mirror of
https://github.com/kairos-io/osbuilder.git
synced 2025-12-25 12:53:27 +00:00
Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
78f2008759 |
26
.github/workflows/bump_repos.yml
vendored
26
.github/workflows/bump_repos.yml
vendored
@@ -1,26 +0,0 @@
|
||||
name: Bump repositories
|
||||
on:
|
||||
schedule:
|
||||
- cron: 0 20 * * *
|
||||
workflow_dispatch:
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
- name: Install earthly
|
||||
uses: Luet-lab/luet-install-action@v1
|
||||
with:
|
||||
repository: quay.io/kairos/packages
|
||||
packages: utils/earthly
|
||||
- name: Bump cos 🔧
|
||||
run: earthly +bump-repositories
|
||||
- name: Create Pull Request
|
||||
uses: peter-evans/create-pull-request@v5
|
||||
with:
|
||||
token: ${{ secrets.PAT_TOKEN }}
|
||||
push-to-fork: ci-forks/osbuilder
|
||||
commit-message: ':arrow_up: Update repositories'
|
||||
title: ':arrow_up: Update repositories'
|
||||
body: Bump of Kairos repositories
|
||||
signoff: true
|
||||
3
.github/workflows/test.yml
vendored
3
.github/workflows/test.yml
vendored
@@ -7,7 +7,6 @@ on:
|
||||
- master
|
||||
tags:
|
||||
- '*'
|
||||
pull_request:
|
||||
|
||||
jobs:
|
||||
docker:
|
||||
@@ -17,4 +16,4 @@ jobs:
|
||||
uses: actions/checkout@v2
|
||||
- name: Test
|
||||
run: |
|
||||
make kind-e2e-tests
|
||||
make kind-e2e-tests
|
||||
22
Earthfile
22
Earthfile
@@ -1,22 +0,0 @@
|
||||
VERSION 0.6
|
||||
|
||||
last-commit-packages:
|
||||
FROM quay.io/skopeo/stable
|
||||
RUN dnf install -y jq
|
||||
WORKDIR build
|
||||
RUN skopeo list-tags docker://quay.io/kairos/packages | jq -rc '.Tags | map(select( (. | contains("-repository.yaml")) )) | sort_by(. | sub("v";"") | sub("-repository.yaml";"") | sub("-";"") | split(".") | map(tonumber) ) | .[-1]' > REPO_AMD64
|
||||
RUN skopeo list-tags docker://quay.io/kairos/packages-arm64 | jq -rc '.Tags | map(select( (. | contains("-repository.yaml")) )) | sort_by(. | sub("v";"") | sub("-repository.yaml";"") | sub("-";"") | split(".") | map(tonumber) ) | .[-1]' > REPO_ARM64
|
||||
SAVE ARTIFACT REPO_AMD64 REPO_AMD64
|
||||
SAVE ARTIFACT REPO_ARM64 REPO_ARM64
|
||||
|
||||
bump-repositories:
|
||||
FROM mikefarah/yq
|
||||
WORKDIR build
|
||||
COPY +last-commit-packages/REPO_AMD64 REPO_AMD64
|
||||
COPY +last-commit-packages/REPO_ARM64 REPO_ARM64
|
||||
ARG REPO_AMD64=$(cat REPO_AMD64)
|
||||
ARG REPO_ARM64=$(cat REPO_ARM64)
|
||||
COPY tools-image/luet.yaml luet.yaml
|
||||
RUN yq eval ".repositories[0] |= . * { \"reference\": \"${REPO_AMD64}\" }" -i luet.yaml
|
||||
RUN yq eval ".repositories[1] |= . * { \"reference\": \"${REPO_ARM64}\" }" -i luet.yaml
|
||||
SAVE ARTIFACT luet.yaml AS LOCAL tools-image/luet.yaml
|
||||
7
Makefile
7
Makefile
@@ -147,12 +147,13 @@ uninstall: manifests kustomize ## Uninstall CRDs from the K8s cluster specified
|
||||
.PHONY: deploy
|
||||
deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in ~/.kube/config.
|
||||
cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
|
||||
# TODO: No need to build and then apply. `kubectl apply -k config/default` does the trick
|
||||
$(KUSTOMIZE) build config/default | kubectl apply -f -
|
||||
|
||||
|
||||
.PHONY: deploy-dev
|
||||
deploy-dev: manifests kustomize ## Deploy controller to the K8s cluster specified in ~/.kube/config.
