xcat-ws.conf sends /xcatws and /xcatwsv2 to https only when mod_rewrite is
loaded. Without that module the aliases run the REST CGI on any port.
An IfModule !mod_rewrite.c block now answers 403 for both aliases.
RedirectMatch comes from mod_alias, which the ScriptAlias lines of the
same file already require. Other paths, such as /install, are not changed.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
`rpm -V xCAT-server` reports /etc/httpd/conf.d/xcat-ws.conf and
/etc/apache2/conf.d/xcat-ws.conf changed on every EL, openEuler and SUSE
management node, for the life of the install. %install shipped the Apache 2.2
fragment as the payload, and %post replaced it with the Apache 2.4 fragment
whenever httpd, apachectl or apache2ctl reported 2.4. Every supported
distribution runs Apache 2.4, so the file on disk never matched the package
digest. The drift is a permanent false positive for anyone who verifies an
installed xCAT before trusting it.
Both fragments also began with
`LoadModule rewrite_module /usr/lib64/apache2-prefork/mod_rewrite.so`. That
file exists only on SUSE under the prefork MPM. Apache tolerates it on EL and
openEuler because conf.modules.d loaded mod_rewrite first, and logs AH01574;
where the module is not loaded first, the missing file stops Apache from
starting.
xcat-ws.conf.apache22 and xcat-ws.conf.apache24 are replaced by one
xcat-ws.conf that serves both generations: the redirect sits behind
<IfModule mod_rewrite.c>, and the authorization directives behind
<IfModule mod_authz_core.c> and its negation. %install copies that one file to
both conf.d paths and %post no longer names them, so the payload is the final
file. %post runs a2enmod rewrite where a2enmod manages modules, which is how
SUSE gets the module the removed LoadModule used to pull in.
xCAT-test/unit/wsapi_apache_conf_portable.t fails 22 of its 30 assertions
without this change.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
_run_omshell stops omshell after 10 seconds, but it read the output a
line at a time. A line read waits for a newline, and omshell writes its
prompt without one. An omshell that stalled after a prompt kept makedhcp
waiting past the deadline. The check of an external ISC server does that
read while it holds the DHCP lock.
_run_omshell now reads the output in chunks.
makedhcp builds a new configuration when dhcpd.conf is missing or xCAT
did not write it. It replaced each host over OMAPI before dhcpd loaded
that configuration. A dhcpd that still ran an older one then rejected a
host that tests an iPXE feature option. OMAPI had already removed the
old host, so the node lost its reservation.
makedhcp now writes the new configuration and restarts dhcpd first. It
changes no host when that restart fails. The restart marker of an
upgraded configuration now also covers a new one, so the next run
restarts dhcpd first after a run that stopped before the restart.
Kea gave a node in state boot or iscsiboot no classes of its own and
left a node that boots from SAN out of the local-boot class. Its clients
fell to the shared classes, which now skip a client with the iPXE
features of a script. A firmware iPXE without iSCSI then got no loader,
and an iPXE with iSCSI got the discovery script of the network.
Such a node now gets the loader of its method from its own classes on a
client without iSCSI, for BIOS and, with netboot=ipxe, for UEFI, as its
ISC host statements do. A client with iSCSI is in the local-boot class,
so no class names a boot file for it and it boots the root path. Kea
tests the iSCSI feature, which xNBA and iPXE both report, for a node of
any method.
omshell reads 1023 bytes of a line and parses the rest as a new command.
makedhcp removes the old host of a node before it creates it again, so a
longer "set statements" line, as an iSCSI node with long target and
initiator names can give, left the node without its reservation.
makedhcp now checks every command of a host before it sends any. For a
node whose command is too long, it reports the node and leaves its host
unchanged.
addnode printed the omshell commands of a host one line at a time,
starting with the removal of the old host. _isc_omapi_host_commands now
returns them as one text, so that makedhcp can check them before it
sends any. The commands and their order do not change.
Unknown x86 clients and netboot=ipxe nodes boot the upstream iPXE
loader of the ipxe-xcat package, which the xCAT packages did not
install.
The specs require ipxe-xcat where they require xnba-undi: on x86 and
ppc for xCAT, and on x86 for xCATsn. xCAT on riscv64 and xCATsn on ppc
and riscv64 require ipxe-xcat alone, because a POWER or riscv64 server
can serve x86 nodes. The xcat and xcatsn debs depend on ipxe-xcat on
every architecture for the same reason. go-xcat installs and removes
ipxe-xcat with the other packages.
xnba-undi stays a dependency, because netboot=xnba nodes still boot
xNBA.
