Hi Prefect Community! We are running our infrastructure on GKE Autopilot and have been seeing an in...
k

Keith

over 3 years ago
Hi Prefect Community! We are running our infrastructure on GKE Autopilot and have been seeing an increase in the number of
Crashed
jobs recently. I am trying to do root cause analysis on it so I start by digging through the logs in Prefect Cloud. What I see is that at some point (it is random) the logs stop and nothing further is output to the UI. Digging through the logs in Google Logs Explorer I see the same behavior, Prefect container logs stop at the same specific point in time. Inside Google Logs I am also able to see a lot of Kubernetes related logs and am starting to see a pattern but not clear how to fix it. • Roughly 5-10 seconds after the last log this shows up: ◦
INFO 2023-02-03T19:18:11Z [resource.labels.nodeName: gk3-prefect-autopilot-cl-nap-ji2s72nv-db29cac6-hxzc] marked the node as toBeDeleted/unschedulable
• Quickly followed by: ◦
INFO 2023-02-03T19:18:11Z [resource.labels.clusterName: prefect-autopilot-cluster-1] Scale-down: removing node gk3-prefect-autopilot-cl-nap-ji2s72nv-db29cac6-hxzc, utilization: {0.5538631957906397 0.1841863664058054 0 cpu 0.5538631957906397}, pods to reschedule: adorable-axolotl-d8k8c-6dx5c
INFO 2023-02-03T19:18:38Z [resource.labels.clusterName: prefect-autopilot-cluster-1] Scale-down: node gk3-prefect-autopilot-cl-nap-ji2s72nv-db29cac6-hxzc removed with drain
• GKE tries to reschedule the job but it fails with the following, which is when Prefect alerts for the
Crashed
state: ◦
INFO 2023-02-03T19:18:11Z [resource.labels.podName: adorable-axolotl-d8k8c-6dx5c] deleting pod for node scale down
ERROR 2023-02-03T19:18:19.215934101Z [resource.labels.containerName: prefect-job] 19:18:19.214 | INFO | prefect.engine - Engine execution of flow run '8ca83100-dcc3-46d5-91be-f342b19b45a9' aborted by orchestrator: This run cannot transition to the RUNNING state from the RUNNING state.
This appears to be happening on jobs randomly and leads me to believe that GKE believes the cluster is overprovisioned so it is trying to reduce the cluster size and move jobs around, but jobs can't be moved in the middle of execution and Crash/Fail. I am also curious if this is due to resource sizing, but I am not seeing any issues with the jobs I have been troubleshooting with
insufficient resource
problems. They all typically state the following in the
containerStatuses
leaf of the JSON element with the following message:
state: {
terminated: {
containerID: "<containerd://aac705>"
exitCode: 143
finishedAt: "2023-02-03T19:18:19Z"
reason: "Error"
startedAt: "2023-02-03T19:16:52Z"
}}
Any incite would be greatly appreciated!
<@ULVA73B9P> I want your help to fix and properly enhance my stack, here's my compose file: ```name...
m

Mohamed Zaki

12 months ago
@Marvin I want your help to fix and properly enhance my stack, here's my compose file:
name: prefect-wizard

services:
  nginx:
    image: nginx:latest
    ports:
      - "80:80" # Expose NGINX on port 80
    volumes:
      - ./proxies/nginx.conf:/etc/nginx/nginx.conf:ro
    depends_on:
      - server
      - api
      - keycloak
      - oauth2-proxy

  # VNC browser for local development to use for keycloak and oauth2-proxy
  browser:
    image: jlesage/firefox
    ports:
      - "5800:5800"
    environment:
      # Optional: Set a password for the VNC web interface
      - VNC_PASSWORD=my_password
    depends_on:
      - keycloak
      - oauth2-proxy
      - nginx

  keycloak:
    image: <http://quay.io/keycloak/keycloak:24.0|quay.io/keycloak/keycloak:24.0>
    command: [ "start-dev", "--http-port=8080" ]
    environment:
      KC_BOOTSTRAP_ADMIN_USERNAME: admin
      KC_BOOTSTRAP_ADMIN_PASSWORD: admin
      #KC_HOSTNAME: "keycloak"          # no path, just host (and optional port)
      KC_HOSTNAME_STRICT: "false" # dev convenience
      KC_HOSTNAME_STRICT_HTTPS: "false" # dev convenience
      KC_PROXY: "edge" # recommended when behind a proxy
    ports:
      - "8080:8080"
    volumes:
      - keycloak_data:/opt/keycloak/data
      - ./keycloak/local/config.json:/opt/keycloak/conf/realm-config.json

