xCAT/confluent
2
0
Fork 0
mirror of https://github.com/xcat2/confluent.git synced 2026-08-04 00:17:01 +00:00
Code Issues Projects Releases Wiki Activity
6,382 Commits 41 Branches 83 Tags
cfc26f1e60d2615886562a14e50f983da2ceba2f
Commit Graph

3107 Commits

Author SHA1 Message Date
Jarrod Johnson 98190031df Merge pull request #221 from Obihoernchen/defaultdoc 
Add more attribute documentation
 2026-07-02 15:05:44 -04:00
Markus Hilger 0f20c709c0 Add more attribute documentation 
- deployment.lock: add missing 'unlocked' (messages.py's
  InputDeploymentLock/DeploymentLock already accept and persist it).
- hardwaremanagement.method: correct stale "ipmi is used if not
  specified" claim. Was changed to null in
  c14165e2bd.
- snmp.privacyprotocol: document that unset is treated as 'des'
  (snmputil.py explicitly groups None with 'des').
 2026-07-02 19:50:56 +02:00
Jarrod Johnson a8cd9a24d5 Auto-restart vtbufferd on exit 
If vtbuffer is interrupted, then restart it.
 2026-07-02 12:13:24 -04:00
Jarrod Johnson 752d04939b Merge pull request #220 from Obihoernchen/pubkeys_addpolicy 
Fix pubkeys.addpolicy documentation to match implementation
 2026-07-02 10:31:04 -04:00
Jarrod Johnson d24359a86c Add comments clarifying non-voting state with respect to security expectations 2026-07-02 10:27:21 -04:00
Markus Hilger 4c0b2e44f4 Fix pubkeys.addpolicy documentation to match implementation 
validvalues listed 'automatic'/'manual', but that was outdated.
Commit 454e1b8267 and cc70dcfa2b
implemented unset/'tofu' (trust-on-first-use, the default), 'manual', 'ca-only',
and an implicit 'ca' (any value that isn't otherwise handled falls
through to the standard CA-verification path, keying an already
pinned match without a full CA reverify).
The validvalues fix in ecaa75d967 rejected
these new values. Add new valid values with proper documentation.
 2026-07-02 15:55:50 +02:00
Jarrod Johnson ada4cb196d Lock down non-system users to not have open ended access 2026-07-01 21:11:27 -04:00
Jarrod Johnson 0106758ceb Prevent overwrite of existing files when saving licenses 2026-07-01 21:06:32 -04:00
Jarrod Johnson 1934b88b0d Use basename to ensure no path traversal in license filenames 2026-07-01 20:54:36 -04:00
Jarrod Johnson ae290c4419 Ensure the filename cannot have path traversal in XCC2 and older 2026-07-01 20:42:22 -04:00
Jarrod Johnson 57a4c840cb Fix web shell sessions 2026-07-01 14:47:42 -04:00
Jarrod Johnson 6bcf1b73ba Fix stale references to wsgi style env 2026-07-01 13:49:05 -04:00
Jarrod Johnson 3a6887b4b4 Provide nicer message when requested VM does not exist 2026-07-01 09:55:15 -04:00
Jarrod Johnson d761c7e6da Slow down reconnect attempts to powered down Proxmox VMs and better handle closed websockets. 2026-07-01 09:30:28 -04:00
Jarrod Johnson 45b392932d Handle unreachable proxmox host more friendly 2026-07-01 09:14:07 -04:00
Jarrod Johnson 33c67db3c4 Further mitigate potential XML misbehavior 
Since it turns out we already incurred lxml dependency, use lxml etree instead of xml and mitigate risky xml features beyond blocking the word '!entity'
 2026-07-01 08:28:25 -04:00
Jarrod Johnson fbec09c073 Fix behavior with IPMI bad user/password 2026-06-30 15:17:45 -04:00
Jarrod Johnson 5abd080ba2 Restore some sanity to redfish error handling 2026-06-30 13:56:34 -04:00
Jarrod Johnson 0383115446 Merge pull request #217 from Obihoernchen/hwplugins 
Add missing validvalues to attributes.py
 2026-06-30 08:13:21 -04:00
gosforthcross 6505810833 Improve handling of IPs with colon notation with seperate IPv4 and IPv6 paths, as well as whitespace stripping 2026-06-30 13:05:22 +02:00
gosforthcross fbb79de786 Include EUREKA in necessary files for loading and handling redfish and autodiscovery 2026-06-30 11:30:24 +02:00
gosforthcross 6ab7d573da Add EUREKA discovery handler 2026-06-30 11:29:19 +02:00
gosforthcross 5435acd23e Add redfish OEM implementation for EUREKA Chassis 2026-06-30 11:28:45 +02:00
gosforthcross cacfce214f Add fallback for generic redfish and add specific MEGWARE code path for EUREKA 2026-06-30 11:25:11 +02:00
gosforthcross b4882692ea Add port discovery via colon notation 2026-06-30 11:22:30 +02:00
Markus Hilger aed0bf0bea Add valid_values to hardwaremanagement.method 2026-06-30 04:26:48 +02:00
Markus Hilger ecaa75d967 Fix validvalues typo 
valid_values is never checked and is a typo. Use validvalues instead.

