Skip to content

fix: (host-setup) properly set and pin the desired kernel #920

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
rackerchris wants to merge 4 commits into from
Closed

fix: (host-setup) properly set and pin the desired kernel #920

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
04cfeb5
fix: (kernel) properly set and pin the desired kernel
rackerchris Mar 24, 2025
f0f6fb2
fix: use ansible generic package module
rackerchris Mar 24, 2025
2f4f292
fix: remove hardcoded version, update docs
rackerchris Mar 24, 2025
f783ae5
fix: make distro agnostic
rackerchris Mar 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
47 changes: 31 additions & 16 deletions ansible/roles/host_setup/tasks/pin_kernel.yml
View file
Open in desktop

@cloudnull cloudnull Mar 25, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it would be good to create an opt-out interface for the task that calls this file; thinking of how we might need to run other kernel versions like linux-image-6.8.0-1006-intel for some of the accelerator work we're aiming to release in flex in the not so distant future.

Original file line number Diff line number Diff line change
Expand Up @@ -18,44 +18,59 @@
filter: "ansible_kernel"

- name: Check Kernel Version

@cloudnull cloudnull Mar 25, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the intent of this check was to ensure that the deployed kernel on a given host met our minimum requirements. If we go down the path of pinning to a specific kernel version, we can eliminate this task.

ansible.builtin.fail:
ansible.builtin.debug:
msg: >
Wrong kernel Version found
[ {{ ansible_facts['kernel'] }} < {{ host_required_kernel }} ]
[ {{ ansible_facts['kernel'] }} != {{ host_required_kernel }} ]
Resolve this issue before continuing.
when:
- ansible_facts['kernel'] is version(host_required_kernel, '<')
- ansible_facts['kernel'] is version(host_required_kernel, '!=')

- name: Pin kernel packages version
ansible.builtin.copy:
dest: "{{ apt_preferences }}/pin-kernel"
content: |
Package: linux-image-{{ ansible_facts['kernel'] }}
- name: "Install specific kernel image/modules/extra version {{ host_required_kernel }}"
ansible.builtin.apt:
Comment thread
rackerchris marked this conversation as resolved.
Outdated
name:
- "linux-image-{{ host_required_kernel }}"
Comment thread
rackerchris marked this conversation as resolved.
- "linux-modules-{{ host_required_kernel }}"
- "linux-modules-extra-{{ host_required_kernel }}"
state: present

- name: "Update grub to boot the desired kernel {{ host_required_kernel }}"
ansible.builtin.lineinfile:
path: /etc/default/grub
regexp: '^GRUB_DEFAULT='
line: 'GRUB_DEFAULT="Advanced options for Ubuntu>Ubuntu, with Linux 6.8.0-47-generic"'
Comment thread
rackerchris marked this conversation as resolved.
Outdated
notify: "Update Grub2 config file"

- name: Update Grub2 config file
ansible.builtin.command: update-grub
become: yes # Required for update-grub
tags: grub_update

- name: Create apt preference file for specific kernel
ansible.builtin.blockinfile:
path: "{{ apt_preferences }}/pin-kernel"
create: true
block: |
Package: linux-image-{{ host_required_kernel }}
Pin: release *
Pin-Priority: 1001

Package: linux-headers-{{ ansible_facts['kernel'] }}
Package: linux-modules-{{ host_required_kernel }}
Comment thread
rackerchris marked this conversation as resolved.
Pin: release *
Pin-Priority: 1001

Package: linux-modules-{{ ansible_facts['kernel'] }}
Package: linux-modules-extra-{{ host_required_kernel }}
Pin: release *
Pin-Priority: 1001

Package: linux-image-*
Pin: release *
Pin-Priority: -1

Package: linux-headers-*
Pin: release *
Pin-Priority: -1

Package: linux-modules-*
Pin: release *
Pin-Priority: -1
mode: '0644'
when:
- ansible_facts['kernel'] is version(host_required_kernel, '<')

- name: Disable unattended-upgrades
ansible.builtin.lineinfile:
Expand Down
2 changes: 1 addition & 1 deletion ansible/roles/host_setup/vars/ubuntu.yml
View file
Open in desktop

@cloudnull cloudnull Mar 25, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we'll need an equal configuration setup for debian defined here

Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---

## Defined required kernel
host_required_kernel: 6.8.0-0-generic
host_required_kernel: 6.8.0-47-generic

@cloudnull cloudnull Mar 25, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The latest kernel in this series is 6.8.0-56-generic if we're going down the path of doing specific kernel pinning, I don't think we should start out with an older version of the kernel that contains known CVEs.

host_sysstat_file: /etc/default/sysstat
host_sysstat_cron_file: /etc/cron.d/sysstat
host_cron_template: sysstat.cron.debian.j2
Expand Down