Tutorials
,

CPU Experiment Pack

Tammy Butow
Principal SRE
Last Updated:
February 3, 2020
Categories:
Chaos Engineering
,

Description

This Gremlin CPU Experiment Pack shares how you can utilise the Gremlin CPU attack. CPU Attacks are available with your Gremlin account.

What’s Included

  • Ability to run a CPU attack on cloud infrastructure hosts & containers on AWS, Azure, GCP & more
  • Ability to run a CPU attack on cpu containers running locally with Docker

What we’ll break

With Gremlin, you have the ability to cpu attack any host or container wherever it may reside.

This pack includes 4 x 5 minute experiments:

  • Experiment 1: CPU Attack a cloud infrastructure host using Gremlin
  • Experiment 2: CPU Attack a cloud infrastructure Docker container using Gremlin
  • Experiment 3: CPU Attack a Kubernetes pod using Gremlin
  • Experiment 4: CPU Attack a local Docker container using Gremlin
  • Experiment 5: CPU Attack a cloud infrastructure host using the Gremlin API

What you’ll need

Get ready to unleash chaos, get your credentials!

After you have created your Gremlin account (sign up here) you will need to get your Gremlin daemon credentials.

Login to the Gremlin App using your Company name and sign-on credentials. These details were emailed to you when you signed up to start using Gremlin.

Get a free Datadog trial to monitor your chaos 💥

Learn how to implement Chaos Engineering with Gremlin and Datadog.

Get your free 1 week Datadog trial account here: https://www.datadoghq.com/partner/gremlin-chaos-monitoring/.

Install your Datadog agent on each of your hosts or as a container by following the Datadog agent installation guide available within the Datadog App.

Experiment 1: CPU Attack a cloud infrastructure host using Gremlin

Step 1.0 - Installing the Gremlin Daemon and CLI

First, ssh into your server and add the Gremlin Debian repository:

BASH

echo "deb https://deb.gremlin.com/ release non-free" | sudo tee /etc/apt/sources.list.d/gremlin.list

Import the repo’s GPG key:

BASH

sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys C81FC2F43A48B25808F9583BDFF170F324D41134 9CDB294B29A5B1E2E00C24C022E8EF3461A50EF6

Then install the Gremlin agent:

BASH

sudo apt-get update && sudo apt-get install -y gremlind gremlin

Step 1.1 - Configuring the Gremlin Agent

After installing the agent, you'll need to authenticate it with the Gremlin Control Plane.

Start by initializing Gremlin and assigning tags with the following command. Substitute your desired tag name for <span class="code-class-custom">service=api</span>:

BASH

gremlin init

Now you’re ready to run attacks using the Gremlin.

Step 1.2 - Run a CPU Attack Using Gremlin

Using your Gremlin login credentials (which were emailed to you when you created your account), log in to the Gremlin App. Then click Create Attack.

First choose your target by selecting the host you registered with Gremlin:

cpu target

Next we will use the Gremlin App to create a CPU Attack. Choose the Resource Category and Select the CPU Attack:

cpu attack

Click Unleash Gremlin and the Gremlin CPU Attack will consume CPU resources on your host.

You can now view the Gremlin CPU Attack in Datadog:

cpu infra attack datadog

Experiment 2 - CPU a cloud infrastructure container using Gremlin

Step 2.0 - Install Docker

In this step, you’ll install Docker.

Add Docker’s official GPG key:

BASH

curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -

Use the following command to set up the stable repository.

BASH

sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"

Update the apt package index:

BASH

sudo apt-get update

Make sure you are about to install from the Docker repo instead of the default Ubuntu 16.04 repo:

BASH

apt-cache policy docker-ce

Install the latest version of Docker CE:

BASH

sudo apt-get install docker-ce

Docker should now be installed, the daemon started, and the process enabled to start on boot. Check that it’s running:

BASH

sudo systemctl status docker

Make sure you are in the Docker usergroup, replace $USER with your username:

BASH

sudo usermod -aG docker $USER

Log out and back in for your permissions to take effect, or type the following:

BASH

su - ${USER}

Step 2.1 - Create an htop container for monitoring

Htop is an interactive process viewer for UNIX. We’ll use it to monitor the progress of our attacks.

