Load the production redactor and schema instead of extracting source.
Check audit, syslog, and dispatch trace output through their real owners.
Keep production code unchanged.
Run the unchanged driver with command and filesystem fixtures instead of
matching its source. Check apt arguments, syntax exclusions, and failure
propagation. Parse the workflow with YAML::PP and install it in CI.
The staging directory was keyed by package, target and uniqueext. Nothing
deleted it, so every pair left a SOURCES tree under $HOME/rpmbuild, and an
archive from an earlier run stayed beside the next run's sources.
Each forked builder now stages into $HOME/rpmbuild/sources/SOURCES.<host>.<pid>.
The pid is unique among live processes on one host, and the host name keeps two
hosts apart when $HOME is on NFS. prepare_build_sources_dir creates the directory
empty. The parent deletes it when it reaps the builder, whatever the exit, and
abort_builds deletes it for each builder that exits after SIGTERM. At start, the
run deletes the directories of this host whose pid is not alive.
buildrpms_sources_per_package.t covers the name, the empty directory, the
deletion after success and failure, and the sweep of a dead pid next to a live
one and another host.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The xCATsn templates archive held xCAT/templates/..., so xCATsn installed the
templates under /opt/xcat/share/xcat/xCAT/templates. The xCAT build wrote the
same archive rooted at templates/ into the shared SOURCES directory, and the
existence check let xCATsn reuse it when xCAT wrote first.
stage_xcatsn_templates now runs tar from xCAT/, so the members start with
templates/, and it always writes the archive. The archive matches the one
the xCAT build writes.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
xCATsn.spec extracts templates.tar.gz in %{prefix}/share/xcat. buildrpms.pl
creates that archive from the checkout root, so its members start with
xCAT/templates and the templates install under share/xcat/xCAT/templates.
With one shared SOURCES directory the xCAT build often wrote the archive
first, rooted at templates/, and the existence check kept it.
The tar step moves unchanged into stage_xcatsn_templates in
XCAT::BuildUtils. xcatsn_templates_staged.t stages the archive and reads its
members. It fails on this commit: the members start with xCAT/, and a second
staging keeps the old archive.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
kea_node_client_classes_for_nodes answered { classes, noip } when it
could not open the noderes or mac table, and left out the localboot
list that kea_sync_node_client_classes reads. makedhcp then died with
"Can't use an undefined value as an ARRAY reference".
Return an empty localboot list as well.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
kea_node_client_classes_for_nodes returns early, without a localboot
list, when it cannot open the noderes or mac table.
kea_sync_node_client_classes then dereferences that missing list and
dies with "Can't use an undefined value as an ARRAY reference".
dhcp_kea_ddns_deferral.t takes this path, so the unit tests fail on
master since #7830 added the localboot list.
Check the early answer and the sync with both tables unavailable.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Every RPM target of every family failed in buildrpms.pl before it built a package:
Can't rename('.xCAT-probe-2.20.0.UNf6IG', '/xCAT-probe-2.20.0.tar.gz'):
Invalid cross-device link at ./buildrpms.pl line 386
The staging directory is set per package in the child that buildall forks. main()
staged the xCAT-probe tarball before that fork, where $SOURCES is still the empty
string, so the destination was composed as /xCAT-probe-<version>.tar.gz.
stage_xcat_probe_sources in XCAT::BuildUtils replaces prepare_xcat_probe_source_tar.
It takes the staging directory, refuses an unset or absent one, and composes the file
name itself. buildsources calls it for the xCAT-probe package, in the child, where the
directory exists.
xcat_probe_sources_staged.t runs the staging and reads the archive: the helpers are at
xCAT-probe/lib/perl/xCAT, no temporary file is left behind, and each refusal names the
guard that fired. Removing either guard turns it red. On the unfixed tree
"./buildrpms.pl --package xCAT-probe --source-only" dies at line 386; with this change
it reaches the build lock.
