Bertrand d'Hérouville
2 years ago
committed by
GitHub
GitHub
19 changed files with 1108 additions and 25 deletions
@ -0,0 +1 @@ |
|||||
|
.vscode |
||||
@ -0,0 +1,2 @@ |
|||||
|
inventory.yaml |
||||
|
vault.yaml |
||||
@ -0,0 +1,55 @@ |
|||||
|
# Installation on RHEL 9 Automatisation |
||||
|
|
||||
|
Ansible Playbook allowing to create ostree images for edge using Ansible. |
||||
|
|
||||
|
## Pre-requisites |
||||
|
|
||||
|
RHEL 9 pre-requisites : |
||||
|
|
||||
|
- RHEL 9 is installed |
||||
|
- The Red Hat repositories **baseos** and **appstream** are reachable |
||||
|
|
||||
|
Microshift pre-requisites : |
||||
|
|
||||
|
- RHEL 9.2 or 9.3 |
||||
|
- LVM volume group (VG) with unused space |
||||
|
|
||||
|
## Pre-requisites on the target machine |
||||
|
|
||||
|
```sh |
||||
|
sudo subscription-manager register --username $RHN_LOGIN --auto-attach |
||||
|
sudo subscription-manager attach --pool=$RHN_POOL_ID |
||||
|
``` |
||||
|
|
||||
|
## Ansible Config |
||||
|
|
||||
|
Create a `inventory.yaml` file inside the ansible folder or define the inventory path inside the `ansible.cfg` file |
||||
|
|
||||
|
Update `config.yaml` in `ansible/group_vars/all/` to match your environment. |
||||
|
|
||||
|
Create an ansible vault named `vault.yaml` in `ansible/group_vars/all/` with the following content. |
||||
|
|
||||
|
```yaml |
||||
|
blueprint_admin_password_hash: # Generate one with "mkpasswd -m bcrypt" |
||||
|
blueprint_kiosk_password_hash: # Generate one with "mkpasswd -m bcrypt" |
||||
|
kickstart_microshift_pull_secret: # Generate one on https://console.redhat.com/openshift/install/pull-secret |
||||
|
``` |
||||
|
|
||||
|
Install the required collections. |
||||
|
|
||||
|
```sh |
||||
|
ansible-galaxy collection install -r requirements.yaml |
||||
|
``` |
||||
|
|
||||
|
## Prepare the target machine |
||||
|
|
||||
|
```sh |
||||
|
ansible-playbook prerequisites.yaml |
||||
|
ansible-playbook bootstrap-ostree.yaml |
||||
|
``` |
||||
|
|
||||
|
## Regular builds |
||||
|
|
||||
|
```sh |
||||
|
ansible-playbook build.yaml |
||||
|
``` |
||||
@ -0,0 +1,6 @@ |
|||||
|
[defaults] |
||||
|
# Use the provided inventory |
||||
|
inventory = inventory.yaml |
||||
|
|
||||
|
# Use a forked copy of the infra.osbuild plugins |
||||
|
library = plugins/modules |
||||
@ -0,0 +1,77 @@ |
|||||
|
- name: Create the initial ostree repo |
||||
|
hosts: all |
||||
|
become: false |
||||
|
tasks: |
||||
|
- name: Read blueprint |
||||
|
register: results |
||||
|
args: |
||||
|
executable: /usr/bin/python3 |
||||
|
stdin: "{{ lookup('ansible.builtin.file', playbook_dir ~ '/files/minimal.toml') }}" |
||||
|
shell: | |
||||
|
import toml |
||||
|
import json |
||||
|
import sys |
||||
|
str=sys.stdin.read() |
||||
|
obj=toml.loads(str) |
||||
|
print(json.dumps(obj)) |
||||
|
delegate_to: localhost |
||||
|
become: false |
||||
|
changed_when: false |
||||
|
|
||||
|
- set_fact: |
||||
|
blueprint_name: '{{ blueprint_object.name }}' |
||||
|
vars: |
||||
|
blueprint_object: '{{ results.stdout | from_json }}' |
||||
|
|
||||
|
- name: Push blueprint |
||||
|
infra.osbuild.push_blueprint: |
||||
|
blueprint: "{{ lookup('ansible.builtin.file', playbook_dir ~ '/files/minimal.toml') }}" |
||||
|
|
||||
|
- name: Start ostree compose |
||||
|
infra.osbuild.start_compose: |
||||
|
blueprint: "{{ blueprint_name }}" |
||||
|
allow_duplicate: true |
||||
|
compose_type: edge-commit |
||||
|
timeout: "{{ compose_timeout }}" |
||||
|
register: builder_compose_start_out |
||||
|
|
||||
|
- ansible.builtin.set_fact: |
||||
|
compose_id: "{{ builder_compose_start_out['result']['body']['build_id'] }}" |
||||
|
|
||||
|
- name: Wait for compose to finish |
||||
|
infra.osbuild.wait_compose: |
||||
|
compose_id: "{{ compose_id }}" |
||||
|
timeout: 3600 |
||||
|
|
||||
|
- ansible.builtin.tempfile: |
||||
|
state: directory |
||||
|
suffix: build |
||||
|
register: tmp |
||||
|
|
||||
|
- name: Export the compose artifact |
||||
|
infra.osbuild.export_compose: # noqa only-builtins |
||||
|
compose_id: "{{ compose_id }}" |
||||
|
dest: "{{ tmp.path }}/{{ compose_id }}.tar" |
||||
|
|
||||
|
- name: Clear directory /var/www/repo |
||||
|
ansible.builtin.file: |
||||
|
path: "{{ www_location }}/repo" |
||||
|
state: absent |
||||
|
|
||||
|
- name: Extract compose artifact into /var/www/repo |
||||
|
ansible.builtin.unarchive: |
||||
|
src: "{{ tmp.path }}/{{ compose_id }}.tar" |
||||
|
dest: "{{ www_location }}" |
||||
|
remote_src: true |
||||
|
become: true |
||||
|
|
||||
|
- name: Create an empty tree |
||||
|
ansible.builtin.file: |
||||
|
path: "{{ tmp.path }}/empty-tree" |
||||
|
mode: '0755' |
||||
|
state: directory |
||||
|
become: true |
||||
|
|
||||
|
- name: Create an empty commit |
||||
|
