Fixes ownership and relocation problems when Itential Platform is installed with a custom platform_user/platform_group and relocated directories

roles/platform/CLAUDE.md

@@ -9,14 +9,12 @@ Installs and configures Itential Platform (IAP). Handles OS user/directory setup
 1. `validate-vars.yml` (always tagged) — validates required variables and loads release-specific vars
 2. Configure OS:
    a. `create-itential-user.yml` — create `itential` user and group
-   b. Create directories: `platform_server_dir`, `platform_config_dir`, `platform_log_dir`
-   c. Add sudoers entry for `chroot` (required by TemplateBuilder)
-   d. `configure-firewalld.yml` — open HTTP and HTTPS ports
+   b. `configure-firewalld.yml` — open HTTP and HTTPS ports
 3. Install Dependencies, Platform, Adapters, App Artifacts (notifies `Update Itential release file`):
    a. `install-platform-dependency-packages.yml` — install OS packages
    b. `install-nodejs.yml` — install NodeJS
    c. `install-python.yml` — install Python; installs pip dependencies as `platform_user` (`itential`) via `pip install --user` rather than system-wide as root, then validates each application dependency actually imports (see `roles/python/CLAUDE.md`). No `/usr/local/bin` python3/pip3 symlinks are created — the P6 Platform RPM already creates its own `python3` symlink under `/home/itential/bin`.
-   d. `install-platform.yml` — install IAP RPM packages. The itential-platform RPM declares a hardcoded `itential:itential` owner for `platform_server_dir`/`platform_config_dir`/`platform_log_dir` in its own package metadata, so installing/upgrading it silently resets ownership on these directories. Immediately after this step, `platform_user`/`platform_group` ownership is re-applied to all three (same `ansible.builtin.file` call as step 2b) so a non-default `platform_user` can actually start the service afterward.
+   d. `install-platform.yml` — install IAP RPM packages. The itential-platform RPM declares a hardcoded `itential:itential` owner for the paths it ships (`platform_root_dir`, `platform_services_dir`, `platform_server_dir`, `platform_config_dir`, `platform_log_dir`, and `platform_itential_home_dir`), so installing/upgrading it silently resets ownership on them. At the end of `install-platform.yml`, when `platform_user`/`platform_group` is not `itential`, a task runs `chown -hR platform_user:platform_group` on `platform_root_dir` (which contains the server and services dirs) and `platform_itential_home_dir`, and a non-recursive `chown -h` on `platform_config_dir` and `platform_log_dir` (their contents are created after the install). It uses `chown` rather than the `file` module because a recursive `file` run over ~250k files takes minutes. This lets a non-default `platform_user` start the service afterward.
    e. `install-adapters.yml` — install configured adapters
    f. `install-app-artifacts.yml` — when `platform_app_artifacts_enabled: true`
 4. `configure-selinux.yml` — apply SELinux configuration
@@ -31,6 +29,8 @@ Installs and configures Itential Platform (IAP). Handles OS user/directory setup
 - Asserts repo credentials when packages are downloaded from HTTP URLs
 - Asserts `platform_release` is defined OR all individual vars (`platform_nodejs_package`, `platform_python_version`, `platform_python_packages`, `platform_python_app_dependencies`) are defined
 - Asserts `platform_encryption_key` is a 64-character hex string
+- Asserts `platform_root_dir`, `platform_config_dir`, `platform_log_dir` and `platform_itential_home_dir` are not top-level system directories (`/`, `/etc`, `/home`, `/var`, `/var/log`, etc.), since ownership of these is changed to `platform_user:platform_group`
+- Asserts `platform_log_dir` ends in `/platform`. The RPM's relocatable prefix is `/var/log/itential` and it always creates `platform` beneath it, so `install-platform-packages-relocate.yml` relocates the parent of `platform_log_dir`
 - Validates Vault variables when `platform_configure_vault: true`
 - Validates PKI source directories when copy-certs flags are enabled
 - Loads `vars/platform-release-<N>.yml` and sets release-specific defaults for NodeJS/Python when not overridden in inventory

roles/platform/tasks/certify-platform.yml

@@ -39,11 +39,11 @@
 
 - name: Check Itential config file exists
   ansible.builtin.stat:
-    path: /etc/itential/platform.properties
+    path: "{{ platform_config_dir }}/platform.properties"
   register: platform_conf_file
 
