assistant: keep prepared iso bootable on uefi with flash drives
By mapping files into the ISO, the UUID for the partitions change as
they depend on the timestamp. The result is, that grub cannot find its
partition anymore and the user ends up on the grub shell.
This only happens when booting from a blockdev in UEFI mode. E.g. a USB
flash drive. Alternatively one can `dd` the ISO to a small (2GiB) VM
disk and mark it as the first boot device.
When booting in legacy mode or via CDROM (e.g. pass through via IPMI),
it worked.
Xorriso can report the commands needed to recreate the source ISO. The
'-volume_date uuid' is the one needed to override the same UUIDs. We
therefore read it first from the source iso and pass it as parameter
whenever we inject a file into the iso.
Thomas Lamprecht [Wed, 24 Apr 2024 08:23:43 +0000 (10:23 +0200)]
auto-installer: shorten partition label to fit in 11 characters for FAT
(v)FAT is still the most popular FS on removable medias like USB pen
drives, so we need to cope with its legacy..
So, rename the label that we look for again to PROXMOX-AIS, as that
still should allow admins to better recognize what this might be for
by having the "Proxmox" context and the rest is just hard to get
sensible meaning in, so do not bother to invent elaborate explanations
of why AIS is a good choice, it isn't but it's about the best thing
that one can do in these constraints.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Tue, 23 Apr 2024 22:11:28 +0000 (00:11 +0200)]
also skip proxmox-grub if not booted in EFI mode
This would effectively pull in grub-efi-amd64, which we skip a line
above this if not in EFI mode..
The builder now adds this always to the packages due to the
proxmox-secure-boot-support meta package being present there, at least
that's my current educated guess (confirmed in practice).
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Tue, 23 Apr 2024 19:02:47 +0000 (21:02 +0200)]
fetch answer: allow to override fetch-from mode through CLI arguments
Allow the user to pass a fetch-from mode also through CLI arguments.
This can be useful for debugging or if the GRUB boot entry from the
advanced menu is used with a ISO that did not (yet) got prepared for
automatic installation.
This is done in a quite crudely way, probably still beats most C
programs though. Only real bigger ugliness the user will notice is
that it exits with a failure code when the user asking for help
through passing `-h` or `--help`.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Tue, 23 Apr 2024 18:51:06 +0000 (20:51 +0200)]
fetch answer: split main for easier error handling
Making the top-level main a simple match around a result allows us to
use normal rust error handling inside the actual do_main code, making
it much more ergonomic.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Tue, 23 Apr 2024 16:53:05 +0000 (18:53 +0200)]
low level installer: drop printing about extracting deb packages to stderr
we already log that and printing that to stderr does not provides that
much extra value and is also not done for similar actions like the
configuration of packages.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
assistant: error out on set network config for dhcp
potentially will not happen too often in practice if the sample files
always contain the right source. Still having settings in an answer
file that get ignored does not seem right.
tested with `validate-answer` on a file without `source` in the
network section (which initially caused confusion for me)
Christoph Heiss [Tue, 23 Apr 2024 13:23:39 +0000 (15:23 +0200)]
tui: update screen during installation only when necessary
This can significantly reduces CPU load and even speed up the
installation a lot on single-core machines. While the latter may not be
a realistic target for obvious reasons, lowering overall CPU usage is
always a good thing.
Also helps with flickering during the installation process quite a bit
too.
E.g. a test installation on a single-core VM goes down from 47:35 min
w/o the patch to 2:26 min w/ the patch, a ~94%(!) decrease in time.
Signed-off-by: Christoph Heiss <c.heiss@proxmox.com>
Thomas Lamprecht [Tue, 23 Apr 2024 13:06:37 +0000 (15:06 +0200)]
assistant: default to output directory for tmp iso file on prepare
The directory where the input ISO is on might be read-only and so it
makes more sense to use the output directory to derive the default tmp
directory from.
Note that by default the output directory is the same as the one from
the input file, so this commit won't have a change for those that do
not override the output file explicitly.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Tue, 23 Apr 2024 13:03:10 +0000 (15:03 +0200)]
assistant: rework prepare-iso command line interface
Use input and output for the input and output files, drop various
short options, we can always re-add them later and forcing the use of
the more telling long options is a UX gift to sites with multiple
admins working on this stuff.
