OCPBUGS-35507: Fix CRI-O version to match Kubernetes version

packaging/rpm/microshift.spec

@@ -61,8 +61,8 @@ BuildRequires: systemd
 BuildRequires: golang
 # DO NOT REMOVE
 
-Requires: cri-o >= 1.25
-Requires: cri-tools >= 1.25
+Requires: cri-o >= 1.30.0, cri-o < 1.31.0
+Requires: cri-tools >= 1.30.0, cri-tools < 1.31.0
 Requires: iptables
 Requires: microshift-selinux = %{version}
 Requires: microshift-networking = %{version}
@@ -474,6 +474,9 @@ fi
 # Use Git command to generate the log and replace the VERSION string
 # LANG=C git log --date="format:%a %b %d %Y" --pretty="tformat:* %cd %an <%ae> VERSION%n- %s%n" packaging/rpm/microshift.spec
 %changelog
+* Wed Jun 19 2024 Patryk Matuszak <pmatusza@redhat.com> 4.17.0
+- Fix CRI-O version to match Kubernetes version
+
 * Wed Jun 12 2024 Pablo Acevedo Montserrat <pacevedo@redhat.com> 4.16.0
 - Explicitly configure crun as default crio runtime
 

scripts/devenv-builder/configure-vm.sh

@@ -167,37 +167,31 @@ if ${BUILD_AND_RUN}; then
     make srpm
 fi
 
-if ${RHEL_SUBSCRIPTION}; then
-    # This version might not match the version under development because we need
-    # to pull in dependencies that are already released
-    LATEST_RHOCP_MINOR=$("${RHOCP_REPO}")
-else
-    # Assume the current development version on non-RHEL OS
-    LATEST_RHOCP_MINOR=$(cut -d'.' -f2 "${MAKE_VERSION}")
-fi
-OCPVERSION="4.${LATEST_RHOCP_MINOR}"
-
 if ${RHEL_SUBSCRIPTION}; then
     OSVERSION=$(awk -F: '{print $5}' /etc/system-release-cpe)
     sudo subscription-manager config --rhsm.manage_repos=1
 
-    sudo subscription-manager repos \
-        --enable "rhocp-${OCPVERSION}-for-rhel-${OSVERSION}-$(uname -m)-rpms"
-
-    if ! ${RHEL_BETA_VERSION} ; then
-        sudo subscription-manager repos \
-            --enable "fast-datapath-for-rhel-${OSVERSION}-$(uname -m)-rpms"
-    else
-        OCP_REPO_NAME="rhocp-${OCPVERSION}-for-rhel-${OSVERSION}-mirrorbeta-$(uname -i)-rpms"
+    RHOCP=$("${RHOCP_REPO}")
+    if [[ "${RHOCP}" =~ ^[0-9]{2} ]]; then
+        sudo subscription-manager repos --enable "rhocp-4.${RHOCP}-for-rhel-9-$(uname -m)-rpms"
+    elif [[ "${RHOCP}" =~ ^http ]]; then
+        url=$(echo "${RHOCP}" | cut -d, -f1)
+        ver=$(echo "${RHOCP}" | cut -d, -f2)
+        OCP_REPO_NAME="rhocp-4.${ver}-for-rhel-9-mirrorbeta-$(uname -i)-rpms"
         sudo tee "/etc/yum.repos.d/${OCP_REPO_NAME}.repo" >/dev/null <<EOF
 [${OCP_REPO_NAME}]
-name=Beta rhocp-${OCPVERSION} RPMs for RHEL ${OSVERSION}
-baseurl=https://mirror.openshift.com/pub/openshift-v4/\$basearch/dependencies/rpms/${OCPVERSION}-el${OSVERSION}-beta/
+name=Beta rhocp-4.${ver} RPMs for RHEL 9
+baseurl=${url}
 enabled=1
 gpgcheck=0
 skip_if_unavailable=0
 EOF
     fi
+
+    # Enable fast-datapath (ovn) only for non-beta. Beta RHEL will use openvswitch from RHOCP beta mirror.
+    if ! ${RHEL_BETA_VERSION}; then
+        sudo subscription-manager repos --enable "fast-datapath-for-rhel-${OSVERSION}-$(uname -m)-rpms"
+    fi
 else
     "${DNF_RETRY}" "install" "centos-release-nfv-common"
     sudo dnf copr enable -y @OKD/okd "centos-stream-9-$(uname -m)"
@@ -215,6 +209,8 @@ fi
 if ${RHEL_SUBSCRIPTION}; then
     "${DNF_RETRY}" "install" "openshift-clients"
 else
+    # Assume the current development version on non-RHEL OS
+    OCPVERSION="4.$(cut -d'.' -f2 "${MAKE_VERSION}")"
     OCC_SRC="https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/dependencies/rpms/${OCPVERSION}-el9-beta"
     OCC_RPM="$(curl -s "${OCC_SRC}/" | grep -o "openshift-clients-4[^\"']*.rpm" | sort | uniq)"
     OCC_LOC="$(mktemp /tmp/openshift-client-XXXXX.rpm)"