 - name: Get Itential config file permissions
-  ansible.builtin.command: ls -la /etc/itential/platform.properties
+  ansible.builtin.command: ls -la {{ platform_config_dir }}/platform.properties
   register: platform_conf_permissions
   ignore_errors: true
   changed_when: false
@@ -56,7 +56,7 @@
 - name: Parse Itential config for server_id
   ansible.builtin.shell:
     cmd: >
-      grep '^server_id' /etc/itential/platform.properties |
+      grep '^server_id' {{ platform_config_dir }}/platform.properties |
       awk -F'=' '{print $2}' |
       xargs
   register: platform_server_id
@@ -67,7 +67,7 @@
 - name: Parse Itential config for mongo_auth_enabled
   ansible.builtin.shell:
     cmd: >
-      grep '^mongo_auth_enabled' /etc/itential/platform.properties
+      grep '^mongo_auth_enabled' {{ platform_config_dir }}/platform.properties
       | awk -F'=' '{print $2}' |
       xargs
   register: platform_mongo_auth_enabled
@@ -78,7 +78,7 @@
 - name: Parse Itential config for mongo_user
   ansible.builtin.shell:
     cmd: >
-      grep '^mongo_user' /etc/itential/platform.properties
+      grep '^mongo_user' {{ platform_config_dir }}/platform.properties
       | awk -F'=' '{print $2}' |
       xargs
   register: platform_mongo_user
@@ -89,7 +89,7 @@
 - name: Parse Itential config for mongo_auth_db
   ansible.builtin.shell:
     cmd: >
-      grep '^mongo_auth_db' /etc/itential/platform.properties |
+      grep '^mongo_auth_db' {{ platform_config_dir }}/platform.properties |
       awk -F'=' '{print $2}' |
       xargs
   register: platform_mongo_auth_db
@@ -100,7 +100,7 @@
 - name: Parse Itential config for mongo_db_name
   ansible.builtin.shell:
     cmd: >
-      grep '^mongo_db_name' /etc/itential/platform.properties |
+      grep '^mongo_db_name' {{ platform_config_dir }}/platform.properties |
       awk -F'=' '{print $2}' |
       xargs
   register: platform_mongo_db_name
@@ -111,7 +111,7 @@
 - name: Parse Itential config for mongo_url
   ansible.builtin.shell:
     cmd: >
-      grep '^mongo_url' /etc/itential/platform.properties |
+      grep '^mongo_url' {{ platform_config_dir }}/platform.properties |
       sed 's/^mongo_url[[:space:]]*=[[:space:]]*//' |
       xargs
   register: platform_mongo_url
@@ -132,7 +132,7 @@
 - name: Parse Itential config for mongo_tls_enabled
   ansible.builtin.shell:
     cmd: >
-      grep '^mongo_tls_enabled' /etc/itential/platform.properties |
+      grep '^mongo_tls_enabled' {{ platform_config_dir }}/platform.properties |
       awk -F'=' '{print $2}' |
       xargs
   register: platform_mongo_tls_enabled
@@ -143,7 +143,7 @@
 - name: Parse Itential config for mongo_read_concern
   ansible.builtin.shell:
     cmd: >
-      grep '^mongo_read_concern' /etc/itential/platform.properties |
+      grep '^mongo_read_concern' {{ platform_config_dir }}/platform.properties |
       awk -F'=' '{print $2}' |
       xargs
   register: platform_mongo_read_concern
@@ -154,7 +154,7 @@
 - name: Parse Itential config for mongo_write_concern
   ansible.builtin.shell:
     cmd: >
-      grep '^mongo_write_concern' /etc/itential/platform.properties |
+      grep '^mongo_write_concern' {{ platform_config_dir }}/platform.properties |
       awk -F'=' '{print $2}' |
       xargs
   register: platform_mongo_write_concern
@@ -165,7 +165,7 @@
 - name: Parse Itential config for redis_username
   ansible.builtin.shell:
     cmd: >
-      grep '^redis_username' /etc/itential/platform.properties |
+      grep '^redis_username' {{ platform_config_dir }}/platform.properties |
       awk -F'=' '{print $2}' |
       xargs
