Containers in Infix are read-only, any persistent data is either stored
in volumes or content mounts. To prevent lingering containers, as have
been seen on some test systems, we move cleanup stage from confd to use
the Finit cleanup:script mechanism.
The resulting code is simpler, shorter, and easier to debug and use.
As an added benefit, confd no longer prunes "unused" volumes by itself
on (any!) reconfiguration event, which with the new container life cycle
in Infix was quite fragile. Instead the CLI command 'container prune'
is extended with 'podman volume prune', which coincidentally the help
text already alluded to.
This patch requires Finit v4.10-rc1, or later.
Fixes#902
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When updating a container configuration we need to rerun the setup stage
of the container. However, a run/task in Finit only runs once for each
runlevel, meaning changes at runtime of a container was broken.
This is a refactor of the container script to allow it to also run as a
pre:script in the Finit setup stage of a sysv/service. Also included is
a fix to the timeout/retry handling in case the container setup fails.
We must call `read -t 60` *before* calling `ip monitor`, otherwise it
will not be called until `ip monitor` returns.
This patch requires Finit v4.9, or later.
Fixes#930
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
By declaring the service as manually configured, we can control it
from dagger (confd) without the indirection via a condition.
This has the benefit of mstpd being in the "stopped", rather than the
somewhat confusing "waiting", state when not running.
Fixes#890
Since `conmon` only logs the output from the monitored container's
`stdout`/`stderr`, we might as well get rid of `k8s-logger`, and let
the output pass through to finit, which will then pipe the messages to
syslog.
Fix#836
This is a complete redesign of how the system creates/deletes containers
from the running-config. Containers are now removed synchronously from
confd before any interfaces they may be using are removed, and created
in parallel, using a Finit task, well after confd has finished setting
up interfaces.
The logic previously provided by execd to retry container create on any
route/address changes, or periodically every 60 seconds, is now handled
by a new 'setup' command in the container wrapper script.
Additionally, container create is now split in wget/curl/podman pull of
the image and 'podman create'. This to both consolidate image fetching
and improve user feedback since most of the retry logic (above) revolves
around the image download.
Fixes#835
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Before this change, we relied on `udevadm settle` to act as a barrier
which we could only cross after all devices had been probed. As it
turns out, when drivers defer probing due to missing dependencies,
`udevadm settle` may exit (as no events are generated for a period of
time) before all devices are set up. This was the root cause behind
issue #685, for which #752 was the initial attempt at a fix.
As we know that systems using mv88e6xxx will always have a device link
referencing the conduit interface, add a script to finit's system
runparts directory, which will block while any device link consumers
are still probing.
As a consequence of this, we can no longer rely on the sysklogd.conf
shipped with finit. Therefore, install an Infix specific one, which
will make sure that the aforementioned script has run before launching
the syslog daemon, which most other things depend on.
Fixes#685
While sysrepo's architecture places the responsibility of choosing a
timeout on each front-end, we want to control it centrally since the
majority of the time is spend actually applying the config to the
system - which is front-end agnostic.
Therefore, create a single definition of the timeout, which can be
included by all front-ends.
For consistency with the / + /usr merge, see 2194f7be, let's move the
last remnants in /: /libexec/infix to /usr/libexec/infix
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Ensure Finit installs its files to /usr/lib/finit when building with the
merged-usr config option. For consistency we adjust --exec-prefix, which
is the base for $libdir, meaning also /libexec is moved to /usr/libexec.
Finit tracks the paths internally, we only need to update runparts probe.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This makes it easier to add more scripts without having to update the
finit config file, and it clarifies which of the scripts in
/libexec/infix only execute at boot.
This enables access to /restconf on port 443 over HTTP/1.1 and HTTP/2
via rousette when enabled.
Also, slight refactor to allow including /restconf and /netbrowse as
optional locations in the main servier directive.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit adds an initial YANG model for Infix web services under the
infix-services.yang umbrella. For now the nginx server statements in
/etc/nginx/nginx.conf are always on, but the backend ttyd, and the
entire nginx server can be disabled.
The default in the YANG model for both is disabled, the factory-config
has been updated to enable these services by default.
The Web Console Interface mDNS service has been updated to advertise
on port 7681, which nginx is set to forward to ttyd.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Sending SIGTERM to conmon is not a safe shutdown of a podman container.
To handle gracefully handle shutdown, restarting and provide an orderly
start of dependencies, we use the Finit sysv trick via container script
wrapper to call 'podman stop foo'.
However, since podman does not support syslog as output for containers
we employ an old FIFO trick with another program, k8s-logger, to allow
logs to reach syslog. Please note that k8s-logger must have properly
started before we call `podman start` -- this makes us fully dependent
on the 'container' wrapper script. Hence the documentation update.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Currently does not need any conditions, but may later need to check for
loaded modules and other capabilities.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead, use the version from package/skeleton-init-finit, including the
ssh-hostkeys (previously ssh-genhostkeys) from the same package, because
it include extensive error handling and logging on failure.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- board/common: drop everything not needed by NETCONF mode
- board/classic: most board/common helpers relocated here
- Simplify Finit scripts for critical services
- Source variant from /etc/os-release to select ramdisk /etc
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the recent `if:<cond>` addition to Finit we can simplify a lot of
the logic for disabling and enabling features in Infix. Standardizing
on conditions that Finit provides.
We create boot/netconf, boot/etc, and boot/profinet conditions early,
after all filesystems have been mounted (and cleaned), so they are all
set before Finit loads its configuration files in runlevel S.
The default is still to boot into a managed NETCONF mode, since the end
goal remains to integrate PROFINET as yet another service. The other
mode, native /etc, should then be the only exception.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Joachim Wiberg