Commit graph

3102 commits

Author SHA1 Message Date
Sanne Raymaekers
3be2c92a1b internal/blueprint: add ExpireDate to UserCustomization
Just to make osbuild-composer compile, this field is not functional yet.
2024-03-28 11:11:13 +01:00
Brian C. Lane
d3fc53bdec cloudapi: Override the request distro with the blueprint distro
When the blueprint sets a specific distribution it should be used
instead of the distribution from the compose request.

Includes a test to make sure it uses repositories from the blueprint,
not the request.
2024-03-22 19:12:24 +01:00
Sanne Raymaekers
314ed4b527 cloud/awscloud: allow internet access on secure instance again
The executor is timing out and there are no logs. This will require some
further work. Remove the restriction for now.
2024-03-20 14:58:25 +01:00
Achilleas Koutsou
3633528613 worker: drop compatibility test for DepsolveJob serialisation
This reverts commit c8ce3e4428
2024-03-20 12:12:12 +01:00
Achilleas Koutsou
80f8fa051c worker: drop backwards compatibility for DepsolveJob serialisation
We've kept this around a lot longer than we should have.

This reverts commit 94c7fda779.
2024-03-20 12:12:12 +01:00
Achilleas Koutsou
8f78171f83 cloudapi: add installer customizations to the API
Adding both as a traditional compose request customization and in the
new blueprint customizations.
2024-03-20 11:45:08 +01:00
Achilleas Koutsou
bd57d95e49 blueprint: add installer customizations 2024-03-20 11:45:08 +01:00
Sanne Raymaekers
79b5b736e9 cloud/awscloud: restrict network egress for secure instance
The security instance should no longer have any internet access.
2024-03-19 17:07:30 +01:00
Sanne Raymaekers
56bdcf1cdc aws.ec2: prep sources before starting build 2024-03-19 17:07:30 +01:00
Brian C. Lane
57ebfb4011 cloudapi: Use distro repos if none included in imageRequest
In order to support cloudapi blueprint requests from the cmdline using
composer-cli it needs to select the repositories based on the selected
distribution instead of requiring the user to include them with the
request.

If the image request includes repositories they are used, which matches
the current behavior. If the repository list is empty it will use the
distribution name to select from the repositories shipped with
osbuild-composer.
2024-03-11 03:04:54 -07:00
Brian C. Lane
01ba674cac cloudapi: Pass the RepoRegistry to the cloudapi Server 2024-03-11 03:04:54 -07:00
Brian C. Lane
b8967d53bc Move RepoRegistry setup into Composer
This is so that both the weldr and cloud api's can use it as the source
of their repositories.
2024-03-11 03:04:54 -07:00
Tomáš Hozza
e7743f17ec Worker: allow configuring executor CloudWatch group
We need the ability to use different CloudWatch group for the
osbuild-executor on Fedora workers in staging and production
environment.

Extend the worker confguration to allow configuring the CloudWatch group
name used by the osbuild-executor. Extend the secure instance code to
instruct cloud-init via user data to create /tmp/cloud_init_vars file
with the CloudWatch group name in the osbuild-executor instance, to make
it possible for the executor to configure its logging differently based
on the value.

Cover new changes by unit tests.

Signed-off-by: Tomáš Hozza <thozza@redhat.com>
2024-03-08 13:13:44 +01:00
Sanne Raymaekers
040eec4089 osbuild-worker: allow adding key to aws.ec2 executor
This is useful during testing to set up the executor machine.
2024-03-01 19:20:51 +01:00
Gianluca Zuccarelli
c480d79e95 cloudapi: enable masked services
Extend the cloudapi to accept masked systemd services as a
customization.
2024-02-29 20:57:39 +01:00
Gianluca Zuccarelli
f6b76cce31 Update osbuild/images to v0.41.0
Multiple blueprint fixes:

- Extend the blueprint service customizations to accept services to be
  masked.

