Page MenuHomePhabricator

Reduce rpcbind use
Closed, ResolvedPublic

Description

We have rpcbind needlessly installed/running on half the fleet.

It gets pulled in as a "Recommends:" of nagios-plugins-standard for the check_rpc Nagios plugin, but that plugin is only used on dataset1001 and maybe a few other hosts. We should trim that down.

Details

Related Gerrit Patches:

Event Timeline

MoritzMuehlenhoff raised the priority of this task from to Low.
MoritzMuehlenhoff updated the task description. (Show Details)
Restricted Application added subscribers: Matanya, Aklapper. · View Herald TranscriptJul 22 2015, 7:03 AM
Dzahn awarded a token.Aug 22 2015, 1:15 AM
Dzahn added a subscriber: Dzahn.
MoritzMuehlenhoff set Security to None.

A similar issue exists with smbclient: nagios-plugins-standard recommends it, which in turn pulls in a lot of Samba-related libraries. Since we neither use CIFS shares nor any Windows systems, I doubt it is used at all.

nfs-common and rpcbind get installed during the initial d-i base installation. At this point our apt config to not install recommended packages is not yet in place (and I've also found no preseed option to configure that). IIRC d-i also uses anna and not apt, so maybe it's not even supported.

I think the cleanest solution would be to remove nfs-common and rpcbind in late-command.sh and fix our puppet code to explicitly install the packages where they're actually needed (dumps/NFS and labstore). And remove them from the rest.

Although rpcbind is normally blocked by ferm, it's better to not even have it installed from the start. Also e.g. lvs and cp* already have a hack in place (base::no_nfs_client), which would then be obsolete as well.

nfs-common and rpcbind get installed during the initial d-i base installation. At this point our apt config to not install recommended packages is not yet in place (and I've also found no preseed option to configure that). IIRC d-i also uses anna and not apt, so maybe it's not even supported.
I think the cleanest solution would be to remove nfs-common and rpcbind in late-command.sh and fix our puppet code to explicitly install the packages where they're actually needed (dumps/NFS and labstore). And remove them from the rest.

Sounds good to me!

Change 352097 had a related patch set uploaded (by Muehlenhoff; owner: Muehlenhoff):
[operations/puppet@production] labstore: Explicitly declare package dependencies for nfs-common and rpcbind

https://gerrit.wikimedia.org/r/352097

Change 352105 had a related patch set uploaded (by Muehlenhoff; owner: Muehlenhoff):
[operations/puppet@production] Strip nfs-common/rpcbind during jessie base installation

https://gerrit.wikimedia.org/r/352105

I doublechecked production hosts:

Hosts which have an /etc/exports:

dataset1001.wikimedia.org
labstore1003.eqiad.wmnet
labstore1004.eqiad.wmnet
labstore1005.eqiad.wmnet
ms1001.wikimedia.org

Hosts which have an NFS mount in their mtab:

dataset1001.wikimedia.org
labstore1003.eqiad.wmnet
labstore1005.eqiad.wmnet
ms1001.wikimedia.org
snapshot1001.eqiad.wmnet
snapshot1005.eqiad.wmnet
snapshot1006.eqiad.wmnet
snapshot1007.eqiad.wmnet
stat1002.eqiad.wmnet
stat1003.eqiad.wmnet

Change 352097 merged by Rush:
[operations/puppet@production] labstore: Explicitly declare package dependencies for nfs-common and rpcbind

https://gerrit.wikimedia.org/r/352097

Change 352105 merged by Muehlenhoff:
[operations/puppet@production] Strip nfs-common/rpcbind during jessie base installation

https://gerrit.wikimedia.org/r/352105

Change 352748 had a related patch set uploaded (by Muehlenhoff; owner: Muehlenhoff):
[operations/puppet@production] Drop cache/LVS NFS override

https://gerrit.wikimedia.org/r/352748

Mentioned in SAL (#wikimedia-operations) [2017-05-09T07:34:54Z] <moritzm> removing unneeded rpcbind/nfs-common packages (T106477)

Change 352748 merged by Muehlenhoff:
[operations/puppet@production] Drop cache/LVS NFS override

https://gerrit.wikimedia.org/r/352748

MoritzMuehlenhoff closed this task as Resolved.May 15 2017, 9:03 AM

rpcbind and nfs-common have been removed from all jessie hosts except those which actually use NFS. In addition our base d-i jessie installation strips nfs-common and rpcbind during base install.