fix: harden Windows reboots and AD group creation against aws_ssm reconnect timeouts - #401
Merged
Merged
Conversation
…lity **Added:** - Boot-time baseline capture and block/rescue reboot verification across the `groups_domains`, `iis`, `mssql`, `trusts`, and `webdav` roles, so the expected aws_ssm reconnect timeout during a reboot no longer fails the play — reboots now verify completion via `LastBootUpTime` comparison and retry until the host is back - Async execution and `async_status` wait tasks for universal, global, and DomainLocal group creation in the `ad` role, with retries to tolerate transient failures during group provisioning - `sanitizeAWSEnv` helper in the ansible runner that drops `AWS_PROFILE` when explicit `AWS_ACCESS_KEY_ID`/`AWS_SESSION_TOKEN` are present, resolving the boto3 "profile and access tokens is not supported" error in the aws_ssm connection plugin - cli/internal/ansible/runner.go - Test coverage for the AWS env sanitization logic and for a fatal error rescued by block/rescue with a clean PLAY RECAP - cli/internal/ansible/runner_test.go, logparser_test.go **Changed:** - `CheckAnsibleSuccess` now treats an existing PLAY RECAP as authoritative, relying on ansible's failed/unreachable counters (which already discount rescued/ignored fatals) and only scanning for unignored fatals when no recap is present - cli/internal/ansible/logparser.go - Reduced reboot timeouts to standardized values (300s timeout, 60s post-reboot delay) now that verification is handled explicitly by the rescue logic - Regenerated architecture diagram and updated role README task listings to reflect the new baseline/reboot block structure - docs/architecture.svg
dreadnode-renovate-bot
Bot
added
area/roles
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Key Changes:
win_reboottasks in block/rescue patterns that record a pre-reboot boot-time baseline and verify the host actually rebooted, tolerating expected aws_ssm reconnect timeouts across the ad, groups_domains, iis, mssql, trusts, and webdav rolesasync_statuswait tasks to improve reliability of universal, global, and domainlocal group provisioningAWS_PROFILEwhen explicit access-key/session-token vars are present, resolving the boto3 "profile and access tokens is not supported" error in the aws_ssm connection pluginAdded:
async_statuswait tasks for universal, global, and domainlocal groups with retry/delay handling inansible/roles/ad/tasks/groups.yml, and documented them in the role READMEWin32_OperatingSystem.LastBootUpTime) acrossgroups_domains,iis,mssql,trusts, andwebdavroles to confirm reboots complete despite reconnect timeoutssanitizeAWSEnvincli/internal/ansible/runner.goto prevent boto3 profile+credential conflicts, with warning logging and a comprehensive test suite in the newcli/internal/ansible/runner_test.gocli/internal/ansible/logparser_test.gocovering fatals rescued by block/rescue with a clean recapChanged:
CheckAnsibleSuccessincli/internal/ansible/logparser.goso a present PLAY RECAP is authoritative (relying on ansible's failed/unreachable counters) and only falls back to fatal-scanning via the retry indicator when no recap existsasync: 120,poll: 0) with retries, startup timeout tuning, and result registrationwin_rebootinvocations with block/rescue blocks using shorterreboot_timeout/post_reboot_delayvalues across multiple roles, updating each role README accordinglybuildEnvto runos.Environ()output throughsanitizeAWSEnvdocs/architecture.svgwith updated layout dimensions