X-Git-Url: https://git.openstreetmap.org./chef.git/blobdiff_plain/5e3578ef0d86feac33ccf96a0afe267c8115bf72..1bc8da5f3a3bfd6c3f0ba374f12d489d13831460:/cookbooks/hardware/recipes/default.rb?ds=sidebyside diff --git a/cookbooks/hardware/recipes/default.rb b/cookbooks/hardware/recipes/default.rb index 3d1d8aa19..69afc73ff 100644 --- a/cookbooks/hardware/recipes/default.rb +++ b/cookbooks/hardware/recipes/default.rb @@ -17,8 +17,8 @@ # limitations under the License. # +include_recipe "apt" include_recipe "git" -include_recipe "munin" include_recipe "prometheus" include_recipe "sysfs" include_recipe "tools" @@ -27,11 +27,17 @@ ohai_plugin "hardware" do template "ohai.rb.erb" end -case node[:cpu][:"0"][:vendor_id] -when "GenuineIntel" - package "intel-microcode" -when "AuthenticAMD" - package "amd64-microcode" +if platform?("debian") + package "firmware-linux" +end + +if node[:cpu] && node[:cpu][:"0"] && node[:cpu][:"0"][:vendor_id] + case node[:cpu][:"0"][:vendor_id] + when "GenuineIntel" + package "intel-microcode" + when "AuthenticAMD" + package "amd64-microcode" + end end if node[:dmi] && node[:dmi][:system] @@ -77,13 +83,13 @@ when "HP", "HPE" package "hp-health" do action :install notifies :restart, "service[hp-health]" - only_if { node[:lsb][:release].to_f < 22.04 } + only_if { platform?("ubuntu") && node[:lsb][:release].to_f < 22.04 } end service "hp-health" do action [:enable, :start] supports :status => true, :restart => true - only_if { node[:lsb][:release].to_f < 22.04 } + only_if { platform?("ubuntu") && node[:lsb][:release].to_f < 22.04 } end if product.end_with?("Gen8", "Gen9") @@ -186,6 +192,8 @@ if File.exist?("/etc/default/grub") end end +package "initramfs-tools" + execute "update-initramfs" do action :nothing command "update-initramfs -u -k all" @@ -201,9 +209,24 @@ template "/etc/initramfs-tools/conf.d/mdadm" do notifies :run, "execute[update-initramfs]" end -package "haveged" -service "haveged" do - action [:enable, :start] +# haveged is only required on older kernels +# /dev/random is not blocking anymore in 5.15+ +if Chef::Util.compare_versions(node[:kernel][:release], [5, 15]).negative? + package "haveged" + service "haveged" do + action [:enable, :start] + end +else + service "haveged" do + action [:stop, :disable] + end + package "haveged" do + action :remove + end +end + +watchdog_module = %w[hpwdt sp5100_tco].find do |module_name| + node[:hardware][:pci]&.any? { |_, pci| pci[:modules]&.any?(module_name) } end if node[:kernel][:modules].include?("ipmi_si") @@ -226,6 +249,8 @@ if node[:kernel][:modules].include?("ipmi_si") options "--config.file=/etc/prometheus/ipmi_local.yml" subscribes :restart, "template[/etc/prometheus/ipmi_local.yml]" end + + watchdog_module ||= "ipmi_watchdog" end package "irqbalance" @@ -306,6 +331,8 @@ if node[:virtualization][:role] != "guest" || end end +include_recipe "apt::hwraid" unless status_packages.empty? + %w[ssacli lsiutil sas2ircu megactl megacli arcconf].each do |tools_package| if tools_packages.include?(tools_package) package tools_package @@ -334,65 +361,32 @@ else end end -include_recipe "apt::hwraid" unless status_packages.empty? - -if status_packages.include?("cciss-vol-status") - template "/usr/local/bin/cciss-vol-statusd" do - source "cciss-vol-statusd.erb" - owner "root" - group "root" - mode "755" - notifies :restart, "service[cciss-vol-statusd]" - end - - systemd_service "cciss-vol-statusd" do - description "Check cciss_vol_status values in the background" - exec_start "/usr/local/bin/cciss-vol-statusd" - nice 10 - private_tmp true - protect_system "full" - protect_home true - no_new_privileges true - notifies :restart, "service[cciss-vol-statusd]" - end -else - systemd_service "cciss-vol-statusd" do - action :delete - end - - template "/usr/local/bin/cciss-vol-statusd" do - action :delete - end -end - %w[cciss-vol-status mpt-status sas2ircu-status megaclisas-status aacraid-status].each do |status_package| if status_packages.include?(status_package) package status_package - template "/etc/default/#{status_package}d" do - source "raid.default.erb" - owner "root" - group "root" - mode "644" - variables :devices => status_packages[status_package] + service "#{status_package}d" do + action [:stop, :disable] end - service "#{status_package}d" do - action [:start, :enable] - supports :status => false, :restart => true, :reload => false - subscribes :restart, "template[/etc/default/#{status_package}d]" + file "/etc/default/#{status_package}d" do + action :delete end else package status_package do action :purge end - - file "/etc/default/#{status_package}d" do - action :delete - end end end +systemd_service "cciss-vol-statusd" do + action :delete +end + +template "/usr/local/bin/cciss-vol-statusd" do + action :delete +end + disks = if