This entry is based on customer escalation, I hope it will help or at least inspire you in some extend too.
This entry is part of ‘OpenSolaris on Amazon EC2′ workshop
This entry is based on customer escalation, I hope it will help or at least inspire you in some extend too.
This entry is part of ‘OpenSolaris on Amazon EC2′ workshop
This entry is part of ‘OpenSolaris on Amazon EC2′ workshop
We will create a MySQL 5.1 and Glassfish 2.1 developer profile bundle, we will run both applications as non-root user for higher security.
This time I will like to use as much as possible (re)configuration from Glassfish CLI management instead of direct editing Glassfish XML configuration files.
This entry is part of ‘OpenSolaris on Amazon EC2′ workshop
Amazon AWS is designed for OS configurations, where instance admin login into instance as ROOT with SSH key, ROOT user don’t have password (is locked), so we can’t ‘sudo’ to it. This is imposing some limitations in non-root SW install when some tasks need to be done directly as root user due to known limitations of pfexec command.
From past Glassfish on Solaris Amazon EC2 user feedback, most users are skilled developers who want to use AMI instances to porting their JAVA apps to Glassfish and/or EC2 Solaris platform. So in this Glassfish 2.1 AMI image we will focus on reasonable secure developer oriented installation in Cloud environment.
Use pre-created AMI with MySQL 5.1 AMI-752CCB1C
zfs list -t snapshot NAME USED AVAIL REFER MOUNTPOINT rpool/ROOT/opensolaris@install 140M - 2.65G -
zfs list NAME USED AVAIL REFER MOUNTPOINT rpool 4.07G 5.53G 72K /rpool rpool/ROOT 3.21G 5.53G 18K legacy rpool/ROOT/opensolaris 3.21G 5.53G 3.07G / rpool/dump 293M 5.53G 293M - rpool/export 56K 5.53G 19K /export rpool/export/home 37K 5.53G 37K /export/home rpool/swap 586M 6.10G 16K - root@jsc-xen-14:~# zfs list -t snapshot NAME USED AVAIL REFER MOUNTPOINT rpool/ROOT/opensolaris@install 140M - 2.65G -
zfs destroy rpool/ROOT/opensolaris@install
zfs list NAME USED AVAIL REFER MOUNTPOINT rpool 3.93G 5.66G 72K /rpool rpool/ROOT 3.07G 5.66G 18K legacy rpool/ROOT/opensolaris 3.07G 5.66G 3.07G / rpool/dump 293M 5.66G 293M - rpool/export 56K 5.66G 19K /export rpool/export/home 37K 5.66G 37K /export/home rpool/swap 586M 6.24G 16K -
1. Check if image is cleaned
du -s -h /var/pkg/download/ 34M /var/pkg/download/ du -s -h /var/pkg/index/ 36M /var/pkg/index/
2. Check if PKG IPS is set up to auto clean cache
No, set it
pkg property -H flush-content-cache-on-success flush-content-cache-on-success False pkg set-property flush-content-cache-on-success True
pkg install SUNWj6dev
pkg install SUNWant
1. We will use AMI with MySQL 5.1, until this version will be in official OpenSolaris REPO
Use pre-created AMI with MySQL 5.1 AMI-752ccb1c
2. Install Mysql Connector/J 5.1
Note: We will use version 5.1 from official OpenSolaris REPO
pkg install SUNWmysql5jdbc
GlassFish Project – v2.1 FinalBuild
The Open Sourcing Clustering features are included in this promotion.
