0

How does one get to a single restart/reload on a single chef run and be within chef best practices?

Is using a status file a good practice or re-writing the service dnsmasq information?

This question was asked 7 years ago, has someone found a better way? Re-writing service documented here --
Minimize service restarts from chef notifications?

Issue:

The current code has resulted in 1 restart and 1 reload. Which has caused issues.

dnsmasq has 3 configuration files that need to be managed with different start/restart/reload methods. dnsmasq has no-poll as an argument by design, to prevent it from reloading /etc/resolv.conf on every change. I want to control the reloads here.

package "install dnsmasq" do
  name 'dnsmasq'
  action :install
  notifies :create, 'cookbook_file[/etc/dnsmasq.conf]', :delayed
  notifies :create, 'template[/etc/resolv.dnsmasq]', :delayed
  notifies :create, 'template[/etc/resolv.conf]', :delayed
  notifies :restart, 'service[dnsmasq]', :delayed
end

template '/etc/resolv.dnsmasq' do
  ...
  notifies :reload, 'service[dnsmasq]', :delayed
end

file '/etc/dnsmasq.conf' do
  ...
  notifies :restart, 'service[dnsmasq]', :delayed
end

template '/etc/resolv.conf' do
  ...
  notifies :reload, 'service[dnsmasq]', :delayed
end

service 'dnsmasq' do
  supports [:restart, :status, :start, :reload]
  action [ :enable, :start ]
  reload_command "/usr/bin/killall -s SIGHUP dnsmasq"
end
2
  • Is :reload required at all, as service :restart is also requested? IMHO one restart at the end after updating all configuration files should be enough.
    – seshadri_c
    Jan 19, 2021 at 5:42
  • Updating all configurations on the first change or a change of dnsmasq.conf will result in a restart, which we accept as a risk. However, if we are updating/changing the files that only require a reload, we want avoid doing a restart on the service if at all possible.
    – wildcm
    Jan 19, 2021 at 16:33

2 Answers 2

0

If you're doing more than that:

package "install dnsmasq" do
  name 'dnsmasq'
  action :install
end

file '/etc/dnsmasq.conf' do
  ...
  notifies :restart, 'service[dnsmasq]', :delayed
end

template '/etc/resolv.dnsmasq' do
  ...
  notifies :reload, 'service[dnsmasq]', :delayed
end

template '/etc/resolv.conf' do
  ...
  notifies :reload, 'service[dnsmasq]', :delayed
end

service 'dnsmasq' do
  supports [:restart, :status, :start, :reload]
  action [ :enable, :start ]
  reload_command "/usr/bin/killall -s SIGHUP dnsmasq"
end

Then you probably have a logical problem in your code for what you put in those files, these resources are idempotent, notifying templates and files from package install to then notify a service restart is a nonsense on a declarative model.

No need to play with the notifications here for that, :delayed is also not necessary as it's the default value, but it make things obvious at read.

Putting the /etc/dnsmasq.conf file first ensure the restart notification will be triggered first before any reload if need be, to avoid a reload with a configuration change that need a restart. A reload after the restart isn't a problem at all.

4
  • thanks for the feed back. I sort of wish a restart then a reload would not be "disruptive". We followed RedHat's 5 9's documentation. By default dnsmasq drops the cache and has to reload it after each action. These are deemed "disruptive" to a handful of our applications. Today, for these apps, we have to swap out the nameservers in resolv.conf when doing maintenance, even with timeout of 1 second. We found restart/reload is very "disruptive", restart is "disruptive", reload not as "disruptive." I was tasked with making it least disruptive on deploy and future changes.
    – wildcm
    Feb 1, 2021 at 14:47
  • I wonder which modification you could have needing a real restart of dnsmasq, as far as I know a reload is enough to reconfigure all of it, and IIRC you can prevent a cache clean, but it seems you are reloading for that so that may not be the better approach.
    – Tensibai
    Feb 1, 2021 at 17:12
  • 1
    Per the maintainer of dnsmasq, a change to dnsmasq.conf requires a restart. This is a security feature as the process switches to user "nobody" and the only way to reload changes for that configuration is a restart. Also, we are now including a custom systemd unit file which includes the reload command and a restart if process dies. To pickup the new unit changes, requires a systemctl daemon-reload and a restart of dnsmasq. For the Linux 6 systems we have to include dnsmasq in our old monitoring processes and still have to keep the reload_command= in the service resource.
    – wildcm
    Feb 2, 2021 at 14:14
  • Fair point. I kind of see where you're coming from.
    – Tensibai
    Feb 2, 2021 at 20:36
-1

