Previously, makedhcp warned but still created host entries without
a static IP reservation when a node's address fell inside the
dynamic range. The node would silently get a random IP from the
pool instead of its configured address.
Now errors and skips the node on all four DHCP paths (ISC v4/v6,
Kea v4/v6) with a clear message telling the admin to move the IP
outside the range or adjust the dynamic range.
This makes ISC DHCP and Kea behavior consistent and aligns with
xCAT's design: the dynamic range is for hardware discovery,
known nodes should have static IPs outside it.
Closes#6539
Template.pm silently continued rendering kickstart templates when
getipaddr() failed to resolve the master hostname, producing
kickstarts with an empty MASTER_IP. Nodes would install successfully
but fail on first reboot when post.xcat and xcatinstallpost tried
to contact the master, timing out after 90 retries with:
the network between the node and is not ready
Postage.pm (mypostscript generation) already checks for this and
returns a clear error. Apply the same pattern in Template.pm so
nodeset fails immediately with a descriptive message instead of
producing a broken kickstart.
Fixes#7544
On some BMCs (notably Supermicro), a GET immediately after SET
returns the old value until the BMC applies the change. This made
rspconfig output misleading for network setting operations.
- Store the canonical SET value after normalization and compare
with the GET readback for ip, netmask, gateway, and backupgateway.
When they differ, annotate the output:
"BMC Gateway: 10.20.0.1 (requested 10.20.0.254, not yet reflected)"
- Consolidate ip/netmask/gateway/backupgateway display into one block
- Fix backupgateway SET: was routed through the gateway branch
writing parameter 0x0C instead of 0x0E. Now has its own branch
writing the correct IPMI parameter.
- ip=dhcp is unaffected (separate code path, never stores a value)
Tested on Supermicro IPMI BMC (10.20.0.51).
Fixes#3445
Docker container lifecycle management (mgt=docker, mkdocker, rmdocker,
lsdocker) was added in 2015-2016 as an experiment targeting Docker API
v1.22 on Ubuntu only. Documentation and man pages were deliberately
removed in 2019 (PRs #6222 and #6324) with the original developer's
approval, noting that "the interface of Docker has become very simple
right now, so there is no value for xCAT to offer such functions."
The plugin was still being shipped but has had no functional code changes
since April 2016, was never listed as a valid mgt value in Schema.pm,
and no user ever filed an issue about it.
Removed:
- xCAT-server/lib/xcat/plugins/docker.pm (1,142 lines)
- xCAT/postscripts/setupdockerhost
- xCAT-server/share/xcat/scripts/setup-dockerhost-cert.sh
- xCAT-test/autotest/testcase/dockercommand/ (test cases)
- Docker attribute definitions in Schema.pm
- Client symlinks (mkdocker, rmdocker, lsdocker)
- Usage entries and dockerhost cert handling in credentials.pm
- Docker attribute documentation in man7 pages
The "Running xCAT in Docker" documentation (dockerized_xcat/) is
retained as it documents containerizing xCAT itself, not the removed
mgt=docker feature.
Closes#7518
rspconfig vlan= only accepted values 1-4096 with no way to disable
VLAN tagging. Users had to resort to raw IPMI commands to clear a
stale VLAN after ip=dhcp.
- Accept vlan=off/disable/disabled to clear VLAN tagging via
standard IPMI parameter 0x14 with the enable bit unset
- Fix valid range from 1-4096 to 1-4094 (IEEE 802.1Q)
- Use strict digit matching to reject malformed inputs
To clear VLAN after a DHCP reset: rspconfig <node> vlan=off
Tested on Supermicro IPMI BMC (10.20.0.51).
Partially addresses #3725
Two pre-existing bugs in the alert on/off conditions:
1. Operator precedence: 'and' with 'or' without parens caused any
subcommand with argument matching /^en/ or /^dis/ to silently
trigger the alert handler.
