Skip to content

Commit 902882d

Browse files
authored
Merge pull request #1780 from jlebon/pr/nuke-okd-c9s
NO-JIRA: Switch layered build to `treefile-apply`, drain `get-ocp-repo.sh`
2 parents 48a1891 + 7997d1a commit 902882d

17 files changed

Lines changed: 122 additions & 393 deletions

Containerfile

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -29,15 +29,7 @@
2929

3030
FROM quay.io/openshift-release-dev/ocp-v4.0-art-dev:c9s-coreos as build
3131
ARG OPENSHIFT_CI=0
32-
# Avoid shipping modified .pyc files. Due to https://github.com/ostreedev/ostree/issues/1469,
33-
# any Python apps that run (e.g. dnf) will cause pyc creation.
34-
RUN --mount=type=bind,target=/run/src --mount=type=secret,id=yumrepos,target=/etc/yum.repos.d/secret.repo \
35-
find /usr -name '*.pyc' -exec mv {} {}.bak \; && \
36-
if [ "${OPENSHIFT_CI}" != 0 ]; then /run/src/ci/get-ocp-repo.sh --ocp-layer /run/src/packages-openshift.yaml --output-dir /etc/yum.repos.d; fi && \
37-
/run/src/scripts/apply-manifest /run/src/packages-openshift.yaml && \
38-
if [ "${OPENSHIFT_CI}" != 0 ]; then /run/src/ci/get-ocp-repo.sh --output-dir /etc/yum.repos.d --cleanup; fi && \
39-
find /usr -name '*.pyc.bak' -exec sh -c 'mv $1 ${1%.bak}' _ {} \; && \
40-
ostree container commit
32+
RUN --mount=type=bind,target=/run/src --mount=type=secret,id=yumrepos,target=/etc/yum.repos.d/secret.repo /run/src/build-node-image.sh
4133

4234
FROM build as metadata
4335
RUN --mount=type=bind,target=/run/src /run/src/scripts/generate-metadata

README.md

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,6 @@ supported:
1616
- `rhel-9.6`: RHEL 9.6-based CoreOS; without OpenShift components.
1717
- `ocp-rhel-9.6`: RHEL 9.6-based CoreOS; including OpenShift components.
1818
- `c9s`: CentOS Stream-based CoreOS, without OKD components.
19-
- `okd-c9s`: CentOS Stream-based CoreOS, including OpenShift components. This
20-
currently includes some packages from RHEL because not all packages required
21-
by OpenShift are provided in CentOS Stream.
2219

2320
In the future, the `ocp-*` variants will be removed. Instead, OpenShift
2421
components will be layered by deriving from the `rhel-9.X`/`c9s` images.

build-node-image.sh

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
#!/bin/bash
2+
set -euo pipefail
3+
4+
# This script builds the OpenShift node image. It's called from `Containerfile`. set -xeuo pipefail
5+
6+
# Avoid shipping modified .pyc files. Due to
7+
# https://github.com/ostreedev/ostree/issues/1469, any Python apps that
8+
# run (e.g. dnf) will cause pyc creation. We do this by backing them up and
9+
# restoring them at the end.
10+
find /usr -name '*.pyc' -exec mv {} {}.bak \;
11+
12+
# fetch repos from in-cluster mirrors if we're running in OpenShift CI
13+
if [ "${OPENSHIFT_CI}" != 0 ]; then
14+
/run/src/ci/get-ocp-repo.sh /etc/yum.repos.d/ocp.repo
15+
fi
16+
17+
source /etc/os-release
18+
19+
# XXX: For SCOS, only allow certain packages to come from ART; everything else
20+
# should come from CentOS. We should eventually sever this.
21+
if [ $ID = centos ]; then
22+
# this says: "if the line starts with [.*], turn off printing. if the line starts with [our-repo], turn it on."
23+
awk "/\[.*\]/{p=0} /\[rhel-9.6-server-ose-4.19\]/{p=1} p" /etc/yum.repos.d/*.repo > /etc/yum.repos.d/okd.repo.tmp
24+
sed -i -e 's,rhel-9.6-server-ose-4.19,rhel-9.6-server-ose-4.19-okd,' /etc/yum.repos.d/okd.repo.tmp
25+
echo 'includepkgs=openshift-*,ose-aws-ecr-*,ose-azure-acr-*,ose-gcp-gcr-*' >> /etc/yum.repos.d/okd.repo.tmp
26+
mv /etc/yum.repos.d/okd.repo{.tmp,}
27+
fi
28+
29+
# XXX: patch cri-o spec to use tmpfiles
30+
# https://github.com/CentOS/centos-bootc/issues/393
31+
mkdir -p /var/opt
32+
33+
# this is where all the real work happens
34+
rpm-ostree experimental compose treefile-apply \
35+
--var id=$ID /run/src/packages-openshift.yaml
36+
37+
# cleanup the repo file we injected
38+
if [ "${OPENSHIFT_CI}" != 0 ]; then
39+
rm /etc/yum.repos.d/ocp.repo
40+
fi
41+
42+
find /usr -name '*.pyc.bak' -exec sh -c 'mv $1 ${1%.bak}' _ {} \;
43+
ostree container commit

