Skip to content

Commit caf4ce4

Browse files
sbernauersbernauer
committed
feat: Support configuring JVM arguments
1 parent 25d9a9c commit caf4ce4

File tree

11 files changed

+318
-82
lines changed

11 files changed

+318
-82
lines changed

‎CHANGELOG.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ All notable changes to this project will be documented in this file.
99
- The lifetime of auto generated TLS certificates is now configurable with the role and roleGroup
1010
config property `requestedSecretLifetime`. This helps reducing frequent Pod restarts ([#722]).
1111
- Run a `containerdebug` process in the background of each Nifi container to collect debugging information ([#730]).
12+
- Support configuring JVM arguments ([#724]).
1213
- Aggregate emitted Kubernetes events on the CustomResources ([#742]).
1314

1415
### Fixed
@@ -21,6 +22,7 @@ All notable changes to this project will be documented in this file.
2122
[#717]: https://github.com/stackabletech/nifi-operator/pull/717
2223
[#718]: https://github.com/stackabletech/nifi-operator/pull/718
2324
[#722]: https://github.com/stackabletech/nifi-operator/pull/722
25+
[#724]: https://github.com/stackabletech/nifi-operator/pull/724
2426
[#730]: https://github.com/stackabletech/nifi-operator/pull/730
2527
[#742]: https://github.com/stackabletech/nifi-operator/pull/742
2628

‎Cargo.lock

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎deploy/helm/nifi-operator/crds/crds.yaml

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -655,6 +655,32 @@ spec:
655655
default: {}
656656
description: '`envOverrides` configure environment variables to be set in the Pods. It is a map from strings to strings - environment variables and the value to set. Read the [environment variable overrides documentation](https://docs.stackable.tech/home/nightly/concepts/overrides#env-overrides) for more information and consult the operator specific usage guide to find out about the product specific environment variables that are available.'
657657
type: object
658+
jvmArgumentOverrides:
659+
default:
660+
add: []
661+
remove: []
662+
removeRegex: []
663+
description: Allows overriding JVM arguments. Please read on the [JVM argument overrides documentation](https://docs.stackable.tech/home/nightly/concepts/overrides#jvm-argument-overrides) for details on the usage.
664+
properties:
665+
add:
666+
default: []
667+
description: JVM arguments to be added
668+
items:
669+
type: string
670+
type: array
671+
remove:
672+
default: []
673+
description: JVM arguments to be removed by exact match
674+
items:
675+
type: string
676+
type: array
677+
removeRegex:
678+
default: []
679+
description: JVM arguments matching any of this regexes will be removed
680+
items:
681+
type: string
682+
type: array
683+
type: object
658684
podOverrides:
659685
default: {}
660686
description: In the `podOverrides` property you can define a [PodTemplateSpec](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#podtemplatespec-v1-core) to override any property that can be set on a Kubernetes Pod. Read the [Pod overrides documentation](https://docs.stackable.tech/home/nightly/concepts/overrides#pod-overrides) for more information.
@@ -1116,6 +1142,32 @@ spec:
11161142
default: {}
11171143
description: '`envOverrides` configure environment variables to be set in the Pods. It is a map from strings to strings - environment variables and the value to set. Read the [environment variable overrides documentation](https://docs.stackable.tech/home/nightly/concepts/overrides#env-overrides) for more information and consult the operator specific usage guide to find out about the product specific environment variables that are available.'
11181144
type: object
1145+
jvmArgumentOverrides:
1146+
default:
1147+
add: []
1148+
remove: []
1149+
removeRegex: []
1150+
description: Allows overriding JVM arguments. Please read on the [JVM argument overrides documentation](https://docs.stackable.tech/home/nightly/concepts/overrides#jvm-argument-overrides) for details on the usage.
1151+
properties:
1152+
add:
1153+
default: []
1154+
description: JVM arguments to be added
1155+
items:
1156+
type: string
1157+
type: array
1158+
remove:
1159+
default: []
1160+
description: JVM arguments to be removed by exact match
1161+
items:
1162+
type: string
1163+
type: array
1164+
removeRegex:
1165+
default: []
1166+
description: JVM arguments matching any of this regexes will be removed
1167+
items:
1168+
type: string
1169+
type: array
1170+
type: object
11191171
podOverrides:
11201172
default: {}
11211173
description: In the `podOverrides` property you can define a [PodTemplateSpec](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#podtemplatespec-v1-core) to override any property that can be set on a Kubernetes Pod. Read the [Pod overrides documentation](https://docs.stackable.tech/home/nightly/concepts/overrides#pod-overrides) for more information.

