remove ocistorage (#1297)

Author: YasenT

.alcove/agents/planner-v2.yml

@@ -31,7 +31,7 @@ prompt: |
     pulp-worker (Celery/Redis)
   - Auth: X-RH-IDENTITY header → custom auth classes in app/authentication.py
   - Multi-tenancy: DomainOrg model maps org_id → Pulp domain
-  - Storage: S3Boto3Storage (pulpcore built-in, with CloudFront patches), OCIStorage (OCI/ORAS)
+  - Storage: S3Boto3Storage (pulpcore built-in, with CloudFront patches)
   - Formatter: black --line-length 100
   - Test runner: pytest pulp_service/pulp_service/tests/functional/
 

.alcove/agents/pulp-developer/AGENT.md

@@ -92,11 +92,12 @@ Additional ContextVars in middleware.py:
 - `x_quay_auth_var` — for Quay authentication context
 - `x_task_diagnostics_var` — for task profiling diagnostics
 
-### Storage (app/storage.py)
-- `OCIStorage` (extends `BaseStorage`) — stores artifacts as OCI blobs in Quay.io via ORAS client
-- S3 via pulpcore's built-in `S3Boto3Storage` with CloudFront patches (no custom class in pulp-service)
+### Storage
+- S3 via pulpcore's built-in `S3Boto3Storage` with CloudFront patches
 - `CreateDomainView` clones storage settings from `template-domain-s3`
 
+> **Decommissioned:** The custom `OCIStorage` backend (ORAS/Quay.io) has been removed.
+
 ### Custom viewsets (app/viewsets.py)
 - `FeatureContentGuardViewSet` — subscription-feature content guards
 - `VulnerabilityReport` — RPM/Python/Gem/npm scanning via osv.dev
@@ -126,6 +127,6 @@ Additional ContextVars in middleware.py:
 - Tests: `pulp_service/pulp_service/tests/functional/`
 
 ### Runtime patches (critical awareness)
-18 patches applied at Docker build time to modify pulpcore and upstream plugins.
+11 patches applied at Docker build time to modify pulpcore and upstream plugins.
 Any change touching patched areas must verify patch compatibility.
-Patches cover: OCI storage, CloudFront, registry API routing, ClamAV, attestation.
+Patches cover: CloudFront, registry API routing, ClamAV, attestation.

.alcove/agents/reviewer-security.yml

@@ -33,7 +33,7 @@ prompt: |
   - **Multi-tenancy**: DomainOrg model maps org_id → Pulp domain. Each org's
     content is isolated via domain-based routing.
   - **Content guards**: Control access to content distribution endpoints.
-  - **Storage backends**: S3Boto3Storage (pulpcore built-in, with CloudFront patches) and OCIStorage (OCI/ORAS)
+  - **Storage backends**: S3Boto3Storage (pulpcore built-in, with CloudFront patches)
     handle artifact storage with pre-signed URLs.
   - **Workers**: Celery tasks run background operations (scanning, metrics).
   - **Middleware**: ContextVar carries org_id, user_id across request layers.

.alcove/agents/triage.yml

@@ -31,7 +31,7 @@ prompt: |
   pulp-service extends Pulpcore with Red Hat cloud-specific features:
   - Multi-tenant authentication via X-RH-IDENTITY header
   - Domain-based org isolation (DomainOrg model)
-  - Custom S3/OCI storage backends
+  - Custom S3 storage (via pulpcore's S3Boto3Storage with CloudFront patches)
   - Content guards, vulnerability reporting, OpenTelemetry observability
   - Three-service architecture: pulp-api, pulp-content, pulp-worker
 