scripts/get-latest-rhocp-repo.sh

@@ -8,7 +8,12 @@
 # because repositories are only usable after the release.
 # Accessing them before the release results in 403 error.
 #
-# Output is just the minor (Y) version number.
+# Script can accept a minor version (e.g. 16) to check for RHOCP of specific version only.
+#
+# Output is:
+# - just a minor version in case of subscription RHOCP repository, e.g.: 15
+# - or an URL to beta mirror followed by comma and minor version, e.g.:
+#   https://mirror.openshift.com/pub/openshift-v4/x86_64/dependencies/rpms/4.16-el9-beta/,16
 
 set -euo pipefail
 
@@ -20,20 +25,25 @@ if ! sudo subscription-manager status >&/dev/null; then
     exit 1
 fi
 
-# Get minor version of currently checked out branch.
-# It's based on values stored in Makefile.version.$ARCH.var.
-make_version="${REPOROOT}/Makefile.version.$(uname -m).var"
-if [ ! -f "${make_version}" ] ; then
-    # Attempt to locate the Makefile version file next to the current script.
-    # This is necessary when bootstrapping the development environment for the first time.
-    make_version=$(find "${SCRIPTDIR}" -maxdepth 1 -name "Makefile.version.$(uname -m).*.var" | tail -1)
+if [[ "$#" -eq 1 ]]; then
+    current_minor="${1}"
+    stop="${current_minor}"
+else
+    # Get minor version of currently checked out branch.
+    # It's based on values stored in Makefile.version.$ARCH.var.
+    make_version="${REPOROOT}/Makefile.version.$(uname -m).var"
     if [ ! -f "${make_version}" ] ; then
-        >&2 echo "Cannot find the Makefile.version.$(uname -m).var file"
-        exit 1
+        # Attempt to locate the Makefile version file next to the current script.
+        # This is necessary when bootstrapping the development environment for the first time.
+        make_version=$(find "${SCRIPTDIR}" -maxdepth 1 -name "Makefile.version.$(uname -m).*.var" | tail -1)
+        if [ ! -f "${make_version}" ] ; then
+            >&2 echo "Cannot find the Makefile.version.$(uname -m).var file"
+            exit 1
+        fi
     fi
+    current_minor=$(cut -d'.' -f2 "${make_version}")
+    stop=$(( current_minor - 3 ))
 fi
-current_minor=$(cut -d'.' -f2 "${make_version}")
-stop=$(( current_minor - 3 ))
 
