Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

DLPX-89763 DLPX-86523 delphix-platform changes #477

Open
wants to merge 1 commit into
base: develop
Choose a base branch
from

Conversation

justsanjeev
Copy link
Contributor

@justsanjeev justsanjeev commented Apr 18, 2024

Problem

CIS is looking or a single home directory filesystem mounted at the /home location, currently we have the home dataset is mounted on /export/home

Due to that we see the below issues in the CIS Report

  • (1.45) 7402 Status of the '/home' partition in the '/etc/fstab' file
  • (1.46) 13248 Status of Mount Partition '/home' using mount command
  • (1.47) 7403 Status of the 'nodev' mount option setting for the '/home partition' defined in the '/etc/ fstab' file
  • (1.48) 14601 Status of the 'nodev' option for '/home' partition using 'mount' command

Solution

  • Mounting the home dataset to /home.
  • Post upgrade creating a softlink /export/home to /home so that the exiting tests and dependencies have minimal impact.

Testing Done

**Kindly refer testing section from Review** : https://github.com/delphix/appliance-build/pull/756

@justsanjeev justsanjeev force-pushed the dlpx/pr/justsanjeev/ef30769e-a58a-4475-af32-174db6d07951 branch from ec9dada to 317e58e Compare April 18, 2024 14:34
@justsanjeev justsanjeev force-pushed the dlpx/pr/justsanjeev/ef30769e-a58a-4475-af32-174db6d07951 branch from 317e58e to 68118d0 Compare June 24, 2024 09:31
@justsanjeev justsanjeev force-pushed the dlpx/pr/justsanjeev/ef30769e-a58a-4475-af32-174db6d07951 branch from 68118d0 to e56b7de Compare July 2, 2024 11:54
@justsanjeev justsanjeev force-pushed the dlpx/pr/justsanjeev/ef30769e-a58a-4475-af32-174db6d07951 branch 4 times, most recently from a4f876c to d356ef1 Compare July 11, 2024 10:29
@justsanjeev justsanjeev force-pushed the dlpx/pr/justsanjeev/ef30769e-a58a-4475-af32-174db6d07951 branch 5 times, most recently from 38fba97 to 28cab6b Compare July 16, 2024 07:08
@justsanjeev justsanjeev force-pushed the dlpx/pr/justsanjeev/ef30769e-a58a-4475-af32-174db6d07951 branch 2 times, most recently from b1d61e7 to 0c718f3 Compare September 25, 2024 17:25
@justsanjeev justsanjeev force-pushed the dlpx/pr/justsanjeev/ef30769e-a58a-4475-af32-174db6d07951 branch 2 times, most recently from b984a71 to f389cbe Compare October 7, 2024 10:17
@justsanjeev justsanjeev force-pushed the dlpx/pr/justsanjeev/ef30769e-a58a-4475-af32-174db6d07951 branch 2 times, most recently from 64091f7 to 5022542 Compare October 22, 2024 11:48
@justsanjeev justsanjeev force-pushed the dlpx/pr/justsanjeev/ef30769e-a58a-4475-af32-174db6d07951 branch from 5022542 to 744dc46 Compare November 4, 2024 07:54
@justsanjeev justsanjeev marked this pull request as ready for review November 5, 2024 10:42
@justsanjeev justsanjeev force-pushed the dlpx/pr/justsanjeev/ef30769e-a58a-4475-af32-174db6d07951 branch 3 times, most recently from d39c466 to 52eee14 Compare November 25, 2024 07:26
@justsanjeev justsanjeev force-pushed the dlpx/pr/justsanjeev/ef30769e-a58a-4475-af32-174db6d07951 branch 3 times, most recently from b5743b5 to 3a9629e Compare December 3, 2024 08:11
@justsanjeev justsanjeev force-pushed the dlpx/pr/justsanjeev/ef30769e-a58a-4475-af32-174db6d07951 branch 5 times, most recently from 4e5c764 to d0ba9f9 Compare December 3, 2024 11:33
@justsanjeev justsanjeev force-pushed the dlpx/pr/justsanjeev/ef30769e-a58a-4475-af32-174db6d07951 branch from d0ba9f9 to 43d194d Compare January 16, 2025 06:30
Comment on lines +33 to +38
if [[ -e $auto_master ]]; then
if grep -q "\/home\s+auto_home\s+-nobrowse" "$auto_master"; then
sed -i 's|/home auto_home -nobrowse|#/home auto_home -nobrowse|g' "$auto_master"
systemctl restart autofs
fi
fi
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is this here?

Comment on lines +20 to +24
# Checking the fstab file if the /export/home entry
# is present in the /etc/fstab, In case of container
# upgrade the file is already changed by the
# container-upgrade script and we dont need to do
# it again.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm confused with the wording in this comment. There is also no script called "container-upgrade". If this is referring to the code from the "upgrade-container" script, that script sets up the container used for upgrade verification. I don't think it's relevant here. I might change this to something like:

Home directories were previously mounted under /export/home, and this was changed to /home. This is the upgrade logic that updates the /etc/fstab file to reflect that change. Home directories will be mounted in both /export/home and /home until the system is rebooted to ensure that running processes referencing the old /export/home paths continue to function while also enabling new logins under /home to work.

Comment on lines +767 to +771
- name: Unmount the path if it is mounted
ansible.builtin.mount:
path: /export/home
state: unmounted
when: mount_status.rc == 0
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is going to fail if there are any running processes with references to any files under /export/home. This feels very fragile. What I would recommend doing instead is:

  1. Keep /export/home mounted. Since it's been changed in /etc/fstab, it simply won't get mounted at the next reboot.
  2. At boot, since /export/home won't be mounted at that point, create the symbolic link then. I think this could be as simple as creating the symbolic link (if it doesn't already exist) in the delphix-platform service's start method.

This would remove the need for all of this new ansible logic, and harden the system against random upgrade failures due to unexpected processes holding the mount hostage.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

3 participants