Bug #21924
closedPolicy generation broken when defining a group with invert result of inclusion of another group
Description
I created this group
and policy generation broke
No properties are definied by these groups (but an update campain is defined on the passiv group)
Error is
[2022-10-06 16:46:53+0200] ERROR policy.generation - Error while building target configuration node for node 'c8e2c037-78df-4530-8f3a-db7d337517c9' which is one of the target of rules. Ignoring it for the rest of the process <- Inconsistency: Error when looking for parent group '57e9a28c-8e0c-41f1-b7fa-2847c19f35d4' of group 'Active group' [191510ea-c276-4e19-9c34-3 ba03dc49587]. Please check criterium for that group.
happen in 7.2, maybe in earlier versions
Workaround: you can implement that behavior as rule site in place of at group site, by having in the include
part of the rule "all nodes" and in the exclude
part of the rule the group which was in the group criteria inverted.
analysis: the error is during node properties resolution. The code says "I don't find the group in the property hierarchy for which we told to NOT look for (invert). So in that case, we should just say "that group does not take part of property inheritance".
Files
Updated by François ARMAND about 2 years ago
- Severity set to Critical - prevents main use of Rudder | no workaround | data loss | security
- User visibility set to Operational - other Techniques | Rudder settings | Plugins
Updated by François ARMAND about 2 years ago
- UX impact set to It bothers me each time
- Priority changed from 0 to 88
Updated by Vincent MEMBRÉ about 2 years ago
- Target version changed from 7.2.1 to 7.2.2
Updated by Vincent MEMBRÉ almost 2 years ago
- Target version changed from 7.2.2 to 7.2.3
- Priority changed from 88 to 87
Updated by Vincent MEMBRÉ almost 2 years ago
- Target version changed from 7.2.3 to 7.2.4
- Priority changed from 87 to 86
Updated by Vincent MEMBRÉ almost 2 years ago
- Target version changed from 7.2.4 to 7.2.5
- Priority changed from 86 to 84
Updated by François ARMAND over 1 year ago
So, it breaks when we are resolving properties for a node.
The reason is that all nodes not in the inverted group are in the target of the group, but not of the parent, which breaks current logic.
Updated by François ARMAND over 1 year ago
- Description updated (diff)
So, the question is: do we want to inherit properties from an inverted parent group ? ie in the case we said "the node NOT IN THAT group" => no, we don't want to.
Updated by François ARMAND over 1 year ago
- Status changed from New to In progress
- Assignee changed from Nicolas CHARLES to François ARMAND
Updated by François ARMAND over 1 year ago
- Status changed from In progress to Pending technical review
- Assignee changed from François ARMAND to Vincent MEMBRÉ
- Pull Request set to https://github.com/Normation/rudder/pull/4703
Updated by Anonymous over 1 year ago
- Status changed from Pending technical review to Pending release
Applied in changeset rudder|5db22139550b402b76c744f5d57b28c224b44afc.
Updated by Félix DALLIDET over 1 year ago
- Fix check changed from To do to Checked
Updated by Vincent MEMBRÉ over 1 year ago
- Status changed from Pending release to Released
- Priority changed from 112 to 111
This bug has been fixed in Rudder 7.2.5 which was released today.