1570767 - [Ronin Windows] Install Chrome release on windows machines

Status: RESOLVED FIXED

(Infrastructure & Operations :: RelOps: Puppet, task, P2)

Description

[Greg Mierzwinski [:sparky]]

This bug is for getting chrome release installed on windows hardware machines.

Comment 1

[Greg Mierzwinski [:sparky]]

:fubar, since this needs to be manually installed I imagine we will need to coordinate this task with relops? We need the same thing for linux and mac machines (in bug 1570765, and bug 1570768) but Windows is the highest priority OS for us.

Comment 2

[Kendall Libby [:fubar] (he/him)]

If we want to have the Chrome install managed the same way across the board then yes, we'll help out. Technically on Windows, you could use scoop to install Chrome as part of the test setup into the user's AppDir and then it gets automatically cleaned up when the job is done, but Linux and macOS don't have a nice utility to do that for you.

rob/mark, can you get Chrome (release) onto gecko-t-win10-64-hw?

Comment 3

[Rob Thijssen [:grenade (EET/UTC+0300)]]

task install

to install chrome as part of a task without elevated privileges, so that it is removed before the next task run, use the commands from the example task created in bug 1570262. eg, set the PATH env var to include task profile scoop shims:

%PATH%;%cd%\\scoop\\shims

and run the following commands in the task:

powershell -NoProfile -InputFormat None -ExecutionPolicy RemoteSigned -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://get.scoop.sh'))"
scoop install git
scoop bucket add extras
scoop install googlechrome

system install

an occ install created for bug 1570213, looks like this. it'll need to be modified for puppet since this bug is about hardware.

    {
      "ComponentName": "GoogleChrome",
      "ComponentType": "MsiInstall",
      "Comment": "https://bugzilla.mozilla.org/show_bug.cgi?id=1570213",
      "Url": "https://dl.google.com/tag/s/dl/chrome/install/googlechromestandaloneenterprise64.msi",
      "Name": "Google Chrome",
      "ProductId": "86B1D736-F1F4-3367-9B39-C2E176B68239",
      "sha512": "7c3c0928203ef8bcbf5f769887f29ba92208b8b449d4c18ca43bd05679b2788e9c6af249187e57cc7efd5758146c5cea9de440d12d2c632cefc2cb17fddc5e6c"
    }

Comment 4

[Greg Mierzwinski [:sparky]]

So for the system install, I see that there is a config for win10-64-hw here.

Is that the config file we need to add this entry to and what modifications would need to be made for puppet? (I'm not familiar with puppet).

Comment 5

[Mark Cornmesser [:markco]]

(In reply to Greg Mierzwinski [:sparky] from comment #4)

So for the system install, I see that there is a config for win10-64-hw here.

Is that the config file we need to add this entry to and what modifications would need to be made for puppet? (I'm not familiar with puppet).

That config file is no longer in use. Windows 1o hardware is now managed through https://github.com/mozilla-platform-ops/ronin_puppet

I can look at adding this in this week. Is there a specific version we want to use or do we want to keep this at the latest? To have a Chrome live on the hardware nodes we would have to use the enterprise version. It looks like it is slightly different than the typical Chrome installer. Would that be an issue?

Comment 6

[Greg Mierzwinski [:sparky]]

:markco, that would be great if you could add it in, thanks!

We'd like to keep it at the latest, and no it won't be an issue to use the enterprise version. I believe that it's the only version which provides an msi to install as well.

Comment 7

[Dave Hunt [:davehunt] [he/him] ⌚BST]

(In reply to Greg Mierzwinski [:sparky] from comment #6)

We'd like to keep it at the latest, and no it won't be an issue to use the enterprise version. I believe that it's the only version which provides an msi to install as well.

Does this mean the version will automatically update? If so, I think this is great but we'll want to make sure we're able to at least report the exact version number in the logs. Ideally, we'd also report this to Perfherder so that we can distinguish between releases.

Comment 8

[Greg Mierzwinski [:sparky]]

:davehunt, yes if automatic updating is enabled.

:markco is it feasible to have it auto-update? If not, there's no problem to disable auto-updating. We'll log the chrome version that's tested in either case though.

Comment 9

[Mark Cornmesser [:markco]]

I think for enterprise version it will default to automatic updates. I am taking a look at it today.

Comment 10

[Mark Cornmesser [:markco]]

The install itself is easy, and I have verified that the update service runs automatically.

AJ: Are there security concerns with installing Chrome on testing nodes?

For reference https://www.google.com/chrome/privacy/index.html .