2. Loose prefix matching: /^en/ and /^dis/ accepted typos like
"enterprise" or "discover". Replace with exact token matching
while preserving the "en"/"dis" abbreviations used by snmpmon.pm.
* Fix silent failure when site.master is not set (#6157)
Hardware control commands (rpower, rinv, etc.) silently return no output
and exit 0 when site.master is empty. The original fix (#6074) was
reverted (#6158) because it warned per-node with the wrong hostname.
Check once in plugin_command before dispatching to plugins, so the error
appears exactly once with the correct command name.
* Also reject empty site.master, not only undef
The else branch handles a rare case where XS libraries (Sys::Virt,
Net::SNMP) crash without setting $@. This IS a plugin bug, so keep
that label and the debug hint. Only the common case (die with $@)
gets the clean passthrough.
When a plugin dies during request processing, xcatd wrapped the error
in a misleading "plugin bug" message that hid the real cause (e.g.
"No space left on device"). Now passes through the actual error from
the eval, making the output useful for any failure, not just disk full.
Fixes#2719
RHEL 7 shipped ppc64le ISOs under the "alternate" label, causing
copycds to create distro paths like rhels7.6-alternate/ppc64le.
This mismatched osver() which returns rhels7.6 since /etc/os-release
has no knowledge of the alternate designation.
The architecture (ppc64le vs ppc64) already differentiates the
builds, making the alternate suffix redundant. Strip it during
auto-detection so copycds paths match osver() output.
Fixes#5593
When mkdef is called with an object name but no attributes (e.g.
mkdef -t node -o mynode), setFINALattrs produces an empty hash
and the OBJ loop has nothing to iterate. The code falls through to
"0 object definitions have been created or modified" with no
explanation of what went wrong.
Add a check after setFINALattrs: if FINALATTRS is empty, tell the
user what's missing. For nodes, mention that 'groups' is required.
Fixes#2765
The ntpd config generated by makentp had no access restrictions,
explicitly disabled authentication, and was vulnerable to CVE-2013-5211
amplification attacks.
Add restrict lines to block unauthorized access, add iburst for faster
initial sync, replace "disable auth" with "disable monitor". Security
hardening applies to all platforms including AIX (xntpd supports the
same restrict directives).
The chrony path (EL8+) is unaffected — it delegates to setupntp.
Fixes#2435
The verification logic in rspconfig_response uses a mutually exclusive
if/else to check for the old IP (origin_type) and new IP (check_result).
When setting the same IP, both match the same entry but only origin_type
gets set — check_result stays 0 and the command reports "Config IP failed".
Make the two checks independent so both can match the same IP object.
Fixes#5121
When a pkgdir has no valid repodata, Yum.pm creates an empty
local-repository.tmpl file. Template.pm then reads it and generates
an empty yum repo config block in the kickstart. Adding a -s check
skips empty template files instead of silently including them.
Revives the fix from PR #4769 which was closed without merging.
Fixes#3572
This fixes a problem where the dracut image was pulling artifacts from
the build host and not the mock image, e.g. building for EL9 in EL10.
Signed-off-by: Daniel Hilst Selli <392820+dhilst@users.noreply.github.com>
This commit adds an early return to xcatconfig settunnables function.
This function set parameters at
/proc/sys/net/ipv4/neigh/default/gc_thresh1
/proc/sys/net/ipv4/neigh/default/gc_thresh2
/proc/sys/net/ipv4/neigh/default/gc_thresh3
And set sysctl attributes by writing to /etc/sysctl.d/ and
/etc/sysctl.conf
These are tunning network parameters for running on production
and should not affect the overall function for testing purposes.
Signed-off-by: Daniel Hilst Selli <392820+dhilst@users.noreply.github.com>
Add buildrpms.pl to build RPMs in parallel using mock
Add xCAT-buildkit to the build list
Fix build dependency in xCAT-buildkit.spec
Add fallback in /etc/init.d/xcatd for /etc/rc.d/init.d/functions
Signed-off-by: Daniel Hilst Selli <392820+dhilst@users.noreply.github.com>
