feat(host_agent): a root helper the agent can start, for updates, reboots and drains only (#5766)
#5766 "A root helper the agent can start, for a fixed set of maintenance actions and nothing else", milestone 514. The agent runs unprivileged under NoNewPrivileges, so it can't update or reboot its host. It now leaves a request in /var/lib/steward-agent/requests, the one path its unit lets it write; steward-maint.path starts maint.py as root, which reads it without following links, accepts only update, reboot, drain or undrain, deletes it, and writes the outcome to /var/lib/steward-maint/results. The agent (1.17.0) reports each new result state once as a `maintenance` event, re-checks pending updates when an update finishes, and says in its metadata whether the helper is installed. The units and the helper are served from one copy at /plugins/host_agent/files/<name> (a fixed list), and install.sh plus the install, provision and update playbooks all fetch them, replacing three inline copies of the unit. Update agent installs the helper on existing hosts; the Agent panel says under Manage agent whether it is there. Steward handing out jobs is #5767; the cadence is #5768. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5.5
@@ -74,32 +74,47 @@
|
||||
interval_seconds = {{ agent_interval }}
|
||||
notify: restart steward-agent
|
||||
|
||||
- name: Install systemd unit
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/systemd/system/steward-agent.service
|
||||
# The units and the maintenance helper come from Steward: one copy for
|
||||
# install.sh and every playbook (#5766). The agent may write only its
|
||||
# request directory; the helper and its results stay root's.
|
||||
- name: Create the maintenance directories
|
||||
ansible.builtin.file:
|
||||
path: "{{ item.path }}"
|
||||
state: directory
|
||||
owner: "{{ item.owner }}"
|
||||
group: "{{ item.owner }}"
|
||||
mode: "{{ item.mode }}"
|
||||
loop:
|
||||
- {path: /var/lib/steward-agent, owner: root, mode: "0755"}
|
||||
- {path: /var/lib/steward-agent/requests, owner: steward-agent, mode: "0700"}
|
||||
- {path: /var/lib/steward-maint, owner: root, mode: "0755"}
|
||||
- {path: /var/lib/steward-maint/results, owner: root, mode: "0755"}
|
||||
|
||||
- name: Download the maintenance helper
|
||||
ansible.builtin.get_url:
|
||||
url: "{{ steward_url }}/plugins/host_agent/files/maint.py"
|
||||
dest: /usr/local/lib/steward-agent/maint.py
|
||||
owner: root
|
||||
mode: "0755"
|
||||
force: true
|
||||
|
||||
- name: Install the agent and maintenance units
|
||||
ansible.builtin.get_url:
|
||||
url: "{{ steward_url }}/plugins/host_agent/files/{{ item }}"
|
||||
dest: "/etc/systemd/system/{{ item }}"
|
||||
owner: root
|
||||
mode: "0644"
|
||||
content: |
|
||||
[Unit]
|
||||
Description=Steward host agent
|
||||
After=network-online.target
|
||||
Wants=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=steward-agent
|
||||
Environment=STEWARD_AGENT_CONFIG=/etc/steward-agent.conf
|
||||
ExecStart=/usr/bin/env python3 /usr/local/lib/steward-agent/agent.py
|
||||
Restart=on-failure
|
||||
RestartSec=5
|
||||
NoNewPrivileges=true
|
||||
ProtectSystem=strict
|
||||
ProtectHome=true
|
||||
PrivateTmp=true
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
force: true
|
||||
loop: [steward-agent.service, steward-maint.service, steward-maint.path]
|
||||
notify: restart steward-agent
|
||||
|
||||
- name: Watch for maintenance requests
|
||||
ansible.builtin.systemd:
|
||||
name: steward-maint.path
|
||||
enabled: true
|
||||
state: started
|
||||
daemon_reload: true
|
||||
|
||||
- name: Enable and start the agent
|
||||
ansible.builtin.systemd:
|
||||
name: steward-agent
|
||||
|
||||
@@ -130,32 +130,47 @@
|
||||
interval_seconds = {{ agent_interval }}
|
||||
notify: restart steward-agent
|
||||
|
||||
- name: Install systemd unit
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/systemd/system/steward-agent.service