Create non-root runtime user (account locked by default)
groupadd gf21 useradd -d /export/home/gf21 -m -s /usr/bin/bash -g gf21 gf21
Note: User will don’t have enough privileges to start/stop GF service, I consider to add to it profile , see separate section for it
1. Install glassfish 2.1
mkdir /opt/gf21; chown gf21:gf21 /opt/gf21 su - gf21 cd /opt/gf21 wget http://java.net/download/javaee5/v2.1_branch/promoted/SunOS_X86/glassfish-installer-v2.1-b60e-sunos_x86.jar java -Xmx256m -jar glassfish-installer-v2.1-b60e-sunos_x86.jar Accept license with "A" Installation will by unpacked in ./glassfish
2. Configure glassfish 2.1 (Create domain1)
cd /opt/gf21/glassfish chmod -R +x lib/ant/bin lib/ant/bin/ant -f setup.xml create.domain: [exec] Using port 4848 for Admin. [exec] Using port 8080 for HTTP Instance. [exec] Using port 7676 for JMS. [exec] Using port 3700 for IIOP. [exec] Using port 8181 for HTTP_SSL. [exec] Using default port 3820 for IIOP_SSL. [exec] Using default port 3920 for IIOP_MUTUALAUTH. [exec] Using default port 8686 for JMX_ADMIN. [exec] Domain being created with profile:developer, as specified by variable AS_ADMIN_PROFILE in configuration file. [exec] ------ Using Profile [developer] to create the domain ------ .... [exec] Security Store uses: JKS [exec] Domain domain1 created. [exec] Login information relevant to admin user name [admin] for this domain [domain1] stored at [/export/home/gf21/.asadminpass] successfully.
3. Backup original domain1 configuration
cp /opt/gf21/glassfish/domains/domain1/config/domain.xml /opt/gf21/glassfish/domains/domain1/config/domain.xml.org
4. Put glassfish tools into path
echo export PATH=$PATH:/opt/gf21/glassfish/bin >>~/.profile exit su - gf21
5) Create minimal Glassfish SMF script for automatic start / stop
How to Create a Service Management Facility (SMF) Manifest
cat >/opt/gf21/smf-glassfish.xml <<EOF <?xml version="1.0"?> <!DOCTYPE service_bundle SYSTEM "/usr/share/lib/xml/dtd/service_bundle.dtd.1"> <service_bundle type='manifest' name='glassfish:domain1'> <service name='application/glassfish/domain1' type='service' version='1'> <create_default_instance enabled='true' /> <single_instance /> <dependency name='fs-local' grouping='require_all' restart_on='none' type='service'> <service_fmri value='svc:/system/filesystem/local' /> </dependency> <dependency name='network-service' grouping='require_all' restart_on='none' type='service'> <service_fmri value='svc:/network/service' /> </dependency> <method_context> <method_credential user='gf21' group='gf21' /> </method_context> <exec_method type='method' name='start' exec='/opt/gf21/glassfish/bin/asadmin start-domain domain1' timeout_seconds='600' /> <exec_method type='method' name='stop' exec='/opt/gf21/glassfish/bin/asadmin stop-domain domain1' timeout_seconds='600' /> <property_group name='startd' type='framework'> <propval name='duration' type='astring' value='transient' /> </property_group> <stability value='Unstable' /> <template> <common_name> <loctext xml:lang='C'>Glassfish V2.1 Simple non-root user SMF</loctext> </common_name> </template> </service> </service_bundle> EOF
6. Load SMF this XML definition and start service
Execute as root, pfexec as gf21 fail on these ? exit whoami root /usr/sbin/svccfg validate /opt/gf21/smf-glassfish.xml /usr/sbin/svccfg import /opt/gf21/smf-glassfish.xml /usr/sbin/svcadm enable svc:/application/glassfish/domain1:default svcs /application/glassfish/domain1 STATE STIME FMRI online* 12:50:01 svc:/application/glassfish/domain1:default Wait after is service is online svcs /application/glassfish/domain1 online 12:05:29 svc:/application/glassfish/domain1:default
7. Add line to create authorization into auth_attr
Good Article: Less known Solaris features: RBAC and Privileges
Part 1: Introduction
Part 2: Role based access control
Part 3: Privileges
as root echo "solaris.smf.manage.glassfish/domain1:::Glassfish Domain1 Server management::" >> /etc/security/auth_attr
8. Add service authorization to user gf21
usermod -A solaris.smf.manage.glassfish/domain1 gf21
9. Add authorization to restart and manage service
svccfg -s glassfish/domain1 setprop general/action_authorization=astring: 'solaris.smf.manage.glassfish/domain1' svccfg -s glassfish/domain1 setprop general/value_authorization=astring: 'solaris.smf.manage.glassfish/domain1' svcadm refresf glassfish/domain1
10. Secure default instance domain1 admin interface by using SSL and localhost
su - gf21 asadmin get server.http-service.http-listener.admin-listener.address server.http-service.http-listener.admin-listener.address = 0.0.0.0 asadmin set server.http-service.http-listener.admin-listener.address=127.0.0.1 asadmin get server.http-service.http-listener.admin-listener.security-enabled server.http-service.http-listener.admin-listener.security-enabled = false asadmin set server.http-service.http-listener.admin-listener.security-enabled=true
11. Optional: Tuning Glassfish configuration for Amazon EC2 c1.small
Tune JVM HEAP memory in /opt/glassfish/domains/domain1/config/domain.xml,
Amazon AWS m1.small which have 1700MB RAM, so for Solaris for JeOS we can put there 1024MB
(But we need to keep in mind also memory needs of MySQL and ZFS ARCH chache ?)
