From 5cbb61f5598d952df3d845136b16a66ca753bfda Mon Sep 17 00:00:00 2001 From: raulluzon Date: Fri, 19 Jun 2026 13:46:58 +0200 Subject: [PATCH 01/33] fix: resize OneKE disks via Ruby API --- oneKE/code/component_playbook.yaml | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/oneKE/code/component_playbook.yaml b/oneKE/code/component_playbook.yaml index e839927c..9d07da28 100644 --- a/oneKE/code/component_playbook.yaml +++ b/oneKE/code/component_playbook.yaml @@ -61,12 +61,20 @@ # For some weird reason, idempotency with this tool gives rc=255, but syntax errors give rc=0... - name: Resize the disk reserved for Longhorn in the storage VMs - ansible.builtin.shell: > - /usr/bin/onevm - disk-resize {{ item }} 1 30G - --user {{ lookup('ansible.builtin.env', 'OPENNEBULA_USERNAME') }} - --password {{ lookup('ansible.builtin.env', 'OPENNEBULA_PASSWORD') }} - --endpoint {{ lookup('ansible.builtin.env', 'OPENNEBULA_ENDPOINT') }} + ansible.builtin.shell: | + ruby - "{{ item }}" <<'RUBY' + require 'opennebula' + + auth = "#{ENV.fetch('OPENNEBULA_USERNAME')}:#{ENV.fetch('OPENNEBULA_PASSWORD')}" + client = OpenNebula::Client.new(auth, ENV.fetch('OPENNEBULA_ENDPOINT')) + vm = OpenNebula::VirtualMachine.new_with_id(Integer(ARGV.fetch(0)), client) + rc = vm.disk_resize(1, 30 * 1024) + + if OpenNebula.is_error?(rc) + warn rc.message + exit 255 + end + RUBY register: disk_resize failed_when: > (disk_resize.rc != 0 and 'must be larger' not in disk_resize.stderr) or From 9ef41134e32c69c5f5d334c0c41c7cf8212ba045 Mon Sep 17 00:00:00 2001 From: raulluzon Date: Mon, 22 Jun 2026 13:47:01 +0200 Subject: [PATCH 02/33] fix: ensure S3 bucket exists before listing objects in s3_download The amazon.aws.s3_object list mode fails with a hard error when the bucket does not exist (auto-creation was removed in amazon.aws 6.0.0). Add an idempotent amazon.aws.s3_bucket task before the list/download tasks so the bucket is created on first deployment and silently reused on all subsequent deployments. Co-Authored-By: Claude Sonnet 4.6 --- .global/cac/s3_download.yaml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.global/cac/s3_download.yaml b/.global/cac/s3_download.yaml index 942c5132..9e41d19d 100644 --- a/.global/cac/s3_download.yaml +++ b/.global/cac/s3_download.yaml @@ -1,3 +1,12 @@ +- name: Ensure S3 bucket exists + amazon.aws.s3_bucket: + name: "{{ site_s3_server.bucket }}" + state: present + endpoint_url: "{{ site_s3_server.endpoint }}" + access_key: "{{ lookup('ansible.builtin.env', 'AWS_ACCESS_KEY_ID') }}" + secret_key: "{{ lookup('ansible.builtin.env', 'AWS_SECRET_ACCESS_KEY') }}" + validate_certs: false + - name: Get list of files from S3 object storage amazon.aws.s3_object: endpoint_url: "{{ site_s3_server.endpoint }}" From 36be98e102b5d7f0962705404cb3a374f306365a Mon Sep 17 00:00:00 2001 From: raulluzon Date: Wed, 24 Jun 2026 12:54:38 +0200 Subject: [PATCH 03/33] fix(open5gs_vm): bypass strict KEX negotiation to fix SSH connection failure The open5gs_vm image (id: 260) advertises kex-strict-s-v00@openssh.com but fails to complete the handshake when strict KEX mode is activated, causing Stage 3 (wait_for_connection) to time out with "Connection closed by UNKNOWN port 65535". Adding -o KexAlgorithms=curve25519-sha256 prevents the client from engaging strict mode, which allows the key exchange to complete. Co-Authored-By: Claude Sonnet 4.6 --- open5gs_vm/code/component_playbook.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/open5gs_vm/code/component_playbook.yaml b/open5gs_vm/code/component_playbook.yaml index d7601569..285c6787 100644 --- a/open5gs_vm/code/component_playbook.yaml +++ b/open5gs_vm/code/component_playbook.yaml @@ -69,7 +69,7 @@ ansible.builtin.add_host: hostname: "open5gs_vm" ansible_host: "{{ ips[access_vnet_id] }}" - ansible_ssh_common_args: "-J jenkins@{{ bastion_ip }}" + ansible_ssh_common_args: "-J jenkins@{{ bastion_ip }} -o KexAlgorithms=curve25519-sha256" ansible_user: "jenkins" - name: Add new VM to SSH config file in the Jenkins-master for debugging purposes From 6a7128e076f187f4274f445ad2a2ea50129bbbdf Mon Sep 17 00:00:00 2001 From: raulluzon Date: Fri, 26 Jun 2026 15:26:49 +0200 Subject: [PATCH 04/33] fix(open5gs_vm): update Open5GS version pin from 2.7.6 to 2.8.0 Version 2.7.6 has been removed from the open5gs/latest PPA. The only available version is now 2.8.0~jammy5. Added update_cache: yes to ensure the APT index is refreshed after adding the PPA. Co-Authored-By: Claude Sonnet 4.6 --- open5gs_vm/code/one/cac/02_install/install_open5gs.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/open5gs_vm/code/one/cac/02_install/install_open5gs.yml b/open5gs_vm/code/one/cac/02_install/install_open5gs.yml index 0e1638dc..850864b5 100644 --- a/open5gs_vm/code/one/cac/02_install/install_open5gs.yml +++ b/open5gs_vm/code/one/cac/02_install/install_open5gs.yml @@ -41,9 +41,10 @@ repo: 'ppa:open5gs/latest' state: present - - name: Install Open5GS 2.7.6~* + - name: Install Open5GS 2.8.0~* ansible.builtin.apt: - name: open5gs=2.7.6~* + name: open5gs=2.8.0~* + update_cache: yes state: present when: not one_open5gs_vm_use_nightly From cfcb0c7d185b8945894e14f80fe016d93354ba73 Mon Sep 17 00:00:00 2001 From: raulluzon Date: Fri, 26 Jun 2026 15:48:33 +0200 Subject: [PATCH 05/33] docs(open5gs_vm): update version references from 2.7.6 to 2.8.0 Follows the installation fix in commit 6a7128e; the README and result template still referenced the old pinned version. Co-Authored-By: Claude Sonnet 4.6 --- open5gs_vm/README.md | 4 ++-- open5gs_vm/result_templates/ok_result.md.j2 | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/open5gs_vm/README.md b/open5gs_vm/README.md index 67fb264f..b69f4f83 100644 --- a/open5gs_vm/README.md +++ b/open5gs_vm/README.md @@ -2,7 +2,7 @@ The **open5gs_vm** 6G-Library component deploys a 5G SA Core inside an Ubuntu VM using scripts. Current versions: -- Open5GS v2.7.6 +- Open5GS v2.8.0 > [!NOTE] > The VM needs a CPU architecture with the vmx instructions set. @@ -54,7 +54,7 @@ Deploys a Open5GS as a standalone Virtual Machine ## Long Description Deploys a Open5GS over a general-purpose Virtual Machine based on Ubuntu 22.04 LTS. -The automation installs Open5GS version 2.7.6 and MongoDB on it. +The automation installs Open5GS version 2.8.0 and MongoDB on it. Through variable `one_open5gs_vm_size`, five different types of instances can be deployed: - **extra_large**: 32 GiB of memory, 8 vCPU and 100GiB of storage diff --git a/open5gs_vm/result_templates/ok_result.md.j2 b/open5gs_vm/result_templates/ok_result.md.j2 index 2817b028..d53190c3 100644 --- a/open5gs_vm/result_templates/ok_result.md.j2 +++ b/open5gs_vm/result_templates/ok_result.md.j2 @@ -25,7 +25,7 @@ Deployed Open5GS includes the following 5G Core components: If you need detailed information about Open5GS you can visit the official documentation: https://open5gs.org/open5gs/docs/guide/01-quickstart/ Current versions: -- Open5GS `v2.7.6` +- Open5GS `v2.8.0` - Ubuntu 22.04 ## Important information From 2e9d5afebefdbaf8a0c055b70698efe88f032e83 Mon Sep 17 00:00:00 2001 From: raulluzon Date: Tue, 30 Jun 2026 09:30:58 +0200 Subject: [PATCH 06/33] fix(open5gs_vm): update Open5GS version reference from 2.7.6 to 2.8.0 in public.yaml Co-Authored-By: Claude Sonnet 4.6 --- open5gs_vm/.tnlcm/public.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/open5gs_vm/.tnlcm/public.yaml b/open5gs_vm/.tnlcm/public.yaml index 2395dd11..51adf384 100644 --- a/open5gs_vm/.tnlcm/public.yaml +++ b/open5gs_vm/.tnlcm/public.yaml @@ -19,7 +19,7 @@ metadata: short_description: Deploys a Open5GS as a standalone Virtual Machine long_description: | Deploys a Open5GS over a general-purpose Virtual Machine based on Ubuntu 22.04 lTS. - The automation is installing Open5GS version 2.7.6 and MongoDB on it. + The automation is installing Open5GS version 2.8.0 and MongoDB on it. Through variable "one_open5gs_vm_size", five different types of instances can be deployed - **extra_large**: 32 GiB of memory, 8 vCPU and 100GiB of storage - **large**: 16 GiB of memory, 4 vCPU and 50GiB of storage From 849f7f81277dd63bb816c493ae9417d78155f6a6 Mon Sep 17 00:00:00 2001 From: raulluzon Date: Wed, 1 Jul 2026 22:13:28 +0200 Subject: [PATCH 07/33] fix(open5gs_vm): wait for dpkg lock before apt operations on fresh VMs unattended-upgrades holds /var/lib/dpkg/lock-frontend on VM boot, causing apt installs to fail with rc 100 when Ansible runs immediately after the VM becomes reachable. Co-Authored-By: Claude Sonnet 4.6 --- open5gs_vm/code/one/cac/02_install/install_open5gs.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/open5gs_vm/code/one/cac/02_install/install_open5gs.yml b/open5gs_vm/code/one/cac/02_install/install_open5gs.yml index 850864b5..f1b34193 100644 --- a/open5gs_vm/code/one/cac/02_install/install_open5gs.yml +++ b/open5gs_vm/code/one/cac/02_install/install_open5gs.yml @@ -2,6 +2,12 @@ - name: Run every task as root user become: true block: + - name: Wait for dpkg lock to be released + ansible.builtin.wait_for: + path: /var/lib/dpkg/lock-frontend + state: absent + timeout: 300 + - name: Render netplan aliases ansible.builtin.template: src: "{{ workspace }}/{{ component_type }}/code/{{ site_hypervisor }}/cac/02_install/templates/99-netplan-aliases.yaml.j2" From b358ce12bb9fd3849b592a1dc18fc1897dabc373 Mon Sep 17 00:00:00 2001 From: raulluzon Date: Wed, 1 Jul 2026 22:27:57 +0200 Subject: [PATCH 08/33] fix(open5gs_vm): stop unattended-upgrades before apt to avoid lock timeout Passive wait could timeout (>5 min) if unattended-upgrades was running. Stop the service first so the lock is released immediately. Co-Authored-By: Claude Sonnet 4.6 --- open5gs_vm/code/one/cac/02_install/install_open5gs.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/open5gs_vm/code/one/cac/02_install/install_open5gs.yml b/open5gs_vm/code/one/cac/02_install/install_open5gs.yml index f1b34193..963400f9 100644 --- a/open5gs_vm/code/one/cac/02_install/install_open5gs.yml +++ b/open5gs_vm/code/one/cac/02_install/install_open5gs.yml @@ -2,11 +2,17 @@ - name: Run every task as root user become: true block: + - name: Stop unattended-upgrades to release dpkg lock + ansible.builtin.systemd: + name: unattended-upgrades + state: stopped + failed_when: false + - name: Wait for dpkg lock to be released ansible.builtin.wait_for: path: /var/lib/dpkg/lock-frontend state: absent - timeout: 300 + timeout: 60 - name: Render netplan aliases ansible.builtin.template: From 1325a356e59b668fdda26e44eae7e737d894b479 Mon Sep 17 00:00:00 2001 From: raulluzon Date: Thu, 2 Jul 2026 07:51:02 +0200 Subject: [PATCH 09/33] fix(open5gs_vm): force-kill processes holding dpkg lock before apt Stopping unattended-upgrades via systemd sends SIGTERM but the in-flight dpkg operation keeps holding lock-frontend until it completes. Use fuser -k to immediately kill any process holding the dpkg/apt locks, then repair any interrupted dpkg state before proceeding with apt installs. Co-Authored-By: Claude Sonnet 4.6 --- .../code/one/cac/02_install/install_open5gs.yml | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) diff --git a/open5gs_vm/code/one/cac/02_install/install_open5gs.yml b/open5gs_vm/code/one/cac/02_install/install_open5gs.yml index 963400f9..1bab8d62 100644 --- a/open5gs_vm/code/one/cac/02_install/install_open5gs.yml +++ b/open5gs_vm/code/one/cac/02_install/install_open5gs.yml @@ -2,18 +2,15 @@ - name: Run every task as root user become: true block: - - name: Stop unattended-upgrades to release dpkg lock - ansible.builtin.systemd: - name: unattended-upgrades - state: stopped + - name: Release dpkg lock held by unattended-upgrades or apt + ansible.builtin.shell: | + systemctl stop unattended-upgrades apt-daily.service apt-daily-upgrade.service 2>/dev/null || true + fuser -k /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock /var/cache/apt/archives/lock 2>/dev/null || true + sleep 2 + dpkg --configure -a 2>/dev/null || true + changed_when: false failed_when: false - - name: Wait for dpkg lock to be released - ansible.builtin.wait_for: - path: /var/lib/dpkg/lock-frontend - state: absent - timeout: 60 - - name: Render netplan aliases ansible.builtin.template: src: "{{ workspace }}/{{ component_type }}/code/{{ site_hypervisor }}/cac/02_install/templates/99-netplan-aliases.yaml.j2" From 304c37380edfb290efb3db53233fa00be21c95e6 Mon Sep 17 00:00:00 2001 From: raulluzon Date: Thu, 9 Jul 2026 14:22:22 +0200 Subject: [PATCH 10/33] fix: derive VM SSH key from Jenkins service key instead of OpenNebula user profile All VM Terraform templates used \$USER[SSH_PUBLIC_KEY], which expands to the SSH key stored in the OpenNebula account of the deploying user. When that user is a human operator rather than Jenkins, the provisioned VM gets the wrong key in authorized_keys and Jenkins can never authenticate. Read the key at pipeline time from /var/lib/jenkins/.ssh/id_ed25519.pub via an Ansible lookup (always runs on the controller) and inject it as jenkins_ssh_public_key. Replace \$USER[SSH_PUBLIC_KEY] with this variable in all 23 VM component templates. Co-Authored-By: Claude Sonnet 4.6 --- .dummy_component/code/one/iac/dummy_component.tf.j2 | 2 +- .global/cac/load_variables.yaml | 4 ++++ elcm/code/one/iac/elcm.tf.j2 | 2 +- grafana/code/one/iac/grafana.tf.j2 | 2 +- influxdb/code/one/iac/influxdb.tf.j2 | 2 +- int_p4_sw/code/one/iac/int_collector_p4_sw.tf.j2 | 2 +- int_p4_sw/code/one/iac/int_switch_p4_sw.tf.j2 | 2 +- ixc_endpoint/code/one/iac/ixc_endpoint.tf.j2 | 2 +- ks8500_runner/code/one/iac/ks8500_runner.tf.j2 | 2 +- loadcore_agent/code/one/iac/loadcore_agent.tf.j2 | 2 +- mongodb/code/one/iac/mongodb.tf.j2 | 2 +- monitoring/code/one/iac/monitoring.tf.j2 | 2 +- open5gcore_vm/code/one/iac/open5gcore_vm.tf.j2 | 2 +- open5gs_vm/code/one/iac/open5gs_vm.tf.j2 | 2 +- opensand_gw/code/one/iac/opensand_gw.tf.j2 | 2 +- opensand_sat/code/one/iac/opensand_sat.tf.j2 | 2 +- opensand_st/code/one/iac/opensand_st.tf.j2 | 2 +- prometheus/code/one/iac/prometheus.tf.j2 | 2 +- qosium_probe/code/one/iac/qosium_probe.tf.j2 | 2 +- tn_bastion/code/one/iac/tn_bastion.tf.j2 | 2 +- ueransim/code/one/iac/ueransim.tf.j2 | 2 +- upf_p4_sw/code/one/iac/upf_p4_sw.tf.j2 | 2 +- vm_kvm/code/one/iac/vm_kvm.tf.j2 | 2 +- xrext/code/one/iac/xrext.tf.j2 | 2 +- 24 files changed, 27 insertions(+), 23 deletions(-) diff --git a/.dummy_component/code/one/iac/dummy_component.tf.j2 b/.dummy_component/code/one/iac/dummy_component.tf.j2 index ababca31..13ee00d1 100644 --- a/.dummy_component/code/one/iac/dummy_component.tf.j2 +++ b/.dummy_component/code/one/iac/dummy_component.tf.j2 @@ -12,7 +12,7 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { NETCFG_TYPE = "interfaces" SET_HOSTNAME = "$NAME" USERNAME = "jenkins" - SSH_PUBLIC_KEY = "$USER[SSH_PUBLIC_KEY]" + SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" } {# ### Disabled the possibility to modify VM's size due to a problem with Terraform's OpenNebula Provider diff --git a/.global/cac/load_variables.yaml b/.global/cac/load_variables.yaml index 64a2119f..e73d8664 100644 --- a/.global/cac/load_variables.yaml +++ b/.global/cac/load_variables.yaml @@ -16,3 +16,7 @@ - name: Load public component-specific variables from input file ansible.builtin.include_vars: file: "{{ workspace }}/{{ component_type }}/variables/input_file.yaml" + +- name: Set Jenkins SSH public key from local file + ansible.builtin.set_fact: + jenkins_ssh_public_key: "{{ lookup('file', '/var/lib/jenkins/.ssh/id_ed25519.pub') }}" diff --git a/elcm/code/one/iac/elcm.tf.j2 b/elcm/code/one/iac/elcm.tf.j2 index 12ab2f27..9539150d 100644 --- a/elcm/code/one/iac/elcm.tf.j2 +++ b/elcm/code/one/iac/elcm.tf.j2 @@ -12,7 +12,7 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { NETCFG_TYPE = "interfaces" SET_HOSTNAME = "$NAME" USERNAME = "jenkins" - SSH_PUBLIC_KEY = "$USER[SSH_PUBLIC_KEY]" + SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" ONEAPP_ELCM_PORTAL_ENABLE = "YES" ONEAPP_ELCM_INFLUXDB_ENABLE = "YES" ONEAPP_ELCM_INFLUXDB_HOST = "{{ influxdb_configuration.host }}" diff --git a/grafana/code/one/iac/grafana.tf.j2 b/grafana/code/one/iac/grafana.tf.j2 index 8e206c74..c7d5016f 100644 --- a/grafana/code/one/iac/grafana.tf.j2 +++ b/grafana/code/one/iac/grafana.tf.j2 @@ -12,7 +12,7 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { NETCFG_TYPE = "interfaces" SET_HOSTNAME = "$NAME" USERNAME = "jenkins" - SSH_PUBLIC_KEY = "$USER[SSH_PUBLIC_KEY]" + SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" ONEAPP_GRAFANA_VERSION = "{{ one_grafana_version }}" ONEAPP_GRAFANA_ADMIN_PASSWORD = "{{ one_grafana_password }}" } diff --git a/influxdb/code/one/iac/influxdb.tf.j2 b/influxdb/code/one/iac/influxdb.tf.j2 index 719341b5..22fdb174 100644 --- a/influxdb/code/one/iac/influxdb.tf.j2 +++ b/influxdb/code/one/iac/influxdb.tf.j2 @@ -12,7 +12,7 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { NETCFG_TYPE = "interfaces" SET_HOSTNAME = "$NAME" USERNAME = "jenkins" - SSH_PUBLIC_KEY = "$USER[SSH_PUBLIC_KEY]" + SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" ONEAPP_INFLUXDB_VERSION = "{{ one_influxdb_version }}" ONEAPP_INFLUXDB_USER = "{{ one_influxdb_user }}" ONEAPP_INFLUXDB_PASSWORD = "{{ one_influxdb_password }}" diff --git a/int_p4_sw/code/one/iac/int_collector_p4_sw.tf.j2 b/int_p4_sw/code/one/iac/int_collector_p4_sw.tf.j2 index 6685114c..d6a81358 100644 --- a/int_p4_sw/code/one/iac/int_collector_p4_sw.tf.j2 +++ b/int_p4_sw/code/one/iac/int_collector_p4_sw.tf.j2 @@ -10,7 +10,7 @@ resource "opennebula_virtual_machine" "{{ entity_name }}_collector" { NETCFG_TYPE = "interfaces" SET_HOSTNAME = "$NAME" USERNAME = "jenkins" - SSH_PUBLIC_KEY = "$USER[SSH_PUBLIC_KEY]" + SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" } {# ### Disabled the possibility to modify VM's size due to a problem with Terraform's OpenNebula Provider diff --git a/int_p4_sw/code/one/iac/int_switch_p4_sw.tf.j2 b/int_p4_sw/code/one/iac/int_switch_p4_sw.tf.j2 index 550bbb84..d299bfd5 100644 --- a/int_p4_sw/code/one/iac/int_switch_p4_sw.tf.j2 +++ b/int_p4_sw/code/one/iac/int_switch_p4_sw.tf.j2 @@ -12,7 +12,7 @@ resource "opennebula_virtual_machine" "{{ entity_name }}_{{ switch_index }}" { NETCFG_TYPE = "interfaces" SET_HOSTNAME = "$NAME" USERNAME = "jenkins" - SSH_PUBLIC_KEY = "$USER[SSH_PUBLIC_KEY]" + SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" } {% for network in switch_config.networks %} diff --git a/ixc_endpoint/code/one/iac/ixc_endpoint.tf.j2 b/ixc_endpoint/code/one/iac/ixc_endpoint.tf.j2 index 613a80a6..6c6338f4 100644 --- a/ixc_endpoint/code/one/iac/ixc_endpoint.tf.j2 +++ b/ixc_endpoint/code/one/iac/ixc_endpoint.tf.j2 @@ -9,7 +9,7 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { NETCFG_TYPE = "interfaces" SET_HOSTNAME = "$NAME" USERNAME = "jenkins" - SSH_PUBLIC_KEY = "$USER[SSH_PUBLIC_KEY]" + SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" ONEAPP_IXCHARIOT_ENDPOINT_RS_ADDRESS = "{{ one_ixc_endpoint_rs }}" } diff --git a/ks8500_runner/code/one/iac/ks8500_runner.tf.j2 b/ks8500_runner/code/one/iac/ks8500_runner.tf.j2 index 3d1612c2..ba7b4d3e 100644 --- a/ks8500_runner/code/one/iac/ks8500_runner.tf.j2 +++ b/ks8500_runner/code/one/iac/ks8500_runner.tf.j2 @@ -13,7 +13,7 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { SET_HOSTNAME: "$NAME" USERNAME: "jenkins" PASSWORD: "keysight" - SSH_PUBLIC_KEY: "$USER[SSH_PUBLIC_KEY]" + SSH_PUBLIC_KEY: "{{ jenkins_ssh_public_key }}" # install apt install python3 -y; growpart /dev/vda 1; resize2fs /dev/vda1 START_SCRIPT_BASE64: "IyEvYmluL2Jhc2gKZ3Jvd3BhcnQgL2Rldi92ZGEgMQpyZXNpemUyZnMgL2Rldi92ZGExCmFwdCBpbnN0YWxsIHB5dGhvbjMgLXk=" } diff --git a/loadcore_agent/code/one/iac/loadcore_agent.tf.j2 b/loadcore_agent/code/one/iac/loadcore_agent.tf.j2 index 550ad193..25246f35 100644 --- a/loadcore_agent/code/one/iac/loadcore_agent.tf.j2 +++ b/loadcore_agent/code/one/iac/loadcore_agent.tf.j2 @@ -12,7 +12,7 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { NETCFG_TYPE = "interfaces" SET_HOSTNAME = "$NAME" USERNAME = "jenkins" - SSH_PUBLIC_KEY = "$USER[SSH_PUBLIC_KEY]" + SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKZ3Jvd3BhcnQgL2Rldi92ZGEgMQpyZXNpemUyZnMgL2Rldi92ZGEx" } diff --git a/mongodb/code/one/iac/mongodb.tf.j2 b/mongodb/code/one/iac/mongodb.tf.j2 index 4b001df2..2aa5e2e1 100644 --- a/mongodb/code/one/iac/mongodb.tf.j2 +++ b/mongodb/code/one/iac/mongodb.tf.j2 @@ -12,7 +12,7 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { NETCFG_TYPE = "interfaces" SET_HOSTNAME = "$NAME" USERNAME = "jenkins" - SSH_PUBLIC_KEY = "$USER[SSH_PUBLIC_KEY]" + SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" ONEAPP_MONGODB_VERSION = "{{ one_mongodb_version }}" ONEAPP_MONGODB_USER = "{{ one_mongodb_user }}" ONEAPP_MONGODB_PASSWORD = "{{ one_mongodb_password }}" diff --git a/monitoring/code/one/iac/monitoring.tf.j2 b/monitoring/code/one/iac/monitoring.tf.j2 index d87e650d..7e781842 100644 --- a/monitoring/code/one/iac/monitoring.tf.j2 +++ b/monitoring/code/one/iac/monitoring.tf.j2 @@ -12,7 +12,7 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { NETCFG_TYPE = "interfaces" SET_HOSTNAME = "$NAME" USERNAME = "jenkins" - SSH_PUBLIC_KEY = "$USER[SSH_PUBLIC_KEY]" + SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" ONEAPP_INFLUXDB_VERSION = "{{ one_influxdb_version }}" ONEAPP_INFLUXDB_USER = "{{ one_influxdb_user }}" ONEAPP_INFLUXDB_PASSWORD = "{{ one_influxdb_password }}" diff --git a/open5gcore_vm/code/one/iac/open5gcore_vm.tf.j2 b/open5gcore_vm/code/one/iac/open5gcore_vm.tf.j2 index 0f1f1edc..47807e5c 100644 --- a/open5gcore_vm/code/one/iac/open5gcore_vm.tf.j2 +++ b/open5gcore_vm/code/one/iac/open5gcore_vm.tf.j2 @@ -12,7 +12,7 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { NETCFG_TYPE = "interfaces" SET_HOSTNAME = "$NAME" USERNAME = "jenkins" - SSH_PUBLIC_KEY = "$USER[SSH_PUBLIC_KEY]" + SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" } {# ### Disabled the possibility to modify VM's size due to a problem with Terraform's OpenNebula Provider diff --git a/open5gs_vm/code/one/iac/open5gs_vm.tf.j2 b/open5gs_vm/code/one/iac/open5gs_vm.tf.j2 index aad0dc56..df8fe92d 100644 --- a/open5gs_vm/code/one/iac/open5gs_vm.tf.j2 +++ b/open5gs_vm/code/one/iac/open5gs_vm.tf.j2 @@ -12,7 +12,7 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { NETCFG_TYPE = "interfaces" SET_HOSTNAME = "$NAME" USERNAME = "jenkins" - SSH_PUBLIC_KEY = "$USER[SSH_PUBLIC_KEY]" + SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" } {# ### Disabled the possibility to modify VM's size due to a problem with Terraform's OpenNebula Provider diff --git a/opensand_gw/code/one/iac/opensand_gw.tf.j2 b/opensand_gw/code/one/iac/opensand_gw.tf.j2 index fb8ab4f9..8fd840e0 100644 --- a/opensand_gw/code/one/iac/opensand_gw.tf.j2 +++ b/opensand_gw/code/one/iac/opensand_gw.tf.j2 @@ -14,7 +14,7 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { NETCFG_TYPE = "interfaces" SET_HOSTNAME = "$NAME" USERNAME = "jenkins" - SSH_PUBLIC_KEY = "$USER[SSH_PUBLIC_KEY]" + SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" } diff --git a/opensand_sat/code/one/iac/opensand_sat.tf.j2 b/opensand_sat/code/one/iac/opensand_sat.tf.j2 index ee2e7089..f5eedbb9 100644 --- a/opensand_sat/code/one/iac/opensand_sat.tf.j2 +++ b/opensand_sat/code/one/iac/opensand_sat.tf.j2 @@ -14,7 +14,7 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { NETCFG_TYPE = "interfaces" SET_HOSTNAME = "$NAME" USERNAME = "jenkins" - SSH_PUBLIC_KEY = "$USER[SSH_PUBLIC_KEY]" + SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" } diff --git a/opensand_st/code/one/iac/opensand_st.tf.j2 b/opensand_st/code/one/iac/opensand_st.tf.j2 index dab9ac2e..f3956524 100644 --- a/opensand_st/code/one/iac/opensand_st.tf.j2 +++ b/opensand_st/code/one/iac/opensand_st.tf.j2 @@ -14,7 +14,7 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { NETCFG_TYPE = "interfaces" SET_HOSTNAME = "$NAME" USERNAME = "jenkins" - SSH_PUBLIC_KEY = "$USER[SSH_PUBLIC_KEY]" + SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" } diff --git a/prometheus/code/one/iac/prometheus.tf.j2 b/prometheus/code/one/iac/prometheus.tf.j2 index 6f0ba291..b8bba2cd 100644 --- a/prometheus/code/one/iac/prometheus.tf.j2 +++ b/prometheus/code/one/iac/prometheus.tf.j2 @@ -12,7 +12,7 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { NETCFG_TYPE = "interfaces" SET_HOSTNAME = "$NAME" USERNAME = "jenkins" - SSH_PUBLIC_KEY = "$USER[SSH_PUBLIC_KEY]" + SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" ONEAPP_PROMETHEUS_VERSION = "{{ one_prometheus_version }}" } diff --git a/qosium_probe/code/one/iac/qosium_probe.tf.j2 b/qosium_probe/code/one/iac/qosium_probe.tf.j2 index a013ec16..aa2ca074 100644 --- a/qosium_probe/code/one/iac/qosium_probe.tf.j2 +++ b/qosium_probe/code/one/iac/qosium_probe.tf.j2 @@ -12,7 +12,7 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { NETCFG_TYPE= "interfaces" SET_HOSTNAME = "$NAME" USERNAME = "jenkins" - SSH_PUBLIC_KEY = "$USER[SSH_PUBLIC_KEY]" + SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" } {# ### Disabled the possibility to modify VM's size due to a Terraform OpenNebula Provider's error diff --git a/tn_bastion/code/one/iac/tn_bastion.tf.j2 b/tn_bastion/code/one/iac/tn_bastion.tf.j2 index 3476ee61..ec853336 100644 --- a/tn_bastion/code/one/iac/tn_bastion.tf.j2 +++ b/tn_bastion/code/one/iac/tn_bastion.tf.j2 @@ -12,7 +12,7 @@ resource "opennebula_virtual_machine" "tn_bastion" { NETCFG_TYPE = "interfaces" SET_HOSTNAME = "$NAME" USERNAME = "jenkins" - SSH_PUBLIC_KEY = "$USER[SSH_PUBLIC_KEY]" + SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" TOKEN = "YES" ONEAPP_BASTION_DNS_PASSWORD = "" ONEAPP_BASTION_DNS_FORWARDERS = "{{ site_dns | default('8.8.8.8,1.1.1.1') }}" diff --git a/ueransim/code/one/iac/ueransim.tf.j2 b/ueransim/code/one/iac/ueransim.tf.j2 index 31c30cba..1f9bb65c 100644 --- a/ueransim/code/one/iac/ueransim.tf.j2 +++ b/ueransim/code/one/iac/ueransim.tf.j2 @@ -12,7 +12,7 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { NETCFG_TYPE = "interfaces" SET_HOSTNAME = "$NAME" USERNAME = "jenkins" - SSH_PUBLIC_KEY = "$USER[SSH_PUBLIC_KEY]" + SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" {% if one_ueransim_mode in ['gnb', 'both'] %} ONEAPP_UERANSIM_RUN_GNB = "{% if one_ueransim_run_gnb %}YES{% else %}NO{% endif %}" ONEAPP_UERANSIM_GNB_AMF_IP = "{{ one_ueransim_gnb_amf_n2_ip }}" diff --git a/upf_p4_sw/code/one/iac/upf_p4_sw.tf.j2 b/upf_p4_sw/code/one/iac/upf_p4_sw.tf.j2 index e101d0ab..9bdaa069 100644 --- a/upf_p4_sw/code/one/iac/upf_p4_sw.tf.j2 +++ b/upf_p4_sw/code/one/iac/upf_p4_sw.tf.j2 @@ -10,7 +10,7 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { NETCFG_TYPE = "interfaces" SET_HOSTNAME = "$NAME" USERNAME = "jenkins" - SSH_PUBLIC_KEY = "$USER[SSH_PUBLIC_KEY]" + SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" } {% for network in one_upf_p4_sw_networks %} diff --git a/vm_kvm/code/one/iac/vm_kvm.tf.j2 b/vm_kvm/code/one/iac/vm_kvm.tf.j2 index f91d78a0..7842c8ff 100644 --- a/vm_kvm/code/one/iac/vm_kvm.tf.j2 +++ b/vm_kvm/code/one/iac/vm_kvm.tf.j2 @@ -12,7 +12,7 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { NETCFG_TYPE = "interfaces" SET_HOSTNAME = "$NAME" USERNAME = "jenkins" - SSH_PUBLIC_KEY = "$USER[SSH_PUBLIC_KEY]" + SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" } {# ### Disabled the possibility to modify VM's size due to a problem with Terraform's OpenNebula Provider diff --git a/xrext/code/one/iac/xrext.tf.j2 b/xrext/code/one/iac/xrext.tf.j2 index cb1da15e..68936306 100644 --- a/xrext/code/one/iac/xrext.tf.j2 +++ b/xrext/code/one/iac/xrext.tf.j2 @@ -12,7 +12,7 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { NETCFG_TYPE = "interfaces" SET_HOSTNAME = "$NAME" USERNAME = "jenkins" - SSH_PUBLIC_KEY = "$USER[SSH_PUBLIC_KEY]" + SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" ONEAPP_XR_CAPIF_API_NAME = "{{ one_xr_capif_api_name }}" ONEAPP_XR_CAPIF_HTTPS_HOST = "{{ one_xr_capif_https_host }}" ONEAPP_XR_CAPIF_HTTPS_PORT = "{{ one_xr_capif_https_port }}" From 7f0430bf0f3f7648c4680c335aaa57aef262b1c1 Mon Sep 17 00:00:00 2001 From: raulluzon Date: Thu, 9 Jul 2026 14:35:33 +0200 Subject: [PATCH 11/33] fix: replace -J ProxyJump with explicit ProxyCommand on all VM components ProxyJump (-J) does not forward -o KexAlgorithms to the bastion hop; it uses system defaults for the proxy connection. Bastions running the Open5GS appliance image advertise kex-strict-s-v00@openssh.com, which causes the proxy hop to fail with "kex_exchange_identification: Connection closed by remote host" even when KexAlgorithms=curve25519-sha256 is set for the target connection. Replace -J with an explicit ProxyCommand that runs ssh+nc and carries KexAlgorithms=curve25519-sha256 for the bastion hop, and also sets it for the final hop. Fixes SSH connectivity for all 21 VM components that use a bastion proxy. Multi-hop variants (oneKE, open5gs_k8s, ocf) are left unchanged. Co-Authored-By: Claude Sonnet 4.6 --- .dummy_component/code/component_playbook.yaml | 9 ++++++++- elcm/code/component_playbook.yaml | 9 ++++++++- grafana/code/component_playbook.yaml | 9 ++++++++- influxdb/code/component_playbook.yaml | 9 ++++++++- int_p4_sw/code/component_playbook.yaml | 18 ++++++++++++++++-- ixc_endpoint/code/component_playbook.yaml | 9 ++++++++- ks8500_runner/code/component_playbook.yaml | 9 ++++++++- loadcore_agent/code/component_playbook.yaml | 9 ++++++++- mongodb/code/component_playbook.yaml | 9 ++++++++- monitoring/code/component_playbook.yaml | 9 ++++++++- open5gcore_vm/code/component_playbook.yaml | 9 ++++++++- open5gs_vm/code/component_playbook.yaml | 9 ++++++++- opensand_gw/code/component_playbook.yaml | 9 ++++++++- opensand_sat/code/component_playbook.yaml | 9 ++++++++- opensand_st/code/component_playbook.yaml | 9 ++++++++- prometheus/code/component_playbook.yaml | 9 ++++++++- qosium_probe/code/component_playbook.yaml | 9 ++++++++- ueransim/code/component_playbook.yaml | 9 ++++++++- upf_p4_sw/code/component_playbook.yaml | 9 ++++++++- vm_kvm/code/component_playbook.yaml | 9 ++++++++- xrext/code/component_playbook.yaml | 9 ++++++++- 21 files changed, 176 insertions(+), 22 deletions(-) diff --git a/.dummy_component/code/component_playbook.yaml b/.dummy_component/code/component_playbook.yaml index 264f822c..20b53234 100644 --- a/.dummy_component/code/component_playbook.yaml +++ b/.dummy_component/code/component_playbook.yaml @@ -86,7 +86,14 @@ ansible.builtin.add_host: hostname: "new_host" ansible_host: "{{ ips[access_vnet_id] }}" - ansible_ssh_common_args: "-J jenkins@{{ bastion_ip }}" + ansible_ssh_common_args: >- + -F /dev/null + -o ControlMaster=no + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 + -o KexAlgorithms=curve25519-sha256 + -o StrictHostKeyChecking=no + -o UserKnownHostsFile=/dev/null ansible_user: "jenkins" # While not used by the Jenkins, we included the configuration of a .ssh/config per TN in the Jenkins VM for debugging purposes. diff --git a/elcm/code/component_playbook.yaml b/elcm/code/component_playbook.yaml index 4b0066e3..95454979 100644 --- a/elcm/code/component_playbook.yaml +++ b/elcm/code/component_playbook.yaml @@ -70,7 +70,14 @@ ansible.builtin.add_host: hostname: "elcm" ansible_host: "{{ ips[access_vnet_id] }}" - ansible_ssh_common_args: "-J jenkins@{{ bastion_ip }}" + ansible_ssh_common_args: >- + -F /dev/null + -o ControlMaster=no + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 + -o KexAlgorithms=curve25519-sha256 + -o StrictHostKeyChecking=no + -o UserKnownHostsFile=/dev/null ansible_user: "jenkins" - name: Add new VM to SSH config file in the Jenkins-master for debugging purposes diff --git a/grafana/code/component_playbook.yaml b/grafana/code/component_playbook.yaml index 35a47e69..ed098912 100644 --- a/grafana/code/component_playbook.yaml +++ b/grafana/code/component_playbook.yaml @@ -50,7 +50,14 @@ ansible.builtin.add_host: hostname: "grafana" ansible_host: "{{ ips[access_vnet_id] }}" - ansible_ssh_common_args: "-J jenkins@{{ bastion_ip }}" + ansible_ssh_common_args: >- + -F /dev/null + -o ControlMaster=no + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 + -o KexAlgorithms=curve25519-sha256 + -o StrictHostKeyChecking=no + -o UserKnownHostsFile=/dev/null ansible_user: "jenkins" - name: Add new VM to SSH config file in the Jenkins-master for debugging purposes diff --git a/influxdb/code/component_playbook.yaml b/influxdb/code/component_playbook.yaml index a92eb3a1..a58938e5 100644 --- a/influxdb/code/component_playbook.yaml +++ b/influxdb/code/component_playbook.yaml @@ -50,7 +50,14 @@ ansible.builtin.add_host: hostname: "influxdb" ansible_host: "{{ ips[access_vnet_id] }}" - ansible_ssh_common_args: "-J jenkins@{{ bastion_ip }}" + ansible_ssh_common_args: >- + -F /dev/null + -o ControlMaster=no + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 + -o KexAlgorithms=curve25519-sha256 + -o StrictHostKeyChecking=no + -o UserKnownHostsFile=/dev/null ansible_user: "jenkins" - name: Add new VM to SSH config file in the Jenkins-master for debugging purposes diff --git a/int_p4_sw/code/component_playbook.yaml b/int_p4_sw/code/component_playbook.yaml index 5e5decec..c6b7ffce 100644 --- a/int_p4_sw/code/component_playbook.yaml +++ b/int_p4_sw/code/component_playbook.yaml @@ -56,7 +56,14 @@ ansible.builtin.add_host: hostname: "int_p4_switch_{{ item.key }}" ansible_host: "{{ item.value[switch_first_vnet_id] }}" - ansible_ssh_common_args: "-J jenkins@{{ bastion_ip }}" + ansible_ssh_common_args: >- + -F /dev/null + -o ControlMaster=no + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 + -o KexAlgorithms=curve25519-sha256 + -o StrictHostKeyChecking=no + -o UserKnownHostsFile=/dev/null ansible_user: "jenkins" loop: "{{ switch_ips | dict2items }}" @@ -65,7 +72,14 @@ ansible.builtin.add_host: hostname: "int_p4_collector" ansible_host: "{{ collector_ips[collector_first_vnet_id] }}" - ansible_ssh_common_args: "-J jenkins@{{ bastion_ip }}" + ansible_ssh_common_args: >- + -F /dev/null + -o ControlMaster=no + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 + -o KexAlgorithms=curve25519-sha256 + -o StrictHostKeyChecking=no + -o UserKnownHostsFile=/dev/null ansible_user: "jenkins" - name: Add new VM to SSH config file in the Jenkins-master for debugging purposes diff --git a/ixc_endpoint/code/component_playbook.yaml b/ixc_endpoint/code/component_playbook.yaml index 9c263941..eb5b992a 100644 --- a/ixc_endpoint/code/component_playbook.yaml +++ b/ixc_endpoint/code/component_playbook.yaml @@ -50,7 +50,14 @@ ansible.builtin.add_host: hostname: "endpoint" ansible_host: "{{ ips[access_vnet_id] }}" - ansible_ssh_common_args: "-J jenkins@{{ bastion_ip }}" + ansible_ssh_common_args: >- + -F /dev/null + -o ControlMaster=no + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 + -o KexAlgorithms=curve25519-sha256 + -o StrictHostKeyChecking=no + -o UserKnownHostsFile=/dev/null ansible_user: "jenkins" - name: Add the bastion