- The `storage-path` and `container-transport` fields were removed in
  imagees 41.0 in order to simplify the way local storage containers are
  handled.
2024-02-29 20:57:39 +01:00
Amelia Crate
b3bb851863 Tag rhel 9.2+ with SEV_LIVE_MIGRATABLE_V2
SEV-SNP capable kernels containing commit ac3f9c9f are compatible.
SEV_LIVE_MIGRATABLE indicated compatibility with an older version of SEV live migration, without ac3f9c9f.
See: https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=ac3f9c9f1b37edaa7d1a9b908bc79d843955a1a2
2024-02-22 15:45:39 +01:00
Florian Schüller
d900a5315e blueprints_test: Simplify check of the error message RHEL-16006 2024-02-22 15:22:52 +01:00
Florian Schüller
fe338cc475 blueprints_test: change to exact error message validation RHEL-16006 2024-02-22 15:22:52 +01:00
Florian Schüller
7bfd3ea464 blueprints_test: change to more readable table driven tests 2024-02-22 15:22:52 +01:00
Florian Schüller
42da3cb143 blueprint: rename package variable for readability 2024-02-22 15:22:52 +01:00
Florian Schüller
fb8634a991 blueprint: improve error message on missing name
the error should not infer that a version is mandatory.
Also the error message is now explicitly checked
2024-02-22 15:22:52 +01:00
Florian Schüller
99e84abc66 api: add error message for package without name RHEL-16006 2024-02-22 15:22:52 +01:00
Ondřej Budai
242df9ab75 cloudapi: Add a smoke test for GetImageRequests
The focus of this test is to ensure that the image type enumeration in the
public Cloud API is correctly translated to the image type names as defined
in the images library.

Additionally, it covers that the default target is correctly set.

Signed-off-by: Ondřej Budai <ondrej@budai.cz>
2024-02-21 12:09:01 +01:00
Ondřej Budai
9b965b0912 cloudapi: Add forgotten iot-simplified-installer to getDefaultTarget
Signed-off-by: Ondřej Budai <ondrej@budai.cz>
2024-02-21 12:09:01 +01:00
Ondřej Budai
504a51089c cloudapi: split GetImageRequests off PostCompose
This allows us to do some testing of the ComposeRequest => []imageRequest
conversion without actually enqueueing any jobs (which requires us to
do quite a lot of setup in the testsuite).

Signed-off-by: Ondřej Budai <ondrej@budai.cz>
2024-02-21 12:09:01 +01:00
Ondřej Budai
28ef0bc855 cloudapi: move manifest seed into an image request
The goal of this commit is primarily to simplify the API of the enqueue
methods. This way, basically everything needed to generate manifests
is in the imageRequest structure, which simplifies the amount of structures
that we need to think about.

Signed-off-by: Ondřej Budai <ondrej@budai.cz>
2024-02-21 12:09:01 +01:00
Ondřej Budai
7385cab165 cloudapi: move blueprint into an image request
The goal of this commit is primarily to simplify the API of the enqueue
methods. This way, basically everything needed to generate manifests
is in the imageRequest structure, which simplifies the amount of structures
that we need to think about.

Signed-off-by: Ondřej Budai <ondrej@budai.cz>
2024-02-21 12:09:01 +01:00
Ondřej Budai
ab8c1ae4f7 clouadpi: remove distribution from enqueue methods
They can just find it from the image type.

Signed-off-by: Ondřej Budai <ondrej@budai.cz>
2024-02-21 12:09:01 +01:00
Ondřej Budai
c48bf0a143 cloudapi: remove arch from imageRequest
You can absolutely just get it from imageType, let's not duplicate
information, that's error-prone.

Signed-off-by: Ondřej Budai <ondrej@budai.cz>
2024-02-21 12:09:01 +01:00
Ondřej Budai
08aabe1bef cloudapi: add minimal-raw 2024-02-21 12:09:01 +01:00
Ondřej Budai
eb3bd9dc43 cloudapi: sort image types in getDefaultTarget
Not a functional change.

Signed-off-by: Ondřej Budai <ondrej@budai.cz>
2024-02-21 12:09:01 +01:00
Diaa Sami
76e686df10 switch to images/pkg/dnfjson and remove internal copy
COMPOSER-2068
2024-02-20 15:55:47 +01:00
Sanne Raymaekers
5025ec31d3 cloud/awscloud: describe security groups using filters
Using the group names option only works for the default VPC, the workers
are not running in the default VPC. For non-default VPCs filters should
be used.
2024-02-20 15:23:52 +01:00
Sanne Raymaekers
7fce482baa cloud/awscloud: create secure instance in the same subnet
This reduces network costs as transferring data between AZs is not free.
2024-02-16 15:21:20 +01:00
Sanne Raymaekers
ee6b198b0a cloud/awscloud: remove restricting egress rule from SG
The machine still needs to be able to fetch sources, so just keep the
default 0.0.0.0/0 rule.
2024-02-15 14:23:18 +01:00
Sanne Raymaekers
bfd1978ad8 osbuildexecutor/aws.ec2: pass the manifest to the job manager 2024-02-14 20:28:22 +01:00
Sanne Raymaekers
8e6717fa1b cloud/awscloud: take instance type from host
InstanceRequirements is very flakey, the create fleet request fails
almost consistently with the same error.

