From 2474419fe899ff792db414090b20d0ce31632cd7 Mon Sep 17 00:00:00 2001 From: Jonathan Lebon Date: Thu, 25 Apr 2024 23:24:31 -0400 Subject: [PATCH 1/3] Add new `okd-c9s` and `ocp-rhel-9.4` variants To make introducing the base RHCOS/SCOS images safer, let's create two new variants: `okd-c9s` and `ocp-rhel-9.4`. These variants are cloned from the existing `c9s` and `rhel-9.4` variants to start. The new variants will track the status quo: building SCOS/RHCOS with the OpenShift components baked in (hence the `okd`/`ocp` prefixes). This is what the pipeline will keep building. Meanwhile, what is currently the `c9s` and rhel-9.4` variants will become the new base SCOS/RHCOS streams containing *purely* CentOS Stream/RHEL content. The default variant is still `ocp-rhel-9.4` for now. --- README.md | 8 ++- ci/prow-entrypoint.sh | 12 ++-- extensions-ocp-rhel-9.4.yaml | 1 + extensions-okd-c9s.yaml | 1 + extensions.yaml | 2 +- image-ocp-rhel-9.4.yaml | 1 + image-okd-c9s.yaml | 1 + image.yaml | 2 +- manifest-ocp-rhel-9.4.yaml | 110 +++++++++++++++++++++++++++++++ manifest-okd-c9s.yaml | 123 +++++++++++++++++++++++++++++++++++ manifest.yaml | 2 +- 11 files changed, 251 insertions(+), 12 deletions(-) create mode 120000 extensions-ocp-rhel-9.4.yaml create mode 120000 extensions-okd-c9s.yaml create mode 120000 image-ocp-rhel-9.4.yaml create mode 120000 image-okd-c9s.yaml create mode 100644 manifest-ocp-rhel-9.4.yaml create mode 100644 manifest-okd-c9s.yaml diff --git a/README.md b/README.md index 4663763c..acac80b4 100644 --- a/README.md +++ b/README.md @@ -13,12 +13,14 @@ To support building both a RHEL-based and a CentOS Stream-based CoreOS, the coreos-assembler concept of [variants] is used. The following variants are supported: -- `rhel-9.4`: RHEL 9.4-based CoreOS; including OpenShift components. -- `c9s`: CentOS Stream-based CoreOS, including OpenShift components. This +- `rhel-9.4`: Clone of `ocp-rhel-9.4` for now. +- `ocp-rhel-9.4`: RHEL 9.4-based CoreOS; including OpenShift components. +- `c9s`: Clone of `okd-c9s` for now. +- `okd-c9s`: CentOS Stream-based CoreOS, including OpenShift components. This currently includes some packages from RHEL because not all packages required by OpenShift are provided in CentOS Stream. -The default variant is `rhel-9.4`. +The default variant is `ocp-rhel-9.4`. ## Reporting issues diff --git a/ci/prow-entrypoint.sh b/ci/prow-entrypoint.sh index eaffd070..78c6d306 100755 --- a/ci/prow-entrypoint.sh +++ b/ci/prow-entrypoint.sh @@ -305,36 +305,36 @@ main() { prepare_repos ;; "build" | "init-and-build-default") # TODO: change prow job to use init-and-build-default - cosa_init "rhel-9.4" + cosa_init "ocp-rhel-9.4" cosa_build ;; "rhcos-cosa-prow-pr-ci") setup_user - cosa_init "rhel-9.4" + cosa_init "ocp-rhel-9.4" cosa_build kola_test_qemu ;; "rhcos-9-build-test-qemu") setup_user - cosa_init "rhel-9.4" + cosa_init "ocp-rhel-9.4" cosa_build kola_test_qemu ;; "rhcos-9-build-test-metal") setup_user - cosa_init "rhel-9.4" + cosa_init "ocp-rhel-9.4" cosa_build kola_test_metal ;; "scos-9-build-test-qemu") setup_user - cosa_init "c9s" + cosa_init "okd-c9s" cosa_build kola_test_qemu ;; "scos-9-build-test-metal") setup_user - cosa_init "c9s" + cosa_init "okd-c9s" cosa_build kola_test_metal ;; diff --git a/extensions-ocp-rhel-9.4.yaml b/extensions-ocp-rhel-9.4.yaml new file mode 120000 index 00000000..94e08ff2 --- /dev/null +++ b/extensions-ocp-rhel-9.4.yaml @@ -0,0 +1 @@ +extensions-rhel-9.4.yaml \ No newline at end of file diff --git a/extensions-okd-c9s.yaml b/extensions-okd-c9s.yaml new file mode 120000 index 00000000..dedefe81 --- /dev/null +++ b/extensions-okd-c9s.yaml @@ -0,0 +1 @@ +extensions-c9s.yaml \ No newline at end of file diff --git a/extensions.yaml b/extensions.yaml index 94e08ff2..4fb167ca 120000 --- a/extensions.yaml +++ b/extensions.yaml @@ -1 +1 @@ -extensions-rhel-9.4.yaml \ No newline at end of file +extensions-ocp-rhel-9.4.yaml \ No newline at end of file diff --git a/image-ocp-rhel-9.4.yaml b/image-ocp-rhel-9.4.yaml new file mode 120000 index 00000000..3abbf78c --- /dev/null +++ b/image-ocp-rhel-9.4.yaml @@ -0,0 +1 @@ +image-rhel-9.4.yaml \ No newline at end of file diff --git a/image-okd-c9s.yaml b/image-okd-c9s.yaml new file mode 120000 index 00000000..56168f45 --- /dev/null +++ b/image-okd-c9s.yaml @@ -0,0 +1 @@ +image-c9s.yaml \ No newline at end of file diff --git a/image.yaml b/image.yaml index 3abbf78c..d2760020 120000 --- a/image.yaml +++ b/image.yaml @@ -1 +1 @@ -image-rhel-9.4.yaml \ No newline at end of file +image-ocp-rhel-9.4.yaml \ No newline at end of file diff --git a/manifest-ocp-rhel-9.4.yaml b/manifest-ocp-rhel-9.4.yaml new file mode 100644 index 00000000..ca1387fd --- /dev/null +++ b/manifest-ocp-rhel-9.4.yaml @@ -0,0 +1,110 @@ +# Manifest for RHCOS based on RHEL 9.4 + +rojig: + license: MIT + name: rhcos + summary: OpenShift 4 + +variables: + osversion: "rhel-9.4" + +# Include manifests common to all RHEL and CentOS Stream versions and manifest +# common to RHEL 9 & C9S variants +include: + - common.yaml + - packages-openshift.yaml + +# Starting from here, everything should be specific to RHCOS based on RHEL 9.4 content + +repos: + - rhel-9.4-baseos + - rhel-9.4-appstream + - rhel-9.4-fast-datapath + # Include RHCOS 9 repo for oc, kubelet + - rhel-9.4-server-ose-4.17 + +# We include hours/minutes to avoid version number reuse +automatic-version-prefix: "417.94." +# This ensures we're semver-compatible which OpenShift wants +automatic-version-suffix: "-" +# Keep this is sync with the version in postprocess +mutate-os-release: "4.17" + +postprocess: + - | + #!/usr/bin/env bash + set -xeo pipefail + + # Tweak /usr/lib/os-release + grep -v -e "OSTREE_VERSION" -e "OPENSHIFT_VERSION" /etc/os-release > /usr/lib/os-release.rhel + ( + . /etc/os-release + cat > /usr/lib/os-release < /usr/lib/system-release-cpe < /usr/lib/system-release < /usr/lib/issue <" +# This ensures we're semver-compatible which OpenShift wants +automatic-version-suffix: "-" +# Keep this is sync with the version in postprocess +mutate-os-release: "4.17" + +postprocess: + - | + #!/usr/bin/env bash + set -xeo pipefail + + # Tweak /usr/lib/os-release + grep -v -e "OSTREE_VERSION" -e "OPENSHIFT_VERSION" /etc/os-release > /usr/lib/os-release.stream + ( + . /etc/os-release + cat > /usr/lib/os-release < /usr/lib/system-release-cpe < /usr/lib/system-release < /usr/lib/issue < Date: Fri, 26 Apr 2024 00:04:48 -0400 Subject: [PATCH 2/3] Make c9s and rhel-9.4 variants be pure C9S/RHEL 9.4 content This is the second step now in this switcheroo dance (see previous commit). We make the `c9s` and `rhel-9.4` variants contain only C9S/ RHEL 9.4 content and then make the `okd-c9s` and `ocp-rhel-9.4` variants inherit from those and add the OCP-specific stuff. --- README.md | 7 +- common.yaml | 15 +++ manifest-c9s.yaml | 111 ++------------------ manifest-ocp-rhel-9.4.yaml | 28 ++--- manifest-okd-c9s.yaml | 29 ++--- manifest-rhel-9.4.yaml | 93 ++-------------- tests/kola/version/rhel-major-version | 3 + tests/kola/version/rhel-matches-rhcos-build | 5 + 8 files changed, 61 insertions(+), 230 deletions(-) diff --git a/README.md b/README.md index acac80b4..e978b729 100644 --- a/README.md +++ b/README.md @@ -13,13 +13,16 @@ To support building both a RHEL-based