 # Go through minor versions, starting from current_mirror counting down
 # to get latest available rhocp repository.
@@ -42,11 +52,16 @@ stop=$(( current_minor - 3 ))
 # and then rhocp-4.14 (which will be returned from the script because it's usable).
 for ver in $(seq "${current_minor}" -1 "${stop}"); do
     repository="rhocp-4.${ver}-for-rhel-9-$(uname -m)-rpms"
-    if sudo dnf -v repository-packages "${repository}" info cri-o 1>&2;
-    then
+    if sudo dnf repository-packages "${repository}" info cri-o 1>&2; then
         echo "${ver}"
         exit 0
     fi
+
+    rhocp_beta_url="https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/dependencies/rpms/4.${ver}-el9-beta/"
+    if sudo dnf repository-packages --disablerepo '*' --repofrompath "this,${rhocp_beta_url}" this info cri-o 1>&2; then
+        echo "${rhocp_beta_url},${ver}"
+        exit 0
+    fi
 done
 
 >&2 echo "Failed to get latest rhocp repository!"

scripts/image-builder/build.sh

@@ -348,7 +348,17 @@ fi
 
 title "Loading package sources"
 
-LATEST_RHOCP_MINOR=$("${ROOTDIR}/scripts/get-latest-rhocp-repo.sh")
+RHOCP=$("${ROOTDIR}/scripts/get-latest-rhocp-repo.sh")
+if [[ "${RHOCP}" =~ ^[0-9]{2} ]]; then
+    OCP_MINOR="${RHOCP}"
+    RHOCP_URL="https://cdn.redhat.com/content/dist/layered/rhel9/${BUILD_ARCH}/rhocp/4.${OCP_MINOR}/os"
+    RHOCP_GPG_RHSM="true"
+elif [[ "${RHOCP}" =~ ^http ]]; then
+    RHOCP_URL=$(echo "${RHOCP}" | cut -d, -f1)
+    OCP_MINOR=$(echo "${RHOCP}" | cut -d, -f2)
+    RHOCP_GPG_RHSM="false"
+fi
+
 PACKAGE_SOURCES="microshift-local rhocp fast-datapath"
 if [ -n "${CUSTOM_RPM_FILES}" ] ; then
     PACKAGE_SOURCES+=" custom-rpms"
@@ -357,7 +367,9 @@ fi
 for f in ${PACKAGE_SOURCES} ; do
     sed -e "s;REPLACE_IMAGE_BUILDER_DIR;${BUILDDIR};g" \
         -e "s;REPLACE_BUILD_ARCH;${BUILD_ARCH};g" \
-        -e "s;REPLACE_OCP_MINOR;${LATEST_RHOCP_MINOR};g" \
+        -e "s;REPLACE_OCP_MINOR;${OCP_MINOR};g" \
+        -e "s;REPLACE_RHOCP_URL;${RHOCP_URL};g" \
+        -e "s;REPLACE_RHOCP_GPG_RHSM;${RHOCP_GPG_RHSM};g" \
         "${SCRIPTDIR}/config/${f}.toml.template" \
         > ${f}.toml
     sudo composer-cli sources delete ${f} 2>/dev/null || true

scripts/image-builder/config/rhocp.toml.template

@@ -1,8 +1,8 @@
 id = "rhocp-4.REPLACE_OCP_MINOR"
 name = "Red Hat OpenShift Container Platform 4.REPLACE_OCP_MINOR for RHEL 9"
 type = "yum-baseurl"
-url = "https://cdn.redhat.com/content/dist/layered/rhel9/REPLACE_BUILD_ARCH/rhocp/4.REPLACE_OCP_MINOR/os"
-check_gpg = true
+url = "REPLACE_RHOCP_URL"
+check_gpg = REPLACE_RHOCP_GPG_RHSM
 check_ssl = true
 system = false
-rhsm = true
+rhsm = REPLACE_RHOCP_GPG_RHSM

test/bin/build_images.sh

@@ -81,6 +81,8 @@ configure_package_sources() {
     export RHOCP_MINOR_Y
     export RHOCP_MINOR_Y1
     export RHOCP_MINOR_Y2
+    export RHOCP_MINOR_Y_BETA
+    export RHOCP_MINOR_Y1_BETA
 