.alcove/agents/upgrade-deps/AGENT.md

@@ -73,7 +73,7 @@ When the workflow finishes, `/workspace/pulp-service` has all changes applied in
 
 ```bash
 export PATH="$HOME/.swamp/bin:$PATH"
-for pkg in pulpcore pulp-container pulp-python pulp-rpm pulp-maven pulp-file pulp-npm oras django-storages; do
+for pkg in pulpcore pulp-container pulp-python pulp-rpm pulp-maven pulp-file pulp-npm django-storages; do
   swamp data get --workflow "pulp-upgrade-check" "result-${pkg}" 2>/dev/null | grep -E '"status":\s*"(conflicts|regen_verify_failed|failed)"' && echo "^^^ $pkg has unresolved patches"
 done
 ```
@@ -94,7 +94,7 @@ First, uninstall all packages that have patches applied to them:
 curl -s -X POST http://$DEV_CONTAINER_HOST/exec \
   -H "Authorization: Bearer $DEV_TOKEN" \
   -H "Content-Type: application/json" \
-  -d '{"cmd": "pip uninstall -y pulpcore pulp-python pulp-container pulp-rpm pulp-maven pulp-file pulp-npm django-storages oras", "timeout": 120}'
+  -d '{"cmd": "pip uninstall -y pulpcore pulp-python pulp-container pulp-rpm pulp-maven pulp-file pulp-npm django-storages", "timeout": 120}'
 ```
 
 IMPORTANT: `pip uninstall` only removes files that pip installed. Files CREATED by patches (new files, not modifications) survive the uninstall. You MUST delete these manually before reinstalling.

CHANGES/decommission-ocistorage.removal

@@ -0,0 +1 @@
+Decommissioned the custom OCI storage backend (`OCIStorage`). Removed the `storage.py` module, `oras` dependency, and Docker build patches 0010, 0011, and 0028. Production deployments use S3 via pulpcore's built-in `S3Boto3Storage`.

CLAUDE.md

@@ -4,14 +4,14 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## Project Overview
 
-pulp-service is a **Django REST Framework plugin for Pulpcore** that extends the Pulp content management platform with Red Hat cloud-specific features: multi-tenant authentication (X-RH-IDENTITY), custom S3/OCI storage backends, domain-based org isolation, content guards, vulnerability reporting, and OpenTelemetry observability.
+pulp-service is a **Django REST Framework plugin for Pulpcore** that extends the Pulp content management platform with Red Hat cloud-specific features: multi-tenant authentication (X-RH-IDENTITY), S3 storage (via pulpcore's built-in backend with CloudFront patches), domain-based org isolation, content guards, vulnerability reporting, and OpenTelemetry observability.
 
 The plugin is registered via the `pulpcore.plugin` entry point in `pulp_service/setup.py`.
 
 ## Repository Layout
 
 - `pulp_service/` — The Python package (all source code lives here)
-  - `pulp_service/app/` — Core Django app: models, viewsets, serializers, middleware, auth, storage, tasks
+  - `pulp_service/app/` — Core Django app: models, viewsets, serializers, middleware, auth, tasks
   - `pulp_service/tests/functional/` — Functional tests (pytest + pytest-django)
   - `setup.py`, `requirements.txt` — Package definition and dependencies
 - `images/` — Container build assets (startup scripts for pulp-api, pulp-content, pulp-worker; WSGI middleware)
@@ -66,7 +66,7 @@ WSGI middleware (`images/assets/log_middleware.py`) → Django middleware stack
 - **Authentication**: `X-RH-IDENTITY` header (base64-encoded JSON) → custom auth classes in `app/authentication.py`
 - **Multi-tenancy**: `DomainOrg` model maps org_id → Pulp domain; domain-based routing for content APIs
 - **Context variables**: `ContextVar` instances in `app/middleware.py` carry request-scoped data (org_id, user_id, request_path) across layers
-- **Storage backends**: `AIPCCStorageBackend` (S3) and `OCIStorageBackend` (OCI/ORAS) in `app/storage.py`
+- **Storage**: S3 via pulpcore's built-in `S3Boto3Storage` with CloudFront patches; domain creation clones settings from `template-domain-s3`
 - **Tasks**: Background work in `app/tasks/` (package scanning, domain metrics, RDS testing)
 
 **Upstream plugins this extends**: pulpcore, pulp-python, pulp-container, pulp-rpm, pulp-npm, pulp-maven, pulp-hugging-face.
@@ -80,7 +80,7 @@ Uses **towncrier**. For any non-trivial change, create a file in `CHANGES/` name
 - **Ruff** formatter and linter, line length 120, targeting py311
 - 23 lint rule categories as "harness sensors" for agentic development (including security via flake8-bandit)
 - Complexity thresholds: max-complexity=10, max-branches=10, max-args=6, max-statements=40
-- Per-file exceptions: viewsets.py and rds_connection_tests.py (complexity rules), storage.py (hardcoded temp paths), tests (argument count, print, unused args, security), migrations (excluded entirely)
+- Per-file exceptions: viewsets.py and rds_connection_tests.py (complexity rules), tests (argument count, print, unused args, security), migrations (excluded entirely)
 
 ## Code Gotchas
 

Dockerfile

@@ -113,22 +113,12 @@ RUN ln -s /usr/local/lib/pulp/bin/pulpcore-manager /usr/local/bin/pulpcore-manag
 RUN chmod 2775 /var/lib/pulp/{scripts,media,tmp,assets}
 RUN chown :root /var/lib/pulp/{scripts,media,tmp,assets}
 
-COPY images/assets/patches/0010-Added-ability-to-return-a-URL-for-a-blob.patch /tmp/
