(MODULES-10996) Fix SLES 11 PE upgrades #551
Conversation
puppet_agent::install is a classthat may have no external impact to Forge modules. puppet_agent::osfamily::suse is a classthat may have no external impact to Forge modules. This module is declared in 3 of 576 indexed public
|
GabrielNagy
force-pushed
the
MODULES-10996/sles-11-pe-fix
branch
4 times, most recently
from
16e089d to
a2a9f11
Compare
|
Updated the GPG key import checks, spec tests will also need to be updated. |
GabrielNagy
force-pushed
the
MODULES-10996/sles-11-pe-fix
branch
2 times, most recently
from
5da189b to
baff754
Compare
GabrielNagy
force-pushed
the
MODULES-10996/sles-11-pe-fix
branch
from
baff754 to
df35318
Compare
GabrielNagy
force-pushed
the
MODULES-10996/sles-11-pe-fix
branch
3 times, most recently
from
749f4ec to
bb357cb
Compare
GabrielNagy
force-pushed
the
MODULES-10996/sles-11-pe-fix
branch
2 times, most recently
from
a180f5d to
83bb265
Compare
SLES 11 can no longer be upgraded in PE by installing from the repos. To work around this, if we're SLES 11 and PE, download the package and install it directly using rpm, regardless of the value of `manage_repo`. This is the same approach we take for AIX, macOS and Windows. Because zypper is left in a semi-broken state if our pe_repo is installed, make sure we remove it and don't install it again. The GPG keys will continue to be imported. For non-PE agents, installing from the FOSS repos should still be possible, so nothing should change on that part. Additional tests were added to assert the behavior of FOSS vs PE.
The install class was getting a bit complex, so I pulled out the SUSE logic into a separate file. This also made it easier to add a GPG check before installing the RPM file. Since we don't use zypper anymore on SLES 11 in PE, create a separate `exec` resource to handle the GPG check before upgrading.
The puppet GPG signing key with ID 4528b6cd9e61ef26 had a subkey in it until February 2021. This caused GPG checks on systems with RPM versions that do not support subkeys[1] (SLES 11 and EL 5) to fail. We added this GPG key in the puppet_agent module in January, and included it in the 4.4.0 release of the module. We discovered the subkey issue in February and promptly removed the subkey from the existing key. The new key is available since version 4.5.0 of the puppet_agent module. This module imports GPG keys based on their ID. Since in our case both the good key and the bad key have the same ID, the module will not import the correct key if the bad one is already installed (or any other key with the same ID for that matter). To circumvent this, we now specifically compare the contents of the GPG key from the RPM database with the contents of the GPG key laid by Puppet in `/etc/pki/rpm-gpg`. If any differences are found, the imported key is purged and reimported, which should ensure that the key shipped in the module is identical to the from the RPM database. [1] https://technosorcery.net/blog/2010/10/pitfalls-with-rpm-and-gpg/
By relying on the puppet service to upgrade puppet we lose all logging info in case something fails, which makes things difficult to debug. Change to run with puppet agent -t. We can also fix the logging part by configuring puppet to log to a file, then printing the contents of the file.
puppet_agent::install is a classthat may have no external impact to Forge modules. puppet_agent::install::suse is a classthat may have no external impact to Forge modules. puppet_agent::osfamily::redhat is a classthat may have no external impact to Forge modules. puppet_agent::osfamily::suse is a classthat may have no external impact to Forge modules. This module is declared in 3 of 576 indexed public
|
GabrielNagy
force-pushed
the
MODULES-10996/sles-11-pe-fix
branch
from
83bb265 to
8bb9628
Compare
|
@GabrielNagy what about |
|
It should be fixed by: #557 |
SLES 11 can no longer be upgraded in PE by installing from the repos. To work around this, if we're SLES 11 and PE, download the package and install it directly using rpm, regardless of the value of
manage_repo. This is the same approach we take for AIX, macOS and Windows. Because zypper is left in a semi-broken state if our pe_repo is installed, make sure we remove it and don't install it again.The GPG keys will continue to be imported.
For non-PE agents, installing from the FOSS repos should still be possible, so nothing should change on that part. Additional tests were added to assert the behavior of FOSS vs PE.