Check the profile *before* rebooting systems

This provides a much better experience when a typo or other mistake has a profile that is not actionable.
Fix some osdeploy ordering issues
2026-09-29 00:31:09 +00:00 · 2023-11-16 10:20:48 -05:00 · 2023-11-15 11:30:20 -05:00 · 2023-11-14 15:14:54 -05:00 · 2023-11-13 15:43:11 -05:00 · 2023-11-09 17:28:38 -05:00
19 changed files with 233 additions and 73 deletions
@@ -90,17 +90,6 @@ def main(args):
        if 'error' in rsp:
            sys.stderr.write(rsp['error'] + '\n')
            sys.exit(1)
-    if not args.clear and args.network and not args.prepareonly:
-        rc = c.simple_noderange_command(args.noderange, '/boot/nextdevice', 'network',
-                                        bootmode='uefi',
-                                        persistent=False,
-                                        errnodes=errnodes)
-        if errnodes:
-            sys.stderr.write(
-                'Unable to set boot device for following nodes: {0}\n'.format(
-                    ','.join(errnodes)))
-            return 1
-        rc |= c.simple_noderange_command(args.noderange, '/power/state', 'boot')
    if args.clear:
        cleararm(args.noderange, c)
        clearpending(args.noderange, c)
@@ -120,7 +109,7 @@ def main(args):
                for profname in profnames:
                    sys.stderr.write('    ' + profname + '\n')
            else:
-                sys.stderr.write('No deployment profiles available, try osdeploy fiimport or imgutil capture\n')
+                sys.stderr.write('No deployment profiles available, try osdeploy import or imgutil capture\n')
            sys.exit(1)
        armonce(args.noderange, c)
        setpending(args.noderange, args.profile, c)
@@ -166,6 +155,17 @@ def main(args):
            else:
                print('{0}: {1}{2}'.format(node, profile, armed))
        sys.exit(0)
+    if not args.clear and args.network and not args.prepareonly:
+        rc = c.simple_noderange_command(args.noderange, '/boot/nextdevice', 'network',
+                                        bootmode='uefi',
+                                        persistent=False,
+                                        errnodes=errnodes)
+        if errnodes:
+            sys.stderr.write(
+                'Unable to set boot device for following nodes: {0}\n'.format(
+                    ','.join(errnodes)))
+            return 1
+        rc |= c.simple_noderange_command(args.noderange, '/power/state', 'boot')
    if args.network and not args.prepareonly:
        return rc
    return 0
@@ -151,13 +151,14 @@ class NetplanManager(object):
        needcfgapply = False
        for devname in devnames:
            needcfgwrite = False
-            if stgs['ipv6_method'] == 'static':
+            # ipv6_method missing at uconn...
+            if stgs.get('ipv6_method', None) == 'static':
                curraddr = stgs['ipv6_address']
                currips = self.getcfgarrpath([devname, 'addresses'])
                if curraddr not in currips:
                    needcfgwrite = True
                    currips.append(curraddr)
-            if stgs['ipv4_method'] == 'static':
+            if stgs.get('ipv4_method', None) == 'static':
                curraddr = stgs['ipv4_address']
                currips = self.getcfgarrpath([devname, 'addresses'])
                if curraddr not in currips:
@@ -180,7 +181,7 @@ class NetplanManager(object):
            if dnsips:
