For the event generation i was thinking of enhancing anamon. The snippets for both %pre and %post (/etc/rc.d integration) are already available. Improvements I thought of are:
- let anamon monitor logfiles. If a certain pattern (e.g. partitioning/installing rpm/running pre/running post) is found then send an event to cobbler using wget
  

anamon already has it's own communication pipe that's fancier than the wget status pipe, so it could use that, actually... or another API that was also controlled by the anamon on/off flag... perhaps.
- Extend the cobbler shell profile.d snippet with COBBLER_DEPLOYID
- Install a anamon_event script (=wget wrapper) on the node that can be used for custom events
- let the post-reboot rc.d anamon sent an event to cobbler that the kickstart is ready.

The configuration of anamon can be extended with the following options:

Anamon_enabled			Enable anamon snippets
Anamon_send_logfiles		Upload of log files (this is the current anamon functionality)
Anamon_send_events		Generation of events through HTTP service with the wget command
  

I think if you enable anamon (which is inheritantly insecure -- and we know it -- and we're fine with that -- not a knock at it at all -- someone should just get the events behavior by default ... it doesn't seem to be hurting anything extra and I like to cut down on extra config options when the default behaviors are sane, it keeps branching down and makes testing easier.

The upload of events and logfiles with anamon can be made a little more secure by requiring also a deploy_id that must be already registered with the system. The URL then becomes: "cblr/svc/event/<systemname>/<deployid>" (e.g /cblr/svc/event/node1/3214343432 for the example above).
  

Not really secure, just obfuscated, since that ID is available in the kickstart file that is (by Anaconda requirement) readable.   I don't think we'd need to go that far.
We'd just admit when AnaMon was on that status information is not guaranteed to be secure/accurate.    This is the catch-22 with fully automated provisioning from metal, and I don't think it's really that much of a hole if off by default.

Another thought ... Do we want cobbler status to require usage of AnaMon?   If so that might help streamline output and web integration for that feature, and encourage more people to use it, which seems to be a very good idea.

Regards,
Peter


This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.


_______________________________________________
cobbler-devel mailing list
cobbler-devel@lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/cobbler-devel