ddns.pm's DNS-update send has a 3-try retry loop, but it only retried on
NOTAUTH and -- on the final attempt -- the `next` fell out of the loop without
reporting failure. makedns then printed "Completed updating DNS records." and
"DNS setup is completed" even when the update was never accepted.
Two problems this causes:
- SERVFAIL was never retried. named routinely replies SERVFAIL transiently
right after a zone (re)load, before the zone is ready to accept dynamic
updates; the update succeeds a second or two later. This reliably breaks real
flat-cluster provisioning on el9/el10, where the test case's makedns -n runs
right after named reloads the zone with the new compute node.
- A persistent NOTAUTH/SERVFAIL (retries exhausted) was silently swallowed and
reported as success, so a genuinely failed DNS update looked like it worked.
Extract the batch send into send_ddns_update(), which retries NOTAUTH and
SERVFAIL (pausing on SERVFAIL), returns 0 only on NOERROR, and otherwise emits
the error and returns 1. Both batch-send sites now `return 1 if
send_ddns_update(...)`, so a real failure aborts add_or_delete_records instead
of falsely reporting success.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Modern x86-64 UEFI firmware (including OVMF and recent iPXE) reports DHCP
client architecture 00:07, but the xNBA network-boot conditionals only matched
00:09. A UEFI node would load xnba.efi, re-request with user-class xNBA and
arch 00:07, fail to match, and be handed xnba.efi again -- an endless boot
loop. Accept 00:07 alongside 00:09 in the xNBA UEFI branches of both the
network-level (addnet) and node-level (addnode) dhcpd statements.
Validated on an OVMF UEFI client: it progresses from xnba.efi to the .uefi
genesis config and boots, instead of looping on xnba.efi.
Recovered from the unmerged lenovobuild branch (5d697b5c, 86b0e12e).
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
The generated /opt/xcat/xcatinstallpost ran the install postscripts first and
only disabled the xcatpostinit1 service afterwards. If one of those postscripts
rebooted the node (for example a firmware or kernel update), the service was
still enabled, so on the next boot the whole postscript set ran again from the
start. Disable the service *before* running the postscripts so a mid-postscript
reboot cannot re-trigger them.
The disable decision reads OSVER (base variant only), RUNBOOTSCRIPTS and
NODESTATUS, which the included xcatinstallpost script would otherwise set.
Moving the INCLUDE below the disable block leaves those variables unset, so read
them up front (the included script re-reads them) and source xcatlib.sh so
msgutil_r is available; the disable decision is then identical to before.
The original change (lenovobuild 9184cbe0) touched only the legacy post.xcat.
Modern EL uses the systemd variants: post.xcat.ng (RHEL/CentOS 8 and 9) and
post.xcat.rhels10 (RHEL 10). Apply the same reorder to all three so the fix
actually takes effect on current platforms.
Lab-validated with a full AlmaLinux 9.8 stateful install (post.xcat.ng path):
the generated xcatinstallpost disables the service before running the
postscripts, the postscripts run exactly once, the node reaches "booted", and
with the default NODESTATUS=1 the service is left enabled just as before.
Recovered from the unmerged lenovobuild branch (original 9184cbe0), adapted and
extended to the .ng and .rhels10 variants.
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
replaycons chose the confluent console log directory
(/var/log/confluent/consoles) whenever the confetty binary happened to be
present. On a host that has confluent installed but runs conserver as the
active console service, that directory is empty and replaycons could not find
the log. Gate on the site table's consoleservice attribute instead -- the
same setting rcons uses -- so replaycons reads /var/log/confluent/consoles
only when confluent is actually the configured console service.
Recovered from the unmerged lenovobuild branch (originals 3ce4d81b3, 57f6ddd38).
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
The DNS-managed-networks check used my_ip_facing($net->{net}), which only
returns local addresses on the interface directly facing that network. A
nameserver that is a local address reachable via a different (routed)
interface was therefore treated as external, and the network was wrongly
dropped from ddns management.
Use thishostisnot(), which recognizes any local address regardless of the
interface, and keep the existing <xcatmaster> and site-nameserver special
cases.
Recovered from the unmerged lenovobuild branch (original 3c343f83), adapted
to preserve those special cases: lab validation showed the original replaced
them wholesale, which would exclude any network whose nameserver is the
literal <xcatmaster> token (thishostisnot('<xcatmaster>') is true).
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
getzonesfornet() derives the number of reverse-zone nibbles as
$nibbs = $maskbits / 4, then decrements it once per hex nibble of the network
prefix. For a sub-nibble (not 4-bit-aligned) IPv6 mask $nibbs can go negative
before the padding loop, and `while ($nibbs)` then never terminates: it keeps
decrementing past zero while appending "0." to $rev, spinning forever and
growing the string until the process is killed.
Make the padding loop `while ($nibbs > 0)` so it can never run away, and
return early only when $nibbs is genuinely negative. $nibbs == 0 is the normal
nibble-aligned case (e.g. a /64) and must still emit its reverse zone.
Recovered from the unmerged lenovobuild branch (original 0e070cd2). The
original guarded with `$nibbs < 1`, which also dropped the valid $nibbs == 0
case and left standard /64 subnets with no reverse zone; corrected to
`$nibbs < 0` after lab validation on a real provisioning cluster.
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
The diskless/statelite xcatroot scripts only recognize an http:// rootfs
image URL; an https:// imgurl falls through to the "unsupported" path even
though the download itself already uses wget/curl on the full $imgurl, both
of which handle TLS.
Accept xhttps alongside xhttp in the protocol test. Applied to every current
xcatroot variant (rh dracut/dracut_033/dracut_047/dracut_105 stateless and
statelite, plus fedora, sles and ubuntu), so HTTPS works uniformly rather
than only on the three rh scripts the original touched.
Recovered from the unmerged lenovobuild branch (original 751bce24, extended
to the dracut generations and distros that postdate it).
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
mknb writes the compressed genesis filesystem by streaming cpio output
straight onto the final path in $tftpdir/xcat (genesis.fs.$arch.lzma or .gz).
When two mknb/nodeset runs target a shared $tftpdir at once, one run reads or
overwrites the other's half-written image, producing a corrupt genesis.fs and
failed netboots.
Write each image to a uniquely-suffixed temporary file
(xCAT::Utils::genpassword(24)) and File::Copy::move() it into place. move()
within the same directory is a rename, so the final path only ever appears
complete. Both modules are already imported by mknb.pm.
Recovered from the unmerged lenovobuild branch (originals c651e7b8 and its
fix da0723f2, which switched the suffix to genpassword after the first
attempt only produced a single character). master lacks the branch's xz
path, so only the lzma and gzip paths are adjusted here.
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
xCAT-server.spec sets "AutoReqProv: no", so RPM does not auto-generate
dependencies from the Perl modules this package ships. Modules that are
loaded (compile-time "use") only by xCAT-server code are therefore neither
auto-required here nor pulled in transitively by perl-xCAT (which does have
AutoReqProv on and already covers SNMP, Expect, JSON, Net::Ping, Time::HiRes
and Text::Balanced). On a host without them the package installs cleanly and
the affected subcommands then fail at load time with "Can't locate <M>.pm".
Add the five that are genuinely uncovered, each a compile-time "use" in a
module shipped by xCAT-server and used nowhere in perl-xCAT:
perl-Net-Telnet xCAT/SSHInteract.pm (telnet switch/console)
perl-Net-DNS plugins/activedirectory.pm
perl-Crypt-CBC xCAT/IPMI.pm (IPMI 2.0 RMCP+ crypto)
perl-Crypt-Rijndael xCAT/IPMI.pm (IPMI 2.0 RMCP+ crypto)
perl-DB_File Confluent/Client.pm
The Crypt::CBC / Crypt::Rijndael gap is the notable one: IPMI.pm fails to
load without them, disabling all IPMI-based hardware control on a host where
those modules are absent.
Recovered from the unmerged lenovobuild branch (Jarrod Johnson; originals
807d30d3, c2e22f6f, 792e41727), reduced to the subset that master's current
packaging does not already satisfy.
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
go-xcat's install list still named yaboot-xcat, which was obsoleted in the
xcat-dep 2.18 rebuild and is no longer published. It also lists the cross-arch
ppc64 genesis packages, which the arch-split 2.18 dep repo no longer places in
the x86_64 view an x86 management node reads. Because EL dnf is strict by
default, any one of these unresolvable names aborts the entire `dnf install`
transaction, so `go-xcat install` fails outright on EL9/EL10 even though every
package the node actually needs is available.
Drop yaboot-xcat from the install list (kept in the uninstall list so existing
installs are still cleaned up) and pass `dnf --setopt=strict=0` so a package
missing from the enabled repository is warned and skipped instead of failing
the whole install. The existing post-install smoke test still catches a
genuinely broken install.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Daniel Hilst
Vinícius Ferrão
Vinícius Ferrão