                currdnsips = self.getcfgarrpath([devname, 'nameservers', 'addresses'])
                for dnsip in dnsips:
-                    if dnsip not in currdnsips:
+                    if dnsip and dnsip not in currdnsips:
                        needcfgwrite = True
                        currdnsips.append(dnsip)
            if dnsdomain:
@@ -344,7 +345,7 @@ class NetworkManager(object):
                    bondcfg[stg] = deats[stg]
        if member in self.uuidbyname:
            subprocess.check_call(['nmcli', 'c', 'del', self.uuidbyname[member]])
-        subprocess.check_call(['nmcli', 'c', 'add', 'type', 'team-slave', 'master', team, 'con-name', member, 'connection.interface-name', member])
+        subprocess.check_call(['nmcli', 'c', 'add', 'type', 'bond-slave', 'master', team, 'con-name', member, 'connection.interface-name', member])
        if bondcfg:
            args = []
            for parm in bondcfg:
@@ -378,7 +379,7 @@ class NetworkManager(object):
            for arg in cmdargs:
                cargs.append(arg)
                cargs.append(cmdargs[arg])
-            subprocess.check_call(['nmcli', 'c', 'add', 'type', 'team', 'con-name', cname, 'connection.interface-name', cname, 'team.runner', stgs['team_mode']] + cargs)
+            subprocess.check_call(['nmcli', 'c', 'add', 'type', 'bond', 'con-name', cname, 'connection.interface-name', cname, 'bond.options', 'mode={}'.format(stgs['team_mode'])] + cargs)
            for iface in cfg['interfaces']:
                self.add_team_member(cname, iface)
            subprocess.check_call(['nmcli', 'c', 'u', cname])
@@ -435,7 +436,7 @@ if __name__ == '__main__':
                    curridx = addr[-1]
        if curridx in doneidxs:
            continue
-        for tries in (1, 2 3):
+        for tries in (1, 2, 3):
            try:
                status, nc = apiclient.HTTPSClient(usejson=True, host=srv).grab_url_with_status('/confluent-api/self/netcfg')
                break
@@ -446,7 +447,7 @@ if __name__ == '__main__':
                continue
        nc = json.loads(nc)
        if not dc:
-            for tries in (1, 2 3):
+            for tries in (1, 2, 3):
                try:
                    status, dc = apiclient.HTTPSClient(usejson=True, host=srv).grab_url_with_status('/confluent-api/self/deploycfg2')
                    break
@@ -189,7 +189,7 @@ cat > /run/NetworkManager/system-connections/$ifname.nmconnection << EOC
 EOC
 echo id=${ifname} >> /run/NetworkManager/system-connections/$ifname.nmconnection
 echo uuid=$(uuidgen) >> /run/NetworkManager/system-connections/$ifname.nmconnection
-linktype=$(ip link |grep -A2 ${ifname}|tail -n 1|awk '{print $1}')
+linktype=$(ip link show dev ${ifname}|grep link/|awk '{print $1}')
 if [ "$linktype" = link/infiniband ]; then
 	linktype="infiniband"
 else
@@ -154,7 +154,7 @@ cat > /run/NetworkManager/system-connections/$ifname.nmconnection << EOC
 EOC
 echo id=${ifname} >> /run/NetworkManager/system-connections/$ifname.nmconnection
 echo uuid=$(uuidgen) >> /run/NetworkManager/system-connections/$ifname.nmconnection
-linktype=$(ip link |grep -A2 ${ifname}|tail -n 1|awk '{print $1}')
+linktype=$(ip link show dev ${ifname}|grep link/|awk '{print $1}')
 if [ "$linktype" = link/infiniband ]; then
        linktype="infiniband"
 else
@@ -174,6 +174,8 @@ dnsdomain=${dnsdomain#dnsdomain: }
 echo search $dnsdomain >> /etc/resolv.conf
 echo -n "Initializing ssh..."