c9s-mirror.repo

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,28 +9,28 @@ baseurl=https://mirror.stream.centos.org/9-stream/BaseOS/$basearch/os
99
gpgcheck=1
1010
repo_gpgcheck=0
1111
enabled=1
12-
gpgkey=file:///usr/share/distribution-gpg-keys/centos/RPM-GPG-KEY-CentOS-Official
12+
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial
1313

1414
[c9s-appstream-mirror]
1515
name=CentOS Stream 9 - AppStream
1616
baseurl=https://mirror.stream.centos.org/9-stream/AppStream/$basearch/os
1717
gpgcheck=1
1818
repo_gpgcheck=0
1919
enabled=1
20-
gpgkey=file:///usr/share/distribution-gpg-keys/centos/RPM-GPG-KEY-CentOS-Official
20+
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial
2121

2222
[c9s-nfv-mirror]
2323
name=CentOS Stream 9 - NFV
2424
baseurl=https://mirror.stream.centos.org/9-stream/NFV/$basearch/os
2525
gpgcheck=1
2626
repo_gpgcheck=0
2727
enabled=1
28-
gpgkey=file:///usr/share/distribution-gpg-keys/centos/RPM-GPG-KEY-CentOS-Official
28+
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial
2929

3030
[c9s-rt-mirror]
3131
name=CentOS Stream 9 - RT
3232
baseurl=https://mirror.stream.centos.org/9-stream/RT/$basearch/os
3333
gpgcheck=1
3434
repo_gpgcheck=0
3535
enabled=1
36-
gpgkey=file:///usr/share/distribution-gpg-keys/centos/RPM-GPG-KEY-CentOS-Official
36+
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial

c9s.repo

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -10,15 +10,15 @@ baseurl=https://composes.stream.centos.org/production/latest-CentOS-Stream/compo
1010
gpgcheck=1
1111
repo_gpgcheck=0
1212
enabled=1
13-
gpgkey=file:///usr/share/distribution-gpg-keys/centos/RPM-GPG-KEY-CentOS-Official
13+
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial
1414

1515
[c9s-appstream]
1616
name=CentOS Stream 9 - AppStream
1717
baseurl=https://composes.stream.centos.org/production/latest-CentOS-Stream/compose/AppStream/$basearch/os
1818
gpgcheck=1
1919
repo_gpgcheck=0
2020
enabled=1
21-
gpgkey=file:///usr/share/distribution-gpg-keys/centos/RPM-GPG-KEY-CentOS-Official
21+
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial
2222

2323
[c9s-extras-common]
2424
name=CentOS Stream 9 - Extras packages
@@ -29,44 +29,44 @@ baseurl=https://mirror.stream.centos.org/SIGs/9-stream/extras/x86_64/extras-comm
2929
gpgcheck=1
3030
repo_gpgcheck=0
3131
enabled=1
32-
gpgkey=file:///usr/share/distribution-gpg-keys/centos/RPM-GPG-KEY-CentOS-SIG-Extras-SHA512
32+
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-Extras-SHA512
3333

3434
[c9s-nfv]
3535
name=CentOS Stream 9 - NFV
3636
baseurl=https://composes.stream.centos.org/production/latest-CentOS-Stream/compose/NFV/$basearch/os
3737
gpgcheck=1
3838
repo_gpgcheck=0
3939
enabled=1
40-
gpgkey=file:///usr/share/distribution-gpg-keys/centos/RPM-GPG-KEY-CentOS-Official
40+
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial
4141

4242
[c9s-rt]
4343
name=CentOS Stream 9 - RT
4444
baseurl=https://composes.stream.centos.org/production/latest-CentOS-Stream/compose/RT/$basearch/os
4545
gpgcheck=1
4646
repo_gpgcheck=0
4747
enabled=1
48-
gpgkey=file:///usr/share/distribution-gpg-keys/centos/RPM-GPG-KEY-CentOS-Official
48+
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial
4949

