|
| 1 | +use snafu::{OptionExt, ResultExt, Snafu}; |
| 2 | +use stackable_nifi_crd::{NifiConfig, NifiConfigFragment}; |
| 3 | +use stackable_operator::{ |
| 4 | + memory::{BinaryMultiple, MemoryQuantity}, |
| 5 | + role_utils::{self, GenericRoleConfig, JavaCommonConfig, JvmArgumentOverrides, Role}, |
| 6 | +}; |
| 7 | + |
| 8 | +use super::{JVM_SECURITY_PROPERTIES_FILE, NIFI_CONFIG_DIRECTORY}; |
| 9 | + |
| 10 | +// Part of memory resources allocated for Java heap |
| 11 | +const JAVA_HEAP_FACTOR: f32 = 0.8; |
| 12 | + |
| 13 | +#[derive(Snafu, Debug)] |
| 14 | +pub enum Error { |
| 15 | + #[snafu(display("invalid memory resource configuration - missing default or value in crd?"))] |
| 16 | + MissingMemoryResourceConfig, |
| 17 | + |
| 18 | + #[snafu(display("invalid memory config"))] |
| 19 | + InvalidMemoryConfig { |
| 20 | + source: stackable_operator::memory::Error, |
| 21 | + }, |
| 22 | + |
| 23 | + #[snafu(display("failed to merge jvm argument overrides"))] |
| 24 | + MergeJvmArgumentOverrides { source: role_utils::Error }, |
| 25 | +} |
| 26 | + |
| 27 | +/// Create the NiFi bootstrap.conf |
| 28 | +pub fn build_merged_jvm_config( |
| 29 | + merged_config: &NifiConfig, |
| 30 | + role: &Role<NifiConfigFragment, GenericRoleConfig, JavaCommonConfig>, |
| 31 | + role_group: &str, |
| 32 | +) -> Result<JvmArgumentOverrides, Error> { |
| 33 | + let heap_size = MemoryQuantity::try_from( |
| 34 | + merged_config |
| 35 | + .resources |
| 36 | + .memory |
| 37 | + .limit |
| 38 | + .as_ref() |
| 39 | + .context(MissingMemoryResourceConfigSnafu)?, |
| 40 | + ) |
| 41 | + .context(InvalidMemoryConfigSnafu)? |
| 42 | + .scale_to(BinaryMultiple::Mebi) |
| 43 | + * JAVA_HEAP_FACTOR; |
| 44 | + let java_heap = heap_size |
| 45 | + .format_for_java() |
| 46 | + .context(InvalidMemoryConfigSnafu)?; |
| 47 | + |
| 48 | + let jvm_args = vec![ |
| 49 | + // Heap settings |
| 50 | + format!("-Xmx{java_heap}"), |
| 51 | + format!("-Xms{java_heap}"), |
| 52 | + // The G1GC is known to cause some problems in Java 8 and earlier, but the issues were addressed in Java 9. If using Java 8 or earlier, |
| 53 | + // it is recommended that G1GC not be used, especially in conjunction with the Write Ahead Provenance Repository. However, if using a newer |
| 54 | + // version of Java, it can result in better performance without significant \"stop-the-world\" delays. |
| 55 | + "-XX:+UseG1GC".to_owned(), |
| 56 | + // Set headless mode by default |
| 57 | + "-Djava.awt.headless=true".to_owned(), |
| 58 | + // Disable JSR 199 so that we can use JSP's without running a JDK |
| 59 | + "-Dorg.apache.jasper.compiler.disablejsr199=true".to_owned(), |
| 60 | + // Note(sbernauer): This has been here since ages, leaving it here for compatibility reasons. |
| 61 | + // That being said: IPV6 rocks :rocket:! |
| 62 | + "-Djava.net.preferIPv4Stack=true".to_owned(), |
| 63 | + // allowRestrictedHeaders is required for Cluster/Node communications to work properly |
| 64 | + "-Dsun.net.http.allowRestrictedHeaders=true".to_owned(), |
| 65 | + "-Djava.protocol.handler.pkgs=sun.net.www.protocol".to_owned(), |
| 66 | + // Sets the provider of SecureRandom to /dev/urandom to prevent blocking on VMs |
| 67 | + "-Djava.security.egd=file:/dev/urandom".to_owned(), |
| 68 | + // Requires JAAS to use only the provided JAAS configuration to authenticate a Subject, without using any "fallback" methods (such as prompting for username/password) |
| 69 | + // Please see https://docs.oracle.com/javase/8/docs/technotes/guides/security/jgss/single-signon.html, section "EXCEPTIONS TO THE MODEL" |
| 70 | + "-Djavax.security.auth.useSubjectCredsOnly=true".to_owned(), |
| 71 | + // Zookeeper 3.5 now includes an Admin Server that starts on port 8080, since NiFi is already using that port disable by default. |
| 72 | + // Please see https://zookeeper.apache.org/doc/current/zookeeperAdmin.html#sc_adminserver_config for configuration options. |
| 73 | + "-Dzookeeper.admin.enableServer=false".to_owned(), |
| 74 | + // JVM security properties include especially TTL values for the positive and negative DNS caches. |
| 75 | + format!( |
| 76 | + "-Djava.security.properties={NIFI_CONFIG_DIRECTORY}/{JVM_SECURITY_PROPERTIES_FILE}" |
| 77 | + ), |
| 78 | + ]; |
| 79 | + |
| 80 | + let operator_generated = JvmArgumentOverrides::new_with_only_additions(jvm_args); |
| 81 | + role.get_merged_jvm_argument_overrides(role_group, &operator_generated) |
| 82 | + .context(MergeJvmArgumentOverridesSnafu) |
| 83 | +} |
0 commit comments