|
||||
kubectl apply -k config/dev
|
||||
cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
|
||||
$(KUSTOMIZE) build config/dev | kubectl apply -f -
|
||||
|
||||
.PHONY: undeploy
|
||||
undeploy: ## Undeploy controller from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
|
||||
@@ -281,4 +282,4 @@ kind-e2e-tests: ginkgo kind-setup install undeploy-dev deploy-dev e2e-tests
|
||||
kubesplit: manifests kustomize
|
||||
rm -rf helm-chart
|
||||
mkdir helm-chart
|
||||
$(KUSTOMIZE) build config/default | kubesplit -helm helm-chart
|
||||
$(KUSTOMIZE) build config/default | kubesplit -helm helm-chart
|
||||
9
PROJECT
9
PROJECT
@@ -16,4 +16,13 @@ resources:
|
||||
kind: OSArtifact
|
||||
path: github.com/kairos-io/osbuilder/api/v1alpha1
|
||||
version: v1alpha1
|
||||
- api:
|
||||
crdVersion: v1
|
||||
namespaced: true
|
||||
controller: true
|
||||
domain: kairos.io
|
||||
group: build
|
||||
kind: NetbootDeployment
|
||||
path: github.com/kairos-io/osbuilder/api/v1alpha1
|
||||
version: v1alpha1
|
||||
version: "3"
|
||||
|
||||
61
README.md
61
README.md
@@ -1,64 +1,9 @@
|
||||
<h1 align="center">
|
||||
<br>
|
||||
<img width="184" alt="kairos-white-column 5bc2fe34" src="https://user-images.githubusercontent.com/2420543/193010398-72d4ba6e-7efe-4c2e-b7ba-d3a826a55b7d.png"><br>
|
||||
osbuilder
|
||||
<br>
|
||||
</h1>
|
||||
|
||||
<h3 align="center">Kubernetes Native Extension to build Linux distributions artifacts from container images</h3>
|
||||
<p align="center">
|
||||
<a href="https://opensource.org/licenses/">
|
||||
<img src="https://img.shields.io/badge/licence-APL2-brightgreen"
|
||||
alt="license">
|
||||
</a>
|
||||
<a href="https://github.com/kairos-io/osbuilder/issues"><img src="https://img.shields.io/github/issues/kairos-io/osbuilder"></a>
|
||||
<a href="https://kairos.io/docs/" target=_blank> <img src="https://img.shields.io/badge/Documentation-blue"
|
||||
alt="docs"></a>
|
||||
<img src="https://img.shields.io/badge/made%20with-Go-blue">
|
||||
<img src="https://goreportcard.com/badge/github.com/kairos-io/osbuilder" alt="go report card" />
|
||||
</p>
|
||||
|
||||
|
||||
With Kairos you can build immutable, bootable Kubernetes and OS images for your edge devices as easily as writing a Dockerfile. Optional P2P mesh with distributed ledger automates node bootstrapping and coordination. Updating nodes is as easy as CI/CD: push a new image to your container registry and let secure, risk-free A/B atomic upgrades do the rest.
|
||||
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<th align="center">
|
||||
<img width="640" height="1px">
|
||||
<p>
|
||||
<small>
|
||||
Documentation
|
||||
</small>
|
||||
</p>
|
||||
</th>
|
||||
<th align="center">
|
||||
<img width="640" height="1">
|
||||
<p>
|
||||
<small>
|
||||
Contribute
|
||||
</small>
|
||||
</p>
|
||||
</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
|
||||
📚 [Getting started with Kairos](https://kairos.io/docs/getting-started) <br> :bulb: [Examples](https://kairos.io/docs/examples) <br> :movie_camera: [Video](https://kairos.io/docs/media/) <br> :open_hands:[Engage with the Community](https://kairos.io/community/)
|
||||
|
||||
</td>
|
||||
<td>
|
||||
|
||||
🙌[ CONTRIBUTING.md ]( https://github.com/kairos-io/kairos/blob/master/CONTRIBUTING.md ) <br> :raising_hand: [ GOVERNANCE ]( https://github.com/kairos-io/kairos/blob/master/GOVERNANCE.md ) <br>:construction_worker:[Code of conduct](https://github.com/kairos-io/kairos/blob/master/CODE_OF_CONDUCT.md)
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
# osbuilder
|
||||
|
||||
| :exclamation: | This is experimental! |
|
||||
|-|:-|
|
||||
|
||||
## Installation
|
||||
This is the Kairos osbuilder Kubernetes Native Extension.
