Skip to content

ART-14453: Use rpm-ostree install directly in legacy build pipeline#1935

Open
locriandev wants to merge 2 commits into
openshift:masterfrom
locriandev:rpm-ostree-install-legacy
Open

ART-14453: Use rpm-ostree install directly in legacy build pipeline#1935
locriandev wants to merge 2 commits into
openshift:masterfrom
locriandev:rpm-ostree-install-legacy

Conversation

@locriandev
Copy link
Copy Markdown

@locriandev locriandev commented May 13, 2026 •
edited
Loading

Summary

Per feedback on #1932, this PR updates the legacy build pipeline to use rpm-ostree install directly instead of rpm-ostree experimental compose treefile-apply with packages-openshift.yaml.

Changes

  • build-node-image.sh — Replace rpm-ostree experimental compose treefile-apply with direct rpm-ostree install command, embedding all postprocess steps inline
  • packages-openshift.yaml — Removed (no longer needed)
  • All postprocess steps from packages-openshift.yaml are now embedded inline in build-node-image.sh

Related: #1932

@locriandev
Use rpm-ostree install directly in legacy build pipeline
ef13eab 
Replace rpm-ostree experimental compose treefile-apply with direct
rpm-ostree install and inline postprocess steps. This aligns the
legacy build-node-image.sh with the Konflux approach while maintaining
support for SCOS/OKD variant detection.

Changes:
- Replace treefile-apply with rpm-ostree install command
- Move all postprocess steps from packages-openshift.yaml inline
- Remove packages-openshift.yaml (no longer needed)
- Keep OPENSHIFT_VERSION=5.0 for master branch
- Preserve SCOS/OKD detection using ID and VERSION_ID heuristic

Related: openshift#1932

Co-Authored-By: Claude Sonnet 4.5 <[email protected]>

rh-pre-commit.version: 2.3.2
rh-pre-commit.check-secrets: ENABLED
@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented May 13, 2026

@locriandev: GitHub didn't allow me to request PR reviews from the following users: openshift/team-coreos.

Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

Summary

Per feedback on #1932, this PR updates the legacy build pipeline to use rpm-ostree install directly instead of rpm-ostree experimental compose treefile-apply with packages-openshift.yaml.

Changes

  • build-node-image.sh — Replace rpm-ostree experimental compose treefile-apply with direct rpm-ostree install command, embedding all postprocess steps inline
  • packages-openshift.yaml — Removed (no longer needed)

Key details

  • All postprocess steps from packages-openshift.yaml are now embedded inline in build-node-image.sh
  • Maintains OPENSHIFT_VERSION="5.0" for the master branch
  • Preserves SCOS/OKD variant detection using ID and VERSION_ID heuristic (centos-10 → SCOS, everything else → RHCOS)
  • Net change: 97 insertions, 176 deletions

This aligns the legacy pipeline with the approach taken in the Konflux build path (#1932), making both pipelines use the same direct installation method.

Related: #1932

/cc @openshift/team-coreos

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented May 13, 2026

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: locriandev
Once this PR has been reviewed and has the lgtm label, please assign aaradhak for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@locriandev locriandev changed the title Use rpm-ostree install directly in legacy build pipeline ART-14453: Use rpm-ostree install directly in legacy build pipeline May 13, 2026
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label May 13, 2026
@openshift-ci-robot
Copy link
Copy Markdown

openshift-ci-robot commented May 13, 2026 •
edited by openshift-ci Bot
Loading

@locriandev: This pull request references ART-14453 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

Per feedback on #1932, this PR updates the legacy build pipeline to use rpm-ostree install directly instead of rpm-ostree experimental compose treefile-apply with packages-openshift.yaml.

Changes

  • build-node-image.sh — Replace rpm-ostree experimental compose treefile-apply with direct rpm-ostree install command, embedding all postprocess steps inline
  • packages-openshift.yaml — Removed (no longer needed)
  • All postprocess steps from packages-openshift.yaml are now embedded inline in build-node-image.sh

Related: #1932

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@travier
Copy link
Copy Markdown
Member

travier commented May 13, 2026 •
edited
Loading

Maybe we should go one step further and use dnf directly?

