bvandeusenandClaude Opus 5.5
6a68bd75d9
#5766 "A root helper the agent can start, for a fixed set of maintenance actions and nothing else", milestone 514. The agent runs unprivileged under NoNewPrivileges, so it can't update or reboot its host. It now leaves a request in /var/lib/steward-agent/requests, the one path its unit lets it write; steward-maint.path starts maint.py as root, which reads it without following links, accepts only update, reboot, drain or undrain, deletes it, and writes the outcome to /var/lib/steward-maint/results. The agent (1.17.0) reports each new result state once as a `maintenance` event, re-checks pending updates when an update finishes, and says in its metadata whether the helper is installed. The units and the helper are served from one copy at /plugins/host_agent/files/<name> (a fixed list), and install.sh plus the install, provision and update playbooks all fetch them, replacing three inline copies of the unit. Update agent installs the helper on existing hosts; the Agent panel says under Manage agent whether it is there. Steward handing out jobs is #5767; the cadence is #5768. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
131 lines
4.4 KiB
YAML
131 lines
4.4 KiB
YAML
---
|
|
# description: Install or re-enroll the Steward host agent on an already-provisioned host.
|
|
# steward:category: host-agent
|
|
# Install (or update) the Steward host agent on a target. Mirrors the
|
|
# curl-based install.sh. Pass the per-host registration token as extra-vars:
|
|
# steward_url=https://steward.example steward_token=<token from Host Agents>
|
|
# Re-running updates agent.py in place and restarts the service.
|
|
- name: Install Steward host agent
|
|
hosts: all
|
|
become: true
|
|
gather_facts: false
|
|
# steward_token is a per-host inventory var — not declared here, or a play var
|
|
# would outrank and shadow it. steward_url arrives as an extra-var.
|
|
vars:
|
|
steward_url: ""
|
|
agent_interval: 30
|
|
tasks:
|
|
- name: Require steward_url and steward_token
|
|
ansible.builtin.assert:
|
|
that:
|
|
- steward_url | default('') | length > 0
|
|
- steward_token | default('') | length > 0
|
|
fail_msg: "Pass steward_url and steward_token (Steward injects these)."
|
|
|
|
- name: Create steward-agent system user
|
|
ansible.builtin.user:
|
|
name: steward-agent
|
|
system: true
|
|
shell: /usr/sbin/nologin
|
|
create_home: false
|
|
|
|
# Let the agent read the local Docker socket so it can report this host's
|
|
# containers (the per-host docker collection path). Best-effort: skipped on
|
|
# hosts without Docker. Restart picks up the new supplementary group.
|
|
- name: Detect docker group
|
|
ansible.builtin.command: getent group docker
|
|
register: _docker_grp
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Add steward-agent to the docker group
|
|
ansible.builtin.user:
|
|
name: steward-agent
|
|
groups: docker
|
|
append: true
|
|
when: _docker_grp.rc == 0
|
|
notify: restart steward-agent
|
|
|
|
- name: Create agent directory
|
|
ansible.builtin.file:
|
|
path: /usr/local/lib/steward-agent
|
|
state: directory
|
|
mode: "0755"
|
|
|
|
- name: Download agent.py
|
|
ansible.builtin.get_url:
|
|
url: "{{ steward_url }}/plugins/host_agent/agent.py"
|
|
dest: /usr/local/lib/steward-agent/agent.py
|
|
mode: "0755"
|
|
force: true
|
|
notify: restart steward-agent
|
|
|
|
- name: Write agent config
|
|
# The content carries steward_token; --diff and a failure would print it.
|
|
no_log: true
|
|
ansible.builtin.copy:
|
|
dest: /etc/steward-agent.conf
|
|
owner: root
|
|
group: steward-agent
|
|
mode: "0640"
|
|
content: |
|
|
url = {{ steward_url }}
|
|
token = {{ steward_token }}
|
|
interval_seconds = {{ agent_interval }}
|
|
notify: restart steward-agent
|
|
|
|
# The units and the maintenance helper come from Steward: one copy for
|
|
# install.sh and every playbook (#5766). The agent may write only its
|
|
# request directory; the helper and its results stay root's.
|
|
- name: Create the maintenance directories
|
|
ansible.builtin.file:
|
|
path: "{{ item.path }}"
|
|
state: directory
|
|
owner: "{{ item.owner }}"
|
|
group: "{{ item.owner }}"
|
|
mode: "{{ item.mode }}"
|
|
loop:
|
|
- {path: /var/lib/steward-agent, owner: root, mode: "0755"}
|
|
- {path: /var/lib/steward-agent/requests, owner: steward-agent, mode: "0700"}
|
|
- {path: /var/lib/steward-maint, owner: root, mode: "0755"}
|
|
- {path: /var/lib/steward-maint/results, owner: root, mode: "0755"}
|
|
|
|
- name: Download the maintenance helper
|
|
ansible.builtin.get_url:
|
|
url: "{{ steward_url }}/plugins/host_agent/files/maint.py"
|
|
dest: /usr/local/lib/steward-agent/maint.py
|
|
owner: root
|
|
mode: "0755"
|
|
force: true
|
|
|
|
- name: Install the agent and maintenance units
|
|
ansible.builtin.get_url:
|
|
url: "{{ steward_url }}/plugins/host_agent/files/{{ item }}"
|
|
dest: "/etc/systemd/system/{{ item }}"
|
|
owner: root
|
|
mode: "0644"
|
|
force: true
|
|
loop: [steward-agent.service, steward-maint.service, steward-maint.path]
|
|
notify: restart steward-agent
|
|
|
|
- name: Watch for maintenance requests
|
|
ansible.builtin.systemd:
|
|
name: steward-maint.path
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: true
|
|
|
|
- name: Enable and start the agent
|
|
ansible.builtin.systemd:
|
|
name: steward-agent
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: true
|
|
|
|
handlers:
|
|
- name: restart steward-agent
|
|
ansible.builtin.systemd:
|
|
name: steward-agent
|
|
state: restarted
|
|
daemon_reload: true
|