1338324 - Identify configuration for AWS TaskCluster hardware Windows 7 and add support to for it to OpenCloudConfig

Status: RESOLVED FIXED

(Infrastructure & Operations :: RelOps: General, task)

Comment 1

[Mark Cornmesser [:markco] OOO 2024/04/15]

From what I can tell these are currently in the base AMI or is needed for certain tests and is not currently account for in the MDT install or OpenCloudConfig: 

Applications:

7 zip
Git 
Ultra VNC .. including ini file to set password
KTS(SSH server) and supporting files
Apache (Talos support) and supporting files 

Configuration:

Disable Auto-update
Disable indexing
Disable ipv6 
Disable Desktop Notifications
Disable Paging Executive 
Disable Screen Saver 
Disable Windows Defender 

 

Other:

Python psutil file 
Mozilla maintenance service  (include certs and registry entries)
Monitor Configuration (file and scripts)

grenade: Do you know if any these are not needed, or we already have it in the OpenCloudCOnfig and I missed it?

Comment 2

[Rob Thijssen [:grenade (EET/UTC+0300)]]

i could easily be wrong (jmaher may be able to help confirm or refute some of this). this is my understanding:

- 7 zip: is nice to have from a maintenance/debugging perspective but is not used by the test harnesses (talos could be different, but i haven't come across anything in ec2 tests that use this). i'd like to hold off installing this via manifest until we understand what uses it because i think it has the potential to be confusing if installed but not used.
- git: if it is required is installed by tooltool or in-tree code. i think it should be added to the json manifests anyway because it does no harm and is very likely to be useful.
- ultra vnc: we should add this to the manifests
- kts: we should add this to the manifests
- apache: i believe this has been deprecated and should not be installed. happy to be wrong but currently having it installed causes lots of error noise in the logs and creates confusion. i don't believe anything uses it.

- disable auto-update (wuauserv): this one is nasty. dsc says you can only specify service state (running, disabled, etc) once in a dsc config. we need wuauserv running in order for many of the build dependencies to be installed (sdks and compile toolchains) so json manifests enable it. we then disable it after the dsc run in occ powershell. hacky but currently necessary until we have a better solution.
- disable indexing: i thought we were doing this. maybe we're just getting lucky because its disabled in the ami.
- disable ipv6: we don't do this. is there a reason to? if there is we should comment that in the manifest so that it's clear why some os default has been changed in the context of tests.
- disable desktop notifications: we do this in the GenericWorker logon script because it's user account specific (https://github.com/mozilla-releng/OpenCloudConfig/blob/master/userdata/Configuration/GenericWorker/run-generic-worker.bat#L3).
- disable paging executive: if this is related to paging files, then we currently don't use it because our ec2 instances are configured to not use paging files at the ami level so it would do nothing. if our paging setup is different on hardware we should document this one carefully in the manifest.
- disable screen saver: handled in the disable interrupts reg file mentioned in desktop notifications above for the same reason.
- disable windefend: i thought we were doing this too, but again, we're probably just getting lucky.

- python psutil: we should not install this. it's installed from mozharness configs when needed. having it at the instance level creates black magic builds and tests that work for reasons that are obscure. we want python dependencies to be explicit and in-tree.
- mozilla maintenance service: i think we want this. i believe we have tests failing because we don't have it. i also think we need to be careful to understand which tests use it and look at ways for making this explicit and configured in-tree rather than in the manifests (if possible).
- monitor configuration: this has to be done in-tree (we no longer have a cltbld user and its currently too obscure anyway(eg: tests fail because somebody rdps in and changes resolution)). it probably belongs in the pre-flight scripts from mozharness configs but i suspect that's already true.

Comment 3

[Mark Cornmesser [:markco] OOO 2024/04/15]

The initial list is only from the GPOs. I need to go through MDT as well and see if there are needed pieces there.

Comment 4

[Mark Cornmesser [:markco] OOO 2024/04/15]

(In reply to Rob Thijssen (:grenade - GMT) from comment #2)
> i could easily be wrong (jmaher may be able to help confirm or refute some
> of this). this is my understanding:
jmaher: any insights?

Comment 5

[Mark Cornmesser [:markco] OOO 2024/04/15]

Grenade what about Microsoft_VC100_DebugCRT_x86?

And in OpenCloudOCnfig is there anything in place for management of the Nvidia drivers? Mostly asking out of hope that I missed it when looking through OpenCloudConfig.

Comment 6

[Joel Maher ( :jmaher ) (UTC -8)]

we need some type of zip, I thought we used 7zip, but if there is something else in use, lets stick with it.

We do not need apache- that is old school :)


disabled bits++

psutil- it is installed if needed, lets not install it.

mozilla maintenance service- wouldn't we install that if we need it for builds/tests?  I assume this is user facing software, this is not familiar to me.

If we are building this up for hardware, we need the xperf toolchain, but that is not needed for AWS.

Comment 7

[Mark Cornmesser [:markco] OOO 2024/04/15]

What is involved in the xperf toolchain?

Comment 8

[Joel Maher ( :jmaher ) (UTC -8)]

oh, this is documented:
https://wiki.mozilla.org/index.php?title=ReferencePlatforms/Test/Win7#Xperf_and_mozprofilerprobe.mof

Comment 9

[Rob Thijssen [:grenade (EET/UTC+0300)]]

nothing in occ for nvidia drivers or Microsoft_VC100_DebugCRT_x86

Comment 10

[Rob Thijssen [:grenade (EET/UTC+0300)]]

i was wrong about 7zip. it's definitely used by the signing/packaging process and probably elsewhere also.

Comment 11

[Mark Cornmesser [:markco] OOO 2024/04/15]

Attachment: Base OCC support for Windows 7 in the datacenter #49

Comment 12

[Rob Thijssen [:grenade (EET/UTC+0300)]]

Comment on attachment 8846911 [details] [review]
Base OCC support for Windows 7 in the datacenter #49

used GitHub review tool to put some inline comments: https://github.com/mozilla-releng/OpenCloudConfig/pull/49#pullrequestreview-26753672