and a CentOS Stream-based CoreOS, the coreos-assembler concept of [variants] is used. The following variants are supported: -- `rhel-9.4`: Clone of `ocp-rhel-9.4` for now. +- `rhel-9.4`: RHEL 9.4-based CoreOS; without OpenShift components. - `ocp-rhel-9.4`: RHEL 9.4-based CoreOS; including OpenShift components. -- `c9s`: Clone of `okd-c9s` for now. +- `c9s`: CentOS Stream-based CoreOS, without OKD components. - `okd-c9s`: CentOS Stream-based CoreOS, including OpenShift components. This currently includes some packages from RHEL because not all packages required by OpenShift are provided in CentOS Stream. +In the future, the `ocp-*` variants will be removed. Instead, OpenShift +components will be layered by deriving from the `rhel-9.4`/`c9s` images. + The default variant is `ocp-rhel-9.4`. ## Reporting issues diff --git a/common.yaml b/common.yaml index 2af9c503..2439281e 100644 --- a/common.yaml +++ b/common.yaml @@ -43,6 +43,21 @@ conditional-include: documentation: false postprocess: + # Mark the OS as of the CoreOS variant. + # XXX: should be part of a centos/redhat-release subpackage instead + - | + #!/usr/bin/bash + set -euo pipefail + cat >> /usr/lib/os-release <" -# This ensures we're semver-compatible which OpenShift wants -automatic-version-suffix: "-" -# Keep this is sync with the version in postprocess -mutate-os-release: "4.17" - -postprocess: - - | - #!/usr/bin/env bash - set -xeo pipefail - # Tweak /usr/lib/os-release - grep -v -e "OSTREE_VERSION" -e "OPENSHIFT_VERSION" /etc/os-release > /usr/lib/os-release.stream - ( - . /etc/os-release - cat > /usr/lib/os-release <" - # Tweak /etc/system-release, /etc/system-release-cpe & /etc/redhat-release - ( - . /etc/os-release - cat > /usr/lib/system-release-cpe < /usr/lib/system-release < /usr/lib/issue < /usr/lib/os-release < /usr/lib/os-release <" -# This ensures we're semver-compatible which OpenShift wants -automatic-version-suffix: "-" -# Keep this is sync with the version in postprocess -mutate-os-release: "4.17" - -postprocess: - - | - #!/usr/bin/env bash - set -xeo pipefail - # Tweak /usr/lib/os-release - grep -v -e "OSTREE_VERSION" -e "OPENSHIFT_VERSION" /etc/os-release > /usr/lib/os-release.rhel - ( - . /etc/os-release - cat > /usr/lib/os-release <" - # Tweak /etc/system-release, /etc/system-release-cpe & /etc/redhat-release - ( - . /etc/os-release - cat > /usr/lib/system-release-cpe < /usr/lib/system-release < /usr/lib/issue < Date: Wed, 15 May 2024 17:56:08 -0400 Subject: [PATCH 3/3] Containerfile: new file This Containerfile allows us to build the OpenShift node image on top of the base RHCOS/SCOS image (i.e. built from the `c9s` or `rhel-9.4` image). Currently, the resulting image is at parity with the base image you'd get from building the `okd-c9s` or `ocp-rhel-9.4` variant. In the future, those variants will go away and this will become the only way to build the node image. Part of: https://github.com/openshift/os/issues/799 --- Containerfile | 33 +++++++++++++++++++ scripts/apply-manifest | 75 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 108 insertions(+) create mode 100644 Containerfile create mode 100755 scripts/apply-manifest diff --git a/Containerfile b/Containerfile new file mode 100644 index 00000000..a514c9ea --- /dev/null +++ b/Containerfile @@ -0,0 +1,33 @@ +# This builds the final OCP node image on top of the base RHCOS image. The +# latter may be RHEL or CentOS Stream-based. This is currently only buildable +# using podman/buildah as it uses some mounting options only available there. +# +# To build this, you will want to pass `--security-opt=label=disable` to avoid +# having to