knife-proxmox-ve 0.1.2 → 0.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bff2fdcc58a1aeadf186e297e838ddb91510536f7cf0169ccb25a3091c590931
-  data.tar.gz: 9cdc6b30bfe1a9d8da2feb3f8cf622973dbb0ab553c13c10a3a9729ea444a46a
+  metadata.gz: fbd3b9c6dcb50cfa79244a9ff639c08e2b4417bdc99416a870b0a9886367a888
+  data.tar.gz: e4c7f6ab01e458c4794651ac8927f8aecb5a1e42368b7222862f25e6b85d08bc
 SHA512:
-  metadata.gz: 118d4dd196b869f226c11801b728b4d71661c9aa9756210b3857bf6f629c45515199a9b2e0b9b0f27b07bbf1cee995de81eaa1e1e8102a228d415eae7a94a460
-  data.tar.gz: b2b0d7b679086f772f7d844c22635c9a749110405362788ece0e7de99a23eec68a97c1e7e18ddfdad30500a5bfb606e8f8ed4b396a61faa9a32a0a1a4f2226ae
+  metadata.gz: 7633f2ed9ae45c09629598331707b209076eb32e477239a5cc91732339eb8947f4637631ef974e99604eac66fbb8ef59ed5ebab07ec24dee427d1037053ef5c6
+  data.tar.gz: 3df97180d137de70f035416f88d487b13d3f562ec02087b2b8e382abea081dcc7b91c0fa6475ef15453dde08d857290e8b703f39d2015aca121228bba7f60e73

data/README.md

@@ -45,12 +45,16 @@ knife[:proxmox_clusters] = {
     verify_ssl:   true,                  # optional (default true); false warns every run
 
     # Optional per-cluster provisioning defaults (any CLI flag overrides these):
-    storage:      "local-lvm",
-    bridge:       "vmbr0",
-    ciuser:       "ubuntu",
-    nameserver:   "10.0.0.1",
-    searchdomain: "example.com",
-    target_node:  nil,
+    storage:        "local-lvm",
+    bridge:         "vmbr0",
+    ciuser:         "ubuntu",
+    ssh_public_key: "~/.ssh/id_ed25519.pub", # default authorized key; satisfies the auth
+                                             # requirement without --ssh-public-key. For
+                                             # `vm bootstrap`, :ciuser also becomes the
+                                             # default --connection-user.
+    nameserver:     "10.0.0.1",
+    searchdomain:   "example.com",
+    target_node:    nil,
   },
 }
 
@@ -150,13 +154,14 @@ Both commands share the provisioning flags below.
 | `--bridge vmbrN` / `--vlan TAG` | net0 bridge and VLAN tag (needs a VLAN-aware bridge). |
 | `--ip CIDR\|dhcp` / `--gateway IP` / `--prefix N` | Static IPv4 (`10.0.10.5/24`, or a bare IP with `--prefix`) or `dhcp`. |
 | `--nameserver IP` / `--searchdomain DOMAIN` | cloud-init DNS. |
-| `--ciuser USER` | cloud-init user. |
-| `--ssh-public-key PATH` | Public key injected via cloud-init (preferred auth). |
+| `--ciuser USER` | cloud-init user. For `vm bootstrap`, also the default `--connection-user`. |
+| `--ssh-public-key PATH` | Public key injected via cloud-init (preferred auth). Falls back to the cluster's `:ssh_public_key`. |
 | `--cipassword` | Prompt (no echo) for a cloud-init password; or set `KNIFE_PROXMOX_CIPASSWORD`. |
 | `--clone-timeout SEC` / `--boot-timeout SEC` | Clone and boot/SSH wait limits (default 600 / 300). |
 
 For `vm bootstrap`, the standard `knife bootstrap` options are inherited: `-N/--node-name`,
-`-r/--run-list`, `-E/--environment`, `--connection-user`, `--ssh-identity-file`,
+`-r/--run-list`, `-E/--environment`, `--connection-user` (defaults to the resolved `:ciuser`,
+since cloud-init creates the guest account under that name), `--ssh-identity-file`,
 `--bootstrap-version`, `--ssh-verify-host-key` (defaults to `:accept_new` for the
 freshly-created host), `--yes`, etc. They do not apply to `vm create`, which never bootstraps.
 

data/lib/chef/knife/helpers/proxmox_vm_provision.rb

@@ -110,7 +110,8 @@ class Chef
 
           option :ssh_public_key,
             long:        "--ssh-public-key PATH",
-            description: "Path to an SSH PUBLIC key authorized for the cloud-init user."
+            description: "Path to an SSH PUBLIC key authorized for the cloud-init user. " \
+                         "Defaults to the cluster's :ssh_public_key when set."
 
