15 changed files with 317 additions and 81 deletions
@ -0,0 +1,37 @@ |
|||
FROM quay.io/redhat-et/rhel-bootc-tegra:base |
|||
|
|||
ARG ADMIN_USERNAME=demo \ |
|||
ADMIN_PASSWORD=redhat \ |
|||
ENABLE_DNF_CACHE=1 \ |
|||
LOCAL_RPM_REPO=0 |
|||
|
|||
RUN <<EOF |
|||
set -Eeuo pipefail |
|||
|
|||
if [[ "$ENABLE_DNF_CACHE" == "1" ]] && ! grep -qxF 'keepcache=1' /etc/dnf/dnf.conf; then |
|||
echo "Enabling dnf cache..." |
|||
sed -i.bak '/^\[main\]$/a keepcache=1' /etc/dnf/dnf.conf |
|||
fi |
|||
|
|||
if [[ "$LOCAL_RPM_REPO" == "1" ]]; then |
|||
echo "Disabling Subscription Manager because we have no internet connection and no satelite..." |
|||
echo -e "[main]\nenabled=0" > /etc/dnf/plugins/subscription-manager.conf |
|||
fi |
|||
|
|||
if [[ "$LOCAL_RPM_REPO" != "1" ]]; then |
|||
#dnf config-manager --enable codeready-builder-for-rhel-9-$(arch)-rpms |
|||
dnf install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm |
|||
fi |
|||
|
|||
dnf install -y mkpasswd NetworkManager-wifi podman skopeo git |
|||
|
|||
if [ -n "$ADMIN_USERNAME" ]; then |
|||
useradd -m -G wheel -p "$(echo -n "$ADMIN_PASSWORD" | mkpasswd -m bcrypt --stdin)" "$ADMIN_USERNAME" |
|||
fi |
|||
EOF |
|||
|
|||
ADD --chown=root:root root / |
|||
|
|||
RUN set -Eeuo pipefail ; \ |
|||
systemctl enable nvidia-ctk-init.service ; \ |
|||
systemctl enable git-repo.service |
|||
@ -1,55 +0,0 @@ |
|||
FROM registry.redhat.io/rhel9/rhel-bootc:9.4 |
|||
|
|||
ARG ADMIN_USERNAME=demo \ |
|||
ADMIN_PASSWORD=redhat \ |
|||
NVIDIA_KERNEL_VERSION=5.14.0-427.22.1.el9_4 \ |
|||
ENABLE_DNF_CACHE=1 \ |
|||
LOCAL_RPM_REPO=0 |
|||
|
|||
RUN <<EOF |
|||
set -Eeuo pipefail |
|||
|
|||
if [[ "$ENABLE_DNF_CACHE" == "1" ]] && ! grep -qxF 'keepcache=1' /etc/dnf/dnf.conf; then |
|||
echo "Disabling dnf cache..." |
|||
sed -i.bak '/^\[main\]$/a keepcache=1' /etc/dnf/dnf.conf |
|||
fi |
|||
|
|||
if [[ "$LOCAL_RPM_REPO" == "1" ]]; then |
|||
echo "Disabling Subscription Manager because we have no internet connection and no satelite..." |
|||
echo -e "[main]\nenabled=0" > /etc/dnf/plugins/subscription-manager.conf |
|||
fi |
|||
|
|||
if [ -n "$NVIDIA_KERNEL_VERSION" ]; then |
|||
echo "Replacing current kernel with a version compatible with the kernel modules shipped by Nvidia" |
|||
mkdir -p /tmp/rpms |
|||
dnf download -y --destdir /tmp/rpms kernel{,-core,-modules,-modules-core}-$NVIDIA_KERNEL_VERSION |
|||
rpm-ostree override replace /tmp/rpms/*.rpm |
|||
rm -rf /tmp/rpms |
|||
fi |
|||
|
|||
if [[ "$LOCAL_RPM_REPO" != "1" ]]; then |
|||
dnf config-manager --enable codeready-builder-for-rhel-9-$(arch)-rpms |
|||
dnf install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm |
|||
fi |
|||
|
|||
dnf install -y mkpasswd NetworkManager-wifi podman skopeo git |
|||
if [[ "$(arch)" == "aarch64" ]]; then |
|||
echo "Installing the Nvidia stuff..." ; \ |
