From 301565b910383d90662e4850b05f1b0fbff81ef9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A2u=20Cao?= <raucao@kosmos.org>
Date: Sun, 5 Jul 2026 17:07:56 +0200
Subject: [PATCH] Move allowed node attrs to config file, apply automatically

This moves the whitelist for nodes' "normal" attributes to a config
file, which is loaded live during every run and applied in memory in
case the node's local file hasn't been updated before the client run.

Fixes allowed attributes being overwritten/removed in the node info
JSON files.
---
 .chef/config.rb                               |  6 +++--
 .../files/default/chef_normal_attributes.yml  |  6 +++++
 site-cookbooks/kosmos-base/recipes/default.rb | 27 +++++++++++++++++++
 3 files changed, 37 insertions(+), 2 deletions(-)
 create mode 100644 site-cookbooks/kosmos-base/files/default/chef_normal_attributes.yml

diff --git a/.chef/config.rb b/.chef/config.rb
index a0f2ce6..c081eb4 100644
--- a/.chef/config.rb
+++ b/.chef/config.rb
@@ -28,5 +28,7 @@ knife[:automatic_attribute_whitelist] = %w[
 
 # Added to /etc/chef/client.rb on node bootstrap
 # https://docs.chef.io/attribute_persistence/
-knife[:normal_attribute_allowlist] = ['knife_zero', 'kosmos_kvm', 'kosmos-ejabberd', 'openresty']
-knife[:allowed_normal_attributes] = ['knife_zero', 'kosmos_kvm', 'kosmos-ejabberd', 'openresty']
+# Source of truth: site-cookbooks/kosmos-base/files/default/chef_normal_attributes.yml
+normal_attrs = YAML.load_file(File.expand_path("../site-cookbooks/kosmos-base/files/default/chef_normal_attributes.yml", __dir__))
+knife[:normal_attribute_allowlist] = normal_attrs
+knife[:allowed_normal_attributes] = normal_attrs
diff --git a/site-cookbooks/kosmos-base/files/default/chef_normal_attributes.yml b/site-cookbooks/kosmos-base/files/default/chef_normal_attributes.yml
new file mode 100644
index 0000000..5a6e74e
--- /dev/null
+++ b/site-cookbooks/kosmos-base/files/default/chef_normal_attributes.yml
@@ -0,0 +1,6 @@
+---
+- knife_zero
+- kosmos_kvm
+- kosmos-ejabberd
+- openresty
+- vm_host
diff --git a/site-cookbooks/kosmos-base/recipes/default.rb b/site-cookbooks/kosmos-base/recipes/default.rb
index 7d7b5eb..5c6fa78 100644
--- a/site-cookbooks/kosmos-base/recipes/default.rb
+++ b/site-cookbooks/kosmos-base/recipes/default.rb
@@ -26,6 +26,33 @@
 
 include_recipe "apt"
 
+cookbook_file "/etc/chef/chef_normal_attributes.yml" do
+  source "chef_normal_attributes.yml"
+  owner "root"
+  group "root"
+  mode "0644"
+end
+
+ruby_block "update allowed_normal_attributes in client.rb" do
+  block do
+    whitelist = YAML.load_file("/etc/chef/chef_normal_attributes.yml")
+    fe = Chef::Util::FileEdit.new("/etc/chef/client.rb")
+    fe.search_file_replace_line(
+      /^allowed_normal_attributes.*/,
+      "allowed_normal_attributes #{whitelist.inspect}"
+    )
+    fe.write_file
+
+    Chef::Config[:allowed_normal_attributes] = whitelist
+    Chef::Config[:normal_attribute_allowlist] = whitelist
+  end
+  not_if do
+    whitelist = YAML.load_file("/etc/chef/chef_normal_attributes.yml")
+    client_rb = ::File.read("/etc/chef/client.rb")
+    whitelist.all? { |attr| client_rb.include?(attr) }
+  end
+end
+
 directory "/etc/apt/keyrings" do
   mode "0755"
   action :create