This "Accumulator" solution results in one start, restart, or reload depending on what is passed. The process was previously referenced as rewind. This may not be very efficient coding or the correct way of doing this type of activity within chef, however the solution does work for me at present time.

recipe:dnsmasq.rb

dnsmasq_service 'dnsmasq' do
  action :nothing
end

package 'dnsmasq' do
  action :install
end

# This has to come first, as it requires a restart
cookbook_file '/etc/dnsmasq.conf' do
  delayed_action :create
  notifies :restart, 'dnsmasq_service[dnsmasq]'
end

# This comes second
template '/etc/resolv.dnsmasq' do
  delayed_action :create
  notifies :reload, 'dnsmasq_service[dnsmasq]'
end

# This comes third.  Do not create until the other configs are down.
template '/etc/resolv.conf' do
  delayed_action :create
  notifies :reload, 'dnsmasq_service[dnsmasq]'
end

# This comes fourth
# Make sure the service is always started and enabled.
service 'dnsmasq' do
  action [ :enable, :start ]
  delayed_action :start
end

resources:dnsmasq_service.rb

#https://github.com/chef/chef/issues/5454
# Be aware of the cookbook name being lost
#https://github.com/chef/chef/issues/5438
# Could not get this to work without the log notifications.

#https://coderanger.net/rewind/
#https://docs.chef.io/infra_language/

provides :dnsmasq_service
resource_name :dnsmasq_service

default_action :start

action :start do
  # Find resource, if it does not exist create with this action
  with_run_context :root do
    find_resource(:service, 'dnsmasq') do
      action [ :enable, :start ]
    end
  end
  log "force :start dnsmasq notification" do
    notifies :start, 'service[dnsmasq]', :delayed
  end
end

action :reload do
  r = with_run_context :root do
    find_resource(:service, 'dnsmasq') do
      action [ :enable, :reload ]
      reload_command "/usr/bin/killall -s SIGHUP dnsmasq"
    end
  end

  a = Array.new(r.action)
  f_act = :reload
  if a.include?(:restart)
    f_act = :restart
    with_run_context :root do
      edit_resource!(:service, 'dnsmasq') do
        action [ :enable, :restart ]
      end
    end
  else
    with_run_context :root do
      edit_resource!(:service, 'dnsmasq') do
        action [ :enable, :reload ]
        reload_command "/usr/bin/killall -s SIGHUP dnsmasq"
      end
    end
  end
  log "force #{f_act} dnsmasq notification" do
    notifies f_act, 'service[dnsmasq]', :delayed
  end
end

action :restart do
  r = with_run_context :root do
    find_resource(:service, 'dnsmasq') do
      action [ :enable, :reload ]
    end
  end

  with_run_context :root do
    edit_resource!(:service, 'dnsmasq') do
      action [ :enable, :restart ]
    end
  end
  log "force :restart dnsmasq notification" do
    notifies :restart, 'service[dnsmasq]', :delayed
  end
end
1
  • No reason to notify the resources with the same action they already have. if you set a create notification for a file, its own action should be create_if_missing OR nothing, but here the notification in the package resource make no sense. Moreover, trying to edit the service resource from a custom resource is just an horrible complexity custom resources are not made for. They're here to abstract resources getting together, if you create one, move all bits inside it (file, template and service) and declare only this resource in your recipe.
    – Tensibai
    Jan 29, 2021 at 22:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.