From 97fe2bfdf0c6383282d34920700b6ab9b2c21869 Mon Sep 17 00:00:00 2001 From: Thomas Stokes Date: Tue, 19 Mar 2024 19:48:22 +0100 Subject: [PATCH 1/5] Improve sync-repo security --- .../repo/usr/local/bin/sync-repo-and-execute-cmd.sh | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/configuration/environments_scripts/repo/usr/local/bin/sync-repo-and-execute-cmd.sh b/configuration/environments_scripts/repo/usr/local/bin/sync-repo-and-execute-cmd.sh index 34468f2fba4..ba09a4f63d2 100755 --- a/configuration/environments_scripts/repo/usr/local/bin/sync-repo-and-execute-cmd.sh +++ b/configuration/environments_scripts/repo/usr/local/bin/sync-repo-and-execute-cmd.sh @@ -17,7 +17,11 @@ GIT_PATH=$1 COMMAND_ON_COMPLETION=$2 GIT_BRANCH=$3 cd ${GIT_PATH} -git checkout ${GIT_BRANCH} >/dev/null +git checkout ${GIT_BRANCH} >/dev/null 2>&1 +if [[ "$?" -ne 0 ]]; then + echo "Error encountered: issue checking out branch" + exit 1 +fi # Rev-parse gets the commit hash of given reference. CURRENT_HEAD=$(git rev-parse HEAD) GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=no" git fetch From 5a0f5781a34df5599ebbb9586ffaee80443cd913 Mon Sep 17 00:00:00 2001 From: Thomas Stokes Date: Tue, 19 Mar 2024 21:00:00 +0100 Subject: [PATCH 2/5] Utilise tags for register-deregister-from-nlb script, instead of target group name. --- .../usr/local/bin/register-deregister-from-nlb-target-group.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/configuration/environments_scripts/reverse_proxy/files/usr/local/bin/register-deregister-from-nlb-target-group.sh b/configuration/environments_scripts/reverse_proxy/files/usr/local/bin/register-deregister-from-nlb-target-group.sh index ebabac1bf77..10af3444d70 100755 --- a/configuration/environments_scripts/reverse_proxy/files/usr/local/bin/register-deregister-from-nlb-target-group.sh +++ b/configuration/environments_scripts/reverse_proxy/files/usr/local/bin/register-deregister-from-nlb-target-group.sh @@ -10,7 +10,8 @@ if [[ -z "$selfIp" || -z "$availabilityZone" ]]; then availabilityZone=$(cat /var/cache/availability-zone) fi nlbName="HTTP-to-sapsailing-dot-com" -targetGroupArn=$(aws elbv2 describe-target-groups --name "${nlbName}" | jq -r ".TargetGroups[].TargetGroupArn") +# First we describe the target groups which are served by a load balancer, which has an ARN containing the substring "loadbalancer/net". Then, we get the tags of these target groups and iterate over the tag descriptions (a list of resourceArns paired with tags), selecting those resources which have a key "allReverseProxies". Finally we extract the resource ARN. Note: .[] means to iterate over an array. +targetGroupArn=$(aws elbv2 describe-tags --resource-arns $(aws elbv2 describe-target-groups | jq -r '.TargetGroups | .[] | select(.LoadBalancerArns | .[] | contains("loadbalancer/net") ) | .TargetGroupArn') | jq -r '.TagDescriptions | .[] | select(.Tags | any(.Key=="allReverseProxies") ) | .ResourceArn') if [[ "$#" -eq 0 ]];then echo "Use add-to-nlb OR remove-from-nlb as the first and only argument." exit 2 From 8a2d8a8d8a90309c47a605bdcad1975d9c372350 Mon Sep 17 00:00:00 2001 From: Axel Uhl Date: Wed, 20 Mar 2024 09:56:43 +0100 Subject: [PATCH 3/5] reverted jdk.net extra package specification; it's now optional in redisson-3.27.2 --- java/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/java/pom.xml b/java/pom.xml index 43cbfd51aed..a56bcbec43f 100755 --- a/java/pom.xml +++ b/java/pom.xml @@ -47,7 +47,7 @@ Can we move the system property -Dmongo.dbName to "parameters.mongodb"? If so the IP of the host would be the same for all profiles. --> - -Dfile.encoding=cp1252 -Dmongo.dbName=winddbTest -DspatialWind=true -Xss100m -Dgwt.rpc.version=9 -Dgoogle.maps.authenticationparams=key=AIzaSyD1Se4tIkt-wglccbco3S7twaHiG20hR9E -Dosgi.framework.system.packages.extra=jdk.net + -Dfile.encoding=cp1252 -Dmongo.dbName=winddbTest -DspatialWind=true -Xss100m -Dgwt.rpc.version=9 -Dgoogle.maps.authenticationparams=key=AIzaSyD1Se4tIkt-wglccbco3S7twaHiG20hR9E -ea -Xmx8192m -XX:+UseG1GC From 7d45f37931e9ed17447eb5f9a5c21df195271e97 Mon Sep 17 00:00:00 2001 From: Axel Uhl Date: Wed, 20 Mar 2024 13:51:44 +0100 Subject: [PATCH 4/5] use sailing.omegatiming.com as base URL for Paris/Marseille and leading-up events --- .../compare-secondary-to-primary-master | 4 +- ...onitor-paris2024-reachability-from-regions | 6 +- .../paris2024/notify-operators | 2 +- .../paris2024/upgrade-landscape.sh | 8 +- .../SailingServer (No Proxy).launch | 572 +++++++++--------- .../info/landscape/paris2024/olympic-setup.md | 18 + 6 files changed, 312 insertions(+), 298 deletions(-) diff --git a/configuration/on-site-scripts/paris2024/compare-secondary-to-primary-master b/configuration/on-site-scripts/paris2024/compare-secondary-to-primary-master index 1b68603a143..a50632a7a84 100755 --- a/configuration/on-site-scripts/paris2024/compare-secondary-to-primary-master +++ b/configuration/on-site-scripts/paris2024/compare-secondary-to-primary-master @@ -1,6 +1,6 @@ #!/bin/bash -PRIMARY_MASTER=https://paris2024-master.sapsailing.com:9443 -SECONDARY_MASTER=https://paris2024-secondary-master.sapsailing.com:9443 +PRIMARY_MASTER=https://palma2024-master.sailing.omegatiming.com:9443 +SECONDARY_MASTER=https://palma2024-secondary-master.sailing.omegatiming.com:9443 COMPARE_OUTPUT=$( /home/sailing/code/java/target/compareServers -ael ${SECONDARY_MASTER} ${PRIMARY_MASTER} ) if [ "$?" != "0" ]; then echo "Comparing ${SECONDARY_MASTER} with ${PRIMARY_MASTER} showed differences: diff --git a/configuration/on-site-scripts/paris2024/monitor-paris2024-reachability-from-regions b/configuration/on-site-scripts/paris2024/monitor-paris2024-reachability-from-regions index e2e97101aa1..419c7a684bd 100755 --- a/configuration/on-site-scripts/paris2024/monitor-paris2024-reachability-from-regions +++ b/configuration/on-site-scripts/paris2024/monitor-paris2024-reachability-from-regions @@ -22,9 +22,9 @@ else echo "${message}" | notify-operators "${message}" else read first others <<<"${IPs}" - if ! ssh -o StrictHostKeyChecking=no root@${first} "curl https://paris2024.sapsailing.com/gwt/status 2>/dev/null >/dev/null"; then - echo "Problem reaching paris2024.sapsailing.com from instance ${first} in region ${i}" >&2 - message="Problem reaching paris2024.sapsailing.com from instance ${first} in region ${i}" + if ! ssh -o StrictHostKeyChecking=no root@${first} "curl https://palma2024.sailing.omegatiming.com/gwt/status 2>/dev/null >/dev/null"; then + echo "Problem reaching palma2024.sailing.omegatiming.com from instance ${first} in region ${i}" >&2 + message="Problem reaching palma2024.sailing.omegatiming.com from instance ${first} in region ${i}" echo "${message}" | notify-operators "${message}" else echo "Access from region ${i}, IP ${first} OK." >&2 diff --git a/configuration/on-site-scripts/paris2024/notify-operators b/configuration/on-site-scripts/paris2024/notify-operators index 37a0e26dea6..3d4cd41865d 100755 --- a/configuration/on-site-scripts/paris2024/notify-operators +++ b/configuration/on-site-scripts/paris2024/notify-operators @@ -1,5 +1,5 @@ #!/bin/bash #OPERATORS="axel.uhl@sap.com jan.hamann@sapsailing.com alessandro.stoltenberg@sap.com alstolten@gmail.com" -OPERATORS="axel.uhl@sap.com jan.hamann@sapsailing.com heather.allard@sap.com finn.huelsbusch@sap.com fabian.kallenbach@sap.com" +OPERATORS="axel.uhl@sap.com" logger -t sailing "Sending notification e-mail with subject $1 to ${OPERATORS}" mail -s "$1" ${OPERATORS} diff --git a/configuration/on-site-scripts/paris2024/upgrade-landscape.sh b/configuration/on-site-scripts/paris2024/upgrade-landscape.sh index 8b375cda21a..4992fbf0eb5 100755 --- a/configuration/on-site-scripts/paris2024/upgrade-landscape.sh +++ b/configuration/on-site-scripts/paris2024/upgrade-landscape.sh @@ -1,9 +1,9 @@ #!