kt vm: Pin Rocky repos to vault to prevent minor version drift#71
Open
roxanan1996 wants to merge 1 commit into
Open
kt vm: Pin Rocky repos to vault to prevent minor version drift#71roxanan1996 wants to merge 1 commit into
roxanan1996 wants to merge 1 commit into
Conversation
There was a problem hiding this comment.
Pull request overview
Pins Rocky Linux DNF repository configuration inside kt vm cloud-init to avoid unintended minor-version drift when installing packages after the image is built.
Changes:
- Disable
mirrorlist=entries in Rocky repo files to prevent redirects to newer minor releases. - Rewrite
baseurlto point to the Rocky vault location for the image’s minor version. - Replace
$releaseverwith the OSVERSION_IDand clear DNF metadata cache.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
roxanan1996
force-pushed
the
{rnicolescu}_kt_vm_pin
branch
from
a4ed21b to
f1394ce
Compare
roxanan1996
force-pushed
the
{rnicolescu}_kt_vm_pin
branch
from
f1394ce to
5627b50
Compare
roxanan1996
force-pushed
the
{rnicolescu}_kt_vm_pin
branch
from
5627b50 to
bde249f
Compare
roxanan1996
force-pushed
the
{rnicolescu}_kt_vm_pin
branch
from
bde249f to
85c4624
Compare
Without this, dnf resolves packages from the latest minor release instead of the one the image was built with. - Disable mirrorlist to stop dnf from redirecting to the latest minor version - Point baseurl to the Rocky vault where old minor versions are permanently hosted - Replace $releasever with the actual VERSION_ID from /etc/os-release to pin to the exact minor version - Clear dnf cache to force metadata refresh from the new vault URLs All of these were added in kt/data/cloud-init.yaml that is the base for all vms. When kt vm is run the first time for a kernel workspace, a copy of cloud-init.yaml is created. Use ruamel instead so that comments and the original formatting stays the same when the yaml file is read and then dump in python. Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>
roxanan1996
force-pushed
the
{rnicolescu}_kt_vm_pin
branch
from
85c4624 to
0879576
Compare
Comment on lines
+44
to
+46
| - find /etc/yum.repos.d/ -iname "*.repo" -exec sed -i 's|^mirrorlist=|#mirrorlist=|g' {} \; | ||
| - find /etc/yum.repos.d/ -iname "*.repo" -exec sed -i 's|^#baseurl=http://dl.rockylinux.org/$contentdir|baseurl=https://dl.rockylinux.org/vault/rocky|g' {} \; | ||
| - find /etc/yum.repos.d/ -iname "*.repo" -exec sed -i "s|\$releasever|$(. /etc/os-release && echo $VERSION_ID)|g" {} \; |
roxanan1996
force-pushed
the
{rnicolescu}_kt_vm_pin
branch
from
0879576 to
a8edde3
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A.
Without this, dnf resolves packages from the latest minor release instead of the one the image was built with.
B. While testing found that lts8.6 does not install the kernel dependency.
Now that we're using maching basic images, there is a discrepancy
for rocky 8.6 images:
ROCKY_SUPPORT_PRODUCT='Rocky Linux'.
Since ROCKY_SUPPORT_PRODUCT is not the same for all versions, use VERSION_ID
instead.
Testing
NOTE
I used ruaml instead of oyaml because it added extra chars when dumping the cloud-init.yaml file adapted for each kernel_workspace and user. But that broke lts8.6 because of the array format. That's why I changed
kt/data/cloud-init.yaml arrays so they are backwards compatible. For some reason, oyaml would modify that during dump, hence there was no issue there.