Commit graph

3070 commits

Author SHA1 Message Date
Diaa Sami
76e686df10 switch to images/pkg/dnfjson and remove internal copy
COMPOSER-2068
2024-02-20 15:55:47 +01:00
Sanne Raymaekers
5025ec31d3 cloud/awscloud: describe security groups using filters
Using the group names option only works for the default VPC, the workers
are not running in the default VPC. For non-default VPCs filters should
be used.
2024-02-20 15:23:52 +01:00
Sanne Raymaekers
7fce482baa cloud/awscloud: create secure instance in the same subnet
This reduces network costs as transferring data between AZs is not free.
2024-02-16 15:21:20 +01:00
Sanne Raymaekers
ee6b198b0a cloud/awscloud: remove restricting egress rule from SG
The machine still needs to be able to fetch sources, so just keep the
default 0.0.0.0/0 rule.
2024-02-15 14:23:18 +01:00
Sanne Raymaekers
bfd1978ad8 osbuildexecutor/aws.ec2: pass the manifest to the job manager 2024-02-14 20:28:22 +01:00
Sanne Raymaekers
8e6717fa1b cloud/awscloud: take instance type from host
InstanceRequirements is very flakey, the create fleet request fails
almost consistently with the same error.

To continue with testing use a fixed instance type for now. As a
followup we can expand the instance type selection logic or figure out
what was wrong with the InstanceRequirements.
2024-02-14 18:15:25 +01:00
Sanne Raymaekers
8a1d66a0bd cloud/awscloud: max 4 overrides are allowed when creating a fleet
```
InvalidParameterValue: Your request contains more than the maximum allowed number of InstanceRequirements (4)
```
2024-02-14 15:24:42 +01:00
Sanne Raymaekers
7fd150b938 cloud/awscloud: specify subnets when creating secure instance
For non-default VPCs, AWS needs the subnets it can launch the instance
in, otherwise it will try to launch the instance in the default VPC,
even if the supplied security groups are attached to a non-default VPC.

Furthermore there can only be 1 subnet specified per availability zone,
so query the subnets in the VPC of the host (as the instance needs to be
launched in the same network), and pick 1 of the VPC's subnets per AZ.
2024-02-14 13:45:52 +01:00
Sanne Raymaekers
e7cadb16af osbuildexecutor: add aws.ec2 executor
This executor spins up an instance which can only contact the host, and
uses the osbuild-jobsite manager & builder to invoke osbuild.
2024-02-14 09:54:11 +01:00
Sanne Raymaekers
a2fb1bfc61 cloud/awscloud: add userdata to secure instance
This way the `worker-initialization.service` knows to spin up the
builder instead of the worker.
2024-02-14 09:54:11 +01:00
Sanne Raymaekers
3db88960c2 cloud/awscloud: add ability to run a secure instance to awscloud
This instance can only contact the host, and requires this host to be
running on AWS itself with the appropriate IAM role.
2024-02-14 09:54:11 +01:00
Sanne Raymaekers
05a45ed233 cloud/awscloud: add ec2metadata client 2024-02-14 09:54:11 +01:00
Sanne Raymaekers
e10424de2f osbuildexecutor: introduce osbuildexecutor.Executor interface
Wrap the current osbuildexecutor.Executor in an interface so it's easier
to add different executors, which for instance can run osbuild in a VM.
2024-02-14 09:54:11 +01:00
Diaa Sami
c9c51613a4 composer: glitchtip integration 2024-02-13 14:57:57 +01:00
Achilleas Koutsou
52d4b196a3 cloudapi: enable iot-bootable-container image type 2024-02-02 10:34:41 +01:00
Tomáš Hozza
0690b6f1ba cloudapi: pass depsolve job error details to the manifest job error
If a depsolve job fails, the error details were not passed as details to
the manifest job error details. This may help with debugging failures.

Signed-off-by: Tomáš Hozza <thozza@redhat.com>
2024-01-26 11:32:34 +01:00
Tomáš Hozza
b79eaeb78e weldr: don't determine distro name from image type when depsolving
Weldr API used to determine the distro name from the image type, when it
was getting the repositories to use for depsolving and for the actual
depsolving (solver uses the distro name to namespace cache).

This used to be OK, but with the introduction of distro name aliases,
the distro name used to get the distro object may not be the same as the
name returned by the actual distro object. To preserve the current
behavior, the same name used to get the distro object should be used to
also get the repositories for depsolving and to namespace depsolving
cache.