Chane Java Heap memory from 512M to 1024M
asadmin create-jvm-options -- "-Xmx1024m" cat /opt/gf21/glassfish/domains/domain1/config/domain.xml | grep Xmx <jvm-options>-Xmx512m</jvm-options> <jvm-options>-Xmx1024m</jvm-options> asadmin delete-jvm-options -- -Xmx512m cat /opt/gf21/glassfish/domains/domain1/config/domain.xml | grep Xmx <jvm-options>-Xmx1024m</jvm-options>
Note: c1.small have only one CPU, do we need optimize threads , need to be investigated together with MySQL setup needs
12. Restart glassfish SMF service
Execute as root, pfexec as gf21 fail on these ? Most work NOW ! exit whoami root /usr/sbin/svcadm disable -t svc:/application/glassfish/domain1:default /usr/sbin/svcadm enable svc:/application/glassfish/domain1:default svcs /application/glassfish/domain1 STATE STIME FMRI online* 12:50:01 svc:/application/glassfish/domain1:default svcs /application/glassfish/domain1 online 12:05:29 svc:/application/glassfish/domain1:default
13. Check running GF2.2 running instance under gf21:gf21 (Still under root)
ps -ef |grep gf21 gf21 16270 1 0 08:20:29 ? 0:42 /usr/jdk/instances/jdk1.6.0/jre/../bin/java -Dcom.sun.aas.instanceRoot=/opt/gf2 svcs glassfish/domain1 STATE STIME FMRI online 8:21:12 svc:/application/glassfish/domain1:default svcs -l glassfish/domain1 | grep logfile lofile /var/svc/log/application-glassfish-domain1:default.log tail /var/svc/log/application-glassfish-domain1:default.log Domain listens on at least following ports for connections: [8080 8181 4848 3700 3820 3920 8686 ]. Domain does not support application server clusters and other standalone instances. netstat -an | egrep "8080|8181|4848|3700|3820|3920|8686" *.3700 *.* 0 0 49152 0 LISTEN *.3820 *.* 0 0 49152 0 LISTEN *.3920 *.* 0 0 49152 0 LISTEN *.8686 *.* 0 0 49152 0 LISTEN *.8080 *.* 0 0 49152 0 LISTEN *.8181 *.* 0 0 49152 0 LISTEN 127.0.0.1.4848 *.* 0 0 49152 0 LISTEN *.3700 *.* 0 0 49152 0 LISTEN *.3820 *.* 0 0 49152 0 LISTEN *.3920 *.* 0 0 49152 0 LISTEN *.8686 *.* 0 0 49152 0 LISTEN *.8080 *.* 0 0 49152 0 LISTEN *.8181 *.* 0 0 49152 0 LISTEN
This entry is part of ‘OpenSolaris on Amazon EC2′ workshop
| ami-3cf81c55 | aki-b78367de | ari-b68367df | sun-osol/opensol2008.05-b91-GF-MySQL.img |
Amazon EC2 OpenSolaris 200805-91 AMI Image with Glassfish V2 and MySQL 5.1 based on ami-89ef0be0 MySQL 5.1.x AMI image , origin is OpenSolaris 2008.05-91 ami-41e70328 image.
MySQL use for data /export/home/data2, I will use it for Glassfish installation too, so I can build a persistent storage solution (EBS) using this Glassfish and MySQL image.
