DataDog / KubeHound

Kubernetes Attack Graph
https://kubehound.io
Apache License 2.0
705 stars 39 forks source link

JanusGraph server doesn't start #129

Closed ecancino-ncl closed 9 months ago

ecancino-ncl commented 9 months ago

Describe the bug When i'm preparing Kubehound to run, I execute the ./kubehound.sh backend-up command but it fails to get container JanusGraph Server running, it keeps restarting with the message: waiting for JanusGraph Server... /etc/opt/janusgraph/janusgraph-server.yaml will be used to start JanusGraph Server in foreground

To Reproduce Steps to reproduce the behavior:

  1. Download the binary
  2. Execute "./kubehound.sh backend-up"

Expected behavior Get the backend services running.

Screenshots Captura de pantalla 2023-10-09 a la(s) 15 32 20 Captura de pantalla 2023-10-09 a la(s) 15 32 32 Captura de pantalla 2023-10-09 a la(s) 15 32 43

Desktop (please complete the following information):

Additional context

Downloaded release: https://github.com/DataDog/KubeHound/releases/latest/download/KubeHound_Darwin_arm64.tar.gz Result of docker inspect command: [ { "Id": "fd520a0c2ad222dceacc58b830dc61458ce23d3820575184c3efd851ef0da712", "Created": "2023-10-09T18:22:05.43352592Z", "Path": "docker-entrypoint.sh", "Args": [ "janusgraph" ], "State": { "Status": "restarting", "Running": true, "Paused": false, "Restarting": true, "OOMKilled": false, "Dead": false, "Pid": 0, "ExitCode": 137, "Error": "", "StartedAt": "2023-10-09T18:35:54.363988398Z", "FinishedAt": "2023-10-09T18:36:00.551024818Z", "Health": { "Status": "unhealthy", "FailingStreak": 0, "Log": [] } }, "Image": "sha256:f3c1795355a9da8c31065d8ed42be3bc82f0956987b6b8c2f96863ed63e658d5", "ResolvConfPath": "/var/lib/docker/containers/fd520a0c2ad222dceacc58b830dc61458ce23d3820575184c3efd851ef0da712/resolv.conf", "HostnamePath": "/var/lib/docker/containers/fd520a0c2ad222dceacc58b830dc61458ce23d3820575184c3efd851ef0da712/hostname", "HostsPath": "/var/lib/docker/containers/fd520a0c2ad222dceacc58b830dc61458ce23d3820575184c3efd851ef0da712/hosts", "LogPath": "/var/lib/docker/containers/fd520a0c2ad222dceacc58b830dc61458ce23d3820575184c3efd851ef0da712/fd520a0c2ad222dceacc58b830dc61458ce23d3820575184c3efd851ef0da712-json.log", "Name": "/kubehound-release-graphdb", "RestartCount": 21, "Driver": "overlay2", "Platform": "linux", "MountLabel": "", "ProcessLabel": "", "AppArmorProfile": "", "ExecIDs": null, "HostConfig": { "Binds": null, "ContainerIDFile": "", "LogConfig": { "Type": "json-file", "Config": {} }, "NetworkMode": "kubehound-release_kubenet", "PortBindings": { "8099/tcp": [ { "HostIp": "127.0.0.1", "HostPort": "8099" } ], "8182/tcp": [ { "HostIp": "127.0.0.1", "HostPort": "8182" } ] }, "RestartPolicy": { "Name": "unless-stopped", "MaximumRetryCount": 0 }, "AutoRemove": false, "VolumeDriver": "", "VolumesFrom": null, "ConsoleSize": [ 0, 0 ], "CapAdd": null, "CapDrop": null, "CgroupnsMode": "host", "Dns": null, "DnsOptions": null, "DnsSearch": null, "ExtraHosts": [], "GroupAdd": null, "IpcMode": "private", "Cgroup": "", "Links": null, "OomScoreAdj": 