Rename skip_upgrade to upgrade and add more use cases

Author: cmd-ntrf

aws/infrastructure.tf

@@ -31,7 +31,7 @@ module "configuration" {
   software_stack  = var.software_stack
   cloud_provider  = local.cloud_provider
   cloud_region    = local.cloud_region
-  skip_upgrade    = var.skip_upgrade
+  upgrade         = var.upgrade
   puppet_conf     = var.puppet_conf
 }
 

azure/infrastructure.tf

@@ -31,7 +31,7 @@ module "configuration" {
   software_stack  = var.software_stack
   cloud_provider  = local.cloud_provider
   cloud_region    = local.cloud_region
-  skip_upgrade    = var.skip_upgrade
+  upgrade         = var.upgrade
   puppet_conf     = var.puppet_conf
 }
 

common/configuration/main.tf

@@ -23,7 +23,7 @@ variable "guest_passwd" {}
 
 variable "public_keys" {}
 
-variable "skip_upgrade" {}
+variable "upgrade" {}
 variable "bastion_tags" {}
 
 resource "tls_private_key" "ssh" {
@@ -127,7 +127,7 @@ locals {
         ssh_authorized_keys   = local.public_keys
         tf_ssh_public_key     = chomp(tls_private_key.ssh.public_key_openssh)
         terraform_facts       = local.terraform_facts
-        skip_upgrade          = var.skip_upgrade
+        upgrade               = var.upgrade
         module_path           = path.module
         user_tf_required      = contains(values.tags, "puppet") || length(setintersection(values.tags, var.bastion_tags)) > 0
         hostkeys = {

common/configuration/puppet.yaml.tftpl

@@ -64,10 +64,13 @@ runcmd:
       # upload the terraform_data.yaml
       dnf -y install git pciutils unzip
       dnf -y remove cockpit\* firewalld --exclude=iptables
-%{ if ! skip_upgrade ~}
-      # Upgrade all packages except openvox if already installed
-      dnf -y upgrade -x openvox*
-%{ endif ~}
+    fi
+    # Upgrade all packages except openvox if already installed
+%{ if upgrade != "none" ~}
+  - %{ if startswith(upgrade, "vanilla") }test -f /etc/magic-castle-release || %{ endif }dnf -y upgrade -x openvox* %{ if strcontains(upgrade, "security") }--security%{ endif }
+%{ endif }
+  - |
+    if ! test -f /etc/magic-castle-release; then
       # Puppet agent configuration and install
       dnf -y install https://yum.voxpupuli.org/openvox8-release-el-$(grep -oP 'VERSION_ID="\K\d*' /etc/os-release).noarch.rpm
       dnf -y install openvox-agent-8.23.1
@@ -148,7 +151,7 @@ runcmd:
 %{ endif ~}
   # If the current image has already been configured with Magic Castle Puppet environment,
   # we can start puppet and skip reboot, reducing the delay for bringing the node up.
-  - test -f /etc/magic-castle-release && systemctl start puppet || true
+  - dnf needs-restarting -r && test -f /etc/magic-castle-release && systemctl start puppet || true
   - test -f /run/cloud-init-failed && echo 'WARNING - some steps cloud-init runcmd failed, listed in /run/cloud-init-failed. Manual fixing and rebooting required. ' | tee /etc/motd || true
 
 write_files:
@@ -241,7 +244,7 @@ output: { all: "| tee -a /var/log/cloud-init-output.log" }
 power_state:
   delay: now
   mode: reboot
-  condition: test ! -f /etc/magic-castle-release && test ! -f /run/cloud-init-failed
+  condition: "! dnf needs-restarting -r || (test ! -f /etc/magic-castle-release && test ! -f /run/cloud-init-failed)"
 
 # Configure owner of /var/log/cloud-init.log
 syslog_fix_perms: root:systemd-journal

common/variables.tf

@@ -150,10 +150,14 @@ variable "pool" {
   default = []
 }
 
-variable "skip_upgrade" {
-  type        = bool
-  default     = false
-  description = "If set to true, the packages already installed in the base image will not be upgraded on first boot."
+variable "upgrade" {
+  type        = string
+  default     = "vanilla-all"
+  description = "If set to all, all base packages are upgraded on first boot. When prefixed with `vanilla-`, upgrade only happen with vanilla based image."
+  validation {
+    condition     = contains(["all", "none", "security", "vanilla-all", "vanilla-security"], var.upgrade)
+    error_message = "Upgrade options are: all, none, security, vanilla-all, vanilla-security"
+  }
 }
 
 variable "puppetfile" {

docs/README.md

@@ -951,16 +951,21 @@ managed by the workload scheduler through Terraform API. For more information, r
 will be instantiated, others will stay uninstantiated or will be destroyed
 if previously instantiated.
 
-### 4.20 skip_upgrade (optional)
+### 4.20 upgrade (optional)
 
-**default_value** = `false`
+**default_value** = `"vanilla-all"`
 
-If true, the base image packages will not be upgraded during the first boot. By default,
-all packages are upgraded.
+Defines if base image packages are upgraded during the first boot. Possible values are:
+
+- `"all"`: upgrade all packages
+- `"none"`: do not upgrade packages
+- `"security"`: upgrade security packages only
+- `"vanilla-all"`: upgrade all packages only when booting from a vanilla base image
+- `"vanilla-security"`: upgrade security packages only when booting from a vanilla base image
 
 **Post build modification effect**: No effect on currently built instances. Ones created
 after the modification will take into consideration the new value of the parameter to determine
-whether they should upgrade the base image packages or not.
+how they should upgrade the base image packages.
 
 ### 4.21 puppetfile (optional)
 

gcp/infrastructure.tf

@@ -31,7 +31,7 @@ module "configuration" {
   software_stack  = var.software_stack
   cloud_provider  = local.cloud_provider
   cloud_region    = local.cloud_region
-  skip_upgrade    = var.skip_upgrade
+  upgrade         = var.upgrade
   puppet_conf     = var.puppet_conf
 }
 

incus/infrastructure.tf

@@ -27,7 +27,7 @@ module "configuration" {
   software_stack  = var.software_stack
   cloud_provider  = "incus"
   cloud_region    = "local"
-  skip_upgrade    = var.skip_upgrade
+  upgrade         = var.upgrade
   puppet_conf     = var.puppet_conf
 }
 

openstack/infrastructure.tf

@@ -26,7 +26,7 @@ module "configuration" {
   software_stack  = var.software_stack
   cloud_provider  = local.cloud_provider
   cloud_region    = local.cloud_region
-  skip_upgrade    = var.skip_upgrade
+  upgrade         = var.upgrade
   puppet_conf     = var.puppet_conf
 }