pollinate should not run in containers and only for first boot

Bug #1578833 reported by Martin Pitt on 2016-05-05
10
This bug affects 1 person
Affects Status Importance Assigned to Milestone
pollinate (Ubuntu)
Low
Martin Pitt
Trusty
Undecided
Unassigned
Xenial
Low
Martin Pitt

Bug Description

Booting a xenial cloud image in lxd shows that pollinate by far is the biggest bottleneck:

$ systemd-analyze blame
  2.756s pollinate.service
   656ms cloud-init-local.service
   598ms cloud-init.service
   509ms cloud-config.service
   393ms cloud-final.service
   147ms networking.service
[...]

This is the second boot, so cloud-init should not actually do anything any more (it takes muuuch longer on the first boot).

pollinate should not run in containers at all, as containers take randomness from the host. Also, for VMs it should only run for the first boot. Both upstart and systemd save the random seed on shutdown and load it at boot, which is a lot faster than pollinate.

So pollinate.service should grow

  ConditionVirtualization=!container
  ConditionPathExists=!/var/lib/systemd/random-seed

== SRU ==

[IMPACT]
Some Xenial boots take longer than they should. Pollinate should only run once, at first boot, and never in containers. And should never take longer than 3 seconds.

[TEST CASE]
Boot a new Xenial instance. Ensure that pollinate runs the first time it boots. You can check that in /var/log/syslog and ensure that /var/cache/pollinate/seeded exists /var/cache/pollinate/log. Now reboot that instance. Ensure that more, new entries do *not* show up.

[REGRESSION POTENTIAL]
The regression potential is important. We need to ensure that we don't somehow *never* pollinate the first time.

Martin Pitt (pitti) on 2016-05-05
tags: added: bootspeed
tags: added: cloud-image xenial
Martin Pitt (pitti) on 2016-05-05
Changed in pollinate (Ubuntu):
status: New → Fix Committed
assignee: nobody → Martin Pitt (pitti)
importance: Undecided → Low
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package pollinate - 4.16-0ubuntu1

---------------
pollinate (4.16-0ubuntu1) yakkety; urgency=medium

  [ Martin Pitt ]
  * Don't run pollinate.service in containers (as containers can't and should
    not write the host's random pool) and when we already have a saved random
    seeds (i. e. only on first boot). (LP: #1578833)
  * Bump Standards-Version to 3.9.8 (no changes needed).

  [ Dustin Kirkland ]
  * pollinate: use timeout(1) to limit curl, related to LP: #1578833

 -- Dustin Kirkland <email address hidden> Wed, 09 Mar 2016 17:38:22 -0500

Changed in pollinate (Ubuntu):
status: Fix Committed → Fix Released
Martin Pitt (pitti) on 2016-05-05
Changed in pollinate (Ubuntu Xenial):
status: New → Triaged
assignee: nobody → Martin Pitt (pitti)
importance: Undecided → Low
Changed in pollinate (Ubuntu Xenial):
milestone: none → xenial-updates
Changed in pollinate (Ubuntu Xenial):
status: Triaged → In Progress
description: updated

Hello Martin, or anyone else affected,

Accepted pollinate into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/pollinate/4.18-0ubuntu1~16.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in pollinate (Ubuntu Xenial):
status: In Progress → Fix Committed
tags: added: verification-needed
Martin Pitt (pitti) wrote :

I confirm that with the proposed package,

 - pollinate does not start at all in a container (tested LXD)
 - pollinate starts once in a VM, but not at the second boot any more.

tags: added: verification-done
removed: verification-needed
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package pollinate - 4.18-0ubuntu1~16.04

---------------
pollinate (4.18-0ubuntu1~16.04) xenial-proposed; urgency=medium

  * debian/pollinate.service:
    - move to later in boot, after network starts, but before ssh starts

pollinate (4.17-0ubuntu1) yakkety; urgency=medium

  * debian/pollinate.service:
    - use the right flag file for LP: #1578833

pollinate (4.16-0ubuntu1) yakkety; urgency=medium

  [ Martin Pitt ]
  * Don't run pollinate.service in containers (as containers can't and should
    not write the host's random pool) and when we already have a saved random
    seeds (i. e. only on first boot). (LP: #1578833)
  * Bump Standards-Version to 3.9.8 (no changes needed).