By default only Java 6 JRE is installed on OpenSolaris 200805-91, but we need JDK, we also need MySQL JDBC drivers.
1. Update package system
pkg refresh pkg install -nv SUNWipkg@0.5.11-0.91 Before evaluation: UNEVALUATED: +pkg:/SUNWipkg@0.5.11,5.11-0.91:20080807T173946Z After evaluation: pkg:/SUNWipkg@0.5.11,5.11-0.91:20080620T101740Z -> pkg:/SUNWipkg@0.5.11,5.11-0.91:20080807T173946Z None pkg install SUNWipkg@0.5.11-0.91 DOWNLOAD PKGS FILES XFER (MB) Completed 1/1 154/154 1.40/1.40 PHASE ACTIONS Removal Phase 1/1 Update Phase 136/136 Install Phase 22/22
pkg install SUNWj6dev DOWNLOAD PKGS FILES XFER (MB) Completed 1/1 56/56 48.18/48.18 PHASE ACTIONS Install Phase 86/86 pkg list SUNWj6dev NAME (AUTHORITY) VERSION STATE UFIX SUNWj6dev 0.5.11-0.91 installed u---
3. Install MySQL 5 jdbc driver
pkg install SUNWmysql5jdbc DOWNLOAD PKGS FILES XFER (MB) Completed 1/1 12/12 1.29/1.29 PHASE ACTIONS Install Phase 22/22 pkg list SUNWmysql5jdbc NAME (AUTHORITY) VERSION STATE UFIX SUNWmysql5jdbc 5.1.5-0.95 installed ---- pkg contents SUNWmysql5jdbc | grep jar usr/mysql/connectors/jdbc/5.1/mysql-connector-java-5.1.5-bin.jar
cd /export/home/data/2
https://glassfish.dev.java.net/downloads/v2ur2-b04.html
wget http://www.java.net/download/javaee5/v2ur2/promoted/SunOS_X86/glassfish-installer-v2ur2-b04-sunos_x86-ml.jar
java -Xmx256m -jar glassfish-installer-v2ur2-b04-sunos_x86-ml.jar create.domain: [exec] Using port 4848 for Admin. [exec] Using port 8080 for HTTP Instance. [exec] Using port 7676 for JMS. [exec] Using port 3700 for IIOP. [exec] Using port 8181 for HTTP_SSL. [exec] Using default port 3820 for IIOP_SSL. [exec] Using default port 3920 for IIOP_MUTUALAUTH. [exec] Using default port 8686 for JMX_ADMIN. [exec] Domain being created with profile:developer, as specified by variable AS_ADMIN_PROFILE in configuration file. [exec] Security Store uses: JKS [exec] Domain domain1 created. [exec] Admin login information for host [localhost] and port [4848] is being overwritten with credentials provided. This is because the --savelogin option was used during create-domain command. [exec] Login information relevant to admin user name [admin] for this domain [domain1] stored at [/root/.asadminpass] successfully. [exec] Make sure that this file remains protected. Information stored in this file will be used by asadmin commands to manage this domain. [delete] Deleting: /export/home/data2/glassfish/passfile
cd /export/home/data2/glassfish ./bin/asadmin start-domain domain1 Starting Domain domain1, please wait. Log redirected to /export/home/data2/glassfish/domains/domain1/logs/server.log. Redirecting output to /export/home/data2/glassfish/domains/domain1/logs/server.log Domain domain1 is ready to receive client requests. Additional services are being started in background. Domain [domain1] is running [Sun Java System Application Server 9.1_02 (build b04-fcs)] with its configuration and logs at: [/export/home/data2/glassfish/domains]. Admin Console is available at [https://localhost:4848]. Use the same port [4848] for "asadmin" commands. User web applications are available at these URLs: [http://localhost:8080 https://localhost:8181 ]. Following web-contexts are available: [/web1 /__wstx-services ]. Standard JMX Clients (like JConsole) can connect to JMXServiceURL: [service:jmx:rmi:///jndi/rmi://domU-12-31-39-00-88-61.compute-1.internal:8686/jmxrmi] for domain management purposes. Domain listens on at least following ports for connections: [8080 8181 4848 3700 3820 3920 8686 ]. Domain does not support application server clusters and other standalone instances.
