[BUG] MKP install fails on 2.4.0p8.cre

[gurubert]

I have this in my site definition:

    mkp_packages:
      - name: 'sslcertificates'
        version: 9.2.1
        url: 'https://exchange.checkmk.com/packages/sslcertificates/1928/sslcertificates-9.2.1.mkp'
        checksum: 'md5:0bdaa05f53877a23dbc4fe65d30f0b54'
        installed: true
        enabled: true

Running the playbook for the checkmk.general.server role yields:

TASK [checkmk.general.server : Include MKP management tasks.] ****************************************************************************************************************************
included: /home/kurs/.ansible/collections/ansible_collections/checkmk/general/roles/server/tasks/mkp.yml for client01 => (item={'name': 'cephmon', 'version': '2.4.0p8', 'update_conflict_resolution': 'abort', 'state': 'started', 'admin_pw': '__omit_place_holder__ed88aad7d43ba668a3a66944aeadccc4c0c23404', 'omd_auto_restart': 'false', 'omd_config': [{'var': 'AUTOSTART', 'value': 'on'}], 'mkp_packages': [{'name': 'sslcertificates', 'version': '9.2.1', 'url': 'https://exchange.checkmk.com/packages/sslcertificates/1928/sslcertificates-9.2.1.mkp', 'checksum': 'md5:0bdaa05f53877a23dbc4fe65d30f0b54', 'installed': True, 'enabled': True}]})

TASK [checkmk.general.server : Download MKP Packages.] ***********************************************************************************************************************************
changed: [hostname] => (item={'name': 'sslcertificates', 'version': '9.2.1', 'url': 'https://exchange.checkmk.com/packages/sslcertificates/1928/sslcertificates-9.2.1.mkp', 'checksum': 'md5:0bdaa05f53877a23dbc4fe65d30f0b54', 'installed': True, 'enabled': True})

TASK [checkmk.general.server : Transfer MKP Packages.] ***********************************************************************************************************************************
skipping: [hostname] => (item={'name': 'sslcertificates', 'version': '9.2.1', 'url': 'https://exchange.checkmk.com/packages/sslcertificates/1928/sslcertificates-9.2.1.mkp', 'checksum': 'md5:0bdaa05f53877a23dbc4fe65d30f0b54', 'installed': True, 'enabled': True}) 
skipping: [hostname]

TASK [checkmk.general.server : Install mkp packages.] ************************************************************************************************************************************
failed: [hostname] (item={'name': 'sslcertificates', 'version': '9.2.1', 'url': 'https://exchange.checkmk.com/packages/sslcertificates/1928/sslcertificates-9.2.1.mkp', 'checksum': 'md5:0bdaa05f53877a23dbc4fe65d30f0b54', 'installed': True, 'enabled': True}) => {"__mkp": {"checksum": "md5:0bdaa05f53877a23dbc4fe65d30f0b54", "enabled": true, "installed": true, "name": "sslcertificates", "url": "https://exchange.checkmk.com/packages/sslcertificates/1928/sslcertificates-9.2.1.mkp", "version": "9.2.1"}, "ansible_loop_var": "__mkp", "changed": false, "cmd": ["/bin/bash", "-l", "-c", "mkp add /tmp/sslcertificates-9.2.1.mkp"], "delta": "0:00:00.022297", "end": "2025-07-23 09:48:35.615408", "failed_when_result": true, "msg": "non-zero return code", "rc": 127, "start": "2025-07-23 09:48:35.593111", "stderr": "/bin/bash: line 1: mkp: command not found", "stderr_lines": ["/bin/bash: line 1: mkp: command not found"], "stdout": "", "stdout_lines": []}

Does "Install mkp packages" run as root? Shouldn't it run "mkp add" as site user?

$ ansible-galaxy collection list | grep checkmk
checkmk.general                          6.0.0  

[robin-checkmk]

This is the task within the role:

- name: "Install mkp packages."
  become: true
  become_user: "{{ __site.name }}"
  ansible.builtin.command: "/bin/bash -l -c 'mkp add {{ __checkmk_server_tmp_dir }}/{{ __mkp.name }}-{{ __mkp.version }}.mkp'"
  changed_when: __checkmk_server_mkp_install_output.rc == 0
  failed_when: __checkmk_server_mkp_install_output.rc != 0 and 'exists on the site' not in __checkmk_server_mkp_install_output.stderr
  register: __checkmk_server_mkp_install_output
  loop: "{{ __site.mkp_packages }}"
  loop_control:
    loop_var: __mkp
  when: (__mkp.installed | default(true) ) | bool
  tags:
    - manage-mkp-packages

I am not too deep into bash, but the command and parameters look good to me and the become part handles the user selection. Maybe you can manually test in your environment, if you can reproduce the issue?

[gurubert]

The variable ansible_become_user is root as I found out through the Ansible debugger.

I have this in the variables for the playbook:

ansible_become: true
ansible_become_user: "root"
ansible_become_method: "sudo"
ansible_user: "kurs"

I have to ssh as user kurs into the host and then use sudo to become root before Ansible is able to execute anything.

Does this clash with your use of become_user in that module?

[robin-checkmk]

Hm, it is possible, that this clashes, however it feels surprising to me.
Any chance you can test and debug this further on your end?
I am not sure yet, if this is a bug with the role, or if it is more of a documentation thing.

[gurubert]

I am not able to change these settings because I cannot access the machine with other settings.

I was now able to reduce the configuration to ansible_user: "root".

Now the MKP installation works. But this is not ideal as most IT systems nowadays forbid the login as root.

[gurubert]

IMHO you cannot use become_user: "{{ __site.name }}" in the tasks of the module.

You need to run su - {{ __site.name }} -c … within the ansible.builtin.command.

[gurubert]

OK, fault was on my side.

I now removed the redundant ansible_become_user: "root" from my global playbook vars and MKP installation works.

[gurubert]

I have to reopen the issue as it fails again. I have now version 6.2.2 of checkmk.general installed and get this error:

TASK [checkmk.general.server : cephmon: Install MKP packages.] ****************************************************************************************************************************************************
[ERROR]: Task failed: Failed to set permissions on the temporary files Ansible needs to create when becoming an unprivileged user (rc: 1, err: chmod: invalid mode: ‘A+user:cephmon:rx:allow’
Try 'chmod --help' for more information.
}). For information on working around this, see https://docs.ansible.com/ansible-core/2.19/playbook_guide/playbooks_privilege_escalation.html#risks-of-becoming-an-unprivileged-user
Origin: /home/kurs/.ansible/collections/ansible_collections/checkmk/general/roles/server/tasks/mkp.yml:36:3

34     - manage-mkp-packages
35
36 - name: "{{ __site.name }}: Install MKP packages."
     ^ column 3

failed: [rgw01] (item={'name': 'sslcertificates', 'version': '9.2.1', 'url': 'https://exchange.checkmk.com/packages/sslcertificates/1928/sslcertificates-9.2.1.mkp', 'checksum': 'md5:0bdaa05f53877a23dbc4fe65d30f0b54', 'installed': True, 'enabled': True}) => {"__mkp": {"checksum": "md5:0bdaa05f53877a23dbc4fe65d30f0b54", "enabled": true, "installed": true, "name": "sslcertificates", "url": "https://exchange.checkmk.com/packages/sslcertificates/1928/sslcertificates-9.2.1.mkp", "version": "9.2.1"}, "ansible_loop_var": "__mkp", "changed": false, "msg": "Task failed: Failed to set permissions on the temporary files Ansible needs to create when becoming an unprivileged user (rc: 1, err: chmod: invalid mode: ‘A+user:cephmon:rx:allow’\nTry 'chmod --help' for more information.\n}). For information on working around this, see https://docs.ansible.com/ansible-core/2.19/playbook_guide/playbooks_privilege_escalation.html#risks-of-becoming-an-unprivileged-user"}