  [ Dustin Kirkland ]
  * pollinate: use timeout(1) to limit curl, related to LP: #1578833

 -- Dustin Kirkland <email address hidden> Fri, 06 May 2016 11:36:02 -0500

Changed in pollinate (Ubuntu Xenial):
status: Fix Committed → Fix Released

The verification of the Stable Release Update for pollinate has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

tags: added: cloud-images
removed: cloud-image

Hello Martin, or anyone else affected,

Accepted pollinate into trusty-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/pollinate/4.21-0ubuntu1~14.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in pollinate (Ubuntu Trusty):
status: New → Fix Committed
tags: removed: verification-done
tags: added: verification-needed
Launchpad Janitor (janitor) wrote :
Download full text (4.1 KiB)

This bug was fixed in the package pollinate - 4.21-0ubuntu1~14.04

---------------
pollinate (4.21-0ubuntu1~14.04) trusty-proposed; urgency=medium

  [ Dustin Kirkland ]
  * pollinate:
    - fix broken printing of binary data, this was breaking check_pollen
      nagios scripts on the server

  [ Junien Fridrick ]
  * entropy.ubuntu.com.pem:
    - simplify CA cert to just the DigiCert chain (drop GoDaddy)

pollinate (4.20-0ubuntu1) yakkety; urgency=medium

  * debian/control:
    - drop the anerd references, hasn't existed in basically forever
    - update description
    - add dummy | dh-apparmor dependency to get this building on precise,
      where dh-systemd doesn't exist
    - drop run-one dependency, no longer needed
    - make the bsdutils dependency (for logger) explicit, add epoch
  * debian/rules:
    - use systemd, when possible
  * pollinate:
    - fix breakage on older (trusty, precise) Ubuntu, where logger does not
      support --id=[ID]; check version of bsdutils (provides logger) to
      ensure that it's at least ubuntu wily
    - cloud-init version string
  * debian/pollinate.service, debian/pollinate.upstart:
    - improve the init messages logged

pollinate (4.19-0ubuntu1) yakkety; urgency=medium

  [ Martin Pitt ]
  * debian/pollinate.service: Move installation from network.target to
    multi-user.target. network.target is too early and causes dependency loops
    with e. g. NFS. (LP: #1576333)
  * debian/pollinate.preinst: Clean up old enablement symlink on upgrade. This
    needs to be kept until after 18.04 LTS.

pollinate (4.18-0ubuntu1) yakkety; urgency=medium

  * debian/pollinate.service:
    - move to later in boot, after network starts, but before ssh starts

pollinate (4.17-0ubuntu1) yakkety; urgency=medium

  * debian/pollinate.service:
    - use the right flag file for LP: #1578833

pollinate (4.16-0ubuntu1) yakkety; urgency=medium

  [ Martin Pitt ]
  * Don't run pollinate.service in containers (as containers can't and should
    not write the host's random pool) and when we already have a saved random
    seeds (i. e. only on first boot). (LP: #1578833)
  * Bump Standards-Version to 3.9.8 (no changes needed).

  [ Dustin Kirkland ]
  * pollinate: use timeout(1) to limit curl, related to LP: #1578833

pollinate (4.15-0ubuntu1) xenial; urgency=medium

  * pollinate: LP: #1555362
    - log the right pid

pollinate (4.14-0ubuntu1) xenial; urgency=medium

  * pollinate, pollinate.1: LP: #1554152
    - change the failure mode of pollinate, so as to more cleanly
      tolerate network failures
    - add a --strict option to re-enable the previous behavior,
      ie, strictly exit non-zero if pollinate fails for any reason
    - we've always promised that pollinate would operate on a best-effort
      basis, improving the prng seeding when possible, but failing
      gracefully when not possible; as such, we've made good on the first
      half of that promise, however, the latter half has proven
      troublesome; this is due to the fact that if pollinate exits
      non-zero, then its callers (cloud-init, maas, etc.) may well
      interpret the behavior strictly as a failure to boot the system,
      when in ...

Read more...

Changed in pollinate (Ubuntu Trusty):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers