Skip to content

fix: (host-setup) properly set and pin the desired kernel #920

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 4 commits into
base: main
Choose a base branch
from
Draft

fix: (host-setup) properly set and pin the desired kernel #920

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
04cfeb5
fix: (kernel) properly set and pin the desired kernel
rackerchris Mar 24, 2025
f0f6fb2
fix: use ansible generic package module
rackerchris Mar 24, 2025
2f4f292
fix: remove hardcoded version, update docs
rackerchris Mar 24, 2025
f783ae5
fix: make distro agnostic
rackerchris Mar 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 32 additions & 17 deletions ansible/roles/host_setup/tasks/pin_kernel.yml
View file
Open in desktop
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it would be good to create an opt-out interface for the task that calls this file; thinking of how we might need to run other kernel versions like linux-image-6.8.0-1006-intel for some of the accelerator work we're aiming to release in flex in the not so distant future.

Original file line number Diff line number Diff line change
Expand Up @@ -18,44 +18,59 @@
filter: "ansible_kernel"

- name: Check Kernel Version
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the intent of this check was to ensure that the deployed kernel on a given host met our minimum requirements. If we go down the path of pinning to a specific kernel version, we can eliminate this task.

ansible.builtin.fail:
ansible.builtin.debug:
msg: >
Wrong kernel Version found
[ {{ ansible_facts['kernel'] }} < {{ host_required_kernel }} ]
[ {{ ansible_facts['kernel'] }} != {{ host_required_kernel }} ]
Resolve this issue before continuing.
when:
- ansible_facts['kernel'] is version(host_required_kernel, '<')
- ansible_facts['kernel'] is version(host_required_kernel, '!=')

- name: Pin kernel packages version
ansible.builtin.copy:
dest: "{{ apt_preferences }}/pin-kernel"
content: |
Package: linux-image-{{ ansible_facts['kernel'] }}
- name: "Install specific kernel image/modules/extra version {{ host_required_kernel }}"
ansible.builtin.package:
name:
- "linux-image-{{ host_required_kernel }}"
- "linux-modules-{{ host_required_kernel }}"
- "linux-modules-extra-{{ host_required_kernel }}"
state: present

- name: "Update grub to boot the desired kernel {{ host_required_kernel }}"
ansible.builtin.lineinfile:
path: /etc/default/grub
regexp: '^GRUB_DEFAULT='
line: 'GRUB_DEFAULT="Advanced options for Ubuntu>Ubuntu, with Linux {{ host_required_kernel }}"'
notify: "Update Grub"

- name: Update Grub
ansible.builtin.command: update-grub2
become: yes

Check warning on line 46 in ansible/roles/host_setup/tasks/pin_kernel.yml

View workflow job for this annotation

GitHub Actions / pre_commit (3.10) 

46:11 [truthy] truthy value should be one of [false, true]

- name: Create apt preference file for specific kernel
ansible.builtin.blockinfile:
path: "{{ apt_preferences }}/pin-kernel"
create: true
block: |
Package: linux-image-{{ host_required_kernel }}
Pin: release *
Pin-Priority: 1001

Package: linux-headers-{{ ansible_facts['kernel'] }}
Package: linux-modules-{{ host_required_kernel }}
Pin: release *
Pin-Priority: 1001

Package: linux-modules-{{ ansible_facts['kernel'] }}
Package: linux-modules-extra-{{ host_required_kernel }}
Pin: release *
Pin-Priority: 1001

Package: linux-image-*
Pin: release *
Pin-Priority: -1

Package: linux-headers-*
Pin: release *
Pin-Priority: -1

Package: linux-modules-*
Pin: release *
Pin-Priority: -1
mode: '0644'
when:
- ansible_facts['kernel'] is version(host_required_kernel, '<')
when: ansible_distribution == 'Ubuntu'

Check failure on line 73 in ansible/roles/host_setup/tasks/pin_kernel.yml

View workflow job for this annotation

GitHub Actions / pre_commit (3.10) 

73:41 [trailing-spaces] trailing spaces

- name: Disable unattended-upgrades
ansible.builtin.lineinfile:
Expand All @@ -75,6 +90,6 @@
value: "0"

- name: Ensure unattended-upgrades package is removed
ansible.builtin.apt:
ansible.builtin.package:
name: unattended-upgrades
state: absent
4 changes: 3 additions & 1 deletion ansible/roles/host_setup/vars/ubuntu.yml
View file
Open in desktop
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we'll need an equal configuration setup for debian defined here

Original file line number Diff line number Diff line change
@@ -1,7 +1,9 @@
---

## Defined required kernel
host_required_kernel: 6.8.0-0-generic
# This variable is used to set the default kernel in grub. Ensure you are

Check failure on line 4 in ansible/roles/host_setup/vars/ubuntu.yml

View workflow job for this annotation

GitHub Actions / pre_commit (3.10) 

4:75 [trailing-spaces] trailing spaces
# using the ENTIRE output from uname -r
host_required_kernel: 6.8.0-47-generic
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The latest kernel in this series is 6.8.0-56-generic if we're going down the path of doing specific kernel pinning, I don't think we should start out with an older version of the kernel that contains known CVEs.

host_sysstat_file: /etc/default/sysstat
host_sysstat_cron_file: /etc/cron.d/sysstat
host_cron_template: sysstat.cron.debian.j2
Expand Down
Loading