fix(roles/kernel_settings): work with fedora.linux_system_roles 2.5.0

CHANGELOG.md

@@ -83,6 +83,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+* **role:kernel_settings**: The role works with fedora.linux_system_roles 2.5.0 and later, which a fresh installation of LFOps pulls in. Until now the run aborted with "kernel_settings_transparent_hugepages must be null, one of always, madvise, never" unless `kernel_settings__transparent_hugepages__*_var` and `kernel_settings__transparent_hugepages_defrag__*_var` were set.
 * **role:system_update**: The AIDE database is only updated after an update if a check right before the update comes out clean, instead of relying on the last scheduled check, so changes made since then are no longer accepted along with the update; a check that cannot run at all is reported in a mail of its own.
 * **role:fangfrisch**: `--tags fangfrisch:state` no longer aborts on an undefined variable.
 * **role:firewall**: Hosts in one run with different `firewall__fwbuilder_repo_url` values each deploy `/etc/fwb.sh` from their own repository, instead of all from the repository of the first host.

extensions/molecule/kernel_settings/sysctl/inventory/group_vars/systems_under_test.yml

@@ -1,3 +1,7 @@
 kernel_settings__sysctl__group_var:
   - name: 'vm.overcommit_memory'
     value: 1
+
+# set, to check that a value reaches the kernel; systemd_cpu_affinity and
+# transparent_hugepages_defrag stay unset, to check that fedora.linux_system_roles accepts that
+kernel_settings__transparent_hugepages__group_var: 'madvise'

extensions/molecule/kernel_settings/sysctl/verify.yml

@@ -10,3 +10,17 @@
     - name: 'Assert that vm.overcommit_memory is set to 1'
       ansible.builtin.assert:
         that: '__molecule__sysctl_vm_overcommit_memory_result["content"] | ansible.builtin.b64decode | int == 1'
+
+
+- name: 'Verify transparent_hugepages is set'
+  hosts: 'systems_under_test'
+  gather_facts: false
+  tasks:
+    - name: 'Read /sys/kernel/mm/transparent_hugepage/enabled'
+      ansible.builtin.slurp:
+        src: '/sys/kernel/mm/transparent_hugepage/enabled'
+      register: '__molecule__transparent_hugepage_enabled_result'
+
+    - name: 'Assert that transparent hugepages are set to madvise'
+      ansible.builtin.assert:
+        that: '"[madvise]" in (__molecule__transparent_hugepage_enabled_result["content"] | ansible.builtin.b64decode)'

roles/kernel_settings/tasks/main.yml

@@ -25,15 +25,32 @@
       state: 'present'
     when: 'kernel_settings__sysctl__combined_var | selectattr("name", "match", "^sunrpc\.") | list | length > 0'  # if there is at least one key starting with "sunrpc."
 
+  # fedora.linux_system_roles >= 2.5.0 accepts only null (leave the setting alone) for an unset
+  # value and rejects the empty string our defaults carry, while a template cannot hand a role a
+  # null (`{{ none }}` and `omit` arrive as strings, verified with ansible-core 2.16 and 2.18).
+  # So pass a value only if it is set; otherwise the null from the role's own defaults applies.
+  # Older versions treat both alike.
+  - name: 'Pass systemd_cpu_affinity to the kernel_settings role if it is set'
+    ansible.builtin.set_fact:
+      kernel_settings_systemd_cpu_affinity: '{{ kernel_settings__systemd_cpu_affinity__combined_var }}' # noqa var-naming[pattern]
+    when: 'kernel_settings__systemd_cpu_affinity__combined_var | string | length'
+
+  - name: 'Pass transparent_hugepages to the kernel_settings role if it is set'
+    ansible.builtin.set_fact:
+      kernel_settings_transparent_hugepages: '{{ kernel_settings__transparent_hugepages__combined_var }}' # noqa var-naming[pattern]
+    when: 'kernel_settings__transparent_hugepages__combined_var | string | length'
+
+  - name: 'Pass transparent_hugepages_defrag to the kernel_settings role if it is set'
+    ansible.builtin.set_fact:
+      kernel_settings_transparent_hugepages_defrag: '{{ kernel_settings__transparent_hugepages_defrag__combined_var }}' # noqa var-naming[pattern]
+    when: 'kernel_settings__transparent_hugepages_defrag__combined_var | string | length'
+
   - name: 'Use fedora.linux_system_roles.kernel_settings role to configure the kernel settings'
     ansible.builtin.include_role:
       name: 'fedora.linux_system_roles.kernel_settings'
     vars:
       kernel_settings_sysctl: '{{ kernel_settings__sysctl__combined_var }}' # noqa var-naming[pattern]
       kernel_settings_sysfs: '{{ kernel_settings__sysfs__combined_var }}' # noqa var-naming[pattern]
-      kernel_settings_systemd_cpu_affinity: '{{ kernel_settings__systemd_cpu_affinity__combined_var }}' # noqa var-naming[pattern]
-      kernel_settings_transparent_hugepages: '{{ kernel_settings__transparent_hugepages__combined_var }}' # noqa var-naming[pattern]
-      kernel_settings_transparent_hugepages_defrag: '{{ kernel_settings__transparent_hugepages_defrag__combined_var }}' # noqa var-naming[pattern]
 
   tags:
     - 'kernel_settings'