First create the Dockerfile for your htop container:

BASH

vim Dockerfile

Add the following to the Dockerfile:


FROM alpine:latestRUN apk add --update htop && rm -rf /var/cache/apk/*ENTRYPOINT ["htop"]

Build the Dockerfile and tag the image:

BASH

sudo docker build -t htop .

Run htop inside a container, this will monitor the host:

BASH

sudo docker run -it --rm --pid=host htop

To exit htop, enter q.

Next we will create an NGINX container and monitor it directly by joining the container’s pid namespace.

Step 2.2 - Create an NGINX container to attack

First we will create a directory for the html page we will serve using nginx:

BASH

mkdir -p ~/docker-nginx/html

BASH

cd ~/docker-nginx/html

Create a simple HTML page:

BASH

vim index.html

Paste in this content:


<html>    <head>        <title>Docker nginx tutorial</title>        <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css" integrity="sha384-Gn5384xqQ1aoWXA+058RXPxPg6fy4IWvTNh0E263XmFcJlSAwiGgFAW/dAiS6JXm" crossorigin="anonymous">    </head>    <body>        <div class="container">            <h1>Hello it is your container speaking</h1>            <p>This nginx page was created by your Docker container.</p>            <p>Now it’s time to create a Gremlin attack.</p>        </div>    </body></html>

Create a container using the nginx Docker image:

BASH

sudo docker run -l service=nginx --name docker-nginx -p 80:80 -d -v ~/docker-nginx/html:/usr/share/nginx/html nginx

Make sure the docker-nginx container is running:

BASH

sudo docker ps


CONTAINER ID        IMAGE               COMMAND                       CREATED                 STATUS                   PORTS                         NAMES352609a67e95        nginx               "nginx -g 'daemon of…"        33 seconds ago          Up 32 seconds       0.0.0.0:80->80/tcp              docker-nginx

Step 2.3 - Set up your Gremlin agent credentials

The Gremlin daemon (<span class="code-class-custom">gremlind</span>) connects to the Gremlin backend and waits for attack orders from you. When it receives attack orders, it uses the CLI (<span class="code-class-custom">gremlin</span>) to run the attack.

BASH

export GREMLIN_TEAM_ID=your_team_ID

BASH

export GREMLIN_TEAM_SECRET=your_team_secret

Step 2.4 - Run the Gremlin Daemon in a Container

Use docker run to pull the official Gremlin Docker image and run the Gremlin daemon:

BASH

sudo docker run -d \    --net=host \    --pid=host \    --cap-add=NET_ADMIN \    --cap-add=SYS_BOOT \    --cap-add=SYS_TIME \    --cap-add=KILL \    -e GREMLIN_TEAM_ID="${GREMLIN_TEAM_ID}" \    -e GREMLIN_TEAM_SECRET="${GREMLIN_TEAM_SECRET}" \    -v /var/run/docker.sock:/var/run/docker.sock \    -v /var/log/gremlin:/var/log/gremlin \    -v /var/lib/gremlin:/var/lib/gremlin \    gremlin/gremlin daemon

Use docker ps to see all running Docker containers:

BASH

sudo docker ps


CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                NAMES7167cacb2536        gremlin/gremlin     "/entrypoint.sh daem…"   40 seconds ago      Up 39 seconds                            practical_benzfb58b77e5ef8        nginx               "nginx -g 'daemon of…"   10 minutes ago      Up 10 minutes       0.0.0.0:80->80/tcp   docker-nginx

Jump into your Gremlin container with an interactive shell (replace 7167cacb2536 with the real ID of your Gremlin container):

BASH

sudo docker exec -it 7167cacb2536 /bin/bash

From within the container, check out the available attack types:

BASH

gremlin help attack-container


Usage: gremlin attack-container CONTAINER TYPE [type-specific-options]Type "gremlin help attack-container TYPE" for more details:  blackhole # An attack which drops all matching network traffic  cpu   # An attack which consumes CPU resources  io    # An attack which consumes IO resources  latency # An attack which adds latency to all matching network traffic  memory  # An attack which consumes memory  packet_loss # An attack which introduces packet loss to all matching network traffic  shutdown  # An attack which forces the target to shutdown  dns   # An attack which blocks access to DNS servers  time_travel # An attack which changes the system time.  disk    # An attack which consumes disk resources  process_killer  # An attack which kills the specified process

Then exit the container.

