Without pipelining every task copies the module to the node over sftp,
then makes it executable, runs it and removes it, each a separate ssh
operation. With pipelining the module is fed to the interpreter over
the ssh session, so a task takes one operation and nothing is written
to the node's temporary directory.
Pipelining breaks become through sudo with requiretty, which rarely
applies here: plays connect as root and drop become unless become_user
is set. Setting ANSIBLE_PIPELINING or ANSIBLE_SSH_PIPELINING still
overrides this default.
Setting ANSIBLE_SSH_ARGS replaces ansible's ssh_args instead of adding
to them, so plays ran without the default ControlMaster and
ControlPersist options. Every task then opened a new ssh connection
and authenticated again.
Start from ansible's default ssh_args when ANSIBLE_SSH_ARGS is not
set. An ANSIBLE_SSH_ARGS from the environment is still extended as
before.
Plays run by the deployment server get the target node's attributes in
the host variable 'confluent', nested at each dot of the name, e.g.
confluent['net']['ib0']['ipv4_address']. Secrets and unset attributes
are left out, and values are never templated.
Newer ansible-core only takes a stdout callback name and no longer
templates untrusted YAML. Attach the results collector directly, load
plays trusted through the DataLoader, and report a crashed play
process as a failed task.
The attribute help promises "a specific device name", but getinstalldisk
only understood "m2" and "/dev/<name>". A plain "nvme0n1" aborted the
install with "Unknown deployment.storage specification", and a
"/dev/<name>" that matched no disk was silently ignored, so the OS went
to whatever disk the default ordering picked. For an attribute meant to
pin the OS disk that is the dangerous failure mode.
Accept a kernel name with or without /dev/ and resolve /dev/disk/by-*
links to their kernel name, so a disk can be pinned by a stable path.
When nothing matches, fail with "No disks match" like the m2 filter
already does. Document the accepted forms in the attribute help.
confluent_client and confluent_server rpms took the PEP 440 version
setup.py needs, 4.0.1.dev5+g..., which rpm sorts after 4.0.1: a
released package did not upgrade a development build of it. Stamp the
rpm with the ~dev form the other packages already use and keep .dev only
for setup.py and the sdist name. The debs already sort right, since
stdeb rewrites .dev to ~dev.
Python 3.13 dropped crypt from the stdlib, and openSUSE Leap 16 packages
neither legacycrypt nor crypt_r, so the server did not start there
without a pip install. Both of those only call crypt(3) from libcrypt,
which every distribution ships, so do that through ctypes as the last
resort, serialized because crypt(3) returns a static buffer. Its hashes
match the stdlib module byte for byte.
Move the import chain both callers carried into confluent.pwcrypt. The
legacycrypt Recommends is no longer needed.
Neither is packaged by EPEL or Ubuntu, so the hard dependency made the
server uninstallable there without --nodeps or a stub package. Both are
already optional in the code: httpapi drops passkey support when
webauthn does not import, and the Lenovo IMM2 BIOS settings path reports
the missing module as unsupported functionality. Recommend them instead,
as the SUSE branch already does for webauthn.
See xcat2/confluent#192.
For one, at the time an XCC emits a NOTIFY, it's DeviceDescription.json is also very sluggish. Extend timeout
knowing this may be delayed.
Further, if snoop comes back with only one address family, do not
perturb existing address families.
- A manager that is not a confluent node is pinned on the guest's node
(pubkeys.tls_hardwaremanager), as the console already does.
- user@realm!tokenid with the token secret is accepted as the login;
VNC needs a password login and says so.
- Route every API call through one checked path: non-2xx answers raise
with PVE's message, a 401 logs in again, a migrated guest is re-mapped.
- Report login failures other than 401 instead of a TypeError.
- Power changes are bounded and reported per node; 'on' when on is a
no-op; every live QEMU state counts as on.
- Read and set the boot order in every form PVE accepts, keeping disks.
- Stop toggling Content-Type on the shared client headers.
- Inventory from the current config, all SMBIOS forms.
- Refuse ambiguous guest names; skip templates.
- Keep the serial console alive and report how it ends.
- Let the self-test run without a config manager.
Jarrod Johnson
Markus Hilger
Laurence