   register: platform_redis_username
@@ -176,7 +176,7 @@
 - name: Parse Itential config for redis_host
   ansible.builtin.shell:
     cmd: >
-      grep '^redis_host' /etc/itential/platform.properties |
+      grep '^redis_host' {{ platform_config_dir }}/platform.properties |
       awk -F'=' '{print $2}' |
       xargs
   register: platform_redis_host
@@ -187,7 +187,7 @@
 - name: Parse Itential config for redis_sentinel_username
   ansible.builtin.shell:
     cmd: >
-      grep '^redis_sentinel_username' /etc/itential/platform.properties |
+      grep '^redis_sentinel_username' {{ platform_config_dir }}/platform.properties |
       awk -F'=' '{print $2}' |
       xargs
   register: platform_redis_sentinel_username
@@ -198,7 +198,7 @@
 - name: Parse Itential config for redis_sentinels
   ansible.builtin.shell:
     cmd: >
-      grep '^redis_sentinels' /etc/itential/platform.properties |
+      grep '^redis_sentinels' {{ platform_config_dir }}/platform.properties |
       awk -F'=' '{print $2}' |
       xargs
   register: platform_redis_sentinels
@@ -209,7 +209,7 @@
 - name: Parse Itential config for redis_name
   ansible.builtin.shell:
     cmd: >
-      grep '^redis_name' /etc/itential/platform.properties |
+      grep '^redis_name' {{ platform_config_dir }}/platform.properties |
       awk -F'=' '{print $2}' |
       xargs
   register: platform_redis_name
@@ -220,7 +220,7 @@
 - name: Parse Itential config for redis_tls
   ansible.builtin.shell:
     cmd: >
-      grep '^redis_tls' /etc/itential/platform.properties
+      grep '^redis_tls' {{ platform_config_dir }}/platform.properties
       | awk -F'=' '{print $2}' |
       xargs
   register: platform_redis_tls
@@ -231,7 +231,7 @@
 - name: Parse Itential config for task_worker_enabled
   ansible.builtin.shell:
     cmd: >
-      grep '^task_worker_enabled' /etc/itential/platform.properties |
+      grep '^task_worker_enabled' {{ platform_config_dir }}/platform.properties |
       awk -F'=' '{print $2}' |
       xargs
   register: platform_task_worker_enabled
@@ -242,7 +242,7 @@
 - name: Parse Itential config for job_worker_enabled
   ansible.builtin.shell:
     cmd: >
-      grep '^job_worker_enabled' /etc/itential/platform.properties |
+      grep '^job_worker_enabled' {{ platform_config_dir }}/platform.properties |
       awk -F'=' '{print $2}' |
       xargs
   register: platform_job_worker_enabled
@@ -253,7 +253,7 @@
 - name: Parse Itential config for default_user_username
   ansible.builtin.shell:
     cmd: >
-      grep '^default_user_username' /etc/itential/platform.properties |
+      grep '^default_user_username' {{ platform_config_dir }}/platform.properties |
       awk -F'=' '{print $2}' |
       xargs
   register: platform_default_user_username
@@ -264,7 +264,7 @@
 - name: Parse Itential config for webserver_http_enabled
   ansible.builtin.shell:
     cmd: >
-      grep '^webserver_http_enabled' /etc/itential/platform.properties |
+      grep '^webserver_http_enabled' {{ platform_config_dir }}/platform.properties |
       awk -F'=' '{print $2}' |
       xargs
   register: platform_webserver_http_enabled
@@ -275,7 +275,7 @@
 - name: Parse Itential config for webserver_https_enabled
   ansible.builtin.shell:
     cmd: >
-      grep '^webserver_https_enabled' /etc/itential/platform.properties |
+      grep '^webserver_https_enabled' {{ platform_config_dir }}/platform.properties |
       awk -F'=' '{print $2}' |
       xargs
   register: platform_webserver_https_enabled
@@ -286,7 +286,7 @@
 - name: Parse Itential config for webserver_http_port
   ansible.builtin.shell:
     cmd: >
-      grep '^webserver_http_port' /etc/itential/platform.properties |
+      grep '^webserver_http_port' {{ platform_config_dir }}/platform.properties |
       awk -F'=' '{print $2}' |
       xargs
   register: platform_webserver_http_port
@@ -297,7 +297,7 @@
 - name: Parse Itential config for webserver_https_port
   ansible.builtin.shell:
     cmd: >
-      grep '^webserver_https_port' /etc/itential/platform.properties |
+      grep '^webserver_https_port' {{ platform_config_dir }}/platform.properties |
       awk -F'=' '{print $2}' |
       xargs
   register: platform_webserver_https_port
@@ -308,7 +308,7 @@
 - name: Parse Itential config for webserver_https_key
   ansible.builtin.shell:
     cmd: >
-      grep '^webserver_https_key' /etc/itential/platform.properties |
+      grep '^webserver_https_key' {{ platform_config_dir }}/platform.properties |
       awk -F'=' '{print $2}' |
       xargs
   register: platform_webserver_https_key
@@ -319,7 +319,7 @@
 - name: Parse Itential config for webserver_https_cert
   ansible.builtin.shell:
     cmd: >
-      grep '^webserver_https_cert' /etc/itential/platform.properties |
+      grep '^webserver_https_cert' {{ platform_config_dir }}/platform.properties |
       awk -F'=' '{print $2}' |
       xargs
   register: platform_webserver_https_cert
@@ -330,7 +330,7 @@
 - name: Parse Itential config for log_directory
   ansible.builtin.shell:
     cmd: >
-      grep '^log_directory' /etc/itential/platform.properties |
+      grep '^log_directory' {{ platform_config_dir }}/platform.properties |
       awk -F'=' '{print $2}' |
       xargs
   register: platform_log_directory
@@ -341,7 +341,7 @@
 - name: Parse Itential config for log_file
   ansible.builtin.shell:
     cmd: >
-      grep '^log_file' /etc/itential/platform.properties |
+      grep '^log_file' {{ platform_config_dir }}/platform.properties |
       awk -F'=' '{print $2}' |
       xargs
   register: platform_log_file
@@ -352,7 +352,7 @@
 - name: Parse Itential config for log_level
   ansible.builtin.shell:
     cmd: >
-      grep '^log_level[[:space:]]*=' /etc/itential/platform.properties |
+      grep '^log_level[[:space:]]*=' {{ platform_config_dir }}/platform.properties |
       awk -F'=' '{print $2}' |
       xargs
   register: platform_log_level
@@ -363,7 +363,7 @@
 - name: Parse Itential config for webserver_log_directory
   ansible.builtin.shell:
     cmd: >
-      grep '^webserver_log_directory' /etc/itential/platform.properties |
+      grep '^webserver_log_directory' {{ platform_config_dir }}/platform.properties |
       awk -F'=' '{print $2}' |
       xargs
   register: platform_webserver_log_directory
@@ -374,7 +374,7 @@
 - name: Parse Itential config for webserver_log_filename
   ansible.builtin.shell:
     cmd: >
-      grep '^webserver_log_filename' /etc/itential/platform.properties |
+      grep '^webserver_log_filename' {{ platform_config_dir }}/platform.properties |
       awk -F'=' '{print $2}' |
       xargs
   register: platform_webserver_log_filename
@@ -385,7 +385,7 @@
 - name: Parse Itential config for services_directory
   ansible.builtin.shell:
     cmd: >
-      grep '^service_directory' /etc/itential/platform.properties |
+      grep '^service_directory' {{ platform_config_dir }}/platform.properties |
       awk -F'=' '{print $2}' |
       xargs
   register: platform_service_directory
@@ -628,7 +628,7 @@
   changed_when: false
   failed_when: false
   become: true
-  become_user: "itential"
+  become_user: "{{ platform_user }}"
   become_flags: '-i'
   # become_method: ansible.builtin.su
 
