Feature branch sync - pub/omnia_2.2.0.0_fix to staging - #4979
Merged
Conversation
Signed-off-by: Abhishek S A <abhishek.sa3@dell.com> Signed-off-by: Abhishek S A <abhishek.sa3@dell.com>
Signed-off-by: Abhishek S A <abhishek.sa3@dell.com> Signed-off-by: Abhishek S A <abhishek.sa3@dell.com>
Update gitlab_runner_helper_image_version: v18.8.0 -> v19.2.0 Confirmed fixes: CVE-2026-34986 (HIGH) in golang.org/x/net CVE-2026-33186 (CRITICAL) in google.golang.org/grpc Additional Go dependency CVEs expected to be resolved by the v19.2.0 base image and module updates. Signed-off-by: Rajeshkumar S <rajeshkumar.s2@dell.com>
Signed-off-by: pullan1 <sudha.pullalaravu@dell.com>
pulp upgraded from 3.113 to 3.114.2 version
* fix: replace ipcalc with ansible.utils.ipaddr filter * fix: make update-ca-trust and CA trust paths OS-aware for Wolfi compatibility * fix: ca directory issue * Configured pulp as fallback to download RHEL packages * Updated version * Reverted core tag change
* security vulnerability fix for activeMQ, mysql, victoria metrics Signed-off-by: Kratika_Patidar <Kratika.Patidar@dell.com> * catalog update with latest version of packages Signed-off-by: Kratika_Patidar <Kratika.Patidar@dell.com> --------- Signed-off-by: Kratika_Patidar <Kratika.Patidar@dell.com>
- Detect kube-vip version from static pod manifest on each control plane node using SSH delegation since CRI-O stores images by digest without tags - Extract kube_vip_target_version from service_k8s.json - Add kube_vip status tracking in upgrade status structure - Upgrade kube-vip per-node with VIP leader upgraded last for availability - Abort addon upgrades on kube-vip failure since VIP is critical for kubectl - Add kube-vip pod validation in addon validation step - Add msg_addon_kube_vip_failed error message for failure reporting Signed-off-by: Katakam-Rakesh <katakam.rakesh@dell.com>
- Changed Calico pod check from calico-system namespace to kube-system with label selector k8s-app=calico-node - Aligns with actual Calico deployment namespace in the cluster Signed-off-by: Katakam-Rakesh <katakam.rakesh@dell.com>
- Increase migration retries from 3 to 40 and delay from 10s to 15s to accommodate pg_upgrade (PG 13->16) and Django migrations which can take 5-10 minutes on first startup after upgrade - Remove failed_when: false so migration failures are properly caught - Update migration result message to show rc on failure - Add explanatory comment for startup timeout budget Signed-off-by: Katakam-Rakesh <katakam.rakesh@dell.com>
Signed-off-by: Katakam-Rakesh <katakam.rakesh@dell.com>
Add kube-vip upgrade support and harden Pulp migration
* bump calico,metallb,kube vip to latest versions Signed-off-by: Vrinda_Marwah <Vrinda.Marwah@dell.com> * Updating catalog for service_k8s image version changes Signed-off-by: Vrinda_Marwah <vrinda.marwah@dell.com> * Revert catalog_rhel_x86_64_with_slurm_only.json sinceit is not required for service_k8s catalog update Signed-off-by: Vrinda_Marwah <Vrinda.Marwah@dell.com> * Reading kube vip and helm image version dynamically Signed-off-by: Vrinda_Marwah <Vrinda.Marwah@dell.com> --------- Signed-off-by: Vrinda_Marwah <Vrinda.Marwah@dell.com> Signed-off-by: Vrinda_Marwah <vrinda.marwah@dell.com>
…4952) * repo priority fixes Signed-off-by: Abhishek S A <abhishek.sa3@dell.com> * Update fetch_pulp_repos.yml Signed-off-by: Abhishek S A <abhishek.sa3@dell.com> * update repo priority flow Signed-off-by: Abhishek S A <abhishek.sa3@dell.com> * Update main.yml Signed-off-by: Abhishek S A <abhishek.sa3@dell.com> --------- Signed-off-by: Abhishek S A <abhishek.sa3@dell.com>
