On 08/13/2009 07:13 AM, Vreman, Peter wrote:
> For the event generation i was thinking of enhancing anamon. The
> snippets for both %pre and %post (/etc/rc.d integration) are already
> available. Improvements I thought of are:
> - let anamon monitor logfiles. If a certain pattern (e.g.
> partitioning/installing rpm/running pre/running post) is found then
> send an event to cobbler using wget
>
> anamon already has it's own communication pipe that's fancier than the
> wget status pipe, so it could use that, actually... or another API that
> was also controlled by the anamon on/off flag... perhaps.
>
> - Extend the cobbler shell profile.d snippet with COBBLER_DEPLOYID
> - Install a anamon_event script (=wget wrapper) on the node that can be
> used for custom events
> - let the post-reboot rc.d anamon sent an event to cobbler that the
> kickstart is ready.
>
> The configuration of anamon can be extended with the following options:
>
> Anamon_enabled Enable anamon snippets
> Anamon_send_logfiles Upload of log files (this is the current
> anamon functionality)
> Anamon_send_events Generation of events through HTTP service
> with the wget command
>
>
> I think if you enable anamon (which is inheritantly insecure -- and we
> know it -- and we're fine with that -- not a knock at it at all --
> someone should just get the events behavior by default ... it doesn't
> seem to be hurting anything extra and I like to cut down on extra
> config options when the default behaviors are sane, it keeps branching
> down and makes testing easier.
>
> The upload of events and logfiles with anamon can be made a little more
> secure by requiring also a deploy_id that must be already registered
> with the system. The URL then becomes:
> "cblr/svc/event/<systemname>/<deployid>" (e.g
> /cblr/svc/event/node1/3214343432 for the example above).
>
> Not really secure, just obfuscated, since that ID is available in the
> kickstart file that is (by Anaconda requirement) readable. I don't
> think we'd need to go that far.
> We'd just admit when AnaMon was on that status information is not
> guaranteed to be secure/accurate. This is the catch-22 with fully
> automated provisioning from metal, and I don't think it's really that
> much of a hole if off by default.
>
> Another thought ... Do we want cobbler status to require usage of
> AnaMon? If so that might help streamline output and web integration
> for that feature, and encourage more people to use it, which seems to
> be a very good idea.
>
Requiring anamon for status updates on the kickstart is a good idea. It makes things
easier and consistent. The additional service for the wget would then not be required.
Good, let's make is so.
I don't know if debian-installer can also make use of anamon. The
anamon script only watches for log files for that part it is distro independent.
Indeed, though the backend APIs are not so much. We can leave that for
someone to implement later, I think, in a similar fashion, and just make
a note of it.
Right now, we don't have koan on Debian yet, or package inclusion, so
I'm not inclined to worry about the remaining 5% polish until that gets
offered up. Let's concentrate on what we're good at for now, and
perhaps the absense of such a shiny feature on Debian would intice
someone to implement something similar... if that even makes sense.
Peter
This e-mail and any attachment is for authorised use by the intended recipient(s) only.
It may contain proprietary material, confidential information and/or be subject to legal
privilege. It should not be copied, disclosed to, retained or used by, any other party. If
you are not an intended recipient then please promptly delete this e-mail and any
attachment and all copies and inform the sender. Thank you.
_______________________________________________
cobbler-devel mailing list
cobbler-devel(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/cobbler-devel