[FEATURE REQUEST] Add time synchronization service (NTP) to Epiphany

[to-bar]

Is your feature request related to a problem? Please describe.

We need synchronized time on Epiphany instances.

Reasons:

1. NFS requires time synchronization.
   It is highly recommended for NFS to use a time synchronization daemon to keep client/server clocks in sync. Without accurate clocks on all nodes, NFS can introduce unwanted delays.
   Source: https://wiki.archlinux.org/index.php/NFS#Installation
   NFS does not synchronize time between client and server, and offers no mechanism for the client to determine what time the server thinks it is. What this means is that a client can update a file, and have the timestamp on the file be either some time long in the past, or even in the future, from its point of view.
   While this is generally not an issue if clocks are a few seconds or even a few minutes off, it can be confusing and misleading to humans. Of even greater importance is the affect on programs. Programs often do not expect time difference like this, and may end abnormally or behave strangely, as various tasks timeout instantly, or take extraordinarily long while to timeout.
   Source: https://www.time-travellers.org/shane/papers/NFS_considered_harmful.html

2. Kerberos (used to encrypt NFS)
   The Kerberos protocol requires the time of the client and server to match: if the system clocks of the client does not match that of the server, authentication will fail. The simplest way to synchronize the system clocks is to use a Network Time Protocol (NTP) server.
   Source: https://help.ubuntu.com/community/Kerberos

Describe the solution you'd like

Possibilities:

For cloud based installations it should be set up automatically by Epiphany (where possible).

1. On AWS, the Amazon Time Sync Service is available through NTP at the 169.254.169.123 IP address for any instance running in a VPC but (at least for AMIs currently used by Epiphany) it needs to be configured. According to AWS docs, the latest versions of Amazon Linux AMIs synchronize with the Amazon Time Sync Service by default. Worth to check whether images we are going to use (issue Update cloud based OS images #1330) have NTP pre-configured.
   Source: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/set-time.html

2. On Azure there is NTP enabled by default on default images (that is what documentation says, but that requires confirmation).
   Source: https://docs.microsoft.com/en-us/azure/virtual-machines/linux/time-sync#configuration-options

3. For on-premise installations, I think we have a few options:

   1. Install and configure NTP clients by Epiphany (configurable addresses of existing/external NTP servers)
   2. Install and configure NTP clients and server(s) by Epiphany (if external NTP server not defined)
   3. Add NTP service as prerequisite to Epiphany docs, to be configured by an administrator before starting installation (outside Epiphany) + add pre-flight check to fail installation when time is not synchronized

Describe alternatives you've considered
None

Additional context
None

---

DoD checklist

• Changelog
  • updated
  • not needed
• COMPONENTS.md
  • updated
  • not needed
• Schema
  • updated
  • not needed
• Backport tasks
  • created
  • not needed
• Documentation
  • added
  • updated
  • not needed
• Feature has automated tests
• Automated tests passed (QA pipelines)
  • apply
  • upgrade
  • backup/restore
• Idempotency tested
• All conversations in PR resolved
• Solution meets requirements and is done according to design doc
• Usage compliant with license

[mkyc]

@to-bar I updated issue description of this issue. Can you check and comment if that is better now?

[to-bar]

@to-bar I updated issue description of this issue. Can you check and comment if that is better now?

Thanks, good job. Updated AWS part after checking that AMIs we currently use do not have NTP pre-configured. However, RHEL based VMs use RHELs default setup - external NTP sources (rhel.pool.ntp.org).

[ghost]

Looks like ticket #1233 is on hold, so we're not sure if this task is mandatory.. if is.. than we need to put more explanations regarding current work:

• What was done?
• What works?
• What not?
• What are the issues?

[mkyc]

#1233 will be probably closed without resolution after we finish #1455 epic. So question is rather do we need NTP?

[sk4zuzu]

Update:

1. First of all we decided to 86 kerberos, we don't want to look at it again (ever).
2. NFS could be useful in some cases, but probably "CNS" is the way to go here.
3. Despite 1. and 2. the idea is still valid. The simplest example is that apt manager in Ubuntu may stop working if time is incorrect (difference is too large). I had this issue couple of times in my local libvirt infrastructure.
4. I believe, things like etcd and various other databases (clustered software) should have proper time synchronization. 👍

[seriva]

Not going todo anymore feature requests for Epiphany.