     # Add our sources. It is OK to run these steps repeatedly, if the
     # details change they are updated in the service.
@@ -578,7 +580,19 @@ do_group() {
 is_rhocp_available() {
     local -r ver="${1}"
     repository="rhocp-4.${ver}-for-rhel-9-$(uname -m)-rpms"
-    if sudo dnf -v repository-packages "${repository}" info cri-o 1>&2; then
+    if sudo dnf repository-packages "${repository}" info cri-o 1>&2; then
+        return 0
+    fi
+    return 1
+}
+
+is_rhocp_beta_available() {
+    local -r ver="${1}"
+    url_amd="https://mirror.openshift.com/pub/openshift-v4/x86_64/dependencies/rpms/4.${ver}-el9-beta/"
+    url_arm="https://mirror.openshift.com/pub/openshift-v4/aarch64/dependencies/rpms/4.${ver}-el9-beta/"
+    # Use specific minor version RHOCP mirror only if both arches are available.
+    if sudo dnf repository-packages --disablerepo '*' --repofrompath "this,${url_arm}" this info cri-o 1>&2 && \
+        sudo dnf repository-packages --disablerepo '*' --repofrompath "this,${url_amd}" this info cri-o 1>&2; then
         return 0
     fi
     return 1
@@ -725,12 +739,19 @@ PREVIOUS_RELEASE_VERSION=$(echo "${previous_version_repo}" | cut -d, -f1)
 PREVIOUS_RELEASE_REPO=$(echo "${previous_version_repo}" | cut -d, -f2)
 
 RHOCP_MINOR_Y=""
-RHOCP_MINOR_Y1=""
+RHOCP_MINOR_Y_BETA=""
 if is_rhocp_available "${MINOR_VERSION}"; then
     RHOCP_MINOR_Y="${MINOR_VERSION}"
+elif is_rhocp_beta_available "${MINOR_VERSION}"; then
+    RHOCP_MINOR_Y_BETA="https://mirror.openshift.com/pub/openshift-v4/${UNAME_M}/dependencies/rpms/4.${MINOR_VERSION}-el9-beta/"
 fi
+
+RHOCP_MINOR_Y1=""
+RHOCP_MINOR_Y1_BETA=""
 if is_rhocp_available "${PREVIOUS_MINOR_VERSION}"; then
     RHOCP_MINOR_Y1="${PREVIOUS_MINOR_VERSION}"
+elif is_rhocp_beta_available "${PREVIOUS_MINOR_VERSION}"; then
+    RHOCP_MINOR_Y1_BETA="https://mirror.openshift.com/pub/openshift-v4/${UNAME_M}/dependencies/rpms/4.${PREVIOUS_MINOR_VERSION}-el9-beta/"
 fi
 
 # For Y-2, there will always be a real repository, so we can always

test/bin/pyutils/build_bootc_images.py

@@ -91,6 +91,25 @@ def is_rhocp_available(ver):
         return False
 
 
+def get_rhocp_beta_url_if_available(ver):
+    url_amd = f"https://mirror.openshift.com/pub/openshift-v4/x86_64/dependencies/rpms/4.{ver}-el9-beta/"
+    url_arm = f"https://mirror.openshift.com/pub/openshift-v4/aarch64/dependencies/rpms/4.{ver}-el9-beta/"
+
+    try:
+        # Run the dnf command to check for cri-o in the specified repository
+        repo_info = common.run_command_in_shell(f"sudo dnf repository-packages --disablerepo '*' --repofrompath 'this,{url_amd}' this info cri-o")
+        common.print_msg(repo_info)
+
+        repo_info = common.run_command_in_shell(f"sudo dnf repository-packages --disablerepo '*' --repofrompath 'this,{url_arm}' this info cri-o")
+        common.print_msg(repo_info)
+
+        # Use specific minor version RHOCP mirror only if both arches are available.
+        architecture = platform.machine()
+        return f"https://mirror.openshift.com/pub/openshift-v4/{architecture}/dependencies/rpms/4.{ver}-el9-beta/"
+    except Exception:
+        return ""
+
+
 def set_rpm_version_info_vars():
     global SOURCE_VERSION
     global MINOR_VERSION
@@ -107,6 +126,8 @@ def set_rpm_version_info_vars():
     global RHOCP_MINOR_Y2
     global YMINUS2_RELEASE_VERSION
     global YMINUS2_RELEASE_REPO
+    global RHOCP_MINOR_Y_BETA
+    global RHOCP_MINOR_Y1_BETA
 
