-
Notifications
You must be signed in to change notification settings - Fork 1.5k
images/installer: Rewrite tectonic-installer for openshift-install #343
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
images/installer: Rewrite tectonic-installer for openshift-install #343
Conversation
c7ea759 to
7404847
Compare
The golang-1.10 image has everything we need to build now. I run the build in a golang-1.10 container using 'FROM ... AS ...' [1] like we used to. But now I no longer install packages with yum. And I use a recursive COPY [2] to bring the built/fetched binaries over into the output container, which is based on scratch. Once we switch openshift/release over to this Dockerfile, we can drop images/tectonic-installer. [1]: https://docs.docker.com/engine/reference/builder/#from [2]: https://docs.docker.com/engine/reference/builder/#copy
7404847 to
29e4d10
Compare
|
Dropped the |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: abhinavdahiya, wking The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/test images |
|
The images failure was: |
|
/retest |
|
These seem like errors from |
|
For a similar error earlier, @smarterclayton pointed at this indent issue. Looks like that's currently still in master, but it could also be another busted JSON/YAML file causing the "operator "catalog" failed to map images: yaml: line 16: mapping values are not allowed in this context". |
|
More work on that indent issue ongoing in operator-framework/operator-lifecycle-manager#486. |
|
Goal is to have more gating in place in the next few days to mitigate the impact here - everything landing at once etc |
|
/retest Please review the full test history for this PR and help us cut down flakes. |
|
operator-framework/operator-lifecycle-manager#486 landed. /retest |
|
/retest |
|
/retest Please review the full test history for this PR and help us cut down flakes. |
|
The images presubmit is new today with openshift/release#1704. Maybe we shoulfd roll it back temporarily? |
|
/retest Please review the full test history for this PR and help us cut down flakes. |
openshift-install is he next-gen installer. With the new installer, we only need the installer binary and terraform to launch and destroy clusters. I've removed the smoke tests for now, because I haven't looked into building them without Bazel. Hopefully we'll get expanded e2e testing *and* other OpenShift projects using our installer soon to keep us honest. Also missing from the new installer is a way to set expirationDate. But we'll just not leak until we regain the ability to set that, right? ;) The new installer dumps less cruft into the output directory (most of the generated output goes into a temporary directory), so I've adjusted the openshift-install calls to just use an artifacts subdir for their state storage. A bonus of this approach is that if the installer hangs up, we'll capture anything it wrote to disk without needing an explicit cp call. A drawback is that we'll leak any secrets that get put into the kubeconfig, so don't put anything in there that needs to stay private after the cluster is reaped. Using the base image for the installer's 'from' is quite a bit different from openshift/installer@29e4d10e (origin/pr/343) images/installer: Rewrite tectonic-installer for openshift-install, 2018-09-26, openshift/installer#343), where the Dockerfile is 'FROM scratch'. Including the OpenShift base currently adds ~230 MB to the installer layer's 110 MB for the two binaries, although both of those are uncompressed sizes. Gzipping layers reduces the sizes to around 84 MB and 26 MB respectively. So the added base cruft is not huge, but it's still hefty. The upside of using the base image is that we have a standard POSIX-ish system for executing the cleanup script. To demonstrate the 'FROM scratch' approach, I've adjusted the setup container to call the installer directly (with no wrapping shell script). And to support that, I've shifted some waiting code over into the test container (which also saves us from having to copy 'oc' around). I've also dropped the 3.11 config, since the installer is 4.0-only.
| FROM openshift/origin-release:golang-1.10 AS build | ||
| WORKDIR /go/src/github.com/openshift/installer | ||
| COPY . . | ||
| RUN hack/build.sh && hack/get-terraform.sh |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We'll have to replace the curl-based get-terraform.sh here with a yum call or some such to comply with Red Hat's OCP Automated Release Policies. But that's probably not too much of a rush. I think get-terraform.sh should stay curl-based to be package-manager agnostic.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Vendoring a copy of terraform into a repo is probably the best option if you need a specific tagged commit. If you have to change X at a high rate, the pain you'll feel from RPM iteration will outweigh any ugliness of vendoring.
The installer Dockerfile has put the binary in /bin since openshift/install@29e4d10eb7 (images/installer: Rewrite tectonic-installer for openshift-install, 2018-09-26, openshift/installer#343). Fixes: $ oc adm release extract --command=openshift-install registry.svc.ci.openshift.org/openshift/origin-release:v4.0 error: image did not contain usr/bin/openshift-install
The golang-1.10 image has everything we need to build now. I run the build in a golang-1.10 container using
FROM ... AS ...like we used to. But now I no longer install packages withyum. And I use a recursiveCOPYto bring the built/fetched binaries over into the output container, which is based onscratch./assign @abhinavdahiya