Note: This can break existing scripts if invalid values are used.
 2026-06-30 04:21:16 +02:00
Jarrod Johnson 3ce0988f5a Fix -s on certutil 2026-06-29 11:30:49 -04:00
Jarrod Johnson 2c669358b3 Restore ability for certutil to run as standalone script 
Also make days an argument
 2026-06-26 12:12:25 -04:00
Jarrod Johnson 9462de42ac Fix setboot when network not in bootorder 2026-06-25 15:56:11 -04:00
Jarrod Johnson c1eea55610 When possible, check confluent user access to file 
If a confluent user is a system user, do not allow them to
upload paths that their user would not have access to otherwise.

For non-system users, continue with the path based banned behavior.
 2026-06-25 12:14:54 -04:00
Jarrod Johnson d59652e0fd Prevent staging of files from indicating path traversal 2026-06-25 10:09:28 -04:00
Jarrod Johnson 46fbc11a93 Other than skipauth type users (unix domain socket root/confluent), no longer allow confluent user addition/manipulation. 2026-06-25 09:55:09 -04:00
Jarrod Johnson 78ffd509c9 Have messages force normalizing the incoming filenames 
This avoids downstream code that may expect specific locations from being confused.
 2026-06-25 09:48:11 -04:00
Jarrod Johnson 1449eee4f4 Fix to more reliably default to 47 2026-06-23 09:55:29 -04:00
Jarrod Johnson cf7f2f434d Add function for nodes to request a TLS certificate from confluent 
Also, make certificate lifetime default configurable as attribute, with 47 as explicit default.
 2026-06-23 09:39:16 -04:00
Jarrod Johnson 1068be423a Remove some python2 considerations 2026-06-23 08:30:21 -04:00
Jarrod Johnson d3f3242eea Draft attempt at a tlscert self api 2026-06-22 16:40:45 -04:00
Jarrod Johnson 701a9a7268 Adjustments for Suse 16.1 beta 2026-06-22 09:59:40 -04:00
Jarrod Johnson 4aef4ac6d3 Bring XCC3 raid config workaround forward 2026-06-16 10:49:31 -04:00
Jarrod Johnson b5c71e46ee SMM3 debug log workaround 2026-06-11 07:50:29 -04:00
Jarrod Johnson 48f75cc506 Begin SUE 16 support work 2026-06-10 13:25:17 -04:00
Jarrod Johnson 525186ac7f Add empty sensors to VM health 2026-06-09 16:52:59 -04:00
Jarrod Johnson 5bfd44528d Provide unknown health for vcenter and proxmox 2026-06-09 16:35:13 -04:00
Jarrod Johnson 44385388b6 Provide more verbose feedback 2026-06-09 16:17:40 -04:00
Jarrod Johnson c14165e2bd Switch to null by default 
Require active choice of ipmi
 2026-06-09 16:08:13 -04:00
Jarrod Johnson 2f6a87eccd Fix compatibility with newer ssh-agent 
Newer ssh-agent defaults to homedir agent location.

Unfortunately, /var/lib/confluent may be a poor fit, so go back to how openssh used to handle it.
 2026-06-08 10:31:29 -04:00
Jarrod Johnson c8c00c8f5f Update to ast.Constant 
Python removed ast.Num in 3.14
 2026-06-08 09:19:04 -04:00
Jarrod Johnson 3a09861ef6 Set name/email for debian builds 2026-06-05 14:27:05 -04:00
Jarrod Johnson 0b10c240bd Fx issues with IPMI session management 
Do not continue waiting when session is broken.

Do not call _timedout without releasing the lock first.

Properly await on relog with bad rakp4

If an accounting issue pushes logontries too far without touching zero, then still recognize retries were exhausted.

Timeout on missing RAKP2 if retries were already exhausted.
 2026-06-05 09:44:10 -04:00