fix(agent): separate download and upload paths for agent package transfer

Fixes #741

The `win_copy` and `copy` modules always expect their source file to
be located either on the Ansible controller, or on the target host
itself when `remote_src: true` is set. They cannot transparently
bridge a file between two different remote hosts.

Previously, a single path variable (`__checkmk_agent_agent.file.*`)
was used both as the destination for the initial package download
(which may run on a delegated host, e.g. `localhost`, depending on
`checkmk_agent_delegate_download`) and as the source/destination for
the subsequent copy task onto the actual target host. When the
download was delegated to a host different from the target, this
caused the copy task to fail, since the file did not exist at the
expected location on the target.

This change splits the previously shared path into two explicit,
independent path sets:

- `__checkmk_agent_agent.file.download.*`: where the package is
  downloaded to (on the delegated/download host).
- `__checkmk_agent_agent.file.upload.*`: where the package is
  copied/uploaded to on the target host, and subsequently installed
  from.

All download tasks (`get_url`/`win_get_url` via
`checkmk_agent_delegate_download`) now write to `file.download.*`,
while the `copy`/`win_copy` tasks explicitly use `file.download.*`
as `src` and `file.upload.*` as `dest`. Installation tasks
(`package`, `zypper`, `win_package`) now consistently reference
`file.upload.*`, since that is the final location on the target
host.

Additionally:
- `checkmk_agent_delegate_download` is changed from a
  hostname-based variable (defaulting to `inventory_hostname`) to a
  boolean, making the delegation intent explicit rather than
  implicit through hostname comparison.
- `__checkmk_agent_host_tmp_dir` (used for the download destination)
  is now defined centrally in `vars/main.yml`, while OS-specific
  `__checkmk_agent_lin_tmp_dir` / `__checkmk_agent_win_tmp_dir`
  variables are introduced for the upload destination on Linux and
  Windows targets respectively.

Signed-off-by: Alexander Temp <alexander.temp@sit.nrw>

Author: Alexander Temp

roles/agent/defaults/main.yml

@@ -49,7 +49,7 @@ checkmk_agent_configure_firewall: true
 
 ## Delegation
 checkmk_agent_delegate_api_calls: 'localhost'
-checkmk_agent_delegate_download: "{{ inventory_hostname }}"
+checkmk_agent_delegate_download: true
 checkmk_agent_delegate_registration: false
 checkmk_agent_delegate_registration_target: "{{ inventory_hostname }}"
 

roles/agent/tasks/Debian.yml

@@ -2,7 +2,7 @@
 - name: "{{ ansible_facts['os_family'] }} Derivatives: Install host-specific {{ checkmk_agent_edition | upper }} Agent."
   become: true
   ansible.builtin.package:
-    deb: "{{ __checkmk_agent_agent.file.host }}"
+    deb: "{{ __checkmk_agent_agent.file.upload.host }}"
     force: "{{ checkmk_agent_force_install | bool }}"
     state: present
   when: |
@@ -14,7 +14,7 @@
 - name: "{{ ansible_facts['os_family'] }} Derivatives: Install folder-specific {{ checkmk_agent_edition | upper }} Agent."
   become: true
   ansible.builtin.package:
-    deb: "{{ __checkmk_agent_agent.file.pro }}"
+    deb: "{{ __checkmk_agent_agent.file.upload.pro }}"
     force: "{{ checkmk_agent_force_install | bool }}"
     state: present
   when: |
@@ -26,7 +26,7 @@
 - name: "{{ ansible_facts['os_family'] }} Derivatives: Install Vanilla Agent."
   become: true
   ansible.builtin.package:
-    deb: "{{ __checkmk_agent_agent.file.community }}"
+    deb: "{{ __checkmk_agent_agent.file.upload.community }}"
     force: "{{ checkmk_agent_force_install | bool }}"
     state: present
   when: |

roles/agent/tasks/Linux-files.yml

@@ -7,7 +7,7 @@
       os_type={{ __checkmk_agent_files_mapping[ansible_facts['os_family']] }}&\
       agent_type=host_name"
     validate_certs: "{{ checkmk_agent_server_validate_certs | bool }}"
-    dest: "{{ __checkmk_agent_agent.file.host }}"
+    dest: "{{ __checkmk_agent_agent.file.download.host }}"
     method: GET
     headers:
       Authorization: "Bearer {{ checkmk_agent_user }} {{ __checkmk_agent_auth }}"
@@ -20,7 +20,7 @@
   # This task may fail, as we fall back to the vanilla agent later
   failed_when: false
   changed_when: __checkmk_agent_host_download_state.status is defined and __checkmk_agent_host_download_state.status == 200
-  delegate_to: "{{ checkmk_agent_delegate_download }}"
+  delegate_to: "{{ 'localhost' if checkmk_agent_delegate_download else 'inventory_hostname' }}"
   tags:
     - download-package
 
