From 1467f691917fa09d9e2939b9d3ff7bf5b70e618d Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Wed, 27 Jun 2012 13:32:51 -0700
Subject: [PATCH 1/2] Add cgroup memory limits to jenkins_slave.

Add cgroup memory limits to the jenkins_slave module. Nodes including
jenkins_slave::cgroups will have the jenkins user's processes limited
to use only 90% of the nodes available memory. There are two
exceptions to this. The jenkins process run by the jenkins user will
not have its memory capped. Also there is a soft memory limit of
total physical memory * 0.75. If there is memory contention the
jenkins user processes may get only 75% of available memory.

Change-Id: If4a6439b536df4003d74fd1a93686c1c2401ae20
---
 .../jenkins_slave/files/cgroups/cgrules.conf  |  2 +
 .../lib/facter/memorytotalbytes.rb            |  7 ++++
 modules/jenkins_slave/manifests/cgroups.pp    | 37 ++++++++++++++++++
 modules/jenkins_slave/templates/cgconfig.erb  | 38 +++++++++++++++++++
 4 files changed, 84 insertions(+)
 create mode 100644 modules/jenkins_slave/files/cgroups/cgrules.conf
 create mode 100755 modules/jenkins_slave/lib/facter/memorytotalbytes.rb
 create mode 100644 modules/jenkins_slave/manifests/cgroups.pp
 create mode 100644 modules/jenkins_slave/templates/cgconfig.erb

diff --git a/modules/jenkins_slave/files/cgroups/cgrules.conf b/modules/jenkins_slave/files/cgroups/cgrules.conf
new file mode 100644
index 0000000000..ccffe15ad0
--- /dev/null
+++ b/modules/jenkins_slave/files/cgroups/cgrules.conf
@@ -0,0 +1,2 @@
+jenkins:jenkins memory /jenkins
+jenkins         memory /jenkins/children
diff --git a/modules/jenkins_slave/lib/facter/memorytotalbytes.rb b/modules/jenkins_slave/lib/facter/memorytotalbytes.rb
new file mode 100755
index 0000000000..829810d14c
--- /dev/null
+++ b/modules/jenkins_slave/lib/facter/memorytotalbytes.rb
@@ -0,0 +1,7 @@
+# memorytotalbytes.rb
+
+Facter.add("memorytotalbytes") do
+  setcode do
+    Facter::Util::Resolution.exec('free -bo | sed -n \'s/^Mem:\W\+\([0-9]\+\).*$/\1/p\'')
+  end
+end
diff --git a/modules/jenkins_slave/manifests/cgroups.pp b/modules/jenkins_slave/manifests/cgroups.pp
new file mode 100644
index 0000000000..007241ca33
--- /dev/null
+++ b/modules/jenkins_slave/manifests/cgroups.pp
@@ -0,0 +1,37 @@
+class jenkins_slave::cgroups {
+
+  package { 'cgroup-bin':
+    ensure => present
+  }
+
+  file { '/etc/cgconfig.conf':
+    ensure  => present,
+    replace => true,
+    owner   => root,
+    mode    => 0644,
+    content => template('jenkins_slave/cgconfig.erb')
+  }
+
+  file { '/etc/cgrules.conf':
+    ensure  => present,
+    replace => true,
+    owner   => root,
+    mode    => 0644,
+    source  => 'puppet:///modules/jenkins_slave/cgroups/cgrules.conf'
+  }
+
+  service { 'cgconfig':
+    enable    => true,
+    ensure    => running,
+    require   => Package['cgroup-bin'],
+    subscribe => File['/etc/cgconfig.conf']
+  }
+
+  service { 'cgred':
+    enable    => true,
+    ensure    => running,
+    require   => Package['cgroup-bin'],
+    subscribe => File['/etc/cgrules.conf']
+  }
+
+}
diff --git a/modules/jenkins_slave/templates/cgconfig.erb b/modules/jenkins_slave/templates/cgconfig.erb
new file mode 100644
index 0000000000..d947b51b06
--- /dev/null
+++ b/modules/jenkins_slave/templates/cgconfig.erb
@@ -0,0 +1,38 @@
+mount {
+        cpu = /sys/fs/cgroup/cpu;
+        cpuacct = /sys/fs/cgroup/cpuacct;
+        devices = /sys/fs/cgroup/devices;
+        memory = /sys/fs/cgroup/memory;
+        freezer = /sys/fs/cgroup/freezer;
+}
+
+group jenkins {
+	perm {
+		task {
+			uid = jenkins;
+			gid = jenkins;
+		}
+		admin {
+			uid = root;
+			gid = root;
+		}
+	}
+}
+
+group jenkins/children {
+	perm {
+		task {
+			uid = jenkins;
+			gid = jenkins;
+		}
+		admin {
+			uid = root;
+			gid = root;
+		}
+	}
+	memory {
+		memory.soft_limit_in_bytes = <%= (memorytotalbytes.to_f * 0.75).to_i %>;
+		memory.limit_in_bytes = <%= (memorytotalbytes.to_f * 0.9).to_i %>;
+		memory.memsw.limit_in_bytes = <%= (memorytotalbytes.to_f * 0.9).to_i %>;
+	}
+}

From b21e184356384e5aff35492a6e1e069684b864d0 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Tue, 3 Jul 2012 14:28:41 -0700
Subject: [PATCH 2/2] Apply cgroups and ulimit to precise8.

To test the cgroup and ulimit changes in a controlled manner apply
the two limiting tools to precise8. One this host the jenkins user
will only be able to start 256 processes and will be limited to using
90% of the hosts physical memory.

Change-Id: Id57c2ca9bbb40366b2827c4b07236aa33cc10bd7
---
 manifests/site.pp | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/manifests/site.pp b/manifests/site.pp
index 87b40c2d28..2d2138b6c4 100644
--- a/manifests/site.pp
+++ b/manifests/site.pp
@@ -527,6 +527,28 @@ node /^ci-backup-.*\.openstack\.org$/ {
 #
 # Jenkins slaves:
 #
+
+# Test cgroups and ulimits on precise8
+node 'precise8.slave.openstack.org' {
+  include openstack_cron
+  include openstack_jenkins_slave
+
+  package { "tox":
+    ensure => latest,  # okay to use latest for pip
+    provider => pip,
+    require => Package[python-pip],
+  }
+
+  include ulimit
+  ulimit::conf { 'limit_jenkins_procs':
+    limit_domain => 'jenkins',
+    limit_type   => 'hard',
+    limit_item   => 'nproc',
+    limit_value  => '256'
+  }
+  include jenkins_slave::cgroups
+}
+
 node /^.*\.slave\.openstack\.org$/ {
   include openstack_cron
   include openstack_jenkins_slave