Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

stages/ostree.deploy.container: add aleph file #10

Closed

Conversation

lukewarmtemp
Copy link

@lukewarmtemp lukewarmtemp commented Oct 31, 2023

Similar to the aleph file created for builds of FCOS based on ostree commit inputs, this adds an aleph file for builds based on container image inputs.

$ cat /sysroot/.osbuild-container-aleph.json 
{
    "build": "38.20231002.3.1",
    "container-image": {
        "image-digest": "sha256:3bdf633fb6c027a01688aecf1d3f33bbecf8975b138c1861cb89ae20f3e3e7db",
        "image-labels": {
            "coreos-assembler.image-config-checksum": "86726787ca3d30d9489c7f34d3b88d4b0f180b12e655dfcf57c3eeabc0e4af84",
            "coreos-assembler.image-input-checksum": "96725a9aaeb28343babafe7d8ebb1ea1052f7eab21434f0205299811f088cb02",
            "fedora-coreos.stream": "stable",
            "org.opencontainers.image.revision": "7b3ec77dbe68d4291f24fa4b1d8eccfb4fa58241",
            "org.opencontainers.image.source": "https://github.com/coreos/fedora-coreos-config",
            "org.opencontainers.image.version": "38.20231002.3.1",
            "ostree.bootable": "true",
            "ostree.commit": "7ca4ce157e80858b1b47f6f4bfda997193e278e44fe4d0fa2bb43f76fa724eca",
            "ostree.final-diffid": "sha256:12787d84fa137cd5649a9005efe98ec9d05ea46245fdc50aecb7dd007f2035b1",
            "ostree.linux": "6.5.5-200.fc38.x86_64",
            "rpmostree.inputhash": "08b9771a0f8d9acb564baac194a9e37692760e9819177e3f8ca5b81d5d681d00",
            "version": "38.20231002.3.1"
        },
        "image-name": "quay.io/fedora/fedora-coreos:stable"
    },
    "osbuild-version": "99",
    "ostree-commit": "7ca4ce157e80858b1b47f6f4bfda997193e278e44fe4d0fa2bb43f76fa724eca",
    "ref": "docker://ostree-remote-image:fedora:docker://quay.io/fedora/fedora-coreos:stable",
    "version": "38.20231002.3.1"
}

@lukewarmtemp lukewarmtemp changed the title stages/ostree.deploy/container: add aleph file stages/ostree.deploy.container: add aleph file Oct 31, 2023
Similar to the aleph file created for builds of FCOS based on ostree
commit inputs, this adds an aleph file builds based on container image
inputs.
@dustymabe
Copy link
Owner

Similar to the aleph file created for builds of FCOS based on ostree commit inputs, this adds an aleph file builds based on container image inputs.

$ cat /sysroot/.coreos-aleph-version.json 
{
    "osbuild-version": "99",
    "image-name": "registry.gitlab.com/redhat/services/products/image-builder/ci/images/fedora-coreos:stable",
    "image-digest": "sha256:d6ae5e4566d4ddd937e135eb3400db9c78aa76310e7309e601fa8f570d817519",
    "image-revision": "7b3ec77dbe68d4291f24fa4b1d8eccfb4fa58241",
    "image-source": "https://github.com/coreos/fedora-coreos-config",
    "image-version": "38.20231002.3.1"
}

This doesn't appear to include the Image ID which may or may not be something we want to carry forward, but was something that was there in the past:

$ cat /sysroot/.coreos-aleph-version.json 
{
        "build": "38.20230322.1.0",
        "ref": "fedora/aarch64/coreos/next",
        "ostree-commit": "429535029cf16dacdbae67bbe5dac0c6160c1528fdad135c6e516beb01352230",
        "imgid": "fedora-coreos-38.20230322.1.0-metal.aarch64.raw"
}

@cgwalters
Copy link

This doesn't appear to include the Image ID

How could there be one in general? The point of this tooling is to produce disk images from container images.

(It's not clear to me that retaining the image ID matters for the "coreos-using-imagebuilder" task)

@dustymabe
Copy link
Owner

This doesn't appear to include the Image ID

How could there be one in general? The point of this tooling is to produce disk images from container images.

Similar to how we do it in create_disk today, we can do it here.

(It's not clear to me that retaining the image ID matters for the "coreos-using-imagebuilder" task)

I'm mostly trying to look at what we have today and not lose fidelity. If someone does some analysis and tells me nothing is using this information, then sure, let's drop it.