 ssh-keygen -A
+mkdir -p /usr/share/empty.sshd
+rm /etc/ssh/ssh_host_dsa_key*
 for pubkey in /etc/ssh/ssh_host*key.pub; do
    certfile=${pubkey/.pub/-cert.pub}
    privfile=${pubkey%.pub}
@@ -1,4 +1,5 @@
 if ! grep console= /proc/cmdline > /dev/null; then
+    mkdir -p /custom-installation
    /opt/confluent/bin/autocons > /custom-installation/autocons.info
    cons=$(cat /custom-installation/autocons.info)
    if [ ! -z "$cons" ]; then
@@ -206,6 +206,8 @@ def fixup(rootdir, vols):
            partnum = re.search('(\d+)$', targdev).group(1)
            targblock = re.search('(.*)\d+$', targdev).group(1)
    if targblock:
+        if targblock.endswith('p') and 'nvme' in targblock:
+            targblock = targblock[:-1]
        shimpath = subprocess.check_output(['find', os.path.join(rootdir, 'boot/efi'), '-name', 'shimx64.efi']).decode('utf8').strip()
        shimpath = shimpath.replace(rootdir, '/').replace('/boot/efi', '').replace('//', '/').replace('/', '\\')
        subprocess.check_call(['efibootmgr', '-c', '-d', targblock, '-l', shimpath, '--part', partnum])
@@ -15,6 +15,7 @@ import confluent.sshutil as sshutil
 import confluent.certutil as certutil
 import confluent.client as client
 import confluent.config.configmanager as configmanager
+import confluent.netutil as netutil
 import eventlet.green.subprocess as subprocess
 import tempfile
 import shutil
@@ -244,7 +245,7 @@ if __name__ == '__main__':
                allok = False
                uuidok = True  # not really, but suppress the spurious error
            dnsdomain = rsp.get('dns.domain', {}).get('value', '')
-            if ',' in dnsdomain or ' ' in dnsdomain:
+            if dnsdomain and (',' in dnsdomain or ' ' in dnsdomain):
                allok = False
                emprint(f'{args.node} has a dns.domain that appears to be a search instead of singular domain')
                uuidok = True  # not really, but suppress the spurious error
@@ -269,9 +270,28 @@ if __name__ == '__main__':
                    switch_value = rsp[key].get('value',None)
                    if switch_value and switch_value not in valid_nodes:
                        emprint(f'{switch_value} is not a valid node name (as referenced by attribute "{key}" of node {args.node}).')
+        print(f"Checking network configuration for {args.node}")
+        cfg = configmanager.ConfigManager(None)
+        bootablev4nics = []
+        bootablev6nics = []
+        for nic in glob.glob("/sys/class/net/*/ifindex"):
+            idx = int(open(nic, "r").read())
+            nicname = nic.split('/')[-2]
+            ncfg = netutil.get_nic_config(cfg, args.node, ifidx=idx)
+            if ncfg['ipv4_address'] or ncfg['ipv4_method'] == 'dhcp':
+                bootablev4nics.append(nicname)
+            if ncfg['ipv6_address']:
+                bootablev6nics.append(nicname)
+        if bootablev4nics:
+            print("{} appears to have network configuration suitable for IPv4 deployment via: {}".format(args.node, ",".join(bootablev4nics)))
+        elif bootablev6nics:
+            print('{} appears to have networking configuration suitable for IPv6 deployment via: {}'.format(args.node, ",".join(bootablev6nics)))
+        else:
+            emprint(f"{args.node} may not have any viable IP network configuration (check name resolution (DNS or hosts file) "
+                    "and/or net.*ipv4_address, and verify that the deployment serer addresses and subnet mask/prefix length are accurate)")
        if not uuidok and not macok:
            allok = False
-            emprint(f'{args.node} does not have a uuid or mac address defined in id.uuid or net.*hwaddr, deployment will not work')
+            emprint(f'{args.node} does not have a uuid or mac address defined in id.uuid or net.*hwaddr, deployment will not work (Example resolution: nodeinventory {args.node} -s)')
        if allok:
            print(f'No issues detected with attributes of {args.node}')
        fprint("Checking name resolution: ")
@@ -72,6 +72,12 @@ def main(args):
        return rebase(cmdset.profile)