‎docs/modules/nifi/pages/usage_guide/index.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,4 +48,4 @@ spec:
4848
<3> xref:usage_guide/extra-volumes.adoc[Extra volumes] with files that can be referenced in custom workflows.
4949
<4> xref:usage_guide/resource-configuration.adoc[CPU and memory configuration] can be set per role group.
5050

51-
Not shown are the common settings for xref:usage_guide/operations/cluster-operations.adoc[starting and stopping the cluster] and xref:usage_guide/operations/pod-placement.adoc[distributing Pods]. Additionally, you can set any NiFi setting using xref:usage_guide/configuration-environment-overrides.adoc[overrides]. You can also configure xref:usage_guide/log-aggregation.adoc[log aggregation].
51+
Not shown are the common settings for xref:usage_guide/operations/cluster-operations.adoc[starting and stopping the cluster] and xref:usage_guide/operations/pod-placement.adoc[distributing Pods]. Additionally, you can set any NiFi setting using xref:usage_guide/overrides.adoc[overrides]. You can also configure xref:usage_guide/log-aggregation.adoc[log aggregation].

‎docs/modules/nifi/pages/usage_guide/configuration-environment-overrides.adoc renamed to ‎docs/modules/nifi/pages/usage_guide/overrides.adoc

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,3 +114,8 @@ spec:
114114
value: "value1"
115115
effect: "NoSchedule"
116116
----
117+
118+
== JVM argument overrides
119+
120+
Stackable operators automatically determine the set of needed JVM arguments, such as memory settings or trust- and keystores.
121+
Using JVM argument overrides you can configure the JVM arguments xref:concepts:overrides.adoc#jvm-argument-overrides[according to the concepts page].

‎docs/modules/nifi/partials/nav.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
** xref:nifi:usage_guide/log-aggregation.adoc[]
1313
** xref:nifi:usage_guide/monitoring.adoc[]
1414
** xref:nifi:usage_guide/updating.adoc[]
15-
** xref:nifi:usage_guide/configuration-environment-overrides.adoc[]
15+
** xref:nifi:usage_guide/overrides.adoc[]
1616
** xref:nifi:usage_guide/writing-to-iceberg-tables.adoc[]
1717
** xref:nifi:usage_guide/operations/index.adoc[]
1818
*** xref:nifi:usage_guide/operations/cluster-operations.adoc[]

‎rust/crd/src/lib.rs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ use stackable_operator::{
3030
memory::{BinaryMultiple, MemoryQuantity},
3131
product_config_utils::{self, Configuration},
3232
product_logging::{self, spec::Logging},
33-
role_utils::{GenericRoleConfig, Role, RoleGroupRef},
33+
role_utils::{GenericRoleConfig, JavaCommonConfig, Role, RoleGroupRef},
3434
schemars::{self, JsonSchema},
3535
status::condition::{ClusterCondition, HasStatusCondition},
3636
time::Duration,
@@ -107,7 +107,7 @@ pub struct NifiSpec {
107107

108108
// no doc - docs in Role struct.
109109
#[serde(default, skip_serializing_if = "Option::is_none")]
110-
pub nodes: Option<Role<NifiConfigFragment>>,
110+
pub nodes: Option<Role<NifiConfigFragment, GenericRoleConfig, JavaCommonConfig>>,
111111

112112
// no doc - docs in ProductImage struct.
113113
pub image: ProductImage,

‎rust/operator-binary/Cargo.toml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ url.workspace = true
3232

3333
[dev-dependencies]
3434
rstest.workspace = true
35+
serde_yaml.workspace = true
3536

