Support package upgrade scenarios

aws/infrastructure.tf

@@ -14,6 +14,7 @@ module "design" {
   volumes        = var.volumes
   firewall_rules = var.firewall_rules
   bastion_tags   = var.bastion_tags
+  upgrade        = var.upgrade
 }
 
 module "configuration" {
@@ -31,7 +32,6 @@ module "configuration" {
   software_stack  = var.software_stack
   cloud_provider  = local.cloud_provider
   cloud_region    = local.cloud_region
-  skip_upgrade    = var.skip_upgrade
   puppet_conf     = var.puppet_conf
 }
 

azure/infrastructure.tf

@@ -14,6 +14,7 @@ module "design" {
   volumes        = var.volumes
   firewall_rules = var.firewall_rules
   bastion_tags   = var.bastion_tags
+  upgrade        = var.upgrade
 }
 
 module "configuration" {
@@ -31,7 +32,6 @@ module "configuration" {
   software_stack  = var.software_stack
   cloud_provider  = local.cloud_provider
   cloud_region    = local.cloud_region
-  skip_upgrade    = var.skip_upgrade
   puppet_conf     = var.puppet_conf
 }
 

common/configuration/main.tf

@@ -23,7 +23,6 @@ variable "guest_passwd" {}
 
 variable "public_keys" {}
 
-variable "skip_upgrade" {}
 variable "bastion_tags" {}
 
 resource "tls_private_key" "ssh" {
@@ -127,7 +126,7 @@ locals {
         ssh_authorized_keys   = local.public_keys
         tf_ssh_public_key     = chomp(tls_private_key.ssh.public_key_openssh)
         terraform_facts       = local.terraform_facts
-        skip_upgrade          = var.skip_upgrade
+        upgrade               = values.upgrade
         module_path           = path.module
         user_tf_required      = contains(values.tags, "puppet") || length(setintersection(values.tags, var.bastion_tags)) > 0
         hostkeys = {

common/configuration/puppet.yaml.tftpl

@@ -64,20 +64,17 @@ runcmd:
       # upload the terraform_data.yaml
       dnf -y install git pciutils unzip
       dnf -y remove cockpit\* firewalld --exclude=iptables
-%{ if ! skip_upgrade ~}
-      # Upgrade all packages except openvox if already installed
-      dnf -y upgrade -x openvox*
-%{ endif ~}
+    fi
+    # Upgrade all packages except openvox if already installed
+%{ if upgrade != "none" ~}
+  - %{ if startswith(upgrade, "vanilla") }test -f /etc/magic-castle-release || %{ endif }dnf -y upgrade -x openvox* %{ if strcontains(upgrade, "security") }--security%{ endif }
+%{ endif }
+  - |
+    if ! test -f /etc/magic-castle-release; then
       # Puppet agent configuration and install
       dnf -y install https://yum.voxpupuli.org/openvox8-release-el-$(grep -oP 'VERSION_ID="\K\d*' /etc/os-release).noarch.rpm
       dnf -y install openvox-agent-8.23.1
       install -m 700 /dev/null /opt/puppetlabs/bin/postrun
-      # kernel configuration
-%{ if cloud_provider != "incus" ~}
-      systemctl disable kdump
-      grubby --update-kernel=ALL --args="rd.driver.blacklist=nouveau nouveau.modeset=0 crashkernel=0M initcall_blacklist=algif_aead_init"
-      grub2-mkconfig -o /boot/grub2/grub.cfg
-%{ endif ~}
 %{ if cloud_provider == "gcp" ~}
       # Google Cloud user-data fact generates a warning because its size is greater than what is allowed (<4096 bytes).
       # We have no use for it, so we remove startup-script, user-data and user-data-encoding when running in GCE.
@@ -86,6 +83,15 @@ runcmd:
       sed -i "/gce_data\['instance'\] = instance_data/i \ \ \ \ \ \ \ \ \ \ instance_data['attributes'].delete('user-data-encoding')" /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/facter/resolvers/gce.rb
 %{ endif ~}
     fi
+%{ if cloud_provider != "incus" ~}
+  # Kernel configuration
+  - |
+    if ! test -f /etc/magic-castle-release || ! dnf needs-restarting -r; then
+      systemctl disable kdump
+      grubby --update-kernel=ALL --args="rd.driver.blacklist=nouveau nouveau.modeset=0 crashkernel=0M initcall_blacklist=algif_aead_init"
+      grub2-mkconfig -o /boot/grub2/grub.cfg
+    fi
+%{ endif ~}
 %{ if contains(tags, "puppet") ~}
 # Install puppetserver
   - dnf -y install openvox-server-8.11.0
@@ -148,7 +154,7 @@ runcmd:
 %{ endif ~}
   # If the current image has already been configured with Magic Castle Puppet environment,
   # we can start puppet and skip reboot, reducing the delay for bringing the node up.
-  - test -f /etc/magic-castle-release && systemctl start puppet || true
+  - dnf needs-restarting -r && test -f /etc/magic-castle-release && systemctl start puppet || true
   - test -f /run/cloud-init-failed && echo 'WARNING - some steps cloud-init runcmd failed, listed in /run/cloud-init-failed. Manual fixing and rebooting required. ' | tee /etc/motd || true
 