0, "PidMode": "", "Privileged": false, "PublishAllPorts": false, "ReadonlyRootfs": false, "SecurityOpt": null, "UTSMode": "", "UsernsMode": "", "ShmSize": 67108864, "Runtime": "runc", "Isolation": "", "CpuShares": 0, "Memory": 0, "NanoCpus": 0, "CgroupParent": "", "BlkioWeight": 0, "BlkioWeightDevice": null, "BlkioDeviceReadBps": null, "BlkioDeviceWriteBps": null, "BlkioDeviceReadIOps": null, "BlkioDeviceWriteIOps": null, "CpuPeriod": 0, "CpuQuota": 0, "CpuRealtimePeriod": 0, "CpuRealtimeRuntime": 0, "CpusetCpus": "", "CpusetMems": "", "Devices": null, "DeviceCgroupRules": null, "DeviceRequests": null, "MemoryReservation": 0, "MemorySwap": 0, "MemorySwappiness": null, "OomKillDisable": false, "PidsLimit": null, "Ulimits": null, "CpuCount": 0, "CpuPercent": 0, "IOMaximumIOps": 0, "IOMaximumBandwidth": 0, "Mounts": [ { "Type": "volume", "Source": "kubehound-release_kubegraph_data", "Target": "/var/lib/janusgraph", "VolumeOptions": {} } ], "MaskedPaths": [ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "ReadonlyPaths": [ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ] }, "GraphDriver": { "Data": { "LowerDir": "/var/lib/docker/overlay2/a4d0d3507b25b3eaca82f7ec2b0f2da04ffdb8ded599efc8a19c5feda1cdbb93-init/diff:/var/lib/docker/overlay2/a8f1f28540588e07eb04508c4ee81e06cbf63a434bddc4575f6d0f78811aa206/diff:/var/lib/docker/overlay2/d8b8f0cf1c7d20ac1c9642a8240d31655941896d09a41109504b65dea143e960/diff:/var/lib/docker/overlay2/56e71f8b61ab95b5a97f40455eecaf077b9acac07ef6641803f3c40b8796b36b/diff:/var/lib/docker/overlay2/2cd3fbfd7d130c5acf7230da098c5ac60e87399341827c319339119c8fc442d9/diff:/var/lib/docker/overlay2/6a624f092c6fd385d4a2a8626355c0b4537d18e956898b2b82c56a68152b978a/diff:/var/lib/docker/overlay2/d8099fe4a558b3705888a2b12a5ae05a343fc20f2a75c44e42654736a5a951b3/diff:/var/lib/docker/overlay2/9dff0fb5759d9d75b6ddd06553afe49478bed680a9564e95c9b243683d3233e1/diff:/var/lib/docker/overlay2/5410c92351bf7f10543d765b0db4030b53b1ec44c0229484ad2d6eed4bf8fdad/diff:/var/lib/docker/overlay2/a189c64337fae26d5ab6dbbd1b4e5e3ff728c640a161f26c23ec1a18259a2647/diff:/var/lib/docker/overlay2/c055c39615279e85958e5e8ecbacff557777b4bc35d6d709d56c62d6cbdcdbc7/diff:/var/lib/docker/overlay2/d05018347d73099dc3876478199684e128ef8ed1b873d8d9826710bbc070f061/diff:/var/lib/docker/overlay2/4222835c026936d9a752fd7304ee326d0d7242d244020418801fe981fdb4b587/diff:/var/lib/docker/overlay2/d683f794fcc53c911b941a37ddd2ccabd4110cf6ff15d5588ef40a7d4447e7c8/diff:/var/lib/docker/overlay2/6b054a1c0575c7ee608a87c114fbbc36695a3f38e07f22b2a274a13b359b7efb/diff:/var/lib/docker/overlay2/b905ff1b12468ba208dd0fb71eedf33535b147fa771d6ce10379cc38e68a3842/diff:/var/lib/docker/overlay2/ef48b8ee0977d8d177a87afb8d0a7c5032138bc8380ecc0e20b4fa61d0586e6e/diff:/var/lib/docker/overlay2/0433d70d3b548974a90e1e3321a1c4c1751da7adddb163a39cb586d94a8510e3/diff:/var/lib/docker/overlay2/aca1f2a6d43ee32b1755a64315fe81e420bb77aae380baa207dc4d39fc8016