indocker 0.6.1 → 0.6.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0eda49208a82e456326a838e76cab5152673a078e30668832c97c7c1b525a4fa
-  data.tar.gz: 5904dabfde8e6110821b104be6fd0809799a5deb3b35f991bed33627323bf1c9
+  metadata.gz: 10915e6da5c1e8d2899b510a223d8761a0542880776b61e8078d38d23e261b28
+  data.tar.gz: dd047c45c09dd0f26b95ae668f00266c2f45c46ff1c4aecff14ef0155d9e5a59
 SHA512:
-  metadata.gz: '020961f0cae0f634adf95f355d2e537bca061ec0380294f0a12ca75d0e72b54f19eb57d357dbe1f1dbef50cfd5d43896ed7f80107fe7ac822e6d3addd2645586'
-  data.tar.gz: f9ff2feb5c3288474635a3e7d31354c8065075068872865f51b6542e1c6933c0342e253260c58492cc7eb99e3ae09e1904692a9b1acd5a13751d467ca0edaf5d
+  metadata.gz: b879a49d9defa1cbe4dc56685e0467ff070c9d0310a6fd5531766c941e7b51028aa1ace5817dec1638dec944ccba8afbbceffa062095a658fdb248c615095253
+  data.tar.gz: 70814bb24a5a66da13c36a6d1350403686b6a5672f184aa691179cfb40850b74e66b059fc82f249fc052ebe942c2ed26326570ce041270d561f25ca7bb67021c

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    indocker (0.6.1)
+    indocker (0.6.2)
       net-ssh
 
 GEM

data/lib/indocker/launchers/configuration_deployer.rb

@@ -46,6 +46,9 @@ class Indocker::Launchers::ConfigurationDeployer
     deployer = Indocker::ContainerDeployer.new(configuration: configuration, logger: @logger)
 
     @global_logger.info("Establishing ssh sessions to all servers...")
+
+    warm_jump_hosts(deploy_servers + build_servers)
+
     build_server_pool.create_sessions!
 
     build_servers = configuration
@@ -103,6 +106,15 @@ class Indocker::Launchers::ConfigurationDeployer
 
   private
 
+  # Opens the shared connection to each jump host before anything runs in parallel, so the
+  # fan-out reuses it instead of racing to create one connection per operation.
+  def warm_jump_hosts(servers)
+    servers.map(&:jump_host).compact.uniq.each do |jump_host|
+      @logger.info("Establishing shared connection to jump host #{jump_host}")
+      Indocker::SshSession.warm_jump_host(jump_host, logger: @logger)
+    end
+  end
+
   def wait_remote_operations(remote_operations)
     remote_operations.each do |remote_operation|
       server = remote_operation.server

data/lib/indocker/rsync.rb

@@ -44,8 +44,13 @@ class Indocker::Rsync
       ]
 
       # Tunnel through the jump host the server is defined with, so that a server
-      # reachable only over its internal address syncs like any other one.
-      ssh_command << "-J #{session.jump_host}" if session.jump_host
+      # reachable only over its internal address syncs like any other one. ProxyCommand
+      # rather than -J: it is the same tunnel every other remote operation uses, including
+      # the shared connection that keeps a parallel sync from exhausting the jump host's
+      # MaxStartups.
+      if session.jump_host
+        ssh_command << %Q{-o ProxyCommand="#{Indocker::SshSession.jump_proxy_command(session.jump_host)}"}
+      end
 
       ssh_command = ssh_command.join(' ')
       command = "rsync --delete-after -a -e '#{ssh_command}' #{from} #{session.user}@#{session.host}:#{to}"

data/lib/indocker/ssh_session.rb

@@ -2,6 +2,7 @@ require_relative 'shell'
 
 class Indocker::SshSession
   LOCALHOST = 'localhost'.freeze
+  JUMP_CONTROL_PERSIST = '600'.freeze
 
   class ExecResult
     attr_reader :stdout_data, :stderr_data, :exit_code, :exit_signal
@@ -21,6 +22,53 @@ class Indocker::SshSession
 
