fix: Agent-Based Installer robustness fixes (workdir, DNS, ISO boot, ssh_agent)#508
Open
vinayakray19 wants to merge 6 commits into
Open
fix: Agent-Based Installer robustness fixes (workdir, DNS, ISO boot, ssh_agent)#508vinayakray19 wants to merge 6 commits into
vinayakray19 wants to merge 6 commits into
Conversation
Add roles/common/tasks/resolve_ocp_install_workdir.yaml, which resolves a single ocp_install_workdir fact (defaulting to abi.ansible_workdir) and asserts it is defined. Use it across the prepare_configs, setup_params, create_agent, and abi_install_complete roles instead of hardcoding ~/ansible_workdir or repeating abi.ansible_workdir, so the install directory can be overridden per inventory and stays consistent. Co-authored-by: Cursor <cursoragent@cursor.com>
named.conf unconditionally referenced env.bastion.networking.nameserver2 in the forwarders list, raising a Jinja UndefinedError when only a single upstream nameserver is configured. Guard the second forwarder and fall back to the cluster forwarder when nameserver2 is not defined. Co-authored-by: Cursor <cursoragent@cursor.com>
With --wait=-1 the virt-install async tasks left the ISO-booted agent VMs powered off, stalling the agent-based install. Remove --wait=-1 from both the control and compute ISO virt-install commands, then add a task that waits for every VM definition to register and an explicit step to ensure all agent VMs are running before the install proceeds. Co-authored-by: Cursor <cursoragent@cursor.com>
The Setup SSH agent play ran with the default become and without loading inventory vars, so it escalated to root and could not see secret-backed variables. Set become: false and load group_vars/all.yaml and group_vars/secrets.yaml so the ssh_agent role runs as the bastion login user with the values it expects. Co-authored-by: Cursor <cursoragent@cursor.com>
v78singh
reviewed
Jun 25, 2026
CI runs ansible-lint on changed files, and touching this role surfaced pre-existing violations. Use FQCN module names (file/copy/stat/debug), replace truthy `yes` with `true`, remove a trailing space, order task keys as name/when/block, and shorten the over-length web-console line. No behavioral change. Co-authored-by: Cursor <cursoragent@cursor.com>
Address review feedback that removing --wait=-1 could break the ABI flow. Restore upstream behavior by default: --wait=-1 is still passed for the ISO virt-install commands unless the new abi.iso_virt_install_wait toggle is set to false. This lets operators opt out on hosts where the async (poll: 0) virt-install job being reaped at the async timeout powers the agent VMs off mid-install. The follow-up "ensure VMs running" task stays as a safety net. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A set of small, independent robustness fixes to the Agent-Based Installer (ABI)
flow, found while deploying OpenShift 4.22 ABI clusters on z/LinuxONE KVM. Each
fix is a separate commit and none change default behaviour for existing users.
Changes
1. Configurable OCP install work directory (
refactor)roles/common/tasks/resolve_ocp_install_workdir.yamlwhich resolves asingle
ocp_install_workdirfact (defaulting toabi.ansible_workdir) andasserts it is set.
prepare_configs,setup_params,create_agent, andabi_install_completenow use
ocp_install_workdirinstead of hardcoding~/ansible_workdirorrepeating
abi.ansible_workdir. This also fixesprepare_configs, whichpreviously created/deleted a hardcoded
~/ansible_workdirthat did not matchthe configured
abi.ansible_workdir.2. Make bastion
nameserver2optional in DNS config (fix)roles/dns/templates/dns-named.conf.j2referencedenv.bastion.networking.nameserver2unconditionally, causing a JinjaUndefinedErrorwhen only one upstream nameserver is configured. The secondforwarder is now guarded and falls back to the cluster forwarder.
3. Keep agent VMs running after ISO boot (
fix)virt-installtasks used--wait=-1, which left the ISO-booted agentVMs powered off and stalled the install.
--wait=-1is removed from both thecontrol and compute ISO commands, and two tasks were added: one waits until
every VM definition is registered, and one ensures all agent VMs are running.
4. Run
ssh_agentplay as the login user with secrets (fix)playbooks/create_abi_cluster.yaml: the "Setup SSH agent" play now setsbecome: falseand loadsgroup_vars/all.yamlandgroup_vars/secrets.yaml,so the
ssh_agentrole runs as the bastion login user and can see thesecret-backed variables it needs.
Test plan
KVM (ISO boot) with these changes.
virt-installlines changed).nameserver2set still render identicalnamed.confforwarders.