be/diff:/var/lib/docker/overlay2/b565d6cdaf625d36b016a7892397e194538b98ff3403c87118acd4d55d7e0e3f/diff", "MergedDir": "/var/lib/docker/overlay2/a4d0d3507b25b3eaca82f7ec2b0f2da04ffdb8ded599efc8a19c5feda1cdbb93/merged", "UpperDir": "/var/lib/docker/overlay2/a4d0d3507b25b3eaca82f7ec2b0f2da04ffdb8ded599efc8a19c5feda1cdbb93/diff", "WorkDir": "/var/lib/docker/overlay2/a4d0d3507b25b3eaca82f7ec2b0f2da04ffdb8ded599efc8a19c5feda1cdbb93/work" }, "Name": "overlay2" }, "Mounts": [ { "Type": "volume", "Name": "kubehound-release_kubegraph_data", "Source": "/var/lib/docker/volumes/kubehound-release_kubegraph_data/_data", "Destination": "/var/lib/janusgraph", "Driver": "local", "Mode": "z", "RW": true, "Propagation": "" } ], "Config": { "Hostname": "fd520a0c2ad2", "Domainname": "", "User": "janusgraph", "AttachStdin": false, "AttachStdout": true, "AttachStderr": true, "ExposedPorts": { "8099/tcp": {}, "8182/tcp": {} }, "Tty": false, "OpenStdin": false, "StdinOnce": false, "Env": [ "PATH=/opt/java/openjdk/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "JAVA_HOME=/opt/java/openjdk", "LANG=en_US.UTF-8", "LANGUAGE=en_US:en", "LC_ALL=en_US.UTF-8", "JAVA_VERSION=jdk-11.0.20.1+1", "JANUS_VERSION=1.0.0-rc2", "JANUS_HOME=/opt/janusgraph", "JANUS_CONFIG_DIR=/etc/opt/janusgraph", "JANUS_DATA_DIR=/var/lib/janusgraph", "JANUS_SERVER_TIMEOUT=30", "JANUS_STORAGE_TIMEOUT=60", "JANUS_PROPS_TEMPLATE=berkeleyje-lucene", "JANUS_INITDB_DIR=/docker-entrypoint-initdb.d", "gremlinserver.graphs.graph=/etc/opt/janusgraph/janusgraph.properties", "gremlinserver.threadPoolWorker=8", "gremlinserver.gremlinPool=0", "JAVA_OPTIONS_FILE=/opt/janusgraph/conf/jvm.options", "janusgraph.ids.block-size=3000000", "janusgraph.schema.constraints=true", "janusgraph.schema.default=none", "gremlinserver.maxContentLength=2097152", "gremlinserver.evaluationTimeout=240000", "gremlinserver.metrics.jmxReporter.enabled=true", "gremlinserver.metrics.consoleReporter.enabled=false", "gremlinserver.metrics.slf4jReporter.enabled=false", "gremlinserver.metrics.graphiteReporter.enabled=false", "gremlinserver.metrics.csvReporter.enabled=false", "gremlinserver.scriptEngines.gremlin-groovy.plugins[org.apache.tinkerpop.gremlin.jsr223.ImportGremlinPlugin].classImports[+]=com.datadog.ase.kubehound.EndpointExposure", "gremlinserver.scriptEngines.gremlin-groovy.plugins[org.apache.tinkerpop.gremlin.jsr223.ScriptFileGremlinPlugin].files[+]=scripts/kubehound-dsl-init.groovy" ], "Cmd": [ "janusgraph" ], "Healthcheck": { "Test": [ "CMD", "bin/gremlin.sh", "-e", "scripts/remote-connect.groovy" ], "Interval": 30000000000, "Timeout": 30000000000, "Retries": 3 }, "Image": "ghcr.io/datadog/kubehound-graph:latest", "Volumes": null, "WorkingDir": "/opt/janusgraph", "Entrypoint": [ "docker-entrypoint.sh" ], "OnBuild": null, "Labels": { "com.datadoghq.ad.logs": "[{\"app\": \"kubegraph\", \"service\": \"kubehound\"}]", "com.docker.compose.config-hash": "b9d8951c4c51d1f6e87eccf848003100083486f7d69a578abc59bc7db7cd14c1", "com.docker.compose.container-number": "1", "com.docker.compose.depends_on": "", "com.docker.compose.image": "sha256:f3c1795355a9da8c31065d8ed42be3bc82f0956987b6b8c2f96863ed63e658d5", "com.docker.compose.oneoff": "False", "com.docker.compose.project": "kubehound-release", "com.docker.compose.project.config_files": "xxxxxx/kubehound/deployments/kubehound/docker-compose.yaml,/xxxxx/kubehound/deployments/kubehound/docker-compose.release.yaml", "com.docker.compose.project.working_dir": "/xxxxx/kubehound/deployments/kubehound", "com.docker.compose.service": "kubegraph", "com.docker.compose.version": "2.19.0", "org.opencontainers.image.created": "”2023-09-06T06:40:31Z”", "org.opencontainers.image.description": "Official JanusGraph Docker image", "org.opencontainers.image.documentation": "https://docs.janusgraph.org/v1.0/", "org.opencontainers.image.license": "Apache-2.0", "org.opencontainers.image.ref.name": "ubuntu", "org.opencontainers.image.revision": "30b9415", "org.opencontainers.image.source": "https://github.com/DataDog/kubehound/", "org.opencontainers.image.title": "JanusGraph Docker Image", "org.opencontainers.image.url": "https://janusgraph.org/", "org.opencontainers.image.vendor": "JanusGraph", "org.opencontainers.image.version": "1.0.0-rc2" } }, "NetworkSettings": { "Bridge": "", "SandboxID": "34b830f2f44a76437e74d97000d8d856147a79cdebcff0e5fd65616f41dd9858", "HairpinMode": false, "LinkLocalIPv6Address": "", "LinkLocalIPv6PrefixLen": 0, "Ports": {}, "SandboxKey": "/var/run/docker/netns/34b830f2f44a", "SecondaryIPAddresses": null, "SecondaryIPv6Addresses": null, "EndpointID": "", "Gateway": "", "GlobalIPv6Address": "", "GlobalIPv6PrefixLen": 0, "IPAddress": "", "IPPrefixLen": 0, "IPv6Gateway": "", "MacAddress": "", "Networks": { "kubehound-release_kubenet": { "IPAMConfig": null, "Links": null, "Aliases": [ "kubehound-release-graphdb", "kubegraph", "fd520a0c2ad2" ], "NetworkID": "7a91697d9e723b2273592ad7051ee85f9406e04e654116c6ba30676599324450", "EndpointID": "", "Gateway": "", "IPAddress": "", "IPPrefixLen": 0, "IPv6Gateway": "", "GlobalIPv6Address": "", "GlobalIPv6PrefixLen": 0, "MacAddress": "", "DriverOpts": null } } } } ]

jt-dd commented 9 months ago

Hello @ecancino-ncl ,

How much RAM did you allocate to docker ? This info can be found from:

Also does the screenshot about docker logs kubehound-release-graphdb shows all the logs ?

ecancino-ncl commented 9 months ago

Hello @jt-dd,

Initially i allocated 4 GB of RAM, after letting the container restart multiple times, I got more logs where it says that there was insufficient memory. Now i allocated 8 GB for Docker and started right away.

Is there any way to reduce the memory usage of JanusGraph? Saw a jvm.options file but i'm not sure if modifying Heap settings will work.

d0g0x01 commented 9 months ago

You are correct - if you modify the jvm.options file you will be able to reduce the heap memory. However depending on the size of your cluster you might trigger OOM errors, but you should be fine for smaller clusters