kt vm: Pin Rocky repos to vault to prevent minor version drift#71
kt vm: Pin Rocky repos to vault to prevent minor version drift#71roxanan1996 wants to merge 1 commit into
Conversation
There was a problem hiding this comment.
Pull request overview
Pins Rocky Linux DNF repository configuration inside kt vm cloud-init to avoid unintended minor-version drift when installing packages after the image is built.
Changes:
- Disable
mirrorlist=entries in Rocky repo files to prevent redirects to newer minor releases. - Rewrite
baseurlto point to the Rocky vault location for the image’s minor version. - Replace
$releaseverwith the OSVERSION_IDand clear DNF metadata cache.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
roxanan1996
force-pushed
the
{rnicolescu}_kt_vm_pin
branch
from
a4ed21b to
f1394ce
Compare
roxanan1996
force-pushed
the
{rnicolescu}_kt_vm_pin
branch
from
f1394ce to
5627b50
Compare
roxanan1996
force-pushed
the
{rnicolescu}_kt_vm_pin
branch
from
5627b50 to
bde249f
Compare
roxanan1996
force-pushed
the
{rnicolescu}_kt_vm_pin
branch
from
bde249f to
85c4624
Compare
Without this, dnf resolves packages from the latest minor release instead of the one the image was built with. - Disable mirrorlist to stop dnf from redirecting to the latest minor version - Point baseurl to the Rocky vault where old minor versions are permanently hosted - Replace $releasever with the actual VERSION_ID from /etc/os-release to pin to the exact minor version - Clear dnf cache to force metadata refresh from the new vault URLs All of these were added in kt/data/cloud-init.yaml that is the base for all vms. When kt vm is run the first time for a kernel workspace, a copy of cloud-init.yaml is created. Use ruamel instead so that comments and the original formatting stays the same when the yaml file is read and then dump in python. Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>
roxanan1996
force-pushed
the
{rnicolescu}_kt_vm_pin
branch
from
85c4624 to
0879576
Compare
roxanan1996
force-pushed
the
{rnicolescu}_kt_vm_pin
branch
from
0879576 to
a8edde3
Compare
| - find /etc/yum.repos.d/ -iname "*.repo" -exec sed -i 's|^mirrorlist=|#mirrorlist=|g' {} \; | ||
| - find /etc/yum.repos.d/ -iname "*.repo" -exec sed -i 's|^#baseurl=http://dl.rockylinux.org/$contentdir|baseurl=https://dl.rockylinux.org/vault/rocky|g' {} \; | ||
| - find /etc/yum.repos.d/ -iname "*.repo" -exec sed -i "s|\$releasever|$(. /etc/os-release && echo $VERSION_ID)|g" {} \; |
There was a problem hiding this comment.
I'm sorry I'm just now getting to this:
There is a little simpler way to do pinning.
https://github.com/ctrliq/kernel-src-tree/wiki#pin-to-vault
Feel free to rewrite the awk if you want.
There was a problem hiding this comment.
yeah, this looks better as it just sets env variables instead of manually rewriting them in the repo files.
But, on friday, I ran into issues for all 9.x kernels because of epel-cisco-openh264. There is only one repo for 9. And what I don't understand is that the repo files already use 9.X, so there is no nice way to override that only for this repo.
I do not even know why we need this in the first place, maybe I can disable it..
I'll sleep on this a bit, I was busy with other stuff.
There was a problem hiding this comment.
I'm actually not sure why the cisco stuff would be there, its on my host machine ... and I couldn't tell you why exactly but none of the VM images i create has it installed for the guest vm
A.
Without this, dnf resolves packages from the latest minor release instead of the one the image was built with.
B. While testing found that lts8.6 does not install the kernel dependency.
Now that we're using maching basic images, there is a discrepancy
for rocky 8.6 images:
ROCKY_SUPPORT_PRODUCT='Rocky Linux'.
Since ROCKY_SUPPORT_PRODUCT is not the same for all versions, use VERSION_ID
instead.
Testing
NOTE
I used ruaml instead of oyaml because it added extra chars when dumping the cloud-init.yaml file adapted for each kernel_workspace and user. But that broke lts8.6 because of the array format. That's why I changed
kt/data/cloud-init.yaml arrays so they are backwards compatible. For some reason, oyaml would modify that during dump, hence there was no issue there.