Further rename the "install-mode" to "fetch-from" as the option does
not changes the installation mode but rather the mode where the answer
file is fetched from.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Tue, 23 Apr 2024 12:43:52 +0000 (14:43 +0200)]
auto installer: drop fetch-from auto mode
It simpler to force the user to chose, as then they will always know
where an ISO pulls the answer file from without any complex automatic
fallback logic, which might be also undesired, especially in
environments where one has not full control (trust) over the network.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
looking through /usr/lib/udev/rules.d there are at least some which
also have digits (eg. `IEEE1394_...`), so let's just match [^=]+ for
the variable name.
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Thomas Lamprecht [Mon, 22 Apr 2024 14:48:39 +0000 (16:48 +0200)]
assistant: prepare iso: avoid an useless intermediate copy of the answer file
This fixes a bug for the case where the answer file was named
"answer.toml", as then the code tried to copy the file to itself,
which just caused the file being truncated.
This was quite confusing for the user, as the validation of the answer
file happened before the copy step, so one would see that it got
correctly validated only to then turn up empty inside the ISO..
While this was introduced through a14a934 ("assistant: perpare-iso
avoid separate directory and make less verbose"), copying the answer
file before injecting it into the ISO was never required, so just use
the source file directly.
Note that this is still a bit racy w.r.t. validation and inserting
into the ISO, to fix that we'd need to pass around empty files or
write the content directly, both not worth it for now.
Fixes: a14a934 Reported-by: Stefan Hanreich <s.hanreich@proxmox.com> Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Christoph Heiss [Mon, 22 Apr 2024 12:11:06 +0000 (14:11 +0200)]
auto-installer: add new `system.root_ssh_keys` answer option
.. for declaratively adding SSH keys to the installed system. This is a
list of SSH public keys added to `/root/.ssh/authorized_keys` after the
installation has finished.
Signed-off-by: Christoph Heiss <c.heiss@proxmox.com> Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Mon, 22 Apr 2024 06:12:07 +0000 (08:12 +0200)]
auto install: rename network config source
A use_dhcp boolean implies that the network config is set to always
use DHCP, not that the installer uses the info that it got from DHCP
to write out a static network config.
Use a source field that allows to cleanly separate the two possible
options.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Mon, 22 Apr 2024 06:00:58 +0000 (08:00 +0200)]
auto install: drop post/pre command execution for now
This can be quite a bit dangerous w.r.t. prepared ISOs as attack
vector or copy cats, we rather should implement the common use cases,
like adding a SSH auth key, as explicit, declarative defined config
option.
Such a overly general command execution might be something to add at a
later stage, but not for the initial MVP.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Fri, 19 Apr 2024 16:06:14 +0000 (18:06 +0200)]
print paths directly with debug, not display
A debug print is not only shorter code but also quotes the path
correctly, making it nicer for the user to copy (e.g., if the path is
at the end of a sentence the trailing dot could be misinterpreted as
being part of the path otherwise)
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Fri, 19 Apr 2024 13:14:27 +0000 (15:14 +0200)]
fetch answers: rename partition search label
The new one is far from perfect either, but labels can be at max 16
characters, so that's what we have to work with.
It now is slightly easier to read due to the hyphen separation and
contains the following relevant info:
- proxmox spelled out in full, so anybody seeing that label has a good
chance to narrow down what it could do already by a lot
- inst is a bit cryptic, but that Proxmox has a installer is a easy to
find out fact
- src should hopefully relay that this is the source of
(configuration) for something related to a installer by proxmox
But yeah, please don't limit IDs or names to less than 32, ideally
even 64, characters, that's the bare minimum to get some expressive
names that can have actual meaning..
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Fri, 19 Apr 2024 12:52:33 +0000 (14:52 +0200)]
fetch answers: avoid utils module
utils/helpers/tools are all modules with a way to generic name and
will be misused as dumping ground for basically everything.
Just move the helper to where they are used and drop some bogus
methods like get_answer_file, which neither searches nor gets an
answer file (type) but just is a plain and slightly over engineered
std::fs::read_to_string
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Fri, 19 Apr 2024 12:20:16 +0000 (14:20 +0200)]
auto installer: rework sys-info struct layout and add more details
move the decoded DMI info into a "dmi" object to avoid crowding the
outer layer, add more info from the ISO and Product currently booted
and use the complete mocked variants for the assistant environments so
that users evaluating this have a full picture of possible keys.