    ap.print_help()

+def symlinkp(src, trg):
+    try:
+        os.symlink(src, trg)
+    except Exception as e:
+        if e.errno != 17:
+            raise

 def initialize_genesis():
    if not os.path.exists('/opt/confluent/genesis/x86_64/boot/kernel'):
@@ -89,30 +95,33 @@ def initialize_genesis():
        return retval[1]
    retcode = 0
    try:
+        util.mkdirp('/var/lib/confluent', 0o755)
        if hasconfluentuser:
+            os.chown('/var/lib/confluent', hasconfluentuser.pw_uid, -1)
            os.setgid(hasconfluentuser.pw_gid)
            os.setuid(hasconfluentuser.pw_uid)
        os.umask(0o22)
-        os.makedirs('/var/lib/confluent/public/os/genesis-x86_64/boot/efi/boot', 0o755)
-        os.makedirs('/var/lib/confluent/public/os/genesis-x86_64/boot/initramfs', 0o755)
-        os.symlink('/opt/confluent/genesis/x86_64/boot/efi/boot/BOOTX64.EFI',
+        util.mkdirp('/var/lib/confluent/public/os/genesis-x86_64/boot/efi/boot', 0o755)
+        util.mkdirp('/var/lib/confluent/public/os/genesis-x86_64/boot/initramfs', 0o755)
+        symlinkp('/opt/confluent/genesis/x86_64/boot/efi/boot/BOOTX64.EFI',
                '/var/lib/confluent/public/os/genesis-x86_64/boot/efi/boot/BOOTX64.EFI')
-        os.symlink('/opt/confluent/genesis/x86_64/boot/efi/boot/grubx64.efi',
+        symlinkp('/opt/confluent/genesis/x86_64/boot/efi/boot/grubx64.efi',
                '/var/lib/confluent/public/os/genesis-x86_64/boot/efi/boot/grubx64.efi')
-        os.symlink('/opt/confluent/genesis/x86_64/boot/initramfs/distribution',
+        symlinkp('/opt/confluent/genesis/x86_64/boot/initramfs/distribution',
                '/var/lib/confluent/public/os/genesis-x86_64/boot/initramfs/distribution')
-        os.symlink('/var/lib/confluent/public/site/initramfs.cpio',
+        symlinkp('/var/lib/confluent/public/site/initramfs.cpio',
                '/var/lib/confluent/public/os/genesis-x86_64/boot/initramfs/site.cpio')
-        os.symlink('/opt/confluent/lib/osdeploy/genesis/initramfs/addons.cpio',
+        symlinkp('/opt/confluent/lib/osdeploy/genesis/initramfs/addons.cpio',
                '/var/lib/confluent/public/os/genesis-x86_64/boot/initramfs/addons.cpio')
-        os.symlink('/opt/confluent/genesis/x86_64/boot/kernel',
+        symlinkp('/opt/confluent/genesis/x86_64/boot/kernel',
                '/var/lib/confluent/public/os/genesis-x86_64/boot/kernel')
-        shutil.copytree('/opt/confluent/lib/osdeploy/genesis/profiles/default/ansible/',
-                        '/var/lib/confluent/public/os/genesis-x86_64/ansible/')
-        shutil.copytree('/opt/confluent/lib/osdeploy/genesis/profiles/default/scripts/',
-                        '/var/lib/confluent/public/os/genesis-x86_64/scripts/')
-        shutil.copyfile('/opt/confluent/lib/osdeploy/genesis/profiles/default/profile.yaml',
-                       '/var/lib/confluent/public/os/genesis-x86_64/profile.yaml')
+        if not os.path.exists('/var/lib/confluent/public/os/genesis-x86_64/ansible/'):
+            shutil.copytree('/opt/confluent/lib/osdeploy/genesis/profiles/default/ansible/',
+                            '/var/lib/confluent/public/os/genesis-x86_64/ansible/')
+            shutil.copytree('/opt/confluent/lib/osdeploy/genesis/profiles/default/scripts/',
+                            '/var/lib/confluent/public/os/genesis-x86_64/scripts/')
+            shutil.copyfile('/opt/confluent/lib/osdeploy/genesis/profiles/default/profile.yaml',
+                            '/var/lib/confluent/public/os/genesis-x86_64/profile.yaml')
    except Exception as e:
        sys.stderr.write(str(e) + '\n')
        retcode = 1
@@ -373,9 +382,14 @@ def initialize(cmdset):
        for rsp in c.read('/uuid'):
            uuid = rsp.get('uuid', {}).get('value', None)
            if uuid:
-                with open('confluent_uuid', 'w') as uuidout:
-                    uuidout.write(uuid)
-                    uuidout.write('\n')
+                oum = os.umask(0o11)
+                try:
+                    with open('confluent_uuid', 'w') as uuidout:
+                        uuidout.write(uuid)
+                        uuidout.write('\n')
+                    os.chmod('confluent_uuid', 0o644)
+                finally:
+                    os.umask(oum)
    totar.append('confluent_uuid')
    topack.append('confluent_uuid')
    if os.path.exists('ssh'):
@@ -403,7 +417,17 @@ def initialize(cmdset):
        if res:
            sys.stderr.write('Error occurred while packing site initramfs')
            sys.exit(1)
-    os.rename(tmpname, '/var/lib/confluent/public/site/initramfs.cpio')
+    oum = os.umask(0o22)
+    try:
+        os.rename(tmpname, '/var/lib/confluent/public/site/initramfs.cpio')
+        os.chmod('/var/lib/confluent/public/site/initramfs.cpio', 0o644)
+    finally:
+        os.umask(oum)
+    oum = os.umask(0o22)
+    try:
+        os.chmod('/var/lib/confluent/public/site/initramfs.cpio', 0o644)
+    finally:
+        os.umask(oum)
    if cmdset.g:
        updateboot('genesis-x86_64')
    if totar:
@@ -411,6 +435,11 @@ def initialize(cmdset):
        tarcmd = ['tar', '-czf', tmptarname] + totar
        subprocess.check_call(tarcmd)
        os.rename(tmptarname, '/var/lib/confluent/public/site/initramfs.tgz')
+        oum = os.umask(0o22)
+        try:
+            os.chmod('/var/lib/confluent/public/site/initramfs.tgz', 0o644)
+        finally:
+            os.umask(0o22)
    os.chdir(opath)
    print('Site initramfs content packed successfully')

@@ -421,6 +450,9 @@ def initialize(cmdset):


 def updateboot(profilename):
+    if not os.path.exists('/var/lib/confluent/public/site/initramfs.cpio'):
+        emprint('Must generate site content first (TLS (-t) and/or SSH (-s))')
+        return 1
    c = client.Command()
    for rsp in c.update('/deployment/profiles/{0}'.format(profilename),
            {'updateboot': 1}):
@@ -95,27 +95,29 @@ def assure_tls_ca():
        os.makedirs(os.path.dirname(fname))
    except OSError as e:
        if e.errno != 17:
+            os.seteuid(ouid)
            raise
+    try:
+        shutil.copy2('/etc/confluent/tls/cacert.pem', fname)
+        hv, _ = util.run(
+            ['openssl', 'x509', '-in', '/etc/confluent/tls/cacert.pem', '-hash', '-noout'])
+        if not isinstance(hv, str):
+            hv = hv.decode('utf8')
+        hv = hv.strip()
+        hashname = '/var/lib/confluent/public/site/tls/{0}.0'.format(hv)
+        certname = '{0}.pem'.format(collective.get_myname())
+        for currname in os.listdir('/var/lib/confluent/public/site/tls/'):
+            currname = os.path.join('/var/lib/confluent/public/site/tls/', currname)
+            if currname.endswith('.0'):
+                try:
+                    realname = os.readlink(currname)
+                    if realname == certname:
+                        os.unlink(currname)
+                except OSError:
+                    pass
+        os.symlink(certname, hashname)
    finally:
        os.seteuid(ouid)
-    shutil.copy2('/etc/confluent/tls/cacert.pem', fname)
-    hv, _ = util.run(
-        ['openssl', 'x509', '-in', '/etc/confluent/tls/cacert.pem', '-hash', '-noout'])
-    if not isinstance(hv, str):
-        hv = hv.decode('utf8')
-    hv = hv.strip()
-    hashname = '/var/lib/confluent/public/site/tls/{0}.0'.format(hv)
-    certname = '{0}.pem'.format(collective.get_myname())
-    for currname in os.listdir('/var/lib/confluent/public/site/tls/'):
-        currname = os.path.join('/var/lib/confluent/public/site/tls/', currname)
-        if currname.endswith('.0'):
-            try:
-                realname = os.readlink(currname)
-                if realname == certname:
-                    os.unlink(currname)
-            except OSError:
-                pass
-    os.symlink(certname, hashname)

 def substitute_cfg(setting, key, val, newval, cfgfile, line):
    if key.strip() == setting:
@@ -481,6 +481,20 @@ def _init_core():
                    'pluginattrs': ['hardwaremanagement.method'],
                    'default': 'ipmi',
                }),
+                'normalized': {
