OCPBUGS-52363: ci/get-ocp-repo.sh: Fixes for scos to accomodate building images in CI by Prashanth684 · Pull Request #1757 · openshift/os

Prashanth684 · 2025-02-27T16:09:31Z

For scos, we need the rhel-9.x-server-ose repo to get the Openshift releated binaries (kubelet, oc..)
Append the c9s.repo so the packages for the rest comes from the CentOS Stream repos.
Install centos stream packages so GPG keys are available when accessing the CentOS Stream repos

Once we have this merged, I am going to try to have config changes similar to the rhel-coreos config to build and promote scos images. This will be the substitute for the mass open cloud pipeline through which we build our images today and will eliminate having us maintain and run it.

jlebon · 2025-03-04T21:02:38Z

+# on SCOS, we need to add the GPG keys of the various SIGs we need - same as what is done for extensions
+RUN if rpm -q centos-stream-release && ! rpm -q centos-release-cloud; then dnf install -y centos-release-{cloud,nfv,virt}-common; fi
+RUN mkdir -p /usr/share/distribution-gpg-keys/centos
+RUN ln -s /etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial /usr/share/distribution-gpg-keys/centos/RPM-GPG-KEY-CentOS-Official
+RUN ln -s {/etc/pki/rpm-gpg,/usr/share/distribution-gpg-keys/centos}/RPM-GPG-KEY-CentOS-SIG-Cloud
+RUN ln -s {/etc/pki/rpm-gpg,/usr/share/distribution-gpg-keys/centos}/RPM-GPG-KEY-CentOS-SIG-Extras-SHA512
+RUN ln -s {/etc/pki/rpm-gpg,/usr/share/distribution-gpg-keys/centos}/RPM-GPG-KEY-CentOS-SIG-NFV
+RUN ln -s {/etc/pki/rpm-gpg,/usr/share/distribution-gpg-keys/centos}/RPM-GPG-KEY-CentOS-SIG-Virtualization


Hmm, I think this hints at a larger issue though, which is that we don't actually want the repo definitions fetched by get-ocp-repo.sh to stay in the final node image. For RHCOS/OCP, it doesn't matter too much because get-ocp-repo.sh is only used in the CI path. That's not the case for OKD AIUI. (And even for RHCOS, ideally we do clean it up.)

So I think we need to rework this so that we only use those repos for the dnf install, and then remove them. I guess we should probably also uninstall the SIG packages too? If the repos don't actually ship by default, then it seems odd to still ship the keys for it.

OK how about:

enhance get-ocp-repo.sh to install the centos-release-* packages and do the symlink hack

remove these RUN commands here and in the extensions build since it's already done in get-ocp-repo.sh, which they both call

add a e.g. get-ocp-repo.sh --cleanup, which will:

remove any repo files it added

remove any packages it installed

call get-ocp-repo.sh --cleanup after apply-manifest but before the find to call. we don't have to do this in the extensions build, since it's a multi-stage build anyway

That's not the case for OKD AIUI.

Ah right. I was doing it locally with the --secret id=yumrepos which was why it was getting cleaned up. That's not the case when building with prow

I guess we should probably also uninstall the SIG packages too? If the repos don't actually ship by default, then it seems odd to still ship the keys for it.

Yes, we could uninstall it and keep it clean, but I thought having those was benign, and anyway, they are public.

I like the suggestion of pulling these into get-ocp-repo though . I'll work on those changes.

(And even for RHCOS, ideally we do clean it up.)

Actually, we really want it there too. Someone just filed https://issues.redhat.com/browse/OCPBUGS-52363 which this now fixes! (I think the related issue there is that our sed isn't handling space before/after the = as it occurs in the mirror repo definitions, but we can fix that separately.)

fixed the sed line in a separate commit. the PR is ready if you want to give it a look!

openshift-ci-robot · 2025-03-05T14:09:35Z

@Prashanth684: This pull request references Jira Issue OCPBUGS-52363, which is invalid:

expected the bug to target the "4.19.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

For scos, we need the rhel-9.x-server-ose repo to get the Openshift releated binaries (kubelet, oc..)

Append the c9s.repo so the packages for the rest comes from the CentOS Stream repos.

Install centos stream packages so GPG keys are available when accessing the CentOS Stream repos

Once we have this merged, I am going to try to have config changes similar to the rhel-coreos config to build and promote scos images. This will be the substitute for the mass open cloud pipeline through which we build our images today and will eliminate having us maintain and run it.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

jlebon · 2025-03-05T14:12:06Z

/jira refresh

openshift-ci-robot · 2025-03-05T14:12:14Z

@jlebon: This pull request references Jira Issue OCPBUGS-52363, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.19.0) matches configured target version for branch (4.19.0)
bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @mike-nguyen

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

jlebon

Some comments, but LGTM overall. Thanks for working on this!

jlebon · 2025-03-05T17:44:03Z

    info "Neutering RHEL repos for SCOS"
    awk '/server-ose/,/^$/' "$repo_path" > "$repo_path.tmp"
+    # only pull in certain Openshift packages as the rest come from the c9s repo
+    sed -i '/^baseurl = /a includepkgs=openshift-* ose-aws-ecr-* ose-azure-acr-* ose-gcp-gcr-*' "$repo_path.tmp"


Do we need this? What else comes from the plashet without it?
Just want to avoid having to maintain a list here.

yes - we want cri-o, cri-tools, conmon, openvswitch to come from the sig-cloud and the Centos Stream openvswitch repos and not from the plashet.

in the longterm we want to target even building the kubelet, openshift-clients and the platform related packages through sig-cloud so we can eliminate the need for the plashet completely.

in the longterm we want to target even building the kubelet, openshift-clients and the platform related packages through sig-cloud so we can eliminate the need for the plashet completely.