ansible.builtin.shell: "ostree --repo={{ www_location }}/repo commit -b 'empty' --tree=dir={{ tmp.path }}/empty-tree" |
||||
|
become: true |
||||
@ -0,0 +1,270 @@ |
|||||
|
- name: Build the Kiosk images |
||||
|
hosts: all |
||||
|
become: false |
||||
|
tasks: |
||||
|
- name: Checkout the git repo |
||||
|
ansible.builtin.git: |
||||
|
repo: 'https://github.com/nmasse-itix/red-hat-kiosk.git' |
||||
|
dest: "{{ ansible_user_dir }}/red-hat-kiosk" |
||||
|
update: yes |
||||
|
clone: yes |
||||
|
|
||||
|
- ansible.builtin.tempfile: |
||||
|
state: directory |
||||
|
suffix: -build |
||||
|
register: tmp |
||||
|
|
||||
|
## |
||||
|
## Cleanup |
||||
|
## |
||||
|
|
||||
|
- name: Get all images for removal |
||||
|
ansible.builtin.command: /usr/bin/composer-cli compose list |
||||
|
register: builder_output |
||||
|
changed_when: false |
||||
|
|
||||
|
- name: Remove each image by UUID |
||||
|
ansible.builtin.command: "/usr/bin/composer-cli compose delete {{ (item | split)[0] }}" |
||||
|
loop: "{{ builder_output.stdout_lines }}" |
||||
|
loop_control: |
||||
|
label: "{{ (item | split)[0] }}" |
||||
|
changed_when: true |
||||
|
when: (item | split)[0] != "ID" |
||||
|
|
||||
|
## |
||||
|
## RPM construction |
||||
|
## |
||||
|
|
||||
|
- debug: |
||||
|
msg: "Starting RPM build..." |
||||
|
|
||||
|
- name: Ensure ~/rpmbuild is a symbolic link |
||||
|
ansible.builtin.file: |
||||
|
src: "{{ ansible_user_dir }}/red-hat-kiosk/rpms" |
||||
|
dest: "{{ ansible_user_dir }}/rpmbuild" |
||||
|
state: link |
||||
|
|
||||
|
- name: Build the kiosk-config RPMS |
||||
|
ansible.builtin.shell: | |
||||
|
spectool -g -R {{ ansible_user_dir }}/rpmbuild/SPECS/kiosk-config.spec |
||||
|
rpmbuild -ba {{ ansible_user_dir }}/rpmbuild/SPECS/kiosk-config.spec |
||||
|
|
||||
|
- name: Build the microshift-manifests RPM |
||||
|
ansible.builtin.shell: | |
||||
|
spectool -g -R {{ ansible_user_dir }}/rpmbuild/SPECS/microshift-manifests.spec |
||||
|
rpmbuild -ba {{ ansible_user_dir }}/rpmbuild/SPECS/microshift-manifests.spec |
||||
|
|
||||
|
- name: Ensure the VENDOR directory exists |
||||
|
ansible.builtin.file: |
||||
|
path: "{{ ansible_user_dir }}/rpmbuild/VENDOR" |
||||
|
state: directory |
||||
|
mode: '0755' |
||||
|
|
||||
|
- name: Download Google Chrome RPM |
||||
|
ansible.builtin.get_url: |
||||
|
url: https://dl.google.com/linux/direct/google-chrome-stable_current_x86_64.rpm |
||||
|
dest: "{{ ansible_user_dir }}/rpmbuild/VENDOR/google-chrome-stable_current_x86_64.rpm" |
||||
|
|
||||
|
- name: Rebuild the Google Chrome RPM |
||||
|
ansible.builtin.shell: | |
||||
|
set -Eeuo pipefail |
||||
|
rpmrebuild -s {{ ansible_user_dir }}/rpmbuild/SPECS/google-chrome-stable.spec -p {{ ansible_user_dir }}/rpmbuild/VENDOR/google-chrome-stable_current_x86_64.rpm |
||||
|
RPM=$(rpm -q {{ ansible_user_dir }}/rpmbuild/VENDOR/google-chrome-stable_current_x86_64.rpm) |
||||
|
mkdir -p {{ ansible_user_dir }}/rpmbuild/BUILDROOT/$RPM/ |
||||
|
rpm2cpio {{ ansible_user_dir }}/rpmbuild/VENDOR/google-chrome-stable_current_x86_64.rpm | cpio -idmv -D {{ ansible_user_dir }}/rpmbuild/BUILDROOT/$RPM/ |
||||
|
mv {{ ansible_user_dir }}/rpmbuild/BUILDROOT/$RPM/opt/google/ {{ ansible_user_dir }}/rpmbuild/BUILDROOT/$RPM/usr/bin/ |
||||
|
cd {{ ansible_user_dir }}/rpmbuild/BUILDROOT/$RPM/usr/bin/ |
||||
|
rm -f google-chrome-stable |
||||
|
ln -s google/chrome/google-chrome google-chrome-stable |
||||
|
ln -s google/chrome/google-chrome chrome |
||||
|
sed -i.${EPOCHREALTIME:-bak} 's|/opt/google|/usr/bin/google|g' {{ ansible_user_dir }}/rpmbuild/SPECS/google-chrome-stable.spec |
||||
|
rpmbuild -bb {{ ansible_user_dir }}/rpmbuild/SPECS/google-chrome-stable.spec |
||||
|
args: |
||||
|
executable: /bin/bash |
||||
|
register: rebuild_result |
||||
|
failed_when: rebuild_result.rc != 0 |
||||
|
|
||||
|
- name: Get built RPMS |
||||
|
ansible.builtin.find: |
||||
|
path: "{{ ansible_user_dir }}/rpmbuild/RPMS/x86_64/" |
||||
|
patterns: "*.rpm" |
||||
|
register: build_rpms |
||||
|
|
||||
|
- name: Extract filenames from paths of built RPMs |
||||
|
ansible.builtin.set_fact: |
||||
|
rpm_filenames: "{{ build_rpms.files | map(attribute='path') | list }}" |
||||
|
|
||||
|
- name: Copy RPMs to the repository location |
||||
|
ansible.builtin.copy: |
||||
|
src: '{{ item }}' |
||||
|
dest: "{{ repo_location }}" |
||||
|
owner: root |
||||
|
group: root |
||||
|
mode: '0644' |
||||
|
remote_src: yes |
||||
|
loop: '{{ rpm_filenames }}' |
||||
|
loop_control: |
||||
|
label: "{{ item | basename }}" |
||||
|
become: true |
||||
|
|
||||
|
- name: Update the repository with createrepo |
||||
|
become: true |
||||
|
ansible.builtin.command: |
||||
|
cmd: "createrepo {{ repo_location }}" |
||||
|
|
||||
|
- name: Clean dnf cache |
||||
|