   attr_reader :host, :user, :port, :logger, :jump_host
 
+  # Builds the tunnel to a jump host, shared by Net::SSH sessions and by rsync.
+  #
+  # Net::SSH::Proxy::Jump would build a bare `ssh -W`: a jump host that asks for a password
+  # hangs the deploy, and probing a server whose sshd is still starting prints
+  # "channel 0: open failed" from the ssh client on every retry.
+  #
+  # Multiplexing matters even more. A deploy syncs and deploys to every server in parallel,
+  # and each of those opens its own tunnel; sshd drops everything above MaxStartups (10 by
+  # default), which surfaces as "connection closed by remote host" on random servers. Sharing
+  # one connection to the jump host keeps the whole fan-out down to a single tunnel.
+  def self.jump_proxy_command(jump_host)
+    require 'digest'
+
+    host = jump_host
+    port = nil
+
+    if host =~ /\A(.+):(\d+)\z/
+      host = $1
+      port = $2
+    end
+
+    control_path = "/tmp/indocker-jump-#{Digest::MD5.hexdigest(jump_host)[0, 10]}"
+
+    command = [
+      "ssh -q",
+      "-o BatchMode=yes",
+      "-o ConnectTimeout=#{Indocker.ssh_connect_timeout}",
+      "-o ControlMaster=auto",
+      "-o ControlPath=#{control_path}",
+      "-o ControlPersist=#{JUMP_CONTROL_PERSIST}",
+    ]
+
+    command << "-p #{port}" if port
+    command << "-W %h:%p"
+    command << host
+
+    command.join(' ')
+  end
+
+  # Opens the shared connection to a jump host up front. Without it the first wave of
+  # parallel operations races to create the master connection and opens a burst of them.
+  def self.warm_jump_host(jump_host, logger:)
+    command = jump_proxy_command(jump_host).sub("-W %h:%p ", "")
+
+    Indocker::Shell.command("#{command} true", logger)
+  end
+
   # Opens a session to a server as it is defined in the configuration, including its
   # jump host, if any. Every remote operation goes through here, so a server reached
   # through a jump host is reached that way by binaries sync, container deploys and
@@ -56,7 +104,7 @@ class Indocker::SshSession
 
       if @jump_host
         require 'net/ssh/proxy/command'
-        options[:proxy] = Net::SSH::Proxy::Command.new(jump_proxy_command)
+        options[:proxy] = Net::SSH::Proxy::Command.new(self.class.jump_proxy_command(@jump_host))
       end
 
       @ssh = Net::SSH.start(@host, @user, options)
@@ -82,32 +130,6 @@ class Indocker::SshSession
   end
 
   private
-    # Net::SSH::Proxy::Jump builds this same `ssh -W` tunnel, but without BatchMode,
-    # connect timeout or -q: a jump host that asks for a password hangs the deploy, and
-    # every probe of a server whose sshd is still starting prints "channel 0: open failed"
-    # from the ssh client.
-    def jump_proxy_command
-      host = @jump_host
-      port = nil
-
-      if host =~ /\A(.+):(\d+)\z/
-        host = $1
-        port = $2
-      end
-
-      command = [
-        "ssh -q",
-        "-o BatchMode=yes",
-        "-o ConnectTimeout=#{Indocker.ssh_connect_timeout}",
-      ]
-
-      command << "-p #{port}" if port
-      command << "-W %h:%p"
-      command << host
-
-      command.join(' ')
-    end
-
     def exec_locally!(command)
       res = Indocker::Shell.command_with_result(command, @logger, skip_logging: false)
       ExecResult.new(res.stdout, '', res.exit_status, nil)

data/lib/indocker/version.rb

@@ -1,3 +1,3 @@
 module Indocker
-  VERSION = "0.6.1"
+  VERSION = "0.6.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: indocker
 version: !ruby/object:Gem::Version
-  version: 0.6.1
+  version: 0.6.2
 platform: ruby
 authors:
 - Ruslan Gatiyatov