@@ -39,7 +39,7 @@
       folder_name={{ checkmk_agent_folder }}&\
       agent_type=generic"
     validate_certs: "{{ checkmk_agent_server_validate_certs | bool }}"
-    dest: "{{ __checkmk_agent_agent.file.pro }}"
+    dest: "{{ __checkmk_agent_agent.file.download.pro }}"
     method: GET
     headers:
       Authorization: "Bearer {{ checkmk_agent_user }} {{ __checkmk_agent_auth }}"
@@ -56,7 +56,7 @@
   # This task may fail, as we fall back to the vanilla agent later
   failed_when: false
   changed_when: __checkmk_agent_folder_download_state.status is defined and __checkmk_agent_folder_download_state.status == 200
-  delegate_to: "{{ checkmk_agent_delegate_download }}"
+  delegate_to: "{{ 'localhost' if checkmk_agent_delegate_download else 'inventory_hostname' }}"
   tags:
     - download-package
 
@@ -71,7 +71,7 @@
   ansible.builtin.get_url:  # This has to be the `get_url` module, as the download works different than for the bakery-based tasks.
     url: "{{ __checkmk_agent_agent.url.community }}"
     validate_certs: "{{ checkmk_agent_server_validate_certs | bool }}"
-    dest: "{{ __checkmk_agent_agent.file.community }}"
+    dest: "{{ __checkmk_agent_agent.file.download.community }}"
     mode: '0644'
     timeout: "{{ checkmk_agent_download_timeout | default(omit) }}"
   become: false
@@ -82,14 +82,14 @@
   retries: 3
   delay: 10
   until: "not __checkmk_agent_vanilla_download_state.failed | bool"
-  delegate_to: "{{ checkmk_agent_delegate_download }}"
+  delegate_to: "{{ 'localhost' if checkmk_agent_delegate_download else 'inventory_hostname' }}"
   tags:
     - download-package
 
 - name: "{{ ansible_facts['system'] }}: Transfer host-specific {{ checkmk_agent_edition | upper }} Agent."
   ansible.builtin.copy:
-    src: "{{ __checkmk_agent_agent.file.host }}"
-    dest: "{{ __checkmk_agent_agent.file.host }}"
+    src: "{{ __checkmk_agent_agent.file.download.host }}"
+    dest: "{{ __checkmk_agent_agent.file.upload.host }}"
     mode: "0644"
   when: |
     checkmk_agent_edition | lower != "community"
@@ -100,8 +100,8 @@
 
 - name: "{{ ansible_facts['system'] }}: Transfer folder-specific {{ checkmk_agent_edition | upper }} Agent."
   ansible.builtin.copy:
-    src: "{{ __checkmk_agent_agent.file.pro }}"
-    dest: "{{ __checkmk_agent_agent.file.pro }}"
+    src: "{{ __checkmk_agent_agent.file.download.pro }}"
+    dest: "{{ __checkmk_agent_agent.file.upload.pro }}"
     mode: "0644"
   when: |
     checkmk_agent_edition | lower != "community"
@@ -112,8 +112,8 @@
 
 - name: "{{ ansible_facts['system'] }}: Transfer Vanilla {{ checkmk_agent_edition | upper }} Agent."
   ansible.builtin.copy:
-    src: "{{ __checkmk_agent_agent.file.community }}"
-    dest: "{{ __checkmk_agent_agent.file.community }}"
+    src: "{{ __checkmk_agent_agent.file.download.community }}"
+    dest: "{{ __checkmk_agent_agent.file.upload.community }}"
     mode: "0644"
   when: |
     checkmk_agent_delegate_download != inventory_hostname

roles/agent/tasks/Linux.yml

@@ -282,6 +282,6 @@
   loop:
     - "{{ __checkmk_agent_agent.file.community }}"
     - "{{ __checkmk_agent_agent.file.pro }}"
-    - "{{ __checkmk_agent_agent.file.host }}"
+    - "{{ __checkmk_agent_agent.file.download.host }}"
   tags:
     - download-package

