Re: [xcat-user] management node replacement

[Mark Gurevich]

You can try to follow some recommendations here
https://xcat-docs.readthedocs.io/en/stable/advanced/hamn/index.html and
treat it as a manual failover.

Make sure to backup the xCAT DB described here
https://xcat-docs.readthedocs.io/en/stable/guides/install-guides/maintenance/backup_restore_xcat.html


Mark Gurevich
Poughkeepsie Development Lab
HPC Software Development - xCAT

"If we knew what it was we were doing, it would not be called research,
would it?"
--Albert Einstein





From:   "Huette, Antoine" 
To: xCAT Users Mailing list 
Date:   09/26/2019 11:53 AM
Subject:[EXTERNAL] [xcat-user] management node replacement



Hello

On an already configured and running xCAT cluster, what should be the
procedure to replace the management node ?
The new head node will be a different hardware model, meaning we may have
different interface names.
We will move the current disks into the new management node. Could that
work ?

Thanks 


Regards,

Antoine Huette
HPC Engineer
antoine.hue...@bechtle.com | 03.67.07.97.37/07.72.31.82.12 |  bechtle.fr |
BechtleRésultat de recherche d'images pour "instagram logo"
 ___
xCAT-user mailing list
xCAT-user@lists.sourceforge.net
https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.sourceforge.net_lists_listinfo_xcat-2Duser=DwICAg=jf_iaSHvJObTbx-siA1ZOg=cGs4a-jfx6Emudek2Wdi4FLq2XKm1pvrlbCQ-h7Qq7A=OcodStBBbLwloETFpFj9JLoArxFwfum9jeuoejsIYMc=lDeCvym1T2EBmPCIaQ4wtzaIpA3q-rSYZ9ipQjqU7YE=



___
xCAT-user mailing list
xCAT-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/xcat-user

Re: [xcat-user] [External] xCAT forcibly disabling SELinux and firewalld

[Vinícius Ferrão via xCAT-user]

Hello Kevin, I’ve answered at the same time.

Take a look at the answer, there’s a command that does everything. It really 
nails down to avoid running the command. In the xCAT package only runs on the 
first time:

. /etc/profile.d/xcat.sh
if [ "$1" = "1" ]; then #Only if installing for the first time..
$RPM_INSTALL_PREFIX0/sbin/xcatconfig -i
else
if [ -r "/tmp/xcat/installservice.pid" ]; then
  mv /tmp/xcat/installservice.pid /var/run/xcat/installservice.pid
fi
if [ -r "/tmp/xcat/udpservice.pid" ]; then
  mv /tmp/xcat/udpservice.pid /var/run/xcat/udpservice.pid
fi
if [ -r "/tmp/xcat/mainservice.pid" ]; then
  mv /tmp/xcat/mainservice.pid /var/run/xcat/mainservice.pid
fi



On 26 Sep 2019, at 13:38, Kevin Keane 
mailto:kke...@sandiego.edu>> wrote:

Just a thought - you could get the best of both worlds by removing this 
behavior from the RPMs, and creating a separate "setup" RPM that does all these 
things.

This behavior should really be removed from the main RPMs because otherwise, 
these actions are repeated on updates.

___
Kevin Keane | Systems Architect | University of San Diego ITS | 
kke...@sandiego.edu
Maher Hall, 192 |5998 Alcalá Park | San Diego, CA 92110-2492 | 619.260.6859 | 
Text: 760-721-8339

REMEMBER! No one from IT at USD will ever ask to confirm or supply your 
password.
These messages are an attempt to steal your username and password. Please do 
not reply to, click the links within, or open the attachments of these 
messages. Delete them!



On Wed, Sep 25, 2019 at 11:54 PM Jarrod Johnson 
mailto:jjohns...@lenovo.com>> wrote:
I've been considering removing all of that from executing on rpm install (also 
enabling services to start on boot just by installing rpm)

It was added for convenience of not asking to run a setup after install but it 
is inconsistent with general rpm behavior and limits ability to use flags to 
customize behavior.