Step 2.5 - Run a CPU Attack against the NGINX container from a Gremlin Container

In this step we will run gremlin attack-container to target the NGINX container by its ID and run a CPU Attack against it.

Before running the CPU attack, use htop to monitor the docker-nginx container (replace f291a040a6aa with your docker-nginx container ID):

BASH

sudo docker run -it --rm --pid=container:f291a040a6aa htop

Run the following to create the CPU container attack against the container (replace f291a040a6aa with your docker-nginx container ID):

BASH

sudo docker run -d -it \    --cap-add=NET_ADMIN \    -e GREMLIN_TEAM_ID="${GREMLIN_TEAM_ID}" \    -e GREMLIN_TEAM_SECRET="${GREMLIN_TEAM_SECRET}" \    -v /var/run/docker.sock:/var/run/docker.sock \    gremlin/gremlin attack-container f291a040a6aa cpu

Now use your htop container to monitor the results:

BASH

sudo docker run -it --rm --pid=container:f291a040a6aa htop

You will also see Gremlin consuming CPU resources in Datadog:

cpu attack datadog

Experiment 3 - CPU a Kubernetes pod using Gremlin

Kubernetes is a container management system which is built with reliability in mind. Architecture is commonly 1 master and 2 or more nodes which are replicated from the master. When the master dies the nodes are ready to replace it. When one node dies another will be ready to replace it.

Step 3.0 - Retrieve Your Team ID and Secret Key

To install the Gremlin agent and Kubernetes agent, you will need your Gremlin Team ID and Secret Key. If you don’t know what your Team ID and Secret Key are, you can get them from the Gremlin web app.

Visit the Teams page in Gremlin, and then click on your team’s name in the list.

Gremlin Teams page

On the Teams screen click on Configuration.

Teams configuration

Make a note of your Team ID.

If you don’t know your Secret Key, you will need to reset it. Click the Reset button. You’ll get a popup reminding you that any running agents using the current Secret Key will need to be configured with the new key. Hit Continue.

Next you’ll see a popup screen that will show you the new Secret Key. Make a note of it.

Secret Key

Step 3.1 - Install Gremlin with Helm

The simplest way to install the Gremlin agent on your Kubernetes cluster is to use Helm. If you do not already have Helm installed, go here to get started. Once Helm is installed and configured, the next steps are to add the Gremlin repo and install the agent.

Add the Gremlin Helm chart:

BASH

helm repo add gremlin https://helm.gremlin.com

Create a namespace for the Gremlin Kubernetes agent:

BASH

kubectl create namespace gremlin

Next you will run the <span class="code-class-custom">helm</soan> command to install the Gremlin agent. In this command there are three placeholder variables that you will need to replace with real data. Replace <span class="code-class-custom">$GREMLIN_TEAM_ID</span> with your Team ID from step1, and replace <span class="code-class-custom">$GREMLIN_TEAM_SECRET</span> with your Secret Key from step 1. Replace <span class="code-class-custom">$GREMLIN_CLUSTER_ID</span> with a name for the cluster.

If you are using Helm v3, run this command:

BASH

helm install gremlin gremlin/gremlin \
    --namespace gremlin \
    --set gremlin.secret.managed=true \
    --set gremlin.secret.type=secret \
    --set gremlin.secret.teamID=$GREMLIN_TEAM_ID \
    --set gremlin.secret.clusterID=$GREMLIN_CLUSTER_ID \
    --set gremlin.secret.teamSecret=$GREMLIN_TEAM_SECRET

For older versions of Helm, use the --name option:

BASH

helm install gremlin/gremlin \
    --name gremlin \
    --namespace gremlin \
    --set gremlin.secret.managed=true \
    --set gremlin.secret.type=secret \
    --set gremlin.secret.teamID=$GREMLIN_TEAM_ID \
    --set gremlin.secret.clusterID=$GREMLIN_CLUSTER_ID \
    --set gremlin.secret.teamSecret=$GREMLIN_TEAM_SECRET

If you’re not sure which version of Helm you’re using, run this command:

BASH

helm version

For more information on the Gremlin Helm chart, including more configuration options, check out the chart on Github.