5. Check login to Glassfish administration
http://amazon_public_honstname:4848/ User: admin Password:adminadmin
For creating of pre-build PUBLIC OpenSolairs AMIs I select Glassfish MySQL and WebStack AMP bundles, they are very easy to deploy and configure so they are ideal for Virtual Appliances as PoC (Proof-of-Concept) software.
This entry is part of ‘OpenSolaris on Amazon EC2′ workshop
| ami-0d50b564 | aki-7846a311 | ari-7d46a314 | sun-osol/2008.05_JeOS_32_1.0.img.manifest.xml |
In fact this an another example how composite image can be created, this time I will use IPS net based install from default OpenSolaris repository.
Advanced ec2ify: ssh_indent_key + data disks formated with ZFS and mounted /mnt, user-data, updater, syncer
<p
See install steps bellow:
Get & Inst: Net based install of IPS packages into OpenSolaris 2008.05
In fact this an another example how composite image can be created, this time I will use IPS net based install from default OpenSolaris repository.
This entry is part of ‘OpenSolaris on Amazon EC2′ workshop
New IPS packaging system
Amazon EC2 is based on XEN hypervisor, AMI runs as DomU so any OS with XEN hypervisor implementation as popular Linux distributions, OpenSolaris Nevada and Indiana lines can be used for emulating Amazon EC2 environment for faster local development.
This entry is part of ‘OpenSolaris on Amazon EC2′ workshop
Because users don’t have access to Kernel/Ramdisk, they are located in Dom0 on RO mode. many issues with getting them before boot with PyGRUB from DomU image don’t apply, especially where OpenSolaris images with UFS or ZFS root is used in Linux based Dom0.
You can use rebundling process on Amazon EC2 for fast initial AMI creations, later you can download your private AMIS locally and unbundle (split into one image and decode) them. This is why it is good in process of rebudling set your password to root user, so you can after access image locally with console.
If you plan to run Linux based Dom0 is also good to get Kernel/Ramdisk images from running instance. t. m. save /platform dir with ssh.
I prepared XEN DomU OpenSolaris JeOS RNJS archives, its planned as Optional Feature Download, if somebody of you is experienced with XEN Hypervisor and will like try local development. Ask on Beta program email alias to get access to them.
Based on my previous Linux on Amazon AWS experience I define 5 optional Solaris ec2ify steps:
This entry is part of ‘OpenSolaris on Amazon EC2′ workshop
Based on my previous Linux on Amazon AWS experience I define 5 required Solaris ec2ify steps:
This entry is part of ‘OpenSolaris on Amazon EC2′ workshop
To get impression of ephemeral store behavior under OpenSolaris (UFS,ZFS) I use bonnie++, compiled from source with debug output. Pre-compiled binary can be get from [www.sunfreeware.com SunFreeware]
This entry is part of ‘OpenSolaris on Amazon EC2′ workshop
I will skip file based tests and use large file pool test only with size configuration more then 2x of instance memory, because main purpose of test is evaluate “Amazon EC2 documented ephemeral storage feature fist access can be significantly slower “.
New OpenSolaris 2008.05 utilize ZFS root and use ZFS clones for system updates with IPS net based repository, it’s counts on ability of reboot OS instance into new environment.
This entry is part of ‘OpenSolaris on Amazon EC2′ Workshop
Will OpenSolaris 2008.05 OS survive reboot after update ? Yes !!!
We need scrips to support specific features of Amazon AWS (EC2,S3), yes, we need ec2ify our Solaris instances.
This entry is part of ‘OpenSolaris on Amazon EC2′ Workshop
Bellow I will demonstrate some ec2ify functionality, however main purpose of them is to demonstrate ec2ify process and issues, rather then make perfect suit all script(s).
I will create this ec2ify functionality:
Both ec2ify services will be created as Solaris SMF services so we can make they depend on other services, see more about Solaris SMF in Predictive Self-Healing – Bigadmin home of SMF
Note: This stuff will sit in /opt/ec2ify directory, SMF services will start with ec2ify name
Amazon AWS represent Utility on demand , Pay as you go concepts, Amazon AWS is also known as Highly Scalable, developer oriented, Web Platform build on XEN hypervisor technology.