  oauth2-proxy:
    image: <http://quay.io/oauth2-proxy/oauth2-proxy:v7.5.1|quay.io/oauth2-proxy/oauth2-proxy:v7.5.1>
    extra_hosts:
      - "host.docker.internal:host-gateway"
    ports:
      - "4180:4180"
    command: [ "--config=/etc/oauth2-proxy.cfg" ]
    volumes:
      - "./proxies/oauth2-proxy.cfg:/etc/oauth2-proxy.cfg"
    depends_on:
      - keycloak


  api:
    build:
      context: .
      dockerfile: docker/api/nonprod/Dockerfile
    ports:
      - "9832:9832"
    environment:
      PREFECT_API_URL: <http://server:4200/api>
    volumes:
      - ./api:/app
      - ./autoupdate:/app/autoupdate
      - ./core:/app/core
    extra_hosts:
      - "host.docker.internal:host-gateway"
    env_file:
      - .env
    restart: always
    healthcheck:
      test: [ "CMD-SHELL", "curl -f <http://localhost:9832/health> || exit 1" ]
      interval: 5s
      timeout: 5s
      retries: 5

  db:
    ...

  redis:
    ...

  server:
    image: prefecthq/prefect:3.4.13-python3.11
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
    environment:
      PREFECT_API_DATABASE_CONNECTION_URL: <postgresql+asyncpg://prefect:prefect@db:5432/prefect>
      PREFECT_SERVER_API_HOST: 0.0.0.0
      PREFECT_UI_API_URL: "<http://localhost:4200/api>"
      PREFECT_MESSAGING_BROKER: prefect_redis.messaging
      PREFECT_MESSAGING_CACHE: prefect_redis.messaging
      PREFECT_REDIS_MESSAGING_HOST: redis
      PREFECT_REDIS_MESSAGING_PORT: 6379
      PREFECT_REDIS_MESSAGING_DB: 0
      PREFECT_LOGGING_LEVEL: DEBUG
      PREFECT_LOGGING_LOG_PRINTS: True
      PREFECT_SERVER_LOGGING_LEVEL: DEBUG
      PREFECT_SERVER_LOGGING_LOG_PRINTS: True
      #PREFECT_SERVER_API_AUTH_STRING: "admin:admin"
    command: prefect server start --no-services
    ports:
      - "4200:4200"
    healthcheck:
      test: [ "CMD-SHELL", "python -c 'import json,urllib.request,sys; sys.exit(0 if json.loads(urllib.request.urlopen(\"<http://localhost:4200/api/health>\", timeout=1).read()) is True else 1)' " ]
      interval: 5s
      timeout: 3s
      retries: 30

  services:
    ...

  create-deployment:
    ...

  autoupdate-worker:
    image: prefect-workpool
    depends_on:
      server:
        condition: service_healthy
      services:
        condition: service_started
      create-deployment:
        condition: service_completed_successfully
    environment:
      PREFECT_API_URL: <http://server:4200/api>
      DOCKER_HOST: <tcp://host.docker.internal:2375>
      PREFECT_LOCAL_STORAGE_PATH: /logs/storage
      # DOCKER_TLS_VERIFY: ${DOCKER_TLS_VERIFY:-}
      # DOCKER_CERT_PATH: ${DOCKER_CERT_PATH:-}
    restart: always
    volumes:
      - ./autoupdate:/opt/prefect/autoupdate
      - ./core:/opt/prefect/autoupdate/core
      - ${HOME}/.wizard:/logs
    extra_hosts:
      - "host.docker.internal:host-gateway"
    env_file:
      - .env

volumes:
  postgres_data:
  redis_data:
  keycloak_data:
I will send you keycloak config, oauth-proxy configs, nginx configs on separate messages as i am not allowed to post a message that is too long The error i am gettting: When I try to visit http://nginx on my virtual browser, it routes me to http://keycloak:8080/realms/wizard/protocol/.... with error
invalid parameter: redirect uri