feat(ipmi-exporter): add option to run with udev-based device access

[guivin]

Add an opt-in flag ipmi_exporter_run_with_capabilities that deploys a udev rule granting the service group read/write access to /dev/ipmi* devices. This allows FreeIPMI tools to access IPMI hardware without sudo, while preserving all systemd security hardening.

[github-actions]

Docs Build 📝

Thank you for contributing!✨

The docs for this PR have been published here:
https://prometheus-community.github.io/ansible/pr/789

You can compare to the docs for the main branch here:
https://prometheus-community.github.io/ansible/branch/main

The docsite for this PR is also available for download as an artifact from this run:
https://github.com/prometheus-community/ansible/actions/runs/25784989106

File changes:

• M ipmi_exporter_role.html

Click to see the diff comparison.

NOTE: only file modifications are shown here. New and deleted files are excluded.
See the file list and check the published docs to see those files.

diff --git a/home/runner/work/ansible/ansible/docsbuild/base/ipmi_exporter_role.html b/home/runner/work/ansible/ansible/docsbuild/head/ipmi_exporter_role.html
index 4755047..d191d36 100644
--- a/home/runner/work/ansible/ansible/docsbuild/base/ipmi_exporter_role.html
+++ b/home/runner/work/ansible/ansible/docsbuild/head/ipmi_exporter_role.html
@@ -284,6 +284,27 @@ To check whether it is installed, run <code class="code docutils literal notrans
 </div></td>
 </tr>
 <tr class="row-odd"><td><div class="ansible-option-cell">
+<div class="ansibleOptionAnchor" id="parameter-main--ipmi_exporter_udev_enable"></div><p class="ansible-option-title" id="ansible-collections-prometheus-prometheus-ipmi-exporter-role-parameter-main-ipmi-exporter-udev-enable"><strong>ipmi_exporter_udev_enable</strong></p>
+<a class="ansibleOptionLink" href="#parameter-main--ipmi_exporter_udev_enable" title="Permalink to this option"></a><p class="ansible-option-type-line"><span class="ansible-option-type">boolean</span></p>
+</div></td>
+<td><div class="ansible-option-cell"><p>When true, deploy a udev rule granting the service group read/write access to /dev/ipmi* devices.</p>
+<p>This allows freeipmi tools to access IPMI hardware without sudo.</p>
+<p class="ansible-option-line"><strong class="ansible-option-choices">Choices:</strong></p>
+<ul class="simple">
+<li><p><code class="ansible-option-default-bold docutils literal notranslate"><strong><span class="pre">false</span></strong></code> <span class="ansible-option-choices-default-mark">← (default)</span></p></li>
+<li><p><code class="ansible-option-choices-entry docutils literal notranslate"><span class="pre">true</span></code></p></li>
+</ul>
+</div></td>
+</tr>
+<tr class="row-even"><td><div class="ansible-option-cell">
+<div class="ansibleOptionAnchor" id="parameter-main--ipmi_exporter_udev_rule_path"></div><p class="ansible-option-title" id="ansible-collections-prometheus-prometheus-ipmi-exporter-role-parameter-main-ipmi-exporter-udev-rule-path"><strong>ipmi_exporter_udev_rule_path</strong></p>
+<a class="ansibleOptionLink" href="#parameter-main--ipmi_exporter_udev_rule_path" title="Permalink to this option"></a><p class="ansible-option-type-line"><span class="ansible-option-type">string</span></p>
+</div></td>
+<td><div class="ansible-option-cell"><p>Path where the udev rule file is deployed when ipmi_exporter_udev_enable is true.</p>
+<p class="ansible-option-line"><strong class="ansible-option-default-bold">Default:</strong> <code class="ansible-option-default docutils literal notranslate"><span class="pre">&quot;/etc/udev/rules.d/99-ipmi-exporter.rules&quot;</span></code></p>
+</div></td>
+</tr>
+<tr class="row-odd"><td><div class="ansible-option-cell">
 <div class="ansibleOptionAnchor" id="parameter-main--ipmi_exporter_version"></div><p class="ansible-option-title" id="ansible-collections-prometheus-prometheus-ipmi-exporter-role-parameter-main-ipmi-exporter-version"><strong>ipmi_exporter_version</strong></p>
 <a class="ansibleOptionLink" href="#parameter-main--ipmi_exporter_version" title="Permalink to this option"></a><p class="ansible-option-type-line"><span class="ansible-option-type">string</span></p>
 </div></td>

[SuperQ]

Would a systemd restart of systemd-udev-trigger.service be enough for this? It's preferred to avoid command since it's not idempotent.

[guivin]

The --subsystem-match=ipmi filter was intentional here to limit the trigger to IPMI devices only. Restarting systemd-udev-trigger.service would re-trigger all devices system-wide which is broader.

Since changed_when: false is already set, the idempotency concern is addressed at the Ansible reporting level.

I agree command isn't ideal, but there's no clean module equivalent for a scoped udevadm trigger

[guivin]

@SuperQ any additional feedback needed to move this forward ?