feat(roles/bootloader): add role - #331
Open
markuslf wants to merge 3 commits into
Open
Conversation
Manages the kernel command line, for parameters that only take effect at boot time such as psi=1. On the Red Hat family the boot entries are written with grubby, on Debian and Ubuntu through a drop-in in /etc/default/grub.d/ followed by update-grub, so the packaged configuration files stay untouched. An option counts as present only when every boot entry carries it, and it is escaped before it goes into the comparison. A changed command line requests a reboot through schedule_reboot instead of rebooting right away, and a --check run reports what it would change without touching the host. The role deliberately does not use fedora.linux_system_roles.bootloader: that role rewrites GRUB_TIMEOUT in /etc/default/grub and every `set timeout=` in grub.cfg on each run, including the ones of the menu_auto_hide and menu_show_once blocks, and its bootloader_settings module declares supports_check_mode without ever reading module.check_mode, so a --check run rewrites the boot entries for real. Verified on Rocky 8, Rocky 9, Rocky 10, Fedora 44 and Debian 13: the check run leaves every file and boot entry byte-identical, the first run applies the options to all boot entries, the second reports no change, and removing them restores the original state.
…r cannot read On Red Hat family 8 the kernel command line lives in the GRUB environment block, which grub2-efi-x64 ships as a symlink onto the EFI System Partition. A host that boots BIOS from an image carrying both boot paths cannot follow that symlink into the ESP, so grubby reports the option as applied while the running kernel never receives it. Detect the combination and abort, instead of reporting a converged run that changed nothing. Further findings from the review of the role: * Name the platform tasks file directly instead of using the first_found lookup, so an unsupported OS family aborts the run rather than reporting ok and never touching the kernel command line. * Reject `root`, which grubby reports outside the kernel command line and which the role would therefore set again on every run. * Split the molecule scenario into bootloader/install and bootloader/remove, and supply the postfix and mailto_root variables the playbook's dependent roles require. * Read /proc/cmdline outside the reboot block in install/verify.yml. A register on a skipped task overwrites the variable with the skip result, which broke the second verify run. * Promote Debian 12 and Ubuntu 22.04, 24.04 and 26.04 in COMPATIBILITY.md, now that both scenarios pass on all eight targets.
… a new role The multi-line __combined_var expression in defaults/main.yml is reported as jinja[spacing]. We keep the readable form, so every role that has one needs a line in .ansible-lint-ignore.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Manages the kernel command line, for parameters that only take effect at boot time such as
psi=1. Triggered by icinga-demo, which needspsi=1for thepsi-cpu/psi-io/psi-irq/psi-memorychecks.What it does
grubby --update-kernel=ALL. Nothing ingrub.cfgis touched;grubbykeepsGRUB_CMDLINE_LINUXin/etc/default/grubin sync by itself./etc/default/grub.d/z00-lfops.cfgand runsupdate-grub.grub-mkconfigsources that directory after/etc/default/grub, so the packaged file is never edited.schedule_rebootinstead of rebooting right away.--checktouches nothing and reports what it would change.Why not fedora.linux_system_roles.bootloader
It was the first implementation, and a
--check --diffagainst a real host showed why it cannot stay:bootloader_settingsdeclaressupports_check_mode=Truebut never readsmodule.check_mode, so a dry run rewrites the boot entries for real.GRUB_TIMEOUTon every run, overwriting a value the host set on purpose.replaceongrub.cfgmatchesset timeout=.*everywhere, soset timeout="${menu_show_once_timeout}"becomes a literal and thefastbootandrecordfailtimeouts are flattened.Dropping it also removes the dependency on the Linux System Roles collection.
Verification
Run on Rocky 8, Rocky 9, Rocky 10, Fedora 44 and Debian 13, two of them with a
GRUB_TIMEOUTdiffering from the default:--check --diffgrub.cfguntouched on the Red Hat familychanged=0state: 'absent'plus rerunchanged=0on the rerunIdempotency and the check run were additionally confirmed against icinga-demo.
COMPATIBILITY.mdmarks Debian 13, RHEL 8, 9, 10 and Fedora 44 as proven; Debian 12 and the Ubuntu releases stay(x), where only the container and source-level checks exist.