Merge ~hloeung/content-cache-charm:maxfds into content-cache-charm:master

[Haw Loeung]

Ship out systemd service override to increase max. fds for HAProxy

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[Colin Misare (cmisare)]

LGTM

review: Approve

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change successfully merged at revision d562691618d272142f70f7d33233216b3bef38d3

diff --git a/lib/haproxy.py b/lib/haproxy.py
index a8165c9..1e3b804 100644
--- a/lib/haproxy.py
+++ b/lib/haproxy.py
@@ -465,6 +465,11 @@ backend backend-{name}
         if haproxy_maxfds and haproxy_maxfds != 'unlimited' and int(maxfds) > int(haproxy_maxfds):
             cmd = ['prlimit', '--pid', str(haproxy_pid), '--nofile={}'.format(str(maxfds))]
             subprocess.call(cmd, stdout=subprocess.DEVNULL)
+
+            # We also need to make it persistent across HAproxy restarts
+            opts = {'LimitNOFILE': int(maxfds)}
+            utils.systemd_override(service='haproxy', opts=opts)
+
             return True
 
         return False
diff --git a/lib/utils.py b/lib/utils.py
index 65adc48..a04107d 100644
--- a/lib/utils.py
+++ b/lib/utils.py
@@ -291,3 +291,20 @@ def normalize_ip(ip):
         except ValueError:
             pass
     raise ValueError("{} is not a valid ip address".format(repr(ip)))
+
+
+def systemd_override(service, opts, systemd_path='/etc/systemd/system'):
+    service_path = os.path.join(systemd_path, '{}.service.d'.format(service))
+    if not os.path.exists(service_path):
+        os.mkdir(service_path)
+
+    content = ['[Service]']
+    for k, v in opts.items():
+        content.append('{}={}'.format(k, v))
+
+    override_path = os.path.join(service_path, 'override.conf')
+    with open(override_path, 'w', encoding='utf-8') as f:
+        f.write('\n'.join(content) + '\n')
+
+    cmd = ['systemctl', 'daemon-reload']
+    subprocess.call(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
diff --git a/tests/unit/test_haproxy.py b/tests/unit/test_haproxy.py
index 7055281..e0d0ad7 100644
--- a/tests/unit/test_haproxy.py
+++ b/tests/unit/test_haproxy.py
@@ -303,8 +303,9 @@ class TestLibHAProxy(unittest.TestCase):
         self.assertEqual(haproxy.get_parent_pid(pidfile='tests/unit/files/some-file-doesnt-exist.pid'), 1)
 
     @mock.patch('lib.utils.process_rlimits')
+    @mock.patch('lib.utils.systemd_override')
     @mock.patch('subprocess.call')
-    def test_increase_maxfds(self, call, process_rlimits):
+    def test_increase_maxfds(self, call, systemd_override, process_rlimits):
         haproxy = HAProxy.HAProxyConf(self.tmpdir)
 
         call.reset_mock()
@@ -332,7 +333,8 @@ class TestLibHAProxy(unittest.TestCase):
         call.assert_not_called()
 
     @mock.patch('lib.utils.process_rlimits')
-    def test_increase_maxfds_cpe(self, process_rlimits):
+    @mock.patch('lib.utils.systemd_override')
+    def test_increase_maxfds_cpe(self, systemd_override, process_rlimits):
         haproxy = HAProxy.HAProxyConf(self.tmpdir)
 
         process_rlimits.return_value = '10'
diff --git a/tests/unit/test_utils.py b/tests/unit/test_utils.py
index 9d9a081..62fe1e1 100644
--- a/tests/unit/test_utils.py
+++ b/tests/unit/test_utils.py
@@ -315,3 +315,31 @@ class TestLibUtils(unittest.TestCase):
                 lambda _: utils.parse_ip_blocklist_config(incorrect_config),
                 "firewall config containing incorrect seperator should be invalid",
             )
+
+    @mock.patch('subprocess.call')
+    def test_systemd_override(self, call):
+        opts = {'LimitNOFILE': 12345}
+        utils.systemd_override('haproxy', opts, systemd_path=self.tmpdir)
+        with open(os.path.join(self.tmpdir, 'haproxy.service.d', 'override.conf')) as f:
+            want = textwrap.dedent(
+                """\
+                [Service]
+                LimitNOFILE=12345
+                """
+            )
+            got = f.read()
+            self.assertEqual(want, got)
+
+        call.assert_called_once_with(['systemctl', 'daemon-reload'], stdout=-3, stderr=-3)
+
+        opts = {'LimitNOFILE': 66666}
+        utils.systemd_override('haproxy', opts, systemd_path=self.tmpdir)
+        with open(os.path.join(self.tmpdir, 'haproxy.service.d', 'override.conf')) as f:
+            want = textwrap.dedent(
+                """\
+                [Service]
+                LimitNOFILE=66666
+                """
+            )
+            got = f.read()
+            self.assertEqual(want, got)