 write_files:
@@ -241,7 +247,7 @@ output: { all: "| tee -a /var/log/cloud-init-output.log" }
 power_state:
   delay: now
   mode: reboot
-  condition: test ! -f /etc/magic-castle-release && test ! -f /run/cloud-init-failed
+  condition: "! dnf needs-restarting -r || (test ! -f /etc/magic-castle-release && test ! -f /run/cloud-init-failed)"
 
 # Configure owner of /var/log/cloud-init.log
 syslog_fix_perms: root:systemd-journal

common/design/main.tf

@@ -15,11 +15,12 @@ locals {
         for i in range(lookup(attrs, "count", 1)) : {
           (format("%s%d", prefix, i + 1)) = merge(
             { image = var.image },
+            { upgrade = var.upgrade },
             { disk_size = max(var.min_disk_size, [for tag in attrs.tags : lookup(local.min_disk_size_per_tags, tag, 0)]...) },
             { for attr, value in attrs : attr => value if !contains(["count"], attr) },
             {
               prefix = prefix,
-              specs  = { for attr, value in attrs : attr => value if !contains(["count", "tags", "image"], attr) }
+              specs  = { for attr, value in attrs : attr => value if !contains(["count", "tags", "image", "upgrade"], attr) }
             },
           )
         }

common/design/variables.tf

@@ -6,4 +6,5 @@ variable "pool" {}
 variable "firewall_rules" {}
 variable "min_disk_size" {}
 variable "image" {}
-variable "bastion_tags" {}
+variable "bastion_tags" {}
+variable "upgrade" {}

common/variables.tf

@@ -31,6 +31,10 @@ variable "instances" {
     condition     = length(var.instances) == 0 || sum([for key, values in var.instances : contains(values["tags"], "login") ? 1 : 0]) < 2
     error_message = "At most one type of instances in var.instances can have the _login_ tag"
   }
+  validation {
+    condition     = alltrue(flatten([for key, values in var.instances : contains(["all", "none", "security", "vanilla-all", "vanilla-security"], lookup(values, "upgrade", "vanilla-all"))]))
+    error_message = "At least one instance's `upgrade` is invalid. Valid values are: all, none, security, vanilla-all, vanilla-security."
+  }
 }
 
 variable "image" {
@@ -150,10 +154,14 @@ variable "pool" {
   default = []
 }
 
-variable "skip_upgrade" {
-  type        = bool
-  default     = false
-  description = "If set to true, the packages already installed in the base image will not be upgraded on first boot."
+variable "upgrade" {
+  type        = string
+  default     = "vanilla-all"
+  description = "If set to all, all base packages are upgraded on first boot. When prefixed with `vanilla-`, upgrade only happen with vanilla based image."
+  validation {
+    condition     = contains(["all", "none", "security", "vanilla-all", "vanilla-security"], var.upgrade)
+    error_message = "Upgrade options are: all, none, security, vanilla-all, vanilla-security"
+  }
 }
 
 variable "puppetfile" {

docs/README.md

@@ -572,13 +572,14 @@ recommended minimum size per tag as specified in the following table.
     ```
     features = ["skylake", "nvidia"]
     ```
+8. `upgrade`: specification of the package upgrade behavior to use for this instance type (default: global [`upgrade`](#420-upgrade-optional) value, whose default is `"vanilla-all"`).
 
 The instance specifications are retrieved from the cloud provider data source, but it is possible to explicitly specify them.
 
