Merge ~hloeung/content-cache-charm:haproxy-config into content-cache-charm:master

[Haw Loeung]

Set maxconns ceiling of system's init/PID 1's max. open files.

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[Stuart Bishop (stub)]

Looks fine, apart from tests that seem to rely on systemd defaults not being changed. Comments inline. Probably doesn't require rereview, but ping if it does.

review: Approve

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change successfully merged at revision 941f22cb2ada546a8868e956002744c1fc1f9414

diff --git a/lib/haproxy.py b/lib/haproxy.py
index b8d8727..2d378e9 100644
--- a/lib/haproxy.py
+++ b/lib/haproxy.py
@@ -244,23 +244,29 @@ backend backend-{name}
     def render(self, config, num_threads=None, monitoring_password=None, tls_cipher_suites=None):
         if not num_threads:
             num_threads = multiprocessing.cpu_count()
+
+        listen_stanzas = self.render_stanza_listen(config)
+
         if self.max_connections:
             max_connections = self.max_connections
         else:
             max_connections = num_threads * 2000
+        global_max_connections = max_connections * len(listen_stanzas)
+        init_maxfds = utils.process_rlimits(1, 'NOFILE')
+        if init_maxfds != 'unlimited' and (global_max_connections * 2) > int(init_maxfds):
+            global_max_connections = int(init_maxfds) // 2
+
         if not tls_cipher_suites:
             tls_cipher_suites = TLS_CIPHER_SUITES
         tls_cipher_suites = utils.tls_cipher_suites(tls_cipher_suites)
 
-        listen_stanzas = self.render_stanza_listen(config)
-
         base = os.path.dirname(os.path.dirname(os.path.realpath(__file__)))
         env = jinja2.Environment(loader=jinja2.FileSystemLoader(base))
         template = env.get_template('templates/haproxy_cfg.tmpl')
         return template.render(
             {
                 'backend': self.render_stanza_backend(config),
-                'global_max_connections': max_connections * len(listen_stanzas),
+                'global_max_connections': global_max_connections,
                 'listen': listen_stanzas,
                 'max_connections': max_connections,
                 'monitoring_password': monitoring_password or self.monitoring_password,
diff --git a/lib/utils.py b/lib/utils.py
index a075d18..577d9e9 100644
--- a/lib/utils.py
+++ b/lib/utils.py
@@ -168,3 +168,31 @@ def logrotate(path, retention=30, dateext=True):
             new.append(line)
 
     return '\n'.join(new)
+
+
+LIMITS_MATCH = {
+    'NOFILE': 'Max open files',
+}
+
+
+def process_rlimits(pid, res, limits_file=None):
+    if limits_file:
+        limitsf = limits_file
+    else:
+        limitsf = os.path.join('/proc', str(pid), 'limits')
+
+    if not os.path.exists(limitsf):
+        return None
+
+    with open(limitsf, 'r', encoding='utf-8') as f:
+        limits = f.read()
+
+    if res not in LIMITS_MATCH:
+        return None
+
+    for line in limits.split('\n'):
+        m = re.match(r'^{}\s+\S+\s+(\S+)'.format(LIMITS_MATCH[res]), line)
+        if m:
+            return m.group(1)
+
+    return None
diff --git a/tests/unit/files/limits.txt b/tests/unit/files/limits.txt
new file mode 100644
index 0000000..679cc39
--- /dev/null
+++ b/tests/unit/files/limits.txt
@@ -0,0 +1,17 @@
+Limit                     Soft Limit           Hard Limit           Units
+Max cpu time              unlimited            unlimited            seconds
+Max file size             unlimited            unlimited            bytes
+Max data size             unlimited            unlimited            bytes
+Max stack size            8388608              unlimited            bytes
+Max core file size        0                    unlimited            bytes
+Max resident set          unlimited            unlimited            bytes
+Max processes             31268                31268                processes
+Max open files            1048576              1048576              files
+Max locked memory         67108864             67108864             bytes
+Max address space         unlimited            unlimited            bytes
+Max file locks            unlimited            unlimited            locks
+Max pending signals       31268                31268                signals
+Max msgqueue size         819200               819200               bytes
+Max nice priority         0                    0
+Max realtime priority     0                    0
+Max realtime timeout      unlimited            unlimited            us
diff --git a/tests/unit/test_utils.py b/tests/unit/test_utils.py
index 301aafc..d4d4045 100644
--- a/tests/unit/test_utils.py
+++ b/tests/unit/test_utils.py
@@ -169,3 +169,19 @@ class TestLibUtils(unittest.TestCase):
 
         # Test when config file doesn't exist.
         self.assertEqual(utils.logrotate(retention=14, path='tests/unit/files/some-file-that-doesnt-exist'), None)
+
+    def test_process_rlimits(self):
+        # Read current Max open files from PID 1 and make sure
+        # utils.process_rlimits() returns the same.
+        with open('/proc/1/limits') as f:
+            for line in f:
+                if line.startswith('Max open files'):
+                    limit = str(line.split()[4])
+        self.assertEqual(limit, utils.process_rlimits(1, 'NOFILE'))
+        self.assertEqual(limit, utils.process_rlimits(1, 'NOFILE', None))
+        self.assertEqual(limit, utils.process_rlimits(1, 'NOFILE', 'tests/unit/files/limits.txt'))
+
+        self.assertEqual(None, utils.process_rlimits(1, 'NOFILE', 'tests/unit/files/test_file.txt'))
+        self.assertEqual(None, utils.process_rlimits(1, 'NOFILE', 'tests/unit/files/limits-file-does-not-exist.txt'))
+
+        self.assertEqual(None, utils.process_rlimits(1, 'NOMATCH'))