-RUN patch -p1 -d /usr/local/lib/pulp/lib/python${PYTHON_VERSION}/site-packages < /tmp/0010-Added-ability-to-return-a-URL-for-a-blob.patch
-
-COPY images/assets/patches/0011-ocistorage-backend-changes.patch /tmp/
-RUN patch -p1 -d /usr/local/lib/pulp/lib/python${PYTHON_VERSION}/site-packages < /tmp/0011-ocistorage-backend-changes.patch
-
 COPY images/assets/patches/0018-Re-root-the-registry-API-at-api-pulp-v2.patch /tmp/
 RUN patch -p1 -d /usr/local/lib/pulp/lib/python${PYTHON_VERSION}/site-packages < /tmp/0018-Re-root-the-registry-API-at-api-pulp-v2.patch
 
 COPY images/assets/patches/0022-Adds-authentication-to-the-mvn-deploy-api.patch /tmp/
 RUN patch -p1 -d /usr/local/lib/pulp/lib/python${PYTHON_VERSION}/site-packages < /tmp/0022-Adds-authentication-to-the-mvn-deploy-api.patch
 
-COPY images/assets/patches/0028-OCIStorage-create-manifest.patch /tmp/
-RUN patch -p1 -d /usr/local/lib/pulp/lib/python${PYTHON_VERSION}/site-packages < /tmp/0028-OCIStorage-create-manifest.patch
-
-
 COPY images/assets/patches/0031-Replace-ResponseContentDisposition-in-cloudfront.patch /tmp/
 RUN patch -p1 -d /usr/local/lib/pulp/lib/python${PYTHON_VERSION}/site-packages < /tmp/0031-Replace-ResponseContentDisposition-in-cloudfront.patch
 

docs/ARCHITECTURE.md

@@ -31,7 +31,6 @@ This index helps you quickly locate code for common development tasks.
 | **Authentication** | `pulp_service/pulp_service/app/authentication.py` | Custom auth backends (X.509, SAML) |
 | **Authorization** | `pulp_service/pulp_service/app/authorization.py` | Permission and access control logic |
 | **Middleware** | `pulp_service/pulp_service/app/middleware.py` | Django middleware (profiling, headers, metrics) |
-| **Storage** | `pulp_service/pulp_service/app/storage.py` | Custom S3 storage backends |
 | **Signals** | `pulp_service/pulp_service/app/signals.py` | Django signal handlers |
 | **Tasks** | `pulp_service/pulp_service/app/tasks/` | Celery background tasks |
 | **Content Server** | `pulp_service/pulp_service/app/content.py` | aiohttp middleware for pulp-content |
@@ -235,12 +234,11 @@ The `X-RH-IDENTITY` header contains base64-encoded JSON:
 
 ## Storage Backend
 
-Custom S3 storage implementation in `pulp_service/pulp_service/app/storage.py`:
-*Plugin-specific - extends Django's S3Boto3Storage beyond upstream Pulpcore*
+Production deployments use pulpcore's built-in `S3Boto3Storage` with CloudFront patches applied at image build time (patch 0031). Domain creation and migration APIs clone storage settings from the `template-domain-s3` domain so callers never provide S3 credentials directly.
 
-- **AIPCCStorageBackend** - Extends Django's S3Boto3Storage
-- **OCIStorageBackend** - OCI-specific storage with manifest handling
-- Supports multipart uploads and custom metadata
+### Decommissioned: OCI Storage
+
+The custom `OCIStorage` backend (artifacts stored as OCI blobs in Quay.io via the ORAS client) has been **decommissioned**. It was previously implemented in `pulp_service/pulp_service/app/storage.py` with supporting Docker build patches (0010, 0011, 0028) and the `oras` Python dependency. All OCI storage support has been removed from pulp-service; existing domains must use S3 storage. The separate `oci-storage-backup-setup` repository is unaffected and remains available for backup-related workflows.
 
 ## Database Models
 
@@ -325,7 +323,7 @@ Background tasks using Celery (in `pulp_service/pulp_service/app/tasks/`):
 - ⬆️ `PULP_DB_ENCRYPTION_KEY=/etc/pulp/keys/database_fields.symmetric.key` - DB field encryption
 - ⬆️ `PULP_CACHE_ENABLED=true` - Enable Redis caching
 - ⬆️ `PULP_REDIS_PORT=6379` - Redis port
-- ⬆️ `PULP_STORAGES__default__BACKEND` - Storage backend class (🔧 set to plugin AIPCCStorageBackend)
+- ⬆️ `PULP_STORAGES__default__BACKEND` - Storage backend class (S3Boto3Storage)
 - ⬆️ `PULP_STORAGES__default__OPTIONS__default_acl` - S3 ACL setting
 - ⬆️ `PULP_STORAGES__default__OPTIONS__signature_version=s3v4` - S3 signature version
 - ⬆️ `PULP_STORAGES__default__OPTIONS__addressing_style=path` - S3 addressing style
@@ -678,7 +676,6 @@ This service is a Django plugin built on top of Pulp (Python-based repository ma
 - Extends core models with plugin-specific models (RHCertGuardPermission, PushRepository, RHServiceAccount)
 - Overrides authentication backends (RHServiceAccountCertAuthentication, RHSamlAuthentication)
 - Adds custom middleware (ProfilerMiddleware, RhEdgeHostMiddleware, ActiveConnectionsMetricMiddleware)
-- Extends storage backends (AIPCCStorageBackend, OCIStorageBackend)
 - Adds custom viewsets for Red Hat-specific functionality
 - Implements multi-domain support for tenant isolation
 
@@ -714,7 +711,6 @@ This service is a Django plugin built on top of Pulp (Python-based repository ma
 - Tag management
 
 **Plugin Integration:**
-- Custom storage backend (OCIStorageBackend) with manifest handling
 - Token authentication disabled (PULP_TOKEN_AUTH_DISABLED=true)
 - Certificate-based access control (RHCertGuardPermission)
 - Multi-tenant container registries with domain isolation