Seven assertions in xcat_probe_package_payload.t matched the text of buildrpms.pl
rather than running it, and four could not fail: three matched the xCAT-release
routine, which stages the same way, and one spanned the rest of the file. All seven
stayed green while every RPM target died. They are gone.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
A core build failed in %prep with "File
/builddir/build/SOURCES/xCAT-test-2.20.0.tar.gz is smaller than 13 bytes". Its
src.rpm carried 0 bytes where two sibling builds of the same commit carried
1671225.
buildrpms.pl staged every tarball into one $HOME/rpmbuild/SOURCES while forking
a child per package and target, so one child's tar overwrote an archive another
child was copying with mock --sources.
build_sources_dir keys the staging directory per package and target, like the
mock chroot. buildrpms_sources_per_package.t covers it.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
reg_linux_diskfull_installation_flat never finishes on openEuler. The install completes, the
postscripts run, and then the node reboots into the installer again and repeats, so the case waited
an hour and the node stayed at status=installing.
post.xcat.ng ends with updateflag.awk, the call its own comment calls the one that must always run
to prevent infinite installation loops. It passed $MASTER, a hostname. The anaconda %post chroot on
openEuler has no /etc/resolv.conf and no management node entry in /etc/hosts, so gawk cannot open
the socket. From the node's own /var/log/xcat/xcat.log:
awk: /xcatpost/updateflag.awk:15: warning: remote host and port information
(xcat58-mn, 3002) invalid: Name or service not known
updateflag.awk: Retrying flag update
It retries ten times, gives up, and the status is never sent. Nothing reports it: the retry message
goes to logger, and a %post chroot runs no rsyslog.
The same script already uses $MASTER_IP for all 36 of its other callbacks, and the kickstart sets it
to the same host: MASTER_IP=192.168.58.1, MASTER=xcat58-mn. All six updateflag calls now use the
address, so none of them depends on a resolver the node does not have.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
xCAT-test/debian/install did not list lib/xCAT/Test/OS.pm, so the
Debian package shipped xcattest without the module it loads, and
xcattest stopped at startup with "Can't locate xCAT/Test/OS.pm in @INC".
Install the module to opt/xcat/lib/perl/xCAT/Test, as the RPM spec does.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
xcattest loads xCAT::Test::OS from /opt/xcat/lib/perl. xCAT-test.spec
installs it, but xCAT-test/debian/install does not, so xcattest on an
Ubuntu management node dies at startup with "Can't locate
xCAT/Test/OS.pm in @INC".
Check that the RPM spec and the Debian install list both ship every
module under xCAT-test/lib/xCAT. The Debian check fails.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
xcattest reports "Test case <name> has an invalid OS option - Linux" and then
"There is no valid case to run", so every case is skipped on openEuler.
Recorded on an openEuler 24.03 LTS SP4 management node with xCAT 2.20.0: both
flat provisioning cases were rejected and the run measured nothing.
Two causes, both in the os: comparison in xCAT-test/xcattest. get_current_os
takes the /etc/os-release branch, finds no sles, and falls off the end of that
branch, so it returns the exit status of the failed grep, 256, which names no
distribution. And a case marked os:Linux expands to exactly rhels, sles and
ubuntu, so openEuler would be rejected even by a correct get_current_os.
Both halves move into xCAT::Test::OS. xcattest finds it beside itself and the
package installs it at <prefix>/lib/perl. current_os takes a path prefix, so a
test describes a system by writing release files into a scratch tree. openEuler
is named in both halves and nothing else changes.
xCAT-test/unit/xcattest_os_selection.t covers it. Removing openeuler from
linux_aliases fails two checks, and removing the openEuler branch from
current_os fails three. A further case gives a root both /etc/redhat-release
and an openEuler /etc/os-release and asserts rhels10, so the precedence is
named: openEuler ships neither that file nor /etc/lsb-release.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
wget asks for the root image as //install/..., so the leading slash repeats.
The path filter matched a single leading slash and did not count those
requests. A service node that served only the root image would therefore read
as having served no boot payload.
The filter now accepts a repeated leading slash. The bats cases come from
fix/service-node-ub, where a real Ubuntu service node logged one //install
request beside 272 /install and 8 /tftpboot ones. Both new cases fail with the
single-slash filter.
This brings the file level with fix/service-node-ub, so the two branches no
longer carry different versions of the same check.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
fix/service-node-el fixed the management-node guard as commit 0f708b96a, with the same
correction this branch made: the log must hold lines, not gain them. The two differ
only in the comment and in the error message, so the file no longer merges as one
change.
