The original Lenovo SR635/SR655 (IPMI manufacturer 19046, product 1287) use an
AMI "TSM" BMC reached over a LAN-over-USB interface, which needs OEM raw commands
to bring the interface up, select the LAN channel, and restart TSM networking
once configured. Add a dedicated vendor branch for it -- gated on the same
IPMIMFG/XPROD check the script already uses for IBM, Dell, Supermicro, OpenPOWER
and other Lenovo machines -- plus a udev rule and helper that bring up the USB
NIC (169.254.0.120) so in-band ipmitool can reach the TSM. The user-slot
auto-scan is skipped for these machines, which use a fixed slot.
Everything is behind IPMIMFG=19046 && XPROD=1287 (or the 046b:ffb0 USB device),
so no other BMC is affected.
Recovered from the unmerged lenovobuild branch (922dfe18, 42357f9d, 02da8a6b,
765e2ad3, 408cf2b3), adapted to master's bmcsetup structure. The global MD5 LAN
auth removal that rode along in 42357f9d is intentionally left out -- SR635/SR655
IPMI authentication is already handled in master by #7586 (retry cipher suite 3
on a zero RAKP2 HMAC), so dropping MD5 for all BMCs is neither needed nor wanted
here.
Not lab-validated: this targets the original SR635/SR655 (product 1287); no such
machine was available to test (an SR635 V3 reports product 1601 and uses a
different, directly-reachable BMC). The code is gated so it cannot affect other
hardware.
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
run_fast_regression_test() prints a case's output only when it fails.
For 250 cases that is the right default, but it leaves no way to tell
whether a passing case did real work or skipped everything. That is not
academic for cases wrapping prove: prove exits 0 both when tests pass
and when every test skips, so integration_tests reports green either
way and the log cannot distinguish them.
Add @verbose_cases. A case named there has its output printed on a pass
as well, and the failure branch no longer prints a second copy. Seed it
with integration_tests to find out which of the three integration tests
actually run on a runner -- in particular whether
dhcp_kea_config_validation.t validates from /etc/kea now that the case
runs as root, or still skips. Emptying the list restores the previous
behaviour exactly.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The case gated only on rc==0, but prove exits 0 both when tests pass and
when every test skips, so the case could report green having run nothing
at all. That is not hypothetical: all three tests carry environment
guards, and on the pull request run the harness discards a passing
case's output, so there was no way to tell from the log whether anything
had executed.
Add check:output=~Files=3, which proves prove found all three files. It
still tolerates a legitimate skip on a node without Kea, and it catches
a packaging regression or a rename. A missing directory was already
caught, since prove -r on a nonexistent path exits 2.
The count has to be maintained by hand when tests are added here, which
the README now says.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
ddns.pm's DNS-update send has a 3-try retry loop, but it only retried on
NOTAUTH and -- on the final attempt -- the `next` fell out of the loop without
reporting failure. makedns then printed "Completed updating DNS records." and
"DNS setup is completed" even when the update was never accepted.
Two problems this causes:
- SERVFAIL was never retried. named routinely replies SERVFAIL transiently
right after a zone (re)load, before the zone is ready to accept dynamic
updates; the update succeeds a second or two later. This reliably breaks real
flat-cluster provisioning on el9/el10, where the test case's makedns -n runs
right after named reloads the zone with the new compute node.
- A persistent NOTAUTH/SERVFAIL (retries exhausted) was silently swallowed and
reported as success, so a genuinely failed DNS update looked like it worked.
Extract the batch send into send_ddns_update(), which retries NOTAUTH and
SERVFAIL (pausing on SERVFAIL), returns 0 only on NOERROR, and otherwise emits
the error and returns 1. Both batch-send sites now `return 1 if
send_ddns_update(...)`, so a real failure aborts add_or_delete_records instead
of falsely reporting success.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The integration testcase was added without the ci_test label on the
grounds that the pull request workflow has no management node. That was
wrong: github_action_xcat_test.pl builds xCAT, installs it, runs
setup-local-client.sh and chtab, and leaves xcatd running, which makes
the runner a single node management node. Running the ci_test cases
against it is exactly what the fast regression stage already does.