5050
[c9s-sig-nfv]
5151
name=CentOS Stream 9 - SIG NFV
5252
baseurl=https://mirror.stream.centos.org/SIGs/9-stream/nfv/$basearch/openvswitch-2/
5353
gpgcheck=1
5454
repo_gpgcheck=0
5555
enabled=1
56-
gpgkey=file:///usr/share/distribution-gpg-keys/centos/RPM-GPG-KEY-CentOS-SIG-NFV
56+
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-NFV
5757

5858
[c9s-sig-virtualization]
5959
name=CentOS Stream 9 - SIG Virtualization
6060
baseurl=https://mirror.stream.centos.org/SIGs/9-stream/virt/$basearch/kata-containers/
6161
gpgcheck=1
6262
repo_gpgcheck=0
6363
enabled=1
64-
gpgkey=file:///usr/share/distribution-gpg-keys/centos/RPM-GPG-KEY-CentOS-SIG-Virtualization
64+
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-Virtualization
6565

6666
[c9s-sig-cloud-okd]
6767
name=CentOS Stream 9 - SIG Cloud OKD 4.19
6868
baseurl=https://mirror.stream.centos.org/SIGs/9-stream/cloud/$basearch/okd-4.19/
6969
gpgcheck=1
7070
repo_gpgcheck=0
7171
enabled=1
72-
gpgkey=file:///usr/share/distribution-gpg-keys/centos/RPM-GPG-KEY-CentOS-SIG-Cloud
72+
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-Cloud

ci/get-ocp-repo.sh

Lines changed: 12 additions & 194 deletions
Original file line numberDiff line numberDiff line change
@@ -3,203 +3,21 @@ set -euo pipefail
33

44
# This script is used when running within the OpenShift CI clusters to fetch
55
# the RHEL and OCP yum repo files from an in-cluster service that mirrors the
6-
# content. It's called from three places:
7-
# - prow-entrypoint.sh: CI tests that build & and test different variants
8-
# - extensions/Dockerfile: when building the extensions container in OpenShift CI
9-
# - Containerfile: when building the node image in CI
6+
# content.
107