The wording here now matches fix/service-node-el. The remaining difference in this file
is the doubled-slash path filter, which that branch does not carry.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
local_logs added XCAT_HTTPD_ACCESS_LOG to the list of candidate logs and then
read the system paths as well. On a build host that runs apache, the check
counted the host's own /var/log/apache2/access.log beside the file the test
pointed at, so a test could not control what it measured. The empty-log case
read 64 lines it did not write.
An explicit XCAT_HTTPD_ACCESS_LOG now replaces the search instead of extending
it. Production behaviour is unchanged: nothing sets that variable there.
Without this change the bats case for an empty management-node log fails on a
host that serves apache, and passes on one that does not.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
(cherry picked from commit bcb4a77f1a)
check_provisioning_source.sh --baseline wrote one message for two conditions:
"no access log to baseline on ${MN_BASE:+$SN}${MN_BASE:-$MN}". When the management
node has a log and the service node does not, the second expansion returns the
management node's baseline spec, not a host name. On xcat42 the message read "no
access log to baseline on nosuchnode-xyz/var/log/httpd/access_log:881". That is the
message an operator reads when xdsh cannot reach the service node, so it has to name
the host that has no log.
Each condition now has its own test and its own message.
check_provisioning_source.bats covers the service-node condition. The case also
asserts the management node's log path is absent from the message, because the node
name alone matches the old text as a substring.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
(cherry picked from commit 89ac4558a0)
local_logs added XCAT_HTTPD_ACCESS_LOG to the list of candidate logs and then
read the system paths as well. On a build host that runs apache, the check
counted the host's own /var/log/apache2/access.log beside the file the test
pointed at, so a test could not control what it measured. The empty-log case
read 64 lines it did not write.
An explicit XCAT_HTTPD_ACCESS_LOG now replaces the search instead of extending
it. Production behaviour is unchanged: nothing sets that variable there.
Without this change the bats case for an empty management-node log fails on a
host that serves apache, and passes on one that does not.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
check_provisioning_source.sh --baseline wrote one message for two conditions:
"no access log to baseline on ${MN_BASE:+$SN}${MN_BASE:-$MN}". When the management
node has a log and the service node does not, the second expansion returns the
management node's baseline spec, not a host name. On xcat42 the message read "no
access log to baseline on nosuchnode-xyz/var/log/httpd/access_log:881". That is the
message an operator reads when xdsh cannot reach the service node, so it has to name
the host that has no log.
Each condition now has its own test and its own message.
check_provisioning_source.bats covers the service-node condition. The case also
asserts the management node's log path is absent from the message, because the node
name alone matches the old text as a substring.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
check_provisioning_source.sh required the management node's httpd access log to gain
lines after the baseline. The three hierarchy cases take the baseline after
SN_setup_case has provisioned the service node. After that point a correct hierarchical
provision leaves the management node serving nothing, so its log does not grow. On the
xcat42 EL9 cell the service node served the compute node 252 boot-payload requests and
the management node served 0, and the check still reported "no httpd access log with
new entries could be read on xcat42-mn-dhilst".
reg_linux_diskless_installation_hierarchy failed for that message.
The guard now requires the log to hold lines, not to hold new ones. An empty log still
fails, because it makes "the management node served nothing" a property of the file
instead of a measurement.
check_provisioning_source.bats asserted the removed behavior in "a management node log
with nothing new fails the check instead of reading as silence". That case now asserts
the opposite, and a second case covers the empty log. Both fail against the unfixed
script.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
On a new Kea management node, makedhcp -n defers DDNS until makedns -n
writes the key. makedhcp -a then applied the D2 settings to the fresh
intents, but saved the loaded configurations, which had no dhcp-ddns.
It also wrote no kea-dhcp-ddns.conf, so DNS updates stayed off.
When DDNS is on and the loaded DHCPv4 configuration has no dhcp-ddns,
makedhcp -a now copies the D2 settings into the loaded DHCPv4 and DHCPv6
configurations, writes the D2 configuration and, when enabled, the
Control Agent configuration. It then enables and restarts the Kea
services.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
On a new Kea management node, makedhcp -n defers DDNS because no key
exists. After makedns -n writes the key, makedhcp -a keeps the DHCPv4
configuration without dhcp-ddns and writes no kea-dhcp-ddns.conf, so
DNS updates stay off.