-7. `cpus`: number of logical processors on the node - [`CPUs` in slurm.conf](https://slurm.schedmd.com/slurm.conf.html#OPT_CPUs)
-8. `ram`: size of real memory on the node in megabyte - [`RealMemory` in slurm.conf](https://slurm.schedmd.com/slurm.conf.html#OPT_RealMemory)
-9. `gpus`: number of graphics processors on the node - [`Gres=gpu:<gpus>` in slurm.conf](https://slurm.schedmd.com/slurm.conf.html#OPT_Gres_1)
-10. `gpu_type`: type of graphics processor on the node - [`Gres=gpu:<gpu_type>:<gpus>` in slurm.conf](https://slurm.schedmd.com/slurm.conf.html#OPT_Gres_1)
+9. `cpus`: number of logical processors on the node - [`CPUs` in slurm.conf](https://slurm.schedmd.com/slurm.conf.html#OPT_CPUs)
+10. `ram`: size of real memory on the node in megabyte - [`RealMemory` in slurm.conf](https://slurm.schedmd.com/slurm.conf.html#OPT_RealMemory)
+11. `gpus`: number of graphics processors on the node - [`Gres=gpu:<gpus>` in slurm.conf](https://slurm.schedmd.com/slurm.conf.html#OPT_Gres_1)
+12. `gpu_type`: type of graphics processor on the node - [`Gres=gpu:<gpu_type>:<gpus>` in slurm.conf](https://slurm.schedmd.com/slurm.conf.html#OPT_Gres_1)
 
 For some cloud providers, it is possible to define additional attributes.
 The following sections present the available attributes per provider.
@@ -951,16 +952,21 @@ managed by the workload scheduler through Terraform API. For more information, r
 will be instantiated, others will stay uninstantiated or will be destroyed
 if previously instantiated.
 
-### 4.20 skip_upgrade (optional)
+### 4.20 upgrade (optional)
 
-**default_value** = `false`
+**default_value** = `"vanilla-all"`
 
-If true, the base image packages will not be upgraded during the first boot. By default,
-all packages are upgraded.
+Defines if base image packages are upgraded during the first boot. Possible values are:
+
+- `"all"`: upgrade all packages
+- `"none"`: do not upgrade packages
+- `"security"`: upgrade security packages only
+- `"vanilla-all"`: upgrade all packages only when booting from a vanilla base image
+- `"vanilla-security"`: upgrade security packages only when booting from a vanilla base image
 
 **Post build modification effect**: No effect on currently built instances. Ones created
 after the modification will take into consideration the new value of the parameter to determine
-whether they should upgrade the base image packages or not.
+how they should upgrade the base image packages.
 
 ### 4.21 puppetfile (optional)
 

gcp/infrastructure.tf

@@ -14,6 +14,7 @@ module "design" {
   volumes        = var.volumes
   firewall_rules = var.firewall_rules
   bastion_tags   = var.bastion_tags
+  upgrade        = var.upgrade
 }
 
 module "configuration" {
@@ -31,7 +32,6 @@ module "configuration" {
   software_stack  = var.software_stack
   cloud_provider  = local.cloud_provider
   cloud_region    = local.cloud_region
-  skip_upgrade    = var.skip_upgrade
   puppet_conf     = var.puppet_conf
 }
 

incus/infrastructure.tf

@@ -9,6 +9,7 @@ module "design" {
   volumes        = var.volumes
   firewall_rules = var.firewall_rules
   bastion_tags   = var.bastion_tags
+  upgrade        = var.upgrade
 }
 
 module "configuration" {
@@ -27,7 +28,6 @@ module "configuration" {
   software_stack  = var.software_stack
   cloud_provider  = "incus"
   cloud_region    = "local"
-  skip_upgrade    = var.skip_upgrade
   puppet_conf     = var.puppet_conf
 }
 

openstack/infrastructure.tf

@@ -9,6 +9,7 @@ module "design" {
   volumes        = var.volumes
   firewall_rules = var.firewall_rules
   bastion_tags   = var.bastion_tags
+  upgrade        = var.upgrade
 }
 
 module "configuration" {
@@ -26,7 +27,6 @@ module "configuration" {
   software_stack  = var.software_stack
   cloud_provider  = local.cloud_provider
   cloud_region    = local.cloud_region
-  skip_upgrade    = var.skip_upgrade
   puppet_conf     = var.puppet_conf
 }