11-
print_usage_and_exit() {
12-
cat 1>&2 <<'EOF'
13-
Usage: $0 <MODE> [OPTIONS]
14-
15-
Fetch mirrored RHEL/OCP yum repo files from OpenShift CI's in-cluster service.
16-
The following modes are supported:
17-
18-
--cosa-workdir PATH Get RHEL and OCP versions from manifests in cosa workdir
19-
--ocp-layer MANIFEST Get RHEL version from /usr/lib/os-release and OCP version from manifest
20-
21-
The following options are supported
22-
23-
--output-dir PATH Directory to which to output ocp.repo file
24-
EOF
25-
exit 1
26-
}
27-
28-
info() {
29-
echo "INFO:" "$@" >&2
30-
}
31-
32-
cleanup_repos() {
33-
# if we had installed the packages and created symlinks, remove it
34-
if rpm -q centos-release-cloud; then
35-
dnf remove -y centos-release-{cloud,nfv,virt}-common
36-
find "/usr/share/distribution-gpg-keys/centos" -type l -exec rm -f {} \;
37-
echo "Removed all symbolic links and packages installed for scos"
38-
fi
39-
# remove ocp.repo file
40-
if [ -n "$ocp_manifest" ]; then
41-
if [ -z "$output_dir" ]; then
42-
output_dir=$(dirname "$ocp_manifest")
43-
fi
44-
else
45-
if [ -z "$output_dir" ]; then
46-
output_dir="$cosa_workdir/src/config"
47-
fi
48-
fi
49-
rm "$output_dir/ocp.repo"
50-
echo "Removed repo file $output_dir/ocp.repo"
51-
}
52-
53-
create_gpg_keys() {
54-
# Check if centos-stream-release is installed and centos-release-cloud is not
55-
# enablerepo added in case the repo is disabled (when building extensions)
56-
if rpm -q centos-stream-release && ! rpm -q centos-release-cloud; then
57-
dnf install -y centos-release-{cloud,nfv,virt}-common --enablerepo extras-common
58-
fi
59-
60-
# Create directory for CentOS distribution GPG keys
61-
mkdir -p /usr/share/distribution-gpg-keys/centos
62-
# Create symbolic links for GPG keys
63-
if [ ! -e "/usr/share/distribution-gpg-keys/centos/RPM-GPG-KEY-CentOS-Official" ]; then
64-
ln -s /etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial /usr/share/distribution-gpg-keys/centos/RPM-GPG-KEY-CentOS-Official
65-
ln -s {/etc/pki/rpm-gpg,/usr/share/distribution-gpg-keys/centos}/RPM-GPG-KEY-CentOS-SIG-Cloud
66-
ln -s {/etc/pki/rpm-gpg,/usr/share/distribution-gpg-keys/centos}/RPM-GPG-KEY-CentOS-SIG-Extras-SHA512
67-
ln -s {/etc/pki/rpm-gpg,/usr/share/distribution-gpg-keys/centos}/RPM-GPG-KEY-CentOS-SIG-NFV
68-
ln -s {/etc/pki/rpm-gpg,/usr/share/distribution-gpg-keys/centos}/RPM-GPG-KEY-CentOS-SIG-Virtualization
69-
fi
70-
}
71-
72-
cosa_workdir=
73-
ocp_manifest=
74-
output_dir=
75-
rc=0
76-
options=$(getopt --options h --longoptions help,cosa-workdir:,ocp-layer:,output-dir:,cleanup -- "$@") || rc=$?
77-
[ $rc -eq 0 ] || print_usage_and_exit
78-
eval set -- "$options"
79-
while [ $# -ne 0 ]; do
80-
case "$1" in
81-
-h | --help) print_usage_and_exit;;
82-
--cosa-workdir) cosa_workdir=$2; shift;;
83-
--ocp-layer) ocp_manifest=$2; shift;;
84-
--output-dir) output_dir=$2; shift;;
85-
--cleanup) cleanup_repos; exit 0;;
86-
--) break;;
87-
*) echo "$0: invalid argument: $1" >&2; exit 1;;
88-
esac
89-
shift
90-
done
91-
92-
if [ -n "$ocp_manifest" ]; then
93-
# --ocp-layer path
94-
ocp_version=$(rpm-ostree compose tree --print-only "$ocp_manifest" | jq -r '.metadata.ocp_version')
95-
ocp_version=${ocp_version//./-}
96-
info "Got OpenShift version $ocp_version from $ocp_manifest"
97-
# osname is used lower down, so set it
98-
osname=$(source /usr/lib/os-release; if [ $ID == centos ]; then echo scos; fi)
99-
100-
if [ -z "$output_dir" ]; then
101-
output_dir=$(dirname "$ocp_manifest")
102-
fi
103-
104-
# get rhel version corresponding to the release so we can get the
105-
# correct OpenShift rpms from those for scos. These packages are not
106-
# available in CentOS Stream
107-
if [ "$osname" = scos ]; then
108-
workdir=$(dirname "$ocp_manifest")
109-
manifest="$workdir/manifest.yaml"
110-
json=$(rpm-ostree compose tree --print-only "$manifest")
111-
version=$(jq -r '.["automatic-version-prefix"]' <<< "$json")
112-
rhel_version=$(cut -f2 -d. <<< "$version")
113-
info "Got RHEL version $rhel_version from rhel manifest for scos"
114-
else
115-
rhel_version=$(source /usr/lib/os-release; echo ${VERSION_ID//./})
116-
info "Got RHEL version $rhel_version from /usr/lib/os-release"
117-
fi
118-
else
119-
[ -n "$cosa_workdir" ]
120-
# --cosa-workdir path
121-
122-
# the OCP version always comes from packages-openshift.yaml
123-
ocp_version=$(rpm-ostree compose tree --print-only "$cosa_workdir/src/config/packages-openshift.yaml" | jq -r '.metadata.ocp_version')
124-
ocp_version=${ocp_version//./-}
125-
info "Got OpenShift version $ocp_version from packages-openshift.yaml"
126-
127-
# the RHEL version comes from the target manifest
128-
129-
# first, make sure we're looking at the right manifest
130-
manifest="$cosa_workdir/src/config/manifest.yaml"
131-
if [ -f "$cosa_workdir/src/config.json" ]; then
132-
variant="$(jq --raw-output '."coreos-assembler.config-variant"' 'src/config.json')"
133-
manifest="$cosa_workdir/src/config/manifest-${variant}.yaml"
134-
fi
135-
136-
# flatten manifest and query a couple of fields
137-
json=$(rpm-ostree compose tree --print-only "$manifest")
138-
osname=$(jq -r '.metadata.name' <<< "$json")
139-
is_ocp_variant=$(jq '.packages | contains(["cri-o"])' <<< "$json")
140-
141-
if [ "$osname" = scos ] && [ "$is_ocp_variant" = false ]; then
142-
# this is the pure SCOS case; we don't need any additional repos at all
143-
info "Building pure SCOS variant. Exiting..."
144-
exit 0
145-
elif [ "$osname" = scos ]; then
146-
# We still need the OCP repos for now unfortunately because not
147-
# everything is in the Stream repo. For the RHEL version, just use the
148-
# default variant's one.
149-
json=$(rpm-ostree compose tree --print-only "$cosa_workdir/src/config/manifest.yaml")
150-
fi
151-
version=$(jq -r '.["automatic-version-prefix"]' <<< "$json")
152-
if [ "$is_ocp_variant" = true ]; then
153-
# RHEL version is second field
154-
info "Building OCP variant"
155-
rhel_version=$(cut -f2 -d. <<< "$version")
156-
else
157-
# RHEL version is first and second field
158-
info "Building pure variant"
159-
rhel_version=$(cut -f1-2 -d. <<< "$version")
160-
rhel_version=${rhel_version//./}
161-
fi
162-
info "Got RHEL version $rhel_version from automatic-version-prefix value $version"
163-
164-
if [ -z "$output_dir" ]; then
165-
output_dir="$cosa_workdir/src/config"
166-
fi
167-
fi
168-
169-
mkdir -p "$output_dir"
170-
repo_path="$output_dir/ocp.repo"
171-
172-
set -x
173-
curl --fail -L "http://base-${ocp_version}-rhel${rhel_version}.ocp.svc.cluster.local" -o "$repo_path"
174-
set +x
175-
176-
if [ "${rhel_version}" = 96 ]; then
177-
# XXX: also currently also add 9.4 repos for crun-wasm when building extensions
8+
urls=(
9+
# theoretically that's the only one we need
10+
"http://base-4-19-rhel96.ocp.svc.cluster.local"
11+
# XXX: but also currently add 9.4 repos for crun-wasm when building extensions
17812
# https://github.com/openshift/os/issues/1680
17913
# https://github.com/openshift/os/pull/1682
18014
# https://issues.redhat.com/browse/COS-3075
181-
curl --fail -L http://base-4-19-rhel94.ocp.svc.cluster.local >> "$repo_path"
182-
fi
15+
"http://base-4-19-rhel94.ocp.svc.cluster.local"
16+
)
18317

