Promote profile::boot_security_upgrade to sandbox and modules/ - #295
Merged
Conversation
Copies #294 verbatim from environments/development into environments/sandbox and the global modules/ tree, so all three environments carry an identical profile module again. No behavior change from what ran in development: the same opt-in profile, the same best-effort InspectorEc2Exclusion drop, and profile::github_runner consuming it with budget 480 / fail_on_error true. The runner-specific gha-boot-security-upgrade.sh is removed from both trees. Validated in development before promoting: a full instance refresh completed at 100% (i-0028068b3d44d1b4b launched, i-0d969d2f86041003a terminated), with the upgrade succeeding on attempt 1 and the tag call returning clean. modules/ has no profile::apt_lock_timeout yet, so it was worth confirming the global tree satisfies this profile on its own: catalog compiles against modulepath "modules" alone, and against both environment paths, produce an identical exec -- same command, same creates marker, and all four require edges resolving including Package[awscli] and Package[cloud-guest-utils].
infrahouse8
approved these changes
Aug 21, 2026
akuzminsky
added a commit
that referenced
this pull request
Aug 21, 2026
First non-runner consumer of the profile. Jumphosts take the default fail_on_error => false: unlike a disposable runner, a bastion is long-lived, so an unpatched-but-reachable host beats an ABANDONed one. One file covers every environment -- role/ exists only in global modules/, environments carry just profile/ -- and it resolves because #295 put the profile in all three trees. Verified by compiling a full role::jumphost catalog (external modules stubbed, provision-time facts supplied) against all three modulepaths: identical exec in each, returns [0,1] confirming the log-and-continue default, and Package[cloud-guest-utils] and Package[awscli] appearing exactly once -- no duplicate declaration against profile::base or profile::jumphost.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follows #294. Copies the profile verbatim from
environments/developmentintoenvironments/sandboxand the globalmodules/tree, so all three environments carry an identicalprofilemodule again.No behavior change from what has been running in development: same opt-in profile, same best-effort
InspectorEc2Exclusiondrop, andprofile::github_runnerconsuming it withbudget => 480/fail_on_error => true. The runner-specificgha-boot-security-upgrade.shis removed from both trees.Validated in development first
A full instance refresh completed at 100% —
i-0028068b3d44d1b4blaunched,i-0d969d2f86041003aterminated — with the upgrade succeeding on attempt 1 and the tag call returning clean.Global tree checked on its own
modules/has noprofile::apt_lock_timeoutyet, so it was worth confirming the global tree satisfies this profile without help from an environment overlay. Catalog compiles against modulepathmodulesalone, and against both environment paths, produce an identical exec:All four
requireedges resolve in every tree.cloud-guest-utilsis declared nowhere else in the repo, so no duplicate-declaration collision. All three copies of the three files are byte-identical, and no reference to the old script name remains anywhere.Still not covered
The Terraform side still has to tag instances with
InspectorEc2Exclusionat launch.delete-tagsignores a key that isn't there, so a clean return proves the permission exists but not that the tag was set. Until that lands, this profile patches early — useful on its own — but doesn't yet close the Inspector window.Also expect a one-off
Could not retrieve information from ... gha-boot-security-upgrade.sherror in the first of ih-puppet's two applies on instances still booting older baked puppet-code. That is the old catalog referencing a source the mid-catalogPackage['puppet-code']upgrade just deleted; only the second apply's exit code is captured, and it recompiles clean. Same as observed on #294.🤖 Generated with Claude Code
https://claude.ai/code/session_01KLGAXtoyoakLXUjaJSL4M3