Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

validate config in installer container on upgrade #3419

Closed
smira opened this issue Apr 1, 2021 · 0 comments · Fixed by #3460
Closed

validate config in installer container on upgrade #3419

smira opened this issue Apr 1, 2021 · 0 comments · Fixed by #3460
Assignees
@smira
Milestone
0.10

Comments

@smira
Copy link
Member

smira commented Apr 1, 2021

Config validation rules might change from one version of Talos to another.

As Talos fails the boot on config validation process, it makes sense to make sure that Talos will be able to validate the config after the upgrade.

As new Talos version should be used for the validation, it should be done inside the installer container.

We can pass the config to the container probably via stdin and run validation as the first task of the upgrade. If the config is not passed, installer container should ignore that (to support upgrades from the versions which don't pass that).

This should be backported to 0.9 to allow upgrades to 0.10 to use this feature.
@smira smira added this to the 0.10 milestone Apr 1, 2021
@smira smira self-assigned this Apr 9, 2021
smira added a commit to smira/talos that referenced this issue Apr 9, 2021
@smira
feat: validate the machine configuration in the installer container
36e9030 
Talos validates machine configuration at boot time, and refuses to boot
if machine configuration is invalid.

As machine configuration validation rules might change over time, we
need to prevent a scenario when after an upgrade machine configuration
becomes invalid, as there's no way to roll back properly.

Machine configuration is submitted over stdin to the installer
container, and installer container validates it using the new version of
Talos (which is going to be installed).

If the config is not sent over stdin, installer assumes old version of
Talos and proceeds.

This should be backported to 0.9 to allow config validation on upgrade
to 0.10.

Fixes siderolabs#3419

Signed-off-by: Andrey Smirnov <smirnov.andrey@gmail.com>
smira added a commit to smira/talos that referenced this issue Apr 9, 2021
@smira
feat: validate the machine configuration in the installer container
53cf5b1 
Talos validates machine configuration at boot time, and refuses to boot
if machine configuration is invalid.

As machine configuration validation rules might change over time, we
need to prevent a scenario when after an upgrade machine configuration
becomes invalid, as there's no way to roll back properly.

Machine configuration is submitted over stdin to the installer
container, and installer container validates it using the new version of
Talos (which is going to be installed).

If the config is not sent over stdin, installer assumes old version of
Talos and proceeds.

This should be backported to 0.9 to allow config validation on upgrade
to 0.10.

Fixes siderolabs#3419

Signed-off-by: Andrey Smirnov <smirnov.andrey@gmail.com>
@smira smira mentioned this issue Apr 9, 2021
Merged
talos-bot pushed a commit that referenced this issue Apr 12, 2021
@smira @talos-bot
feat: validate the machine configuration in the installer container
d5e2a45 
Talos validates machine configuration at boot time, and refuses to boot
if machine configuration is invalid.

As machine configuration validation rules might change over time, we
need to prevent a scenario when after an upgrade machine configuration
becomes invalid, as there's no way to roll back properly.

Machine configuration is submitted over stdin to the installer
container, and installer container validates it using the new version of
Talos (which is going to be installed).

If the config is not sent over stdin, installer assumes old version of
Talos and proceeds.

This should be backported to 0.9 to allow config validation on upgrade
to 0.10.

Fixes #3419

Signed-off-by: Andrey Smirnov <smirnov.andrey@gmail.com>
smira added a commit to smira/talos that referenced this issue Apr 14, 2021
@smira
feat: validate the machine configuration in the installer container
ba57523 
Talos validates machine configuration at boot time, and refuses to boot
if machine configuration is invalid.

As machine configuration validation rules might change over time, we
need to prevent a scenario when after an upgrade machine configuration
becomes invalid, as there's no way to roll back properly.

Machine configuration is submitted over stdin to the installer
container, and installer container validates it using the new version of
Talos (which is going to be installed).

If the config is not sent over stdin, installer assumes old version of
Talos and proceeds.

This should be backported to 0.9 to allow config validation on upgrade
to 0.10.

Fixes siderolabs#3419

Signed-off-by: Andrey Smirnov <smirnov.andrey@gmail.com>
(cherry picked from commit d5e2a45)
smira added a commit to smira/talos that referenced this issue Apr 14, 2021
@smira
feat: validate the machine configuration in the installer container
4f26f40 
Talos validates machine configuration at boot time, and refuses to boot
if machine configuration is invalid.

As machine configuration validation rules might change over time, we
need to prevent a scenario when after an upgrade machine configuration
becomes invalid, as there's no way to roll back properly.

Machine configuration is submitted over stdin to the installer
container, and installer container validates it using the new version of
Talos (which is going to be installed).

If the config is not sent over stdin, installer assumes old version of
Talos and proceeds.

This should be backported to 0.9 to allow config validation on upgrade
to 0.10.

Fixes siderolabs#3419

Signed-off-by: Andrey Smirnov <smirnov.andrey@gmail.com>
(cherry picked from commit d5e2a45)
smira added a commit that referenced this issue Apr 15, 2021
@smira
feat: validate the machine configuration in the installer container
4f76822 
Talos validates machine configuration at boot time, and refuses to boot
if machine configuration is invalid.

As machine configuration validation rules might change over time, we
need to prevent a scenario when after an upgrade machine configuration
becomes invalid, as there's no way to roll back properly.

Machine configuration is submitted over stdin to the installer
container, and installer container validates it using the new version of
Talos (which is going to be installed).

If the config is not sent over stdin, installer assumes old version of
Talos and proceeds.

This should be backported to 0.9 to allow config validation on upgrade
to 0.10.

Fixes #3419

Signed-off-by: Andrey Smirnov <smirnov.andrey@gmail.com>
(cherry picked from commit d5e2a45)
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Jun 26, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@smira smira

Labels
None yet
Projects
None yet
Milestone
0.10
Development

Successfully merging a pull request may close this issue.

feat: validate the machine configuration in the installer container smira/talos
1 participant
@smira