|||
if [[ "$LOCAL_RPM_REPO" != "1" ]]; then |
|||
curl -sSfL -o /etc/yum.repos.d/nvidia-l4t.repo https://repo.download.nvidia.com/jetson/rhel-9.4/r36.3.1/nvidia-l4t.repo |
|||
curl -sSfL -o /etc/yum.repos.d/nvidia-container-toolkit.repo https://nvidia.github.io/libnvidia-container/stable/rpm/nvidia-container-toolkit.repo |
|||
dnf config-manager --enable nvidia-container-toolkit-experimental |
|||
fi |
|||
dnf install -y nvidia-jetpack-kmod nvidia-jetpack-all nvidia-container-toolkit-base |
|||
fi |
|||
|
|||
if [ -n "$ADMIN_USERNAME" ]; then |
|||
useradd -m -G wheel -p "$(echo -n "$ADMIN_PASSWORD" | mkpasswd -m bcrypt --stdin)" "$ADMIN_USERNAME" |
|||
fi |
|||
EOF |
|||
|
|||
ADD --chown=root:root root / |
|||
|
|||
RUN set -Eeuo pipefail ; \ |
|||
systemctl enable nvidia-ctk-init.service ; \ |
|||
systemctl enable git-repo.service |
|||
@ -0,0 +1,172 @@ |
|||
apiVersion: v1 |
|||
kind: PersistentVolumeClaim |
|||
metadata: |
|||
name: mosquitto-data |
|||
spec: |
|||
accessModes: |
|||
- ReadWriteOnce |
|||
resources: |
|||
requests: |
|||
storage: 1Gi |
|||
volumeMode: Filesystem |
|||
--- |
|||
apiVersion: apps/v1 |
|||
kind: StatefulSet |
|||
metadata: |
|||
name: mosquitto |
|||
spec: |
|||
replicas: 1 |
|||
serviceName: mosquitto |
|||
selector: |
|||
matchLabels: |
|||
name: mosquitto |
|||
template: |
|||
metadata: |
|||
labels: |
|||
name: mosquitto |
|||
spec: |
|||
containers: |
|||
- name: mosquitto |
|||
image: docker.io/library/eclipse-mosquitto:latest |
|||
imagePullPolicy: IfNotPresent |
|||
ports: |
|||
- containerPort: 8883 |
|||
livenessProbe: |
|||
tcpSocket: |
|||
port: 1883 |
|||
failureThreshold: 1 |
|||
initialDelaySeconds: 5 |
|||
periodSeconds: 30 |
|||
successThreshold: 1 |
|||
timeoutSeconds: 5 |
|||
readinessProbe: |
|||
exec: |
|||
command: |
|||
- mosquitto_pub |
|||
- -t |
|||
- _ping |
|||
- -m |
|||
- ping |
|||
failureThreshold: 1 |
|||
initialDelaySeconds: 5 |
|||
periodSeconds: 30 |
|||
successThreshold: 1 |
|||
timeoutSeconds: 5 |
|||
volumeMounts: |
|||
- name: data |
|||
mountPath: /mosquitto/data |
|||
subPath: data |
|||
- name: data |
|||
mountPath: /mosquitto/log |
|||
subPath: log |
|||
- name: config |
|||
mountPath: /mosquitto/config |
|||
- name: tls |
|||
mountPath: /mosquitto/tls |
|||
readOnly: true |
|||
- name: ca |
|||
mountPath: /mosquitto/ca |
|||
readOnly: true |
|||
- name: mosquitto-subscriber |
|||
image: docker.io/library/eclipse-mosquitto:latest |
|||
imagePullPolicy: IfNotPresent |
|||
command: |
|||
- mosquitto_sub |
|||
args: |
|||
- -v |
|||
- -t |
|||
- '#' |
|||
volumeMounts: |
|||
- name: tls |
|||
mountPath: /mosquitto/tls |
|||
readOnly: true |
|||
- name: ca |
|||
mountPath: /mosquitto/ca |
|||
readOnly: true |
|||
terminationGracePeriodSeconds: 30 |
|||
volumes: |
|||
- name: data |
|||
persistentVolumeClaim: |
