Hi! So, I am in the process of enabling SSL on our instance of Zuul and a little surprised to see that no version of Zookeeper in debubuntu repos actually support SSL. The installation docs for Zuul, don't seem to reference how to install zookeeper, expect installing the version that doesn't support SSL. How are others doing this? Does anyone know of an existing PPA to pull zookeeper from? Paul
On Thu, Jun 10, 2021 at 23:55 Paul Belanger wrote:
We are packaging the upstream binary release with this RPM spec file: https://softwarefactory-project.io/cgit/rpms/zookeeper/tree/zookeeper.spec And there is also a zuul-jobs role to install the service: https://zuul-ci.org/docs/zuul-jobs/system-roles.html#role-ensure-zookeeper Regards, -Tristan
Hi Paul, Sorry that it took some time. Your question caught me in understanding that we never finished proper automation of that part (quite some manual messing was always required). Base __was__ https://github.com/opentelekomcloud-infra/ansible-role-zookeeper <https://github.com/opentelekomcloud-infra/ansible-role-zookeeper> which is having nothing to do with SSL, but already deployed cluster as podman/systemd - https://github.com/opentelekomcloud-infra/system-config/pull/186 <https://github.com/opentelekomcloud-infra/system-config/pull/186> - A PR into our system-config repo with the setup. There are still some activities to at least create any reasonable tests for that. (SSL certs are generated by x509 role with custom CA) A bit of challenge is that if your SSL certs are not using IP addresses (at least as alt_name) you are forced to have DNS (forward and reverse) functioning properly, otherwise cluster doesn’t really build up. Additional stuff is that cli works only as “zkCli.sh -server MY_IP:2281”. For not yet identified reasons it simply doesn’t want to work with localhost. The same problem is for “zkServer.sh”, except that we have not found a way to make it working at all. There is somewhere likely a small bug, but after 1 day of fighting with it I simply do not see it. Hope this helps. Regards, Artem
On 2021-06-10 23:55:34 -0400 (-0400), Paul Belanger wrote:
I agree, it looks like they're just pulling whatever Debian has, which at present is 3.4[*] (minimum versions for SSL seem to be 3.5.1/3.6.0[**]).
Unfortunately the guides I'm turning up for installing newer ZK all seem to recommend deploying from the upstream release tarball (after prerequisites from relevant distro packages). [*] https://packages.debian.org/zookeeper [**] https://issues.apache.org/jira/browse/ZOOKEEPER-2125 -- Jeremy Stanley
On Fri, Jun 11, 2021, at 7:24 AM, Jeremy Stanley wrote:
Before switching to the docker containers I did this for a long time as part of my zuul unittesting setup. It works well; it even includes init scripts you can use. The biggest downside is you are on the hook for figuring out updates manually.
participants (5)
-
Artem Goncharov
-
Clark Boylan
-
Jeremy Stanley
-
Paul Belanger
-
Tristan Cacqueray