become: true |
||||
|
ansible.builtin.command: |
||||
|
cmd: dnf clean all |
||||
|
|
||||
|
## |
||||
|
## Ostree construction |
||||
|
## |
||||
|
|
||||
|
- debug: |
||||
|
msg: "Starting ostree build..." |
||||
|
|
||||
|
- name: Parse blueprint |
||||
|
register: results |
||||
|
args: |
||||
|
executable: /usr/bin/python3 |
||||
|
stdin: "{{ lookup('ansible.builtin.template', 'kiosk.toml.j2') }}" |
||||
|
shell: | |
||||
|
import toml |
||||
|
import json |
||||
|
import sys |
||||
|
str=sys.stdin.read() |
||||
|
obj=toml.loads(str) |
||||
|
print(json.dumps(obj)) |
||||
|
become: false |
||||
|
changed_when: false |
||||
|
|
||||
|
- set_fact: |
||||
|
blueprint_name: '{{ blueprint_object.name }}' |
||||
|
vars: |
||||
|
blueprint_object: '{{ results.stdout | from_json }}' |
||||
|
|
||||
|
- name: Push Blueprint |
||||
|
infra.osbuild.push_blueprint: |
||||
|
blueprint: "{{ lookup('ansible.builtin.template', 'kiosk.toml.j2') }}" |
||||
|
|
||||
|
- name: Start ostree compose |
||||
|
start_compose2: |
||||
|
blueprint: "{{ blueprint_name }}" |
||||
|
allow_duplicate: true |
||||
|
compose_type: edge-commit |
||||
|
ostree_ref: "rhel/9/{{ ansible_facts['userspace_architecture'] }}/edge-kiosk" |
||||
|
ostree_parent: "rhel/9/{{ ansible_facts['userspace_architecture'] }}/edge" |
||||
|
ostree_url: http://{{ ansible_default_ipv4.address }}/repo |
||||
|
timeout: "{{ compose_timeout }}" |
||||
|
register: builder_compose_start_out |
||||
|
|
||||
|
- ansible.builtin.set_fact: |
||||
|
compose_id: "{{ builder_compose_start_out['result']['body']['build_id'] }}" |
||||
|
|
||||
|
- name: Wait for compose to finish |
||||
|
infra.osbuild.wait_compose: |
||||
|
compose_id: "{{ compose_id }}" |
||||
|
timeout: 3600 |
||||
|
|
||||
|
- name: Export the compose artifact |
||||
|
infra.osbuild.export_compose: # noqa only-builtins |
||||
|
compose_id: "{{ compose_id }}" |
||||
|
dest: "{{ tmp.path }}/{{ compose_id }}.tar" |
||||
|
|
||||
|
- name: Create commit directory |
||||
|
ansible.builtin.file: |
||||
|
path: "{{ tmp.path }}/{{ compose_id }}" |
||||
|
mode: '0755' |
||||
|
state: directory |
||||
|
|
||||
|
- name: Extract compose artifact |
||||
|
ansible.builtin.unarchive: |
||||
|
src: "{{ tmp.path }}/{{ compose_id }}.tar" |
||||
|
dest: "{{ tmp.path }}/{{ compose_id }}" |
||||
|
remote_src: true |
||||
|
|
||||
|
- name: Pull local ostree repository |
||||
|
ansible.builtin.shell: ostree --repo={{ www_location }}/repo pull-local "{{ tmp.path }}/{{ compose_id }}/repo" |
||||
|
become: true |
||||
|
|
||||
|
## |
||||
|
## ISO Construction |
||||
|
## |
||||
|
|
||||
|
- debug: |
||||
|
msg: "Starting ISO build..." |
||||
|
|
||||
|
- name: Read blueprint |
||||
|
register: results |
||||
|
args: |
||||
|
executable: /usr/bin/python3 |
||||
|
stdin: "{{ lookup('ansible.builtin.file', playbook_dir ~ '/files/edge-installer.toml') }}" |
||||
|
shell: | |
||||
|
import toml |
||||
|
import json |
||||
|
import sys |
||||
|
str=sys.stdin.read() |
||||
|
obj=toml.loads(str) |
||||
|
print(json.dumps(obj)) |
||||
|
delegate_to: localhost |
||||
|
become: false |
||||
|
changed_when: false |
||||
|
|
||||
|
- set_fact: |
||||
|
blueprint_name: '{{ blueprint_object.name }}' |
||||
|
vars: |
||||
|
blueprint_object: '{{ results.stdout | from_json }}' |
||||
|
|
||||
|
- name: Push blueprint |
||||
|
infra.osbuild.push_blueprint: |
||||
|
blueprint: "{{ lookup('ansible.builtin.file', playbook_dir ~ '/files/edge-installer.toml') }}" |
||||
|
|
||||
|
- name: Start ostree compose |
||||
|
start_compose2: |
||||
|
blueprint: "{{ blueprint_name }}" |
||||
|
allow_duplicate: true |
||||
|
compose_type: edge-installer |
||||
|
ostree_ref: empty |
||||
|
ostree_url: http://{{ ansible_default_ipv4.address }}/repo |
||||
|
timeout: "{{ compose_timeout }}" |
||||
|
register: builder_compose_start_out |
||||
|
|
||||
|
- ansible.builtin.set_fact: |
||||
|
compose_id: "{{ builder_compose_start_out['result']['body']['build_id'] }}" |
||||
|
|
||||
|
- name: Wait for compose to finish |
||||
|
infra.osbuild.wait_compose: |
||||
|
compose_id: "{{ compose_id }}" |
||||
|
timeout: 3600 |
||||
|
|
||||
|
- name: Export the compose artifact |
||||
|
infra.osbuild.export_compose: # noqa only-builtins |
||||
|
compose_id: "{{ compose_id }}" |
||||
|
dest: "{{ tmp.path }}/{{ compose_id }}.iso" |
||||
|
|
||||
|
- name: Create kiosk.ks from template |
||||
|
ansible.builtin.template: |
||||
|
src: "kiosk.ks.j2" |
||||
|
dest: "{{ tmp.path }}/kiosk.ks" |
||||
|
|
||||
|
- name: Validate kiosk.ks using ksvalidator |
||||
|
ansible.builtin.command: |
||||
|
cmd: "ksvalidator {{ tmp.path }}/kiosk.ks" |
||||
|
|
||||
|
- name: Create new kiosk.iso file |
||||
|
ansible.builtin.command: |
||||
|
