04 -07:00
James Phillips 3cce06fd38
Pulls in Serf logger fix. 2017-05-25 22:02:09 -07:00
James Phillips 0a8a78833e
Updates Serf to pick up small fixes and coordinate NaN/Inf defenses. 2017-05-25 16:16:37 -07:00
James Phillips 8bcf1a74a9
Updates memberlist and Serf (and adds new dependencies).
This gets a number of improvements:

* Fixed a missing case where gossip would stop flowing to dead nodes for a short while.
* Uses the go-sockaddr library to look for private IP addresses, which prefers non-loopback
  private addresses over loopback ones when trying to automatically determine the advertise address.
* Properly seeds Go's random number generator using the seed library.
* Serf snapshots no longer have the executable bit set on thie file.
2017-02-08 13:56:07 -08:00
James Phillips 2df8b492c4
Updates Serf library to get relay fixes.
https://github.com/hashicorp/serf/pull/447
2017-02-06 08:57:36 -08:00
Kyle Havlovitz 21ce56e6f3
Update serf deps 2017-02-01 20:57:37 -05:00
James Phillips 954c32e6ee
Updates Serf to pick up intent queue fix.
This fixes #1062 by storing intents per-node instead of in a small, fixed-
size circular buffer.
2016-08-08 18:58:44 -07:00
James Phillips 7e75c894b0 Updates serf to get health score in stats. 2016-06-08 17:20:12 -07:00
James Phillips 6ee216eace Pulls in latest Serf to get flap metric. 2016-06-07 09:22:41 -07:00
Sean Chittenden 32c24b5447 Update Serf to include `serf.NumNodes()` 2016-03-23 22:10:50 -07:00
Sean Chittenden 333ff22e9a Manage dependencies via Godep
Embrace the future and use Go 1.6's vendor support via Godep.

Go 1.5 users should `export GO15VENDOREXPERIMENT=1`
2016-02-12 16:50:37 -08:00