Upgrade the base AMI to Fedora 41 #129
Draft
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jsf9k
added
improvement
jsf9k
force-pushed
the
improvement/upgrade-base-ami-to-fedora-40
branch
from
013791c
to
47cd223
Compare
jsf9k
force-pushed
the
improvement/upgrade-base-ami-to-fedora-40
branch
from
f806e19
to
dbc931e
Compare
Merged
5 tasks
jsf9k
force-pushed
the
improvement/upgrade-base-ami-to-fedora-40
branch
from
e3efc0d
to
3af363c
Compare
|
I attempted to upgrade our staging COOL environment to use the new Fedora 40 AMI, but the replica creation process failed at the KRA stage. |
jsf9k
added
the
blocked
jsf9k
removed
the
blocked
jsf9k
added
the
blocked
…journald This is being done for testing purposes and can be reverted once cisagov/ansible-role-persist-journald#40 has been merged.
…ch-agent This is being done for testing purposes and can be reverted once cisagov/ansible-role-cloudwatch-agent#58 has been merged.
This is being done for testing purposes and can be reverted once cisagov/ansible-role-hardening-2#3 is merged.
This can be done now that cisagov/ansible-role-hardening-2#3 has been merged.
…-agent We can do this now that cisagov/ansible-role-cloudwatch-agent#58 has been merged.
…urnald We can do this now that cisagov/ansible-role-persist-journald#40 has been merged.
jsf9k
force-pushed
the
improvement/upgrade-base-ami-to-fedora-40
branch
from
ffaa2e6
to
df7baad
Compare
This project uses community.general.ufw, which is packaged into ansible, so it requires this dependency.
jsf9k
changed the title
This is being done for testing purposes and this change can be reverted once cisagov/ansible-role-upgrade#66 is merged.
jsf9k
force-pushed
the
improvement/upgrade-base-ami-to-fedora-40
branch
from
a88650b
to
4bca549
Compare
This is necessary because the base AMI we use does not come with the python3-libdnf5 package preinstalled. Since Ansible detects dnf5 as the package manage on Fedora 41 and above, this package must be installed before Ansible can be run.
jsf9k
force-pushed
the
improvement/upgrade-base-ami-to-fedora-40
branch
from
76b584a
to
5a440e7
Compare
Since the scripts are being run under bash there is no need for them to be executable.
…d-security-updates This is being done for testing purposes and this change can be reverted once cisagov/ansible-role-automated-security-updates#38 is merged.
We can do this now that cisagov/ansible-role-upgrade#66 has been merged.
…security-updates We can do this now that cisagov/ansible-role-automated-security-updates#38 has been merged.
7 tasks
|
I attempted to upgrade our COOL staging environment to use the new Fedora 41 AMI, but the instance failed to start up properly. It did not respond to pings and the CloudWatch Agent did not start up correctly. The changes in cisagov/freeipa-server-tf-module#86 appear to remedy this. I will fully test by again attempting to upgrade our COOL staging environment in the coming days. |
This is a temporary measure so that we can login via the user on the serial console to debug why the AMI is not booting up correctly.
There is no need to do this because before hardening /tmp has not yet had the noexec bit set.
jsf9k
force-pushed
the
improvement/upgrade-base-ami-to-fedora-40
branch
from
eaa98b4
to
5705ef1
Compare
I was wrong. The changes in cisagov/freeipa-server-tf-module#86 do not remedy the situation. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
🗣 Description
This pull request upgrades the base AMI from Fedora 39 to Fedora 41.
💭 Motivation and context
Resolves #127.
🧪 Testing
Not yet...
✅ Pre-approval checklist
✅ Pre-merge checklist
/etc/systemd/journald.confdirectly ansible-role-persist-journald#40 has been merged./etc/systemd/journald.confdirectly ansible-role-cloudwatch-agent#58 has been merged.auditd.serviceis restarted ansible-role-hardening-2#3 has been merged.dnf5package manager ansible-role-upgrade#66 has been merged.dnf5package manager ansible-role-automated-security-updates#38 has been merged.✅ Post-merge checklist