cmd: "mkksiso -r 'inst.ks' --ks {{ tmp.path }}/kiosk.ks {{ tmp.path }}/{{ compose_id }}.iso {{ tmp.path }}/kiosk.iso" |
||||
|
|
||||
|
- name: Copy new ISO to /var/www |
||||
|
copy: |
||||
|
src: "{{ tmp.path }}/kiosk.iso" |
||||
|
dest: "{{ www_location }}/kiosk.iso" |
||||
|
remote_src: true |
||||
|
become: true |
||||
|
|
||||
|
post_tasks: |
||||
|
- ansible.builtin.file: |
||||
|
path: "{{ tmp.path }}.iso" |
||||
|
state: absent |
||||
|
when: tmp is defined |
||||
@ -0,0 +1,6 @@ |
|||||
|
name = "edge-installer" |
||||
|
description = "" |
||||
|
version = "0.0.0" |
||||
|
modules = [] |
||||
|
groups = [] |
||||
|
packages = [] |
||||
@ -0,0 +1,6 @@ |
|||||
|
name = "minimal-rhel9" |
||||
|
description = "minimal blueprint for ostree commit" |
||||
|
version = "1.1.0" |
||||
|
modules = [] |
||||
|
groups = [] |
||||
|
distro = "rhel-93" |
||||
@ -0,0 +1,5 @@ |
|||||
|
repo_location: /opt/custom-rpms |
||||
|
blueprint_admin_ssh_public_key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFW62WJXI1ZCMfNA4w0dMpL0fsldhbEfULNGIUB0nQui nmasse@localhost.localdomain |
||||
|
www_location: /var/www |
||||
|
compose_timeout: 300 |
||||
|
kickstart_root_disk: /dev/disk/by-path/pci-0000:00:12.0-ata-1 |
||||
@ -0,0 +1,5 @@ |
|||||
|
# README |
||||
|
|
||||
|
This is a modified version of the start_compose module from the repo https://github.com/redhat-cop/infra.osbuild, commit 6e3416233c84623b2edd503a4b50d15c61d6c155. |
||||
|
|
||||
|
The module has been patched to specify the ostree ref when starting a compose of type "ostree-commit". |
||||
@ -0,0 +1,339 @@ |
|||||
|
#!/usr/bin/python |
||||
|
# Copyright: Red Hat Inc. |
||||
|
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt) |
||||
|
|
||||
|
ANSIBLE_METADATA = { |
||||
|
"metadata_version": "1.1", |
||||
|
"status": ["preview"], |
||||
|
"supported_by": "community", |
||||
|
} |
||||
|
|
||||
|
DOCUMENTATION = """ |
||||
|
--- |
||||
|
module: start_compose2 |
||||
|
short_description: Start an ostree compose |
||||
|
description: |
||||
|
- Start an ostree compose |
||||
|
author: |
||||
|
- Adam Miller (@maxamillion) |
||||
|
- Chris Santiago (@resoluteCoder) |
||||
|
options: |
||||
|
blueprint: |
||||
|
description: |
||||
|
- Name of blueprint to iniate a build for |
||||
|
type: str |
||||
|
required: true |
||||
|
size: |
||||
|
description: |
||||
|
- Image size expressed in MiB |
||||
|
type: int |
||||
|
default: 0 |
||||
|
required: false |
||||
|
profile: |
||||
|
description: |
||||
|
- Path to profile toml file |
||||
|
type: str |
||||
|
default: "" |
||||
|
required: false |
||||
|
image_name: |
||||
|
description: |
||||
|
- Image name |
||||
|
type: str |
||||
|
default: "" |
||||
|
required: false |
||||
|
allow_duplicate: |
||||
|
description: |
||||
|
- Allow a duplicate version'd compose. |
||||
|
- (Default osbuild composer functionality is to allow duplicate composes) |
||||
|
type: bool |
||||
|
default: True |
||||
|
required: false |
||||
|
compose_type: |
||||
|
description: |
||||
|
- type of compose |
||||
|
type: str |
||||
|
default: "edge-commit" |
||||
|
required: false |
||||
|
choices: |
||||
|
- ami |
||||
|
- edge-commit |
||||
|
- edge-container |
||||
|
- edge-installer |
||||
|
- edge-raw-image |
||||
|
- edge-simplified-installer |
||||
|
- image-installer |
||||
|
- oci |
||||
|
- openstack |
||||
|
- qcow2 |
||||
|
- tar |
||||
|
- vhd |
||||
|
- vmdk |
||||
|
- iot-commit |
||||
|
- iot-container |
||||
|
- iot-installer |
||||
|
- iot-raw-image |
||||
|
- container |
||||
|
ostree_ref: |
||||
|
description: |
||||
|
- ostree ref |
||||
|
type: str |
||||
|
default: "" |
||||
|
required: false |
||||
|
ostree_parent: |
||||
|
description: |
||||
|
- ostree parent |
||||
|
type: str |
||||
|
default: "" |
||||
|
required: false |
||||
|
ostree_url: |
||||
|
description: |
||||
|
- ostree URL |
||||
|
type: str |
||||
|
default: "" |
||||
|
required: false |
||||
|
timeout: |
||||
|
description: |
||||
|
- timeout for osbuild-compose requests, in seconds |
||||
|
type: int |
||||
|
default: 120 |
||||
|
required: false |
||||
|
notes: |
||||
|
- THIS MODULE IS NOT IDEMPOTENT UNLESS C(allow_duplicate) is set to C(false) |
||||
|
- The params C(profile) and C(image_name) are required together. |
||||
|
- The C(profile) option is not fully implemented at this time. |
||||
|
""" |
||||
|
|
||||
|
EXAMPLES = """ |
||||
|
- name: Start ostree compose size 4096 |
||||
|
start_compose2: |
||||
|
blueprint: rhel-for-edge-demo |
||||
|
image_name: testimage |
||||
|
size: 4096 |
||||
|
|
||||
|
- name: Start ostree compose with idempotent transaction |
||||
|
start_compose2: |
||||
|
blueprint: rhel-for-edge-demo |
||||
|
allow_duplicate: false |
||||
|
""" |
||||
|
import json # noqa E402 |
||||
|
import socket |
||||
|
