-
Notifications
You must be signed in to change notification settings - Fork 44
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
DLPX-89763 DLPX-86523 delphix-platform changes #477
base: develop
Are you sure you want to change the base?
DLPX-89763 DLPX-86523 delphix-platform changes #477
Conversation
ec9dada
to
317e58e
Compare
...n/var/lib/delphix-platform/ansible/10-delphix-platform/roles/delphix-platform/tasks/main.yml
Show resolved
Hide resolved
317e58e
to
68118d0
Compare
68118d0
to
e56b7de
Compare
a4f876c
to
d356ef1
Compare
38fba97
to
28cab6b
Compare
b1d61e7
to
0c718f3
Compare
b984a71
to
f389cbe
Compare
64091f7
to
5022542
Compare
5022542
to
744dc46
Compare
d39c466
to
52eee14
Compare
b5743b5
to
3a9629e
Compare
4e5c764
to
d0ba9f9
Compare
…rt/home DLPX-89763 DLPX-86523 delphix-platform changes PR URL: https://www.github.com/delphix/delphix-platform/pull/477
d0ba9f9
to
43d194d
Compare
if [[ -e $auto_master ]]; then | ||
if grep -q "\/home\s+auto_home\s+-nobrowse" "$auto_master"; then | ||
sed -i 's|/home auto_home -nobrowse|#/home auto_home -nobrowse|g' "$auto_master" | ||
systemctl restart autofs | ||
fi | ||
fi |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why is this here?
# Checking the fstab file if the /export/home entry | ||
# is present in the /etc/fstab, In case of container | ||
# upgrade the file is already changed by the | ||
# container-upgrade script and we dont need to do | ||
# it again. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm confused with the wording in this comment. There is also no script called "container-upgrade". If this is referring to the code from the "upgrade-container" script, that script sets up the container used for upgrade verification. I don't think it's relevant here. I might change this to something like:
Home directories were previously mounted under /export/home, and this was changed to /home. This is the upgrade logic that updates the /etc/fstab file to reflect that change. Home directories will be mounted in both /export/home and /home until the system is rebooted to ensure that running processes referencing the old /export/home paths continue to function while also enabling new logins under /home to work.
- name: Unmount the path if it is mounted | ||
ansible.builtin.mount: | ||
path: /export/home | ||
state: unmounted | ||
when: mount_status.rc == 0 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is going to fail if there are any running processes with references to any files under /export/home. This feels very fragile. What I would recommend doing instead is:
- Keep /export/home mounted. Since it's been changed in /etc/fstab, it simply won't get mounted at the next reboot.
- At boot, since /export/home won't be mounted at that point, create the symbolic link then. I think this could be as simple as creating the symbolic link (if it doesn't already exist) in the delphix-platform service's start method.
This would remove the need for all of this new ansible logic, and harden the system against random upgrade failures due to unexpected processes holding the mount hostage.
Problem
CIS is looking or a single home directory filesystem mounted at the
/home
location, currently we have the home dataset is mounted on/export/home
Due to that we see the below issues in the CIS Report
Solution
/home
./export/home
to/home
so that the exiting tests and dependencies have minimal impact.
**Kindly refer testing section from Review** : https://github.com/delphix/appliance-build/pull/756Testing Done