Skip to content

Use bosh-agent enable-monit-access #98

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mariash wants to merge 5 commits into
base: main
Choose a base branch
from
+7 −218,596
Open

Use bosh-agent enable-monit-access #98

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
a5609b2
Revert "Make bosh-monit-access cgroup rule management idempotent"
mariash Feb 17, 2026
46fd114
Revert "galera-agent: emit bosh-monit-access output to stderr logs"
mariash Feb 17, 2026
a9d73a9
Revert "bosh-monit-access: vendor dependencies"
mariash Feb 17, 2026
25c1b1d
Revert "Add bosh-monit-access helper for nftables firewall"
mariash Feb 17, 2026
89db70f
Use bosh-enable-monit-access command if available
aramprice Feb 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
1 change: 0 additions & 1 deletion jobs/galera-agent/spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,6 @@ templates:

packages:
- galera-agent
- bosh-monit-access

provides:
- name: galera-agent
Expand Down
11 changes: 7 additions & 4 deletions jobs/galera-agent/templates/service.bash
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,10 +4,13 @@ set -o nounset

# Setup firewall rule to allow monit access from this job.
# Try new nftables firewall approach first (bosh-agent with monit_access_jobs chain).
if /var/vcap/packages/bosh-monit-access/bin/bosh-monit-access --check; then
# New firewall with jobs chain exists - use bosh-monit-access helper
/var/vcap/packages/bosh-monit-access/bin/bosh-monit-access 1>&2
else
set +e
/var/vcap/bosh/etc/bosh-enable-monit-access
Copy link
Member

@abg abg Feb 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Isn't this essentially the same as:

if ! /var/vcap/bosh/etc/bosh-enable-monit-access; then
...

Can we rewrite it like something like this to avoid getting "command not found" errors in the logs when running on older stemcells?

if ! [[ -x /var/vcap/bosh/etc/bosh-enable-monit-access ]] || ! /var/vcap/bosh/etc/bosh-enable-monit-access; then
...

Copy link
Member Author

@mariash mariash Feb 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, it was changed per @rkoster comment. He asked if this can be called separately instead of "if" block..

exit_status=$?
set -e

if [[ $exit_status -ne 0 ]]; then
# Failed to enable monit access using bosh-agent.
# Fallback to old approaches for backward compatibility with older stemcells
if type -f -p nft >/dev/null && nft list ruleset | grep -q monit_output; then
rule_handle=$(nft -a list ruleset | awk '/galera-agent/ { print $NF }')
Expand Down
8 changes: 0 additions & 8 deletions packages/bosh-monit-access/packaging
View file
Open in desktop

This file was deleted.

8 changes: 0 additions & 8 deletions packages/bosh-monit-access/spec
View file
Open in desktop

This file was deleted.

81 changes: 0 additions & 81 deletions src/bosh-monit-access/cgroup.go
View file
Open in desktop

This file was deleted.

Loading