PKG-1426: Bake qemu into Graviton worker AMIs via an agent-image factory#369
Open
nogueiraanderson wants to merge 2 commits into
Open
PKG-1426: Bake qemu into Graviton worker AMIs via an agent-image factory#369nogueiraanderson wants to merge 2 commits into
nogueiraanderson wants to merge 2 commits into
Conversation
- Parameterized Packer factory (images/jenkins-agent) for the Tier-A worker agent AMIs: fleet-common payload baked per (os, arch), extension by provisioner not by template copy - arm64 capability profile bakes the digest-pinned qemu static binary with persistent systemd binfmt registration (F flag), BuildID-verified, bounded-retry pull, file(1) preinstalled - Bake -> fresh-boot smoke -> role-tag-flip promote; failed smokes deregister the candidate; emulation asserted end-to-end on arm64 smokes - GHA workflow: no-AWS validate on PRs, dispatch-gated OIDC bake matrix - OIDC role + SSM builder profile + no-ingress SG as a parameterized sibling of the ppg factory substrate, exact-subject trust on this repository
…ply-chain pins - Grant ssm:GetParameter on the AL2023 public parameter path and iam:GetInstanceProfile on the builder profile, the first bake dies without both - skip_create_ami on the smoke build removes the by-product AMI and the concurrent-matrix cleanup race entirely - Read the AMI id from a packer manifest and cross-check its arch tag, never scrape human output; always() cleanup deregisters an unpromoted candidate on any failure or cancellation - Correct the aws-actions/configure-aws-credentials pin to the real v4.3.1 commit; pin packer 1.15.4 and amazon plugin 1.8.2 exactly - Cap the job at 55 minutes so it fails before the one-hour OIDC session expires mid-cleanup
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Feature
images/jenkins-agent/) baking the Tier-A worker agent AMIs, with the arm64 profile carrying qemu user-mode emulation so x86_64-only test helper containers run on Graviton workersWhy
Tickets