Also include the NIC link name with the mach address so that one can
also configure the management interface correctly from a MAC.
Do this all in a slightly more ergonomic rust way, using separate
structs and impls for getting the info.
There could be even more details added, but that's for a future patch,
this one mostly transforms and enhances existing keys.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Fri, 19 Apr 2024 12:17:52 +0000 (14:17 +0200)]
common: add mocked variants for setup and ISO related info structs
and add necessary derives for debug and serialize so that we can use
this for the auto-installer HTTP payload that gets send to the client
to be able to determine a dynamic answer file.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Fri, 19 Apr 2024 10:59:13 +0000 (12:59 +0200)]
auto installer: make fetch print answer to stdout and explicitly run installer
Instead of executing the actual installer from inside a tool named
`fetch-answer` make it print the answer file content it queried to
stdout and use the outer "unconfigured" init process to redirect this
to a file inside run, which is then piped to the actual installer in a
separate command.
This makes the execution flow a bit easier to grasp when reading
unconfigured and allows to inspect the answer file in a debug session.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
This new subcommand makes it possible to prepare an ISO to use it for an
automated installation.
It is possible to control the behavior of the resulting automated ISO
with optional parameters.
If no target file is specified, the new ISO will be named with suffixes
to indicate it as automated and additional information. This should help
to distinct between the different options that were chosen to create it.
The code for parsing an answer file is moved to its own function.
Signed-off-by: Aaron Lauterer <a.lauterer@proxmox.com> Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
This patch switches the behavior to use the settings that can be
specified in the ISO.
This means, that it is possible to control how the answer file should be
fetched:
* auto - as usually, go through the options until one works (partition,
http)
* included - the answer file is included in the ISO
* partition - only check for an answer file in a partition called
'proxmoxinst' in lower or uppercase
* http - only fetch the answer file via an HTTP POST request.
Additionally it is possible to specify the HTTP URL directly in the ISO.
Placing the SSL fingerprint on a partition is not possible anymore. If
one wants to provide it right away (besides DHCP or DNS), it must be
incluced in the ISO itself. This reduced the need for another USB flash
drive.
Signed-off-by: Aaron Lauterer <a.lauterer@proxmox.com> Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
it is meant as a helper utility to prepare an installation for chroot
and clean up afterwards
It tries to determine the used FS from the previous installation, will
do what is necessary to mount/import the root FS to /target. It then
will set up all bind mounts.
Tested-by: Christoph Heiss <c.heiss@proxmox.com> Reviewed-by: Christoph Heiss <c.heiss@proxmox.com> Signed-off-by: Aaron Lauterer <a.lauterer@proxmox.com> Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
common: skip target_hd when deserializing InstallConfig
as only the 'path' property is serialized -> deserialization is
problematic. The information would be present in the 'run-env-info-json',
but for now there is no need for it in any code that deserializes the
low-level config. Therefore we are currently skipping it on
deserialization
If we need it in the future, we need to think about how to handle the
deserialization.
Tested-by: Christoph Heiss <c.heiss@proxmox.com> Reviewed-by: Christoph Heiss <c.heiss@proxmox.com> Signed-off-by: Aaron Lauterer <a.lauterer@proxmox.com> Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Signed-off-by: Aaron Lauterer <a.lauterer@proxmox.com> Tested-by: Christoph Heiss <c.heiss@proxmox.com> Reviewed-by: Christoph Heiss <c.heiss@proxmox.com>
[ TL: fix dependencies feature/version and indentation ] Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
d/control: explicitly depend on rust crate features and minimum version
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
auto installer: factor out fetch-answer and autoinst-helper
Putting proxmox-fetch-answer into it's own crate, will keep the use of
OpenSSL localized to where we need it. Otherwise building other binaries
will always depend on OpenSSL as well, even without actually needing it.
Having a dedicated crate for the proxmox-autoinst-helper should make it
easier to build it independently to have it available outside of the
install environment.
The fetch plugins have been moved to the proxmox-fetch-answer crate,
except for the 'get_nic_list' function and 'sysinfo.rs'. Since both are
also needed by the proxmox-autoinst-helper, they are kept in the
proxmox-auto-installer crate.
Tested-by: Christoph Heiss <c.heiss@proxmox.com> Reviewed-by: Christoph Heiss <c.heiss@proxmox.com> Signed-off-by: Aaron Lauterer <a.lauterer@proxmox.com> Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
projects / pve-installer.git / log