Label the case ci_test so the integration tests get pull request
coverage as well. This also unlocks a test that had been skipping for a
fixable reason: each case is invoked through sudo, and
dhcp_kea_config_validation.t skips only because /etc/kea is not writable
by the unprivileged runner user, so as root it validates instead of
skipping.
Running the integration suite as root and the unit suite unprivileged is
the right way round. Integration tests legitimately need to write to
places like /etc/kea, whereas running the unit tests as root would let
permission-related assertions pass for the wrong reason.
Correct both READMEs, which carried the mistaken claim that the
integration tests do not run in CI.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Three of the files under xCAT-test/unit are not unit tests. They need an
installed management node rather than a checkout: copycds_packages_integrity.t
wants an /install populated by a real copycds, dhcp_kea_config_validation.t
wants a kea-dhcp4 binary that can read the config it generates, and
dhcp_kea_control_agent_smoke.t wants live kea-dhcp4 and kea-ctrl-agent
daemons running as root.
On a GitHub runner none of that exists, so all three plan skip_all. They were
the only three files skipping in the pull request run, which is not a
coincidence -- the skip is the symptom of them being filed in the wrong place.
A skipped test reports neither pass nor fail, so leaving them mixed in with
the unit tests trains the reader to scroll past skips in a directory where a
skip should mean something is wrong.
Move them to xCAT-test/integration, ship that directory alongside unit in
both the rpm and the deb, and drive it from a new xcattest testcase that
proves the installed copy on an MN. The case is deliberately not labelled
ci_test: the pull request workflow has no management node and must not pick
it up. check:rc==0 is the right gate for it -- prove exits non-zero on a real
failure, exits 0 when a test legitimately skips on a node without Kea, and
exits 2 if the directory is missing entirely, so a packaging regression still
fails the case.
Add a README.md to each directory recording which side of the line a new test
belongs on and how each suite is run.
xCAT-test/unit is now 44 files and 802 assertions with no skips at all; the
assertion count is unchanged, confirming the three moved files were
contributing nothing but skips.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The unit test stage failed on the first CI run with
Cannot detect source of 'xCAT-test/unit/*.t'
Files=0, Tests=0
Result: NOTESTS
the glob reached prove unexpanded because it matched nothing. The source
tree is gone by the time the tests run: build-ubunturepo sets
local_core_repo_path="$curdir/../../xcat-core"
and rm -rf's it before creating the apt repository there. GitHub checks
out into work/<repo>/<repo>, so for /home/runner/work/xcat-core/xcat-core
that path resolves to the checkout's own parent and the build wipes the
checkout, leaving an empty directory of the same name behind. The cd
still succeeds, which is why prove was handed a literal glob rather than
failing outright. This is also why every testcase that predates this
change proves /opt/xcat/share/xcat/tools/autotest/unit: after the build
the installed copy is the only one left.
Copy the checkout aside in preserve_source_tree() before the build and
prove that copy, so FindBin still resolves to a real source tree. Switch
to `prove -r xCAT-test/unit` as well, so a missing directory fails loudly
instead of silently degrading to a no-op the way an unmatched glob does.
Reproduced and verified by replaying the build under GitHub's directory
layout: the checkout drops to 0 test files, the preserved copy keeps all
47 and proves clean.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The 47 test files under xCAT-test/unit/ were shipped but almost never
executed on a pull request. Only three hand-written xcattest cases
reached them -- dhcp_unit, ipmi_unit and xcatprobe_unit -- and each
proved a single glob against the installed copy, so the majority of the
suite had never run at all. Real drift went unnoticed as a result:
ubuntu_subiquity_template.t still asserted the pre-86e77bcd7 shape of
compute.subiquity.tmpl and failed against the current template.
Run `prove xCAT-test/unit/*.t` directly from github_action_xcat_test.pl.
The tests resolve xCAT modules and fixture files relative to the repo
root through FindBin, so they must be proved from the checkout and not
from /opt/xcat/share/xcat/tools/autotest/unit; install_xcat() chdir's
away, hence the getcwd() captured up front. The step runs after the
install because the suite needs the perl dependencies xCAT pulls in
(Net::DNS, XML::Simple) and a usable xCAT database.