roles/agent/tasks/RedHat.yml

@@ -2,7 +2,7 @@
 - name: "{{ ansible_facts['os_family'] }} Derivatives: Install host-specific {{ checkmk_agent_edition | upper }} Agent."
   become: true
   ansible.builtin.package:
-    name: "{{ __checkmk_agent_agent.file.host }}"
+    name: "{{ __checkmk_agent_agent.file.upload.host }}"
     state: present
     disable_gpg_check: true
   when: |
@@ -14,7 +14,7 @@
 - name: "{{ ansible_facts['os_family'] }} Derivatives: Install folder-specific {{ checkmk_agent_edition | upper }} Agent."
   become: true
   ansible.builtin.package:
-    name: "{{ __checkmk_agent_agent.file.pro }}"
+    name: "{{ __checkmk_agent_agent.file.upload.pro }}"
     state: present
     disable_gpg_check: true
   when: |
@@ -26,7 +26,7 @@
 - name: "{{ ansible_facts['os_family'] }} Derivatives: Install Vanilla Agent."
   become: true
   ansible.builtin.package:
-    name: "{{ __checkmk_agent_agent.file.community }}"
+    name: "{{ __checkmk_agent_agent.file.upload.community }}"
     state: present
     disable_gpg_check: true
   when: |

roles/agent/tasks/Suse.yml

@@ -2,7 +2,7 @@
 - name: "{{ ansible_facts['os_family'] }} Derivatives: Install host-specific {{ checkmk_agent_edition | upper }} Agent."
   become: true
   community.general.zypper:
-    name: "{{ __checkmk_agent_agent.file.host }}"
+    name: "{{ __checkmk_agent_agent.file.upload.host }}"
     force: "{{ checkmk_agent_force_install | bool }}"
     state: present
     disable_gpg_check: true
@@ -15,7 +15,7 @@
 - name: "{{ ansible_facts['os_family'] }} Derivatives: Install folder-specific {{ checkmk_agent_edition | upper }} Agent."
   become: true
   community.general.zypper:
-    name: "{{ __checkmk_agent_agent.file.pro }}"
+    name: "{{ __checkmk_agent_agent.file.upload.pro }}"
     force: "{{ checkmk_agent_force_install | bool }}"
     state: present
     disable_gpg_check: true
@@ -28,7 +28,7 @@
 - name: "{{ ansible_facts['os_family'] }} Derivatives: Install Vanilla Agent."
   become: true
   community.general.zypper:
-    name: "{{ __checkmk_agent_agent.file.community }}"
+    name: "{{ __checkmk_agent_agent.file.upload.community }}"
     force: "{{ checkmk_agent_force_install | bool }}"
     state: present
     disable_gpg_check: true

roles/agent/tasks/Win32NT-files.yml

@@ -7,7 +7,7 @@
       os_type={{ __checkmk_agent_files_mapping[ansible_facts['os_family']] }}&\
       agent_type=host_name"
     validate_certs: "{{ checkmk_agent_server_validate_certs | bool }}"
-    dest: "{{ __checkmk_agent_agent.file.host }}"
+    dest: "{{ __checkmk_agent_agent.file.download.host }}"
     method: GET
     headers:
       Authorization: "Bearer {{ checkmk_agent_user }} {{ __checkmk_agent_auth }}"
@@ -20,7 +20,7 @@
   # This task may fail, as we fall back to the vanilla agent later
   failed_when: false
   changed_when: __checkmk_agent_host_download_state.status_code is defined and __checkmk_agent_host_download_state.status_code == 200
-  delegate_to: "{{ checkmk_agent_delegate_download }}"
+  delegate_to: "{{ 'localhost' if checkmk_agent_delegate_download else 'inventory_hostname' }}"
   tags:
     - download-package
 
@@ -39,7 +39,7 @@
       folder_name={{ checkmk_agent_folder }}&\
       agent_type=generic"
     validate_certs: "{{ checkmk_agent_server_validate_certs | bool }}"
-    dest: "{{ __checkmk_agent_agent.file.pro }}"
+    dest: "{{ __checkmk_agent_agent.file.download.pro }}"
     method: GET
     headers:
       Authorization: "Bearer {{ checkmk_agent_user }} {{ __checkmk_agent_auth }}"
@@ -56,7 +56,7 @@
   # This task may fail, as we fall back to the vanilla agent later
   failed_when: false
   changed_when: __checkmk_agent_folder_download_state.status_code is defined and __checkmk_agent_folder_download_state.status_code == 200
-  delegate_to: "{{ checkmk_agent_delegate_download }}"
+  delegate_to: "{{ 'localhost' if checkmk_agent_delegate_download else 'inventory_hostname' }}"
   tags:
     - download-package
 
@@ -71,7 +71,7 @@
   ansible.windows.win_get_url:
     url: "{{ __checkmk_agent_agent.url.community }}"
     validate_certs: "{{ checkmk_agent_server_validate_certs | bool }}"
-    dest: "{{ __checkmk_agent_agent.file.community }}"
+    dest: "{{ __checkmk_agent_agent.file.download.community }}"
     timeout: "{{ checkmk_agent_download_timeout | default(omit) }}"
   when: |
     checkmk_agent_edition | lower == "community"
@@ -80,14 +80,14 @@
   retries: 3
   delay: 10
   until: "not __checkmk_agent_vanilla_download_state.failed | bool"
-  delegate_to: "{{ checkmk_agent_delegate_download }}"
+  delegate_to: "{{ 'localhost' if checkmk_agent_delegate_download else 'inventory_hostname' }}"
   tags:
     - download-package
 
 - name: "{{ ansible_facts['system'] }}: Transfer host-specific {{ checkmk_agent_edition | upper }} Agent."
   ansible.windows.win_copy:
-    src: "{{ __checkmk_agent_agent.file.host }}"
-    dest: "{{ __checkmk_agent_agent.file.host }}"
+    src: "{{ __checkmk_agent_agent.file.download.host }}"
+    dest: "{{ __checkmk_agent_agent.file.upload.host }}"
   when: |
     checkmk_agent_edition | lower != "community"
     and checkmk_agent_host_specific | bool
@@ -97,8 +97,8 @@
 
 - name: "{{ ansible_facts['system'] }}: Transfer folder-specific {{ checkmk_agent_edition | upper }} Agent."
   ansible.windows.win_copy:
-    src: "{{ __checkmk_agent_agent.file.pro }}"
-    dest: "{{ __checkmk_agent_agent.file.pro }}"
+    src: "{{ __checkmk_agent_agent.file.download.pro }}"
+    dest: "{{ __checkmk_agent_agent.file.upload.pro }}"
   when: |
     checkmk_agent_edition | lower != "community"
     and checkmk_agent_folder_specific | bool
@@ -108,8 +108,8 @@
 
 - name: "{{ ansible_facts['system'] }}: Transfer Vanilla {{ checkmk_agent_edition | upper }} Agent."
   ansible.windows.win_copy:
-    src: "{{ __checkmk_agent_agent.file.community }}"
-    dest: "{{ __checkmk_agent_agent.file.community }}"
+    src: "{{ __checkmk_agent_agent.file.download.community }}"
+    dest: "{{ __checkmk_agent_agent.file.upload.community }}"
   when: |
     checkmk_agent_delegate_download != inventory_hostname
     and (checkmk_agent_edition | lower == "community"

roles/agent/tasks/Windows.yml

@@ -1,7 +1,7 @@
 ---
 - name: "{{ ansible_facts['os_family'] }}: Install host-specific {{ checkmk_agent_edition | upper }} Agent."
   ansible.windows.win_package:
-    path: "{{ __checkmk_agent_agent.file.host }}"
+    path: "{{ __checkmk_agent_agent.file.upload.host }}"
     state: present
   when: |
     checkmk_agent_edition | lower != "community"
@@ -11,7 +11,7 @@
 
 - name: "{{ ansible_facts['os_family'] }}: Install folder-specific {{ checkmk_agent_edition | upper }} Agent."
   ansible.windows.win_package:
-    path: "{{ __checkmk_agent_agent.file.pro }}"
+    path: "{{ __checkmk_agent_agent.file.upload.pro }}"
     state: present
   when: |
     checkmk_agent_edition | lower != "community"
@@ -21,7 +21,7 @@
 
 - name: "{{ ansible_facts['os_family'] }}: Install Vanilla Agent."
   ansible.windows.win_package:
-    path: "{{ __checkmk_agent_agent.file.community }}"
+    path: "{{ __checkmk_agent_agent.file.upload.community }}"
     state: present
   when: |
     checkmk_agent_edition | lower == "community"
@@ -34,8 +34,8 @@
     path: "{{ item }}"
     state: absent
   loop:
-    - "{{ __checkmk_agent_agent.file.community }}"
-    - "{{ __checkmk_agent_agent.file.pro }}"
-    - "{{ __checkmk_agent_agent.file.host }}"
+    - "{{ __checkmk_agent_agent.file.upload.community }}"
+    - "{{ __checkmk_agent_agent.file.upload.pro }}"
+    - "{{ __checkmk_agent_agent.file.upload.host }}"
   tags:
     - download-package

roles/agent/vars/Debian.yml

@@ -1,11 +1,16 @@
 ---
-__checkmk_agent_host_tmp_dir: "/tmp"
+__checkmk_agent_lin_tmp_dir: "/tmp"
 