184-
# If we're building the SCOS OKD variant, then strip away all the RHEL repos and just keep the plashet.
185-
# Temporary workaround until we have all packages for SCOS in CentOS Stream.
186-
if [ "$osname" = scos ]; then
187-
info "Neutering RHEL repos for SCOS"
188-
awk '/server-ose/,/^$/' "$repo_path" > "$repo_path.tmp"
189-
# only pull in certain Openshift packages as the rest come from the c9s repo
190-
sed -i '/^baseurl = /a includepkgs=openshift-* ose-aws-ecr-* ose-azure-acr-* ose-gcp-gcr-*' "$repo_path.tmp"
191-
# add the contents of the CentOS Stream repo
192-
workdir="$cosa_workdir/src/config"
193-
if [ -n "$ocp_manifest" ]; then
194-
workdir=$(dirname "$ocp_manifest")
195-
fi
196-
# pull in the mirror repo as well in case there are newer versions in the composes
197-
# and we require older versions - this happens because we build the node images async
198-
# and the composes move fast.
199-
cat "$workdir/c9s.repo" >> "$repo_path.tmp"
200-
cat "$workdir/c9s-mirror.repo" >> "$repo_path.tmp"
201-
mv "$repo_path.tmp" "$repo_path"
202-
create_gpg_keys
203-
fi
18+
dest=$1; shift
20419

205-
cat "$repo_path"
20+
rm -f "$dest"
21+
for url in "${urls[@]}"; do
22+
curl --fail -L "$url" >> "$dest"
23+
done

ci/prow-entrypoint.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ cosa_init() {
6060

6161
# Initialize the .repo files
6262
prepare_repos() {
63-
src/config/ci/get-ocp-repo.sh --cosa-workdir .
63+
src/config/ci/get-ocp-repo.sh src/config/ocp.repo
6464
}
6565

6666
# Do a cosa build & cosa build-extensions only.

0 commit comments

Comments
 (0)