Comment 11

[Greg Mierzwinski [:sparky]]

:markco, :ajvb, if there are any concerns with that then it would be fine if we do the task-install.

Comment 12

[Mark Cornmesser [:markco]]

My concern is Chrome is chatty with info back to Google, and would like to have securities input on this before moving forward. If it is OK then there are no worries, but if there is some traffic would should block we will need to block it regardless of the install method.

Comment 13

[AJ Bahnken [:ajvb] (she/her)]

:markco - I think this is fine, but it would be nice to disable telemetry and other such phone-home features if possible.

Comment 14

[Mark Cornmesser [:markco]]

Ty. I am looking into turning off those features.

Comment 15

[Mark Cornmesser [:markco]]

Attachment: chrome.reg

For reference. List of configurable Chrome registry values.

https://cloud.google.com/docs/chrome-enterprise/policies/#accessibilitySettings

Comment 16

[Mark Cornmesser [:markco]]

I set up a test pool of ms-040 - 045 with the gecko-t-win10-64-ht workerType. These have Chrome installed, and the reporting metrics disabled through the registry. Current testing repo can be found here https://github.com/markcor/ronin_puppet/tree/bug1570767.

I would prefer we test on the above mentioned pool before pushing Chrome out to the entirety of the production pool.

Comment 17

[Greg Mierzwinski [:sparky]]

Thanks :markco!

For reference, I've merged your patches to use gecko-t-win10-64-ht into a single patch here: https://hg.mozilla.org/try/rev/670806b297cd4dcaca2734e6d15a892636317151

Comment 18

[Greg Mierzwinski [:sparky]]

Here's a push with a successful chrome job: https://treeherder.mozilla.org/#/jobs?repo=try&tier=1%2C2%2C3&revision=30bd2c91fe52ebc9e03ccd120f67c73e845443de

More tests to come :)

Comment 19

[Greg Mierzwinski [:sparky]]

Try push with all possible raptor tests running with chrome: https://treeherder.mozilla.org/#/jobs?repo=try&tier=1%2C2%2C3&revision=698429c9e3c9a8a616196ef0f8db4501d3f369bb

So far, the failures are all related to tests which won't run on chrome.

EDIT: We're currently testing to check the test stability and check the measurements noise.

Comment 20

[Greg Mierzwinski [:sparky]]

The measurements from Chrome are good and their noise is quite similar to Firefox tests, so I've added another 20 tasks per test to see if it the noise profile stays the same and that no new intermittents would be introduced. Tests are running in the same push as before: https://treeherder.mozilla.org/#/jobs?repo=try&tier=1%2C2%2C3&revision=698429c9e3c9a8a616196ef0f8db4501d3f369bb

:markco, can you provide a list of the registry settings that you changed for chrome?

Comment 21

[Mark Cornmesser [:markco]]

MetricsReportingEnabled, SafeBrowsingExtendedReportingEnabled, and ChromeCleanupReportingEnabled were all set 0/disabled.

Comment 22

[Greg Mierzwinski [:sparky]]

All the tasks in the test push passed, no new intermittents are seen, and the measurements look good.

So I think we can push the chrome install to the larger pool now - unless there is something else that should be tested?

Comment 23

[Mark Cornmesser [:markco]]

Attachment: GitHub Pull Request

Comment 24

[Mark Cornmesser [:markco]]

This is pending the review on the attach Github pull request.

Comment 25

[Mark Cornmesser [:markco]]

This is being deployed this morning.

Comment 26

[Greg Mierzwinski [:sparky]]

Excellent, thanks :markco!

Comment 27

[Greg Mierzwinski [:sparky]]

:markco, is it possible that the chrome install hasn't made it to all machines yet? I am seeing errors saying that we can't find it in the expected location: https://treeherder.mozilla.org/#/jobs?repo=try&revision=82f137038f29b42d44f26a7c4518a0bd20efa414&selectedJob=266004282

I am looking for chrome at this location: C:\Progra~2\Google\Chrome\Application\chrome.exe
Can the install location differ between machines? If so, would you know of a stable way to find the executable?

Comment 28

[Mark Cornmesser [:markco]]

It appears that some of the workers are not updating. I am looking into this this morning.

The exe location should be int he same location across all of the workers.

Comment 29

[Mark Cornmesser [:markco]]

The offending nodes will be reimaged today. This is related to another issue we have been troubleshooting with long lived static instances.

Comment 30

[Greg Mierzwinski [:sparky]]

Oh ok, thanks for looking into this - I'll rerun the tests tomorrow before landing them.