from typing import Any # noqa E402 |
||||
|
|
||||
|
from ansible.module_utils.basic import AnsibleModule # noqa E402 |
||||
|
from ansible_collections.infra.osbuild.plugins.module_utils.weldr import Weldr # noqa E402 |
||||
|
|
||||
|
argument_spec = dict( |
||||
|
blueprint=dict(type="str", required=True), |
||||
|
size=dict(type="int", required=False, default=0), |
||||
|
profile=dict(type="str", required=False, default=""), |
||||
|
image_name=dict(type="str", required=False, default=""), |
||||
|
allow_duplicate=dict(type="bool", required=False, default=True), |
||||
|
compose_type=dict( |
||||
|
type="str", |
||||
|
required=False, |
||||
|
default="edge-commit", |
||||
|
choices=[ |
||||
|
"ami", |
||||
|
"edge-commit", |
||||
|
"edge-container", |
||||
|
"edge-installer", |
||||
|
"edge-raw-image", |
||||
|
"edge-simplified-installer", |
||||
|
"image-installer", |
||||
|
"oci", |
||||
|
"openstack", |
||||
|
"qcow2", |
||||
|
"tar", |
||||
|
"vhd", |
||||
|
"vmdk", |
||||
|
"iot-commit", |
||||
|
"iot-container", |
||||
|
"iot-installer", |
||||
|
"iot-raw-image", |
||||
|
"container", |
||||
|
], |
||||
|
), |
||||
|
ostree_ref=dict(type="str", required=False, default=""), |
||||
|
ostree_parent=dict(type="str", required=False, default=""), |
||||
|
ostree_url=dict(type="str", required=False, default=""), |
||||
|
timeout=dict(type="int", required=False, default=120), |
||||
|
) |
||||
|
|
||||
|
|
||||
|
def start_compose(module, weldr): |
||||
|
changed: bool = False |
||||
|
dupe_compose: list = [] |
||||
|
blueprint_info: dict = weldr.api.get_blueprints_info(module.params["blueprint"]) |
||||
|
blueprint_version: int = blueprint_info["blueprints"][0]["version"] |
||||
|
|
||||
|
# Add check if compose_type is supported |
||||
|
supported_compose_type: dict = weldr.api.get_compose_types() |
||||
|
|
||||
|
is_supported: dict = next((item for item in supported_compose_type["types"] if item["name"] == module.params["compose_type"]), {}) |
||||
|
|
||||
|
if not is_supported: |
||||
|
module.fail_json( |
||||
|
msg="%s is not a valid image type, valid types are: %s" |
||||
|
% (module.params["compose_type"], [[v for k, v in t.items() if k == "name"] for t in supported_compose_type["types"]]), |
||||
|
changed=changed |
||||
|
) |
||||
|
else: |
||||
|
if not is_supported["enabled"]: |
||||
|
module.fail_json( |
||||
|
msg="%s is not a supported image type, supported image types are: %s" |
||||
|
% (module.params["compose_type"], [[v for k, v in t.items() if k == "enabled" and v is True] for t in supported_compose_type["types"]]), |
||||
|
changed=changed |
||||
|
) |
||||
|
|
||||
|
if not module.params["allow_duplicate"]: |
||||
|
# only do all this query and filtering if needed |
||||
|
|
||||
|
compose_queue: dict = weldr.api.get_compose_queue() |
||||
|
# {"new":[],"run":[{"id":"930a1584-8737-4b61-ba77-582780f0ff2d","blueprint":"base-image-with-tmux","version":"0.0.5","compose_type":"edge-commit","image_size":0,"queue_status":"RUNNING","job_created":1654620015.4107578,"job_started":1654620015.415151}]} |
||||
|
|
||||
|
compose_queue_run_dupe: list = [ |
||||
|
compose for compose in compose_queue["run"] if (compose["blueprint"] == module.params["blueprint"]) and (compose["version"] == blueprint_version) |
||||
|
] |
||||
|
compose_queue_new_dupe: list = [ |
||||
|
compose for compose in compose_queue["new"] if (compose["blueprint"] == module.params["blueprint"]) and (compose["version"] == blueprint_version) |
||||
|
] |
||||
|
|
||||
|
compose_finished: dict = weldr.api.get_compose_finished() |
||||
|
# {"finished":[{"id":"930a1584-8737-4b61-ba77-582780f0ff2d","blueprint":"base-image-with-tmux","version":"0.0.5","compose_type":"edge-commit","image_size":8192,"queue_status":"FINISHED","job_created":1654620015.4107578,"job_started":1654620015.415151,"job_finished":1654620302.9069786}]} |
||||
|
compose_finished_dupe: list = [ |
||||
|
compose |
||||
|
for compose in compose_finished["finished"] |
||||
|
if (compose["blueprint"] == module.params["blueprint"]) and (compose["version"] == blueprint_version) |
||||
|
] |
||||
|
|
||||
|
compose_failed: dict = weldr.api.get_compose_failed() |
||||
|
# {"failed":[]} |
||||
|
compose_failed_dupe: list = [ |
||||
|
compose |
||||
|
for compose in compose_failed["failed"] |
||||
|
if (compose["blueprint"] == module.params["blueprint"]) and (compose["version"] == blueprint_version) |
||||
|
] |
||||
|
|
||||
|
dupe_compose: list = compose_queue_run_dupe + compose_queue_new_dupe + compose_failed_dupe + compose_finished_dupe |
||||
|
|
||||
|
if module.params["allow_duplicate"] or (len(dupe_compose) == 0): |
||||
|
# FIXME - build to POST payload and POST that ish |
||||
|
compose_settings: dict[str, Any] = { |
||||
|
"blueprint_name": module.params["blueprint"], |