Drop the three prove testcases so their tests do not run twice, and
refresh the two stale ubuntu_subiquity_template.t assertions: the
identity section is now intentional (86e77bcd7) and the MAC
normalization gained cut filters ahead of the tr (c6e38483f), which the
loosened regex plus a new assertion for the suffix stripping now cover.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
xCAT and xCATsn hard-required elilo-xcat on every non-s390x install. elilo only
provides the ia64 (Itanium) UEFI loader; modern x86-64 UEFI netboot uses
xnba.efi and aarch64 uses grub2, so the dependency pulls a loader no current
platform needs. Drop the Requires (xnba-undi, which the UEFI path does use, is
kept). elilo-xcat can still be installed by hand for legacy ia64.
An OVMF x86-64 UEFI client netboots through xnba.efi with no elilo involved.
Recovered from the unmerged lenovobuild branch (e53b62e0).
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
Modern x86-64 UEFI firmware (including OVMF and recent iPXE) reports DHCP
client architecture 00:07, but the xNBA network-boot conditionals only matched
00:09. A UEFI node would load xnba.efi, re-request with user-class xNBA and
arch 00:07, fail to match, and be handed xnba.efi again -- an endless boot
loop. Accept 00:07 alongside 00:09 in the xNBA UEFI branches of both the
network-level (addnet) and node-level (addnode) dhcpd statements.
Validated on an OVMF UEFI client: it progresses from xnba.efi to the .uefi
genesis config and boots, instead of looping on xnba.efi.
Recovered from the unmerged lenovobuild branch (5d697b5c, 86b0e12e).
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
The generated /opt/xcat/xcatinstallpost ran the install postscripts first and
only disabled the xcatpostinit1 service afterwards. If one of those postscripts
rebooted the node (for example a firmware or kernel update), the service was
still enabled, so on the next boot the whole postscript set ran again from the
start. Disable the service *before* running the postscripts so a mid-postscript
reboot cannot re-trigger them.
The disable decision reads OSVER (base variant only), RUNBOOTSCRIPTS and
NODESTATUS, which the included xcatinstallpost script would otherwise set.
Moving the INCLUDE below the disable block leaves those variables unset, so read
them up front (the included script re-reads them) and source xcatlib.sh so
msgutil_r is available; the disable decision is then identical to before.
The original change (lenovobuild 9184cbe0) touched only the legacy post.xcat.
Modern EL uses the systemd variants: post.xcat.ng (RHEL/CentOS 8 and 9) and
post.xcat.rhels10 (RHEL 10). Apply the same reorder to all three so the fix
actually takes effect on current platforms.
Lab-validated with a full AlmaLinux 9.8 stateful install (post.xcat.ng path):
the generated xcatinstallpost disables the service before running the
postscripts, the postscripts run exactly once, the node reaches "booted", and
with the default NODESTATUS=1 the service is left enabled just as before.
Recovered from the unmerged lenovobuild branch (original 9184cbe0), adapted and
extended to the .ng and .rhels10 variants.
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
The DNS-managed-networks check used my_ip_facing($net->{net}), which only
returns local addresses on the interface directly facing that network. A
nameserver that is a local address reachable via a different (routed)
interface was therefore treated as external, and the network was wrongly
dropped from ddns management.
Use thishostisnot(), which recognizes any local address regardless of the
interface, and keep the existing <xcatmaster> and site-nameserver special
cases.
Recovered from the unmerged lenovobuild branch (original 3c343f83), adapted
to preserve those special cases: lab validation showed the original replaced
them wholesale, which would exclude any network whose nameserver is the
literal <xcatmaster> token (thishostisnot('<xcatmaster>') is true).
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
The diskless/statelite xcatroot scripts only recognize an http:// rootfs
image URL; an https:// imgurl falls through to the "unsupported" path even
though the download itself already uses wget/curl on the full $imgurl, both
of which handle TLS.
Accept xhttps alongside xhttp in the protocol test. Applied to every current
xcatroot variant (rh dracut/dracut_033/dracut_047/dracut_105 stateless and
statelite, plus fedora, sles and ubuntu), so HTTPS works uniformly rather
than only on the three rh scripts the original touched.
Recovered from the unmerged lenovobuild branch (original 751bce24, extended
to the dracut generations and distros that postdate it).
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
The genesis boot script sleeps 20 seconds unconditionally with the comment
"wait for NIC initialization", but that wait exists solely for System P LE
(ppc64) hardware discovery -- the surrounding section is explicitly ppc64
only. Every x86_64 and aarch64 node therefore pays a needless 20s delay on
each genesis boot.
