Rudder

could not reproduce
rejecting, will reopen if it still happen

log in parent ticket doesn't work
when making it work, it says

Inconsistency when modifying node lists for nodeGroup All classic Nodes managed by root policy server: previous content was NodeGroup(NodeGroupId(hasPolicyServer-root),All classic Nodes managed by root policy server,All classic Nodes known by Rudder directly connected to the root server. This group exists only as internal purpose and should not be used to configure nodes.,List(),Some({ returnType:'NodeAndPolicyServerReturnType' with 'And' criteria [node.policyServerId eq root ; node.agentName eq cfengine] }),true,Set(NodeId(e8546e25-e5a7-4f82-bc51-eca5e568413c), NodeId(root)),true,true), new is NodeGroup(NodeGroupId(hasPolicyServer-root),All classic Nodes managed by root policy server,All classic Nodes known by Rudder directly connected to the root server. This group exists only as internal purpose and should not be used to configure nodes.,List(),Some({ returnType:'NodeAndPolicyServerReturnType' with 'And' criteria [node.policyServerId eq root ; node.agentName eq cfengine] }),true,Set(NodeId(e8546e25-e5a7-4f82-bc51-eca5e568413c), NodeId(root)),true,false) - only the node list should change

difference is in the last value: true vs false for isSystem

surprisingly, this is random

i don't understand how the status can differ

Hum, the only case where we use that default parameter seems to be for clone or group creation via ui/api - unlikely the problem for that group.

For posterity: we were forgetting to save the "isSystem" status, so corresponding attribute was deleted in ldap, and when read back, it was missing and defaulted to false (but only on one method, so once saved again it was their).

To reproduce:

- check that group "isSystem" is set to true in ldap or change its value to true otherwise,
- change some node agent from "community" to anything else,
- reload dyngroup

=> isSystem is now to false in entry.