Commit df6ebffa authored by Muhammad Umair Khan's avatar Muhammad Umair Khan
Browse files

fix: correct ACME CSE registrar URL and default Thanos object store 

Two related but separate reliability fixes to components that were
crash-looping or producing corrupted requests out of the box.

ACME CSE registrar addressing (acme.ini.in, both Dockerfiles)
----------------------------------------------------------------
mep-cse-mn could never register with its registrar CSE: every request
returned an ingress 404 instead of a oneM2M response. Traced to
acme.ini.in's [cse.registrar] section, where `address` (ending in "/")
and `root` (starting with "/") were concatenated to build the
registrar's base URL, producing an accidental "//" right after the
host:port. ACME's RequestManager.toHttpUrl() then does a blanket
`path.replace("//", "/~/")` to turn oneM2M's internal SP-relative
marker into the literal wire format - and because str.replace() hits
every occurrence, it also rewrote our unrelated ingress-routing slash,
inserting a bogus extra "/~/" segment that no ingress rule matches.
Dropping the trailing slash from `address` leaves exactly one "//"
boundary (the legitimate one before the CSR path), so only the correct
segment gets rewritten.

While in there, reordered both meep-acme-mn-cse's and meep-acme-in-cse's
Dockerfiles so `pip install` runs right after cloning the upstream ACME
repo, before `COPY ./data` overlays our own entrypoint/config/source
files. Previously any edit to those files invalidated Docker's cache
for the pip layer too, forcing a full dependency re-download on every
rebuild.

Thanos long-term storage default fallback (deploy.go, objstore.go,
charts/thanos)
----------------------------------------------------------------
meep-thanos and meep-thanos-archive crash-looped indefinitely whenever
the manual long-term storage setup (README) wasn't completed, because
the objstore secret still held the shipped placeholder endpoint. Added
detection in meepctl (utils/objstore.go) that recognizes a missing,
empty, or still-placeholder objstore secret and transparently points
Thanos and its Prometheus sidecar at the RustFS instance already
bundled in charts/thanos, instead of leaving them to fail forever. A
real, manually-configured object store is left completely untouched -
this only engages as a fallback.

Two follow-on fixes were needed to make the fallback actually usable
in a single-node deployment:
- RustFS defaults to a 4-replica distributed cluster with pod
  anti-affinity, which can never schedule on one node. The fallback
  now forces single-replica standalone mode.
- RustFS also defaults to local-path-provisioner-managed storage in an
  arbitrary directory, and to running as a hardcoded 10001:10001 user
  that doesn't own that directory. Added a static hostPath PersistentVolume
  template (charts/thanos/templates/rustfs/hostpath-pv.yaml) so RustFS's
  data lands under ~/.meep like every other MEEP component, and set
  RustFS's pod securityContext to the same configured uid/gid meepctl
  already uses for meep-docker-registry, rather than loosening directory
  permissions to work around the mismatch.

Separately, pinned prometheusOperator.thanosImage.tag to v0.41.0 in the
meep-prometheus case: charts/kube-prometheus-stack defaults to the
sidecar's ancient v0.25.2, while charts/thanos (query/storegateway/
compactor) runs v0.41.0. That gRPC/StoreAPI version gap caused a nil
pointer panic (QueryHints.IsSafeToExecute) on every query Thanos Query
sent the sidecar, silently breaking both Prometheus's own long-term
storage and Grafana's separate "Thanos" datasource.
parent 3f2a799e

charts/thanos/templates/rustfs/hostpath-pv.yaml

0 → 100644
+38 −0
Original line number Diff line number Diff line 
{{- if and .Values.rustfs.enabled .Values.rustfs.persistence.hostPath.enabled }}

# Static, hostPath-backed PersistentVolumes for the RustFS subchart's data

# and logs PVCs (named "<release>-rustfs-data"/"-logs" by the subchart's own

# fullname convention). Paired with rustfs.storageclass.name being set to

# "<release>-rustfs" so the subchart's PVCs bind to these specific volumes

# instead of triggering dynamic provisioning.

apiVersion: v1

kind: PersistentVolume

metadata:

  name: {{ .Release.Name }}-rustfs-data

  labels:

    {{- include "thanos.labels" . | nindent 4 }}

spec:

  capacity:

    storage: {{ .Values.rustfs.storageclass.dataStorageSize }}

  accessModes:

    - ReadWriteOnce

  persistentVolumeReclaimPolicy: Retain

  storageClassName: {{ .Release.Name }}-rustfs

  hostPath:

    path: {{ .Values.rustfs.persistence.hostPath.dataLocation | quote }}

---

apiVersion: v1

kind: PersistentVolume

metadata:

  name: {{ .Release.Name }}-rustfs-logs

  labels:

    {{- include "thanos.labels" . | nindent 4 }}

spec:

  capacity:

    storage: {{ .Values.rustfs.storageclass.logStorageSize }}

  accessModes:

    - ReadWriteOnce

  persistentVolumeReclaimPolicy: Retain

  storageClassName: {{ .Release.Name }}-rustfs

  hostPath:

    path: {{ .Values.rustfs.persistence.hostPath.logsLocation | quote }}

{{- end }}

charts/thanos/values.yaml

+18 −0
Original line number Diff line number Diff line
@@ -3239,6 +3239,24 @@ rustfs: 
    accessKey: rustfsadmin

    # -- RustFS admin password. Ignored when existingSecret is set.

    secretKey: rustfsadmin

  persistence:

    # Static, hostPath-backed persistence for RustFS's data/logs PVCs,

    # matching the same <meep-workdir>/<component>/ convention used by the

    # rest of MEEP's persistent components (see e.g.

    # charts/kube-prometheus-stack/templates/prometheus/persistentvolume.yaml).

    # Disabled by default, so a plain `helm install` of this chart still gets

    # RustFS's own dynamic provisioning (rustfs.storageclass.name) unchanged.

    # meepctl sets these three values together when it engages the RustFS

    # fallback, so RustFS's data lands under ~/.meep like everything else

    # instead of local-path-provisioner's own arbitrary directories.

    hostPath:

      # -- Create static PersistentVolumes backed by hostPath instead of

      # relying on rustfs.storageclass.name for dynamic provisioning.

      enabled: false

      # -- Host path backing the RustFS data PVC.

      dataLocation: ""

      # -- Host path backing the RustFS logs PVC.

      logsLocation: ""



# ======================================================================

# kube-prometheus-stack subchart (optional)

go-apps/meep-iot-pltf/meep-acme-in-cse/Dockerfile

+4 −2
Original line number Diff line number Diff line
@@ -44,9 +44,11 @@ ENV MEC_SANDBOX_SERVER="" 


RUN echo "meep-acme-in-cse" > /etc/hostname



COPY ./data/requirements.txt /usr/src/app/ACME-oneM2M-CSE/requirements.txt

RUN pip3 install --no-cache-dir -r requirements.txt --break-system-packages



COPY ./data /usr/src/app/ACME-oneM2M-CSE



RUN chmod +x entrypoint.sh \

  && pip3 install --no-cache-dir -r requirements.txt --break-system-packages

RUN chmod +x entrypoint.sh



ENTRYPOINT ["./entrypoint.sh"]
 
 No newline at end of file

go-apps/meep-iot-pltf/meep-acme-mn-cse/Dockerfile

+4 −2
Original line number Diff line number Diff line
@@ -51,11 +51,13 @@ ENV ACME_IN_SERVICE_NAME="" 


RUN echo "meep-acme-mn-cse" > /etc/hostname



COPY ./data/requirements.txt /usr/src/app/ACME-oneM2M-CSE/requirements.txt

RUN pip3 install --no-cache-dir -r requirements.txt --break-system-packages



COPY ./data /usr/src/app/ACME-oneM2M-CSE



RUN cp -r ./acme/* ./acmecse/ && rm -rf ./acme || true



RUN chmod +x entrypoint.sh \

  && pip3 install --no-cache-dir -r requirements.txt --break-system-packages

RUN chmod +x entrypoint.sh



ENTRYPOINT ["./entrypoint.sh"]

go-apps/meep-iot-pltf/meep-acme-mn-cse/acme.ini.in

+1 −1
Original line number Diff line number Diff line
@@ -44,7 +44,7 @@ allowedCSROriginators=/* 


[cse.registrar]

INCSEcseID=/$REMOTE_CSE_ID

address=https://${basic.config:registrarCseHost}:${basic.config:registrarCsePort}/

address=https://${basic.config:registrarCseHost}:${basic.config:registrarCsePort}

root=$REMOTE_SVC_PATH



[textui]