Feature/trace-collector-service #12

sankalpatimilsina12 · 2025-02-28T15:35:57Z

This adds a dockerized trace collection service.

The directory has been renamed from the original ndntdump-exp-2023 to generic traces which will be present on the host and will contain collected traces.
The image is under ghcr, tagged and is under a username, happy to upload elsewhere.

Source repository: https://github.com/tntech-ngin/ndn-traffic-capture-scripts/tree/feature/docker

Pesa

Please squash the commits.

docker-compose.yml

yoursunny · 2025-02-28T21:09:44Z

docker-compose.yml

+    volumes:
+      - /home/.ssh:/root/.ssh:ro
+      - /home/ndnops/traces:/dump
+      - ${PWD}/dist/nlsr:/config


Do you really need write access to the ${PWD}/dist/nlsr folder?

I was trying to figure this out, we need the nlsr.conf file, but the read access should be enough.

This was a semi-hack we had in the old scripts to get a unique "node name", IIRC. I think we can do better now with the new framework, e.g. pass the name to the container via env or something...

@pulsejet what's the easiest way to pass the site from host_vars to the container?

Create a new config template, have the container read off it.

The latest commit has an entrypoint.sh.j2 template which directly reads site name.

docker-compose.yml

yoursunny · 2025-02-28T21:47:47Z

As discussed in 2025-02-28 meeting, the SSH key pair should be handled as follows:

trace-collector should not use the SSH key pair that belongs to the operator or assume its existence.
trace-collector should mount a Docker volume that contains its own SSH key pair (for convenience, it could be mounted at /root/.ssh).
The public key of the trace-collector's key pair should be published through file-server. This could be achieved by mounting a sub-directory of what's served by the file-server (for example, ${PWD}/dist/file-server/trace-collector-pubkey).

Upon service start, the entrypoint script should perform the following:

If the SSH key pair does not exist in the mountpoint of the Docker volume, generate a key pair noninteractively.
Copy the public key to a directory published by the file-server. This should be done unconditionally, even if the key pair wasn't generated in this session, because it is possible that last time the container crashed between key pair generation and copying.
Invoke the main script.

After the first run of the service, the public key of a router shall be retrievable with ndncat command:

ndncat get-segmented /ndn/edu/neu/file-server/trace-collector-pubkey/id_ed25519.pub

sankalpatimilsina12 · 2025-03-28T15:26:50Z

The entrypoint.sh.j2 has the included flow as discussed. I have added two persistent volume claims for dump and ssh storage, which were added for preserving keys and dumps. The flow was locally verified at my end.

Site is read in the template and cleaned. Eg. /edu/memphis get converted to edu_memphis.
Ssh keys are generated if not already present and copied to fileserver's subdirectory for trace-collector.
Main script is then invoked with the cleaned site name.
Commits squashed.

If we just mount ssh and dump subdirectories under the trace-collector ($PWD/dist/trace-collector/.ssh, etc.), it probably should be enough instead of asking persistent volumes. Please suggest what's best. @pulsejet

Pesa · 2025-03-28T19:46:40Z

templates/trace-collector/entrypoint.sh.j2

+# Ensure permissions
+mkdir -p "$SSH_DIR"
+chmod 700 "$SSH_DIR"


ssh-keygen should already take care of this, no?

Pesa · 2025-03-28T19:49:26Z

templates/trace-collector/entrypoint.sh.j2

+# Generate SSH key pair if not already present
+if [[ ! -f "$PRIVATE_KEY" || ! -f "$PUBLIC_KEY" ]]; then
+    echo "[trace-collector] No SSH key pair found. Generating a new one..."
+    ssh-keygen -t rsa -b 4096 -N "" -f "$PRIVATE_KEY"


can we use ed25519 instead of rsa?

Pesa · 2025-03-28T19:54:47Z

templates/trace-collector/entrypoint.sh.j2

+SSH_DIR="/root/.ssh"
+PRIVATE_KEY="$SSH_DIR/id_rsa"
+PUBLIC_KEY="$SSH_DIR/id_rsa.pub"
+PUBKEY_EXPORT_PATH="/file-server/trace-collector-pubkey/id_rsa.pub"


Just set this to the directory instead of the file name, it seems simpler. The file name should just be the standard one used by openssh (e.g. id_rsa.pub or id_ed25519.pub).

The same applies to the previous two variables. Specifying the file name seems pointless unless there's a way to pass a different identity to the container. If we don't have a use case for this, just keep it simple and use the default openssh naming conventions.

The file name has been referenced multiple times in the script: Checking existence, non-interactive generation with the file name specified, and during copying. Should we keep the private and public key variables? The export path I believe can just be a directory name.

Should we keep the private and public key variables?

If you prefer to use a variable, that's fine. But one variable for the private key should be enough, the public key name should always be privatekey + .pub per openssh conventions.

The export path I believe can just be a directory name.

On second thought, we should really avoid using a dot in the NDN name of the pubkey (e.g. id_rsa.pub) because one dot becomes four dots in NDN URI syntax, which is quite ugly. I'd say just use the directory name trace-collector-pubkey as the actual key name. I don't think we need a subdir for this.

one dot becomes four dots in NDN URI syntax

False.
One dot becomes four dots only if the component consists solely of dots.

If you prefer to use a variable, that's fine. But one variable for the private key should be enough, the public key name should always be privatekey + .pub per openssh conventions.

Sure.

Pesa · 2025-03-28T20:01:10Z

docker-compose.yml

+    restart: unless-stopped
+    depends_on:
+      nfd: { condition: service_healthy }
+      file-server: { condition: service_healthy }


is there an actual dependency on the file server?

I put this there I think from a documentary perspective, there is no actual dependency. It should be just nfd.

sankalpatimilsina12 mentioned this pull request Feb 28, 2025

Add trace-collector service sankalpatimilsina12/testbed#1

Draft

Pesa reviewed Feb 28, 2025

View reviewed changes

docker-compose.yml Outdated Show resolved Hide resolved

yoursunny suggested changes Feb 28, 2025

View reviewed changes

Add trace-collector service

6d82848

sankalpatimilsina12 force-pushed the feature/trace-collector-service branch from 1199061 to 6d82848 Compare March 28, 2025 15:12

Pesa reviewed Mar 28, 2025

View reviewed changes

Feature/trace-collector-service #12

Are you sure you want to change the base?

Feature/trace-collector-service #12

Uh oh!

Conversation

sankalpatimilsina12 commented Feb 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Pesa left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sankalpatimilsina12 Feb 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

yoursunny commented Feb 28, 2025

Uh oh!

sankalpatimilsina12 commented Mar 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sankalpatimilsina12 commented Feb 28, 2025 •

edited

Loading

sankalpatimilsina12 Feb 28, 2025 •

edited

Loading

sankalpatimilsina12 commented Mar 28, 2025 •

edited

Loading