Skip to content

Add PR based override for machine-os-content #21919

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-robot merged 1 commit into from
Feb 3, 2019
Merged

Add PR based override for machine-os-content #21919

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions images/os/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
FROM fedora:29 AS build

COPY --from=registry.svc.ci.openshift.org/openshift/origin-v4.0:machine-os-content /srv/ /srv/
RUN yum install -y ostree yum-utils selinux-policy-targeted && \
commit=$( find /srv -name *.commit | sed -Ee 's|.*objects/(.+)/(.+)\.commit|\1\2|' | head -1 ) && \
mkdir /tmp/working && cd /tmp/working && \
yumdownloader --destdir=/tmp/rpms origin-node origin-clients && \
for i in $(find /tmp/rpms/ -name origin-* -iname *.rpm); do echo "Extracting $i ..."; rpm2cpio $i | cpio -div; done && \
mv etc usr/ && \
ostree --repo=/srv/repo commit --parent=$commit --tree=ref=$commit --tree=dir=. --selinux-policy / \
-s "origin-ci-dev overlay RPMs" --branch=origin-ci-dev
Copy link
Member

@jlebon jlebon Jan 31, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This needs to include the previous tree too so that it's a complete OSTree. See similar code in rpm-ostree: https://github.com/projectatomic/rpm-ostree/blob/master/tests/vmcheck/overlay.sh. It's a mouthful, but essentially:

ostree checkout <parent-tree> /tmp/working
<overlay binaries>
ostree commit /tmp/working --branch=origin-ci-dev

Copy link
Contributor Author

@smarterclayton smarterclayton Jan 31, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh.

Copy link
Member

@jlebon jlebon Jan 31, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually, just ostree commit --tree=ref=<parent-tree> --tree=dir=. should work too.

Copy link
Contributor Author

@smarterclayton smarterclayton Jan 31, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, add --tree-ref

Copy link
Contributor Author

@smarterclayton smarterclayton Jan 31, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

--tree-ref=$commit?

Copy link
Member

@jlebon jlebon Jan 31, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

--tree=ref=$commit --tree=dir=. will basically start off with the same tree as $commit and then overlay . on top of that.

Copy link
Member

@jlebon jlebon Jan 31, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(Another minor thing: --orphan and --branch are contradictory. We should probably error out on that. :) You can drop the --orphan and we can tweak pivot as mentioned to just default to the one branch that exists if there's no com.coreos.ostree-commit)

Copy link
Member

@jlebon jlebon Jan 31, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So, --selinux-policy / here is using the file contexts from the f29 buildroot, but we're running in RHEL. Probably fine if none of the files need special labels, but why not use a CentOS buildroot with CentOS' selinux-policy-targeted?

Copy link
Member

@cgwalters cgwalters Jan 31, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well...that makes it a bit harder to find ostree unfortunately 😢

Copy link
Member

@jlebon jlebon Jan 31, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm, yeah. So was looking at ostree ls -RX origin-ci-dev and it's basically all etc_t and bin_t (we're also including manpages right now, but meh... don't need to overoptimize here). Anyway, seems safe enough!

Copy link
Member

@jlebon jlebon Jan 31, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ahh OK, so one final gotcha here is that we also need to do the /etc -> /usr/etc translation (yet another reason why we should teach this to rpm-ostree). So basically just:

    for i in $(find /tmp/rpms/ -name origin-*); do rpm2cpio $i | cpio -div; done && \
    mv etc usr/ && \
    ...


FROM scratch
COPY --from=build /srv/ /srv/