WIP Updates for 4.23 node image Konflux build#1929
Conversation
Update ocp_version to 4.23 and switch rhel-9.8 repo IDs to match the repo names injected at build time. Drop rhel-9.8-early-kernel as the kernel is now covered by rhel-9-server-ose-rpms. rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: thegreyd The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
ART's art-unsigned.repo uses arch-suffixed section IDs (e.g. [rhel-98-baseos-x86_64]) rather than the plain names referenced in packages-openshift.yaml, causing rpm-ostree treefile-apply to fail with "Unknown repo: '...'" for RHEL builds. Fix by: - Moving `source /etc/os-release` before the repo injection in build-node-image.sh, and only adding the CentOS source .repo files for CentOS/SCOS builds. RHEL builds should only use the repos already injected by ART (art-unsigned.repo) and the yumrepos secret. - Removing the explicit repos: lists from the rhel-9.8 and rhel-10.2 conditional-include blocks in packages-openshift.yaml. Since CentOS repos are no longer added for RHEL builds, there is nothing to restrict; rpm-ostree will use whatever repos ART has configured. rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED
|
@thegreyd: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
| - osversion != "centos-10" | ||
| include: | ||
| repos: [ENOEXIST] # We want an error in this case | ||
| - if: osversion == "rhel-9.8" |
There was a problem hiding this comment.
How do you inject the repos? Don't we still need them here for the CI or local builds?
There was a problem hiding this comment.
For Konflux, we inject them in the Dockerfile we produce by reconciling the upstream one, here.
For CI builds, things get more complicated. For "normal" images, we use well-known CI images that we produce and publish to floating tags like registry.ci.openshift.org/ocp/4.22:base-rhel9. These images have a dnf wrapper script we use to inject the needed repos at build time. Do you need CI builds at all in this case? We would be mirroring the result of our Konflux builds to any imagestream you'd need.
|
Closed in favor of #1932 |
3 participants
rh-pre-commit.version: 2.3.2
rh-pre-commit.check-secrets: ENABLED