The test runs makedhcp -n without a key, adds the key, runs
makedhcp -a, and checks the rendered DHCPv4 and D2 configurations.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
enable_repo_commands chose subscription-manager from the vendor id and the presence of the
binary. An unregistered RHEL node has both, so the postscript ran
`subscription-manager repos --enable`, the command failed for want of a registration, and only
the fallback to `dnf config-manager` enabled the builder repository. The log named the
repository, not the registration.
The decision now takes the registration state. registered_with_subscription_manager reads the
exit status and the output of `subscription-manager identity`, which the postscript runs, and
enable_repo_commands emits the subscription-manager command only for a registered node. A
Foreman, Katello or Red Hat Satellite client registers through subscription-manager, so the same
path covers it, and the vendor id no longer decides. uses_subscription_manager is removed with
its caller.
service_node_artifacts_el.t asserts the probe against the registered and the unregistered output
of subscription-manager 1.30.12, against a missing binary, and against a call without root
privilege. It also asserts that an unregistered node runs no subscription-manager command.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
On the Ubuntu 24.04 hierarchy cell the check reported the right counts and then
failed: "xcat22-sn served xcat22-cn 277 boot-payload request(s)", "xcat22-mn-dhilst
served xcat22-cn 0", and then "no httpd access log with new entries could be read on
xcat22-mn-dhilst". The guard required the management node log to gain lines after the
baseline. It does not: the management node provisions the service node in
SN_setup_case, before the baseline the hierarchy case takes, and it is then idle. Its
silence is the result the check exists to find.
The guard now asks that the log hold at least one line, which is what makes a count of
0 mean something, and no longer asks for activity in the measured window.
The path filter also missed a doubled leading slash. The compute node fetches the root
image with wget as //install/netboot/<os>/<arch>/compute/rootimg.cpio.gz, which the
service node logged and the filter did not count.
check_provisioning_source.bats covers both. The four cases added in the commit before
this one fail without this change.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
check_provisioning_source.bats held a case that required the check to FAIL when the
management node logs nothing after the baseline. That is the hierarchical result, not
a broken log: the management node provisions the service node before the baseline and
then serves the compute node nothing. The suite passed 14 of 14 while the check could
not pass on a real cluster.
Two more cases cover the path filter. The compute node fetches the root image with
wget from a URL that carries a double slash, so the path reaches the log as
//install/netboot/..., and the filter matched neither direction: the request counted
as no boot payload on the service node, and a flat provision that served it went
unreported.
All four cases fail against the current script.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
check_provisioning_source.sh counted every request the compute node had ever
made, for any path. Both directions were wrong. A flat run left
management-node requests for the same address, so a later hierarchical run
read them as its own and failed. A service-node entry from an earlier run, or
a 404 for /favicon.ico, satisfied the positive check without any boot payload
being served.
The script now takes a baseline. --baseline records how many lines each access
log holds on the management node and on the service node, before provisioning,
and the check counts only lines after that point. It counts only requests
under /install or /tftpboot, which are the trees httpd serves a boot payload
from. A log shorter than its baseline was rotated, so it is read from its
first line. Without a baseline the check refuses to answer instead of reading
the whole log. The three hierarchy cases call --baseline before nodeset.
check_provisioning_source.bats covers both regressions: a management-node
request before the baseline no longer fails the run, a service-node request
before the baseline no longer satisfies it, and a request that carries no boot
payload does neither. Removing the baseline comparison fails the first two.
Removing the path filter fails the other two.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
(cherry picked from commit d6f25640b1)
check_provisioning_source.sh counted every request the compute node had ever
made, for any path. Both directions were wrong. A flat run left
management-node requests for the same address, so a later hierarchical run
read them as its own and failed. A service-node entry from an earlier run, or
a 404 for /favicon.ico, satisfied the positive check without any boot payload
being served.
The script now takes a baseline. --baseline records how many lines each access
log holds on the management node and on the service node, before provisioning,
and the check counts only lines after that point. It counts only requests
under /install or /tftpboot, which are the trees httpd serves a boot payload
from. A log shorter than its baseline was rotated, so it is read from its
first line. Without a baseline the check refuses to answer instead of reading
the whole log. The three hierarchy cases call --baseline before nodeset.
check_provisioning_source.bats covers both regressions: a management-node
request before the baseline no longer fails the run, a service-node request
before the baseline no longer satisfies it, and a request that carries no boot
payload does neither. Removing the baseline comparison fails the first two.
