The manual page and the usage message of nodestat give the option
-f|--usefping. The preprocessor of the request knows no option f, and the
handler of the request spells the long name useping, so --usefping does
nothing. An administrator who follows the manual page gets the nmap path, and
gets no message that says why.
The two places also read different specifications, so an option that one
place accepts can reach the other place and take a different meaning. Put the
specification in one routine, and let both places read that routine.
Give the name usefping to the option, and keep useping as a second name. That
spelling has worked since 2.14.2, so a site can have it in a script.
The long name of the fping option starts with the same letters as usemon, so
--use and --us become names that Getopt::Long cannot decide. Those two
abbreviations select usemon today. Keep them with usemon, or an administrator
who monitors with them loses the monitoring and gets no message.
The change has two other effects. The abbreviations --use and --us no longer
select fping as well, which they did only because the two places read
different specifications. The bundles -mf and -fm now select both options,
which they did not do before.
Recovered from the lenovobuild branch.
The genesis image goes into a file whose name ends with .lzma. The plugin
writes that file only when /usr/bin/lzma is there, and it falls back to gzip
when it is not.
Red Hat ships no lzma binary. On AlmaLinux 9 and on AlmaLinux 10 that test
fails, the plugin falls back to gzip, and it gives no message that says why.
The image is larger on each run of mknb. Debian and Ubuntu ship lzma as a
second name for xz, so those systems still get the smaller image.
Ask xz for the same container when lzma is absent. The command
"xz --format=lzma" writes the same bytes as "lzma", so the file keeps its
name, its container and its size. Keep the gzip fallback for a system that
has neither program.
Recovered from the lenovobuild branch, which asked xz for the xz container.
That container is not the lzma container, and the name of the file says lzma.
makedhcp on a noderange sends the request to every service node running a dhcp
server, whether or not it serves any of the named nodes. On a cluster with many
service nodes each one does the work and reports on nodes that are not its
responsibility, for example warning that a node it does not serve has no mac
address.
Map the named nodes to their service nodes and skip the rest. Regenerating the
networks with -n still reaches every dhcp server, since a dynamic range is not
tied to a node, and if none of the named nodes can be mapped the request goes to
all of them as before rather than risk leaving one out.
The node to service node mapping reuses getSNformattedhash, which the
disjointdhcps path in this same function already uses.
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
syncfiles builds an xdcp subrequest with no username. xdcp takes its user from
-l, then from DSH_FROM_USERID, and otherwise leaves it unset, so the sync ends
up running as whatever identity xcatd happens to have rather than one the
request states.
That gap dates from 2c9bdf848, which removed the forceroot flag because any
caller could set it, and replaced it by passing the real username through.
updatenode was updated to do that; syncfiles was not. Its request comes from the
node, so there is no calling user to carry through, and root is what the sync
has to run as.
Name it explicitly, the same way updatenode does. This is a consistency and
hardening change: on a management node running as root the resulting identity is
the same either way, and no behavior difference is observable today.
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
packimage rejects -o, -p and -a before anything else runs, which leaves three
things below it that cannot be reached. The branch handling a missing image
name asks for -o and reports "Please specify a os version with the -o flag",
so passing the option is rejected and omitting it is reported as the option
being absent. The check for those options alongside an image name re-tests a
condition already rejected, and the block that built an image from them can no
longer be entered.
Report the missing image name instead, and drop the parts that cannot run.
Passing -o, -p or -a is rejected exactly as before, and packing a named image
is unchanged.
setdestiny reports the deprecated install, netboot and statelite states and
returns, and the legacy path that set nodetype.provmethod from the target sits
directly after that return. It has not run since the deprecation landed in
57aa41798, and it still reads like live code when following setdestiny.
Remove it. The deprecated states are still rejected exactly as before, and the
osimage path is untouched.
preprocess_request skips any node whose nodehm entry has neither cons nor
serialport. That is the right default while scanning the whole table, but it
also drops nodes the administrator named on the command line, leaving the
dispatched node list empty. makeconfluentcfg then falls back to reading every
node, so naming one console-less node quietly configures the whole cluster
instead of the node that was asked for.
A named node with no nodehm row at all is worse: both the selection here and
the second lookup in makeconfluentcfg produce an undefined entry, which reaches
confluent as an empty node name.
Apply the skip only to the full table scan, and carry the node name through
both lookups when the nodehm row is missing. Nodes without a console method are
already handled downstream, where makeconfluentcfg keeps explicitly named
entries and donodeent falls back to hardware management credentials.
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
When a chain has run down to a single remaining step, nextdestiny replaces that
step with 'standby'. For a completed provision the remaining step is 'boot',
which setdestiny writes into chain.currchain once an install or netboot destiny
is applied, so the replacement discards the destiny that boots the node.
Some installers advance the destiny more than once. On the extra advance the
node silently moves from 'boot' to 'standby' and no longer has a destiny that
boots the system it just installed.
Keep 'boot' when it is the remaining step, and leave every other exhausted
chain falling to 'standby' as before, so a finished install still does not
reinstall the node on its next boot.
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
makedhcp using the Kea backend fails for any node whose mac table entry
uses the *NOIP* sentinel to mark a secondary NIC that has no IP address
(e.g. "mac1|mac2!*NOIP*|mac3!*NOIP*"). kea_node_reservations() and
kea_node_reservations6() split each NIC's hostname and pass it straight
to getipaddr(), so the literal string "*NOIP*" is treated as a host to
resolve. It cannot resolve, and the reservation is reported as unresolved
-- which aborts the whole makedhcp run, leaving the node with no Kea
reservation at all and therefore no DHCP lease.
This breaks provisioning on distros that use the Kea backend (e.g. EL10,
which has no ISC dhcp-server): the node never gets an address and is
unreachable, while the ISC backend has always handled *NOIP* and is
unaffected.
Skip *NOIP* NICs in both the DHCPv4 and DHCPv6 reservation builders, the
same way the ISC path does -- there is no address to reserve for them.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Boot URLs handed to nodes always carried an explicit :80 even when the HTTP
server listens on the default port. grub2.pm already omits the port when it is
80; make the xNBA, genesis and DHCP boot URLs consistent with it.
$portsuffix is empty when site.httpport is unset or 80 and ":<port>" otherwise,
so a non-default port is unchanged. Covers the ISC and Kea paths in dhcp.pm,
xnba.pm, mknb.pm, and the Kea xNBA client classes in BootPolicy.pm.
dhcp_boot_policy.t and mknb_xcatd_address.t follow the new URLs and gain cases
for a non-default and an unset port. The floating-address guard in
mknb_xcatd_address.t also drops :80 so that it keeps matching.
Recovered from the unmerged lenovobuild branch (cd61fd9d, a2f77ea9, 1035841b,
b7db0e2, 792fe6d).
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
Running rspconfig against an mgt=ipmi node with no option fell through to the
generic "Unsupported command: rspconfig " message (with an empty option),
which does not tell the user what is wrong. Detect the empty option in
preprocess_request and report that options are required.
Recovered from the unmerged lenovobuild branch (original 08ae94bd).
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
nodestat -f runs fping to reach the nodes; if the fping package is not
installed the pipe yielded no output and nodestat silently returned an empty
result. Check that an fping binary exists before running it and emit an
explicit "must install fping" error otherwise.
Recovered from the unmerged lenovobuild branch (original f0c88182), reworked
to test for the binary directly: the original inferred fping's presence from
whether the pipe produced output, which false-positived (reporting fping
missing) when fping was present but every node was unresolvable -- caught in
lab validation.
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
The FRU key sort used only `$a <=> $b`, a numeric comparison that returns 0
for the non-numeric FRU field names, leaving them in hash-iteration order.
That order is randomized per process, so `rinv <node> all` printed its fields
in a different order on each run. Add `$a cmp $b` as a tiebreaker so the
output is stable.
Recovered from the unmerged lenovobuild branch (original 9cd3fac6).
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
noderes.netboot is parsed as grub2-<protocol> and validated with
/^http|tftp$/, which reads as (^http)|(tftp$) and so also accepts values
such as https, httpx and xtftp.
A value that passes but is not exactly "http" then falls through to
set root=$grub2protocol,$serverip, which drops site.httpport, so the mistake
surfaces as a confusing grub2 failure at boot instead of the "Invalid netboot
method" error this check exists to give. grub2-https cannot work in any case,
since only "insmod http" is emitted.
Supported values are unchanged: grub2, grub2-http and grub2-tftp.
nodeset aborted with "Unable to find pxelinux.0 from syslinux" when neither
the copy under the tftp directory nor the one under XCATROOT existed. Only
legacy BIOS clients chain pxelinux and not every distribution still ships
syslinux, so a UEFI-only environment could not run nodeset at all.
Copy pxelinux.0 when it is available and warn, rather than fail, when it is not.
Recovered from the unmerged lenovobuild branch (4f0a5106), which skipped
silently; warn so the missing loader is still reported.
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
Daniel Hilst
Vinícius Ferrão