@travier
Copy link
Copy Markdown
Member

travier commented May 13, 2026

Something is off here:

Updating metadata for 'rhel-9-baseos'...done
Updating metadata for 'rhel-9-appstream'...done
Updating metadata for 'rhel-9-nfv'...done
Updating metadata for 'rhel-9-highavailability'...done
Updating metadata for 'rhel-9-fast-datapath'...done
Updating metadata for 'rhel-9-codeready-builder-rpms'...done
Updating metadata for 'rhel-9-server-ose'...done
Updating metadata for 'rhel-9.8-early-kernel'...done
Updating metadata for 'rhel-9-baseos-ppc64le'...done
Updating metadata for 'rhel-9-appstream-ppc64le'...done
Updating metadata for 'rhel-9-fast-datapath-ppc64le'...done
Updating metadata for 'rhel-9-server-ose-ppc64le'...done
Updating metadata for 'rhel-9-codeready-builder-rpms-ppc64le'...done
Updating metadata for 'rhel-9-baseos-s390x'...done
Updating metadata for 'rhel-9-appstream-s390x'...done
Updating metadata for 'rhel-9-fast-datapath-s390x'...done
Updating metadata for 'rhel-9-server-ose-s390x'...done
Updating metadata for 'rhel-9-codeready-builder-rpms-s390x'...done
Updating metadata for 'rhel-9-baseos-aarch64'...done
Updating metadata for 'rhel-9-appstream-aarch64'...done
Updating metadata for 'rhel-9-fast-datapath-aarch64'...done
Updating metadata for 'rhel-9-server-ose-aarch64'...done
Updating metadata for 'rhel-9-codeready-builder-rpms-aarch64'...done
Updating metadata for 'rhel-10.2-baseos'...done
error: Updating rpm-md repo 'rhel-10.2-baseos': cannot update repo 'rhel-10.2-baseos': Cannot download repomd.xml: Cannot download repodata/repomd.xml: All mirrors were tried; Last error: Status code: 401 for http://base-5-0-rhel102.ocp.svc.cluster.local/rhel-10.2-baseos/repodata/repomd.xml (IP: 172.30.30.122)

@locriandev
Fix repo filtering to prevent 401 errors on wrong OS versions
a4808ee 
When using rpm-ostree install directly, all repos from ci/get-ocp-repo.sh
(which fetches both rhel-9 and rhel-10.2 repos) were being accessed,
causing 401 errors when trying to access repos for the wrong OS version.

This commit adds logic to disable repos that don't match the current OS:
- rhel-9.8 builds: disable rhel-10.2 and centos repos
- rhel-10.2 builds: disable rhel-9 and centos repos
- centos-10 builds: disable all rhel repos

This replicates the conditional-include logic from packages-openshift.yaml.

Co-Authored-By: Claude Sonnet 4.5 <[email protected]>

rh-pre-commit.version: 2.3.2
rh-pre-commit.check-secrets: ENABLED
@locriandev
Copy link
Copy Markdown
Author

locriandev commented May 13, 2026 •
edited
Loading

@travier Thanks for the feedback!

Re: dnf adoption

I have not strong opinions on this, as I understand it the adoption of rpm-ostree install came out as a suggestion from last meeting's notes.

Re: the repo 401 errors

Good catch! The issue was that ci/get-ocp-repo.sh fetches repos for both rhel-9 and rhel-10.2 and concatenates them together. With the old packages-openshift.yaml approach, the conditional-include section would only enable repos matching the OS version. Now with direct rpm-ostree install, all repos were being accessed.

I've pushed a fix (a4808ee) that disables repos not matching the current OS version:

  • rhel-9.8 builds: disable rhel-10.2 and centos repos
  • rhel-10.2 builds: disable rhel-9 and centos repos
  • centos-10 builds: disable all rhel repos

This should resolve the 401 errors.

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented May 13, 2026

@locriandev: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@locriandev @openshift-ci-robot @travier