Mark urlmount as an initramfs root storage daemon before entering FUSE so systemd-shutdown does not wait for or kill the process serving the root image.
Write the nightly release notes only after every bundle is uploaded.
The notes carry the build key that prepare compares against, so a
failed upload used to record the new build anyway, and the following
nights skipped it while the release kept stale or missing bundles.
Publish only from the default branch. A manual run defaulted to
publishing, so testing the workflow on a topic branch replaced the
nightly with that branch.
Run the packaging build on pull requests that touch MANIFEST.in, which
decides what goes into the client and server packages, or anything
under confluent_vtbufferd, which is compiled here and carries the only
debian/ packaging in the tree.
Give every job a timeout instead of the six hour default, so a hung
container or download fails within minutes.
The initramfs writes the overlay upper layer before the SELinux policy
is loaded, so those files are unlabeled_t. On an enforcing image /
itself is unlabeled, and logind, getty and sshd fail.
Label exactly the upper layer paths like el9-diskless does. The root
is an overlay in untethered mode too, so this covers both. chcon comes
from the image, the initramfs has none.
Without it the server is only found by link-local discovery, so nodes
behind a DHCP relay never boot. Ported from el9-diskless. The initramfs
has dhcpcd from 24.04 on and only ipconfig before.
Without it the server is only found by link-local discovery, so nodes
behind a DHCP relay never boot. Ported from el9-diskless, with dhcpcd
in place of dhclient.
The SUSE kernel builds it as a module, so dhcpcd failed with "Address
family not supported" and a diskless node with ipv4_method dhcp never
got an address.
Removing it afterwards copied /etc/dracut.conf.d up unlabeled in
tethered mode on images built with SELinux. Skip the whiteout that the
removal leaves in the upper layer.
imgutil build --selinux installs the targeted policy and keeps SELinux enforcing.
imgutil pack labels images that enable SELinux with their own policy.
The install runs before a policy is loaded, so the module index from
kernel-install and files of later post scripts stayed unlabeled and
systemd-modules-load failed. Relabel every local filesystem last.
On an untethered root, files the initramfs writes before policy load
and sockets that unsquashfs creates without attributes have no label.
Label every inode without one, as the upper layer is in tethered mode.
With a tethered root (and on EL8 always), the initramfs writes the
overlay upper layer before the SELinux policy is loaded, so those files
are unlabeled_t. On a captured enforcing image sshd-keygen then cannot
search / and the node comes up without sshd.
Label exactly the upper layer paths with matchpathcon and chcon.
setfiles would recurse into the merged tree and restorecon is a no-op
before policy load. Built images have SELinux disabled and skip this.
With installtodisk and confluent_imagemethod=untethered (or
uncompressed) imageboot.sh first extracts the image to RAM and tears
down the image mount and the cryptimg device. installimage then hands
the empty /mnt/remote to image2disk.py, which wipes the target disk and
fails with:
FileNotFoundError: [Errno 2] No such file or directory: '/dev/mapper/cryptimg'
Writing the image to disk never needs the RAM copy, so treat the image
method as tethered when installtodisk is set. The same profile can then
be switched between untethered and installtodisk by only adding or
removing installtodisk.
A booted diskless node keeps its profile in deployment.pendingprofile
and records it in deployment.profile with state "booted". After
nodedeploy -c clears the pending profile, nodedeploy printed
"completed: <profile> (booted - ...)", although no deployment completed
and the node will not network boot that profile again.
Show "booted, not pending: <profile>" for that case instead.
The attribute help promises "a specific device name", but getinstalldisk
only understood "m2" and "/dev/<name>". A plain "nvme0n1" aborted the
install with "Unknown deployment.storage specification", and a
"/dev/<name>" that matched no disk was silently ignored, so the OS went
to whatever disk the default ordering picked. For an attribute meant to
pin the OS disk that is the dangerous failure mode.
Accept a kernel name with or without /dev/ and resolve /dev/disk/by-*
links to their kernel name, so a disk can be pinned by a stable path.
When nothing matches, fail with "No disks match" like the m2 filter
already does. Document the accepted forms in the attribute help.
Move work out of the signal handler
Have the full resize happen in the draw worker.
Have resize events be skipped if the resize doesn't keep up.
After a redraw, discard queue items that would have had wrong geometry.
No more weird lag on resize and no more stray misshapen screenshots after resize.
Markus Hilger
Jarrod Johnson
Robert Caliman