2022-07-08 - Sys Ops & Management SIG Agenda and Meeting notes

10

Welcome

Ingolf

Let's have a round of introduction for the new members.

Edge Modules Header Injection security issue

IngolfSy

See @Julian Ladisch 's post of July 6th in #sys-ops

Assessment:

• Are you affected by this at your institution ?

Mitigation:

If you run nginx in front of an edge module you may use proxy_set_header X-Okapi-Tenant "";  to remove the header.

WolfCon Session Planning

Ingolf

• Who will attend in person ?

  • @Hkaplanian @jpnelson @Ingolf Kuss @jroot (Unlicensed) 

  • remote: @Philip Robinson 

• We have one hour, Thursday, Sept 1st, 10:15 - 11:15 AM (4:15 - 5:15 AM EST) WOLFcon 2022: Operational Needs (sched.com)

• The meeting is intended to be a working meeting of the Sys Ops SIG; not a presentation to external

• The Conference Schedule is still subject to change, also from next week on (Harry)

• Plans for our presentations and how to frame the session 

  • Jeremy can imagine to give a presentation: What we are doing at Stanford

  • We could give an introduction to our deployment environments (Jason & Jeremy)

  • Ingolf could host a discussion about the major pain points

    • What these are (top 4)

      1. Documentation

      2. A simpler basic installation

      3. Tenant bootstrap process

      4. Logging / Observability

    • How did we solve it

    • What needs yet to be solved, how can we achieve this

• What is the expected outcome of the meeting ?

• What was the original proposal for the session ?

Lotus release installation experiences

Ingolf et al.

• If your tenant has more than one instance of mod-auth, be sure to set the -Djwt.signing.key env var the same across these instances.

• mod-pubsub and its deps no longer need to be deployed first on an in-place upgrade. Has been this way for several releases now.

• If you have Title Level Request fields in your data, the upgrade seems to fail. Remove these data before an upgrade.

• The Okapi logging config seems to have changed, needs to be checked in okapi.conf and log4j2.properties. There is a risk of filling up your local disk if the logging location is not configured to rotate. @Julian Ladisch has created a ticket: [OKAPI-1109] Log to /var/log/folio/okapi/okapi.log, not STDOUT, in Debian - FOLIO Issue Tracker
  
  

• Nils/Jason: How to build okapi from the docker image folioorg/okapi . Jason runs okapi like this folio-install/alternative-install/kubernetes-rancher/TAMU/okapi at master · folio-org/folio-install (github.com)

• Nils/Jason: Build Stripes with nginx in a container. Start with the docker files and nginx.conf of TAMU an tweak them as you need: folio-install/alternative-install/kubernetes-rancher/TAMU/stripes-tamu at master · folio-org/folio-install (github.com)

• Ingolf created two JIRAs for the single server release upgrade:

  • [OKAPI-1110] Okapi install endpoint fails for frontend modues with "deploy=true" - FOLIO Issue Tracker

  • [OKAPI-1108] Okapi install endpoint must not continue with any actions if it runs into a failure - FOLIO Issue Tracker

• How to not pull snapshot version from the central repository (Nils):

  • function Ftransfuse ()  {    curl folio-registry.dev.folio.org/_/proxy/modules/$1 | curl -X POST -d @- localhost:9130/_/proxy/modules }

  • Ftransfuse mod-configuration-5.7.4

Plans for future sessions

Ingolf

• Ingolf on holiday: 29th July - 8. August

• Jason and Chris out next week (July 11 - July 15)

• Florian G. on holiday during WolfCon; might attend some sessions remotely

• August 12th : Florian Kreft will give a presentation in Sys Ops SIG about deployment at LRZ Munich