@@ -639,7 +639,7 @@
   changed_when: false
   failed_when: false
   become: true
-  become_user: "itential"
+  become_user: "{{ platform_user }}"
   become_flags: '-i'
 
 - name: Get list of installed Python modules
@@ -649,7 +649,7 @@
   changed_when: false
   failed_when: false
   become: true
-  become_user: "itential"
+  become_user: "{{ platform_user }}"
   become_flags: '-i'
 
 - name: Get pip version
@@ -659,7 +659,7 @@
   changed_when: false
   failed_when: false
   become: true
-  become_user: "itential"
+  become_user: "{{ platform_user }}"
   become_flags: '-i'
 
 # ============================================================================

roles/platform/tasks/create-itential-user.yml

@@ -1,9 +1,6 @@
 # Copyright (c) 2024, Itential, Inc
 # GNU General Public License v3.0+ (see LICENSE or https://www.gnu.org/licenses/gpl-3.0.txt)
 ---
-
-# TODO: Remove this file once the RPM is creating the directories correctly
-
 - name: Create itential group
   ansible.builtin.group:
     name: "{{ platform_group }}"

roles/platform/tasks/install-platform-packages-relocate.yml

@@ -27,7 +27,7 @@
   vars:
     relocations:
       - { old: "{{ platform_root_dir_default }}", new: "{{ platform_root_dir }}" }
-      - { old: "{{ platform_log_dir_default }}", new: "{{ platform_log_dir }}" }
+      - { old: "{{ platform_log_dir_default | dirname }}", new: "{{ platform_log_dir | dirname }}" }
       - { old: "{{ platform_config_dir_default }}", new: "{{ platform_config_dir }}" }
       - { old: "{{ platform_itential_home_dir_default }}", new: "{{ platform_itential_home_dir }}" }
   loop: "{{ platform_packages_find_result.files | map(attribute='path') }}"

roles/platform/tasks/install-platform.yml

@@ -87,3 +87,24 @@
   vars:
     offline_rpms_path: "{{ platform_offline_control_node_rpms_dir }}/platform"
   when: offline_install_enabled
+
+# The itential-platform RPM hardcodes itential:itential ownership on every path it
+# ships (root, home, config and log dirs), on both install and upgrade. Re-own them
+# to platform_user/platform_group so a non-default user owns everything.
+# platform_server_dir and platform_services_dir live under platform_root_dir, so they
+# are covered by it. The root and home trees are re-owned recursively. The config and
+# log dirs only hold files created after the install, so only the dirs are re-owned.
+# chown is used instead of the file module with recurse because it takes seconds vs.
+# minutes for ~250k files. -h re-owns symlinks (e.g. <home>/bin/python3) rather than
+# their targets.
+- name: Set ownership of Itential Platform files after RPM install
+  ansible.builtin.shell:
+    cmd: >-
+      chown -hR {{ platform_user }}:{{ platform_group }}
+      {{ platform_root_dir | quote }}
+      {{ platform_itential_home_dir | quote }} &&
+      chown -h {{ platform_user }}:{{ platform_group }}
+      {{ platform_config_dir | quote }}
+      {{ platform_log_dir | quote }}
+  changed_when: true
+  when: platform_user != 'itential' or platform_group != 'itential'