     release_info_rpm = find_latest_rpm(LOCAL_REPO)
     release_info_rpm_base = find_latest_rpm(BASE_REPO)
@@ -132,11 +153,26 @@ def set_rpm_version_info_vars():
 
     RHOCP_MINOR_Y = ""
     RHOCP_MINOR_Y1 = ""
+
     if is_rhocp_available(MINOR_VERSION):
         RHOCP_MINOR_Y = MINOR_VERSION
+
     if is_rhocp_available(PREVIOUS_MINOR_VERSION):
         RHOCP_MINOR_Y1 = PREVIOUS_MINOR_VERSION
 
+    # Check RHOCP mirror anyway, because centos9 tests are using them.
+    RHOCP_MINOR_Y_BETA = get_rhocp_beta_url_if_available(MINOR_VERSION)
+    RHOCP_MINOR_Y1_BETA = get_rhocp_beta_url_if_available(PREVIOUS_MINOR_VERSION)
+
+    # Currently bootc tests only use current minor RHOCP. If they are unavailable, use previous minor RHOCP.
+    if RHOCP_MINOR_Y == "" and RHOCP_MINOR_Y1 != "":
+        RHOCP_MINOR_Y = RHOCP_MINOR_Y1
+    elif RHOCP_MINOR_Y_BETA == "" and RHOCP_MINOR_Y1_BETA != "":
+        RHOCP_MINOR_Y_BETA = RHOCP_MINOR_Y1_BETA
+
+    if RHOCP_MINOR_Y == "" and RHOCP_MINOR_Y_BETA == "":
+        raise Exception("Could not find a suitable RHOCP repository to enable")
+
     # For Y-2, there will always be a real repository, so we can always
     # set the template variable for enabling that package source and use
     # the well-known name of that repo instead of figuring out the URL.
@@ -152,7 +188,8 @@ def set_rpm_version_info_vars():
         'YMINUS2_MINOR_VERSION', 'FAKE_NEXT_MINOR_VERSION', 'SOURCE_VERSION_BASE',
         'CURRENT_RELEASE_VERSION', 'CURRENT_RELEASE_REPO', 'PREVIOUS_RELEASE_VERSION',
         'PREVIOUS_RELEASE_REPO', 'RHOCP_MINOR_Y', 'RHOCP_MINOR_Y1',
-        'RHOCP_MINOR_Y2', 'YMINUS2_RELEASE_VERSION', 'YMINUS2_RELEASE_REPO'
+        'RHOCP_MINOR_Y2', 'YMINUS2_RELEASE_VERSION', 'YMINUS2_RELEASE_REPO',
+        'RHOCP_MINOR_Y_BETA', 'RHOCP_MINOR_Y1_BETA'
     ]
     for var in rpmver_globals_vars:
         value = globals().get(var)

