From 58424fccc72dc8ab00f090a2ae382e345c35f351 Mon Sep 17 00:00:00 2001 From: Lakehouse Admin Date: Tue, 19 May 2026 23:18:48 +0200 Subject: [PATCH] Improve ObjectScale on dashboard and document management_clients - Split ObjectScale into UI, S3 API, and SSH tiles on OPS tab - Add docs/objectscale.md explaining 0.0.0.0/0 and lab ports - Dedicated Object Storage row in homepage layout --- config/homepage/services.yaml | 16 +++++++-- config/homepage/settings.yaml | 4 +++ config/objectscale/README.md | 18 ++++++++++ docs/objectscale.md | 57 ++++++++++++++++++++++++++++++++ scripts/backup/check-services.sh | 34 +++++++++++++++++++ 5 files changed, 127 insertions(+), 2 deletions(-) create mode 100644 docs/objectscale.md create mode 100644 scripts/backup/check-services.sh diff --git a/config/homepage/services.yaml b/config/homepage/services.yaml index a191dee..ad8eec7 100644 --- a/config/homepage/services.yaml +++ b/config/homepage/services.yaml @@ -81,12 +81,24 @@ color: "#F46800" - Infrastructure: - - ObjectScale: + - ObjectScale UI: icon: http://atc-docker01.dell-atc.lan:8080/dell.svg href: https://10.0.20.111/ - description: 10.0.20.111 + description: ECS admin · https://10.0.20.111 · luna.local siteMonitor: https://10.0.20.111/ color: "#007DB8" + - ObjectScale S3: + icon: http://atc-docker01.dell-atc.lan:8080/minio.svg + href: http://10.0.20.111:9020/ + description: S3 API :9020 · bucket data · Trino Iceberg + Spark + siteMonitor: http://10.0.20.111:9020/ + color: "#C72C48" + - ObjectScale SSH: + icon: mdi-console + href: https://10.0.20.111/ + description: admin@atc-objectscale · appliance SSH · see docs/objectscale.md + ping: 10.0.20.111 + color: "#64748b" - iDRAC: icon: http://atc-docker01.dell-atc.lan:8080/dell.svg href: https://10.0.41.102/ diff --git a/config/homepage/settings.yaml b/config/homepage/settings.yaml index 650c8c4..f884d11 100644 --- a/config/homepage/settings.yaml +++ b/config/homepage/settings.yaml @@ -27,6 +27,10 @@ layout: tab: OPS style: row columns: 4 + Object Storage: + tab: OPS + style: row + columns: 3 Infrastructure: tab: OPS style: row diff --git a/config/objectscale/README.md b/config/objectscale/README.md index c98a2a0..c75a5fd 100644 --- a/config/objectscale/README.md +++ b/config/objectscale/README.md @@ -27,3 +27,21 @@ ## Storage Single-node lab deployment; block device `/dev/sdb` in storage pool `sp1` per deploy.yml. + +## management_clients: 0.0.0.0/0 explained + +**`0.0.0.0/0` = allow management access from ANY IP address** (no whitelist). + +- Fine for isolated lab VLANs behind firewall +- **Not OK** if management port is reachable from office internet or WAN + +**Recommended for ATC lab** (tighten when convenient): + +```yaml +management_clients: + - 10.0.10.0/24 + - 10.0.20.0/24 + - 10.0.21.0/24 +``` + +See [docs/objectscale.md](../../docs/objectscale.md) for ports and S3 consumers. diff --git a/docs/objectscale.md b/docs/objectscale.md new file mode 100644 index 0000000..6e102e9 --- /dev/null +++ b/docs/objectscale.md @@ -0,0 +1,57 @@ +# Dell ObjectScale (ECS) — atc-objectscale + +| Item | Value | +|------|-------| +| Hostname | `luna.local` / `atc-objectscale` | +| IP | `10.0.20.111` | +| SSH | `admin@10.0.20.111` (appliance; root via sudo keys) | +| Management UI | https://10.0.20.111/ (port **443**) | +| S3 API | http://10.0.20.111:**9020** | +| Container | `ecs-storageos` (`emccorp/ecs-software`) | +| Install config | `/opt/emc/ecs-install/deploy.yml` | + +## What is `management_clients: 0.0.0.0/0`? + +In `deploy.yml`, this setting controls **which client IP addresses may access ECS management ports** (admin API, node management, not the S3 data path). + +| Value | Meaning | +|-------|---------| +| `0.0.0.0/0` | **Everyone on any network** — entire Internet can reach management ports if routed/firewall allows | +| `10.0.20.0/24` | Only hosts in `10.0.20.x` subnet | +| `10.0.21.45` | Only that single host | + +**Lab default:** installer often sets `0.0.0.0/0` for convenience (= no IP whitelist). +**Production:** restrict to management subnet only, e.g.: + +```yaml +management_clients: + - 10.0.10.0/24 # Proxmox / mgmt + - 10.0.20.0/24 # storage VLAN + - 10.0.21.0/24 # compute VLAN +``` + +Changing this requires editing `/opt/emc/ecs-install/deploy.yml` on the appliance and may need an ECS config apply — plan a maintenance window. + +## S3 usage in this lab + +| Consumer | Bucket / path | Config | +|----------|---------------|--------| +| Trino Iceberg | via `iceberg.properties` | `hive.s3.endpoint=http://10.0.20.111:9020` | +| Spark jobs | bucket `data` | `/opt/spark-jobs/*.py` on lake01 | +| AWS CLI | `aws --endpoint-url http://10.0.20.111:9020` | keys in Trino catalog (redacted in git) | + +## Ports (reference) + +| Port | Service | +|------|---------| +| 443 | ECS Management UI (HTTPS) | +| 9020 | S3 API | +| 4443 | ECS API (nginx) | +| 9021–9025 | Data head services (internal) | + +## Health check + +```bash +curl -sk -o /dev/null -w "%{http_code}\n" https://10.0.20.111/ # expect 200 +curl -s -o /dev/null -w "%{http_code}\n" http://10.0.20.111:9020/ # expect 403 without auth (normal) +``` diff --git a/scripts/backup/check-services.sh b/scripts/backup/check-services.sh new file mode 100644 index 0000000..cffa346 --- /dev/null +++ b/scripts/backup/check-services.sh @@ -0,0 +1,34 @@ +#!/usr/bin/env bash +# Health check all ATC lab HTTP endpoints (from homepage siteMonitors). +set -u + +FAIL=0 +check() { + local name="$1" url="$2" + local code + code=$(curl -sk -o /dev/null -w "%{http_code}" --connect-timeout 5 --max-time 10 "$url" 2>/dev/null || echo "000") + if [[ "$code" =~ ^(200|301|302|303|401|403)$ ]]; then + printf "OK %-28s %s (%s)\n" "$name" "$url" "$code" + else + printf "FAIL %-28s %s (%s)\n" "$name" "$url" "$code" + FAIL=$((FAIL + 1)) + fi +} + +check "Homepage" "http://atc-docker01.dell-atc.lan/" +check "RSS proxy" "http://atc-docker01.dell-atc.lan:8090/health" +check "Superset" "http://atc-docker01.dell-atc.lan:8088/health" +check "Kafka UI" "http://atc-kafka01.dell-atc.lan:9000/" +check "Debezium" "http://atc-lake01.dell-atc.lan:8083/" +check "Spark" "http://atc-lake01.dell-atc.lan:8080/" +check "Trino" "http://atc-lake01.dell-atc.lan:8089/ui/" +check "Airflow" "http://10.0.21.55:8080/" +check "Kibana" "http://atc-elastic01.dell-atc.lan:5601/" +check "Grafana" "http://atc-grafana.dell-atc.lan:3000/api/health" +check "Forgejo" "http://atc-mgt01.dell-atc.lan:3001/" +check "ObjectScale" "https://10.0.20.111/" +check "Proxmox" "https://10.0.10.65:8006/" + +echo "---" +[[ $FAIL -eq 0 ]] && echo "All checks passed" && exit 0 +echo "$FAIL check(s) failed" && exit 1