Removing the path filter fails the other two.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The servicenode postscript enabled the builder repository with dnf
config-manager on every vendor. On RHEL that repository is defined in
/etc/yum.repos.d/redhat.repo, which subscription-manager owns and
regenerates, so the enabled flag does not survive the next refresh. The
builder repository turns off again and dnf install xCATsn stops resolving
perl-IO-Tty, perl-Crypt-CBC, perl-Crypt-Rijndael and perl(Expect).
ELBuilderRepo::enable_repo_commands returns the commands to try in order.
uses_subscription_manager names the vendors whose repository file
subscription-manager owns, beside builder_repo_ids which already names the
repository per vendor. RHEL asks subscription-manager first and keeps
config-manager as the fallback. Every other vendor gets config-manager
alone, which is what it had before.
service_node_artifacts_el.t asserts the command order per vendor. Without
the subscription-manager branch, the order assertion fails and no other
assertion does.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
kea_build_ddns_intent returned the deferral under a deferred key. No other
xCAT code uses that key: dhcp.pm reports through error, warning, node and
data, and makedhcp already passed this message to the callback as a warning.
The intent hash now carries the message under warning, so one name describes
it from the hash to the callback. Behaviour does not change.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The comment stated the xcatconfig default and then repeated the reason for the
change, which the commit message already carries. Keep the condition only.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
kea_makedhcp_without_ddns_key covers the same decision as
dhcp_kea_ddns_deferral.t, and no suite runs it: the GitHub workflow runs
prove -r xCAT-test/unit, and no CD bundle names the case.
Delta debugging at commit scope dropped it. The unit test still fails on the
unfixed tree, so the defect stays captured.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
makedhcp -n fails on a new management node that uses the Kea backend:
Error: Unable to find DDNS key material for Kea D2. Run makedns with
dnshandler=ddns first.
xcatconfig writes site.dnshandler=ddns on every new installation, so
kea_ddns_enabled reports DDNS on, and kea_build_ddns_intent then requires
/etc/xcat/ddns.key. Only makedns -n writes that file. The ISC backend reads no
key, so an ISC management node runs makedhcp -n without one. The Kea backend
plan states that basic DHCP and PXE support must not depend on DDNS.
kea_build_ddns_intent now reports a deferral instead of an error when it finds
no key material. kea_apply_ddns_intent attaches the D2 connection only when a
key exists, and returns the deferral for makedhcp to print as a warning. A
management node with key material gets the same configuration as before.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
kea_build_ddns_intent returns an error when no DDNS key material exists, and
makedhcp -n reports it instead of configuring Kea. No unit test reads that
decision, so the error path and the D2 path are both unmeasured.
dhcp_kea_ddns_deferral.t drives kea_build_ddns_intent with and without key
material, and drives the sub that attaches the D2 connection to the DHCPv4 and
DHCPv6 configurations. It also holds down the two boundaries the change must
keep: a management node whose site.dnshandler is not ddns asks for no D2
configuration, and an unreadable networks table stays an error.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
makedhcp -n fails on a new management node that uses the Kea backend:
Error: Unable to find DDNS key material for Kea D2. Run makedns with
dnshandler=ddns first.
xcatconfig writes site.dnshandler=ddns on every new installation, so the Kea
backend asks for the DDNS key, and only makedns -n creates it. No case covers
that order.
kea_makedhcp_without_ddns_key removes both places the Kea backend reads the key
from, runs makedhcp -n, and reads the rendered kea-dhcp4.conf. It then restores
the key material and runs makedhcp -n again, so the case also holds down the
configuration that a management node with a key must keep.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The comments added with the Ubuntu fixes carried the bug report and its
consequences: what a compute node stops at, what named answers to every query
once its working directory is unwritable, and that a failed export does not fail
the service node. The comment rules keep the invariant in the source and put the
symptom and the chain in the commit.
Each is cut to the fact the code cannot show: that the resolv.conf a
systemd-resolved host publishes holds a stub pointing back at this named, that
named must be able to write the directory it drops privileges into, that apt
refuses an unsigned repository, and that re-exporting a mount needs an fsid.
service.subiquity.tmpl keeps its header, which is identical to the sibling
compute template and should stay that way.
No executable line changes.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Vinícius Ferrão
Daniel Hilst