* repo priority fixes Signed-off-by: Abhishek S A <abhishek.sa3@dell.com> * Update fetch_pulp_repos.yml Signed-off-by: Abhishek S A <abhishek.sa3@dell.com> * update repo priority flow Signed-off-by: Abhishek S A <abhishek.sa3@dell.com> * Update main.yml Signed-off-by: Abhishek S A <abhishek.sa3@dell.com> * minio and registry tag updates Signed-off-by: Abhishek S A <abhishek.sa3@dell.com> --------- Signed-off-by: Abhishek S A <abhishek.sa3@dell.com>
Signed-off-by: pullan1 <sudha.pullalaravu@dell.com>
…y on re-runs. (#4957) * fix(openchami): update image tags, RPM packaging, and coredhcp template - Update container image tags to latest versions: opaal v0.3.13, smd v2.20.5, bss v1.32.3, cloud-init v1.4.8, coresmd v0.6.3, postgres 17-alpine - Switch opaal, smd, bss, cloud-init images to Dell Docker Hub registry - Replace RPM download from GitHub with local tarball copy/extract using Git LFS for the tarball (openchami-0.1.7-1.noarch.tar.gz) - Fix coredhcp template to use key=value config format for coresmd v0.6.x+ regardless of additional_subnets presence - Add primary subnet_pool for bootloop plugin in v0.6.x format - Fix hostname rules to use type-specific patterns (nid/bmc) - Remove obsolete commented-out multi-subnet upgrade instructions - Add rescue block for ochami package install to fallback to Red Hat CDN AppStream repo if default (Pulp mirror) fails Signed-off-by: Sujit Jadhav <sujit.jadhav@dell.com> * fix(pulp): ensure certs directory exists and fix password reset retry - Add 'Ensure certs directory exists' task before SSL certificate generation in create_pulp_config_https.yml to prevent failures when the directory is missing on re-runs - Fix password reset retry logic in deploy_pulp_container_https.yml: add register/until clause (required for Ansible retry to work) and increase retries from 8 to 15 to allow sufficient time for Pulp services to initialize after container restart Signed-off-by: Sujit Jadhav <sujit.jadhav@dell.com> * fix(openchami): rebuild images with PR fixes and bump tags Rebuild container images incorporating fixes from upstream PRs: - opaal v0.3.14: SQLite driver fix (sqlite3 -> sqlite pure-Go driver) - cloud-init v1.4.9: replace deprecated middleware.RealIP with ClientIPFromRemoteAddr - bss v1.32.4: migrate chi v1 middleware import to chi/v5 - smd v2.20.6: security dependency updates (golang.org/x/crypto, golang.org/x/net) Update Ansible vars and RPM tarball to match. Signed-off-by: Sujit Jadhav <sujit.jadhav@dell.com> * fix(upgrade): align image tags, registries, and RPM with prepare_oim Update upgrade_openchami vars/tasks to match prepare_oim: - Bump image tags: opaal v0.3.14, smd v2.20.6, bss v1.32.4, cloud-init v1.4.9, coresmd v0.6.3 - Switch opaal/smd/bss/cloud-init from ghcr.io/openchami to docker.io/dellhpcomniaaisolution (Dell Docker Hub images) - Update postgres 11.5-alpine -> 17-alpine, minio to latest release - Replace curl-based RPM download with local tarball copy+extract matching prepare_oim pattern - Add files/ directory with openchami-0.1.7-1.noarch.tar.gz Signed-off-by: Sujit Jadhav <sujit.jadhav@dell.com> * fix: update minio_release_tag to RELEASE.2026-08-04T00-00-00Z Per reviewer feedback from abhishek-sa1. Signed-off-by: Sujit Jadhav <sujit.jadhav@dell.com> * fix: remove duplicate RPM tarball and variablize pulp retries - Remove duplicate openchami tarball from upgrade role files/ - Reference prepare_oim files path via prepare_oim_files_path variable - Replace hardcoded retries: 15 with password_reset_retries variable in deploy_pulp_container_https.yml Signed-off-by: Sujit Jadhav <sujit.jadhav@dell.com> --------- Signed-off-by: Sujit Jadhav <sujit.jadhav@dell.com> Signed-off-by: Abhishek S A <abhishek.sa3@dell.com> Co-authored-by: Abhishek S A <abhishek.sa3@dell.com>