|
||||
# The units and the maintenance helper come from Steward: one copy for
|
||||
# install.sh and every playbook (#5766). The agent may write only its
|
||||
# request directory; the helper and its results stay root's.
|
||||
- name: Create the maintenance directories
|
||||
ansible.builtin.file:
|
||||
path: "{{ item.path }}"
|
||||
state: directory
|
||||
owner: "{{ item.owner }}"
|
||||
group: "{{ item.owner }}"
|
||||
mode: "{{ item.mode }}"
|
||||
loop:
|
||||
- {path: /var/lib/steward-agent, owner: root, mode: "0755"}
|
||||
- {path: /var/lib/steward-agent/requests, owner: steward-agent, mode: "0700"}
|
||||
- {path: /var/lib/steward-maint, owner: root, mode: "0755"}
|
||||
- {path: /var/lib/steward-maint/results, owner: root, mode: "0755"}
|
||||
|
||||
- name: Download the maintenance helper
|
||||
ansible.builtin.get_url:
|
||||
url: "{{ steward_url }}/plugins/host_agent/files/maint.py"
|
||||
dest: /usr/local/lib/steward-agent/maint.py
|
||||
owner: root
|
||||
mode: "0755"
|
||||
force: true
|
||||
|
||||
- name: Install the agent and maintenance units
|
||||
ansible.builtin.get_url:
|
||||
url: "{{ steward_url }}/plugins/host_agent/files/{{ item }}"
|
||||
dest: "/etc/systemd/system/{{ item }}"
|
||||
owner: root
|
||||
mode: "0644"
|
||||
content: |
|
||||
[Unit]
|
||||
Description=Steward host agent
|
||||
After=network-online.target
|
||||
Wants=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=steward-agent
|
||||
Environment=STEWARD_AGENT_CONFIG=/etc/steward-agent.conf
|
||||
ExecStart=/usr/bin/env python3 /usr/local/lib/steward-agent/agent.py
|
||||
Restart=on-failure
|
||||
RestartSec=5
|
||||
NoNewPrivileges=true
|
||||
ProtectSystem=strict
|
||||
ProtectHome=true
|
||||
PrivateTmp=true
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
force: true
|
||||
loop: [steward-agent.service, steward-maint.service, steward-maint.path]
|
||||
notify: restart steward-agent
|
||||
|
||||
- name: Watch for maintenance requests
|
||||
ansible.builtin.systemd:
|
||||
name: steward-maint.path
|
||||
enabled: true
|
||||
state: started
|
||||
daemon_reload: true
|
||||
|
||||
- name: Enable and start the agent
|
||||
ansible.builtin.systemd:
|
||||
name: steward-agent
|
||||
|
||||
@@ -1,7 +1,8 @@
|
||||
---
|
||||
# description: Update the Steward host agent (refresh agent.py + restart) on hosts already running it.
|
||||
# description: Update the Steward host agent (refresh agent.py, its units and the maintenance helper, then restart) on hosts already running it.
|
||||
# steward:category: host-agent
|
||||
# Update an already-installed Steward host agent: refresh agent.py and restart.
|
||||
# Update an already-installed Steward host agent: refresh agent.py, its systemd
|
||||
# units and the maintenance helper (#5766), then restart.
|
||||
#
|
||||
# Deliberately does NOT touch the registration token or /etc/steward-agent.conf
|
||||
# — the host already has a working token, so an update leaves identity alone and
|
||||
@@ -41,6 +42,47 @@
|
||||
force: true
|
||||
notify: restart steward-agent
|
||||
|
||||
# The units and the maintenance helper come from Steward: one copy for
|
||||
# install.sh and every playbook (#5766). The agent may write only its
|
||||
# request directory; the helper and its results stay root's.
|
||||
- name: Create the maintenance directories
|
||||
ansible.builtin.file:
|
||||
path: "{{ item.path }}"
|
||||
state: directory
|
||||
owner: "{{ item.owner }}"
|
||||
group: "{{ item.owner }}"
|
||||
mode: "{{ item.mode }}"
|
||||
loop:
|
||||
- {path: /var/lib/steward-agent, owner: root, mode: "0755"}
|
||||
- {path: /var/lib/steward-agent/requests, owner: steward-agent, mode: "0700"}
|
||||
- {path: /var/lib/steward-maint, owner: root, mode: "0755"}
|
||||
- {path: /var/lib/steward-maint/results, owner: root, mode: "0755"}
|
||||
|
||||
- name: Download the maintenance helper
|
||||
ansible.builtin.get_url:
|
||||
url: "{{ steward_url }}/plugins/host_agent/files/maint.py"
|
||||
dest: /usr/local/lib/steward-agent/maint.py
|
||||
owner: root
|
||||
mode: "0755"
|
||||
force: true
|
||||
|
||||
- name: Install the agent and maintenance units
|
||||
ansible.builtin.get_url:
|
||||
url: "{{ steward_url }}/plugins/host_agent/files/{{ item }}"
|
||||
dest: "/etc/systemd/system/{{ item }}"
|
||||
owner: root
|
||||
mode: "0644"
|
||||
force: true
|
||||
loop: [steward-agent.service, steward-maint.service, steward-maint.path]
|
||||
notify: restart steward-agent
|
||||
|
||||
- name: Watch for maintenance requests
|
||||
ansible.builtin.systemd:
|
||||
name: steward-maint.path
|
||||
enabled: true
|
||||
state: started
|
||||
daemon_reload: true
|
||||
|
||||
handlers:
|
||||
- name: restart steward-agent
|
||||
ansible.builtin.systemd:
|
||||
|
||||
Reference in New Issue
Block a user