+                    'inlet_temp': PluginRoute({
+                        'pluginattrs': ['hardwaremanagement.method'],
+                        'default': 'ipmi',
+                    }),
+                    'average_cpu_temp': PluginRoute({
+                        'pluginattrs': ['hardwaremanagement.method'],
+                        'default': 'ipmi',
+                    }),
+                    'total_power': PluginRoute({
+                        'pluginattrs': ['hardwaremanagement.method'],
+                        'default': 'ipmi',
+                    }),
+                },
                'energy': PluginCollection({
                    'pluginattrs': ['hardwaremanagement.method'],
                    'default': 'ipmi',
@@ -1084,7 +1084,7 @@ def serve(bind_host, bind_port):
        pass  # we gave it our best shot there
    try:
        eventlet.wsgi.server(sock, resourcehandler, log=False, log_output=False,
-                             debug=False, socket_timeout=60)
+                             debug=False, socket_timeout=60, keepalive=False)
    except TypeError:
        # Older eventlet in place, skip arguments it does not understand
        eventlet.wsgi.server(sock, resourcehandler, log=False, debug=False)
@@ -861,6 +861,23 @@ class IpmiHandler(object):
            resourcename = sensor['name']
            self.ipmicmd.sensormap[simplify_name(resourcename)] = resourcename

+    def read_normalized(self, sensorname):
+        readings = None
+        if sensorname == 'average_cpu_temp':
+            cputemp = self.ipmicmd.get_average_processor_temperature()
+            readings = [cputemp]
+        elif sensorname == 'inlet_temp':
+            inltemp = self.ipmicmd.get_inlet_temperature()
+            readings = [inltemp]
+        elif sensorname == 'total_power':
+            sensor = EmptySensor('Total Power')
+            sensor.states = []
+            sensor.units = 'W'
+            sensor.value = self.ipmicmd.get_system_power_watts()
+            readings = [sensor]
+        if readings:
+            self.output.put(msg.SensorReadings(readings, name=self.node))
+
    def read_sensors(self, sensorname):
        if sensorname == 'all':
            sensors = self.ipmicmd.get_sensor_descriptions()
@@ -1157,6 +1174,8 @@ class IpmiHandler(object):
        if len(self.element) < 3:
            return
        self.sensorcategory = self.element[2]
+        if self.sensorcategory == 'normalized':
+            return self.read_normalized(self.element[-1])
        # list sensors per category
        if len(self.element) == 3 and self.element[-2] == 'hardware':
            if self.sensorcategory == 'leds':
@@ -712,6 +712,23 @@ class IpmiHandler(object):
            resourcename = sensor['name']
            self.sensormap[simplify_name(resourcename)] = resourcename

+    def read_normalized(self, sensorname):
+        readings = None
+        if sensorname == 'average_cpu_temp':
+            cputemp = self.ipmicmd.get_average_processor_temperature()
+            readings = [cputemp]
+        elif sensorname == 'inlet_temp':
+            inltemp = self.ipmicmd.get_inlet_temperature()
+            readings = [inltemp]
+        elif sensorname == 'total_power':
+            sensor = EmptySensor('Total Power')
+            sensor.states = []
+            sensor.units = 'W'
+            sensor.value = self.ipmicmd.get_system_power_watts()
+            readings = [sensor]
+        if readings:
+            self.output.put(msg.SensorReadings(readings, name=self.node))
+
    def read_sensors(self, sensorname):
        if sensorname == 'all':
            sensors = self.ipmicmd.get_sensor_descriptions()
@@ -1012,6 +1029,8 @@ class IpmiHandler(object):
        if len(self.element) < 3:
            return
        self.sensorcategory = self.element[2]
+        if self.sensorcategory == 'normalized':
+            return self.read_normalized(self.element[-1])
        # list sensors per category
        if len(self.element) == 3 and self.element[-2] == 'hardware':
            if self.sensorcategory == 'leds':
@@ -98,14 +98,15 @@ def initialize_ca():
         preexec_fn=normalize_uid)
    ouid = normalize_uid()
    try:
-        os.makedirs('/var/lib/confluent/public/site/ssh/', mode=0o755)
-    except OSError as e:
-        if e.errno != 17:
-            raise
+        try:
+            os.makedirs('/var/lib/confluent/public/site/ssh/', mode=0o755)
+        except OSError as e:
+            if e.errno != 17:
+                raise
+        cafilename = '/var/lib/confluent/public/site/ssh/{0}.ca'.format(myname)
+        shutil.copy('/etc/confluent/ssh/ca.pub', cafilename)
    finally:
        os.seteuid(ouid)
-    cafilename = '/var/lib/confluent/public/site/ssh/{0}.ca'.format(myname)
-    shutil.copy('/etc/confluent/ssh/ca.pub', cafilename)
    #    newent = '@cert-authority * ' + capub.read()


@@ -129,11 +130,21 @@ def prep_ssh_key(keyname):
            ap.write('#!/bin/sh\necho $CONFLUENT_SSH_PASSPHRASE\nrm {0}\n'.format(askpass))
        os.chmod(askpass, 0o700)
        os.environ['CONFLUENT_SSH_PASSPHRASE'] = get_passphrase()
+        olddisplay = os.environ.get('DISPLAY', None)
+        oldaskpass = os.environ.get('SSH_ASKPASS', None)
        os.environ['DISPLAY'] = 'NONE'
        os.environ['SSH_ASKPASS'] = askpass
-        with open(os.devnull, 'wb') as devnull:
-            subprocess.check_output(['ssh-add', keyname], stdin=devnull, stderr=devnull)
-        del os.environ['CONFLUENT_SSH_PASSPHRASE']
+        try:
+            with open(os.devnull, 'wb') as devnull:
+                subprocess.check_output(['ssh-add', keyname], stdin=devnull, stderr=devnull)
+        finally:
+            del os.environ['CONFLUENT_SSH_PASSPHRASE']
+            del os.environ['DISPLAY']
+            del os.environ['SSH_ASKPASS']
+            if olddisplay:
+                os.environ['DISPLAY'] = olddisplay
+            if oldaskpass:
+                os.environ['SSH_ASKPASS'] = oldaskpass
        ready_keys[keyname] = 1
    finally:
        adding_key = False
@@ -175,6 +186,14 @@ def initialize_root_key(generate, automation=False):
        if os.path.exists('/etc/confluent/ssh/automation'):
            alreadyexist = True
        else:
+            ouid = normalize_uid()
+            try:
+                os.makedirs('/etc/confluent/ssh', mode=0o700)
+            except OSError as e:
+                if e.errno != 17:
+                    raise
+            finally:
+                os.seteuid(ouid)
            subprocess.check_call(
                ['ssh-keygen', '-t', 'ed25519',
                '-f','/etc/confluent/ssh/automation', '-N', get_passphrase(),
@@ -212,6 +212,8 @@ def sync_list_to_node(sl, node, suffixes, peerip=None):
                    unreadablefiles.append(filename.replace(targdir, ''))
        if unreadablefiles:
            raise Exception("Syncing failed due to unreadable files: " + ','.join(unreadablefiles))
+        elif b'Permission denied, please try again.' in e.stderr:
+            raise Exception('Syncing failed due to authentication error, is the confluent automation key not set up (osdeploy initialize -a) or is there some process replacing authorized_keys on the host?')
        else:
            raise
    finally:
@@ -29,9 +29,9 @@ import struct
 import eventlet.green.subprocess as subprocess


-def mkdirp(path):
+def mkdirp(path, mode=0o777):
    try:
-        os.makedirs(path)
+        os.makedirs(path, mode)
    except OSError as e:
        if e.errno != 17:
            raise
@@ -42,7 +42,7 @@ def run(cmd):
    stdout, stderr = process.communicate()
    retcode = process.poll()
    if retcode:
-        raise subprocess.CalledProcessError(retcode, process.args, output=stdout)
+        raise subprocess.CalledProcessError(retcode, process.args, output=stdout, stderr=stderr)
    return stdout, stderr


@@ -22,3 +22,16 @@ modification, are permitted provided that the following conditions are met:
  * Neither the name of the copyright holder nor the
    names of contributors may be used to endorse or promote products
    derived from this software without specific prior written permission.