To continue with testing use a fixed instance type for now. As a
followup we can expand the instance type selection logic or figure out
what was wrong with the InstanceRequirements.
2024-02-14 18:15:25 +01:00
Sanne Raymaekers
8a1d66a0bd cloud/awscloud: max 4 overrides are allowed when creating a fleet
```
InvalidParameterValue: Your request contains more than the maximum allowed number of InstanceRequirements (4)
```
2024-02-14 15:24:42 +01:00
Sanne Raymaekers
7fd150b938 cloud/awscloud: specify subnets when creating secure instance
For non-default VPCs, AWS needs the subnets it can launch the instance
in, otherwise it will try to launch the instance in the default VPC,
even if the supplied security groups are attached to a non-default VPC.

Furthermore there can only be 1 subnet specified per availability zone,
so query the subnets in the VPC of the host (as the instance needs to be
launched in the same network), and pick 1 of the VPC's subnets per AZ.
2024-02-14 13:45:52 +01:00
Sanne Raymaekers
e7cadb16af osbuildexecutor: add aws.ec2 executor
This executor spins up an instance which can only contact the host, and
uses the osbuild-jobsite manager & builder to invoke osbuild.
2024-02-14 09:54:11 +01:00
Sanne Raymaekers
a2fb1bfc61 cloud/awscloud: add userdata to secure instance
This way the `worker-initialization.service` knows to spin up the
builder instead of the worker.
2024-02-14 09:54:11 +01:00
Sanne Raymaekers
3db88960c2 cloud/awscloud: add ability to run a secure instance to awscloud
This instance can only contact the host, and requires this host to be
running on AWS itself with the appropriate IAM role.
2024-02-14 09:54:11 +01:00
Sanne Raymaekers
05a45ed233 cloud/awscloud: add ec2metadata client 2024-02-14 09:54:11 +01:00
Sanne Raymaekers
e10424de2f osbuildexecutor: introduce osbuildexecutor.Executor interface
Wrap the current osbuildexecutor.Executor in an interface so it's easier
to add different executors, which for instance can run osbuild in a VM.
2024-02-14 09:54:11 +01:00
Diaa Sami
c9c51613a4 composer: glitchtip integration 2024-02-13 14:57:57 +01:00
Achilleas Koutsou
52d4b196a3 cloudapi: enable iot-bootable-container image type 2024-02-02 10:34:41 +01:00
Tomáš Hozza
0690b6f1ba cloudapi: pass depsolve job error details to the manifest job error
If a depsolve job fails, the error details were not passed as details to
the manifest job error details. This may help with debugging failures.

Signed-off-by: Tomáš Hozza <thozza@redhat.com>
2024-01-26 11:32:34 +01:00
Tomáš Hozza
b79eaeb78e weldr: don't determine distro name from image type when depsolving
Weldr API used to determine the distro name from the image type, when it
was getting the repositories to use for depsolving and for the actual
depsolving (solver uses the distro name to namespace cache).

This used to be OK, but with the introduction of distro name aliases,
the distro name used to get the distro object may not be the same as the
name returned by the actual distro object. To preserve the current
behavior, the same name used to get the distro object should be used to
also get the repositories for depsolving and to namespace depsolving
cache.

Signed-off-by: Tomáš Hozza <thozza@redhat.com>
2024-01-26 11:32:34 +01:00
Tomáš Hozza
43e87632fb Drop common.CurrentArch() in favor of osbuild/images
Drop `common.CurrentArch()` implementation and use
`arch.Current().String()` from the osbuild/images instead.

Signed-off-by: Tomáš Hozza <thozza@redhat.com>
2024-01-26 11:32:34 +01:00