[kvelarde-itential]

The itential-platform RPM hardcodes itential:itential ownership on every path it ships and resets it on install and upgrade. The deployer only re-owned the server, config and log directories, non-recursively. Most of the install and home trees stayed itential:itential, so the custom user couldn't use them. A customer reported this.

Changes (roles/platform)

• Ownership: install-platform.yml has a new final task that runs only when platform_user or platform_group is not itential.
  • It runs chown -hR on platform_root_dir (which contains the server and services dirs) and platform_itential_home_dir.
  • It runs a non-recursive chown -h on platform_config_dir and platform_log_dir, because their contents are created after the install.
  • It uses chown instead of the file module because a recursive file run took about 4 minutes on about 250k files, versus about 4 seconds for chown. -h re-owns symlinks such as /bin/python3 instead of their targets.
  • It replaces the unused set-file-ownership.yml, which is deleted, and the inline task in main.yml.
• Removed "Create itential directories": the RPM creates and owns these directories, and nothing uses them before the install. Server, config and log dirs are now mode 755 (the RPM's) instead of the forced 775. Intermediate parents that rpm creates, such as /var/log/itential and /hosting/itential, are root:root.
• Log relocation fix: install-platform-packages-relocate.yml now relocates the parent of platform_log_dir (/var/log/itential, the RPM's declared prefix). It used to relocate /var/log/itential/platform, which rpm rejects as "not relocatable". Any custom platform_log_dir failed at the RPM install, and rpm's error blamed a different path.
• Validation (validate-vars.yml):
  • Fails if platform_root_dir, platform_config_dir, platform_log_dir or platform_itential_home_dir is a system directory such as /, /etc, /home or /var/log. The recursive chown would otherwise damage the host.
  • Fails if platform_log_dir doesn't end in /platform. The RPM always creates platform beneath the relocated prefix.
• Certify: certify-platform.yml and the report template used a hardcoded /etc/itential/platform.properties, which broke certify with a custom config dir. They now use {{ platform_config_dir }}. The four become_user: "itential" tasks now use {{ platform_user }}.
• Housekeeping: CLAUDE.md updated, and a stale TODO comment removed from create-itential-user.yml.

Testing

Each test was a fresh Rocky 9 all-in-one on Itential Platform 6.5.2, and I inspected ownership over SSH. The pipeline passed every phase, including certify_platform, in all three:

• Defaults: the new task is skipped, and ownership is itential:itential, as the RPM sets it.
• Custom user/group with relocated root, config and home dirs: nothing under the custom paths is owned by itential, and the service runs as the custom user.
• Custom platform_log_dir: logs land in the custom directory, log_directory in platform.properties matches, and /var/log/itential is not created.

Known limitations

• With a custom group, the RPM %pre still creates an extra itential user, and it ships an empty itential:itential /opt/itential that can't be relocated.
• The deployer can no longer relocate the log dir to a path that doesn't end in /platform. The assert now rejects that.