Add update orchestrator with image-owned webconfig trampoline - #160
Merged
Conversation
Sequences the four feeder-update phases (apt, feed, webconfig, runtime-overlay) behind a single entrypoint so webconfig's Update System button has one launch path. The trampoline at /usr/local/lib/airplanes-webconfig/start-orchestrator.sh is image-owned so webconfig's sudoers entry pins a stable absolute path; the orchestrator binary itself lives in the runtime overlay and moves with each runtime release.
…n-absent Adds a flock at startup so concurrent invocations exit 75 without racing on state file writes or apt. Sets APT_IRREVERSIBLE before the 'apt/running' state-file write so a poller landing during the mutation window observes the correct flag. Chains apt-get update with apt-get upgrade via && so update failures surface. Replaces unused per-component dry-run gates with a plain helper-present check; the self-update helpers themselves are authoritative for 'is anything newer'.
…defaults Treat the runtime self-updater's FAILED_PRE_MUTATION + same_version_replay_* failure_reason as a no-op success — the orchestrator's contract is 'invoke when newer'; the helper itself decides what's newer and a same-version replay is the no-op case. Defaults for systemctl / apt-get pinned to absolute paths to match the header's stated privilege boundary. Reset APT_IRREVERSIBLE on the apt-get-not-found skip path so a poller doesn't see a stale 'irreversible' flag when no mutation happened.
Prior shape translated any pre-existing FAILED_PRE_MUTATION + same_version_replay_* state into orchestrator success — even when the current invocation exited without touching the state file (e.g. lock contention against rc=75). Snapshot mtime + inode before invoking the runtime self-updater and only honor the translation when this invocation actually rewrote the file.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the on-device update orchestrator that sequences the four feeder-update phases (apt, feed, webconfig, runtime-overlay) so webconfig's "Update System" button has a single launch path instead of four.
The orchestrator script ships inside the runtime overlay at
/opt/airplanes-runtime/current/lib/airplanes-update-orchestrator, where it travels with each runtime release. A small image-owned trampoline at/usr/local/lib/airplanes-webconfig/start-orchestrator.shis what webconfig's sudoers entry pins to; it exec()s the overlay-shipped binary after verifying that it is a regular file and executable, or exits 75 (EX_TEMPFAIL) so the capability gate in webconfig translates a missing overlay to HTTP 503 rather than a 500.Per-step state is persisted atomically to
/run/airplanes/orchestrator.state(JSON, schema covers step / status / started_at / finished_at / error / apt_irreversible) so an HTTP poller can render progress. apt failures are flagged as irreversible in the state file; other steps' self-updaters do their own rollback. After the feed step succeeds, the orchestrator SIGHUPs airplanes-webconfig so any feed-env schema change is observed in the live process.This PR does not bump
AIRPLANES_RUNTIME_OVERLAY_TAG, so the orchestrator binary will land in feeder images only after the next auto-publishedruntime-dev-<YYYYMMDD>-<sha>tag is consumed by a follow-up image config bump. The trampoline lands immediately and is asserted by boot-smoke.