to Ansible Inventory diff --git a/ks8500_runner/code/component_playbook.yaml b/ks8500_runner/code/component_playbook.yaml index 2ba5c717..fc70a215 100644 --- a/ks8500_runner/code/component_playbook.yaml +++ b/ks8500_runner/code/component_playbook.yaml @@ -40,7 +40,14 @@ ansible.builtin.add_host: hostname: "ks8500runner" ansible_host: "{{ ips[access_vnet_id] }}" - ansible_ssh_common_args: "-J jenkins@{{ bastion_ip }}" + ansible_ssh_common_args: >- + -F /dev/null + -o ControlMaster=no + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 + -o KexAlgorithms=curve25519-sha256 + -o StrictHostKeyChecking=no + -o UserKnownHostsFile=/dev/null ansible_user: "jenkins" - name: Add tn_bastion to Ansible Inventory diff --git a/loadcore_agent/code/component_playbook.yaml b/loadcore_agent/code/component_playbook.yaml index 20507494..6aa3f469 100644 --- a/loadcore_agent/code/component_playbook.yaml +++ b/loadcore_agent/code/component_playbook.yaml @@ -53,7 +53,14 @@ ansible.builtin.add_host: hostname: "loadcore_agent" ansible_host: "{{ ips[access_vnet_id][0] }}" - ansible_ssh_common_args: "-J jenkins@{{ bastion_ip }}" + ansible_ssh_common_args: >- + -F /dev/null + -o ControlMaster=no + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 + -o KexAlgorithms=curve25519-sha256 + -o StrictHostKeyChecking=no + -o UserKnownHostsFile=/dev/null ansible_user: "jenkins" - name: Add tn_bastion to Ansible Inventory diff --git a/mongodb/code/component_playbook.yaml b/mongodb/code/component_playbook.yaml index 201e255f..caaf4c0c 100644 --- a/mongodb/code/component_playbook.yaml +++ b/mongodb/code/component_playbook.yaml @@ -50,7 +50,14 @@ ansible.builtin.add_host: hostname: "mongodb" ansible_host: "{{ ips[access_vnet_id] }}" - ansible_ssh_common_args: "-J jenkins@{{ bastion_ip }}" + ansible_ssh_common_args: >- + -F /dev/null + -o ControlMaster=no + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 + -o KexAlgorithms=curve25519-sha256 + -o StrictHostKeyChecking=no + -o UserKnownHostsFile=/dev/null ansible_user: "jenkins" - name: Add new VM to SSH config file in the Jenkins-master for debugging purposes diff --git a/monitoring/code/component_playbook.yaml b/monitoring/code/component_playbook.yaml index 853b63fa..daa03376 100644 --- a/monitoring/code/component_playbook.yaml +++ b/monitoring/code/component_playbook.yaml @@ -50,7 +50,14 @@ ansible.builtin.add_host: hostname: "monitoring" ansible_host: "{{ ips[access_vnet_id] }}" - ansible_ssh_common_args: "-J jenkins@{{ bastion_ip }}" + ansible_ssh_common_args: >- + -F /dev/null + -o ControlMaster=no + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 + -o KexAlgorithms=curve25519-sha256 + -o StrictHostKeyChecking=no + -o UserKnownHostsFile=/dev/null ansible_user: "jenkins" - name: Add new VM to SSH config file in the Jenkins-master for debugging purposes diff --git a/open5gcore_vm/code/component_playbook.yaml b/open5gcore_vm/code/component_playbook.yaml index e56ce7e9..6f5d1c18 100644 --- a/open5gcore_vm/code/component_playbook.yaml +++ b/open5gcore_vm/code/component_playbook.yaml @@ -80,7 +80,14 @@ ansible.builtin.add_host: hostname: "open5gcore_vm" ansible_host: "{{ ips[access_vnet_id] }}" - ansible_ssh_common_args: "-J jenkins@{{ bastion_ip }}" + ansible_ssh_common_args: >- + -F /dev/null + -o ControlMaster=no + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 + -o KexAlgorithms=curve25519-sha256 + -o StrictHostKeyChecking=no + -o UserKnownHostsFile=/dev/null ansible_user: "jenkins" - name: Add new VM to SSH config file in the Jenkins-master for debugging purposes diff --git a/open5gs_vm/code/component_playbook.yaml b/open5gs_vm/code/component_playbook.yaml index 285c6787..1a2dbb1a 100644 --- a/open5gs_vm/code/component_playbook.yaml +++ b/open5gs_vm/code/component_playbook.yaml @@ -69,7 +69,14 @@ ansible.builtin.add_host: hostname: "open5gs_vm" ansible_host: "{{ ips[access_vnet_id] }}" - ansible_ssh_common_args: "-J jenkins@{{ bastion_ip }} -o KexAlgorithms=curve25519-sha256" + ansible_ssh_common_args: >- + -F /dev/null + -o ControlMaster=no + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 + -o KexAlgorithms=curve25519-sha256 + -o StrictHostKeyChecking=no + -o UserKnownHostsFile=/dev/null ansible_user: "jenkins" - name: Add new VM to SSH config file in the Jenkins-master for debugging purposes diff --git a/opensand_gw/code/component_playbook.yaml b/opensand_gw/code/component_playbook.yaml index 135fc867..272de2dd 100644 --- a/opensand_gw/code/component_playbook.yaml +++ b/opensand_gw/code/component_playbook.yaml @@ -40,7 +40,14 @@ ansible.builtin.add_host: hostname: "opensand_gw" ansible_host: "{{ ips[access_vnet_id] }}" - ansible_ssh_common_args: "-J jenkins@{{ bastion_ip }}" + ansible_ssh_common_args: >- + -F /dev/null + -o ControlMaster=no + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 + -o KexAlgorithms=curve25519-sha256 + -o StrictHostKeyChecking=no + -o UserKnownHostsFile=/dev/null ansible_user: "jenkins" - name: Add new VM to SSH config file in the Jenkins-master for debugging purposes diff --git a/opensand_sat/code/component_playbook.yaml b/opensand_sat/code/component_playbook.yaml index b937d1c1..c7bb6ad6 100644 --- a/opensand_sat/code/component_playbook.yaml +++ b/opensand_sat/code/component_playbook.yaml @@ -40,7 +40,14 @@ ansible.builtin.add_host: hostname: opensand_sat ansible_host: "{{ ips[access_vnet_id] }}" - ansible_ssh_common_args: "-J jenkins@{{ bastion_ip }}" + ansible_ssh_common_args: >- + -F /dev/null + -o ControlMaster=no + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 + -o KexAlgorithms=curve25519-sha256 + -o StrictHostKeyChecking=no + -o UserKnownHostsFile=/dev/null ansible_user: "jenkins" - name: Add new VM to SSH config file in the Jenkins-master for debugging purposes diff --git a/opensand_st/code/component_playbook.yaml b/opensand_st/code/component_playbook.yaml index 1df534b6..8b417e01 100644 --- a/opensand_st/code/component_playbook.yaml +++ b/opensand_st/code/component_playbook.yaml @@ -40,7 +40,14 @@ ansible.builtin.add_host: hostname: opensand_st ansible_host: "{{ ips[access_vnet_id] }}" - ansible_ssh_common_args: "-J jenkins@{{ bastion_ip }}" + ansible_ssh_common_args: >- + -F /dev/null + -o ControlMaster=no + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 + -o KexAlgorithms=curve25519-sha256 + -o StrictHostKeyChecking=no + -o UserKnownHostsFile=/dev/null ansible_user: "jenkins" - name: Add new VM to SSH config file in the Jenkins-master for debugging purposes diff --git a/prometheus/code/component_playbook.yaml b/prometheus/code/component_playbook.yaml index 325527ce..9d3ffa29 100644 --- a/prometheus/code/component_playbook.yaml +++ b/prometheus/code/component_playbook.yaml @@ -50,7 +50,14 @@ ansible.builtin.add_host: hostname: "prometheus" ansible_host: "{{ ips[access_vnet_id] }}" - ansible_ssh_common_args: "-J jenkins@{{ bastion_ip }}" + ansible_ssh_common_args: >- + -F /dev/null + -o ControlMaster=no + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 + -o KexAlgorithms=curve25519-sha256 + -o StrictHostKeyChecking=no + -o UserKnownHostsFile=/dev/null ansible_user: "jenkins" - name: Add new VM to SSH config file in the Jenkins-master for debugging purposes diff --git a/qosium_probe/code/component_playbook.yaml b/qosium_probe/code/component_playbook.yaml index b5be3f95..39a26ef6 100644 --- a/qosium_probe/code/component_playbook.yaml +++ b/qosium_probe/code/component_playbook.yaml @@ -54,7 +54,14 @@ ansible.builtin.add_host: hostname: "qosium_probe" ansible_host: "{{ ips[access_vnet_id] }}" - ansible_ssh_common_args: "-J jenkins@{{ bastion_ip }}" + ansible_ssh_common_args: >- + -F /dev/null + -o ControlMaster=no + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 + -o KexAlgorithms=curve25519-sha256 + -o StrictHostKeyChecking=no + -o UserKnownHostsFile=/dev/null ansible_user: "jenkins" - name: Add new VM to SSH config file in the Jenkins-master for debugging purposes diff --git a/ueransim/code/component_playbook.yaml b/ueransim/code/component_playbook.yaml index 4dbed220..bb345f48 100644 --- a/ueransim/code/component_playbook.yaml +++ b/ueransim/code/component_playbook.yaml @@ -53,7 +53,14 @@ ansible.builtin.add_host: hostname: "ueransim" ansible_host: "{{ ips[access_vnet_id] }}" - ansible_ssh_common_args: "-J jenkins@{{ bastion_ip }}" + ansible_ssh_common_args: >- + -F /dev/null + -o ControlMaster=no + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 + -o KexAlgorithms=curve25519-sha256 + -o StrictHostKeyChecking=no + -o UserKnownHostsFile=/dev/null ansible_user: "jenkins" - name: Add new VM to SSH config file in the Jenkins-master for debugging purposes diff --git a/upf_p4_sw/code/component_playbook.yaml b/upf_p4_sw/code/component_playbook.yaml index dc33dfb7..027f128e 100644 --- a/upf_p4_sw/code/component_playbook.yaml +++ b/upf_p4_sw/code/component_playbook.yaml @@ -59,7 +59,14 @@ ansible.builtin.add_host: hostname: "upf_p4_sw" ansible_host: "{{ ips[access_vnet_id] }}" - ansible_ssh_common_args: "-J jenkins@{{ bastion_ip }}" + ansible_ssh_common_args: >- + -F /dev/null + -o ControlMaster=no + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 + -o KexAlgorithms=curve25519-sha256 + -o StrictHostKeyChecking=no + -o UserKnownHostsFile=/dev/null ansible_user: "jenkins" - name: Display host inventory information diff --git a/vm_kvm/code/component_playbook.yaml b/vm_kvm/code/component_playbook.yaml index ff61aed2..9318d5e9 100644 --- a/vm_kvm/code/component_playbook.yaml +++ b/vm_kvm/code/component_playbook.yaml @@ -53,7 +53,14 @@ ansible.builtin.add_host: hostname: "vm_kvm" ansible_host: "{{ ips[access_vnet_id] }}" - ansible_ssh_common_args: "-J jenkins@{{ bastion_ip }}" + ansible_ssh_common_args: >- + -F /dev/null + -o ControlMaster=no + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 + -o KexAlgorithms=curve25519-sha256 + -o StrictHostKeyChecking=no + -o UserKnownHostsFile=/dev/null ansible_user: "jenkins" - name: Add new VM to SSH config file in the Jenkins-master for debugging purposes diff --git a/xrext/code/component_playbook.yaml b/xrext/code/component_playbook.yaml index e0f302ea..1a96a0f4 100644 --- a/xrext/code/component_playbook.yaml +++ b/xrext/code/component_playbook.yaml @@ -50,7 +50,14 @@ ansible.builtin.add_host: hostname: "xrext" ansible_host: "{{ ips[access_vnet_id] }}" - ansible_ssh_common_args: "-J jenkins@{{ bastion_ip }}" + ansible_ssh_common_args: >- + -F /dev/null + -o ControlMaster=no + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 + -o KexAlgorithms=curve25519-sha256 + -o StrictHostKeyChecking=no + -o UserKnownHostsFile=/dev/null ansible_user: "jenkins" - name: Add the bastion to Ansible Inventory From 3e1068f9fa3296e37aed325d9274fe9b5b34a63d Mon Sep 17 00:00:00 2001 From: raulluzon Date: Fri, 10 Jul 2026 09:48:35 +0200 Subject: [PATCH 12/33] fix: disable unattended-upgrades at VM boot and increase wait_for_connection timeout Ubuntu VMs deployed via OpenNebula one-appliance trigger unattended-upgrades at first boot, which runs in the background for ~16 minutes and restarts openssh-server mid-session. This causes Ansible wait_for_connection to fail with "Connection to closed by remote host" before provisioning can start. Two-part fix applied to all VM components: 1. Add START_SCRIPT_BASE64 to the OpenNebula VM context: stops and masks unattended-upgrades, apt-daily-upgrade, and apt-daily services at first boot, before the apt-daily-upgrade.service timer fires at ~30 seconds post-boot. 2. Increase wait_for_connection timeout from 200s to 600s (10 min per phase, ~20 min total) as a safety net for any remaining boot-time delays. For ks8500_runner and loadcore_agent the existing START_SCRIPT is extended with the unattended-upgrades stop/mask commands prepended. Co-Authored-By: Claude Sonnet 4.6 --- elcm/code/component_playbook.yaml | 2 +- elcm/code/one/iac/elcm.tf.j2 | 3 +++ grafana/code/component_playbook.yaml | 2 +- grafana/code/one/iac/grafana.tf.j2 | 3 +++ influxdb/code/component_playbook.yaml | 2 +- influxdb/code/one/iac/influxdb.tf.j2 | 3 +++ int_p4_sw/code/component_playbook.yaml | 2 +- int_p4_sw/code/one/iac/int_collector_p4_sw.tf.j2 | 3 +++ int_p4_sw/code/one/iac/int_switch_p4_sw.tf.j2 | 3 +++ ixc_endpoint/code/component_playbook.yaml | 2 +- ixc_endpoint/code/one/iac/ixc_endpoint.tf.j2 | 3 +++ ks8500_runner/code/component_playbook.yaml | 2 +- ks8500_runner/code/one/iac/ks8500_runner.tf.j2 | 4 ++-- loadcore_agent/code/component_playbook.yaml | 2 +- loadcore_agent/code/one/iac/loadcore_agent.tf.j2 | 3 ++- mongodb/code/component_playbook.yaml | 2 +- mongodb/code/one/iac/mongodb.tf.j2 | 3 +++ monitoring/code/component_playbook.yaml | 2 +- monitoring/code/one/iac/monitoring.tf.j2 | 3 +++ oneKE/code/component_playbook.yaml | 2 +- open5gcore_vm/code/component_playbook.yaml | 2 +- open5gcore_vm/code/one/iac/open5gcore_vm.tf.j2 | 3 +++ open5gs_vm/code/component_playbook.yaml | 2 +- open5gs_vm/code/one/iac/open5gs_vm.tf.j2 | 13 ++++++++----- opensand_gw/code/component_playbook.yaml | 2 +- opensand_gw/code/one/iac/opensand_gw.tf.j2 | 3 +++ opensand_sat/code/component_playbook.yaml | 2 +- opensand_sat/code/one/iac/opensand_sat.tf.j2 | 3 +++ opensand_st/code/component_playbook.yaml | 2 +- opensand_st/code/one/iac/opensand_st.tf.j2 | 3 +++ prometheus/code/component_playbook.yaml | 2 +- prometheus/code/one/iac/prometheus.tf.j2 | 3 +++ qosium_probe/code/component_playbook.yaml | 2 +- qosium_probe/code/one/iac/qosium_probe.tf.j2 | 3 +++ tn_bastion/code/component_playbook.yaml | 2 +- tn_bastion/code/one/iac/tn_bastion.tf.j2 | 3 +++ tn_init/code/component_playbook.yaml | 2 +- ueransim/code/component_playbook.yaml | 2 +- ueransim/code/one/iac/ueransim.tf.j2 | 3 +++ upf_p4_sw/code/component_playbook.yaml | 2 +- upf_p4_sw/code/one/iac/upf_p4_sw.tf.j2 | 3 +++ vm_kvm/code/component_playbook.yaml | 2 +- vm_kvm/code/one/iac/vm_kvm.tf.j2 | 3 +++ xrext/code/component_playbook.yaml | 2 +- xrext/code/one/iac/xrext.tf.j2 | 3 +++ 45 files changed, 92 insertions(+), 31 deletions(-) diff --git a/elcm/code/component_playbook.yaml b/elcm/code/component_playbook.yaml index 95454979..d6e30a5b 100644 --- a/elcm/code/component_playbook.yaml +++ b/elcm/code/component_playbook.yaml @@ -94,7 +94,7 @@ - name: Wait for system to become reachable ansible.builtin.wait_for_connection: connect_timeout: 5 - timeout: 200 + timeout: 600 - name: Set site ssh key as authorized in jenkins user ansible.posix.authorized_key: diff --git a/elcm/code/one/iac/elcm.tf.j2 b/elcm/code/one/iac/elcm.tf.j2 index 9539150d..4ef80ee8 100644 --- a/elcm/code/one/iac/elcm.tf.j2 +++ b/elcm/code/one/iac/elcm.tf.j2 @@ -13,6 +13,9 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { SET_HOSTNAME = "$NAME" USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" + # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" ONEAPP_ELCM_PORTAL_ENABLE = "YES" ONEAPP_ELCM_INFLUXDB_ENABLE = "YES" ONEAPP_ELCM_INFLUXDB_HOST = "{{ influxdb_configuration.host }}" diff --git a/grafana/code/component_playbook.yaml b/grafana/code/component_playbook.yaml index ed098912..0446c404 100644 --- a/grafana/code/component_playbook.yaml +++ b/grafana/code/component_playbook.yaml @@ -74,7 +74,7 @@ - name: Wait for system to become reachable ansible.builtin.wait_for_connection: connect_timeout: 5 - timeout: 200 + timeout: 600 - name: Set site ssh key as authorized in jenkins user ansible.posix.authorized_key: diff --git a/grafana/code/one/iac/grafana.tf.j2 b/grafana/code/one/iac/grafana.tf.j2 index c7d5016f..5706abb5 100644 --- a/grafana/code/one/iac/grafana.tf.j2 +++ b/grafana/code/one/iac/grafana.tf.j2 @@ -13,6 +13,9 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { SET_HOSTNAME = "$NAME" USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" + # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" ONEAPP_GRAFANA_VERSION = "{{ one_grafana_version }}" ONEAPP_GRAFANA_ADMIN_PASSWORD = "{{ one_grafana_password }}" } diff --git a/influxdb/code/component_playbook.yaml b/influxdb/code/component_playbook.yaml index a58938e5..996c05c0 100644 --- a/influxdb/code/component_playbook.yaml +++ b/influxdb/code/component_playbook.yaml @@ -74,7 +74,7 @@ - name: Wait for system to become reachable ansible.builtin.wait_for_connection: connect_timeout: 5 - timeout: 200 + timeout: 600 - name: Set site ssh key as authorized in jenkins user ansible.posix.authorized_key: diff --git a/influxdb/code/one/iac/influxdb.tf.j2 b/influxdb/code/one/iac/influxdb.tf.j2 index 22fdb174..19f866e6 100644 --- a/influxdb/code/one/iac/influxdb.tf.j2 +++ b/influxdb/code/one/iac/influxdb.tf.j2 @@ -13,6 +13,9 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { SET_HOSTNAME = "$NAME" USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" + # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" ONEAPP_INFLUXDB_VERSION = "{{ one_influxdb_version }}" ONEAPP_INFLUXDB_USER = "{{ one_influxdb_user }}" ONEAPP_INFLUXDB_PASSWORD = "{{ one_influxdb_password }}" diff --git a/int_p4_sw/code/component_playbook.yaml b/int_p4_sw/code/component_playbook.yaml index c6b7ffce..865fb29d 100644 --- a/int_p4_sw/code/component_playbook.yaml +++ b/int_p4_sw/code/component_playbook.yaml @@ -95,7 +95,7 @@ - name: Wait for system to become reachable ansible.builtin.wait_for_connection: connect_timeout: 5 - timeout: 200 + timeout: 600 - name: Set site ssh key as authorized in jenkins user ansible.posix.authorized_key: diff --git a/int_p4_sw/code/one/iac/int_collector_p4_sw.tf.j2 