|||
claimName: mosquitto-data |
|||
- name: config |
|||
configMap: |
|||
name: mosquitto-config |
|||
defaultMode: 0640 |
|||
- name: ca |
|||
configMap: |
|||
name: openshift-service-ca.crt |
|||
- name: tls |
|||
secret: |
|||
secretName: mosquitto-tls |
|||
--- |
|||
apiVersion: v1 |
|||
kind: Service |
|||
metadata: |
|||
name: mosquitto |
|||
annotations: |
|||
service.beta.openshift.io/serving-cert-secret-name: mosquitto-tls |
|||
spec: |
|||
type: ClusterIP |
|||
ipFamilies: |
|||
- IPv4 |
|||
ipFamilyPolicy: SingleStack |
|||
ports: |
|||
- name: mqtt |
|||
port: 1883 |
|||
protocol: TCP |
|||
targetPort: 1883 |
|||
- name: tls |
|||
port: 8883 |
|||
protocol: TCP |
|||
targetPort: 8883 |
|||
selector: |
|||
name: mosquitto |
|||
sessionAffinity: None |
|||
--- |
|||
apiVersion: v1 |
|||
kind: ConfigMap |
|||
metadata: |
|||
name: mosquitto-config |
|||
data: |
|||
mosquitto.conf: | |
|||
autosave_interval 60 |
|||
persistence true |
|||
persistence_file mosquitto.db |
|||
persistence_location /mosquitto/data |
|||
allow_anonymous true |
|||
password_file /mosquitto/config/pwfile |
|||
acl_file /mosquitto/config/aclfile |
|||
listener 1883 0.0.0.0 |
|||
protocol mqtt |
|||
listener 8883 0.0.0.0 |
|||
protocol mqtt |
|||
cafile /mosquitto/ca/service-ca.crt |
|||
certfile /mosquitto/tls/tls.crt |
|||
keyfile /mosquitto/tls/tls.key |
|||
aclfile: | |
|||
# This affects access control for clients with no username. |
|||
topic read $SYS/# |
|||
# Allow anonymous users to read all updates. |
|||
topic read # |
|||
# Allow the tekton user to write updates. |
|||
user tekton |
|||
topic readwrite # |
|||
# This affects all clients. |
|||
pattern write /broker/connection/%c/state |
|||
# pwfile is generated using "mosquitto_passwd -c /tmp/pwfile $username" |
|||
pwfile: | |
|||
tekton:REDACTED |
|||
--- |
|||
apiVersion: route.openshift.io/v1 |
|||
kind: Route |
|||
metadata: |
|||
name: mosquitto |
|||
spec: |
|||
to: |
|||
kind: Service |
|||
name: mosquitto |
|||
port: |
|||
targetPort: 8883 |
|||
tls: |
|||
termination: passthrough |
|||
insecureEdgeTerminationPolicy: None |
|||
@ -0,0 +1,24 @@ |
|||
apiVersion: tekton.dev/v1beta1 |
|||
kind: Task |
|||
metadata: |
|||
name: ota-update |
|||
spec: |
|||
params: |
|||
- name: otaVersion |
|||
type: string |
|||
steps: |
|||
- name: ota-update |
|||
image: docker.io/library/eclipse-mosquitto:latest |
|||
env: |
|||
- name: OTA_MQTT_URL |
|||
valueFrom: |
|||
secretKeyRef: |
|||
name: "mqtt-config" |
|||
key: "OTA_MQTT_URL" |
|||
- name: OTA_VERSION |
|||
value: "$(params.otaVersion)" |
|||
script: | |
|||
#!/bin/bash |
|||
set -Eeuo pipefail |
|||
echo "Sending the OTA firmware udate notification for version $OTA_VERSION on $OTA_MQTT_TOPIC..." |
|||
mosquitto_pub -L "$OTA_MQTT_URL" -m "$OTA_VERSION" -d |
|||
Loading…
Reference in new issue