Signed-off-by: Tomáš Hozza <thozza@redhat.com>
2024-01-26 11:32:34 +01:00
Tomáš Hozza
43e87632fb Drop common.CurrentArch() in favor of osbuild/images
Drop `common.CurrentArch()` implementation and use
`arch.Current().String()` from the osbuild/images instead.

Signed-off-by: Tomáš Hozza <thozza@redhat.com>
2024-01-26 11:32:34 +01:00
Tomáš Hozza
c4e5ab5aca Drop internal/common/distro.go in favor of osbuild/images
Drop `common.GetHostDistroName()` implementation and use
`distro.GetHostDistroName()` from the osbuild/images instead.

Signed-off-by: Tomáš Hozza <thozza@redhat.com>
2024-01-26 11:32:34 +01:00
Tomáš Hozza
fb1b27c0ef Move cleaning up old dnfjson cache dirs from composer to Weldr API
Previously, the old dnfjson cache dirs for unsupported distributions
were deleted in the osbuild-composer binary on startup. This is no
longer possible, since the supported distros are determined by loading
available repositories. Loading repositories happens in the Weldr API
constructor. Move the cleanup code there.

Signed-off-by: Tomáš Hozza <thozza@redhat.com>
2024-01-26 11:32:34 +01:00
Tomáš Hozza
625b1578fa Port osbuild/images v0.33.0 with dot-notation to composer
Update the osbuild/images to the version which introduces "dot notation"
for distro release versions.

 - Replace all uses of distroregistry by distrofactory.
 - Delete local version of reporegistry and use the one from the
   osbuild/images.
 - Weldr: unify `createWeldrAPI()` and `createWeldrAPI2()` into a single
   `createTestWeldrAPI()` function`.
 - store/fixture: rework fixtures to allow overriding the host distro
   name and host architecture name. A cleanup function to restore the
   host distro and arch names is always part of the fixture struct.
 - Delete `distro_mock` package, since it is no longer used.
 - Bump the required version of osbuild to 98, because the OSCAP
   customization is using the 'compress_results' stage option, which is
   not available in older versions of osbuild.

Signed-off-by: Tomáš Hozza <thozza@redhat.com>
2024-01-26 11:32:34 +01:00
djach7
4d241b684b edge: add iot-simplified-installer image type
Adds iot-simplified-installer image type to enable koji composes.

Signed-off-by: djach7 <djachimo@redhat.com>
2024-01-18 21:45:23 +01:00
Sanne Raymaekers
edadbb3470 upload/azure: set hyperv generation
This is a required parameter in the new armcompute sdk.
2024-01-16 14:25:58 +01:00
Sanne Raymaekers
adc07299a8 upload/azure: set storage account minimum TLS version to 1.2 2024-01-16 14:25:58 +01:00
Sanne Raymaekers
828d82e871 upload/azure: user newer resourcemanager packages
The older azure sdk and autorest packages are deprecated.

Signed-off-by: Sanne Raymaekers <sanne.raymaekers@gmail.com>
2024-01-16 14:25:58 +01:00
Brian C. Lane
e287138e2e cloudapi: Add testing for blueprint compose request
This tests to make sure the blueprint produced by the customizations
data and the blueprint data are identical.
2024-01-15 11:48:35 +01:00
Brian C. Lane
7438e29375 cloudapi: Create a compose using the blueprint data
If the request includes a blueprint (and not customizations) it uses
that blueprint for the compose.
2024-01-15 11:48:35 +01:00
Brian C. Lane
5b87877109 cloudapi: Add optional blueprint schema to compose request
This adds a 'blueprint' section to the compose request. It also
restricts it so that only 'blueprint' or 'customizations' can be
included, but not both. The goal is to move to using 'blueprint' for all
customizations so that there is a single consistent interface for the
clients.

Where the openapi schemas are the same between the two they have been
shared, but a few are different. They are created with 'Blueprint*' as
their name.

This also re-adds the SSHKey schema removed by commit
bfad6d50e1, it is used by the Blueprint
Customization.
2024-01-15 11:48:35 +01:00
Ondřej Budai
6a4b4b5ded dnfjson: fix repo hashes
20808e9848

changed the hash generation algorithm again, let's adjust the values.

In the future, we should probably mock this out, or change the test.

Signed-off-by: Ondřej Budai <ondrej@budai.cz>
2023-12-22 00:11:19 +00:00
Ondrej Ezr
d5483ccfb0 test: Add nginx to the image request 2023-12-20 09:02:06 +01:00
Ondrej Ezr
4b3b942dde cloudapi: Add module_hotfixes flag
Allow passing module_hotfixes flag through the cloudapi.
This will enable depsolving on repositories that might be affected by modularity filtering.