b/int_p4_sw/code/one/iac/int_collector_p4_sw.tf.j2 index d6a81358..52d83cb1 100644 --- a/int_p4_sw/code/one/iac/int_collector_p4_sw.tf.j2 +++ b/int_p4_sw/code/one/iac/int_collector_p4_sw.tf.j2 @@ -11,6 +11,9 @@ resource "opennebula_virtual_machine" "{{ entity_name }}_collector" { SET_HOSTNAME = "$NAME" USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" + # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" } {# ### Disabled the possibility to modify VM's size due to a problem with Terraform's OpenNebula Provider diff --git a/int_p4_sw/code/one/iac/int_switch_p4_sw.tf.j2 b/int_p4_sw/code/one/iac/int_switch_p4_sw.tf.j2 index d299bfd5..99cd6087 100644 --- a/int_p4_sw/code/one/iac/int_switch_p4_sw.tf.j2 +++ b/int_p4_sw/code/one/iac/int_switch_p4_sw.tf.j2 @@ -13,6 +13,9 @@ resource "opennebula_virtual_machine" "{{ entity_name }}_{{ switch_index }}" { SET_HOSTNAME = "$NAME" USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" + # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" } {% for network in switch_config.networks %} diff --git a/ixc_endpoint/code/component_playbook.yaml b/ixc_endpoint/code/component_playbook.yaml index eb5b992a..11ebba28 100644 --- a/ixc_endpoint/code/component_playbook.yaml +++ b/ixc_endpoint/code/component_playbook.yaml @@ -80,7 +80,7 @@ - name: Wait for system to become reachable ansible.builtin.wait_for_connection: connect_timeout: 5 - timeout: 200 + timeout: 600 - name: Set site ssh key as authorized in jenkins user ansible.posix.authorized_key: diff --git a/ixc_endpoint/code/one/iac/ixc_endpoint.tf.j2 b/ixc_endpoint/code/one/iac/ixc_endpoint.tf.j2 index 6c6338f4..eaa1c783 100644 --- a/ixc_endpoint/code/one/iac/ixc_endpoint.tf.j2 +++ b/ixc_endpoint/code/one/iac/ixc_endpoint.tf.j2 @@ -10,6 +10,9 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { SET_HOSTNAME = "$NAME" USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" + # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" ONEAPP_IXCHARIOT_ENDPOINT_RS_ADDRESS = "{{ one_ixc_endpoint_rs }}" } diff --git a/ks8500_runner/code/component_playbook.yaml b/ks8500_runner/code/component_playbook.yaml index fc70a215..b4a23e2d 100644 --- a/ks8500_runner/code/component_playbook.yaml +++ b/ks8500_runner/code/component_playbook.yaml @@ -87,7 +87,7 @@ - name: Wait for system to become reachable ansible.builtin.wait_for_connection: connect_timeout: 5 - timeout: 200 + timeout: 600 - name: Load enviromental variables from different sources ansible.builtin.include_tasks: "{{ workspace }}/.global/cac/load_variables.yaml" diff --git a/ks8500_runner/code/one/iac/ks8500_runner.tf.j2 b/ks8500_runner/code/one/iac/ks8500_runner.tf.j2 index ba7b4d3e..0348800f 100644 --- a/ks8500_runner/code/one/iac/ks8500_runner.tf.j2 +++ b/ks8500_runner/code/one/iac/ks8500_runner.tf.j2 @@ -14,8 +14,8 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { USERNAME: "jenkins" PASSWORD: "keysight" SSH_PUBLIC_KEY: "{{ jenkins_ssh_public_key }}" - # install apt install python3 -y; growpart /dev/vda 1; resize2fs /dev/vda1 - START_SCRIPT_BASE64: "IyEvYmluL2Jhc2gKZ3Jvd3BhcnQgL2Rldi92ZGEgMQpyZXNpemUyZnMgL2Rldi92ZGExCmFwdCBpbnN0YWxsIHB5dGhvbjMgLXk=" + # Disable unattended-upgrades at first boot; then growpart + resize2fs + apt install python3 + START_SCRIPT_BASE64: "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCmdyb3dwYXJ0IC9kZXYvdmRhIDEKcmVzaXplMmZzIC9kZXYvdmRhMQphcHQgaW5zdGFsbCBweXRob24zIC15Cg==" } # Ignore changes in the disk argument due to limitations in the OpenNebula Terraform provider (#598) diff --git a/loadcore_agent/code/component_playbook.yaml b/loadcore_agent/code/component_playbook.yaml index 6aa3f469..7d7b363e 100644 --- a/loadcore_agent/code/component_playbook.yaml +++ b/loadcore_agent/code/component_playbook.yaml @@ -83,7 +83,7 @@ - name: Wait for system to become reachable ansible.builtin.wait_for_connection: connect_timeout: 5 - timeout: 200 + timeout: 600 - name: Load enviromental variables from different sources ansible.builtin.include_tasks: "{{ workspace }}/.global/cac/load_variables.yaml" diff --git a/loadcore_agent/code/one/iac/loadcore_agent.tf.j2 b/loadcore_agent/code/one/iac/loadcore_agent.tf.j2 index 25246f35..0a21c769 100644 --- a/loadcore_agent/code/one/iac/loadcore_agent.tf.j2 +++ b/loadcore_agent/code/one/iac/loadcore_agent.tf.j2 @@ -13,7 +13,8 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { SET_HOSTNAME = "$NAME" USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" - START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKZ3Jvd3BhcnQgL2Rldi92ZGEgMQpyZXNpemUyZnMgL2Rldi92ZGEx" + # Disable unattended-upgrades at first boot; then growpart + resize2fs + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCmdyb3dwYXJ0IC9kZXYvdmRhIDEKcmVzaXplMmZzIC9kZXYvdmRhMQo=" } # Ignore changes in the disk argument due to limitations in the OpenNebula Terraform provider (#598) diff --git a/mongodb/code/component_playbook.yaml b/mongodb/code/component_playbook.yaml index caaf4c0c..88563819 100644 --- a/mongodb/code/component_playbook.yaml +++ b/mongodb/code/component_playbook.yaml @@ -71,7 +71,7 @@ - name: Wait for system to become reachable ansible.builtin.wait_for_connection: connect_timeout: 5 - timeout: 200 + timeout: 600 - name: Set site ssh key as authorized in jenkins user ansible.posix.authorized_key: diff --git a/mongodb/code/one/iac/mongodb.tf.j2 b/mongodb/code/one/iac/mongodb.tf.j2 index 2aa5e2e1..c446e636 100644 --- a/mongodb/code/one/iac/mongodb.tf.j2 +++ b/mongodb/code/one/iac/mongodb.tf.j2 @@ -13,6 +13,9 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { SET_HOSTNAME = "$NAME" USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" + # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" ONEAPP_MONGODB_VERSION = "{{ one_mongodb_version }}" ONEAPP_MONGODB_USER = "{{ one_mongodb_user }}" ONEAPP_MONGODB_PASSWORD = "{{ one_mongodb_password }}" diff --git a/monitoring/code/component_playbook.yaml b/monitoring/code/component_playbook.yaml index daa03376..9d7aee38 100644 --- a/monitoring/code/component_playbook.yaml +++ b/monitoring/code/component_playbook.yaml @@ -71,7 +71,7 @@ - name: Wait for system to become reachable ansible.builtin.wait_for_connection: connect_timeout: 5 - timeout: 200 + timeout: 600 - name: Set site ssh key as authorized in jenkins user ansible.posix.authorized_key: diff --git a/monitoring/code/one/iac/monitoring.tf.j2 b/monitoring/code/one/iac/monitoring.tf.j2 index 7e781842..6c42afd6 100644 --- a/monitoring/code/one/iac/monitoring.tf.j2 +++ b/monitoring/code/one/iac/monitoring.tf.j2 @@ -13,6 +13,9 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { SET_HOSTNAME = "$NAME" USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" + # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" ONEAPP_INFLUXDB_VERSION = "{{ one_influxdb_version }}" ONEAPP_INFLUXDB_USER = "{{ one_influxdb_user }}" ONEAPP_INFLUXDB_PASSWORD = "{{ one_influxdb_password }}" diff --git a/oneKE/code/component_playbook.yaml b/oneKE/code/component_playbook.yaml index 9d07da28..6e0be3cb 100644 --- a/oneKE/code/component_playbook.yaml +++ b/oneKE/code/component_playbook.yaml @@ -109,7 +109,7 @@ - name: Wait for system to become reachable ansible.builtin.wait_for_connection: connect_timeout: 5 - timeout: 200 + timeout: 600 - name: Set site ssh key as authorized in jenkins user ansible.posix.authorized_key: diff --git a/open5gcore_vm/code/component_playbook.yaml b/open5gcore_vm/code/component_playbook.yaml index 6f5d1c18..bdd257e9 100644 --- a/open5gcore_vm/code/component_playbook.yaml +++ b/open5gcore_vm/code/component_playbook.yaml @@ -101,7 +101,7 @@ - name: Wait for system to become reachable ansible.builtin.wait_for_connection: connect_timeout: 5 - timeout: 200 + timeout: 600 - name: Load enviromental variables from different sources ansible.builtin.include_tasks: "{{ workspace }}/.global/cac/load_variables.yaml" diff --git a/open5gcore_vm/code/one/iac/open5gcore_vm.tf.j2 b/open5gcore_vm/code/one/iac/open5gcore_vm.tf.j2 index 47807e5c..73841807 100644 --- a/open5gcore_vm/code/one/iac/open5gcore_vm.tf.j2 +++ b/open5gcore_vm/code/one/iac/open5gcore_vm.tf.j2 @@ -13,6 +13,9 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { SET_HOSTNAME = "$NAME" USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" + # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" } {# ### Disabled the possibility to modify VM's size due to a problem with Terraform's OpenNebula Provider diff --git a/open5gs_vm/code/component_playbook.yaml b/open5gs_vm/code/component_playbook.yaml index 1a2dbb1a..5c176485 100644 --- a/open5gs_vm/code/component_playbook.yaml +++ b/open5gs_vm/code/component_playbook.yaml @@ -93,7 +93,7 @@ - name: Wait for system to become reachable ansible.builtin.wait_for_connection: connect_timeout: 5 - timeout: 200 + timeout: 600 - name: Load enviromental variables from different sources ansible.builtin.include_tasks: "{{ workspace }}/.global/cac/load_variables.yaml" diff --git a/open5gs_vm/code/one/iac/open5gs_vm.tf.j2 b/open5gs_vm/code/one/iac/open5gs_vm.tf.j2 index df8fe92d..e93b0fd4 100644 --- a/open5gs_vm/code/one/iac/open5gs_vm.tf.j2 +++ b/open5gs_vm/code/one/iac/open5gs_vm.tf.j2 @@ -8,11 +8,14 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { memory = {{ one_open5gs_vm_memory }} context = { - NETWORK = "YES" - NETCFG_TYPE = "interfaces" - SET_HOSTNAME = "$NAME" - USERNAME = "jenkins" - SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" + NETWORK = "YES" + NETCFG_TYPE = "interfaces" + SET_HOSTNAME = "$NAME" + USERNAME = "jenkins" + SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" + # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" } {# ### Disabled the possibility to modify VM's size due to a problem with Terraform's OpenNebula Provider diff --git a/opensand_gw/code/component_playbook.yaml b/opensand_gw/code/component_playbook.yaml index 272de2dd..cbf0e7ac 100644 --- a/opensand_gw/code/component_playbook.yaml +++ b/opensand_gw/code/component_playbook.yaml @@ -61,7 +61,7 @@ - name: Wait for system to become reachable ansible.builtin.wait_for_connection: connect_timeout: 5 - timeout: 200 + timeout: 600 - name: Set site ssh key as authorized in jenkins user diff --git a/opensand_gw/code/one/iac/opensand_gw.tf.j2 b/opensand_gw/code/one/iac/opensand_gw.tf.j2 index 8fd840e0..cfdd6364 100644 --- a/opensand_gw/code/one/iac/opensand_gw.tf.j2 +++ b/opensand_gw/code/one/iac/opensand_gw.tf.j2 @@ -15,6 +15,9 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { SET_HOSTNAME = "$NAME" USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" + # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" } diff --git a/opensand_sat/code/component_playbook.yaml b/opensand_sat/code/component_playbook.yaml index c7bb6ad6..675b7493 100644 --- a/opensand_sat/code/component_playbook.yaml +++ b/opensand_sat/code/component_playbook.yaml @@ -61,7 +61,7 @@ - name: Wait for system to become reachable ansible.builtin.wait_for_connection: connect_timeout: 5 - timeout: 200 + timeout: 600 - name: Set site ssh key as authorized in jenkins user ansible.posix.authorized_key: diff --git a/opensand_sat/code/one/iac/opensand_sat.tf.j2 b/opensand_sat/code/one/iac/opensand_sat.tf.j2 index f5eedbb9..181e1ed5 100644 --- a/opensand_sat/code/one/iac/opensand_sat.tf.j2 +++ b/opensand_sat/code/one/iac/opensand_sat.tf.j2 @@ -15,6 +15,9 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { SET_HOSTNAME = "$NAME" USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" + # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" } diff --git a/opensand_st/code/component_playbook.yaml b/opensand_st/code/component_playbook.yaml index 8b417e01..b1ac9471 100644 --- a/opensand_st/code/component_playbook.yaml +++ b/opensand_st/code/component_playbook.yaml @@ -61,7 +61,7 @@ - name: Wait for system to become reachable ansible.builtin.wait_for_connection: connect_timeout: 5 - timeout: 200 + timeout: 600 - name: Set site ssh key as authorized in jenkins user ansible.posix.authorized_key: diff --git a/opensand_st/code/one/iac/opensand_st.tf.j2 b/opensand_st/code/one/iac/opensand_st.tf.j2 index f3956524..1d8d0faf 100644 --- a/opensand_st/code/one/iac/opensand_st.tf.j2 +++ b/opensand_st/code/one/iac/opensand_st.tf.j2 @@ -15,6 +15,9 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { SET_HOSTNAME = "$NAME" USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" + # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" } diff --git a/prometheus/code/component_playbook.yaml b/prometheus/code/component_playbook.yaml index 9d3ffa29..57433244 100644 --- a/prometheus/code/component_playbook.yaml +++ b/prometheus/code/component_playbook.yaml @@ -74,7 +74,7 @@ - name: Wait for system to become reachable ansible.builtin.wait_for_connection: connect_timeout: 5 - timeout: 200 + timeout: 600 - name: Set site ssh key as authorized in jenkins user ansible.posix.authorized_key: diff --git a/prometheus/code/one/iac/prometheus.tf.j2 b/prometheus/code/one/iac/prometheus.tf.j2 index b8bba2cd..57b014aa 100644 --- a/prometheus/code/one/iac/prometheus.tf.j2 +++ b/prometheus/code/one/iac/prometheus.tf.j2 @@ -13,6 +13,9 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { SET_HOSTNAME = "$NAME" USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" + # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" ONEAPP_PROMETHEUS_VERSION = "{{ one_prometheus_version }}" } diff --git a/qosium_probe/code/component_playbook.yaml b/qosium_probe/code/component_playbook.yaml index 39a26ef6..900c229b 100644 --- a/qosium_probe/code/component_playbook.yaml +++ b/qosium_probe/code/component_playbook.yaml @@ -79,7 +79,7 @@ - name: Wait for system to become reachable ansible.builtin.wait_for_connection: connect_timeout: 5 - timeout: 200 + timeout: 600 - name: Load enviromental variables from different sources ansible.builtin.include_tasks: "{{ workspace }}/.global/cac/load_variables.yaml" diff --git a/qosium_probe/code/one/iac/qosium_probe.tf.j2 b/qosium_probe/code/one/iac/qosium_probe.tf.j2 index aa2ca074..60884439 100644 --- a/qosium_probe/code/one/iac/qosium_probe.tf.j2 +++ b/qosium_probe/code/one/iac/qosium_probe.tf.j2 @@ -13,6 +13,9 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { SET_HOSTNAME = "$NAME" USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" + # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" } {# ### Disabled the possibility to modify VM's size due to a Terraform OpenNebula Provider's error diff --git a/tn_bastion/code/component_playbook.yaml b/tn_bastion/code/component_playbook.yaml index 6b8e1391..7e7e775c 100644 --- a/tn_bastion/code/component_playbook.yaml +++ b/tn_bastion/code/component_playbook.yaml @@ -56,7 +56,7 @@ - name: Wait for system to become reachable ansible.builtin.wait_for_connection: connect_timeout: 5 - timeout: 200 + timeout: 600 - name: Wait again until one-appliance contextualization scripts have finished become: true diff --git a/tn_bastion/code/one/iac/tn_bastion.tf.j2 b/tn_bastion/code/one/iac/tn_bastion.tf.j2 index ec853336..3f39b09e 100644 --- a/tn_bastion/code/one/iac/tn_bastion.tf.j2 +++ b/tn_bastion/code/one/iac/tn_bastion.tf.j2 @@ -13,6 +13,9 @@ resource "opennebula_virtual_machine" "tn_bastion" { SET_HOSTNAME = "$NAME" USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" + # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" TOKEN = "YES" ONEAPP_BASTION_DNS_PASSWORD = "" ONEAPP_BASTION_DNS_FORWARDERS = "{{ site_dns | default('8.8.8.8,1.1.1.1') }}" diff --git a/tn_init/code/component_playbook.yaml b/tn_init/code/component_playbook.yaml index 8a48cf12..83903847 100644 --- a/tn_init/code/component_playbook.yaml +++ b/tn_init/code/component_playbook.yaml @@ -56,7 +56,7 @@ - name: Wait for system to become reachable ansible.builtin.wait_for_connection: connect_timeout: 5 - timeout: 200 + timeout: 600 - name: Wait again until one-appliance contextualization scripts have finished become: true diff --git a/ueransim/code/component_playbook.yaml b/ueransim/code/component_playbook.yaml index bb345f48..de8967a2 100644 --- a/ueransim/code/component_playbook.yaml +++ b/ueransim/code/component_playbook.yaml @@ -77,7 +77,7 @@ - name: Wait for system to become reachable ansible.builtin.wait_for_connection: connect_timeout: 5 - timeout: 200 + timeout: 600 - name: Wait again until one-appliance contextualization scripts have finished become: true diff --git a/ueransim/code/one/iac/ueransim.tf.j2 b/ueransim/code/one/iac/ueransim.tf.j2 index 1f9bb65c..7bcef829 100644 --- a/ueransim/code/one/iac/ueransim.tf.j2 +++ b/ueransim/code/one/iac/ueransim.tf.j2 @@ -13,6 +13,9 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { SET_HOSTNAME = "$NAME" USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" + # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" {% if one_ueransim_mode in ['gnb', 'both'] %} ONEAPP_UERANSIM_RUN_GNB = "{% if one_ueransim_run_gnb %}YES{% else %}NO{% endif %}" ONEAPP_UERANSIM_GNB_AMF_IP = "{{ one_ueransim_gnb_amf_n2_ip }}" diff --git a/upf_p4_sw/code/component_playbook.yaml b/upf_p4_sw/code/component_playbook.yaml index 027f128e..47ed44dd 100644 --- a/upf_p4_sw/code/component_playbook.yaml +++ b/upf_p4_sw/code/component_playbook.yaml @@ -92,7 +92,7 @@ - name: Wait for system to become reachable ansible.builtin.wait_for_connection: connect_timeout: 5 - timeout: 200 + timeout: 600 - name: Set site ssh key as authorized in jenkins user ansible.posix.authorized_key: diff --git a/upf_p4_sw/code/one/iac/upf_p4_sw.tf.j2 