cons/kvm drives the KVM guest serial console through a shared tmux session on
the hypervisor (tmux, unlike screen, is present on every libvirt host we target
incl. ppc64le hosts that ship no screen). The KVM host package lists were never
updated for that switch, so an xCAT-provisioned KVM host got 'screen' (now
unused) -- or nothing -- where tmux is required, leaving rcons broken.
Ship tmux in the KVM host pkglists:
- install/rh, install/ubuntu: screen -> tmux / add tmux.
- netboot/{alma,centos,rocky}: were symlinks to the RHEL 5.4 list; make them
real lists with tmux (the rhel5/6/7 lists keep screen).
- install/suse: add a KVM host list (SUSE had none) carrying tmux.
screen stays where it is still used: the Xen console, and the EOL rhel5/6/7 and
centos6/7 lists.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The diskful service-node otherpkgs pkglist exists for every EL version and
both arches EXCEPT rhels10 ppc64le: install/rh/ has
service.rhels10.x86_64.otherpkgs.pkglist (and install/alma/ symlinks it) but
no ppc64le counterpart, while rhels5/6/7/8/9 and the netboot/ tree carry both
arches. xcat-test's SN_setup_case points a ppc64le service node's osimage
otherpkglist at install/<distro>/service.<ver>.ppc64le.otherpkgs.pkglist; with
the file absent the list resolves empty, so the otherpkgs postscript installs
nothing -- xCATsn never lands, xcatd never starts on the service node, and
every hierarchical dispatch fails with "<sn>:3001 No route to host /
Connection refused", cascading the whole *_hierarchy test suite.
Add install/rh/service.rhels10.ppc64le.otherpkgs.pkglist (xCATsn + the rh10
ppc64le goconserver, mirroring rhels9) and the install/alma symlink to it,
matching the existing x86_64 layout.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
cons/kvm ran `ssh -t <vmhost> screen ... <pty>`, which requires screen on every
hypervisor. Bare libvirt hosts (notably ppc64le power servers) ship tmux but not
screen, so goconserver's console fork failed and no console was captured.
Use tmux (present on all our libvirt hosts) for the shared detach/reattach
session, wrapping `virsh console` keyed on the domain name (== the xCAT node name
for KVM) -- stable across guest reboots, unlike the raw serial pty. The session
status bar is disabled so the captured console log stays clean serial.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
build_xmldesc only recognised cpumodel "ppc64" (big-endian) when deciding to set
<os type arch='ppc64' machine='pseries'>, but ppc64le hosts report cpumodel
"ppc64le" (virNodeGetInfo model). A guest on a ppc64le hypervisor was therefore
emitted as an x86-style domain -- no machine type and with pae/acpi/apic -- and
libvirt rejected it: "machine type 'pseries-*' does not support ACPI".
Recognise "ppc64le" alongside "ppc64" for the arch/machine block, and omit the
x86-only pae/acpi/apic features on both. Little- and big-endian pseries guests
both use libvirt <os> arch "ppc64".
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The single flat xcat-core repo serves el8/el9/el10 from one build, but two spec
decisions were resolved at BUILD time and so were wrong for the other ELs that
share the same repo.
1. DHCP backend. xCAT.spec and xCATsn.spec selected the dhcp provider with a
build-time %if (rhel >= 10 -> kea, else dhcpd), so an el10 build wrongly
required kea on el8/el9 (and an el8/el9 build wrongly required dhcpd on
el10). Replace it with an install-time RPM rich dependency:
Requires: (kea if (system-release >= 10) else /usr/sbin/dhcpd)
Requires: (kea-hooks if (system-release >= 10))
dnf now resolves it per client: kea on el10+ (which dropped ISC dhcp from the
distro), dhcpd on el8/el9. SLES has no "system-release" provide, so the
condition is false there and it falls back to /usr/sbin/dhcpd, preserving
prior behavior. system-release is versioned per release package
(el10=10.x, el9=9.x, el8=8.x).
2. openssl. Make the xCAT-server openssl Requires uniform across EL (non-SUSE)
instead of el10-only, so the produced package set does not depend on which EL
the build host happened to be.
Also drop xCAT-genesis-base from the default @PACKAGES set in buildrpms.pl: its
initramfs bundles the build-chroot kernel/glibc and is therefore OS- and
arch-dependent, so it cannot ship in the single flat core. It is now built per
target by the xcat-dep pipeline (mockbuild-all.pl, via
`buildrpms.pl --package xCAT-genesis-base`) and ships in xcat-dep/rh<N>. The
explicit `--package xCAT-genesis-base` build path is retained.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The Ubuntu netboot image inherited the build host's /etc/hostname --
genimage's chroot shares the build host's UTS namespace, so /etc/hostname
ended up as the MN's name and every diskless node booted as that name
instead of its own ("hostname poisoning"). xCAT keys on IP/MAC so
provisioning still succeeds, but the node's local identity (hostname,
prompt, syslog) is wrong and N nodes share one name. The image also
shipped no netplan, so systemd-networkd-wait-online failed. In
compute.postinstall, clear /etc/hostname so each node takes its name at
boot from DHCP (udhcpc option host-name) / xCAT, and drop in a DHCP
netplan (optional, dhcp-identifier mac) so systemd-networkd configures the
boot NIC. Ubuntu-only.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The Ubuntu live-server ISO copycds imports is not a complete apt pool, so
both Ubuntu install paths fail without an external mirror: the netboot
genimage's debootstrap from the ISO-only pkgdir cannot resolve packages,
and the Subiquity diskful install (Template.pm) fell back to the airgapped
file:///cdrom config. Default site.ubuntu_apt_mirror to
http://archive.ubuntu.com/ubuntu when unset (overridable for local/geo/
ports mirrors). In the Ubuntu genimage, when pkgdir has no http mirror,
build the debootstrap source and chroot sources.list from that mirror with
the codename derived from osvers and the release/-updates/-security pockets
(main + universe) -- the compute pkglist needs universe (busybox-static,
dracut*) and the security-updated openssh. Ubuntu-only; EL netboot
(netboot/rh) and copycds/packimage are untouched.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
When a node's install NIC is selected by MAC (installnic=mac), the generated
netplan was invalid: it named the ethernet device the literal string 'mac' and
set its MAC match to the full pipe-delimited list of all node MACs. The result
had no valid interface, so neither the installer environment nor the installed
system came up on the network. Match the install NIC by interface-name glob in
the installer, and in the target use only the primary MAC and omit set-name
when the install NIC is selected by MAC.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The generated Subiquity autoinstall config defined no identity section. Newer
Subiquity treats a config without an identity as incomplete and stops at an
interactive "Continue with autoinstall?" confirmation, so the install never
proceeds unattended (the prompt's advice to add 'autoinstall' to the kernel
command line is a red herring -- it was already present). Provide an identity
with a password sourced from the cluster passwd table so the install runs
non-interactively.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The Ubuntu live-server install media is not a complete apt package mirror.
With the generated apt configuration pinned to the media only, an install that
needs a package absent from the media stalls instead of fetching it. Emit an
online-mirror apt configuration when one is configured (site.ubuntu_apt_mirror)
so missing packages are retrieved from the archive; offline behaviour is
unchanged when it is unset.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Update all alma10, ol10, and rocky10 netboot symlinks to reference
the new rhels10 base files. Fixes service otherpkgs pointing to
wrong xcat-dep path (rh9 instead of rh10).
Create proper rhels10 versions of exlist, postinstall, service
pkglist, and service otherpkgs files instead of reusing rhels9.
Key differences from rhels9:
- service otherpkgs: xcat-dep path rh9 -> rh10
- service pkglist: drop dhclient (NetworkManager handles DHCP)
Compute exlist and postinstall are identical to rhels9 for now but
kept separate to allow EL10-specific changes without affecting EL9.
Add compute and service profile symlinks for alma10, following the
existing pattern used by alma8 and alma9. Also add the missing
dracut_105 symlink required by EL10's dracut v107.
Tested with BIOS and UEFI stateless provisioning on AlmaLinux 10.1.
When all addkcmdline options have R:: prefix (persistent options for
the installed OS), the volatile check in xnba.pm and pxe.pm would fail
because volatile was undefined. This left the original R::-prefixed
string in the netboot config instead of stripping it.
The fix ensures we always use the volatile portion after calling
splitkcmdline, even if it's empty. Persistent (R::) options are
handled separately by Template.pm via PERSKCMDLINE for the installed
OS bootloader.
Fixes#7442
Address ShellCheck warnings across go-xcat without breaking
distro detection. Key changes:
- Replace source /etc/os-release with awk parsing that strips
quotes, fixing detection on distros that quote ID/VERSION_ID
- Use $() instead of backticks for command substitution
- Quote $1 and file path variables in dnf/yum repo version checks
- Use ${FUNCNAME[0]} instead of ${FUNCNAME} for dispatch calls
- Fix $@ vs $* usage in string contexts (warn_if_bad, el9 check)
- Remove useless use of cat (UUOC) in pipe chains
- Escape $releasever/$basearch/$stream in CRB repo echo
- Use xargs instead of unquoted command substitution in rm
- Split local declaration and assignment per SC2155
- Fix minor typos (secert -> secret, preform -> perform)
Signed-off-by: Vinícius Ferrão <vinicius@ferrao.net.br>
Co-Authored-By: Samveen <samveen@samveen.in>
The activenics{"!remote!"} hash key is checked at line 1940 but never
set by any code path — neither the dhcpinterfaces parsing nor the
querynics discovery populates it. This causes the guard to always
evaluate true, hitting next and silently skipping every !remote!
network when dhcpinterfaces is defined in the site table or on a
service node.
Remove the dead check so remote networks are processed correctly.
The inner activenics{$netif} check (which uses the actual interface
name after stripping the !remote! prefix) is the correct guard and
is preserved.
Original analysis by lebonez in xcat2/xcat-core#7242.
Co-authored-by: Lebonez <25910791+lebonez@users.noreply.github.com>
Add a shared OMAPI policy helper for ISC DHCP and DDNS so administrators can select the key name, signing algorithm, and omshell path from the site table while preserving the existing xcat_key hmac-md5 default.
Keep local ISC updates from hanging indefinitely when omshell does not exit, and use a static host-declaration fallback for local Ubuntu ISC releases where omshell is unstable for xCAT host updates.
Co-authored-by: gskouson <1507929+gskouson@users.noreply.github.com>
OpenBMC BMCs intermittently return 503 Service Unavailable when the
REST service is busy or recovering. xCAT reported the error immediately,
requiring the user to manually retry. A second attempt usually succeeds.
Retry the same request up to 3 times with a 3-second wait on 503.
If all retries fail, report the error as before. The existing 504
handling for bmcreboot is preserved.
Ref: #4264
The xCAT-server build-readme script runs every tool in share/xcat/tools/
with --help during RPM packaging. At build time perl-xCAT is not installed,
so the compile-time 'use xCAT::DHCP::Backend' aborts before --help can run.
Switch to runtime require inside the remove-operation branch where the
module is actually needed.
Extend the existing sha256-to-sha1 fallback (already present in
got_rmcp_response for Open Session errors) to also cover RAKP2
rejections with "Unauthorized name" (0x0d) or "Invalid role" (0x09).
Ref: #7511
Set bit 4 (0x10) of the requested privilege byte in RAKP Message 1
for name-only user lookup, matching ipmitool behavior. Use the same
value consistently in all HMAC calculations (RAKP2 verification,
RAKP3 auth code, SIK derivation).
Without this, some BMCs fail user lookup with "Unauthorized name"
even though the credentials are correct.
Ref: #7511
OpenBMC-based BMCs return message tag 0 in RAKP2/RAKP4 instead of
echoing the tag from the request. xCAT rejected these as stale
responses and retried indefinitely until timeout.
Accept tag 0 but verify the remote console session ID in the response
matches our current sidm. This prevents stale retries from corrupting
session state while allowing OpenBMC responses through.
Applied to got_rmcp_response, got_rakp2, and got_rakp4.
Ref: #7511
cbc_pad in decrypt mode reads the last byte as the pad count, then
calls splice(@block, 0 - $count). If decrypted data is corrupt, the
pad count can exceed the array size, crashing with "Modification of
non-creatable array value attempted, subscript -16".
Return empty string on invalid padding so the caller treats it as a
decryption failure rather than accepting corrupted data as a valid
IPMI response.
Ref: #7511
Vinícius Ferrão
Daniel Hilst
Vinícius Ferrão
Markus Hilger