Hello Everybody,
I've been working on a design for synchronizing JVM heap arguments between RHQ and
managed JBoss AS7 standalone.conf. On the surface this is looks like a simple task but it
is far more complicated because of stability and security implications. I got a few ideas
on how to accomplish this and then had a design session with Thomas. We narrowed it down
to two options (see below) but in the end I think only one is really possible to
implement.
BZ -
https://bugzilla.redhat.com/show_bug.cgi?id=1069648
The issue:
1) The BZ is applicable only to standalone servers. Domain mode has a very nice built-in
mechanism to update JVM settings (already implemented in RHQ).
2) The official way to update JVM settings in standalone is via configuration files:
https://docs.jboss.org/author/display/AS7/JVM+settings
3) JVM settings are stored in two platform dependent files: standalone.conf and
standalone.conf.bat
4) The configuration files have logic in them, shell and batch logic.
5) The configuration files are sourced in the start scripts.
6) Users can update these files outside of RHQ and they can have really important
information
7) So far the AS7 plugin does not touch these files
Design Idea:
1) Expose JAVA_OPTS in the Connection Settings for the server resource as a configuration
field
2) If the user sets then update the two config files simultaneously, regardless of current
platform
3) Add the four lines of configuration at the top of each file
Line 1: == RHQ Configuration ==
Line 2: == BIG WARNING HERE ==
Line 3: If JAVA_OPTS not set already
Line 4: set JAVA_OPTS to user value
4) if RHQ detects these lines at the top of each file then update them when the user
updates the configuration
5) if RHQ does not detect them (user tampered with the configuration, or any other reason)
then add them
Some problems with this design:
1) Because the config files are sourced scripts in the startup scripts for each platform,
RHQ code needs to be very conservative since updates to these files have big security
implications.
2) Anything wrong the lines added in the configuration could render the AS7 server
unusable/unstartable. And the only solution for the user would be to manually fix the
file.
3) If the configuration files become complex via AS7 updates, or the user completely
changes them per their environment the RHQ updates can lead to errors (see 1).
4) If there is any tampering with the start of the file then the users would lose the
value even if it still is in the file.
5) The JAVA_OPTS setting would still be overriden by the Start Script Environment
Variables value if set in the Connection Settings.
6) On Windows, if the user adds anything at the top of the file, the RHQ updates will
force ignore the user configuration. There is no IF in batch, everything is accomplished
via GOTO. So the update for Windows would force a jump from start of the file to a portion
of the config file after the JAVA_OPTS configuration. And that place is currrently at the
bottom of the Windows config file.
The other design idea was around exposing the entire configuration file as a sub-resource
in the EAP resource tree. But that is not easily achievable with the current UI. And this
is not very secure since the config scripts are sourced; somebody could inject malicious
code and then restart EAP.
Any feedback would be greatly appreciated.
Thank you,
Stefan Negrea
Software Engineer