On the flip side, this would be a change that people would have to learn and 
would surprise new installs.

I might make variant of the xCAT meta package with no auto setup so that people 
won't be surprised unless they opt into the other package.

Looking for thoughts.

For wider information, it doesn't yet have os deployment, but confluent has 
been developing and designing specifically with firewall and selinux in mind, 
as well as trying to mitigate the initial setup complexity that drove us to 
create xcatconfig in the first place.  For example no more tls certs required 
for local access and os import will no longer loop mount isos (one of the 
biggest selinux problems) and avoid rewriting other service etc files in daemon 
context.  More straightforward network usage and a documented set of firewalld 
commands.

From: Vinícius Ferrão via xCAT-user 
mailto:xcat-user@lists.sourceforge.net>>
Sent: Thursday, September 26, 2019 2:27:10 AM
To: xCAT Users Mailing list
Cc: Vinícius Ferrão
Subject: [External] [xcat-user] xCAT forcibly disabling SELinux and firewalld

Hello,

When installing xCAT in EL7 with yum install xCAT it’s just put SELinux in 
permissive mode and disables firewalld.

It does not even ask about it. It just does.

[root@headnode ~]# getenforce
Permissive
[root@headnode ~]# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor 
preset: enabled)
   Active: inactive (dead)
 Docs: man:firewalld(1)

Sep 26 02:55:55 
headnode.cluster.iq.ufrj.br systemd[1]: 
Starting firewalld - dynamic firewall daemon...
Sep 26 02:55:56 
headnode.cluster.iq.ufrj.br systemd[1]: 
Started firewalld - dynamic firewall daemon.
Sep 26 03:09:18 
headnode.cluster.iq.ufrj.br systemd[1]: 
Stopping firewalld - dynamic firewall daemon...
Sep 26 03:09:21 
headnode.cluster.iq.ufrj.br systemd[1]: 
Stopped firewalld - dynamic firewall daemon.

There’s a way to avoid this behaviour?

Thanks,

PS: I’m aware of the consequences of firewalld and SELinux in xCAT environments.
___
xCAT-user mailing list
xCAT-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/xcat-user
___
xCAT-user mailing list
xCAT-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/xcat-user
___
xCAT-user mailing list
xCAT-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/xcat-user

___
xCAT-user mailing list
xCAT-user@lists.sourceforge.net

Re: [xcat-user] [External] xCAT forcibly disabling SELinux and firewalld

[Vinícius Ferrão via xCAT-user]

Answering myself:

"rpm -q --scripts xCAT" done the trick.

Looking through the output, there’s a call to xcatconfig -i.

This guy is the responsible for everything. So it nails down to disable this 
xcatconfig command after installation and doing almost everything manually.

With this information I think I can undo what xcatconfig does automatically, 
just after the installation. It’s a stop-gap solution that I can use.

If you guys are willing to change this behaviour it will be welcoming, at least 
for me.


Thanks,
Vinicius.


PS: I rerun the xcatconfig command on my test machine with -V so here’s the 
output:


[root@headnode ~]# xcatconfig -i -V
Running /opt/xcat/sbin/xcatconfig -i -V
Running command on 
headnode.cluster.iq.ufrj.br: /bin/rm 
/etc/xcat/hostkeys/ssh_host* 2>&1

Generating new node hostkeys...
Generating SSH2 RSA Key...
Running command on 
headnode.cluster.iq.ufrj.br: 
/usr/bin/ssh-keygen -t rsa -f /etc/xcat/hostkeys/ssh_host_rsa_key -C '' -N '' 
2>&1

Generating SSH2 DSA Key...
Running command on 
headnode.cluster.iq.ufrj.br: 
/usr/bin/ssh-keygen -t dsa -f /etc/xcat/hostkeys/ssh_host_dsa_key -C '' -N '' 
2>&1