Step 3.2 - Creating attacks using the Gremlin App

Example: Creating a CPU Attack against a Kubernetes node using the Gremlin App

You can use the Gremlin App or the Gremlin API to trigger Gremlin attacks. You can view the available range of Gremlin Attacks in Gremlin Help.

The “Hello World” of Chaos Engineering is the CPU Resource Attack. To create a CPU Resource Attack, click Attacks in the left navigation bar and New Attack.

Host targeting should be selected by default. Click on the Exact button to expand the list of available hosts, and select one of them. You’ll see the Blast Radius for the attack is limited to 1 host.

Click on “Choose a Gremlin” and select “Resource” and then “CPU.”

The CPU Resource Attack will consume CPU resources based on the settings you select. The most popular default settings for a CPU Resource Attack are pre-selected, a default attack will utilize 1 core for 60 seconds.

When your attack is finished it will move to Completed Attacks in the Gremlin App. To view the logs of the Attack, click on the Attack in Completed Attacks then click to the arrow to view the logs.

Experiment 4 - CPU a local Docker container using Gremlin

Step 4.0 - Install Docker For Mac

First you will need to install Docker For Mac if you do not yet have it on your local computer, follow the instructions provided by Docker.

Step 4.1 - Set up your Gremlin credentials

The Gremlin daemon (gremlind) connects to the Gremlin backend and waits for attack orders from you. When it receives attack orders, it uses the CLI (gremlin) to run the attack.

BASH

export GREMLIN_TEAM_ID=your_org_id

BASH

export GREMLIN_TEAM_SECRET=your_org_secret

Step 4.2 - Create a Gremlin Docker container

Use docker pull to pull the official Gremlin Docker image:

BASH

docker pull gremlin/gremlin

Step 4.3 - Create an NGINX container to attack

First we will create a directory for the html page we will serve using nginx:

BASH

mkdir -p ~/docker-nginx/html

BASH

cd ~/docker-nginx/html

Create a simple HTML page:

BASH

vim index.html

Paste in this content:


<html>   <head>        <title>Docker Nginx tutorial</title>

Create a container using the nginx Docker image:

BASH

sudo docker run -l service=nginx --name docker-nginx -p 80:80 -d -v ~/docker-nginx/html:/usr/share/nginx/html nginx

Make sure the docker-nginx container is running:

BASH

sudo docker ps


CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                NAMES7167cacb2536        gremlin/gremlin     "/entrypoint.sh daem…"   40 seconds ago      Up 39 seconds                            practical_benzfb58b77e5ef8        nginx               "nginx -g 'daemon of…"   10 minutes ago      Up 10 minutes       0.0.0.0:80->80/tcp   docker-nginx

Step 4.4 - Run A Gremlin CPU Attack

Now use the Gremlin CLI (gremlin) to run a CPU attack from within a Gremlin container:

BASH

sudo docker run -i \    --cap-add=NET_ADMIN \    -e GREMLIN_TEAM_ID="${GREMLIN_TEAM_ID}" \    -e GREMLIN_TEAM_SECRET="${GREMLIN_TEAM_SECRET}" \    -v /var/run/docker.sock:/var/run/docker.sock \    gremlin/gremlin attack-container docker-nginx cpu

This attack will run a CPU attack on your Nginx container.

Experiment 5: CPU Attack on a cloud infrastructure host using the Gremlin API

It is also possible to run attacks programmatically using the Gremlin API. We will run these attacks from a Mac OS laptop.

