In order to modularize components, get rid of Guice and replace it by the convenient way of Scala.

The realm should be set when using basic authentication. Currently, when basic authentication is specified, the browser displays a message saying "you must log in to area: null"

It should be possible to set the --http_credentials, --ssl_keystore_password and --ssl_keystore_path secure flags via environment variables. There is a security issue with passing them in via command line flags as their values will be visible in the process list.

When hitting http://downloads.mesosphere.io/maven
I'm getting a 403

This helps with debugging

please update the new version of readme

Having the example in the same structure as the chaos build is not convenient.

we first met this issue in Chronos. Pasted here.

We encountered this issue twice in about 3 months, generally we have about 25K jobs per day and the api server may doesn't response sometime. when this issue happen, curl -X -L :/ping will hang up for ever.

see also mesos/chronos#285

why the version 0.8.0+ request java 1.8

http://metrics.dropwizard.io/3.1.0/

I couldn't find the news article to link to indicating that dropwizard was picking up the metrics app from codahale. :(

It would be nice to have a command line option for this, for example, to listen on localhost only instead of 0.0.0.0. Jetty supports this via: http://download.eclipse.org/jetty/8.1.15.v20140411/apidocs/org/eclipse/jetty/server/Server.html#Server(java.net.InetSocketAddress)

Currently, if the "--http_credentials" parameter does not contain a colon char it will be logged, which may expose a password. This information should never be logged as part of reporting an invalid parameter.

hope to support the oauth2

It's currently possible to pass a keystore to enable SSL, but once SSL is enabled it is still possible to access the same endpoints via HTTP. Chaos should allow enforcing SSL once it is enabled so HTTP connections are either redirected or refused to enforce encrypted connections.

It would be nice if we could document which steps are necessary to publish a new release.

E.g.:

• Bumping up versions in version.sbt
• Creating tags
• Testing certain essentials
• Running a team city task

Whatever is necessary.

Try out the MacWire for wiring. Also add some actor and AOP examples.

There is a --http_address option but no corresponding --https_address option.

It would be nice to add this. Otherwise, https connections are always accepted on all interfaces.

The mesosphere marathon package for redhat logs via logger, which gets hoovered up into the systemd journal on RHEL/CentOS 7 or Fedora. It would be really nice to instead send this to a specific file in addition to the systemd journal.

Since marathon uses this library to do logging, the issue seems to be here and not in marathon directly. I've added this systemd service as a stopgap so we can use splunk to read marathon logs:

[Unit]
Description=Hack to log marathon logs to a file
After=network-online.target
Wants=network.target

[Service]
ExecStart=/bin/bash -c "/usr/bin/journalctl --quiet -lfu marathon >> /var/log/marathon/marathon.log"
Restart=always
RestartSec=1

[Install]
WantedBy=multi-user.target

And I've added Requires=marathon-logger.service to the marathon systemd unit to start marathon-logger on demand. Would it be possible to have chaos, and as a nice side effect, marathon support something like:

--log_level=info --log_file=/var/log/marathon/marathon.log

A simple logrotate config like this could be used so that chaos wouldn't natively need to rotate any logs:

/var/log/marathon/*.log {
    daily
    compress
    missingok
    rotate 30
    notifempty
    copytruncate
    delaycompress
}

Hi,

I am trying to use Chronos, which depends on this particular project. Can you upload this artifact to Maven Central instead of using a proprietary Maven repo ?

A generic CORS header was added in commit d9c111b, but that does not fully fit the requirements of Agora.

As noted in MDN's requests with credentials, "when responding to a credentialed request, server must specify a domain, and cannot use wild carding." That means the /ping endpoint needs to return the requesting domain to allow the client to hit the credentialed end point.

• Add Access-Control-Allow-Credentials: true header
• Return requesting domain in Access-Control-Allow-Origin header
  • For example, a request from "https://www.datacentercomputer.com/" would return the header, Access-Control-Allow-Origin: https://www.datacentercomputer.com

All Marathon instances currently proxy to the current leader. Marathon uses its own proxy implementation with various issues.

Jetty 9 includes support for proxying. Thus it would probably make sense to upgrade to Jetty 9 to benefit from this functionality.

Since this is functionality which would be useful to frameworks other than Marathon, I would include the proxy artifact in Chaos, potentially even some utility support to provide proxying to another host dynamically.

If a client requests an asset with Accept-Encoding: gzip, Chaos should serve a gzipped version of the asset if one exists. Right now Chaos ignores the heading and always serves the uncompressed version.

It appears that Jetty supports serving gzipped assets by calling ResourceHandler.setMinGzipLength with a value greater than 0. "1" seems like a reasonable value since every other value is equally arbitrary.

This is where the change looks like it should happen:

Edit: The above example was to the wrong "ResourceHandler". Jetty handles Gzip compression with its Gzip Filter.

After get rid of Guice DI, you replace JacksonMessageBodyProviderby JsonProvider, but the mapper of it only register DefaultScalaModule, so, how to register customized restMapper in RestModule/HttpModule?

Ideally this would support a standard apache htpasswd style file, which would also add the benefit of allowing multiple different user/password combinations to access the webapp such as marathon.