 __checkmk_agent_agent:
   url:
     community: "{{ __checkmk_agent_site_url }}/check_mk/agents/check-mk-agent_{{ checkmk_agent_version }}-1_all.deb"
     pro: "{{ __checkmk_agent_site_url }}/check_mk/api/1.0/domain-types/agent/actions/download_by_host/invoke"
   file:
-    community: "{{ __checkmk_agent_host_tmp_dir }}/check-mk-agent_{{ checkmk_agent_version }}-vanilla.deb"
-    pro: "{{ __checkmk_agent_host_tmp_dir }}/check-mk-agent_{{ checkmk_agent_version }}-generic.deb"
-    host: "{{ __checkmk_agent_host_tmp_dir }}/check-mk-agent_{{ checkmk_agent_version }}-{{ inventory_hostname }}.deb"
+    download:
+      community: "{{ __checkmk_agent_host_tmp_dir }}check-mk-agent_{{ checkmk_agent_version }}-vanilla.deb"
+      pro: "{{ __checkmk_agent_host_tmp_dir }}check-mk-agent_{{ checkmk_agent_version }}-generic.deb"
+      host: "{{ __checkmk_agent_host_tmp_dir }}check-mk-agent_{{ checkmk_agent_version }}-{{ inventory_hostname }}.deb"
+    upload:
+      community: "{{ __checkmk_agent_lin_tmp_dir }}/check-mk-agent_{{ checkmk_agent_version }}-vanilla.deb"
+      pro: "{{ __checkmk_agent_lin_tmp_dir }}/check-mk-agent_{{ checkmk_agent_version }}-generic.deb"
+      host: "{{ __checkmk_agent_lin_tmp_dir }}/check-mk-agent_{{ checkmk_agent_version }}-{{ inventory_hostname }}.deb"

roles/agent/vars/RedHat.yml

@@ -1,11 +1,16 @@
 ---
-__checkmk_agent_host_tmp_dir: "/tmp"
+__checkmk_agent_lin_tmp_dir: "/tmp"
 
 __checkmk_agent_agent:
   url:
     community: "{{ __checkmk_agent_site_url }}/check_mk/agents/check-mk-agent-{{ checkmk_agent_version }}-1.noarch.rpm"
     pro: "{{ __checkmk_agent_site_url }}/check_mk/api/1.0/domain-types/agent/actions/download_by_host/invoke"
   file:
-    community: "{{ __checkmk_agent_host_tmp_dir }}/check-mk-agent-{{ checkmk_agent_version }}-1.noarch-vanilla.rpm"
-    pro: "{{ __checkmk_agent_host_tmp_dir }}/check-mk-agent-{{ checkmk_agent_version }}-1.noarch-generic.rpm"
-    host: "{{ __checkmk_agent_host_tmp_dir }}/check-mk-agent-{{ checkmk_agent_version }}-1.noarch-{{ inventory_hostname }}.rpm"
+    download:
+      community: "{{ __checkmk_agent_host_tmp_dir }}check-mk-agent-{{ checkmk_agent_version }}-1.noarch-vanilla.rpm"
+      pro: "{{ __checkmk_agent_host_tmp_dir }}check-mk-agent-{{ checkmk_agent_version }}-1.noarch-generic.rpm"
+      host: "{{ __checkmk_agent_host_tmp_dir }}check-mk-agent-{{ checkmk_agent_version }}-1.noarch-{{ inventory_hostname }}.rpm"
+    upload:
+      community: "{{ __checkmk_agent_host_tmp_dir }}/check-mk-agent-{{ checkmk_agent_version }}-1.noarch-vanilla.rpm"
+      pro: "{{ __checkmk_agent_host_tmp_dir }}/check-mk-agent-{{ checkmk_agent_version }}-1.noarch-generic.rpm"
+      host: "{{ __checkmk_agent_host_tmp_dir }}/check-mk-agent-{{ checkmk_agent_version }}-1.noarch-{{ inventory_hostname }}.rpm"