@jlebon
Copy link

jlebon commented Nov 1, 2023

FYI, there are consumers of the aleph JSON right now. From a quick GitHub search:

Obviously, we could modify those since we own both of them and adapt them to work with both pre-osbuild and post-osbuild images. But it's way simpler to just keep the fields in there and augment with more fields as relevant.

@cgwalters
Copy link

In the bootupd case though it's not really relevant going forward because there shouldn't be any non-bootupd cases that we ship. (And the non-coreos, non-bootupd case of atomic desktops today doesn't use the aleph either)

So it's really just the MCO which is still just informational that we can easily adapt.

@dustymabe
Copy link
Owner

dustymabe commented Nov 1, 2023

Had a quick session with the team to try to gain some traction on this for the time being:

{
    "osbuild-version": "99",
    "ref": "fedora/aarch64/coreos/next",
    "ref": "docker:///quay.io/fedora/fedora-coreos@sha256:abcdef", target_imgref
    "build": "38.20230322.1.0",
    "ostee-version": "38.20230322.1.0",
    "ostree-commit": "429535029cf16dacdbae67bbe5dac0c6160c1528fdad135c6e516beb01352230",
    "platform": "aws"
    "imgid": "fedora-coreos-38.20230322.1.0-metal.aarch64.raw"
    "container-image": {
        "image-name": "registry.gitlab.com/redhat/services/products/image-builder/ci/images/fedora-coreos:stable",
        "image-digest": "sha256:d6ae5e4566d4ddd937e135eb3400db9c78aa76310e7309e601fa8f570d817519",
        "image-labels": {
           "org.opencontainers.revision": "7b3ec77dbe68d4291f24fa4b1d8eccfb4fa58241",
           "org.opencontainers.source": "https://github.com/coreos/fedora-coreos-config",
           "org.opencontainers.version": "38.20231002.3.1" 
           ...
        }
    }
}
  • ostree-version is added as that is more correct to use than build in the future.
  • build still available for backwards compat
  • ref can be either the ref in the ostree remote or the target_imgref.
  • imgid really only gave us one piece of information that we couldn't get elsewhere, the platform. We added platform as a separate field.
  • imgid in the future will just be whatever filename the disk image was output to. For Fedora CoreOS that will still have the form of fedora-coreos-38.20230322.1.0-metal.aarch64.raw, but for customers it could be something like my-big-corp.qcow2.
  • container-image will contain all of the information about the container image we deployed from, including all image labels.

@jmarrero
Copy link

jmarrero commented Nov 2, 2023

@cgwalters for

{
    "container-image": {
        "image-name": "registry.gitlab.com/redhat/services/products/image-builder/ci/images/fedora-coreos:stable",
        "image-digest": "sha256:d6ae5e4566d4ddd937e135eb3400db9c78aa76310e7309e601fa8f570d817519",
        "image-labels": {
           "org.opencontainers.revision": "7b3ec77dbe68d4291f24fa4b1d8eccfb4fa58241",
           "org.opencontainers.source": "https://github.com/coreos/fedora-coreos-config",
           "org.opencontainers.version": "38.20231002.3.1" 
           ...

This is currently being grabbed from the image with skopeo inspect, I did some search on the filesystem and can't find this under the deployment. Do we have this information cached somewhere after we do the deployment or inspecting the image with skopeo is the best current way?

cgwalters added a commit to cgwalters/ostree-rs-ext that referenced this pull request Nov 2, 2023
@cgwalters
Copy link

It's part of the ostree commit metadata. I did ostreedev/ostree-rs-ext#560 to make this easier to extract from other languages.

@dustymabe
Copy link
Owner

In the bootupd case though it's not really relevant going forward because there shouldn't be any non-bootupd cases that we ship. (And the non-coreos, non-bootupd case of atomic desktops today doesn't use the aleph either)

So it's really just the MCO which is still just informational that we can easily adapt.

If we can reasonably drop the imgid bit and we decide that we want to then we can drop imgid and platform from the proposal in #10 (comment) and we can create the aleph file in an earlier pipeline (i.e. not a pipeline specific to a platform) I think, which may simplify things.