/bin/bash # Upgrades the entire landscape of servers to a new release ${RELEASE} # The procedure works in the following steps: -# - patch *.conf files in sap-p1-1:servers/[master|security_service] and sap-p1-2:servers/[secondary_master|replica|master|security_service] so +# - patch *.conf files in sap-p1-1:servers/[master|security_service] and sap-p1-2:servers/[secondary_master|master|security_service] so # their INSTALL_FROM_RELEASE points to the new ${RELEASE} -# - Install new releases to sap-p1-1:servers/[master|security_service] and sap-p1-2:servers/[secondary_master|replica|master|security_service] +# - Install new releases to sap-p1-1:servers/[master|security_service] and sap-p1-2:servers/[secondary_master|master|security_service] # - Update all launch configurations and auto-scaling groups in the cloud (update-launch-configuration.sh) # - Tell all replicas in the cloud to stop replicating (stop-all-cloud-replicas.sh) # - Tell sap-p1-2 secondary_master to restart (./stop; ./start) @@ -29,9 +29,9 @@ if [ $# -eq 0 ]; then echo "Example: $0 -R build-202106041327 -k Jan" echo "The procedure works in the following steps:" - echo " - patch *.conf files in sap-p1-1:servers/[master|security_service] and sap-p1-2:servers/[secondary_master|replica|master|security_service] so" + echo " - patch *.conf files in sap-p1-1:servers/[master|security_service] and sap-p1-2:servers/[secondary_master|master|security_service] so" echo " their INSTALL_FROM_RELEASE points to the new ${RELEASE}" - echo " - Install new releases to sap-p1-1:servers/[master|security_service] and sap-p1-2:servers/[secondary_master|replica|master|security_service]" + echo " - Install new releases to sap-p1-1:servers/[master|security_service] and sap-p1-2:servers/[secondary_master|master|security_service]" echo " - Update all launch configurations and auto-scaling groups in the cloud (update-launch-configuration.sh)" echo " - Tell all replicas in the cloud to stop replicating (stop-all-cloud-replicas.sh)" echo " - Tell sap-p1-2 secondary_master to restart (./stop; ./start)" diff --git a/java/com.sap.sailing.server/SailingServer (No Proxy).launch b/java/com.sap.sailing.server/SailingServer (No Proxy).launch index ef3783d42b9..e0419f41108 100755 --- a/java/com.sap.sailing.server/SailingServer (No Proxy).launch +++ b/java/com.sap.sailing.server/SailingServer (No Proxy).launch @@ -34,295 +34,291 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/wiki/info/landscape/paris2024/olympic-setup.md b/wiki/info/landscape/paris2024/olympic-setup.md index a6b2423041e..f48aa3d3697 100644 --- a/wiki/info/landscape/paris2024/olympic-setup.md +++ b/wiki/info/landscape/paris2024/olympic-setup.md @@ -563,6 +563,12 @@ REPLICATION_HOST=localhost REPLICATION_PORT=5673 USE_ENVIRONMENT=live-master-server ADDITIONAL_JAVA_ARGS="${ADDITIONAL_JAVA_ARGS} -Dcom.sap.sse.debranding=true -Dpolardata.source.url=https://www.sapsailing.com:22443 -Dwindestimation.source.url=https://www.sapsailing.com:22443" +ADDITIONAL_JAVA_ARGS="$ADDITIONAL_JAVA_ARGS -Dsecurity.sharedAcrossSubdomainsOf=sailing.omegatiming.com -Dsecurity.baseUrlForCrossDomainStorage=https://security-service.sapsailing.com -Dgwt.acceptableCrossDomainStorageRequestOriginRegexp=https?://(.*\.)?sailing\.omegatiming\.com(:[0-9]*)?