Page MenuHomePhabricator

varnish parent unable to send signals to child
Closed, ResolvedPublic

Description

The architecture of varnish is based on a management process supervising its child. The child does all the actual work of handling requests, caching, and so forth.

In some unfortunate cases, the child process can crash. When that happens, the management process detects the event by failing to communicate with its child, and tries to kill it.

Due to CAP_KILL not being in the Capability Bounding Set defined in varnish-frontend systemd unit, sending such signal currently fails:

Jan 09 20:59:52 cp3062 varnishd[2836]: Failed to kill child with PID 112629: Operation not permitted

Details

Related Gerrit Patches:

Event Timeline

ema created this task.Jan 10 2020, 9:35 AM
Restricted Application added a project: Operations. · View Herald TranscriptJan 10 2020, 9:35 AM
Restricted Application added a subscriber: Aklapper. · View Herald Transcript
ema triaged this task as Medium priority.Jan 10 2020, 2:41 PM
ema moved this task from Triage to TLS on the Traffic board.
ema moved this task from TLS to Caching on the Traffic board.

Change 564726 had a related patch set uploaded (by Ema; owner: Ema):
[operations/puppet@production] cache: add CAP_KILL to varnish-frontend capabilities

https://gerrit.wikimedia.org/r/564726

Mentioned in SAL (#wikimedia-operations) [2020-01-15T10:08:18Z] <ema> cache: rolling varnish-frontend-restart to add CAP_KILL to varnish-frontend.service T242411

ema closed this task as Resolved.Jan 22 2020, 4:12 PM
ema claimed this task.

Capability added, all frontends restarted. Closing.