extract_untethered_rootimg reports failure, for example when the image
does not fit into the memory backed root, but imageboot.sh ignored it and
booted into the partly extracted root, which then hung later on. Stop
with a message saying why instead.
image2disk rewrote root= in the boot loader entries but kept their
linux and initrd paths. Those come from where the image was built: in a
diskless image from imgutil they carry the scratch directory of the
server (grub2-mkrelpath sees its bind mount), and a /boot/ path does not
match the separate /boot filesystem image2disk creates for such images.
grub then fails with "you need to load the kernel". Make the paths
relative to the boot filesystem of the target.
An untethered or uncompressed diskless boot downloaded the root image
only from the deployment server and retried it forever when that server
failed. Try the other managers that answered discovery as well, as the
tethered urlmount already does.
urlmount limits each small range request to 10 seconds, but the single
whole-image download cannot take a total limit. Give up on a connect
after 10 seconds and on a transfer that stalls for 30 seconds instead,
so a hung server moves on to the next one.
Removing it afterwards copied /etc/dracut.conf.d up unlabeled in
tethered mode on images built with SELinux. Skip the whiteout that the
removal leaves in the upper layer.
The install runs before a policy is loaded, so the module index from
kernel-install and files of later post scripts stayed unlabeled and
systemd-modules-load failed. Relabel every local filesystem last.
On an untethered root, files the initramfs writes before policy load
and sockets that unsquashfs creates without attributes have no label.
Label every inode without one, as the upper layer is in tethered mode.
With a tethered root (and on EL8 always), the initramfs writes the
overlay upper layer before the SELinux policy is loaded, so those files
are unlabeled_t. On a captured enforcing image sshd-keygen then cannot
search / and the node comes up without sshd.
Label exactly the upper layer paths with matchpathcon and chcon.
setfiles would recurse into the merged tree and restorecon is a no-op
before policy load. Built images have SELinux disabled and skip this.
With installtodisk and confluent_imagemethod=untethered (or
uncompressed) imageboot.sh first extracts the image to RAM and tears
down the image mount and the cryptimg device. installimage then hands
the empty /mnt/remote to image2disk.py, which wipes the target disk and
fails with:
FileNotFoundError: [Errno 2] No such file or directory: '/dev/mapper/cryptimg'
Writing the image to disk never needs the RAM copy, so treat the image
method as tethered when installtodisk is set. The same profile can then
be switched between untethered and installtodisk by only adding or
removing installtodisk.
source_remote imageboot.sh is the last thing the diskless cmdline hook
runs, so returning early on a failed extraction ended the hook and left
dracut to time out. Falling through instead reaches the existing
/sysroot/sbin/init guard, which reports the failure and holds the node so
it stays reachable over ssh, as it did before extraction was checked.
Diskless profiles had the updatestatus callback in onboot.sh commented
out because no suitable status existed: 'complete' clears
deployment.pendingprofile, which the PXE responder requires to answer
the next network boot of a diskless node.
Add a 'booted' status that records the pending profile as
deployment.profile while leaving pendingprofile armed and skipping
autolock, and enable the onboot.sh callback in all diskless profiles.
nodedeploy now shows 'pending: <profile> (booted)' for a running
stateless node.
BUILDSRC is only set if imgutil build is run with --source, otherwise
the build host repos are used. If --source is not used, there is no
distribution symlink and add_local_repositores failed with 404.
Check if BUILDSRC is set and skip add_local_repositories if this is the
case.
`unsquashfs` can use multiple CPU cores during image extraction, significantly reducing boot time.
For example the whole boot time from PXE to shell on a 8-core VM, from approximately 45 seconds to 20 seconds.
This PR adds `squashfs-tools` as a dependency. Since the package is smaller than 1 MB, the additional image size is justified by the performance improvement.
For backward compatibility, the existing `cp`-based extraction method is used when `unsquashfs` is unavailable, such as with images built before this change.
The extraction logic has also been moved into the common functions and is now shared between EL9, EL10, and Ubuntu.
Both untethered `squashfs` images and `confluent_multisquash` images are supported.
Images must be rebuilt to include `unsquashfs` and benefit from the faster extraction path.
Centralize the SELinux chcon helper and use it for downloaded
systemd units, onboot hooks, and apiclient files across EL7 through EL10.
Include chcon in captured EL initramfs images.
Without this fix the onboot services failed to start on SELinux enabled
captured image.
This allows the FS to just live, uncompressed, in cache.
This is generally a bad idea, however:
- In a hypothetically super-tuned diskless image, the lack of double-cache can offset the lack of compression
- The image will have supreme read performance
- It will have the most deterministic memory behavior
By default, the squashfs file was being cached as well as the contents after extraction.
This is superfluous pressure on the cache of the OS.
However, it does help keep the image afloat through 'confignet', so
leave it on until onboot completes, then reclaim cache and disable further caching.
Rather than treat both as the same, since untethered has everything up front anyway, go ahead and extract the filesystem.
This makes the mount look more straightforward and makes it so deletion of files from
the image also frees ram.
Reduce obvious output about skipped devices.
Rule out any read-only device.
Amend minimum size to 2GB.
Among same priority devices, select the smallest target.
If debugssh is not requsted, the initramfs is not needed.
Do not unshare the mount namespace, leave the kernel relevant namespace 'normal'
Remove some initramfs content to free up some memory.
Jarrod Johnson
Markus Hilger
Jarrod Johnson