A sourced go-xcat returns before the main program, which defined
riscv64_install_list, so a test that sources the script could not call
the filter. The function is now defined above the main program. A run of
the script does the same as before.
setdestiny accepted an x86 iscsiboot node without iSCSI boot data only
when undionly.kpxe was in the TFTP root. The check read
-f ("$tftpdir/undionly.kpxe" or -f "$tftpdir/xcat/xnba.kpxe"): the or
was inside the -f argument, so xnba.kpxe never counted.
Accept the node when undionly.kpxe is there, or the BIOS file of the
loader of its netboot method: the upstream loader for netboot=ipxe, and
xNBA for any other method.
makedhcp -n and -a now warn when a server that serves x86 discovery
lacks an upstream loader file in its local TFTP directory, the
snponly.efi that the UEFI shim loads included, or has no network boot
script under xcat/ipxe/nets, which mknb writes. A server
serves x86 discovery when it has network boot scripts under xcat/ipxe
or xcat/xnba. A node can load from another TFTP server, so the check
warns and does not stop.
netboot=xnba is deprecated, but profile-based node definitions, the x86
node templates of mkdef --template, the e1350 noderes table and the
SoftLayer importer still gave new x86 nodes xnba. They now give
netboot=ipxe, as node discovery does. Existing nodes keep their method,
and a profile change keeps netboot=xnba on a node that has it: moving a
node to the upstream loader is the choice of the site.
A discovered x86 node without an x86 method got netboot=xnba, which
names the xNBA loader that xCAT retires. It now gets netboot=ipxe, the
method of the upstream iPXE loader that discovery itself uses. A node
that already has pxe, ipxe or xnba keeps it.
An x86 client without a node definition, such as a node in discovery,
now gets xcat/ipxe/i386/undionly.kpxe for BIOS and
xcat/ipxe/x86_64-sb/snponly-shim.efi for UEFI. Once it reports the iPXE
features of its path, it gets the Genesis script of its network from
xcat/ipxe/nets, which mknb writes. ISC and Kea apply the same test. As
for xNBA, neither backend names a loader that the local TFTP directory
lacks, or the second stage that the loader would fetch.
Kea gave every x86 client its first-stage loader from the global
classes, which now name the upstream loader. An xnba node therefore
carries its own first-stage classes, which name xcat/xnba.kpxe and
xcat/xnba.efi when the local xNBA BIOS file exists, as its ISC host
statements do. An ipxe node carries its own classes for the upstream
loader, because an upgrade keeps the global classes of an older
makedhcp -n until the next makedhcp -n. The ISC host statements of a
node do not change.
makedhcp gives a netboot=ipxe node xcat/ipxe/i386/undionly.kpxe for
BIOS and xcat/ipxe/x86_64-sb/snponly-shim.efi for UEFI. That shim, which
Microsoft signs, loads snponly.efi from its own directory, so the node
also boots with UEFI Secure Boot on: the firmware does not load
snponly.efi directly, as only the iPXE Secure Boot CA signs it.
The node gets its boot script from xcat/ipxe/nodes only when it reports,
in option 175, the iPXE features that the script needs: HTTP, bzImage
and PXE for BIOS, HTTP and EFI for UEFI. A SAN node also needs iSCSI.
Every other client of the node first gets the loader above. xNBA sends
the same option, but xCAT recognizes xNBA by its user class, and the
upstream loader sends the user class of a firmware iPXE. The upstream
loader does not have to be in the local TFTP directory, because a node
can load from another TFTP server.
ISC applies the test in the host statements of the node, and nests each
feature test inside its architecture test: dhcpd saves a host statement
in dhcpd.leases without parentheses, and omshell reads only 1023 bytes
of the line that sets it. Kea applies it in the classes of the node,
which carry their own first-stage loader and the purpose ipxe-boot. As
for an xnba node, a node in state boot or iscsiboot gets no boot file
unless it boots from SAN. The statements and classes of netboot=xnba and
netboot=pxe nodes do not change.
The upstream iPXE loader of an unknown x86 client will fetch its Genesis
discovery script from xcat/ipxe/nets. mknb writes the same BIOS, UEFI
and elilo scripts there as under xcat/xnba/nets. xcat/xnba/nets keeps
them for a server whose DHCP configuration still names it.
xCAT boots x86 nodes through iPXE with netboot=xnba, which names the
xNBA fork that xCAT retires. netboot=ipxe is the method for the upstream
iPXE loaders of the ipxe-xcat package.