+
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER AND CONTRIBUTORS
+* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS,
+* COPYRIGHT HOLDERS, OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+* USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+* ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
@@ -61,13 +61,27 @@ FALLOC_FL_PUNCH_HOLE = 2
 numregex = re.compile('([0-9]+)')

 def get_partition_info():
+    with open('/proc/self/mountinfo') as procinfo:
+        mountinfo = procinfo.read()
+    capmounts = set([])
+    for entry in mountinfo.split('\n'):
+        if not entry:
+            continue
+        firstinf, lastinf = entry.split(' - ')
+        root, mount = firstinf.split()[3:5]
+        filesystem = lastinf.split()[0]
+        if root != '/':
+            continue
+        if filesystem not in ('ext3', 'ext4', 'xfs', 'btrfs', 'vfat'):
+            continue
+        capmounts.add(mount)
    with open('/proc/mounts') as procmounts:
        mountinfo = procmounts.read()
    for entry in mountinfo.split('\n'):
        if not entry:
            continue
        dev, mount, fs, flags = entry.split()[:4]
-        if fs not in ('ext3', 'ext4', 'xfs', 'btrfs', 'vfat'):
+        if mount not in capmounts:
            continue
        fsinfo = os.statvfs(mount)
        partinfo = {
Author	SHA1	Message	Date
Jarrod Johnson	9757cd1ae3	Check the profile before rebooting systems This provides a much better experience when a typo or other mistake has a profile that is not actionable.	2023-11-16 10:20:48 -05:00
Jarrod Johnson	c9452e65e8	Fix some osdeploy ordering issues osdeploy initialization dependencies have been improved and marked if absolutely dependent.	2023-11-15 11:30:20 -05:00
Jarrod Johnson	cd07e0e212	Add missing disclaimer from tmt license	2023-11-14 15:14:54 -05:00
Jarrod Johnson	f475d58955	Various permission fixes for osdeploy initialize Fix a few scenarios where certain ordering of initialize creates unworkable permissions.	2023-11-13 15:43:11 -05:00
Jarrod Johnson	ec023831a5	Fix syntax error in confignet	2023-11-09 17:28:38 -05:00
Jarrod Johnson	6e092934e7	Fix for ubuntu clone to nvme	2023-11-09 17:15:17 -05:00
Jarrod Johnson	e03f010eac	Fix Ubuntu confignet without IPv6 If confignet did not have ipv6 to work with, it would fail to work at all. Also handle when the configuration has a blank DNS server in it.	2023-11-09 09:03:59 -05:00
Jarrod Johnson	2cd75ef425	Fix diskless autocons message	2023-11-08 10:22:51 -05:00
Jarrod Johnson	e90f2829ab	Filter bind mounts from imgutil capture If bind mounts are in use, it will foul the capture. Notably, one example is if you install the firefox snap in ubuntu, snapd creates a bind mount. This will ignore bind mounts, and rely upon the system to put it straight.	2023-11-08 09:37:44 -05:00
Jarrod Johnson	8f927d94e9	Switch to bond from team Teaming is deprecated and EL went back to bond, follow that guidance.	2023-11-01 11:17:04 -04:00
Jarrod Johnson	8a4ef0b1fe	Make link type detection more specific If the ip command shows altnames, do not let the altnames interfere with locking on to linktype. Further, use show dev instead of grep to be more specific.	2023-11-01 10:42:33 -04:00
Jarrod Johnson	814f420852	Update genesis to deal with CS9 sshd	2023-10-31 11:47:28 -04:00
Jarrod Johnson	a1ac234b73	Enhance error message for authentication issue during syncfiles	2023-10-27 15:31:14 -04:00
Jarrod Johnson	d082610678	Add more deep checking of node networking Whether due to the management node or node IP addresses, check if deployment can reasonably proceed using IPv4 or IPv6, and give a warning with some suggestions to check. Also, add nodeinventory <node> -s as an example resolution for missing uuid.	2023-10-27 13:34:52 -04:00
Jarrod Johnson	0857716f64	Add support for normalized sensors This opens the door for normalized common sensors for clients that care about the semantics but cannot keep track of inconsistent sensor names from implementation to implementation.	2023-10-26 08:58:37 -04:00
Jarrod Johnson	49a504972f	Fix syntax error in confignet	2023-10-25 14:21:55 -04:00
Jarrod Johnson	9c9d71882c	Disable keepalive Unfortunately, apache can get a bit odd over how it reports a non-viable open socket for keepalive, which can happen in certain windows. Disable the keepalive feature and take some performance penalty in browsers for the sake of more consistent return behavior and fewer idle greenthreads doing nothing.	2023-10-19 15:51:40 -04:00