$" +# Place additional secrets here, e.g., from root@sapsailing.com:secrets +MANAGE2SAIL_ACCESS_TOKEN=... +IGTIMI_CLIENT_ID=... +IGTIMI_CLIENT_SECRET=... +GOOGLE_MAPS_AUTHENTICATION_PARAMS="..." ``` ### Secondary Master @@ -591,6 +597,12 @@ REPLICATION_HOST=localhost REPLICATION_PORT=5673 USE_ENVIRONMENT=live-master-server ADDITIONAL_JAVA_ARGS="${ADDITIONAL_JAVA_ARGS} -Dcom.sap.sse.debranding=true -Dpolardata.source.url=https://www.sapsailing.com:22443 -Dwindestimation.source.url=https://www.sapsailing.com:22443" +ADDITIONAL_JAVA_ARGS="$ADDITIONAL_JAVA_ARGS -Dsecurity.sharedAcrossSubdomainsOf=sailing.omegatiming.com -Dsecurity.baseUrlForCrossDomainStorage=https://security-service.sapsailing.com -Dgwt.acceptableCrossDomainStorageRequestOriginRegexp=https?://(.*\.)?sailing\.omegatiming\.com(:[0-9]*)?$" +# Place additional secrets here, e.g., from root@sapsailing.com:secrets +MANAGE2SAIL_ACCESS_TOKEN=... +IGTIMI_CLIENT_ID=... +IGTIMI_CLIENT_SECRET=... +GOOGLE_MAPS_AUTHENTICATION_PARAMS="..." ``` @@ -622,6 +634,9 @@ REPLICATION_PORT=5672 REPLICATION_CHANNEL=${SERVER_NAME}-replica USE_ENVIRONMENT=live-replica-server ADDITIONAL_JAVA_ARGS="${ADDITIONAL_JAVA_ARGS} -Dcom.sap.sse.debranding=true" +ADDITIONAL_JAVA_ARGS="$ADDITIONAL_JAVA_ARGS -Dsecurity.sharedAcrossSubdomainsOf=sailing.omegatiming.com -Dsecurity.baseUrlForCrossDomainStorage=https://security-service.sapsailing.com -Dgwt.acceptableCrossDomainStorageRequestOriginRegexp=https?://(.*\.)?sailing\.omegatiming\.com(:[0-9]*)?$" +# Place additional secrets here, e.g., from root@sapsailing.com:secrets +GOOGLE_MAPS_AUTHENTICATION_PARAMS="..." ``` (Adjust the release accordingly, of course). (NOTE: During the first production days of the event we noticed that it was really a BAD IDEA to have all replicas use the same DB set-up, all writing to the MongoDB PRIMARY of the "live" replica set in eu-west-1. With tens of replicas running concurrently, this led to a massive block-up based on MongoDB not writing fast enough. This gave rise to a new application server AMI which now has a MongoDB set-up included, using "replica" as the MongoDB replica set name. Now, each replica hence can write into its own MongoDB instance, isolated from all others and scaling linearly.) @@ -641,6 +656,9 @@ REPLICATE_MASTER_EXCHANGE_NAME=paris2024 REPLICATE_MASTER_QUEUE_HOST=rabbit-eu-west-3.sapsailing.com REPLICATE_MASTER_BEARER_TOKEN="***" ADDITIONAL_JAVA_ARGS="${ADDITIONAL_JAVA_ARGS} -Dcom.sap.sse.debranding=true" +ADDITIONAL_JAVA_ARGS="$ADDITIONAL_JAVA_ARGS -Dsecurity.sharedAcrossSubdomainsOf=sailing.omegatiming.com -Dsecurity.baseUrlForCrossDomainStorage=https://security-service.sapsailing.com -Dgwt.acceptableCrossDomainStorageRequestOriginRegexp=https?://(.*\.)?sailing\.omegatiming\.com(:[0-9]*)?$" +# Place additional secrets here, e.g., from root@sapsailing.com:secrets +GOOGLE_MAPS_AUTHENTICATION_PARAMS="..." ``` ### Application Servers From 7bc59663a7cab38ca3f6dd17ae4f39faa4303517 Mon Sep 17 00:00:00 2001 From: Axel Uhl Date: Wed, 20 Mar 2024 14:08:15 +0100 Subject: [PATCH 5/5] paris2024: don't maintain a "replica" server config on sap-p1-2 anymore --- configuration/on-site-scripts/paris2024/upgrade-landscape.sh | 1 - 1 file changed, 1 deletion(-) diff --git a/configuration/on-site-scripts/paris2024/upgrade-landscape.sh b/configuration/on-site-scripts/paris2024/upgrade-landscape.sh index 4992fbf0eb5..3f937e3ac78 100755 --- a/configuration/on-site-scripts/paris2024/upgrade-landscape.sh +++ b/configuration/on-site-scripts/paris2024/upgrade-landscape.sh @@ -76,7 +76,6 @@ echo " * Patching configurations on sap-p1-1 and sap-p1-2 to new release ${RELEA patch_conf_and_install sap-p1-1 master patch_conf_and_install sap-p1-1 security_service patch_conf_and_install sap-p1-2 secondary_master -patch_conf_and_install sap-p1-2 replica patch_conf_and_install sap-p1-2 master patch_conf_and_install sap-p1-2 security_service echo " * Updating launch configurations and auto-scaling groups"