b/upf_p4_sw/code/one/iac/upf_p4_sw.tf.j2 index 9bdaa069..8941b747 100644 --- a/upf_p4_sw/code/one/iac/upf_p4_sw.tf.j2 +++ b/upf_p4_sw/code/one/iac/upf_p4_sw.tf.j2 @@ -11,6 +11,9 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { SET_HOSTNAME = "$NAME" USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" + # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" } {% for network in one_upf_p4_sw_networks %} diff --git a/vm_kvm/code/component_playbook.yaml b/vm_kvm/code/component_playbook.yaml index 9318d5e9..7b498df7 100644 --- a/vm_kvm/code/component_playbook.yaml +++ b/vm_kvm/code/component_playbook.yaml @@ -77,7 +77,7 @@ - name: Wait for system to become reachable ansible.builtin.wait_for_connection: connect_timeout: 5 - timeout: 200 + timeout: 600 - name: Set site ssh key as authorized in jenkins user ansible.posix.authorized_key: diff --git a/vm_kvm/code/one/iac/vm_kvm.tf.j2 b/vm_kvm/code/one/iac/vm_kvm.tf.j2 index 7842c8ff..cc58d252 100644 --- a/vm_kvm/code/one/iac/vm_kvm.tf.j2 +++ b/vm_kvm/code/one/iac/vm_kvm.tf.j2 @@ -13,6 +13,9 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { SET_HOSTNAME = "$NAME" USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" + # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" } {# ### Disabled the possibility to modify VM's size due to a problem with Terraform's OpenNebula Provider diff --git a/xrext/code/component_playbook.yaml b/xrext/code/component_playbook.yaml index 1a96a0f4..0ab1d206 100644 --- a/xrext/code/component_playbook.yaml +++ b/xrext/code/component_playbook.yaml @@ -80,7 +80,7 @@ - name: Wait for system to become reachable ansible.builtin.wait_for_connection: connect_timeout: 5 - timeout: 200 + timeout: 600 - name: Set site ssh key as authorized in jenkins user ansible.posix.authorized_key: diff --git a/xrext/code/one/iac/xrext.tf.j2 b/xrext/code/one/iac/xrext.tf.j2 index 68936306..afac64a0 100644 --- a/xrext/code/one/iac/xrext.tf.j2 +++ b/xrext/code/one/iac/xrext.tf.j2 @@ -13,6 +13,9 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { SET_HOSTNAME = "$NAME" USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" + # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" ONEAPP_XR_CAPIF_API_NAME = "{{ one_xr_capif_api_name }}" ONEAPP_XR_CAPIF_HTTPS_HOST = "{{ one_xr_capif_https_host }}" ONEAPP_XR_CAPIF_HTTPS_PORT = "{{ one_xr_capif_https_port }}" From 0e606ce9fdc6085f9bbece5edcae163ffe5af166 Mon Sep 17 00:00:00 2001 From: raulluzon Date: Fri, 10 Jul 2026 12:29:18 +0200 Subject: [PATCH 13/33] fix: extend START_SCRIPT to mask apt timers and enable pipelining for open5gs_vm The previous START_SCRIPT_BASE64 masked apt service units but not their timers (apt-daily.timer and apt-daily-upgrade.timer), allowing unattended-upgrades to run at first boot via the timer path and restart sshd during Ansible provisioning. Also enables ansible_pipelining on open5gs_vm to avoid the strict-KEX bug (CVE-2023-48795 mitigation in OpenSSH 8.9) which causes SFTP to hang when the default KEX proposal includes kex-strict-c-v00@openssh.com. With pipelining on, Ansible sends module code via SSH exec stdin instead of SFTP, bypassing the hang entirely. Co-Authored-By: Claude Sonnet 4.6 --- elcm/code/one/iac/elcm.tf.j2 | 4 ++-- grafana/code/one/iac/grafana.tf.j2 | 4 ++-- influxdb/code/one/iac/influxdb.tf.j2 | 4 ++-- int_p4_sw/code/one/iac/int_collector_p4_sw.tf.j2 | 4 ++-- int_p4_sw/code/one/iac/int_switch_p4_sw.tf.j2 | 4 ++-- ixc_endpoint/code/one/iac/ixc_endpoint.tf.j2 | 4 ++-- mongodb/code/one/iac/mongodb.tf.j2 | 4 ++-- monitoring/code/one/iac/monitoring.tf.j2 | 4 ++-- open5gcore_vm/code/one/iac/open5gcore_vm.tf.j2 | 4 ++-- open5gs_vm/code/component_playbook.yaml | 1 + open5gs_vm/code/one/iac/open5gs_vm.tf.j2 | 4 ++-- opensand_gw/code/one/iac/opensand_gw.tf.j2 | 4 ++-- opensand_sat/code/one/iac/opensand_sat.tf.j2 | 4 ++-- opensand_st/code/one/iac/opensand_st.tf.j2 | 4 ++-- prometheus/code/one/iac/prometheus.tf.j2 | 4 ++-- qosium_probe/code/one/iac/qosium_probe.tf.j2 | 4 ++-- tn_bastion/code/one/iac/tn_bastion.tf.j2 | 4 ++-- ueransim/code/one/iac/ueransim.tf.j2 | 4 ++-- upf_p4_sw/code/one/iac/upf_p4_sw.tf.j2 | 4 ++-- vm_kvm/code/one/iac/vm_kvm.tf.j2 | 4 ++-- xrext/code/one/iac/xrext.tf.j2 | 4 ++-- 21 files changed, 41 insertions(+), 40 deletions(-) diff --git a/elcm/code/one/iac/elcm.tf.j2 b/elcm/code/one/iac/elcm.tf.j2 index 4ef80ee8..ae2cbf26 100644 --- a/elcm/code/one/iac/elcm.tf.j2 +++ b/elcm/code/one/iac/elcm.tf.j2 @@ -14,8 +14,8 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning - # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily - START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily and their timers and their timers + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBzdG9wIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBtYXNrIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" ONEAPP_ELCM_PORTAL_ENABLE = "YES" ONEAPP_ELCM_INFLUXDB_ENABLE = "YES" ONEAPP_ELCM_INFLUXDB_HOST = "{{ influxdb_configuration.host }}" diff --git a/grafana/code/one/iac/grafana.tf.j2 b/grafana/code/one/iac/grafana.tf.j2 index 5706abb5..e531a41d 100644 --- a/grafana/code/one/iac/grafana.tf.j2 +++ b/grafana/code/one/iac/grafana.tf.j2 @@ -14,8 +14,8 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning - # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily - START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily and their timers and their timers + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBzdG9wIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBtYXNrIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" ONEAPP_GRAFANA_VERSION = "{{ one_grafana_version }}" ONEAPP_GRAFANA_ADMIN_PASSWORD = "{{ one_grafana_password }}" } diff --git a/influxdb/code/one/iac/influxdb.tf.j2 b/influxdb/code/one/iac/influxdb.tf.j2 index 19f866e6..935ef03d 100644 --- a/influxdb/code/one/iac/influxdb.tf.j2 +++ b/influxdb/code/one/iac/influxdb.tf.j2 @@ -14,8 +14,8 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning - # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily - START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily and their timers and their timers + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBzdG9wIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBtYXNrIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" ONEAPP_INFLUXDB_VERSION = "{{ one_influxdb_version }}" ONEAPP_INFLUXDB_USER = "{{ one_influxdb_user }}" ONEAPP_INFLUXDB_PASSWORD = "{{ one_influxdb_password }}" diff --git a/int_p4_sw/code/one/iac/int_collector_p4_sw.tf.j2 b/int_p4_sw/code/one/iac/int_collector_p4_sw.tf.j2 index 52d83cb1..a0c1062b 100644 --- a/int_p4_sw/code/one/iac/int_collector_p4_sw.tf.j2 +++ b/int_p4_sw/code/one/iac/int_collector_p4_sw.tf.j2 @@ -12,8 +12,8 @@ resource "opennebula_virtual_machine" "{{ entity_name }}_collector" { USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning - # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily - START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily and their timers and their timers + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBzdG9wIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBtYXNrIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" } {# ### Disabled the possibility to modify VM's size due to a problem with Terraform's OpenNebula Provider diff --git a/int_p4_sw/code/one/iac/int_switch_p4_sw.tf.j2 b/int_p4_sw/code/one/iac/int_switch_p4_sw.tf.j2 index 99cd6087..6011e350 100644 --- a/int_p4_sw/code/one/iac/int_switch_p4_sw.tf.j2 +++ b/int_p4_sw/code/one/iac/int_switch_p4_sw.tf.j2 @@ -14,8 +14,8 @@ resource "opennebula_virtual_machine" "{{ entity_name }}_{{ switch_index }}" { USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning - # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily - START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily and their timers and their timers + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBzdG9wIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBtYXNrIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" } {% for network in switch_config.networks %} diff --git a/ixc_endpoint/code/one/iac/ixc_endpoint.tf.j2 b/ixc_endpoint/code/one/iac/ixc_endpoint.tf.j2 index eaa1c783..1e810119 100644 --- a/ixc_endpoint/code/one/iac/ixc_endpoint.tf.j2 +++ b/ixc_endpoint/code/one/iac/ixc_endpoint.tf.j2 @@ -11,8 +11,8 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning - # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily - START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily and their timers and their timers + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBzdG9wIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBtYXNrIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" ONEAPP_IXCHARIOT_ENDPOINT_RS_ADDRESS = "{{ one_ixc_endpoint_rs }}" } diff --git a/mongodb/code/one/iac/mongodb.tf.j2 b/mongodb/code/one/iac/mongodb.tf.j2 index c446e636..682ef9be 100644 --- a/mongodb/code/one/iac/mongodb.tf.j2 +++ b/mongodb/code/one/iac/mongodb.tf.j2 @@ -14,8 +14,8 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning - # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily - START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily and their timers and their timers + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBzdG9wIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBtYXNrIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" ONEAPP_MONGODB_VERSION = "{{ one_mongodb_version }}" ONEAPP_MONGODB_USER = "{{ one_mongodb_user }}" ONEAPP_MONGODB_PASSWORD = "{{ one_mongodb_password }}" diff --git a/monitoring/code/one/iac/monitoring.tf.j2 b/monitoring/code/one/iac/monitoring.tf.j2 index 6c42afd6..cf6b9dcc 100644 --- a/monitoring/code/one/iac/monitoring.tf.j2 +++ b/monitoring/code/one/iac/monitoring.tf.j2 @@ -14,8 +14,8 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning - # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily - START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily and their timers and their timers + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBzdG9wIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBtYXNrIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" ONEAPP_INFLUXDB_VERSION = "{{ one_influxdb_version }}" ONEAPP_INFLUXDB_USER = "{{ one_influxdb_user }}" ONEAPP_INFLUXDB_PASSWORD = "{{ one_influxdb_password }}" diff --git a/open5gcore_vm/code/one/iac/open5gcore_vm.tf.j2 b/open5gcore_vm/code/one/iac/open5gcore_vm.tf.j2 index 73841807..8ecf83db 100644 --- a/open5gcore_vm/code/one/iac/open5gcore_vm.tf.j2 +++ b/open5gcore_vm/code/one/iac/open5gcore_vm.tf.j2 @@ -14,8 +14,8 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning - # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily - START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily and their timers and their timers + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBzdG9wIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBtYXNrIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" } {# ### Disabled the possibility to modify VM's size due to a problem with Terraform's OpenNebula Provider diff --git a/open5gs_vm/code/component_playbook.yaml b/open5gs_vm/code/component_playbook.yaml index 5c176485..fa4990d4 100644 --- a/open5gs_vm/code/component_playbook.yaml +++ b/open5gs_vm/code/component_playbook.yaml @@ -77,6 +77,7 @@ -o KexAlgorithms=curve25519-sha256 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null + ansible_pipelining: true ansible_user: "jenkins" - name: Add new VM to SSH config file in the Jenkins-master for debugging purposes diff --git a/open5gs_vm/code/one/iac/open5gs_vm.tf.j2 b/open5gs_vm/code/one/iac/open5gs_vm.tf.j2 index e93b0fd4..d04e95eb 100644 --- a/open5gs_vm/code/one/iac/open5gs_vm.tf.j2 +++ b/open5gs_vm/code/one/iac/open5gs_vm.tf.j2 @@ -14,8 +14,8 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning - # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily - START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily and their timers + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBzdG9wIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBtYXNrIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" } {# ### Disabled the possibility to modify VM's size due to a problem with Terraform's OpenNebula Provider diff --git a/opensand_gw/code/one/iac/opensand_gw.tf.j2 b/opensand_gw/code/one/iac/opensand_gw.tf.j2 index cfdd6364..0db173a8 100644 --- a/opensand_gw/code/one/iac/opensand_gw.tf.j2 +++ b/opensand_gw/code/one/iac/opensand_gw.tf.j2 @@ -16,8 +16,8 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning - # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily - START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily and their timers and their timers + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBzdG9wIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBtYXNrIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" } diff --git a/opensand_sat/code/one/iac/opensand_sat.tf.j2 b/opensand_sat/code/one/iac/opensand_sat.tf.j2 index 181e1ed5..615282ef 100644 --- a/opensand_sat/code/one/iac/opensand_sat.tf.j2 +++ b/opensand_sat/code/one/iac/opensand_sat.tf.j2 @@ -16,8 +16,8 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning - # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily - START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily and their timers and their timers + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBzdG9wIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBtYXNrIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" } diff --git a/opensand_st/code/one/iac/opensand_st.tf.j2 b/opensand_st/code/one/iac/opensand_st.tf.j2 index 1d8d0faf..0b30befc 100644 --- a/opensand_st/code/one/iac/opensand_st.tf.j2 +++ b/opensand_st/code/one/iac/opensand_st.tf.j2 @@ -16,8 +16,8 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning - # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily - START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily and their timers and their timers + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBzdG9wIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBtYXNrIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" } diff --git a/prometheus/code/one/iac/prometheus.tf.j2 b/prometheus/code/one/iac/prometheus.tf.j2 index 57b014aa..db0983b9 100644 --- a/prometheus/code/one/iac/prometheus.tf.j2 +++ b/prometheus/code/one/iac/prometheus.tf.j2 @@ -14,8 +14,8 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning - # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily - START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily and their timers and their timers + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBzdG9wIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBtYXNrIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" ONEAPP_PROMETHEUS_VERSION = "{{ one_prometheus_version }}" } diff --git a/qosium_probe/code/one/iac/qosium_probe.tf.j2 b/qosium_probe/code/one/iac/qosium_probe.tf.j2 index 60884439..e790131e 100644 --- a/qosium_probe/code/one/iac/qosium_probe.tf.j2 +++ b/qosium_probe/code/one/iac/qosium_probe.tf.j2 @@ -14,8 +14,8 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning - # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily - START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily and their timers and their timers + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBzdG9wIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBtYXNrIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" } {# ### Disabled the possibility to modify VM's size due to a Terraform OpenNebula Provider's error diff --git a/tn_bastion/code/one/iac/tn_bastion.tf.j2 b/tn_bastion/code/one/iac/tn_bastion.tf.j2 index 3f39b09e..d23645b4 100644 --- a/tn_bastion/code/one/iac/tn_bastion.tf.j2 +++ b/tn_bastion/code/one/iac/tn_bastion.tf.j2 @@ -14,8 +14,8 @@ resource "opennebula_virtual_machine" "tn_bastion" { USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning - # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily - START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily and their timers and their timers + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBzdG9wIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBtYXNrIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" TOKEN = "YES" ONEAPP_BASTION_DNS_PASSWORD = "" ONEAPP_BASTION_DNS_FORWARDERS = "{{ site_dns | default('8.8.8.8,1.1.1.1') }}" diff --git a/ueransim/code/one/iac/ueransim.tf.j2 b/ueransim/code/one/iac/ueransim.tf.j2 index 7bcef829..a527eadd 100644 --- a/ueransim/code/one/iac/ueransim.tf.j2 +++ b/ueransim/code/one/iac/ueransim.tf.j2 @@ -14,8 +14,8 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning - # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily - START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily and their timers and their timers + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBzdG9wIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBtYXNrIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" {% if one_ueransim_mode in ['gnb', 'both'] %} ONEAPP_UERANSIM_RUN_GNB = "{% if one_ueransim_run_gnb %}YES{% else %}NO{% endif %}" ONEAPP_UERANSIM_GNB_AMF_IP = "{{ one_ueransim_gnb_amf_n2_ip }}" diff --git a/upf_p4_sw/code/one/iac/upf_p4_sw.tf.j2 b/upf_p4_sw/code/one/iac/upf_p4_sw.tf.j2 index 8941b747..2363cdf5 100644 --- a/upf_p4_sw/code/one/iac/upf_p4_sw.tf.j2 +++ b/upf_p4_sw/code/one/iac/upf_p4_sw.tf.j2 @@ -12,8 +12,8 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning - # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily - START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily and their timers and their timers + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBzdG9wIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBtYXNrIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" } {% for network in one_upf_p4_sw_networks %} diff --git a/vm_kvm/code/one/iac/vm_kvm.tf.j2 b/vm_kvm/code/one/iac/vm_kvm.tf.j2 index cc58d252..bf489204 100644 --- a/vm_kvm/code/one/iac/vm_kvm.tf.j2 +++ b/vm_kvm/code/one/iac/vm_kvm.tf.j2 @@ -14,8 +14,8 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning - # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily - START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily and their timers and their timers + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBzdG9wIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBtYXNrIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" } {# ### Disabled the possibility to modify VM's size due to a problem with Terraform's OpenNebula Provider diff --git a/xrext/code/one/iac/xrext.tf.j2 b/xrext/code/one/iac/xrext.tf.j2 index afac64a0..852fc413 100644 --- a/xrext/code/one/iac/xrext.tf.j2 +++ b/xrext/code/one/iac/xrext.tf.j2 @@ -14,8 +14,8 @@ resource "opennebula_virtual_machine" "{{ entity_name }}" { USERNAME = "jenkins" SSH_PUBLIC_KEY = "{{ jenkins_ssh_public_key }}" # Disable unattended-upgrades at first boot to prevent sshd restarts during Ansible provisioning - # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily - START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" + # Script: systemctl stop/mask unattended-upgrades apt-daily-upgrade apt-daily and their timers and their timers + START_SCRIPT_BASE64 = "IyEvYmluL2Jhc2gKc3lzdGVtY3RsIHN0b3AgdW5hdHRlbmRlZC11cGdyYWRlcyBhcHQtZGFpbHktdXBncmFkZSBhcHQtZGFpbHkgMj4vZGV2L251bGwgfHwgdHJ1ZQpzeXN0ZW1jdGwgbWFzayB1bmF0dGVuZGVkLXVwZ3JhZGVzIGFwdC1kYWlseS11cGdyYWRlIGFwdC1kYWlseSAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBzdG9wIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCnN5c3RlbWN0bCBtYXNrIGFwdC1kYWlseS50aW1lciBhcHQtZGFpbHktdXBncmFkZS50aW1lciAyPi9kZXYvbnVsbCB8fCB0cnVlCg==" ONEAPP_XR_CAPIF_API_NAME = "{{ one_xr_capif_api_name }}" ONEAPP_XR_CAPIF_HTTPS_HOST = "{{ one_xr_capif_https_host }}" ONEAPP_XR_CAPIF_HTTPS_PORT = "{{ one_xr_capif_https_port }}" From f7722ef6a777faaad04b0bd92f3e590d253b1230 Mon Sep 17 00:00:00 2001 From: raulluzon Date: Fri, 10 Jul 2026 18:29:46 +0200 Subject: [PATCH 14/33] fix(open5gs_vm): remove ansible_pipelining to unblock template module transfers With pipelining enabled, the template module serialises the full hostvars dict and sends it through the nc ProxyCommand chain. This is large enough to stall the pipe. The shell module was unaffected because its payload is tiny. Removing pipelining restores SFTP-based file transfer, which works correctly with the existing KexAlgorithms=curve25519-sha256 fix. Co-Authored-By: Claude Sonnet 4.6 --- open5gs_vm/code/component_playbook.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/open5gs_vm/code/component_playbook.yaml b/open5gs_vm/code/component_playbook.yaml index fa4990d4..5c176485 100644 --- a/open5gs_vm/code/component_playbook.yaml +++ b/open5gs_vm/code/component_playbook.yaml @@ -77,7 +77,6 @@ -o KexAlgorithms=curve25519-sha256 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null - ansible_pipelining: true ansible_user: "jenkins" - name: Add new VM to SSH config file in the Jenkins-master for debugging purposes From 07b60afcd769d488479d068dd527f44157e14e85 Mon Sep 17 00:00:00 2001 From: raulluzon Date: Fri, 10 Jul 2026 19:01:15 +0200 Subject: [PATCH 15/33] fix(open5gs_vm): disable SSH ControlMaster and pipelining for bastion-proxied connections The Jenkins global ~/.ansible.cfg sets ControlMaster=auto with ControlPersist=60s. When Ansible connects to the open5gs_vm via nc ProxyCommand, the ControlMaster is created but the nc tunnel drops after the idle period between wait_for_connection and the first real task. This leaves a stale socket file that causes all subsequent SSH connections to hang indefinitely. -S none in ansible_ssh_common_args uses the OpenSSH -S flag which directly overwrites options.control_path, bypassing the first-wins rule that applies to -o options. This definitively disables connection sharing regardless of ansible.cfg. ansible_pipelining: false explicitly overrides the global transfer_method = piped setting in ansible.cfg so SFTP is used for file transfers instead of piped stdin. Also: clean up any stale socket at the start of Stage 3 as a belt-and-suspenders measure, and increase wait_for_connection timeout to 1800s to handle slow VM boots where cloud-init apt operations can take over 16 minutes. Co-Authored-By: Claude Sonnet 4.6 --- open5gs_vm/code/component_playbook.yaml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/open5gs_vm/code/component_playbook.yaml b/open5gs_vm/code/component_playbook.yaml index 5c176485..7579be86 100644 --- a/open5gs_vm/code/component_playbook.yaml +++ b/open5gs_vm/code/component_playbook.yaml @@ -71,6 +71,7 @@ ansible_host: "{{ ips[access_vnet_id] }}" ansible_ssh_common_args: >- -F /dev/null + -S none -o ControlMaster=no -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 @@ -78,6 +79,7 @@ -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ansible_user: "jenkins" + ansible_pipelining: false - name: Add new VM to SSH config file in the Jenkins-master for debugging purposes ansible.builtin.include_tasks: "{{ workspace }}/.global/cac/jenkins_ssh_config.yaml" @@ -90,10 +92,16 @@ hosts: "open5gs_vm" gather_facts: false tasks: + - name: Remove stale SSH ControlMaster socket left by previous builds + ansible.builtin.file: + path: "/tmp/ansible-ssh-{{ ansible_host }}-22-{{ ansible_user }}" + state: absent + delegate_to: localhost + - name: Wait for system to become reachable ansible.builtin.wait_for_connection: connect_timeout: 5 - timeout: 600 + timeout: 1800 - name: Load enviromental variables from different sources ansible.builtin.include_tasks: "{{ workspace }}/.global/cac/load_variables.yaml" From 38181a41195b14951c373defa4ef8e42f8dadc0d Mon Sep 17 00:00:00 2001 From: raulluzon Date: Sat, 11 Jul 2026 09:34:04 +0200 Subject: [PATCH 16/33] fix(open5gs_vm): use local connection for ControlMaster socket cleanup task The delegate_to: localhost task in Stage 3 was inheriting ansible_user=jenkins from the open5gs_vm inventory entry, causing Ansible to SSH to localhost rather than running the file deletion locally. Added vars: ansible_connection: local to force local execution. Co-Authored-By: Claude Sonnet 4.6 --- open5gs_vm/code/component_playbook.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/open5gs_vm/code/component_playbook.yaml b/open5gs_vm/code/component_playbook.yaml index 7579be86..18c290c1 100644 --- a/open5gs_vm/code/component_playbook.yaml +++ b/open5gs_vm/code/component_playbook.yaml @@ -97,6 +97,8 @@ path: "/tmp/ansible-ssh-{{ ansible_host }}-22-{{ ansible_user }}" state: absent delegate_to: localhost + vars: + ansible_connection: local - name: Wait for system to become reachable ansible.builtin.wait_for_connection: From c390e7852c0d5500f63a1b8fd4e709335cdfec43 Mon Sep 17 00:00:00 2001 From: raulluzon Date: Sat, 11 Jul 2026 10:36:10 +0200 Subject: [PATCH 17/33] fix(open5gs_vm): re-enable pipelining for become tasks through ProxyCommand MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ansible_pipelining: false forced sftp-based file upload for become: true tasks, which opens a separate SSH sub-connection through the nc ProxyCommand. That connection is closed by the remote host. The uma-test site succeeded with pipelining enabled — the stale ControlMaster was the real root cause, now fixed with -S none. Pipelining through nc ProxyCommand works for all task sizes here. Co-Authored-By: Claude Sonnet 4.6 --- open5gs_vm/code/component_playbook.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/open5gs_vm/code/component_playbook.yaml b/open5gs_vm/code/component_playbook.yaml index 18c290c1..d7e53afd 100644 --- a/open5gs_vm/code/component_playbook.yaml +++ b/open5gs_vm/code/component_playbook.yaml @@ -79,7 +79,6 @@ -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ansible_user: "jenkins" - ansible_pipelining: false - name: Add new VM to SSH config file in the Jenkins-master for debugging purposes ansible.builtin.include_tasks: "{{ workspace }}/.global/cac/jenkins_ssh_config.yaml" From 3985cc6deb5a965127f04a812572bf2e8be59fc4 Mon Sep 17 00:00:00 2001 From: raulluzon Date: Sat, 11 Jul 2026 12:29:21 +0200 Subject: [PATCH 18/33] fix(open5gs_vm): restore ControlMaster with ControlPersist=3600 for netplan resilience ControlMaster=no caused every task to open a fresh SSH tunnel. When netplan apply briefly disrupts the VXLAN interface (192.168.199.x), the next connection attempt catches the window and fails with "Connection closed by remote host." Using ControlMaster=auto with ControlPersist=3600 keeps a single tunnel alive through the disruption. The original stale-socket bug (60s expiry) is prevented by the longer persist window plus the cleanup task that removes old sockets at Stage 3 start. Socket path is explicit (-S /tmp/cm--22-jenkins) so cleanup is exact. Co-Authored-By: Claude Sonnet 4.6 --- open5gs_vm/code/component_playbook.yaml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/open5gs_vm/code/component_playbook.yaml b/open5gs_vm/code/component_playbook.yaml index d7e53afd..88d20e07 100644 --- a/open5gs_vm/code/component_playbook.yaml +++ b/open5gs_vm/code/component_playbook.yaml @@ -71,8 +71,9 @@ ansible_host: "{{ ips[access_vnet_id] }}" ansible_ssh_common_args: >- -F /dev/null - -S none - -o ControlMaster=no + -S /tmp/cm-{{ ips[access_vnet_id] }}-22-jenkins + -o ControlMaster=auto + -o ControlPersist=3600 -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 -o KexAlgorithms=curve25519-sha256 @@ -93,7 +94,7 @@ tasks: - name: Remove stale SSH ControlMaster socket left by previous builds ansible.builtin.file: - path: "/tmp/ansible-ssh-{{ ansible_host }}-22-{{ ansible_user }}" + path: "/tmp/cm-{{ ansible_host }}-22-{{ ansible_user }}" state: absent delegate_to: localhost vars: From e98a669b081e11f9e3e4c55b15758712dd8e28e3 Mon Sep 17 00:00:00 2001 From: raulluzon Date: Sun, 12 Jul 2026 12:37:48 +0200 Subject: [PATCH 19/33] fix(open5gs_vm): revert to ControlMaster=no and add wait after netplan apply ControlMaster=auto caused silent socket failures (empty error, earlier than previous failures). Reverting to -S none/-o ControlMaster=no which was stable through task 16 in the previous run. The remaining blocker was netplan apply briefly disrupting the VXLAN interface (192.168.199.x), causing the next apt_repository task to get "Connection closed by remote host". Adding wait_for_connection after netplan apply (same when condition) ensures the SSH connection is re-established before apt tasks run. Co-Authored-By: Claude Sonnet 4.6 --- open5gs_vm/code/component_playbook.yaml | 7 +++---- open5gs_vm/code/one/cac/02_install/install_open5gs.yml | 7 +++++++ 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/open5gs_vm/code/component_playbook.yaml b/open5gs_vm/code/component_playbook.yaml index 88d20e07..d7e53afd 100644 --- a/open5gs_vm/code/component_playbook.yaml +++ b/open5gs_vm/code/component_playbook.yaml @@ -71,9 +71,8 @@ ansible_host: "{{ ips[access_vnet_id] }}" ansible_ssh_common_args: >- -F /dev/null - -S /tmp/cm-{{ ips[access_vnet_id] }}-22-jenkins - -o ControlMaster=auto - -o ControlPersist=3600 + -S none + -o ControlMaster=no -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 -o KexAlgorithms=curve25519-sha256 @@ -94,7 +93,7 @@ tasks: - name: Remove stale SSH ControlMaster socket left by previous builds ansible.builtin.file: - path: "/tmp/cm-{{ ansible_host }}-22-{{ ansible_user }}" + path: "/tmp/ansible-ssh-{{ ansible_host }}-22-{{ ansible_user }}" state: absent delegate_to: localhost vars: diff --git a/open5gs_vm/code/one/cac/02_install/install_open5gs.yml b/open5gs_vm/code/one/cac/02_install/install_open5gs.yml index 1bab8d62..1bf1a9d9 100644 --- a/open5gs_vm/code/one/cac/02_install/install_open5gs.yml +++ b/open5gs_vm/code/one/cac/02_install/install_open5gs.yml @@ -25,6 +25,13 @@ changed_when: false when: netplan_changed.changed + - name: Wait for SSH to recover after netplan apply + ansible.builtin.wait_for_connection: + connect_timeout: 5 + timeout: 120 + become: false + when: netplan_changed.changed + - name: Install MongoDB 6 block: - name: Import MongoDB 6 public key From 3e1ddce5ee09069405ed0cbb130baa90df5b3140 Mon Sep 17 00:00:00 2001 From: raulluzon Date: Sun, 12 Jul 2026 17:22:29 +0200 Subject: [PATCH 20/33] fix(open5gs_vm): add second wait_for_connection before first remote task On slow-booting VMs (>15 min), unattended-upgrades runs during the cloud-init window and may restart sshd after wait_for_connection succeeds. The five variable-loading tasks that follow run on the Ansible controller (no SSH), so they appear OK. The first real remote task (Set site ssh key) then hits the restarting sshd and gets "Connection closed by remote host." A second wait_for_connection (delay 5s, timeout 300s) after variable loading but before the first remote task absorbs any sshd restart window. Co-Authored-By: Claude Sonnet 4.6 --- open5gs_vm/code/component_playbook.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/open5gs_vm/code/component_playbook.yaml b/open5gs_vm/code/component_playbook.yaml index d7e53afd..c3ba36d6 100644 --- a/open5gs_vm/code/component_playbook.yaml +++ b/open5gs_vm/code/component_playbook.yaml @@ -107,6 +107,12 @@ - name: Load enviromental variables from different sources ansible.builtin.include_tasks: "{{ workspace }}/.global/cac/load_variables.yaml" + - name: Wait for SSH to stabilize before first remote task + ansible.builtin.wait_for_connection: + connect_timeout: 5 + delay: 5 + timeout: 300 + - name: Set site ssh key as authorized in jenkins user ansible.posix.authorized_key: user: jenkins From 043555441515e918c6113c29213b7f18ae3325b4 Mon Sep 17 00:00:00 2001 From: raulluzon Date: Sun, 12 Jul 2026 17:50:56 +0200 Subject: [PATCH 21/33] fix(open5gs_vm): kill unattended-upgrades early to prevent sshd restart On slow-booting VMs unattended-upgrades runs during cloud-init and periodically restarts sshd, which kills active Ansible connections. Adding a shell task right after the initial wait_for_connection to stop unattended-upgrades and release dpkg locks. ignore_unreachable/ignore_errors tolerates the case where sshd dies mid-task; the follow-up wait_for_connection absorbs the restart window before any real configuration work begins. Co-Authored-By: Claude Sonnet 4.6 --- open5gs_vm/code/component_playbook.yaml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/open5gs_vm/code/component_playbook.yaml b/open5gs_vm/code/component_playbook.yaml index c3ba36d6..e9386755 100644 --- a/open5gs_vm/code/component_playbook.yaml +++ b/open5gs_vm/code/component_playbook.yaml @@ -104,6 +104,20 @@ connect_timeout: 5 timeout: 1800 + - name: Stop unattended-upgrades to prevent sshd restart during configuration + ansible.builtin.shell: | + systemctl stop unattended-upgrades apt-daily.service apt-daily-upgrade.service 2>/dev/null || true + fuser -k /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock /var/cache/apt/archives/lock 2>/dev/null || true + become: true + ignore_unreachable: true + ignore_errors: true + + - name: Wait for SSH to stabilize after stopping unattended-upgrades + ansible.builtin.wait_for_connection: + connect_timeout: 5 + delay: 5 + timeout: 300 + - name: Load enviromental variables from different sources ansible.builtin.include_tasks: "{{ workspace }}/.global/cac/load_variables.yaml" From bc4ead4d7d83f5131d3d86baf6c47bc4566623e1 Mon Sep 17 00:00:00 2001 From: raulluzon Date: Sun, 12 Jul 2026 21:04:47 +0200 Subject: [PATCH 22/33] fix(open5gs_vm): mask apt timers and suppress needrestart to prevent sshd disruption Replace systemctl stop with mask --now for unattended-upgrades and apt-daily timers in both the pre-install stage and the installation block. Also write a needrestart override (restart=l) so that needrestart does not auto-restart sshd after mongodb-org or open5gs packages are installed, which was causing UNREACHABLE failures mid-installation. Co-Authored-By: Claude Sonnet 4.6 --- open5gs_vm/code/component_playbook.yaml | 11 +++++++++-- .../code/one/cac/02_install/install_open5gs.yml | 11 +++++++++-- 2 files changed, 18 insertions(+), 4 deletions(-) diff --git a/open5gs_vm/code/component_playbook.yaml b/open5gs_vm/code/component_playbook.yaml index e9386755..4457c964 100644 --- a/open5gs_vm/code/component_playbook.yaml +++ b/open5gs_vm/code/component_playbook.yaml @@ -104,9 +104,16 @@ connect_timeout: 5 timeout: 1800 - - name: Stop unattended-upgrades to prevent sshd restart during configuration + - name: Mask apt automation to prevent sshd restarts during configuration ansible.builtin.shell: | - systemctl stop unattended-upgrades apt-daily.service apt-daily-upgrade.service 2>/dev/null || true + systemctl mask --now \ + unattended-upgrades \ + apt-daily.service \ + apt-daily-upgrade.service \ + apt-daily.timer \ + apt-daily-upgrade.timer \ + 2>/dev/null || true + echo '$nrconf{restart} = "l";' > /etc/needrestart/conf.d/00-ansible.conf 2>/dev/null || true fuser -k /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock /var/cache/apt/archives/lock 2>/dev/null || true become: true ignore_unreachable: true diff --git a/open5gs_vm/code/one/cac/02_install/install_open5gs.yml b/open5gs_vm/code/one/cac/02_install/install_open5gs.yml index 1bf1a9d9..31044e7b 100644 --- a/open5gs_vm/code/one/cac/02_install/install_open5gs.yml +++ b/open5gs_vm/code/one/cac/02_install/install_open5gs.yml @@ -2,9 +2,16 @@ - name: Run every task as root user become: true block: - - name: Release dpkg lock held by unattended-upgrades or apt + - name: Release dpkg lock and suppress apt automation for the install ansible.builtin.shell: | - systemctl stop unattended-upgrades apt-daily.service apt-daily-upgrade.service 2>/dev/null || true + systemctl mask --now \ + unattended-upgrades \ + apt-daily.service \ + apt-daily-upgrade.service \ + apt-daily.timer \ + apt-daily-upgrade.timer \ + 2>/dev/null || true + echo '$nrconf{restart} = "l";' > /etc/needrestart/conf.d/00-ansible.conf 2>/dev/null || true fuser -k /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock /var/cache/apt/archives/lock 2>/dev/null || true sleep 2 dpkg --configure -a 2>/dev/null || true From 3826f5fc11772cbe3f30bd299aa40d5bbe998273 Mon Sep 17 00:00:00 2001 From: raulluzon Date: Sun, 12 Jul 2026 21:21:45 +0200 Subject: [PATCH 23/33] fix(open5gs_vm): wait for cloud-init to complete before user-creation tasks cloud-init restarts sshd multiple times during early VM boot. The previous wait_for_connection only confirms reachability at that instant; a second restart window during cloud-init can hit the Create-new-user task. Adding cloud-init status --wait (with ignore_unreachable and a recovery wait_for_connection) ensures cloud-init is fully done before any state-changing remote tasks run. Co-Authored-By: Claude Sonnet 4.6 --- open5gs_vm/code/component_playbook.yaml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/open5gs_vm/code/component_playbook.yaml b/open5gs_vm/code/component_playbook.yaml index 4457c964..d96da267 100644 --- a/open5gs_vm/code/component_playbook.yaml +++ b/open5gs_vm/code/component_playbook.yaml @@ -134,6 +134,19 @@ delay: 5 timeout: 300 + - name: Wait for cloud-init to complete so sshd is no longer restarted + ansible.builtin.command: + cmd: cloud-init status --wait + changed_when: false + ignore_unreachable: true + ignore_errors: true + + - name: Wait for SSH to stabilize after cloud-init + ansible.builtin.wait_for_connection: + connect_timeout: 5 + delay: 5 + timeout: 300 + - name: Set site ssh key as authorized in jenkins user ansible.posix.authorized_key: user: jenkins From 38e5b317c6905847e49b0895cc306625cea05fdf Mon Sep 17 00:00:00 2001 From: raulluzon Date: Thu, 16 Jul 2026 09:29:11 +0200 Subject: [PATCH 24/33] fix(all_vms): add SSH keepalives to prevent TCP idle timeout during Ansible wait_for_connection MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The ProxyCommand tunnels (Jenkins → bastion → VM via nc) were being killed by a ~946-second TCP idle timeout on the client network because no data flowed while Ansible waited for the ping module response. Each attempt consumed the full 946 s before failing, causing the 1800-second wait_for_connection timeout to be exceeded after only two retries. Adds -o ServerAliveInterval=30 -o ServerAliveCountMax=10 to both the outer ansible_ssh_common_args and the inner ProxyCommand ssh invocation across all 21 VM component playbooks, keeping both the Jenkins→bastion and the end-to-end SSH connections alive during idle periods. Co-Authored-By: Claude Sonnet 4.6 --- .dummy_component/code/component_playbook.yaml | 4 +++- elcm/code/component_playbook.yaml | 4 +++- grafana/code/component_playbook.yaml | 4 +++- influxdb/code/component_playbook.yaml | 4 +++- int_p4_sw/code/component_playbook.yaml | 8 ++++++-- ixc_endpoint/code/component_playbook.yaml | 4 +++- ks8500_runner/code/component_playbook.yaml | 4 +++- loadcore_agent/code/component_playbook.yaml | 4 +++- mongodb/code/component_playbook.yaml | 4 +++- monitoring/code/component_playbook.yaml | 4 +++- open5gcore_vm/code/component_playbook.yaml | 4 +++- open5gs_vm/code/component_playbook.yaml | 4 +++- opensand_gw/code/component_playbook.yaml | 4 +++- opensand_sat/code/component_playbook.yaml | 4 +++- opensand_st/code/component_playbook.yaml | 4 +++- prometheus/code/component_playbook.yaml | 4 +++- qosium_probe/code/component_playbook.yaml | 4 +++- ueransim/code/component_playbook.yaml | 4 +++- upf_p4_sw/code/component_playbook.yaml | 4 +++- vm_kvm/code/component_playbook.yaml | 4 +++- xrext/code/component_playbook.yaml | 4 +++- 21 files changed, 66 insertions(+), 22 deletions(-) diff --git a/.dummy_component/code/component_playbook.yaml b/.dummy_component/code/component_playbook.yaml index 20b53234..d87e6465 100644 --- a/.dummy_component/code/component_playbook.yaml +++ b/.dummy_component/code/component_playbook.yaml @@ -89,7 +89,9 @@ ansible_ssh_common_args: >- -F /dev/null -o ControlMaster=no - -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o ServerAliveInterval=30 + -o ServerAliveCountMax=10 + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=10 jenkins@{{ bastion_ip }} nc %h %p" -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 -o KexAlgorithms=curve25519-sha256 -o StrictHostKeyChecking=no diff --git a/elcm/code/component_playbook.yaml b/elcm/code/component_playbook.yaml index d6e30a5b..c3d95523 100644 --- a/elcm/code/component_playbook.yaml +++ b/elcm/code/component_playbook.yaml @@ -73,7 +73,9 @@ ansible_ssh_common_args: >- -F /dev/null -o ControlMaster=no - -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o ServerAliveInterval=30 + -o ServerAliveCountMax=10 + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=10 jenkins@{{ bastion_ip }} nc %h %p" -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 -o KexAlgorithms=curve25519-sha256 -o StrictHostKeyChecking=no diff --git a/grafana/code/component_playbook.yaml b/grafana/code/component_playbook.yaml index 0446c404..5752fbf7 100644 --- a/grafana/code/component_playbook.yaml +++ b/grafana/code/component_playbook.yaml @@ -53,7 +53,9 @@ ansible_ssh_common_args: >- -F /dev/null -o ControlMaster=no - -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o ServerAliveInterval=30 + -o ServerAliveCountMax=10 + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=10 jenkins@{{ bastion_ip }} nc %h %p" -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 -o KexAlgorithms=curve25519-sha256 -o StrictHostKeyChecking=no diff --git a/influxdb/code/component_playbook.yaml b/influxdb/code/component_playbook.yaml index 996c05c0..b534ef4e 100644 --- a/influxdb/code/component_playbook.yaml +++ b/influxdb/code/component_playbook.yaml @@ -53,7 +53,9 @@ ansible_ssh_common_args: >- -F /dev/null -o ControlMaster=no - -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o ServerAliveInterval=30 + -o ServerAliveCountMax=10 + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=10 jenkins@{{ bastion_ip }} nc %h %p" -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 -o KexAlgorithms=curve25519-sha256 -o StrictHostKeyChecking=no diff --git a/int_p4_sw/code/component_playbook.yaml b/int_p4_sw/code/component_playbook.yaml index 865fb29d..ad6affa1 100644 --- a/int_p4_sw/code/component_playbook.yaml +++ b/int_p4_sw/code/component_playbook.yaml @@ -59,7 +59,9 @@ ansible_ssh_common_args: >- -F /dev/null -o ControlMaster=no - -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o ServerAliveInterval=30 + -o ServerAliveCountMax=10 + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=10 jenkins@{{ bastion_ip }} nc %h %p" -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 -o KexAlgorithms=curve25519-sha256 -o StrictHostKeyChecking=no @@ -75,7 +77,9 @@ ansible_ssh_common_args: >- -F /dev/null -o ControlMaster=no - -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o ServerAliveInterval=30 + -o ServerAliveCountMax=10 + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=10 jenkins@{{ bastion_ip }} nc %h %p" -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 -o KexAlgorithms=curve25519-sha256 -o StrictHostKeyChecking=no diff --git a/ixc_endpoint/code/component_playbook.yaml b/ixc_endpoint/code/component_playbook.yaml index 11ebba28..68135947 100644 --- a/ixc_endpoint/code/component_playbook.yaml +++ b/ixc_endpoint/code/component_playbook.yaml @@ -53,7 +53,9 @@ ansible_ssh_common_args: >- -F /dev/null -o ControlMaster=no - -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o ServerAliveInterval=30 + -o ServerAliveCountMax=10 + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=10 jenkins@{{ bastion_ip }} nc %h %p" -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 -o KexAlgorithms=curve25519-sha256 -o StrictHostKeyChecking=no diff --git a/ks8500_runner/code/component_playbook.yaml b/ks8500_runner/code/component_playbook.yaml index b4a23e2d..271a4274 100644 --- a/ks8500_runner/code/component_playbook.yaml +++ b/ks8500_runner/code/component_playbook.yaml @@ -43,7 +43,9 @@ ansible_ssh_common_args: >- -F /dev/null -o ControlMaster=no - -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o ServerAliveInterval=30 + -o ServerAliveCountMax=10 + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=10 jenkins@{{ bastion_ip }} nc %h %p" -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 -o KexAlgorithms=curve25519-sha256 -o StrictHostKeyChecking=no diff --git a/loadcore_agent/code/component_playbook.yaml b/loadcore_agent/code/component_playbook.yaml index 7d7b363e..5e60e25f 100644 --- a/loadcore_agent/code/component_playbook.yaml +++ b/loadcore_agent/code/component_playbook.yaml @@ -56,7 +56,9 @@ ansible_ssh_common_args: >- -F /dev/null -o ControlMaster=no - -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o ServerAliveInterval=30 + -o ServerAliveCountMax=10 + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=10 jenkins@{{ bastion_ip }} nc %h %p" -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 -o KexAlgorithms=curve25519-sha256 -o StrictHostKeyChecking=no diff --git a/mongodb/code/component_playbook.yaml b/mongodb/code/component_playbook.yaml index 88563819..6ba8b2e1 100644 --- a/mongodb/code/component_playbook.yaml +++ b/mongodb/code/component_playbook.yaml @@ -53,7 +53,9 @@ ansible_ssh_common_args: >- -F /dev/null -o ControlMaster=no - -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o ServerAliveInterval=30 + -o ServerAliveCountMax=10 + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=10 jenkins@{{ bastion_ip }} nc %h %p" -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 -o KexAlgorithms=curve25519-sha256 -o StrictHostKeyChecking=no diff --git a/monitoring/code/component_playbook.yaml b/monitoring/code/component_playbook.yaml index 9d7aee38..7463760b 100644 --- a/monitoring/code/component_playbook.yaml +++ b/monitoring/code/component_playbook.yaml @@ -53,7 +53,9 @@ ansible_ssh_common_args: >- -F /dev/null -o ControlMaster=no - -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o ServerAliveInterval=30 + -o ServerAliveCountMax=10 + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=10 jenkins@{{ bastion_ip }} nc %h %p" -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 -o KexAlgorithms=curve25519-sha256 -o StrictHostKeyChecking=no diff --git a/open5gcore_vm/code/component_playbook.yaml b/open5gcore_vm/code/component_playbook.yaml index bdd257e9..6c39e0fa 100644 --- a/open5gcore_vm/code/component_playbook.yaml +++ b/open5gcore_vm/code/component_playbook.yaml @@ -83,7 +83,9 @@ ansible_ssh_common_args: >- -F /dev/null -o ControlMaster=no - -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o ServerAliveInterval=30 + -o ServerAliveCountMax=10 + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=10 jenkins@{{ bastion_ip }} nc %h %p" -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 -o KexAlgorithms=curve25519-sha256 -o StrictHostKeyChecking=no diff --git a/open5gs_vm/code/component_playbook.yaml b/open5gs_vm/code/component_playbook.yaml index d96da267..d983d082 100644 --- a/open5gs_vm/code/component_playbook.yaml +++ b/open5gs_vm/code/component_playbook.yaml @@ -73,7 +73,9 @@ -F /dev/null -S none -o ControlMaster=no - -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o ServerAliveInterval=30 + -o ServerAliveCountMax=10 + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=10 jenkins@{{ bastion_ip }} nc %h %p" -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 -o KexAlgorithms=curve25519-sha256 -o StrictHostKeyChecking=no diff --git a/opensand_gw/code/component_playbook.yaml b/opensand_gw/code/component_playbook.yaml index cbf0e7ac..1e0a2997 100644 --- a/opensand_gw/code/component_playbook.yaml +++ b/opensand_gw/code/component_playbook.yaml @@ -43,7 +43,9 @@ ansible_ssh_common_args: >- -F /dev/null -o ControlMaster=no - -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o ServerAliveInterval=30 + -o ServerAliveCountMax=10 + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=10 jenkins@{{ bastion_ip }} nc %h %p" -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 -o KexAlgorithms=curve25519-sha256 -o StrictHostKeyChecking=no diff --git a/opensand_sat/code/component_playbook.yaml b/opensand_sat/code/component_playbook.yaml index 675b7493..2395e0e4 100644 --- a/opensand_sat/code/component_playbook.yaml +++ b/opensand_sat/code/component_playbook.yaml @@ -43,7 +43,9 @@ ansible_ssh_common_args: >- -F /dev/null -o ControlMaster=no - -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o ServerAliveInterval=30 + -o ServerAliveCountMax=10 + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=10 jenkins@{{ bastion_ip }} nc %h %p" -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 -o KexAlgorithms=curve25519-sha256 -o StrictHostKeyChecking=no diff --git a/opensand_st/code/component_playbook.yaml b/opensand_st/code/component_playbook.yaml index b1ac9471..9fba22ef 100644 --- a/opensand_st/code/component_playbook.yaml +++ b/opensand_st/code/component_playbook.yaml @@ -43,7 +43,9 @@ ansible_ssh_common_args: >- -F /dev/null -o ControlMaster=no - -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o ServerAliveInterval=30 + -o ServerAliveCountMax=10 + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=10 jenkins@{{ bastion_ip }} nc %h %p" -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 -o KexAlgorithms=curve25519-sha256 -o StrictHostKeyChecking=no diff --git a/prometheus/code/component_playbook.yaml b/prometheus/code/component_playbook.yaml index 57433244..06f0d01a 100644 --- a/prometheus/code/component_playbook.yaml +++ b/prometheus/code/component_playbook.yaml @@ -53,7 +53,9 @@ ansible_ssh_common_args: >- -F /dev/null -o ControlMaster=no - -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o ServerAliveInterval=30 + -o ServerAliveCountMax=10 + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=10 jenkins@{{ bastion_ip }} nc %h %p" -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 -o KexAlgorithms=curve25519-sha256 -o StrictHostKeyChecking=no diff --git a/qosium_probe/code/component_playbook.yaml b/qosium_probe/code/component_playbook.yaml index 900c229b..a74a2303 100644 --- a/qosium_probe/code/component_playbook.yaml +++ b/qosium_probe/code/component_playbook.yaml @@ -57,7 +57,9 @@ ansible_ssh_common_args: >- -F /dev/null -o ControlMaster=no - -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o ServerAliveInterval=30 + -o ServerAliveCountMax=10 + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=10 jenkins@{{ bastion_ip }} nc %h %p" -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 -o KexAlgorithms=curve25519-sha256 -o StrictHostKeyChecking=no diff --git a/ueransim/code/component_playbook.yaml b/ueransim/code/component_playbook.yaml index de8967a2..cb250760 100644 --- a/ueransim/code/component_playbook.yaml +++ b/ueransim/code/component_playbook.yaml @@ -56,7 +56,9 @@ ansible_ssh_common_args: >- -F /dev/null -o ControlMaster=no - -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o ServerAliveInterval=30 + -o ServerAliveCountMax=10 + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=10 jenkins@{{ bastion_ip }} nc %h %p" -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 -o KexAlgorithms=curve25519-sha256 -o StrictHostKeyChecking=no diff --git a/upf_p4_sw/code/component_playbook.yaml b/upf_p4_sw/code/component_playbook.yaml index 47ed44dd..7bc7ef86 100644 --- a/upf_p4_sw/code/component_playbook.yaml +++ b/upf_p4_sw/code/component_playbook.yaml @@ -62,7 +62,9 @@ ansible_ssh_common_args: >- -F /dev/null -o ControlMaster=no - -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o ServerAliveInterval=30 + -o ServerAliveCountMax=10 + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=10 jenkins@{{ bastion_ip }} nc %h %p" -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 -o KexAlgorithms=curve25519-sha256 -o StrictHostKeyChecking=no diff --git a/vm_kvm/code/component_playbook.yaml b/vm_kvm/code/component_playbook.yaml index 7b498df7..9cf9826e 100644 --- a/vm_kvm/code/component_playbook.yaml +++ b/vm_kvm/code/component_playbook.yaml @@ -56,7 +56,9 @@ ansible_ssh_common_args: >- -F /dev/null -o ControlMaster=no - -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o ServerAliveInterval=30 + -o ServerAliveCountMax=10 + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=10 jenkins@{{ bastion_ip }} nc %h %p" -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 -o KexAlgorithms=curve25519-sha256 -o StrictHostKeyChecking=no diff --git a/xrext/code/component_playbook.yaml b/xrext/code/component_playbook.yaml index 0ab1d206..d0630cb2 100644 --- a/xrext/code/component_playbook.yaml +++ b/xrext/code/component_playbook.yaml @@ -53,7 +53,9 @@ ansible_ssh_common_args: >- -F /dev/null -o ControlMaster=no - -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes jenkins@{{ bastion_ip }} nc %h %p" + -o ServerAliveInterval=30 + -o ServerAliveCountMax=10 + -o ProxyCommand="ssh -i /var/lib/jenkins/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o KexAlgorithms=curve25519-sha256 -o BatchMode=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=10 jenkins@{{ bastion_ip }} nc %h %p" -o IdentityFile=/var/lib/jenkins/.ssh/id_ed25519 -o KexAlgorithms=curve25519-sha256 -o StrictHostKeyChecking=no From e067b3810acf6db39cb97892918d246dde379fc8 Mon Sep 17 00:00:00 2001 From: raulluzon Date: Thu, 16 Jul 2026 09:56:03 +0200 Subject: [PATCH 25/33] fix(open5gs_vm): prevent sshd restart during dpkg --configure -a dpkg --configure -a runs the openssh-server post-install script which calls invoke-rc.d ssh restart, dropping the Ansible SSH session and causing UNREACHABLE. The task had no ignore_unreachable guard, so the play failed. Add a policy-rc.d stub that returns 101 (action refused) before running dpkg --configure -a so invoke-rc.d refuses all service restarts during package configuration. Remove it immediately after. Also add ignore_unreachable: true as a safety net and an unconditional wait_for_connection after the task to reconnect if sshd does restart. Co-Authored-By: Claude Sonnet 4.6 --- open5gs_vm/code/one/cac/02_install/install_open5gs.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/open5gs_vm/code/one/cac/02_install/install_open5gs.yml b/open5gs_vm/code/one/cac/02_install/install_open5gs.yml index 31044e7b..5ee5522a 100644 --- a/open5gs_vm/code/one/cac/02_install/install_open5gs.yml +++ b/open5gs_vm/code/one/cac/02_install/install_open5gs.yml @@ -12,11 +12,21 @@ apt-daily-upgrade.timer \ 2>/dev/null || true echo '$nrconf{restart} = "l";' > /etc/needrestart/conf.d/00-ansible.conf 2>/dev/null || true + printf '#!/bin/sh\nexit 101\n' > /usr/sbin/policy-rc.d && chmod +x /usr/sbin/policy-rc.d fuser -k /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock /var/cache/apt/archives/lock 2>/dev/null || true sleep 2 dpkg --configure -a 2>/dev/null || true + rm -f /usr/sbin/policy-rc.d changed_when: false failed_when: false + ignore_unreachable: true + + - name: Wait for SSH to recover after dpkg configure + ansible.builtin.wait_for_connection: + connect_timeout: 5 + delay: 5 + timeout: 120 + become: false - name: Render netplan aliases ansible.builtin.template: From 5c77b686e1353834d0e2752d2142549cebc3e4ac Mon Sep 17 00:00:00 2001 From: raulluzon Date: Thu, 16 Jul 2026 11:01:58 +0200 Subject: [PATCH 26/33] fix(open5gs_vm): clear pending dpkg state early to prevent deferred sshd restart dpkg --configure -a is called with policy-rc.d (exit 101) during the early apt-masking step, before any non-ignored Ansible tasks. Any pending openssh-server post-install script is resolved here without restarting sshd, eliminating the deferred restart that caused UNREACHABLE on Set TN ssh key as authorized in new user (Bug 18). Co-Authored-By: Claude Sonnet 4.6 --- open5gs_vm/code/component_playbook.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/open5gs_vm/code/component_playbook.yaml b/open5gs_vm/code/component_playbook.yaml index d983d082..17ed4c03 100644 --- a/open5gs_vm/code/component_playbook.yaml +++ b/open5gs_vm/code/component_playbook.yaml @@ -116,7 +116,11 @@ apt-daily-upgrade.timer \ 2>/dev/null || true echo '$nrconf{restart} = "l";' > /etc/needrestart/conf.d/00-ansible.conf 2>/dev/null || true + printf '#!/bin/sh\nexit 101\n' > /usr/sbin/policy-rc.d && chmod +x /usr/sbin/policy-rc.d fuser -k /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock /var/cache/apt/archives/lock 2>/dev/null || true + sleep 2 + dpkg --configure -a 2>/dev/null || true + rm -f /usr/sbin/policy-rc.d become: true ignore_unreachable: true ignore_errors: true From b1eae0898e16966b6a9aa5ef8e2ba63a0a8c54d7 Mon Sep 17 00:00:00 2001 From: raulluzon Date: Thu, 16 Jul 2026 11:34:10 +0200 Subject: [PATCH 27/33] fix(open5gs_vm): give more headroom for SSH to stabilize before first remote task wait_for_connection timed out at elapsed=321s against timeout=300s on raul12 (Bug 19): SSH dropped again after the load_variables include, narrowly missing the deadline. Extend the first check to 600s and guard it with ignore_unreachable/ignore_errors, then confirm stability with a second bounded wait, mirroring the existing cloud-init check/confirm pattern below it. Co-Authored-By: Claude Sonnet 4.6 --- open5gs_vm/code/component_playbook.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/open5gs_vm/code/component_playbook.yaml b/open5gs_vm/code/component_playbook.yaml index 17ed4c03..45b1a39f 100644 --- a/open5gs_vm/code/component_playbook.yaml +++ b/open5gs_vm/code/component_playbook.yaml @@ -135,6 +135,14 @@ ansible.builtin.include_tasks: "{{ workspace }}/.global/cac/load_variables.yaml" - name: Wait for SSH to stabilize before first remote task + ansible.builtin.wait_for_connection: + connect_timeout: 5 + delay: 5 + timeout: 600 + ignore_unreachable: true + ignore_errors: true + + - name: Confirm SSH is stable before first remote task ansible.builtin.wait_for_connection: connect_timeout: 5 delay: 5 From 1a2f30ad1ea99a0e755473cadf56de49e0f90995 Mon Sep 17 00:00:00 2001 From: raulluzon Date: Thu, 16 Jul 2026 12:07:08 +0200 Subject: [PATCH 28/33] fix(open5gs_vm): give more headroom for SSH to recover after dpkg configure wait_for_connection timed out at elapsed=322s against timeout=120s on raul13 (Bug 20): recovery after the guarded dpkg --configure -a UNREACHABLE genuinely takes longer than 120s. Extend to 600s and guard with ignore_unreachable/ignore_errors, then confirm stability with a second bounded wait, matching the pattern already applied to the pre-install stabilize checks in component_playbook.yaml (Bug 19). Co-Authored-By: Claude Sonnet 4.6 --- .../code/one/cac/02_install/install_open5gs.yml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/open5gs_vm/code/one/cac/02_install/install_open5gs.yml b/open5gs_vm/code/one/cac/02_install/install_open5gs.yml index 5ee5522a..4ed69af5 100644 --- a/open5gs_vm/code/one/cac/02_install/install_open5gs.yml +++ b/open5gs_vm/code/one/cac/02_install/install_open5gs.yml @@ -25,7 +25,16 @@ ansible.builtin.wait_for_connection: connect_timeout: 5 delay: 5 - timeout: 120 + timeout: 600 + become: false + ignore_unreachable: true + ignore_errors: true + + - name: Confirm SSH is stable after dpkg configure + ansible.builtin.wait_for_connection: + connect_timeout: 5 + delay: 5 + timeout: 300 become: false - name: Render netplan aliases From e7edbb23bc6bb6a5ac6f1e9cbf02511e0bdb9ea7 Mon Sep 17 00:00:00 2001 From: raulluzon Date: Fri, 17 Jul 2026 14:33:24 +0200 Subject: [PATCH 29/33] la-mayora-descriptor --- ueransim/sample-la-mayora.yaml | 38 ++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 ueransim/sample-la-mayora.yaml diff --git a/ueransim/sample-la-mayora.yaml b/ueransim/sample-la-mayora.yaml new file mode 100644 index 00000000..040e103a --- /dev/null +++ b/ueransim/sample-la-mayora.yaml @@ -0,0 +1,38 @@ +trial_network: + tn_init: + type: "tn_init" + dependencies: [] + input: {} + vnet-n2: + type: "vnet" + name: "n2" + dependencies: + - "tn_init" + input: + one_vnet_first_ip: "10.10.10.1" + one_vnet_netmask: 24 + one_vnet_address_size: 100 + open5gs_vm-core: + type: "open5gs_vm" + name: "core" + dependencies: + - "vnet-n2" + input: + one_open5gs_vm_external_vnet: "tn_vxlan" + one_open5gs_vm_internal_vnet: + - "vnet-n2" + one_open5gs_vm_size: "small" + one_open5gs_vm_ue_subnet: "10.45.0.0/16" + one_open5gs_vm_amf_n2_ip: "10.10.10.200" + one_open5gs_vm_upf_n3_ip: "10.10.10.201" + one_open5gs_vm_s_nssai_sd: "000009" + ueransim-both: + type: "ueransim" + name: "both" + dependencies: + - "open5gs_vm-core" + input: + one_ueransim_networks: + - "tn_vxlan" + one_ueransim_mode: "both" + one_ueransim_gnb_linked_5gcore: "open5gs_vm-core" \ No newline at end of file From 8b0132fbf6ff93f50eb9674fa4b5966257b8c165 Mon Sep 17 00:00:00 2001 From: raulluzon Date: Mon, 20 Jul 2026 12:31:48 +0200 Subject: [PATCH 30/33] fix(tn_destroy): drop stale Address Range state before retrying destroy apply The OpenNebula terraform provider hard-errors with "AR not found" when an opennebula_virtual_network_address_range's AR was already destroyed as a side effect of the first (ignored) apply, but the resource is still tracked in state. Parse that failure for the affected VNet IDs and remove just the matching stale AR entries from state before the second, must-succeed apply. Co-Authored-By: Claude Sonnet 5 --- .global/cac/tn_destroy.yaml | 38 +++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) diff --git a/.global/cac/tn_destroy.yaml b/.global/cac/tn_destroy.yaml index 028c8e8f..ad890996 100644 --- a/.global/cac/tn_destroy.yaml +++ b/.global/cac/tn_destroy.yaml @@ -32,6 +32,44 @@ state: "present" force_init: true ignore_errors: true + register: first_apply_result + + # The OpenNebula terraform provider can hard-error on refresh/plan when an + # opennebula_virtual_network_address_range's AR was already removed from OpenNebula + # (e.g. destroyed as a side effect of the first, ignored apply above) but the AR + # resource itself is still tracked in state. Drop just those stale AR entries so the + # retry below can proceed instead of failing again with "AR not found". + - name: Dump current terraform state as JSON to detect stale Address Ranges + ansible.builtin.command: + cmd: terraform show -json + chdir: "{{ workspace }}/.terraform/" + register: tf_state_dump + changed_when: false + + - name: Identify OpenNebula Virtual Network IDs reported as having a missing Address Range + ansible.builtin.set_fact: + stale_ar_vnet_ids: "{{ (first_apply_result.msg | default('')) | regex_findall('Virtual network \\(ID:(\\d+)\\): AR \\(ID:\\d+\\) not found') }}" + + - name: Compute terraform state addresses for the stale Address Range resources + ansible.builtin.set_fact: + stale_ar_state_addresses: >- + {{ + (tf_state_dump.stdout | from_json).values.root_module.resources + | default([]) + | selectattr('type', 'equalto', 'opennebula_virtual_network_address_range') + | selectattr('values.virtual_network_id', 'in', stale_ar_vnet_ids) + | map(attribute='address') + | list + }} + when: stale_ar_vnet_ids | length > 0 + + - name: Remove stale Address Range entries from terraform state so the retry can proceed + ansible.builtin.command: + cmd: "terraform state rm {{ item }}" + chdir: "{{ workspace }}/.terraform/" + loop: "{{ stale_ar_state_addresses | default([]) }}" + when: stale_ar_vnet_ids | length > 0 + ignore_errors: true - name: Run 'terraform apply' a second time. Command should now succeed community.general.terraform: From 6b64d6bee17c86f03779068dd829f373695b2370 Mon Sep 17 00:00:00 2001 From: raulluzon Date: Mon, 20 Jul 2026 12:58:37 +0200 Subject: [PATCH 31/33] fix(tn_destroy): broaden stale-AR detection to cover the free_ar INTERNAL error The first observed failure mode ("AR (ID:Y) not found") is not the only one OpenNebula's provider produces for an already-gone AR; a second run hit "AR (ID:Y): OpenNebula error [INTERNAL]: [one.vn.free_ar] Address Range does not exist" instead, which the previous regex didn't match. Match on the common "Virtual network (ID:X): AR (ID:Y)" prefix instead of the trailing error text, since that phrase is specific to this failure regardless of wording. Co-Authored-By: Claude Sonnet 5 --- .global/cac/tn_destroy.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.global/cac/tn_destroy.yaml b/.global/cac/tn_destroy.yaml index ad890996..6f5313c2 100644 --- a/.global/cac/tn_destroy.yaml +++ b/.global/cac/tn_destroy.yaml @@ -46,9 +46,12 @@ register: tf_state_dump changed_when: false + # Matches both observed OpenNebula provider error phrasings for a stale AR: + # "Virtual network (ID:X): AR (ID:Y) not found" + # "Virtual network (ID:X): AR (ID:Y): OpenNebula error [INTERNAL]: [one.vn.free_ar] Address Range does not exist" - name: Identify OpenNebula Virtual Network IDs reported as having a missing Address Range ansible.builtin.set_fact: - stale_ar_vnet_ids: "{{ (first_apply_result.msg | default('')) | regex_findall('Virtual network \\(ID:(\\d+)\\): AR \\(ID:\\d+\\) not found') }}" + stale_ar_vnet_ids: "{{ (first_apply_result.msg | default('')) | regex_findall('Virtual network \\(ID:(\\d+)\\): AR \\(ID:\\d+\\)') }}" - name: Compute terraform state addresses for the stale Address Range resources ansible.builtin.set_fact: From d44ced18cdd0142750231de05b32d480c7d9a679 Mon Sep 17 00:00:00 2001 From: raulluzon Date: Mon, 20 Jul 2026 13:27:22 +0200 Subject: [PATCH 32/33] fix(tn_destroy): fix silent type mismatch when matching stale AR resources The previous selectattr('values.virtual_network_id', 'in', stale_ar_vnet_ids) pipeline silently matched nothing whenever virtual_network_id was stored as an int in state (stale_ar_vnet_ids from regex_findall is always strings), so the cleanup step never actually ran despite correctly identifying the affected VNet IDs. Replace the selectattr/map pipeline with a direct loop over state resources with an explicit `| string` cast in the per-item when condition, which can't silently type-mismatch the way selectattr('in') did. Co-Authored-By: Claude Sonnet 5 --- .global/cac/tn_destroy.yaml | 28 ++++++++++++---------------- 1 file changed, 12 insertions(+), 16 deletions(-) diff --git a/.global/cac/tn_destroy.yaml b/.global/cac/tn_destroy.yaml index 6f5313c2..2ba67148 100644 --- a/.global/cac/tn_destroy.yaml +++ b/.global/cac/tn_destroy.yaml @@ -53,25 +53,21 @@ ansible.builtin.set_fact: stale_ar_vnet_ids: "{{ (first_apply_result.msg | default('')) | regex_findall('Virtual network \\(ID:(\\d+)\\): AR \\(ID:\\d+\\)') }}" - - name: Compute terraform state addresses for the stale Address Range resources - ansible.builtin.set_fact: - stale_ar_state_addresses: >- - {{ - (tf_state_dump.stdout | from_json).values.root_module.resources - | default([]) - | selectattr('type', 'equalto', 'opennebula_virtual_network_address_range') - | selectattr('values.virtual_network_id', 'in', stale_ar_vnet_ids) - | map(attribute='address') - | list - }} - when: stale_ar_vnet_ids | length > 0 - + # virtual_network_id may be tracked as an int or a string depending on provider + # version, while stale_ar_vnet_ids (from regex_findall) is always a list of strings; + # cast explicitly per-item in the `when` below so the comparison isn't silently + # type-mismatched (a selectattr('..., 'in', ...) pipeline can't cast inline). - name: Remove stale Address Range entries from terraform state so the retry can proceed ansible.builtin.command: - cmd: "terraform state rm {{ item }}" + cmd: "terraform state rm {{ item.address }}" chdir: "{{ workspace }}/.terraform/" - loop: "{{ stale_ar_state_addresses | default([]) }}" - when: stale_ar_vnet_ids | length > 0 + loop: "{{ (tf_state_dump.stdout | from_json).values.root_module.resources | default([]) }}" + loop_control: + label: "{{ item.address }}" + when: >- + stale_ar_vnet_ids | length > 0 and + item.type == 'opennebula_virtual_network_address_range' and + (item.values.virtual_network_id | string) in stale_ar_vnet_ids ignore_errors: true - name: Run 'terraform apply' a second time. Command should now succeed From 0604b778c02a5186790dc6a34bbe8e6f5f52d8e1 Mon Sep 17 00:00:00 2001 From: raulluzon Date: Mon, 20 Jul 2026 17:36:11 +0200 Subject: [PATCH 33/33] fix(tn_destroy): use bracket notation to avoid dict-method name collision `.values` and (per-resource) `.values` again are dict keys in terraform show -json's output, but Jinja2 dot-notation resolves them to Python's built-in dict.values() method instead of the "values" key, since attribute lookup is tried before key lookup. Combined with `| default([])`, this silently produced an empty list rather than erroring, so the loop always had zero items and "skipping" was the *expected* (but wrong) outcome for every run so far. Switch both accesses to bracket notation, which resolves against dict keys directly. Verified in isolation with a hand-crafted terraform show -json payload before landing this. Co-Authored-By: Claude Sonnet 5 --- .global/cac/tn_destroy.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.global/cac/tn_destroy.yaml b/.global/cac/tn_destroy.yaml index 2ba67148..a084f2f8 100644 --- a/.global/cac/tn_destroy.yaml +++ b/.global/cac/tn_destroy.yaml @@ -61,13 +61,13 @@ ansible.builtin.command: cmd: "terraform state rm {{ item.address }}" chdir: "{{ workspace }}/.terraform/" - loop: "{{ (tf_state_dump.stdout | from_json).values.root_module.resources | default([]) }}" + loop: "{{ (tf_state_dump.stdout | from_json)['values']['root_module']['resources'] | default([]) }}" loop_control: label: "{{ item.address }}" when: >- stale_ar_vnet_ids | length > 0 and item.type == 'opennebula_virtual_network_address_range' and - (item.values.virtual_network_id | string) in stale_ar_vnet_ids + (item['values']['virtual_network_id'] | string) in stale_ar_vnet_ids ignore_errors: true - name: Run 'terraform apply' a second time. Command should now succeed