Release quadlet files had stale image tags (bss v1.32.3, smd v2.20.5, opaal v0.3.13, cloud-init v1.4.8) while Ansible vars and Dell Docker Hub had the newer versions (v1.32.4, v2.20.6, v0.3.14, v1.4.9). This caused BSS 503 errors because the quadlet referenced images that don't exist on the registry. Rebuild RPM tarball with corrected quadlet image tags. Signed-off-by: Sujit Jadhav <sujit.jadhav@dell.com>
* Fix for OS Command Injection Vulnerability in local_repo Signed-off-by: pullan1 <sudha.pullalaravu@dell.com> * Added repo precedence order comments in local_repo_config Signed-off-by: pullan1 <sudha.pullalaravu@dell.com> --------- Signed-off-by: pullan1 <sudha.pullalaravu@dell.com>
…se) (#4964) The openchami-0.1.7 RPM was previously built from release/ which ships an incomplete/newer architecture (tokensmith-based) that conflicts with the container images actually deployed (opaal, bss, hydra, cloud-init). Rebuild from openchami/release/ which has: - Complete bootstrap_openchami.sh with all required podman secrets (bss_postgres_password, hydra_postgres_password, hydra_system_secret, hydra_dsn, and full postgres_multiple_databases) - Correct openchami.env with BSS, OPAAL, and cloud-init env vars - openchami-certificate-update with opaal.container FQDN update - openchami_profile.sh with hydra-based gen_access_token (not tokensmith) - Correct openchami.target without tokensmith/boot-service/metadata-service - Only the containers matching the deployed images (opaal, bss, hydra, etc.) - cloud-init container rebuilt with go-viper/mapstructure/v2 v2.5.0 (fixes CVE-2025-11065 sensitive info leak) Signed-off-by: Sujit Jadhav <sujit.jadhav@dell.com>
…p template (#4968) Since coresmd v0.6.3 is the only version shipped, the version check and the v0.4.x positional argument fallback in coredhcp.yaml.j2 are dead code. Remove them to simplify the template. Both single-subnet and multi-subnet deployments continue to work through the same key=value config format - the additional_subnets for-loops simply produce zero iterations for single-subnet setups. Signed-off-by: Sujit Jadhav <sujit.jadhav@dell.com>
* mysql upgrade and rollback fixes0 Signed-off-by: Kratika_Patidar <Kratika.Patidar@dell.com> * mysql upgrade and rollback changes for version update. Signed-off-by: Kratika_Patidar <Kratika.Patidar@dell.com> * Fix ansible-lint configuration Signed-off-by: Kratika_Patidar <Kratika.Patidar@dell.com> * lint fixes Signed-off-by: Kratika_Patidar <Kratika.Patidar@dell.com> * rollback backup handling fixes Signed-off-by: Kratika_Patidar <Kratika.Patidar@dell.com> * ansible-lint fixes Signed-off-by: Kratika_Patidar <Kratika.Patidar@dell.com> * Delete temp_upgrade_mysql Signed-off-by: Kratika Patidar <Kratika.Patidar@dell.com> * Update restore_mysql_data.yml Signed-off-by: Kratika Patidar <Kratika.Patidar@dell.com> --------- Signed-off-by: Kratika_Patidar <Kratika.Patidar@dell.com> Signed-off-by: Kratika Patidar <Kratika.Patidar@dell.com>
…m_config (#4977) The subnet membership check for aarch64_inventory_host_ip only validated against the primary admin subnet from network_spec.yml, ignoring additional_subnets. In multi-subnet environments, this incorrectly rejected valid IPs on additional subnets (e.g., 192.168.3.48 on 192.168.3.0/24 was rejected because it wasn't in the primary 192.168.0.0/24 subnet). Removed the subnet check entirely. IPv4 format validation and SSH reachability checks are retained, which provide sufficient validation. Signed-off-by: balajikumaran-c-s <balajikumaran.cs@dell.com>
Signed-off-by: Abhishek S A <abhishek.sa3@dell.com>
abhishek-sa1
changed the title
abhishek-sa1
marked this pull request as ready for review
August 12, 2026 11:03
sujit-jadhav
pushed a commit
that referenced
this pull request
Aug 20, 2026
Feature branch sync - pub/omnia_2.2.0.0_fix to staging
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
10 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Feature branch sync - pub/omnia_2.2.0.0_fix to staging