Skip to content

Instantly share code, notes, and snippets.

@LaurentDumont

LaurentDumont/mitigate-meltdown.yml

Forked from mnaser/mitigate-meltdown.yml
Created January 5, 2018 01:03
Download ZIP

Revisions

  1. @mnaser mnaser revised this gist Jan 4, 2018. 1 changed file with 2 additions and 1 deletion.
    3 changes: 2 additions & 1 deletion mitigate-meltdown.yml
    View file
    Original file line number Diff line number Diff line change
    @@ -19,6 +19,7 @@
    wait_for:
    host: "{{ ipmitool_lan_print.stdout }}"
    port: 80
    timeout: 5
    tasks:
    - name: install updated kernel
    yum:
    @@ -43,4 +44,4 @@
    --initrd=/boot/initramfs-3.10.0-693.11.6.el7.x86_64.img \
    --reuse-cmdline
    - debug:
    msg: Machine requires reboot and ready for `systemctl kexec`
    msg: Machine requires reboot and ready for `systemctl kexec`
  2. @mnaser mnaser revised this gist Jan 4, 2018. 1 changed file with 16 additions and 7 deletions.
    23 changes: 16 additions & 7 deletions mitigate-meltdown.yml
    View file
    Original file line number Diff line number Diff line change
    @@ -20,18 +20,27 @@
    host: "{{ ipmitool_lan_print.stdout }}"
    port: 80
    tasks:
    - name: check if system contains fix
    shell:
    cat /boot/config-$(uname -r)
    register: kernel_config
    changed_when: false
    - name: install updated kernel
    yum:
    name:
    - kernel-3.10.0-693.11.6.el7
    - microcode_ctl-2.1-22.2.el7
    state: installed
    post_tasks:
    - debug:
    msg: machine requires reboot
    - name: check if system contains fix
    shell:
    cat /boot/config-$(uname -r)
    register: kernel_config
    changed_when: false
    - name: prepare kexec
    when: '"CONFIG_KAISER=y" not in kernel_config.stdout'
    block:
    - name: unload current target
    shell: kexec -u
    - name: load kexec target
    shell: >
    kexec -l /boot/vmlinuz-3.10.0-693.11.6.el7.x86_64 \
    --initrd=/boot/initramfs-3.10.0-693.11.6.el7.x86_64.img \
    --reuse-cmdline
    - debug:
    msg: Machine requires reboot and ready for `systemctl kexec`
  3. @mnaser mnaser revised this gist Jan 4, 2018. 1 changed file with 3 additions and 1 deletion.
    4 changes: 3 additions & 1 deletion mitigate-meltdown.yml
    View file
    Original file line number Diff line number Diff line change
    @@ -27,7 +27,9 @@
    changed_when: false
    - name: install updated kernel
    yum:
    name: kernel-3.10.0-693.11.6.el7
    name:
    - kernel-3.10.0-693.11.6.el7
    - microcode_ctl-2.1-22.2.el7
    state: installed
    post_tasks:
    - debug:
  4. @mnaser mnaser revised this gist Jan 4, 2018. 1 changed file with 2 additions and 4 deletions.
    6 changes: 2 additions & 4 deletions mitigate-meltdown.yml
    View file
    Original file line number Diff line number Diff line change
    @@ -29,9 +29,7 @@
    yum:
    name: kernel-3.10.0-693.11.6.el7
    state: installed
    when: '"CONFIG_KAISER=y" not in kernel_config.stdout'
    register: yum_install
    post_tasks:
    - debug:
    msg: machine ready for reboot
    when: yum_install.changed
    msg: machine requires reboot
    when: '"CONFIG_KAISER=y" not in kernel_config.stdout'
  5. @mnaser mnaser created this gist Jan 4, 2018.
    37 changes: 37 additions & 0 deletions mitigate-meltdown.yml
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,37 @@
    ---
    - hosts: all
    gather_facts: false
    pre_tasks:
    - name: ensure ipmi tools are installed
    yum:
    name: ipmitool
    - name: retrieve ipmitool address
    shell: >
    ipmitool lan print | grep '^IP Addr' | grep -v Source | cut -d':' -f2 | xargs
    register: ipmitool_lan_print
    changed_when: false
    failed_when: ipmitool_lan_print.stdout == ""
    - name: print ipmi address
    debug:
    msg: "{{ ipmitool_lan_print.stdout }}"
    - name: ensure ipmi is accessible
    delegate_to: localhost
    wait_for:
    host: "{{ ipmitool_lan_print.stdout }}"
    port: 80
    tasks:
    - name: check if system contains fix
    shell:
    cat /boot/config-$(uname -r)
    register: kernel_config
    changed_when: false
    - name: install updated kernel
    yum:
    name: kernel-3.10.0-693.11.6.el7
    state: installed
    when: '"CONFIG_KAISER=y" not in kernel_config.stdout'
    register: yum_install
    post_tasks:
    - debug:
    msg: machine ready for reboot
    when: yum_install.changed