node[:hardware][:disk] node[:hardware][:disk][:disks] else @@ -416,15 +410,15 @@ intel_nvmes = nvmes.select { |pci| pci[:vendor_name] == "Intel Corporation" } if !intel_ssds.empty? || !intel_nvmes.empty? package "unzip" - sst_tool_version = "1.3" - sst_package_version = "#{sst_tool_version}.208-0" + sst_tool_version = "2-0" + sst_package_version = "2.0.300-0" - # remote_file "#{Chef::Config[:file_cache_path]}/SST_CLI_Linux_#{sst_tool_version}.zip" do - # source "https://downloadmirror.intel.com/743764/SST_CLI_Linux_#{sst_tool_version}.zip" - # end + remote_file "#{Chef::Config[:file_cache_path]}/sst-cli-linux-deb--#{sst_tool_version}.zip" do + source "https://sdmsdfwdriver.blob.core.windows.net/files/kba-gcc/drivers-downloads/ka-00085/sst--#{sst_tool_version}/sst-cli-linux-deb--#{sst_tool_version}.zip" + end - execute "#{Chef::Config[:file_cache_path]}/SST_CLI_Linux_#{sst_tool_version}.zip" do - command "unzip SST_CLI_Linux_#{sst_tool_version}.zip sst_#{sst_package_version}_amd64.deb" + execute "#{Chef::Config[:file_cache_path]}/sst-cli-linux-deb--#{sst_tool_version}.zip" do + command "unzip sst-cli-linux-deb--#{sst_tool_version}.zip sst_#{sst_package_version}_amd64.deb" cwd Chef::Config[:file_cache_path] user "root" group "root" @@ -450,38 +444,21 @@ disks = disks.map do |disk| if controller && controller[:device] device = controller[:device].sub("/dev/", "") smart = disk[:smart_device] - - if device.start_with?("cciss/") && smart =~ /^cciss,(\d+)$/ - array = node[:hardware][:disk][:arrays][disk[:arrays].first] - munin = "cciss-3#{array[:wwn]}-#{Regexp.last_match(1)}" - elsif smart =~ /^.*,(\d+)$/ - munin = "#{device}-#{Regexp.last_match(1)}" - elsif smart =~ %r{^.*,(\d+)/(\d+)$} - munin = "#{device}-#{Regexp.last_match(1)}:#{Regexp.last_match(2)}" - end elsif disk[:device] device = disk[:device].sub("/dev/", "") smart = disk[:smart_device] - - if smart =~ /^.*,(\d+),(\d+),(\d+)$/ - munin = "#{device}-#{Regexp.last_match(1)}:#{Regexp.last_match(2)}:#{Regexp.last_match(3)}" - end end elsif disk[:device] =~ %r{^/dev/(nvme\d+)n\d+$} device = Regexp.last_match(1) - munin = device elsif disk[:device] device = disk[:device].sub("/dev/", "") - munin = device end next if device.nil? Hash[ :device => device, - :smart => smart, - :munin => munin, - :hddtemp => munin.tr("-:", "_") + :smart => smart ] end @@ -536,53 +513,17 @@ if disks.count.positive? prometheus_collector "smart" do interval "15m" user "root" - capability_bounding_set %w[CAP_SYS_ADMIN CAP_SYS_RAWIO] + capability_bounding_set %w[CAP_DAC_OVERRIDE CAP_SYS_ADMIN CAP_SYS_RAWIO] private_devices false private_users false protect_clock false end - - # Don't try and do munin monitoring of disks behind - # an Areca controller as they only allow one thing to - # talk to the controller at a time and smartd will - # throw errors if it clashes with munin - disks = disks.reject { |disk| disk[:smart]&.start_with?("areca,") } - - disks.each do |disk| - munin_plugin "smart_#{disk[:munin]}" do - target "smart_" - conf "munin.smart.erb" - conf_variables :disk => disk - end - end else service "smartd" do action [:stop, :disable] end end -if disks.count.positive? - munin_plugin "hddtemp_smartctl" do - conf "munin.hddtemp.erb" - conf_variables :disks => disks - end -else - munin_plugin "hddtemp_smartctl" do - action :delete - conf "munin.hddtemp.erb" - end -end - -plugins = Dir.glob("/etc/munin/plugins/smart_*").map { |p| File.basename(p) } - - disks.map { |d| "smart_#{d[:munin]}" } - -plugins.each do |plugin| - munin_plugin plugin do - action :delete - conf "munin.smart.erb" - end -end - if File.exist?("/etc/mdadm/mdadm.conf") mdadm_conf = edit_file "/etc/mdadm/mdadm.conf" do |line| line.gsub!(/^MAILADDR .*$/, "MAILADDR admins@openstreetmap.org") @@ -620,19 +561,30 @@ node[:hardware][:blacklisted_modules].each do |module_name| end end -if node[:hardware][:watchdog] - package "watchdog" +if watchdog_module + kernel_module watchdog_module do + action :install + end + + execute "systemctl-reload" do + action :nothing + command "systemctl daemon-reload" + user "root" + group "root" + end - template "/etc/default/watchdog" do - source "watchdog.erb" + directory "/etc/systemd/system.conf.d" do owner "root" group "root" - mode "644" - variables :module => node[:hardware][:watchdog] + mode "755" end - service "watchdog" do - action [:enable, :start] + template "/etc/systemd/system.conf.d/watchdog.conf" do + source "watchdog.conf.erb" + owner "root" + group "root" + mode "644" + notifies :run, "execute[systemctl-reload]" end end @@ -700,7 +652,7 @@ prometheus_collector "ohai" do interval "15m" user "root" proc_subset "all" - capability_bounding_set "CAP_SYS_ADMIN" + capability_bounding_set %w[CAP_DAC_OVERRIDE CAP_SYS_ADMIN CAP_SYS_RAWIO] private_devices false private_users false protect_clock false