||||
|
"compose_type": module.params["compose_type"], |
||||
|
"branch": "master", |
||||
|
"size": module.params["size"], |
||||
|
} |
||||
|
|
||||
|
if "edge-commit" in module.params["compose_type"] or "installer" in module.params["compose_type"] or "raw" in module.params["compose_type"]: |
||||
|
compose_settings["ostree"] = { |
||||
|
"ref": module.params["ostree_ref"], |
||||
|
"parent": module.params["ostree_parent"], |
||||
|
"url": module.params["ostree_url"], |
||||
|
} |
||||
|
|
||||
|
try: |
||||
|
result: dict = weldr.api.post_compose(json.dumps(compose_settings), timeout=module.params["timeout"]) |
||||
|
except socket.timeout: |
||||
|
# it's possible we don't get a response back from weldr because on the |
||||
|
# very first run including a new content source composer will build a repo cache |
||||
|
# and when that happens we get an empty JSON response |
||||
|
|
||||
|
compose_queue: dict = weldr.api.get_compose_queue() |
||||
|
# {"new":[],"run":[{"id":"930a1584-8737-4b61-ba77-582780f0ff2d","blueprint":"base-image-with-tmux","version":"0.0.5","compose_type":"edge-commit","image_size":0,"queue_status":"RUNNING","job_created":1654620015.4107578,"job_started":1654620015.415151}]} |
||||
|
|
||||
|
submitted_compose_uuid: str = "" |
||||
|
|
||||
|
submitted_compose_found_run: list[dict[str, str]] = [ |
||||
|
compose |
||||
|
for compose in compose_queue["run"] |
||||
|
if (compose["blueprint"] == module.params["blueprint"]) and (compose["version"] == blueprint_version) |
||||
|
] |
||||
|
if submitted_compose_found_run: |
||||
|
# we expect it to be RUNNING, so check that first |
||||
|
submitted_compose_uuid: str = submitted_compose_found_run[0]["id"] |
||||
|
else: |
||||
|
# didn't find it running, check for NEW queue status |
||||
|
submitted_compose_found_new: list = [ |
||||
|
compose |
||||
|
for compose in compose_queue["new"] |
||||
|
if (compose["blueprint"] == module.params["blueprint"]) and (compose["version"] == blueprint_version) |
||||
|
] |
||||
|
|
||||
|
if submitted_compose_found_new: |
||||
|
submitted_compose_uuid: str = submitted_compose_found_new[0]["id"] |
||||
|
|
||||
|
else: |
||||
|
# it's not RUNNING and not NEW, so check for FAILURE state |
||||
|
compose_failed: dict = weldr.api.get_compose_failed() |
||||
|
# {"failed":[]} |
||||
|
submitted_compose_found_failed: list = [ |
||||
|
compose |
||||
|
for compose in compose_failed["failed"] |
||||
|
if (compose["blueprint"] == module.params["blueprint"]) and (compose["version"] == blueprint_version) |
||||
|
] |
||||
|
if submitted_compose_found_failed: |
||||
|
submitted_compose_uuid: str = submitted_compose_found_failed[0]["id"] |
||||
|
else: |
||||
|
module.fail_json( |
||||
|
msg="Unable to determine state of build, check osbuild-composer system logs. Also, consider increasing the request timeout", |
||||
|
changed=changed |
||||
|
) |
||||
|
|
||||
|
if submitted_compose_uuid: |
||||
|
result: dict = weldr.api.get_compose_status(submitted_compose_uuid) |
||||
|
result['body'] = { |
||||
|
'build_id': submitted_compose_uuid |
||||
|
} |
||||
|
|
||||
|
if "status_code" in result.keys(): |
||||
|
if result["status_code"] >= 400: |
||||
|
module.fail_json( |
||||
|
msg="Compose returned body: {0}, msg {1}, and status_code {2}".format(result["body"], result["error_msg"], result["status_code"]), |
||||
|
changed=changed |
||||
|
) |
||||
|
|
||||
|
# Having received a non-400+ response, we know a compose has started |
||||
|
changed: bool = True |
||||
|
|
||||
|
compose_output_types: dict[str, list[str]] = { |
||||
|
"tar": ["tar", "edge-commit", "iot-commit", "edge-container", "iot-container", "container"], |
||||
|
"iso": ["edge-installer", "edge-simplified-installer", "iot-installer", "image-installer"], |
||||
|
"qcow2": ["qcow2", "openstack", "oci"], |
||||
|
"vmdk": ["vmdk"], |
||||
|
"vhd": ["vhd"], |
||||
|
"raw.xz": ["edge-raw-image", "iot-raw-image"], |
||||
|
"ami": ["ami"], |
||||
|
} |
||||
|
|
||||
|
output_type: str = "" |
||||
|
for compose_type, compose_type_list in compose_output_types.items(): |
||||
|
if module.params["compose_type"] in compose_type_list: |
||||
|
output_type: str = compose_type |
||||
|
result["output_type"] = output_type |
||||
|
|
||||
|
module.exit_json(msg="Compose submitted to queue", result=result, changed=changed) |
||||
|
|
||||
|
else: |
||||
|
changed: bool = False |
||||
|
module.exit_json( |
||||
|
msg="Not queuing a duplicate versioned compose without allow_duplicate set to true", |
||||
|
changed=changed, |
||||
|
) |
||||
|
|
||||
|
|
||||
|
def main() -> None: |
||||
|
module: AnsibleModule = AnsibleModule( |
||||
|
argument_spec=argument_spec, |
||||
|
required_together=[["image_name", "profile"]], |
||||
|
required_if=[ |
||||
|
