feat(ansible): BOXP-178 control-plane journal/watchdog verification - #12604
Open
boxp wants to merge 2 commits into
Open
feat(ansible): BOXP-178 control-plane journal/watchdog verification#12604boxp wants to merge 2 commits into
boxp wants to merge 2 commits into
Conversation
- node_resilience.yml: fail loudly when /dev/watchdog is absent on real hardware (watchdog configured but not activatable must not be silent) - playbooks/verify-control-plane-resilience.yml: new read-only post-apply playbook that asserts effective journald Storage, previous-boot journal, RuntimeWatchdogUSec > 0, /dev/watchdog presence, and armbian-ramlog not mounting /var/log; outputs machine-readable JSON artifact per host - molecule default verify.yml: document that watchdog device check is expected to be skipped in Docker; assert drop-in was written Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This comment has been minimized.
This comment has been minimized.
…esilience
- Fix armbian-ramlog mount check: use regex_search('ramlog|zram') instead of
checking for empty stdout, which was wrong when /var/log has no dedicated
mount (findmnt returns root fs source, not empty)
- Remove 'when: rc == 0' guards that silently skipped assertions on command
failure; add explicit assert tasks that fail loudly when journalctl
--list-boots or systemctl show RuntimeWatchdogUSec fail
- Replace unused journalctl --header with systemd-analyze cat-config to
verify the effective merged Storage= value (catches cases where a drop-in
is overridden by another drop-in or where journald has not been reloaded)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Contributor
Ansible Plan ResultsMode: golyat-4: worker-image
1 changed Changed Tasks (1)
shanghai-1: control-plane
1 changed Changed Tasks (1)
shanghai-1: node-shanghai-1
No changes shanghai-2: control-plane
1 changed Changed Tasks (1)
shanghai-2: node-shanghai-2
No changes shanghai-3: control-plane
1 changed Changed Tasks (1)
shanghai-3: node-shanghai-3
No changes Plan executed on all nodes in parallel. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
BOXP-178: control-plane journaldの永続化とhardware watchdogの実効化・検証を実装。
node_resilience.yml:/dev/watchdogデバイスが実機上で存在しない場合に明示的にFAIL（watchdog configuredだが有効化不能をサイレント成功扱いにしない）playbooks/verify-control-plane-resilience.yml: 新規post-apply read-only検証playbook/dev/watchdog存在・armbian-ramlogが/var/logをマウントしていないことをassertansible/.verify-artifacts/control-plane-resilience-<host>.json）molecule/default/verify.yml: Docker環境ではwatchdog device checkがスキップされることをコメントで明示。drop-in書き込みはassertで確認Acceptance Criteria 状態
verify-control-plane-resilience.yml）注意事項
Test plan
test-ansible.ymlのmolecule testがパスすることを確認（kubernetes_componentsのdefault/journald-disabled/journald-purgeシナリオ）ansible-lint手動実行でexit 0を確認verify-control-plane-resilience.ymlを実行してJSONアーティファクトを確認🤖 Generated with Claude Code