3637
[build-dependencies]
3738
built.workspace = true

‎rust/operator-binary/src/config/jvm.rs

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
use snafu::{OptionExt, ResultExt, Snafu};
2+
use stackable_nifi_crd::{NifiConfig, NifiConfigFragment};
3+
use stackable_operator::{
4+
memory::{BinaryMultiple, MemoryQuantity},
5+
role_utils::{self, GenericRoleConfig, JavaCommonConfig, JvmArgumentOverrides, Role},
6+
};
7+
8+
use super::{JVM_SECURITY_PROPERTIES_FILE, NIFI_CONFIG_DIRECTORY};
9+
10+
// Part of memory resources allocated for Java heap
11+
const JAVA_HEAP_FACTOR: f32 = 0.8;
12+
13+
#[derive(Snafu, Debug)]
14+
pub enum Error {
15+
#[snafu(display("invalid memory resource configuration - missing default or value in crd?"))]
16+
MissingMemoryResourceConfig,
17+
18+
#[snafu(display("invalid memory config"))]
19+
InvalidMemoryConfig {
20+
source: stackable_operator::memory::Error,
21+
},
22+
23+
#[snafu(display("failed to merge jvm argument overrides"))]
24+
MergeJvmArgumentOverrides { source: role_utils::Error },
25+
}
26+
27+
/// Create the NiFi bootstrap.conf
28+
pub fn build_merged_jvm_config(
29+
merged_config: &NifiConfig,
30+
role: &Role<NifiConfigFragment, GenericRoleConfig, JavaCommonConfig>,
31+
role_group: &str,
32+
) -> Result<JvmArgumentOverrides, Error> {
33+
let heap_size = MemoryQuantity::try_from(
34+
merged_config
35+
.resources
36+
.memory
37+
.limit
38+
.as_ref()
39+
.context(MissingMemoryResourceConfigSnafu)?,
40+
)
41+
.context(InvalidMemoryConfigSnafu)?
42+
.scale_to(BinaryMultiple::Mebi)
43+
* JAVA_HEAP_FACTOR;
44+
let java_heap = heap_size
45+
.format_for_java()
46+
.context(InvalidMemoryConfigSnafu)?;
47+
48+
let jvm_args = vec![
49+
// Heap settings
50+
format!("-Xmx{java_heap}"),
51+
format!("-Xms{java_heap}"),
52+
// The G1GC is known to cause some problems in Java 8 and earlier, but the issues were addressed in Java 9. If using Java 8 or earlier,
53+
// it is recommended that G1GC not be used, especially in conjunction with the Write Ahead Provenance Repository. However, if using a newer
54+
// version of Java, it can result in better performance without significant \"stop-the-world\" delays.
55+
"-XX:+UseG1GC".to_owned(),
56+
// Set headless mode by default
57+
"-Djava.awt.headless=true".to_owned(),
58+
// Disable JSR 199 so that we can use JSP's without running a JDK
59+
"-Dorg.apache.jasper.compiler.disablejsr199=true".to_owned(),
60+
// Note(sbernauer): This has been here since ages, leaving it here for compatibility reasons.
61+
// That being said: IPV6 rocks :rocket:!
62+
"-Djava.net.preferIPv4Stack=true".to_owned(),
63+
// allowRestrictedHeaders is required for Cluster/Node communications to work properly
64+
"-Dsun.net.http.allowRestrictedHeaders=true".to_owned(),
65+
"-Djava.protocol.handler.pkgs=sun.net.www.protocol".to_owned(),
66+
// Sets the provider of SecureRandom to /dev/urandom to prevent blocking on VMs
67+
"-Djava.security.egd=file:/dev/urandom".to_owned(),
68+
// Requires JAAS to use only the provided JAAS configuration to authenticate a Subject, without using any "fallback" methods (such as prompting for username/password)
69+
// Please see https://docs.oracle.com/javase/8/docs/technotes/guides/security/jgss/single-signon.html, section "EXCEPTIONS TO THE MODEL"
70+
"-Djavax.security.auth.useSubjectCredsOnly=true".to_owned(),
71+
// Zookeeper 3.5 now includes an Admin Server that starts on port 8080, since NiFi is already using that port disable by default.
72+
// Please see https://zookeeper.apache.org/doc/current/zookeeperAdmin.html#sc_adminserver_config for configuration options.
73+
"-Dzookeeper.admin.enableServer=false".to_owned(),
74+
// JVM security properties include especially TTL values for the positive and negative DNS caches.
75+
format!(
76+
"-Djava.security.properties={NIFI_CONFIG_DIRECTORY}/{JVM_SECURITY_PROPERTIES_FILE}"
77+
),
78+
];
79+
80+
let operator_generated = JvmArgumentOverrides::new_with_only_additions(jvm_args);
81+
role.get_merged_jvm_argument_overrides(role_group, &operator_generated)
82+
.context(MergeJvmArgumentOverridesSnafu)
83+
}

0 commit comments

Comments
 (0)