The ipxe plugin runs the xnba code, with the boot scripts under
xcat/ipxe/nodes instead of xcat/xnba/nodes. nodeset stat, the osimage
check of nodeset and rinstall, and the install check of Postage accept
the new value. The noderes.netboot description lists it and marks xnba
deprecated. The z/VM and FSM builds of xCAT-server leave the ipxe plugin
out with the xnba and pxe plugins. netboot=xnba does not change, and
makedhcp does not serve the new method yet.
makedhcp does not write the configuration of a DHCP server that
site.externaldhcpservers names, so an upgrade leaves it without the
iPXE feature options. OMAPI removes a host before it adds it again, so
a host statement that such a server rejects loses the reservation of
the node.
Before it updates netboot=ipxe nodes on that server, makedhcp creates a
host of its own whose statement tests every iPXE feature option, reads
it back in a second omshell run, and removes it. Only the server can
return the address of that host, so the nodes are updated only when it
does. Otherwise makedhcp reports the server and leaves the reservations
of those nodes unchanged. Other nodes and a local server get no check.
Each run uses its own host name and address, as other xCAT servers can
check the same server at the same time. The check opens no host before
the create, because the omshell of Ubuntu 20.04 and 22.04 can hang on a
failed open.
A package upgrade keeps the DHCP configuration of an older makedhcp -n,
which does not declare the iPXE feature options. makedhcp without -n
then adds the rules of the upstream loader to it. dhcpd rejects a subnet
or an OMAPI host statement that tests an undeclared option, and Kea
never finds a sub-option of option 175 without its definition.
makedhcp without -n now adds the missing declarations to an ISC
configuration that xCAT wrote, after its gpxe option space, writes it
and restarts dhcpd before it changes a subnet or a host. Declarations
with any blanks count. It stops when the configuration declares no gpxe
option space, or when it cannot write the file or restart dhcpd, because
OMAPI removes a host before it adds it again. A missing configuration,
or one that xCAT did not write, still gets a new one, which declares the
options. A marker file beside the configuration records a restart that
has not happened yet, so the next run restarts dhcpd before it changes a
host when a run stopped before the restart or the restart failed.
It adds the missing definitions to an existing Kea configuration, and
Kea restarts, also when the Control Agent applies the host reservations.
A site definition of option 175 without the gpxe encapsulation stays,
because option data can name it, and makedhcp stops with an error that
names the fix.
The rules for the upstream iPXE loader test the feature indicators that
iPXE sends as sub-options of option 175: iSCSI, HTTP, bzImage, PXE and
EFI. Declare them in the gpxe space of the ISC header. Define option 175
and the indicators in Kea, which does not find a sub-option without its
definition.
The declarations only decode the options. OMAPI keeps host statements in
dhcpd.leases, and makedhcp -n restarts dhcpd before -a rewrites them, so
the header declares them whether or not a node uses them. A statement
written for a node on the upstream loader must still parse after the
node moves back to xNBA.
dhcp.pm wrote the ISC host statements of netboot=xnba and netboot=pxe
nodes inline. Each Kea class builder named the xNBA files and the xNBA
user-class test on its own.
Move the host statements into isc_node_boot_statements. Give every ISC
and Kea builder its loader files and second-stage tests from x86_loader.
The rendered statements, lines and classes do not change.
kea_node_client_classes_for_nodes answered { classes, noip } when it
could not open the noderes or mac table, and left out the localboot
list that kea_sync_node_client_classes reads. makedhcp then died with
"Can't use an undefined value as an ARRAY reference".
Return an empty localboot list as well.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
reg_linux_diskfull_installation_flat never finishes on openEuler. The install completes, the
postscripts run, and then the node reboots into the installer again and repeats, so the case waited
an hour and the node stayed at status=installing.
post.xcat.ng ends with updateflag.awk, the call its own comment calls the one that must always run
to prevent infinite installation loops. It passed $MASTER, a hostname. The anaconda %post chroot on
openEuler has no /etc/resolv.conf and no management node entry in /etc/hosts, so gawk cannot open
the socket. From the node's own /var/log/xcat/xcat.log:
awk: /xcatpost/updateflag.awk:15: warning: remote host and port information
(xcat58-mn, 3002) invalid: Name or service not known
updateflag.awk: Retrying flag update
It retries ten times, gives up, and the status is never sent. Nothing reports it: the retry message
goes to logger, and a %post chroot runs no rsyslog.
The same script already uses $MASTER_IP for all 36 of its other callbacks, and the kickstart sets it
to the same host: MASTER_IP=192.168.58.1, MASTER=xcat58-mn. All six updateflag calls now use the
address, so none of them depends on a resolver the node does not have.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
On a new Kea management node, makedhcp -n defers DDNS until makedns -n
writes the key. makedhcp -a then applied the D2 settings to the fresh
intents, but saved the loaded configurations, which had no dhcp-ddns.
It also wrote no kea-dhcp-ddns.conf, so DNS updates stayed off.
When DDNS is on and the loaded DHCPv4 configuration has no dhcp-ddns,
makedhcp -a now copies the D2 settings into the loaded DHCPv4 and DHCPv6
configurations, writes the D2 configuration and, when enabled, the
Control Agent configuration. It then enables and restarts the Kea
services.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
kea_build_ddns_intent returned the deferral under a deferred key. No other
xCAT code uses that key: dhcp.pm reports through error, warning, node and
data, and makedhcp already passed this message to the callback as a warning.
The intent hash now carries the message under warning, so one name describes
it from the hash to the callback. Behaviour does not change.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The comment stated the xcatconfig default and then repeated the reason for the
change, which the commit message already carries. Keep the condition only.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
makedhcp -n fails on a new management node that uses the Kea backend:
Error: Unable to find DDNS key material for Kea D2. Run makedns with
dnshandler=ddns first.
xcatconfig writes site.dnshandler=ddns on every new installation, so
kea_ddns_enabled reports DDNS on, and kea_build_ddns_intent then requires
/etc/xcat/ddns.key. Only makedns -n writes that file. The ISC backend reads no
key, so an ISC management node runs makedhcp -n without one. The Kea backend
plan states that basic DHCP and PXE support must not depend on DDNS.
kea_build_ddns_intent now reports a deferral instead of an error when it finds
no key material. kea_apply_ddns_intent attaches the D2 connection only when a
key exists, and returns the deferral for makedhcp to print as a warning. A
management node with key material gets the same configuration as before.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The comments added with the Ubuntu fixes carried the bug report and its
consequences: what a compute node stops at, what named answers to every query
once its working directory is unwritable, and that a failed export does not fail
the service node. The comment rules keep the invariant in the source and put the
symptom and the chain in the commit.
Each is cut to the fact the code cannot show: that the resolv.conf a
systemd-resolved host publishes holds a stub pointing back at this named, that
named must be able to write the directory it drops privileges into, that apt
refuses an unsigned repository, and that re-exporting a mount needs an fsid.
service.subiquity.tmpl keeps its header, which is identical to the sibling
compute template and should stay that way.
No executable line changes.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
nodepurge removes the autoinstall configuration of each node it deletes. The
cleanup loop was inline in the nodepurge sub of profilednodes.pm, which no test
can load, so the loop moves to xCAT::ProfiledNodeUtils->remove_node_config_files
with its behaviour unchanged.
nodepurge_autoinst_cleanup.t drives that routine against a scratch directory. It
fails here: the Subiquity node keeps its directory, and the preseed file and the
.pre and .post scripts are removed.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
After `apt-get remove`, dpkg reports a package as "deinstall ok
config-files". uninstall_xcat_completely() selected packages with
installed_packages(), which accepts only "install ok installed". So
`go-xcat completely uninstall` after `go-xcat uninstall` did not purge
the xCAT packages, and their configuration files stayed on the node.
uninstall_xcat_completely() now uses purgeable_packages(). On Debian it
also accepts packages whose state ends in "ok config-files". On rpm
systems it is installed_packages(). uninstall_xcat() keeps the
installed-only filter.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
A Windows UEFI install deferred to proxyDHCP gets boot-file-name "" in its
Kea reservation. Kea treats the empty string as not specified, so the
subnet classes still match on architecture, and xcat-uefi-x64 offers
xcat/xnba.efi. The firmware then boots xNBA instead of asking the
proxyDHCP daemon on port 4011.
kea_node_client_classes_for_nodes now also puts the MAC of a proxyDHCP
node in xcat-localboot, which every class that names a boot file already
excludes. The per-node class that sets option 60 to PXEClient names no
boot file and still matches.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Daniel Hilst
Vinícius Ferrão