["compose_type", "edge-installer", ["ostree_url"]], |
||||
|
["compose_type", "iot-installer", ["ostree_url"]], |
||||
|
], |
||||
|
) |
||||
|
weldr: Weldr = Weldr(module) |
||||
|
start_compose(module, weldr) |
||||
|
|
||||
|
|
||||
|
if __name__ == "__main__": |
||||
|
main() |
||||
@ -0,0 +1,148 @@ |
|||||
|
- name: Install prerequisites |
||||
|
hosts: all |
||||
|
become: true |
||||
|
tasks: |
||||
|
- community.general.rhsm_repository: |
||||
|
name: |
||||
|
- rhocp-4.14-for-rhel-9-{{ ansible_facts['userspace_architecture'] }}-rpms |
||||
|
- fast-datapath-for-rhel-9-{{ ansible_facts['userspace_architecture'] }}-rpms |
||||
|
state: enabled |
||||
|
|
||||
|
- name: Install EPEL release package |
||||
|
become: true |
||||
|
ansible.builtin.dnf: |
||||
|
name: https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm |
||||
|
state: present |
||||
|
disable_gpg_check: true |
||||
|
|
||||
|
- name: Install packages |
||||
|
ansible.builtin.dnf: |
||||
|
name: |
||||
|
- python3-toml |
||||
|
- createrepo |
||||
|
- git |
||||
|
- rpm-build |
||||
|
- rpmdevtools |
||||
|
- rpmrebuild |
||||
|
- mkpasswd |
||||
|
- podman |
||||
|
- buildah |
||||
|
- nginx |
||||
|
- lorax |
||||
|
- pykickstart |
||||
|
- osbuild-composer |
||||
|
- composer-cli |
||||
|
- cockpit-composer |
||||
|
- git |
||||
|
- firewalld |
||||
|
state: installed |
||||
|
|
||||
|
- name: Start services |
||||
|
ansible.builtin.systemd: |
||||
|
name: "{{ item }}" |
||||
|
enabled: yes |
||||
|
state: started |
||||
|
loop: |
||||
|
- osbuild-composer.socket |
||||
|
- firewalld.service |
||||
|
- cockpit.socket |
||||
|
- nginx.service |
||||
|
|
||||
|
- name: Adding ansible_user to the weldr group |
||||
|
ansible.builtin.user: |
||||
|
name: '{{ ansible_user | default(ansible_env.SUDO_USER) }}' |
||||
|
groups: weldr |
||||
|
append: yes |
||||
|
|
||||
|
- name: Allow HTTP and HTTPS |
||||
|
ansible.posix.firewalld: |
||||
|
service: '{{ item }}' |
||||
|
permanent: true |
||||
|
immediate: true |
||||
|
state: enabled |
||||
|
loop: |
||||
|
- http |
||||
|
- https |
||||
|
|
||||
|
- name: Ensure the ostree directory exists |
||||
|
become: true |
||||
|
ansible.builtin.file: |
||||
|
path: "{{ www_location }}" |
||||
|
state: directory |
||||
|
mode: '0755' |
||||
|
serole: object_r |
||||
|
setype: httpd_sys_content_t |
||||
|
seuser: system_u |
||||
|
|
||||
|
- name: Configure nginx |
||||
|
lineinfile: |
||||
|
path: /etc/nginx/nginx.conf |
||||
|
line: "root {{ www_location }};" |
||||
|
regexp: "^\\s*root\\s+.*;" |
||||
|
|
||||
|
- name: Restart nginx |
||||
|
ansible.builtin.systemd: |
||||
|
name: nginx.service |
||||
|
state: restarted |
||||
|
|
||||
|
- name: Ensure the repository directory exists |
||||
|
become: true |
||||
|
ansible.builtin.file: |
||||
|
path: "{{ repo_location }}" |
||||
|
state: directory |
||||
|
mode: '0755' |
||||
|
|
||||
|
- name: Update the repository with createrepo |
||||
|
become: true |
||||
|
ansible.builtin.command: |
||||
|
cmd: "createrepo {{ repo_location }}" |
||||
|
|
||||
|
- name: Add custom repository |
||||
|
ansible.builtin.yum_repository: |
||||
|
name: custom |
||||
|
file: custom |
||||
|
description: Custom RPMS |
||||
|
baseurl: file://{{ repo_location }} |
||||
|
enabled: true |
||||
|
gpgcheck: false |
||||
|
|
||||
|
- name: Add sources |
||||
|
infra.osbuild.repository: '{{ item }}' |
||||
|
loop: |
||||
|
- repo_name: custom packages for RHEL |
||||
|
type: yum-baseurl |
||||
|
base_url: file://{{ repo_location }} |
||||
|
check_gpg: false |
||||
|
check_ssl: false |
||||
|
rhsm: false |
||||
|
state: present |
||||
|
- repo_name: Red Hat OpenShift Container Platform 4.14 for RHEL 9 |
||||
|
type: yum-baseurl |
||||
|
base_url: https://cdn.redhat.com/content/dist/layered/rhel9/{{ ansible_facts['userspace_architecture'] }}/rhocp/4.14/os |
||||
|
check_gpg: true |
||||
|
check_ssl: true |
||||
|
rhsm: true |
||||
|
state: present |
||||
|
- repo_name: Fast Datapath for RHEL 9 |
||||
|
type: yum-baseurl |
||||
|
base_url: https://cdn.redhat.com/content/dist/layered/rhel9/{{ ansible_facts['userspace_architecture'] }}/fast-datapath/os |
||||
|
check_gpg: true |
||||
|
check_ssl: true |
||||
|
rhsm: true |
||||
|
state: present |
||||
|
- repo_name: Extra Packages for Enterprise Linux |
||||
|
type: yum-baseurl |
||||
|
base_url: http://mirror.in2p3.fr/pub/epel/9/Everything/{{ ansible_facts['userspace_architecture'] }}/ |
||||
|
check_gpg: false |
||||
|
check_ssl: false |
||||
|
rhsm: false |
||||
|
state: present |
||||
|
loop_control: |
||||
|
label: '{{ item.repo_name }}' |
||||
|
|
||||
|
- name: Install packages on the ansible controller |
||||
|
dnf: |
||||
|
name: |
||||
|
- python3-toml |
||||
|
state: installed |
||||
|
delegate_to: localhost |