This entry is part of ‘OpenSolaris on Amazon EC2′ workshop
(more…)
Amazon APIs used network based protocols so they consumers are highly portable and are implemented in most popular programing languages as rich full libraries. classes or modules.
This entry is part of ‘OpenSolaris on Amazon EC2′ workshop
(more…)
In this type of AMI image use, I will send a control data in form of ZIP file to AMI on instance start which will download from S3 prepackaged and zipped application stack, this way we don’t need to rebuild AMI and we can update it on boot time.
This entry is part of ‘OpenSolaris on Amazon EC2′ Workshop
(more…)
For now it is just JIT (Just Install software) Virtual Appliance, developers will post-configure it using DOCs
This entry is part of ‘OpenSolaris on Amazon EC2′ Workshop
(more…)
Installation of Liferay Glassfish bundle DEMO is easy and is identical to install of empty Glassfish.
This entry is part of ‘OpenSolaris on Amazon EC2′ Workshop
(more…)
Note: Because in Amazon EC2 we can’t update Kernel and Ramdisk plus OpenSolaris store ZFS pool configuration in Ramdisk in form of ZFS cache you will not be able at least for now to upload your images. You need to use our preprepared JeOS image:
This entry is part of ‘OpenSolaris on Amazon EC2′ workshop
(more…)
OpenSolaris 0508 (code name Indiana) is based on IPS and ZFS root. IPS as modern packaging system give use more freedom when creating JeOS. However this first OpenSolaris release is Desktop and GUI oriented system with Live CD based installation only, so we need to process needed CLI components selection manually.
This entry is part of ‘OpenSolaris on Amazon EC2′ Workshop
For next OpenSolaris Indiana line releases CLI unattended installation with similar functionality to JumpStart functionality is planned.
We will try to build CLI JeOS in xVM based on OpenSolaris Indiana line in similar RNJS profile as we did for SXDE0108 Nevada Line.
For creating of PUBLIC AMIs I select Glassfish bundles, they don’t have absolutely latest version of Glassfish, but they are very easy to deploy and configure so they are ideal for Virtual Appliances as PoC (Proof-of-Concept) software.
This entry is part of ‘OpenSolaris on Amazon EC2′ Workshop
(more…)
We will install this additional SW with optional packages form sunfreeware.com (Sol10x86 versions)
This entry is part of ‘OpenSolaris on Amazon EC2′ Workshop
Now, lets install JeOS profile with Netboot install of OpenSolaris Nevada line
This entry is part of ‘OpenSolaris on Amazon EC2′ Workshop
(more…)
We will use OpenSolaris Nevada line based JumpStart install:
Best is to use network JumpStart server, alternatively you can use CD-ROM install with just profile and sysidcfg files.
This entry is part of ‘OpenSolaris on Amazon EC2′ Workshop
(more…)
JeOS is targeted minimal OS installation and is stand from Just Enough OS for running concrete Application(s). There is no “One shoes will fit all” approaches with JeOS creations, each JeOS is ideally individually created to fit concrete applications, so please take JeOS creations tips bellow as a guidelines how to create your JeOS.
This entry is part of ‘OpenSolaris on Amazon EC2′ Workshop
(more…)
As part of Alliances with Global Partners program SUN announce OpenSolaris on Amazon EC2 Beta private program and SUN also announce http://www.mysql.com/news-and-events/press-release/release_2008_16.html”;> MySQL support for Amazon EC2 users
See also: Getting started with OpenSolaris on Amazon EC2 and Official EC2 blog
Bellow I try to summarize my Solaris on Amazon AWS (EC2 , S3) field experience reusing my Linux, Solaris , xVM / XEN theme related knowledge:
New SUN IPS packaging with network based repositories simplify installation of third-party SW to OpenSolaris or Indiana, you don’t need any more to deal with Companion CD or manual packages + dependencies download, install. Great !
This entry is part of ‘OpenSolaris on Amazon EC2′ Workshop
(more…)
This entry is part of ‘OpenSolaris on Amazon EC2′ Workshop
Theme: Shocking Blue Green. Blog at WordPress.com.