           option :cipassword,
             long:        "--cipassword",
@@ -246,8 +247,8 @@ class Chef
         return if @ssh_public_key || @cipassword
 
         ui.fatal!(
-          "no SSH credential for the new VM: pass --ssh-public-key PATH, or provide a " \
-          "cloud-init password via #{ENV_CIPASSWORD} or --cipassword"
+          "no SSH credential for the new VM: pass --ssh-public-key PATH (or set the cluster's " \
+          ":ssh_public_key), or provide a cloud-init password via #{ENV_CIPASSWORD} or --cipassword"
         )
       end
 
@@ -264,7 +265,7 @@ class Chef
       # looks like a private key (a common copy-paste mistake that must never be
       # uploaded as an authorized key).
       def resolve_ssh_public_key
-        path = config[:ssh_public_key]
+        path = from_cli_or_cluster(:ssh_public_key)
         return nil if blank?(path)
 
         @ssh_public_key_path = File.expand_path(path)

data/lib/chef/knife/proxmox_vm_bootstrap.rb

@@ -28,13 +28,30 @@ class Chef
       CINC_PRODUCT = "cinc"
       CINC_INSTALL_URL = "https://omnitruck.cinc.sh/install.sh"
 
-      # A freshly cloned VM often still runs cloud-init (which itself drives apt) when SSH first
-      # answers. Installing the client then races cloud-init for the dpkg lock and fails
-      # non-deterministically. Block on cloud-init completion before the omnibus install so a
-      # single `vm bootstrap` is reliable. Guarded so non-cloud-init images don't error, and
-      # `|| true` so a degraded/errored cloud-init state still lets the bootstrap proceed.
-      CLOUD_INIT_WAIT_COMMAND =
-        "if command -v cloud-init >/dev/null 2>&1; then cloud-init status --wait >/dev/null 2>&1 || true; fi"
+      # A freshly cloned VM is still settling when SSH first answers, and two independent
+      # subsystems contend for the dpkg lock: cloud-init (which itself drives apt) and the
+      # apt-daily / unattended-upgrades systemd timers, which fire on their own schedule even
+      # after cloud-init reports done. Installing the client — or the first client run's package
+      # resources — then races them for the lock and fails non-deterministically. Clear the field
+      # before the omnibus install, in order:
+      #   1. wait for cloud-init to finish;
+      #   2. stop the apt-daily / unattended-upgrades timers and any in-flight run, so nothing
+      #      grabs the lock again for the rest of this boot (`stop`, not `disable`/`mask`: the
+      #      services return on the next reboot, leaving the image unchanged);
+      #   3. block (bounded) until the dpkg lock a stopped run may still hold is released.
+      # Every step is guarded on the tool existing and `|| true`, so non-cloud-init / non-systemd
+      # / non-apt images and degraded states still let the bootstrap proceed.
+      PREINSTALL_WAIT_COMMAND = <<~SH
+        if command -v cloud-init >/dev/null 2>&1; then cloud-init status --wait >/dev/null 2>&1 || true; fi
+        if command -v systemctl >/dev/null 2>&1; then
+          systemctl stop apt-daily.timer apt-daily-upgrade.timer apt-daily.service apt-daily-upgrade.service unattended-upgrades.service >/dev/null 2>&1 || true
+        fi
+        if command -v flock >/dev/null 2>&1; then
+          for lock in /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock; do
+            [ -e "$lock" ] && flock -w 300 "$lock" true >/dev/null 2>&1 || true
+          done
+        fi
+      SH
 
       deps do
         require "chef/knife/bootstrap"
@@ -60,8 +77,8 @@ class Chef
         # TOFU: a freshly cloned VM has no entry in known_hosts. Accept its key on
         # first connect rather than failing the bootstrap or disabling verification.
         config[:ssh_verify_host_key] ||= :accept_new
-        # Wait for cloud-init to finish before the bootstrap installs the client (see constant).
-        config[:bootstrap_preinstall_command] ||= CLOUD_INIT_WAIT_COMMAND
+        # Drain cloud-init and the dpkg lock before the bootstrap installs the client (see constant).
+        config[:bootstrap_preinstall_command] ||= PREINSTALL_WAIT_COMMAND
       end
 
       # The bootstrap target host does not exist yet — it is resolved to the VM's IP
@@ -95,6 +112,11 @@ class Chef
       def apply_provision_auth!(spec)
         super
 
+        # cloud-init creates the guest account as :ciuser, so the bootstrap must connect as that
+        # same user. Fall back to it when the operator did not pass an explicit --connection-user.
+        ciuser = from_cli_or_cluster(:ciuser)
+        config[:connection_user] ||= ciuser if ciuser
+
         config[:connection_password] = @cipassword if @cipassword
 
         return unless @ssh_public_key

data/lib/knife-proxmox-ve/version.rb

@@ -2,6 +2,6 @@
 
 module Knife
   module Proxmox
-    VERSION = "0.1.2"
+    VERSION = "0.1.4"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: knife-proxmox-ve
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.1.4
 platform: ruby
 authors:
 - Piotr Wojcieszonek