Refs HMS-3202
2023-12-20 09:02:06 +01:00
djach7
4870a836f3 cloudapi: enable 'fdo.di_mfg_string_type_mac_iface'
Adds implementation of the 'fdo.di_mfg_string_type_mac_iface' dracut
variable to allow simplified installer images to pass this value to the
manufacturing-client.service.
2023-12-14 22:21:09 +01:00
Achilleas Koutsou
6d57e01506 deps: update images to v0.24.0
Update the images dependency to v0.24.0

Includes the addition of the new FDO option
'di_mfg_string_type_mac_iface'.
2023-12-14 22:21:09 +01:00
Sanne Raymaekers
c6aa7d88d2 internal/weldr: specify architecture of compose
This is useful in environments with multi-arch remote workers.
Defaults to the host architecture.
2023-12-14 21:25:32 +01:00
Sanne Raymaekers
e24772dc57 worker/server: check if worker is available for architecture 2023-12-14 21:25:32 +01:00
Sanne Raymaekers
850e44589b worker/server: split out jobqueue call from PostWorker handler 2023-12-14 21:25:32 +01:00
Sanne Raymaekers
ac854b7cc8 pkg/jobqueue: add arch to worker 2023-12-14 21:25:32 +01:00
Miguel Martín
991293a897 Generate FIPS compliant SSH keys
Generate FIPS compliant SSH keys required
for testing system FIPS mode support
2023-12-13 10:19:47 +01:00
Miguel Martín
98847f7494 Expose the FIPS blueprint customization
Expose the FIPS blueprint customization through
the cloud API.

Signed-off-by: Miguel Martín <mmartinv@redhat.com>
2023-12-13 10:19:47 +01:00
Miguel Martín
3c64edfcb9 Define the FIPS blueprint customization
Define a new blueprint customization that
allows to enable the system FIPS mode

Signed-off-by: Miguel Martín <mmartinv@redhat.com>
2023-12-13 10:19:47 +01:00
Sanne Raymaekers
bfad6d50e1 cloudapi/v2: tweak customizations
Fix verbiage of groups customization, fields which accept an array
should be plural.

Remove the sshkey customization, sshkeys are merged into user
customizations anyway, so users should use the "users" customization
instead.

Since these customizations aren't in use yet, this edit should be fine.

See #3716
2023-12-08 15:31:56 +01:00
Tomáš Hozza
1afe7d20c8 Adjust code to new version of osbuild/images
Signed-off-by: Tomáš Hozza <thozza@redhat.com>
2023-12-06 17:32:18 +01:00
Sanne Raymaekers
d3dd83aceb internal/test: return in TestRouteWithReply on empty body
Check if the response is empty, and return instead of continuing.
2023-12-06 17:22:36 +01:00
Sanne Raymaekers
fd4a3a941a worker: let client register itself with the worker server
Sends a status update to the worker server every 5 minutes.

Also fixes a bug where the body the worker client sent would be empty if
it had to refresh the JWT token. Instead of io.Reader use io.ReadSeeker
so the body can be reread to create the second request (after the token
refresh).
2023-12-06 17:22:36 +01:00
Sanne Raymaekers
794acd8e34 worker: add ability to track workers serverside
Unresponsive workers (>=1 hour of no status update) are cleaned up.

Several things are enabled by keeping track of workers, in future the
worker server could:
- keep track of how many workers are active
- see if a worker for a specific architecture is available
2023-12-06 17:22:36 +01:00
Sanne Raymaekers
d784075d31 jobqueue: add ability to track workers 2023-12-06 17:22:36 +01:00
Brian C. Lane
aca748bc14 Don't Panic in getComposeStatus and skip invalid jobs in fsjobqueue New
This handles corrupt job json files by skipping them. They still exist,
and errors are logged, but the system keeps working.

If one or more of the json files in /var/lib/osbuild-composer/jobs/
becomes corrupt they can stop the osbuild-composer service from
starting, or stop commands like 'composer-cli compose status' from
working because they quit on the first error and miss any job that
aren't broken.
2023-11-20 13:34:40 +01:00
Achilleas Koutsou
fbf63f6a1f cloudapi: add upload targets to route handler tests 2023-11-17 16:48:16 +01:00
Achilleas Koutsou
38664d1b64 cloudapi: add GetTarget() test case for pulp.ostree 2023-11-17 16:48:16 +01:00
Gianluca Zuccarelli
b711e302ba cloudapi: add pulp upload target
Add the pulp.ostree upload target to the cloud API and enable it for
edge/iot commits.

Co-Authored-By: Achilleas Koutsou <achilleas@koutsou.net>
2023-11-17 16:48:16 +01:00