test/bin/scenario.sh

@@ -227,7 +227,7 @@ prepare_kickstart() {
         sed -e "s|REPLACE_LVM_SYSROOT_SIZE|${LVM_SYSROOT_SIZE}|g" \
             -e "s|REPLACE_OSTREE_SERVER_URL|${WEB_SERVER_URL}/repo|g" \
             -e "s|REPLACE_RPM_SERVER_URL|${WEB_SERVER_URL}/rpm-repos|g" \
-            -e "s|REPLACE_PREVIOUS_MINOR_VERSION|$(previous_minor_version)|g" \
+            -e "s|REPLACE_MINOR_VERSION|$(current_minor_version)|g" \
             -e "s|REPLACE_BOOT_COMMIT_REF|${boot_commit_ref}|g" \
             -e "s|REPLACE_PULL_SECRET|${PULL_SECRET_CONTENT}|g" \
             -e "s|REPLACE_HOST_NAME|${vm_hostname}|g" \

test/bootc-sources/microshift_repo_config.sh.template

@@ -37,7 +37,7 @@ config_centos9_repos() {
     cat > "${OCP_MIRROR_REPO_FILE}" <<EOF
 [openshift-mirror-beta]
 name=OpenShift Mirror Beta Repository
-baseurl=https://mirror.openshift.com/pub/openshift-v4/{{ .Env.UNAME_M }}/dependencies/rpms/4.{{ .Env.PREVIOUS_MINOR_VERSION }}-el9-beta/
+baseurl={{ .Env.RHOCP_MINOR_Y_BETA }}
 enabled=1
 gpgcheck=0
 skip_if_unavailable=0
@@ -71,18 +71,25 @@ sslclientcert = ${sslcrt}
 skip_if_unavailable=0
 EOF
 
-    # Only the y-2 version is guaranteed to be available for released repositories
     cat > "${OCP_RHOCP_REPO_FILE}" <<EOF
 [openshift-rhocp]
 name=OpenShift Dependencies RHEL 9
-baseurl=https://cdn.redhat.com/content/dist/layered/rhel9/{{ .Env.UNAME_M }}/rhocp/4.{{ .Env.YMINUS2_MINOR_VERSION }}/os
+{{- if env.Getenv "RHOCP_MINOR_Y" "" }}
+baseurl=https://cdn.redhat.com/content/dist/layered/rhel9/{{ .Env.UNAME_M }}/rhocp/4.{{ .Env.RHOCP_MINOR_Y }}/os
 enabled=1
 gpgcheck=1
 gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
 sslverify=1
 sslcacert = /etc/rhsm/ca/redhat-uep.pem
 sslclientkey = ${sslkey}
 sslclientcert = ${sslcrt}
+{{- else }}
+{{- /* Just use .Env.RHOCP_MINOR_Y_BETA without checking if it exists, so missing repo is an explicit error */}}
+baseurl={{ .Env.RHOCP_MINOR_Y_BETA }}
+enabled=1
+gpgcheck=0
+sslverify=1
+{{- end }}
 skip_if_unavailable=0
 EOF
 }

test/kickstart-templates/includes/post-cos9rpm.cfg

@@ -19,11 +19,10 @@ skip_if_unavailable=0
 gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-NFV
 EOF
 
-# The openshift-client dependency from OpenShift Mirror
-# Only the released previous minor version is guaranteed to be available
+# openshift-client and crio from OpenShift Mirror.
 # Excludes all to avoid unintentionally sourcing packages from here that
 # should come from a centos repos.
-OCPVERSION=4.REPLACE_PREVIOUS_MINOR_VERSION
+OCPVERSION=4.REPLACE_MINOR_VERSION
 OCPREPO="openshift-${OCPVERSION}-mirror"
 cat > "/etc/yum.repos.d/${OCPREPO}.repo" <<EOF
 [${OCPREPO}]

test/package-sources/rhocp-y.toml

@@ -8,3 +8,12 @@ check_ssl = true
 system = false
 rhsm = true
 {{- end -}}
+{{- if env.Getenv "RHOCP_MINOR_Y_BETA" "" -}}
+id = "rhocp-y"
+name = "rhocp BETA"
+type = "yum-baseurl"
+url = "{{ .Env.RHOCP_MINOR_Y_BETA }}"
+check_gpg = false
+check_ssl = true
+system = false
+{{- end -}}