3 Commits

Include renames

Author	SHA1	Message	Date
bvandeusenandClaude Opus 5.5	1ba4784fa6	fix(maintenance): check first, drain before a Docker upgrade, wait 5 min after a drain, see containers back (#6098) ... On 2026-10-18 an update on VDNT-Docker02 restarted the Docker daemon six seconds in, before the drain that came only with the reboot, and every container on the node stopped. Docker's own packages restart the daemon from their install scripts; needrestart's list-only mode doesn't stop that. - The helper gains a `check` action (agent 1.24.0): a dry run of the update for each package manager, whether Docker is among it, and the running containers outside the swarm with their restart policies. - A swarm node is drained before an update that upgrades Docker, else only before a reboot, and at most once a job. - After a drain the job settles 5 minutes before the update or reboot. - Once the work is over, the containers that ran outside the swarm must be seen running again within 10 minutes, or the job fails naming them. - An older agent gets no check and its job runs as before. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-19 10:44:45 -04:00
bvandeusenandClaude Opus 5.5	4054bf6bbb	feat(host-agent): updates on pacman, zypper and yum hosts (#5803, #5804) ... Agent 1.21.0. The hourly update check now covers the package managers beyond apt and dnf (#5803 "The agent's update check reads pacman, zypper and yum"): - yum: `yum -C check-update`, `updateinfo list security`, `needs-restarting -r`, as dnf. - zypper: `--no-refresh list-updates` (`--dup` on Tumbleweed), needed security patches from `list-patches --category security`, and `zypper needs-rebooting`. - pacman: `checkupdates` from pacman-contrib, which install-deps.sh now installs. pacman has no security notion; a reboot is required once the running kernel's /usr/lib/modules/<release> is gone. The checks sit in one UPDATE_CHECKS table, and a failure names its manager. The root helper's update runs on the same hosts (#5804 "The scheduled update runs on pacman, zypper and yum hosts"): yum upgrade, zypper refresh + update (dup on Tumbleweed, with 102/103 counted as success), pacman -Syu. Each step carries a label so a failure says which one, and the reboot check reads zypper and the pacman kernel too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-15 11:47:13 -04:00
bvandeusenandClaude Opus 5.5	6a68bd75d9	feat(host_agent): a root helper the agent can start, for updates, reboots and drains only (#5766) ... #5766 "A root helper the agent can start, for a fixed set of maintenance actions and nothing else", milestone 514. The agent runs unprivileged under NoNewPrivileges, so it can't update or reboot its host. It now leaves a request in /var/lib/steward-agent/requests, the one path its unit lets it write; steward-maint.path starts maint.py as root, which reads it without following links, accepts only update, reboot, drain or undrain, deletes it, and writes the outcome to /var/lib/steward-maint/results. The agent (1.17.0) reports each new result state once as a `maintenance` event, re-checks pending updates when an update finishes, and says in its metadata whether the helper is installed. The units and the helper are served from one copy at /plugins/host_agent/files/<name> (a fixed list), and install.sh plus the install, provision and update playbooks all fetch them, replacing three inline copies of the unit. Update agent installs the helper on existing hosts; the Agent panel says under Manage agent whether it is there. Steward handing out jobs is #5767; the cadence is #5768. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 18:34:28 -04:00