Step 5.0 - Installing the Gremlin Daemon and CLI

First, ssh into your server and add the Gremlin Debian repository:

BASH

echo "deb https://deb.gremlin.com/ release non-free" | sudo tee /etc/apt/sources.list.d/gremlin.list

Import the repo’s GPG key:

BASH

sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys C81FC2F43A48B25808F9583BDFF170F324D41134 9CDB294B29A5B1E2E00C24C022E8EF3461A50EF6

Then install the Gremlin daemon and CLI:

BASH

sudo apt-get update && sudo apt-get install -y gremlind gremlin

Step 5.1 - Register your server to the Gremlin control plane

Using your Gremlin login credentials (which were emailed to you when you created your account), log in to the Gremlin App. Open Settings and copy your Team ID and Secret.

Initialise Gremlin by running the following command and follow the prompts to enter your Gremlin Team ID and Secret:

BASH

gremlin init

Now you’re ready to obtain your Gremlin API token.

Step 5.2 - Obtain your Gremlin API token

First access your Gremlin API token by providing your gremlin username and password to /users/auth, replacing your email, password and company name in the curl request below:

BASH

curl -X POST --header 'Content-Type: application/x-www-form-urlencoded' \    --data-urlencode 'email=name@youremail.com' \    --data-urlencode 'password=changeit' \    --data-urlencode 'companyName=changeit' \    'https://api.gremlin.com/v1/users/auth'

Your API token will be displayed on the screen. The example below shows "Bearer Y4MGE3MGMzOmdyZW1saW5AZ3JlbWxpbmluYy5jb206NWNhMWFiMWU" as the API token that will be used for interacting with the Gremlin API:


[  {   "expires_at": "2099-01-00T00:00:00.000Z",   "header": "Bearer Y4MGE3MGMzOmdyZW1saW5AZ3JlbWxpbmluYy5jb206NWNhMWFiMWU",   "identifier": "yourname@email.com",   "org_id": "e7352a6b-a9a0-513c-8000-980f680a70c3",   "org_name": "My Org (Production)",   "renew_token": "5ca1ab1e-ffff-0000ffff0001",   "role": "USER",   "token": "5ca1ab1e-ffff-0000ffff0000"  },]

Step 5.3 - Store your Gremlin API token

On your local computer (Mac OS), store your Gremlin API token as an environment variable:

BASH

export bearertoken="Bearer Y4MGE3MGMzOmdyZW1saW5AZ3JlbWxpbmluYy5jb206NWNhMWFiMWU"

Check to ensure you have set your token correctly:

BASH

echo $bearertoken

Your API token will be displayed on your terminal screen:


Bearer Y4MGE3MGMzOmdyZW1saW5AZ3JlbWxpbmluYy5jb206NWNhMWFiMWU

Now you’re ready to run attacks using the Gremlin API .

Step 5.4 - Run a CPU Attack Using The Gremlin API

Now you’re ready to run a shutdown attack using the Gremlin API . Run the following command on your local computer (Mac OS):

BASH

curl --header "Content-Type: application/json" \    --header "Authorization: $bearertoken" \    https://api.gremlin.com/v1/attacks/new \    --data '    {        "command": { "type": "cpu" },        "target": { "type": "Random" }    }'

View the attack in progress using the Gremlin API:

BASH

curl -X GET "https://api.gremlin.com/v1/attacks/active" -H "Authorization: $bearertoken" -H "accept: application/json"

Your current attack will be displayed in terminal:

BASH

[  {    "target_type": "Host",    "targets": [      "172.31.21.178"    ],    "org_id": "3f242793-018a-5ad5-8000-fb958f8dc084",    "args": [      "cpu"    ],    "created_at": "2019-03-07T19:14:51.379Z",    "create_source": "Api",    "stage": "Pending",    "stage_lifecycle": "Active",    "guid": "483c1c53-410d-11e9-8165-0242b395dd29",    "start_time": "2019-03-07T19:14:51.379Z",    "create_user": "yourname@email.com",    "updated_at": "2019-03-07T19:14:51.404Z",    "kind": "Api"  }

No items found.
Gremlin's automated reliability platform empowers you to find and fix availability risks before they impact your users. Start finding hidden risks in your systems with a free 30 day trial.
start your trial

Avoid downtime. Use Gremlin to turn failure into resilience.

Gremlin empowers you to proactively root out failure before it causes downtime. See how you can harness chaos to build resilient systems by requesting a demo of Gremlin.GET STARTED

Product Hero ImageShape