Yes, agree.

But I mean more, are those other packages frequently higher versioned in the plashet than in the SIG repos?

the versions differ, but not by much, except for openvswitch and ovn - we cannot use the one from plashets (they come from FDP repos)

I think ideally this list would live elsewhere. E.g. as another repo definition in openshift/release that's really just the same as the plashet, but has the includepkgs= inlined. We do something similar also for the kernel: openshift/release#61361

The advantage of that is that anything that wants to reuse these repo definitions doesn't have to redefine this stuff.

oh yeah that's an idea..we could put the repo there and have a service to access similar to the rhel ones. especially once we start building the images through prow. Although every release we would need to bump the sig-cloud repos, which is fine as we have to do that in this repo too anyway

jlebon · 2025-03-05T17:45:19Z

+    if [ -n "$ocp_manifest" ]; then
+        workdir=$(dirname "$ocp_manifest")
+    fi
+    cat "$workdir/c9s.repo" >> "$repo_path.tmp"


This is OK, though I think at least baseos and appstream will be duplicates with the builtin ones.

Actually, is there a package we could install that has the SIG repo definitions?

You can imagine once this repo is split in two and the base image is defined elsewhere, we wouldn't necessarily have the c9s.repo file here.

i'd have to look into that - you are correct that the base and appstream are present, but nothing else. installing these repos: centos-release-{cloud,nfv,virt}-common, do add some of the nfv and rt repos, but I didn't find an equivalent for sig-cloud or openvswitch.

- For scos, we need the rhel-9.x-server-ose repo to get the Openshift releated binaries (kubelet, oc..) - Append the c9s.repo so the packages for the rest of the images come from the CentOS Stream repos. - Install centos stream packages so GPG keys are available when accessing the CentOS Stream repos

openshift-ci · 2025-03-05T21:05:10Z

@Prashanth684: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

jlebon · 2025-03-05T21:09:57Z

/approve
/lgtm

Thanks!

openshift-ci · 2025-03-05T21:10:20Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jlebon, Prashanth684

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [jlebon]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci-robot · 2025-03-05T21:13:21Z

@Prashanth684: Jira Issue OCPBUGS-52363: All pull requests linked via external trackers have merged:

openshift/os#1757

Jira Issue OCPBUGS-52363 has been moved to the MODIFIED state.

Details

In response to this:

For scos, we need the rhel-9.x-server-ose repo to get the Openshift releated binaries (kubelet, oc..)

Append the c9s.repo so the packages for the rest comes from the CentOS Stream repos.

Install centos stream packages so GPG keys are available when accessing the CentOS Stream repos

Once we have this merged, I am going to try to have config changes similar to the rhel-coreos config to build and promote scos images. This will be the substitute for the mass open cloud pipeline through which we build our images today and will eliminate having us maintain and run it.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci Bot requested review from c4rt0 and prestist February 27, 2025 16:10

Prashanth684 force-pushed the os-scos-ci branch 2 times, most recently from 6cccb01 to 57cefb4 Compare February 27, 2025 19:44

Prashanth684 requested a review from jlebon February 27, 2025 21:40

Prashanth684 mentioned this pull request Mar 3, 2025

openshift/os: start building scos node images openshift/release#62296

Merged

jlebon reviewed Mar 4, 2025

View reviewed changes

Prashanth684 force-pushed the os-scos-ci branch 12 times, most recently from 9965ca7 to 326db48 Compare March 5, 2025 06:52

jlebon changed the title ~~ci/get-ocp-repo.sh: Fixes for scos to accomodate building images in CI~~ OCPBUGS-52363: ci/get-ocp-repo.sh: Fixes for scos to accomodate building images in CI Mar 5, 2025

openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Mar 5, 2025

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Mar 5, 2025

openshift-ci Bot requested a review from mike-nguyen March 5, 2025 14:12

Prashanth684 force-pushed the os-scos-ci branch from 326db48 to 19adbf9 Compare March 5, 2025 16:26

jlebon reviewed Mar 5, 2025

View reviewed changes

Prashanth684 force-pushed the os-scos-ci branch from 70a7384 to 8e39002 Compare March 5, 2025 18:27

Prashanth684 added 2 commits March 5, 2025 10:30

packages-openshift: fix the disabling of repo files that are mountpoints

8e39002

openshift-ci Bot assigned jlebon Mar 5, 2025

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Mar 5, 2025

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 5, 2025

openshift-merge-bot Bot merged commit 6655529 into openshift:master Mar 5, 2025

Conversation

Prashanth684 commented Feb 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Prashanth684 Mar 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

openshift-ci-robot commented Mar 5, 2025

Uh oh!

jlebon commented Mar 5, 2025

Uh oh!

openshift-ci-robot commented Mar 5, 2025

Uh oh!

jlebon left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented Mar 5, 2025

Uh oh!

jlebon commented Mar 5, 2025

Uh oh!

openshift-ci Bot commented Mar 5, 2025

Uh oh!

openshift-ci-robot commented Mar 5, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Prashanth684 commented Feb 27, 2025 •

edited

Loading

Prashanth684 Mar 4, 2025 •

edited

Loading