Move the sleep inside the `[[ ${ARCH} =~ ppc64 ]]` block so only ppc64 waits.
Applied to the base script and both dracut_105 (el, ubuntu) variants.
Recovered from the unmerged lenovobuild branch (original d0916d9d).
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
The etc.tar.gz payload is unpacked into the buildroot and the resulting
etc/logrotate.d/xcat inherits whatever mode the build umask produced.
logrotate silently skips (and warns about) config files that are group- or
world-writable, so a loose umask can disable xCAT log rotation entirely.
chmod the file to 644 after extraction so the shipped config is always
honored.
Recovered from the unmerged lenovobuild branch (original cb8d671d).
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
For each secondary NIC in NICSTOBRINGUP, doxcat backgrounds a loop that polls
`ethtool $nic` until the link reports "detected: yes" before running dhclient.
A NIC that is never connected keeps that loop (and its `sleep 5`) running for
the life of the genesis environment, leaking background shells and needlessly
churning.
Add a second exit condition so each loop also stops once /tmp/netinitted
exists, and touch that file once the boot NIC has completed network init. A
link that never appears no longer waits indefinitely.
Recovered from the unmerged lenovobuild branch (original 9ece12e4).
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
xCAT-server.spec sets "AutoReqProv: no", so RPM does not auto-generate
dependencies from the Perl modules this package ships. Modules that are
loaded (compile-time "use") only by xCAT-server code are therefore neither
auto-required here nor pulled in transitively by perl-xCAT (which does have
AutoReqProv on and already covers SNMP, Expect, JSON, Net::Ping, Time::HiRes
and Text::Balanced). On a host without them the package installs cleanly and
the affected subcommands then fail at load time with "Can't locate <M>.pm".
Add the five that are genuinely uncovered, each a compile-time "use" in a
module shipped by xCAT-server and used nowhere in perl-xCAT:
perl-Net-Telnet xCAT/SSHInteract.pm (telnet switch/console)
perl-Net-DNS plugins/activedirectory.pm
perl-Crypt-CBC xCAT/IPMI.pm (IPMI 2.0 RMCP+ crypto)
perl-Crypt-Rijndael xCAT/IPMI.pm (IPMI 2.0 RMCP+ crypto)
perl-DB_File Confluent/Client.pm
The Crypt::CBC / Crypt::Rijndael gap is the notable one: IPMI.pm fails to
load without them, disabling all IPMI-based hardware control on a host where
those modules are absent.
Recovered from the unmerged lenovobuild branch (Jarrod Johnson; originals
807d30d3, c2e22f6f, 792e41727), reduced to the subset that master's current
packaging does not already satisfy.
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
go-xcat's install list still named yaboot-xcat, which was obsoleted in the
xcat-dep 2.18 rebuild and is no longer published. It also lists the cross-arch
ppc64 genesis packages, which the arch-split 2.18 dep repo no longer places in
the x86_64 view an x86 management node reads. Because EL dnf is strict by
default, any one of these unresolvable names aborts the entire `dnf install`
transaction, so `go-xcat install` fails outright on EL9/EL10 even though every
package the node actually needs is available.
Drop yaboot-xcat from the install list (kept in the uninstall list so existing
installs are still cleaned up) and pass `dnf --setopt=strict=0` so a package
missing from the enabled repository is warned and skipped instead of failing
the whole install. The existing post-install smoke test still catches a
genuinely broken install.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Label a PR 'backport <branch>' (e.g. 'backport 2.18') and, once it
merges, this workflow cherry-picks the PR's commits onto that branch
and opens the backport PR automatically. Labeling an already-merged
PR triggers it retroactively. On cherry-pick conflict the action
comments on the original PR so the backport can be done by hand.
Master is the 2.19 development line: it already carries 2.19-bound
features (statelite NFS root mount options, DHCP OMAPI HMAC-SHA256
defaults for new sites, the xcat-release package). 2.18.x maintenance
releases are cut from the 2.18 branch, and 2.18.1 has already been
published to the EL yum repos, so builds from master must not label
themselves 2.18.x.
Vinícius Ferrão
Daniel Hilst
Vinícius Ferrão