relabel the context directory. Any repos found in `/run/yum.repos.d` +# will be imported into `/etc/yum.repos.d/` and then removed in the same step (so +# as to not end up in the final image). +# +# Use `--from` to override the base RHCOS image. E.g.: +# +# podman build --from quay.io/openshift-release-dev/ocp-v4.0-art-dev:rhel-coreos-base-9.4 ... +# +# Or to use a locally built OCI archive: +# +# podman build --from oci-archive:builds/latest/x86_64/scos-9-20240416.dev.0-ostree.x86_64.ociarchive ... + +# If consuming from repos hosted within the RH network, you'll want to mount in +# certs too: +# +# podman build -v /etc/pki/ca-trust:/etc/pki-ca-trust:ro ... +# +# Example invocation: +# +# podman build --from oci-archive:$(ls builds/latest/x86_64/*.ociarchive) \ +# -v rhel-9.4.repo:/run/yum.repos.d/rhel-9.4.repo:ro \ +# -v /etc/pki/ca-trust:/etc/pki/ca-trust:ro \ +# --security-opt label=disable -t localhost/openshift-node-c9s \ +# src/config + +FROM quay.io/openshift-release-dev/ocp-v4.0-art-dev:rhel-coreos-base-c9s +RUN --mount=type=bind,target=/run/src /run/src/scripts/apply-manifest /run/src/packages-openshift.yaml && \ + ostree container commit diff --git a/scripts/apply-manifest b/scripts/apply-manifest new file mode 100755 index 00000000..ced24170 --- /dev/null +++ b/scripts/apply-manifest @@ -0,0 +1,75 @@ +#!/usr/bin/python3 -u + +# This is a hacky temporary script to apply an rpm-ostree manifest as part of a +# derived container build. It's only required because we're in this transitional +# state where some streams use the old way, and others use layering. Once all +# streams use layering, we could stop using manifests for the layered bits. (An +# obvious question here is whether we should keep extending the `rpm-ostree ex +# rebuild` stuff to keep using manifests even in a layered build. Though likely +# similar functionality will live in dnf instead.) + +# Note this only supports the subset of the manifest spec actually used in +# `packages-openshift.yaml`. + +import os +import shutil +import subprocess +import sys +import yaml + + +def runcmd(args): + print("Running:", ' '.join(args)) + subprocess.check_call(args) + + +manifest_file = sys.argv[1] +manifest_dir = os.path.dirname(manifest_file) + +with open(manifest_file) as f: + manifest = yaml.safe_load(f) + +if len(manifest.get('packages', [])): + + packages = [] + for pkg in manifest['packages']: + packages += pkg.split() + rpmostree_install = ['rpm-ostree', 'install', '-y'] + packages + + # XXX: temporary hack for cri-o, which wants to create dirs under /opt + # https://github.com/CentOS/centos-bootc/issues/393 + if 'cri-o' in packages: + os.makedirs("/var/opt", exist_ok=True) + + # inject mounted-in repo files + extra_repos_dir = '/run/yum.repos.d' + copied_repo_files = [] + if os.path.isdir(extra_repos_dir): + for file in os.listdir(extra_repos_dir): + src_path = os.path.join(extra_repos_dir, file) + if not os.path.isfile(src_path): + continue + if not file.endswith(".repo"): + continue + dest_path = os.path.join('/etc/yum.repos.d', file) + if os.path.exists(dest_path): + raise Exception(f"Repo file {dest_path} already exists") + print(f"Copying repo file {file} to /etc/yum.repos.d/") + shutil.copy(src_path, dest_path) + copied_repo_files += [dest_path] + + runcmd(rpmostree_install) + + # delete the repo files we injected + for repo in copied_repo_files: + os.unlink(repo) + + +if len(manifest.get('postprocess', [])): + for i, script in enumerate(manifest['postprocess']): + name = f"/tmp/postprocess-script-{i}" + with open(name, 'w') as f: + f.write(script) + os.chmod(name, 0o755) + runcmd([name]) + os.unlink(name)