Running command on 
headnode.cluster.iq.ufrj.br: rm -rf 
/tmp/ecdsa_key >/dev/null 2>&1 ; /usr/bin/ssh-keygen -t ecdsa -f /tmp/ecdsa_key 
 -P "" &>/dev/null 2>&1

Generating SSH2 ECDSA Key...
Running command on 
headnode.cluster.iq.ufrj.br: 
/usr/bin/ssh-keygen -t ecdsa -f /etc/xcat/hostkeys/ssh_host_ecdsa_key -C '' -N 
'' 2>&1

Running command on 
headnode.cluster.iq.ufrj.br: /bin/cp 
/etc/xcat/hostkeys/*.pub /install/postscripts/hostkeys/. 2>&1

/bin/cp /etc/xcat/hostkeys/*.pub /install/postscripts/hostkeys/. is successful
Running command on 
headnode.cluster.iq.ufrj.br: /bin/echo 
'1024' >/proc/sys/net/ipv4/neigh/default/gc_thresh1 2>&1

Running command on 
headnode.cluster.iq.ufrj.br: /bin/echo 
'4096' >/proc/sys/net/ipv4/neigh/default/gc_thresh2 2>&1

Running command on 
headnode.cluster.iq.ufrj.br: /bin/echo 
'8192' >/proc/sys/net/ipv4/neigh/default/gc_thresh3 2>&1

Running command on 
headnode.cluster.iq.ufrj.br: /bin/cat 
/root/.ssh/config | grep 'StrictHostKeyChecking no' 2>&1

Running command on 
headnode.cluster.iq.ufrj.br: /bin/cp -p 
/root/.ssh/id_rsa.pub /install/postscripts/_ssh/authorized_keys  2>&1

Copied /root/.ssh/id_rsa.pub to /install/postscripts/_ssh/authorized_keys.
Running command on 
headnode.cluster.iq.ufrj.br: /bin/cat 
/etc/exports | grep '/tftpboot' 2>&1

Running command on 
headnode.cluster.iq.ufrj.br: /bin/cat 
/etc/exports | grep '/install' 2>&1

Running command on 
headnode.cluster.iq.ufrj.br: /bin/rm -rf 
/install/postscripts/ca >/dev/null 2>&1

Running command on 
headnode.cluster.iq.ufrj.br: /bin/mkdir -m 
755 -p /install/postscripts/ca 2>&1

Running command on 
headnode.cluster.iq.ufrj.br: /bin/cp -p 
/etc/xcat/ca/ca-cert.pem /install/postscripts/ca/ca-cert.pem 2>&1

/bin/cp -p /etc/xcat/ca/ca-cert.pem /install/postscripts/ca/ca-cert.pem 
succeeded.
Running command on 
headnode.cluster.iq.ufrj.br: /bin/rm -rf 
/install/postscripts/cert >/dev/null 2>&1

Running command on 
headnode.cluster.iq.ufrj.br: /bin/rm -rf 
/install/postscripts/_xcat >/dev/null 2>&1

Running command on 
headnode.cluster.iq.ufrj.br: /bin/mkdir -m 
755 -p /install/postscripts/_xcat 2>&1

Created /install/postscripts/_xcat directory.
Running command on 
headnode.cluster.iq.ufrj.br: /bin/cp -p 
/root/.xcat/ca.pem /install/postscripts/_xcat/ca.pem 2>&1

Copied /root/.xcat/ca.pem to /install/postscripts/_xcat directory.
Running command on 
headnode.cluster.iq.ufrj.br: ip -4 
--oneline addr show |awk -F ' ' '{print $4}'|awk -F '/' '{print $1}' 2>&1

Running command on 
headnode.cluster.iq.ufrj.br: /bin/grep 
^[^#]*nameserver /etc/resolv.conf | awk '{print $2}' 2>&1

Running command on 
headnode.cluster.iq.ufrj.br: grep Subject 
/etc/xcat/cert/server-cert.pem 2>&1

Running command on 
headnode.cluster.iq.ufrj.br: find 
/usr/share/zoneinfo -xtype f -exec cmp -s /etc/localtime {} \; -print | grep -v 
posix | grep -v SystemV | grep -v right | grep -v localtime  2>&1

Running command on 

Re: [xcat-user] [External] xCAT forcibly disabling SELinux and firewalld

[Kevin Keane]

Just a thought - you could get the best of both worlds by removing this
behavior from the RPMs, and creating a separate "setup" RPM that does all
these things.

This behavior should really be removed from the main RPMs because
otherwise, these actions are repeated on updates.

___
Kevin Keane | Systems Architect | University of San Diego ITS |
kke...@sandiego.edu
Maher Hall, 192 |5998 Alcalá Park | San Diego, CA 92110-2492 | 619.260.6859
| Text: 760-721-8339

*REMEMBER! **No one from IT at USD will ever ask to confirm or supply your
password*.
These messages are an attempt to steal your username and password. Please
do not reply to, click the links within, or open the attachments of these
messages. Delete them!




On Wed, Sep 25, 2019 at 11:54 PM Jarrod Johnson 
wrote:

> I've been considering removing all of that from executing on rpm install
> (also enabling services to start on boot just by installing rpm)
>
> It was added for convenience of not asking to run a setup after install
> but it is inconsistent with general rpm behavior and limits ability to use
> flags to customize behavior.
>
> On the flip side, this would be a change that people would have to learn
> and would surprise new installs.
>
> I might make variant of the xCAT meta package with no auto setup so that
> people won't be surprised unless they opt into the other package.
>
> Looking for thoughts.
>
> For wider information, it doesn't yet have os deployment, but confluent
> has been developing and designing specifically with firewall and selinux in
> mind, as well as trying to mitigate the initial setup complexity that drove
> us to create xcatconfig in the first place.  For example no more tls certs
> required for local access and os import will no longer loop mount isos (one
> of the biggest selinux problems) and avoid rewriting other service etc
> files in daemon context.  More straightforward network usage and a
> documented set of firewalld commands.
> --
> *From:* Vinícius Ferrão via xCAT-user 
> *Sent:* Thursday, September 26, 2019 2:27:10 AM
> *To:* xCAT Users Mailing list
> *Cc:* Vinícius Ferrão
> *Subject:* [External] [xcat-user] xCAT forcibly disabling SELinux and
> firewalld
>
> Hello,
>
> When installing xCAT in EL7 with yum install xCAT it’s just put SELinux in
> permissive mode and disables firewalld.
>
> It does not even ask about it. It just does.
>
> [root@headnode ~]# getenforce
> Permissive
> [root@headnode ~]# systemctl status firewalld
> ● firewalld.service - firewalld - dynamic firewall daemon
>Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled;
> vendor preset: enabled)
>Active: inactive (dead)
>  Docs: man:firewalld(1)
>
> Sep 26 02:55:55 headnode.cluster.iq.ufrj.br systemd[1]: Starting
> firewalld - dynamic firewall daemon...
> Sep 26 02:55:56 headnode.cluster.iq.ufrj.br systemd[1]: Started firewalld
> - dynamic firewall daemon.
> Sep 26 03:09:18 headnode.cluster.iq.ufrj.br systemd[1]: Stopping
> firewalld - dynamic firewall daemon...
> Sep 26 03:09:21 headnode.cluster.iq.ufrj.br systemd[1]: Stopped firewalld
> - dynamic firewall daemon.
>
> There’s a way to avoid this behaviour?
>
> Thanks,
>
> PS: I’m aware of the consequences of firewalld and SELinux in xCAT
> environments.
> ___
> xCAT-user mailing list
> xCAT-user@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/xcat-user
> ___
> xCAT-user mailing list
> xCAT-user@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/xcat-user
>
___
xCAT-user mailing list
xCAT-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/xcat-user

Re: [xcat-user] [External] xCAT forcibly disabling SELinux and firewalld

[Vinícius Ferrão via xCAT-user]

Hello Jarod, so you’re the guy who can help it out :)

The message was originally about firewalld and SELinux but can be extended to a 
lot of other things. Like the automatic names that xCAT creates for networks 
and things like this.

So I think a package without automatic installation is really welcoming. But to 
this there’s a place we’re it’s documented everything that the xCAT package 
install do?

If not there’s a way to get this from the package? I think the commands are 
sufficient.

In a complex or custom environment manual installation, with other tools 
automating, things is a good ideia.

Thanks.

Sent from my iPhone

On 26 Sep 2019, at 03:54, Jarrod Johnson  wrote:


I've been considering removing all of that from executing on rpm install (also 
enabling services to start on boot just by installing rpm)

It was added for convenience of not asking to run a setup after install but it 
is inconsistent with general rpm behavior and limits ability to use flags to 
customize behavior.

On the flip side, this would be a change that people would have to learn and 
would surprise new installs.

I might make variant of the xCAT meta package with no auto setup so that people 
won't be surprised unless they opt into the other package.

Looking for thoughts.

For wider information, it doesn't yet have os deployment, but confluent has 
been developing and designing specifically with firewall and selinux in mind, 
as well as trying to mitigate the initial setup complexity that drove us to 
create xcatconfig in the first place.  For example no more tls certs required 
for local access and os import will no longer loop mount isos (one of the 
biggest selinux problems) and avoid rewriting other service etc files in daemon 
context.  More straightforward network usage and a documented set of firewalld 
commands.

From: Vinícius Ferrão via xCAT-user 
Sent: Thursday, September 26, 2019 2:27:10 AM
To: xCAT Users Mailing list
Cc: Vinícius Ferrão
Subject: [External] [xcat-user] xCAT forcibly disabling SELinux and firewalld

Hello,

When installing xCAT in EL7 with yum install xCAT it’s just put SELinux in 
permissive mode and disables firewalld.

It does not even ask about it. It just does.

[root@headnode ~]# getenforce
Permissive
[root@headnode ~]# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor 
preset: enabled)
   Active: inactive (dead)
 Docs: man:firewalld(1)

Sep 26 02:55:55 headnode.cluster.iq.ufrj.br systemd[1]: Starting firewalld - 
dynamic firewall daemon...
Sep 26 02:55:56 headnode.cluster.iq.ufrj.br systemd[1]: Started firewalld - 
dynamic firewall daemon.
Sep 26 03:09:18 headnode.cluster.iq.ufrj.br systemd[1]: Stopping firewalld - 
dynamic firewall daemon...
Sep 26 03:09:21 headnode.cluster.iq.ufrj.br systemd[1]: Stopped firewalld - 
dynamic firewall daemon.

There’s a way to avoid this behaviour?

Thanks,

PS: I’m aware of the consequences of firewalld and SELinux in xCAT environments.
___
xCAT-user mailing list
xCAT-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/xcat-user
___
xCAT-user mailing list
xCAT-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/xcat-user

[xcat-user] management node replacement

[Huette, Antoine]

Hello

On an already configured and running xCAT cluster, what should be the procedure 
to replace the management node ?
The new head node will be a different hardware model, meaning we may have 
different interface names.
We will move the current disks into the new management node. Could that work ?

