Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Enable hermetic pipeline builds #598

Open
wants to merge 8 commits into
base: master
Choose a base branch
from
Open

Enable hermetic pipeline builds #598

wants to merge 8 commits into from
+1,036 −23

Conversation

yuumasato
Copy link
Contributor

Hermetic builds are built in total isolation.
These are required to make a release.

@openshift-ci openshift-ci bot requested review from mkumku and rhmdnd November 1, 2024 13:58
@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 1, 2024
@rhmdnd
Copy link
Contributor

rhmdnd commented Nov 5, 2024

This should hopefully start working once konflux-ci/build-definitions#1205 lands.

@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 6, 2024
@yuumasato yuumasato force-pushed the enable-hermetic-builds branch from fe509a7 to 22398dc Compare November 6, 2024 13:28
@openshift-merge-robot openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 6, 2024
@yuumasato yuumasato force-pushed the enable-hermetic-builds branch from 22398dc to b56bb85 Compare November 11, 2024 15:31
@yuumasato yuumasato force-pushed the enable-hermetic-builds branch from b56bb85 to e31c7f1 Compare December 6, 2024 18:29
@yuumasato
Copy link
Contributor Author

/retest

@yuumasato yuumasato force-pushed the enable-hermetic-builds branch 2 times, most recently from 2aac018 to b7cd6c4 Compare December 9, 2024 18:49
@yuumasato yuumasato force-pushed the enable-hermetic-builds branch 3 times, most recently from 0d02299 to 340cbd4 Compare December 16, 2024 15:05
@yuumasato
Copy link
Contributor Author

/retest

@yuumasato
Enable hermetic pipeline builds
9ef025a 
Hermetic builds are built in total isolation.
@yuumasato
Add prefetching of RPMs during Konflux build
ae086e3
@yuumasato
Add Go modules prefetching
82d33da
@yuumasato
Remove subscription manager commands
54e32be 
They will not work on hermetic builds.
@yuumasato
Update list of modules and their checksums
3d65167 
Konflux prefetch task needs up to date list of modules and checksums.
@yuumasato yuumasato force-pushed the enable-hermetic-builds branch from 340cbd4 to 6e5746f Compare December 17, 2024 14:26
@yuumasato yuumasato force-pushed the enable-hermetic-builds branch 7 times, most recently from cf47786 to e82a404 Compare December 19, 2024 15:06
@yuumasato yuumasato force-pushed the enable-hermetic-builds branch 3 times, most recently from 674b945 to 6af8345 Compare December 19, 2024 19:18
@yuumasato yuumasato force-pushed the enable-hermetic-builds branch from 6af8345 to 6f8a566 Compare December 19, 2024 19:37
@yuumasato yuumasato force-pushed the enable-hermetic-builds branch from d9418e9 to bb3401f Compare January 9, 2025 14:19
yuumasato
yuumasato commented Jan 9, 2025
View reviewed changes
bundle-hack/update_csv.go

FIO_IMAGE_PULLSPEC := "quay.io/redhat-user-workloads/ocp-isc-tenant/file-integrity-operator@sha256:148940c5046c11914540b7c9ad872f5b7c1219d2c75d2eeb6d721c9578b9f43a"

env, ok := csv["spec"].(map[string]interface{})["install"].(map[string]interface{})["spec"].(map[string]interface{})["deployments"].([]interface{})[0].(map[string]interface{})["spec"].(map[string]interface{})["template"].(map[string]interface{})["spec"].(map[string]interface{})["containers"].([]interface{})[0].(map[string]interface{})["env"].([]interface{})
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not happy with this, couldn't find a good way to write this.
Unless I add a function to iterate over the a list of tuple (keys, type) while casting.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using CSV struct from operator-framework package helped, but it had problems parsing the CSV version.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This will still only update the CSV file with pull specs from our public Konflux instance, right? We'll need to add another step to build a bundle that will work with registry.redhat.io, right?

@yuumasato
Copy link
Contributor Author

/retest

@yuumasato yuumasato force-pushed the enable-hermetic-builds branch 2 times, most recently from b7a119f to a466ad1 Compare January 13, 2025 17:28
@yuumasato
Update CSV using go
e66f6b4 
This will avoid need to prefetch RPMs and python packages.
@yuumasato yuumasato force-pushed the enable-hermetic-builds branch from a466ad1 to e66f6b4 Compare January 13, 2025 17:35
Vincent056
Vincent056 approved these changes Jan 15, 2025
View reviewed changes
Copy link
Contributor

@Vincent056 Vincent056 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR looks good, I am wondering if we should import the CSV api to the main go dependency.

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Jan 15, 2025
@openshift-ci OpenShift CI
Copy link
Contributor

openshift-ci bot commented Jan 15, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Vincent056, yuumasato

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:
  • OWNERS [Vincent056,yuumasato]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci-robot
Copy link

/retest-required

Remaining retests: 0 against base HEAD fec621d and 2 for PR HEAD 7134350 in total

@yuumasato
Copy link
Contributor Author

The PR looks good, I am wondering if we should import the CSV api to the main go dependency.

@Vincent056 I'm reverting to using maps instead of the CSV struct to unmarshal the yaml, since that was working.

@yuumasato yuumasato force-pushed the enable-hermetic-builds branch from 7134350 to e66f6b4 Compare January 15, 2025 13:21
@openshift-ci openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Jan 15, 2025
@openshift-ci OpenShift CI
Copy link
Contributor

openshift-ci bot commented Jan 15, 2025

New changes are detected. LGTM label has been removed.

@yuumasato
Copy link
Contributor Author

/retest

@openshift-ci OpenShift CI
Copy link
Contributor

openshift-ci bot commented Jan 15, 2025

@yuumasato: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-rosa e66f6b4 link false /test e2e-rosa

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@Vincent056
Copy link
Contributor

The PR looks good, I am wondering if we should import the CSV api to the main go dependency.

@Vincent056 I'm reverting to using maps instead of the CSV struct to unmarshal the yaml, since that was working.

thanks the update, the change looks good!

Vincent056
Vincent056 reviewed Jan 22, 2025
View reviewed changes
bundle-hack/requirements.txt
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wonder if those are still needed

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think so - since we're using update_csv.go for the heavy lifting now.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Vincent056 Vincent056 Vincent056 approved these changes

@mkumku mkumku Awaiting requested review from mkumku

@rhmdnd rhmdnd Awaiting requested review from rhmdnd

Assignees

@Vincent056 Vincent056

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@yuumasato @rhmdnd @openshift-ci-robot @Vincent056 @openshift-merge-robot