||||
@ -0,0 +1,4 @@ |
|||||
|
collections: |
||||
|
- infra.osbuild |
||||
|
- community.general |
||||
|
- ansible.posix |
||||
@ -0,0 +1,68 @@ |
|||||
|
## |
||||
|
## Environment setup |
||||
|
## |
||||
|
|
||||
|
# French I18n |
||||
|
lang fr_FR.UTF-8 |
||||
|
|
||||
|
# French keyboard layout |
||||
|
keyboard fr |
||||
|
|
||||
|
# Timezone is UTC to avoid issue with DST |
||||
|
timezone UTC --utc |
||||
|
|
||||
|
# Configure NTP |
||||
|
timesource --ntp-server=rhel.pool.ntp.org |
||||
|
|
||||
|
# Which action to perform after install: poweroff or reboot |
||||
|
reboot |
||||
|
|
||||
|
# Install mode: text (interactive installs) or cmdline (unattended installs) |
||||
|
text |
||||
|
|
||||
|
## |
||||
|
## Storage configuration for only one disk |
||||
|
## /dev/disk/by-path/pci-0000:00:12.0-ata-1 instead of sda when sda is taken by the usb stick |
||||
|
## |
||||
|
zerombr |
||||
|
clearpart --all --initlabel |
||||
|
reqpart --add-boot |
||||
|
part pv.01 --size=1024 --grow --ondisk={{ kickstart_root_disk }} |
||||
|
volgroup rhel pv.01 |
||||
|
logvol / --fstype="xfs" --size=10240 --name=root --vgname=rhel |
||||
|
|
||||
|
## |
||||
|
## Network configuration |
||||
|
## |
||||
|
|
||||
|
# Configure the first network device |
||||
|
network --bootproto=dhcp --device=enp1s0 --noipv6 --activate |
||||
|
|
||||
|
# Configure hostname |
||||
|
network --hostname=kiosk.localdomain |
||||
|
|
||||
|
## |
||||
|
## Ostree installation |
||||
|
## |
||||
|
|
||||
|
# Use this to fetch from a remote URL |
||||
|
ostreesetup --nogpg --osname=rhel --remote=edge --url=http://{{ ansible_default_ipv4.address }}/repo --ref=rhel/9/x86_64/edge-kiosk |
||||
|
|
||||
|
## |
||||
|
## Post install scripts |
||||
|
## |
||||
|
%post --log=/var/log/anaconda/post-install.log --erroronfail |
||||
|
# Add the pull secret to CRI-O and set root user-only read/write permissions |
||||
|
cat > /etc/crio/openshift-pull-secret << 'EOF' |
||||
|
{{ kickstart_microshift_pull_secret }} |
||||
|
EOF |
||||
|
chmod 600 /etc/crio/openshift-pull-secret |
||||
|
|
||||
|
# Configure the firewall with the mandatory rules for MicroShift |
||||
|
firewall-offline-cmd --zone=trusted --add-source=10.42.0.0/16 |
||||
|
firewall-offline-cmd --zone=trusted --add-source=169.254.169.1 |
||||
|
|
||||
|
# Do not ask password for sudo |
||||
|
sed -i.post-install -e "s/^%wheel\tALL=(ALL)\tALL/%wheel ALL=(ALL) NOPASSWD: ALL/" /etc/sudoers |
||||
|
|
||||
|
%end |
||||
@ -0,0 +1,74 @@ |
|||||
|
name = "kiosk" |
||||
|
description = "Example Kiosk" |
||||
|
version = "0.0.8" |
||||
|
modules = [] |
||||
|
groups = [] |
||||
|
|
||||
|
[[packages]] |
||||
|
name = "kiosk-config" |
||||
|
version = "*" |
||||
|
|
||||
|
[[packages]] |
||||
|
name = "cockpit" |
||||
|
|
||||
|
[[packages]] |
||||
|
name = "microshift-manifests" |
||||
|
version = "*" |
||||
|
|
||||
|
[[packages]] |
||||
|
name = "cockpit-system" |
||||
|
|
||||
|
[customizations] |
||||
|
hostname = "kiosk.local" |
||||
|
|
||||
|
[customizations.services] |
||||
|
enabled = ["cockpit.socket", "sshd", "microshift", "rpm-ostreed", "rpm-ostreed-automatic.timer"] |
||||
|
|
||||
|
[customizations.timezone] |
||||
|
timezone = "Europe/Paris" |
||||
|
ntpservers = ["0.fr.pool.ntp.org", "1.fr.pool.ntp.org"] |
||||
|
|
||||
|
[customizations.locale] |
||||
|
languages = ["fr_FR.UTF-8"] |
||||
|
keyboard = "fr" |
||||
|
|
||||
|
#22 ssh / 9090 cockpit / 6443 microshift |
||||
|
[customizations.firewall] |
||||
|
ports = ["22:tcp", "30000:tcp", "9090:tcp", "6443:tcp"] |
||||
|
|
||||
|
## |
||||
|
## Automatic updates |
||||
|
## |
||||
|
## This file is used by the rpm-ostreed service that is triggered by the |
||||
|
## rpm-ostreed-automatic systemd timer: |
||||
|
## |
||||
|
## [Timer] |
||||
|
## OnBootSec=1h # 1 hour after boot |
||||
|
## OnUnitInactiveSec=1d # 1 day after last check |
||||
|
## |
||||
|
## But you can trigger a check manually with: |
||||
|
## |
||||
|
## sudo rpm-ostree upgrade --trigger-automatic-update-policy |
||||
|
## |
||||
|
[[customizations.files]] |
||||
|
path = "/etc/rpm-ostreed.conf" |
||||
|
data = """[Daemon] |
||||
|
AutomaticUpdatePolicy=apply |
||||
|
""" |
||||
|
|
||||
|
[[customizations.user]] |
||||
|
name = "admin" |
||||
|
description = "admin" |
||||
|
password = '{{ blueprint_admin_password_hash }}' |
||||
|
key = "{{ blueprint_admin_ssh_public_key }}" |
||||
|
home = "/home/admin/" |
||||
|
shell = "/usr/bin/bash" |
||||
|
groups = ["users", "wheel"] |
||||
|
|
||||
|
[[customizations.user]] |
||||
|
name = "kiosk" |
||||
|
description = "kiosk" |
||||
|
password = '{{ blueprint_kiosk_password_hash }}' |
||||
|
home = "/home/kiosk/" |
||||
|
shell = "/bin/bash" |
||||
|
|
||||
Loading…
Reference in new issue