Thanks 


Regards,

Antoine Huette
HPC Engineer
antoine.hue...@bechtle.com | 
03.67.07.97.37/07.72.31.82.12 |  bechtle.fr |
[Bechtle][http://www.bechtle-contenu.fr/signature/facebook.png]
   [http://www.bechtle-contenu.fr/signature/twitter.png] 

[http://www.bechtle-contenu.fr/signature/linkedin.png] 

[http://www.bechtle-contenu.fr/signature/youtube.png] 
[Résultat de recherche d'images 
pour "instagram logo"] 

___
xCAT-user mailing list
xCAT-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/xcat-user

Re: [xcat-user] [External] xCAT forcibly disabling SELinux and firewalld

[Jarrod Johnson]

I've been considering removing all of that from executing on rpm install (also 
enabling services to start on boot just by installing rpm)

It was added for convenience of not asking to run a setup after install but it 
is inconsistent with general rpm behavior and limits ability to use flags to 
customize behavior.

On the flip side, this would be a change that people would have to learn and 
would surprise new installs.

I might make variant of the xCAT meta package with no auto setup so that people 
won't be surprised unless they opt into the other package.

Looking for thoughts.

For wider information, it doesn't yet have os deployment, but confluent has 
been developing and designing specifically with firewall and selinux in mind, 
as well as trying to mitigate the initial setup complexity that drove us to 
create xcatconfig in the first place.  For example no more tls certs required 
for local access and os import will no longer loop mount isos (one of the 
biggest selinux problems) and avoid rewriting other service etc files in daemon 
context.  More straightforward network usage and a documented set of firewalld 
commands.

From: Vinícius Ferrão via xCAT-user 
Sent: Thursday, September 26, 2019 2:27:10 AM
To: xCAT Users Mailing list
Cc: Vinícius Ferrão
Subject: [External] [xcat-user] xCAT forcibly disabling SELinux and firewalld

Hello,

When installing xCAT in EL7 with yum install xCAT it’s just put SELinux in 
permissive mode and disables firewalld.

It does not even ask about it. It just does.

[root@headnode ~]# getenforce
Permissive
[root@headnode ~]# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor 
preset: enabled)
   Active: inactive (dead)
 Docs: man:firewalld(1)

Sep 26 02:55:55 headnode.cluster.iq.ufrj.br systemd[1]: Starting firewalld - 
dynamic firewall daemon...
Sep 26 02:55:56 headnode.cluster.iq.ufrj.br systemd[1]: Started firewalld - 
dynamic firewall daemon.
Sep 26 03:09:18 headnode.cluster.iq.ufrj.br systemd[1]: Stopping firewalld - 
dynamic firewall daemon...
Sep 26 03:09:21 headnode.cluster.iq.ufrj.br systemd[1]: Stopped firewalld - 
dynamic firewall daemon.

There’s a way to avoid this behaviour?

Thanks,

PS: I’m aware of the consequences of firewalld and SELinux in xCAT environments.
___
xCAT-user mailing list
xCAT-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/xcat-user
___
xCAT-user mailing list
xCAT-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/xcat-user

[xcat-user] xCAT forcibly disabling SELinux and firewalld

[Vinícius Ferrão via xCAT-user]

Hello,

When installing xCAT in EL7 with yum install xCAT it’s just put SELinux in 
permissive mode and disables firewalld.

It does not even ask about it. It just does.

[root@headnode ~]# getenforce 
Permissive
[root@headnode ~]# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor 
preset: enabled)
   Active: inactive (dead)
 Docs: man:firewalld(1)

Sep 26 02:55:55 headnode.cluster.iq.ufrj.br systemd[1]: Starting firewalld - 
dynamic firewall daemon...
Sep 26 02:55:56 headnode.cluster.iq.ufrj.br systemd[1]: Started firewalld - 
dynamic firewall daemon.
Sep 26 03:09:18 headnode.cluster.iq.ufrj.br systemd[1]: Stopping firewalld - 
dynamic firewall daemon...
Sep 26 03:09:21 headnode.cluster.iq.ufrj.br systemd[1]: Stopped firewalld - 
dynamic firewall daemon.

There’s a way to avoid this behaviour?

Thanks,

PS: I’m aware of the consequences of firewalld and SELinux in xCAT environments.
___
xCAT-user mailing list
xCAT-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/xcat-user