@lukewarmtemp
Copy link
Author

@dustymabe @cgwalters @jlebon Changes made to the contents of the aleph file, please see the modified top comment of the PR for the updated values of osbuild-container-aleph.json . Everything is still part of the org.osbuild.ostree.deploy.container stage for now until the discussion on imgid and platform is resolved:

If we can reasonably drop the imgid bit and we decide that we want to then we can drop imgid and platform from the proposal in #10 (comment) and we can create the aleph file in an earlier pipeline (i.e. not a pipeline specific to a platform) I think, which may simplify things.

stages/org.osbuild.ostree.deploy.container Outdated Show resolved Hide resolved
stages/org.osbuild.ostree.deploy.container Outdated Show resolved Hide resolved
stages/org.osbuild.ostree.deploy.container Outdated Show resolved Hide resolved
stages/org.osbuild.ostree.deploy.container Outdated Show resolved Hide resolved
Fixes some of the labels in the aleph file. Calling `ostree container
image metadata` also requires the target image reference to be only
the container image and tag (ie. without the signature verification
type and remote).
stages/org.osbuild.ostree.coreos.aleph Outdated Show resolved Hide resolved
encoding="utf8",
stdout=sys.stderr,
stdout=subprocess.PIPE,
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ahh. I hadn't realized we'd need to make this change.. I honestly think this is the way it should be, but the osbuild devs might want stdout to still go to stderr to keep the same behavior. We can still achieve that goal if they ask us by just doing:

cp = subprocess.run(["ostree"] + args,
                   encoding="utf8",
                   stdout=sys.stderr,
                   stdout=subprocess.PIPE,\
                   input=_input,
                   check=True)
print(cp.stdout)
return cp

but let's wait and see what they say.

stages/org.osbuild.ostree.deploy.container Outdated Show resolved Hide resolved
tools/osbuild-mpp Outdated Show resolved Hide resolved
stages/org.osbuild.ostree.coreos.aleph Outdated Show resolved Hide resolved
stages/org.osbuild.ostree.coreos.aleph Outdated Show resolved Hide resolved
stages/org.osbuild.ostree.coreos.aleph Outdated Show resolved Hide resolved
osbuild/util/ostree.py Outdated Show resolved Hide resolved
osbuild/util/ostree.py Outdated Show resolved Hide resolved
@dustymabe
Copy link
Owner

This is looking pretty good to me. @jlebon - want to give it another round?

osbuild/buildroot.py Show resolved Hide resolved
@@ -215,15 +214,24 @@ def parse_input_commits(commits):
def deployment_path(root: PathLike, osname: str, ref: str, serial: int):
"""Return the path to a deployment given the parameters"""

base = os.path.join(root, "ostree")
if osname == "" and ref == "" and serial == None:
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there even a use case in osbuild for having multiple deployments in the image? I'd just nuke those parameters and always do the glob approach. That should simplify some of the callers currently doing extra work to prepare those params.

Obviously fine to do as a follow-up.

Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah, I think there is an argument to make for that - +1 for a follow up. We'd need to keep supporting specifying the options even though they would do nothing.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we're making the main aleph file non-CoreOS specific, then we should probably not have "coreos" in its name.

stages/org.osbuild.ostree.coreos.aleph Outdated Show resolved Hide resolved
test/data/manifests/fedora-coreos-container.mpp.yaml Outdated Show resolved Hide resolved
stages/org.osbuild.ostree.coreos.aleph Outdated Show resolved Hide resolved
stages/org.osbuild.ostree.coreos.aleph Outdated Show resolved Hide resolved
stages/org.osbuild.ostree.coreos.aleph Outdated Show resolved Hide resolved
stages/org.osbuild.ostree.coreos.aleph Outdated Show resolved Hide resolved
This commit makes the code more clear by refactoring the part extracts
the deployment type and imgref from the origin file into a separate
function. This function was implemented as an ostree tool such that
other stages can also utilize it. Several other minor changes were also
made to clean up the code
osbuild/util/ostree.py Outdated Show resolved Hide resolved
osbuild/util/ostree.py Outdated Show resolved Hide resolved
stages/org.osbuild.ostree.aleph Outdated Show resolved Hide resolved
stages/org.osbuild.ostree.aleph Show resolved Hide resolved
stages/org.osbuild.ostree.aleph Outdated Show resolved Hide resolved
@dustymabe
Copy link
Owner

upstream PR opened (with some tweaks): osbuild#1475

lukewarmtemp added a commit to lukewarmtemp/machine-config-operator that referenced this pull request Dec 1, 2023
This commit removes the dependency of the imgid field in the coreos
aleph file. As per the discussion in the following PR to OSBuild,
as decision was made to remove the field:

dustymabe/osbuild#10 (comment)

A decision was also made to log the entire aleph file since it is more
verbose.
lukewarmtemp added a commit to lukewarmtemp/machine-config-operator that referenced this pull request Dec 1, 2023
This commit removes the dependency of the imgid field in the coreos
aleph file. As per the discussion in the following PR to OSBuild,
as decision was made to remove the field:

dustymabe/osbuild#10 (comment)

A decision was also made to log the entire aleph file since it is more
verbose.
@dustymabe dustymabe closed this Apr 11, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants