Repository navigation
Package reboot deps - #193
Merged
Merged
Conversation
Signed-off-by: Blagovest Petrov <blagovest@petrovs.info>
A new policy type manages the distribution's unattended update mechanism and the reboot after updates. A policy sets what the node installs on its own (nothing, check only, security updates, all updates), the schedule as a drop-in of the engine's timer, packages held back, and the reboot rule: never, when an update needs it, or after every run, within a daily window, only when nobody is logged in unless the reboot has been pending for a number of days, with a desktop warning before a reboot that affects users. The agent drives dnf-automatic (DNF 4 and 5), unattended-upgrades, os-update and rpm-ostree's automatic update policy, installs the engine package when it is missing, switches every engine's own reboot off and decides reboots itself, records every original state and restores it when the node leaves every policy. Nodes report their engine, pending updates with advisories and CVE ids, last run, kernels and reboot state, shown in a new Software updates section of the node page. Holds are audited as policy.updates_hold. Migration 000045 adds the inventory tables. Agent configuration gains the updates section. Documentation, demo seed and screenshot included. Signed-off-by: Blagovest Petrov <blagovest@petrovs.info>
- Limits: security, reboot and metadata age thresholds reported as the updates:security-age, updates:reboot-age and updates:check-age items, evaluated from the scan facts the agent records; the mode and age items carry the CIS "Ensure updates, patches, and additional security software are installed" control. - Node actions check, install and reboot over the policy stream, behind the new updates:operate permission (migration 000046) and audited as updates.action; forced reboots warn users and restart after a minute. - Nodes list Updates column and filter, per-row update summary and dashboard cards from GET /api/v1/updates/summary. - Firmware: fwupd metadata refresh timer and pending firmware in the inventory and as the updates:firmware item. - Editor tabs Limits and Firmware, templates with limits, docs, permissions reference and release notes. Signed-off-by: Blagovest Petrov <blagovest@petrovs.info>
Signed-off-by: Blagovest Petrov <blagovest@petrovs.info>
- Offline mode on dnf5 systems: the engine downloads only, the agent stores the offline transaction (updates:offline item, a pending reboot) and the policy's reboot runs it with dnf5 offline reboot. - transactional-update as a fifth engine for MicroOS, Aeon, Kalpa and SLE Micro, and updates.engine to force an engine on a node. - CVE ids for dnf security advisories, and a CSV or JSON export of the pending updates from the nodes list and the node section. - The updates schedule drop-in is 90-bor-updates.conf, so the Services & timers type no longer removes it; a sync's window reset covers only its own files. - Agent packages keep the unit enabled across upgrades and restart an enrolled agent on the new binary. Signed-off-by: Blagovest Petrov <blagovest@petrovs.info>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.