|
||||
|
||||
To install, use helm:
|
||||
|
||||
@@ -83,5 +28,3 @@ TEST SUITE: None
|
||||
# Installs osbuilder
|
||||
$ helm install kairos-osbuilder kairos/osbuilder
|
||||
```
|
||||
|
||||
Documentation available at: https://kairos.io/docs/advanced/build/
|
||||
|
||||
63
api/v1alpha1/netbootdeployment_types.go
Normal file
63
api/v1alpha1/netbootdeployment_types.go
Normal file
@@ -0,0 +1,63 @@
|
||||
/*
|
||||
Copyright 2022.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package v1alpha1
|
||||
|
||||
import (
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
)
|
||||
|
||||
// EDIT THIS FILE! THIS IS SCAFFOLDING FOR YOU TO OWN!
|
||||
// NOTE: json tags are required. Any new fields you add must have json tags for the fields to be serialized.
|
||||
|
||||
// NetbootDeploymentSpec defines the desired state of NetbootDeployment
|
||||
type NetbootDeploymentSpec struct {
|
||||
CloudConfig string `json:"cloudConfig,omitempty"`
|
||||
CommandLine string `json:"cmdLine,omitempty"`
|
||||
|
||||
// TODO: Those below should be deprecated and reference an osbuild instead
|
||||
}
|
||||
|
||||
// NetbootDeploymentStatus defines the observed state of NetbootDeployment
|
||||
type NetbootDeploymentStatus struct {
|
||||
// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
|
||||
// Important: Run "make" to regenerate code after modifying this file
|
||||
}
|
||||
|
||||
//+kubebuilder:object:root=true
|
||||
//+kubebuilder:subresource:status
|
||||
|
||||
// NetbootDeployment is the Schema for the netbootdeployments API
|
||||
type NetbootDeployment struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
metav1.ObjectMeta `json:"metadata,omitempty"`
|
||||
|
||||
Spec NetbootDeploymentSpec `json:"spec,omitempty"`
|
||||
Status NetbootDeploymentStatus `json:"status,omitempty"`
|
||||
}
|
||||
|
||||
//+kubebuilder:object:root=true
|
||||
|
||||
// NetbootDeploymentList contains a list of NetbootDeployment
|
||||
type NetbootDeploymentList struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
metav1.ListMeta `json:"metadata,omitempty"`
|
||||
Items []NetbootDeployment `json:"items"`
|
||||
}
|
||||
|
||||
func init() {
|
||||
SchemeBuilder.Register(&NetbootDeployment{}, &NetbootDeploymentList{})
|
||||
}
|
||||
@@ -49,8 +49,7 @@ type OSArtifactSpec struct {
|
||||
Bundles []string `json:"bundles,omitempty"`
|
||||
PullOptions Pull `json:"pull,omitempty"`
|
||||
OSRelease string `json:"osRelease,omitempty"`
|
||||
// TODO: Currently not used. Reserved to be used when we have a way to push to registries.
|
||||
PushOptions Push `json:"push,omitempty"`
|
||||
PushOptions Push `json:"push,omitempty"`
|
||||
}
|
||||
|
||||
type Push struct {
|
||||
|
||||
@@ -40,6 +40,95 @@ func (in *LocalObjectReference) DeepCopy() *LocalObjectReference {
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *NetbootDeployment) DeepCopyInto(out *NetbootDeployment) {
|
||||
*out = *in
|
||||
out.TypeMeta = in.TypeMeta
|
||||
in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
|
||||
out.Spec = in.Spec
|
||||
out.Status = in.Status
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NetbootDeployment.
|
||||
func (in *NetbootDeployment) DeepCopy() *NetbootDeployment {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(NetbootDeployment)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||
func (in *NetbootDeployment) DeepCopyObject() runtime.Object {
|
||||
if c := in.DeepCopy(); c != nil {
|
||||
return c
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *NetbootDeploymentList) DeepCopyInto(out *NetbootDeploymentList) {
|
||||
*out = *in
|
||||
out.TypeMeta = in.TypeMeta
|
||||
in.ListMeta.DeepCopyInto(&out.ListMeta)
|
||||
if in.Items != nil {
|
||||
in, out := &in.Items, &out.Items
|
||||
*out = make([]NetbootDeployment, len(*in))
|
||||
for i := range *in {
|
||||
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NetbootDeploymentList.
|
||||
func (in *NetbootDeploymentList) DeepCopy() *NetbootDeploymentList {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(NetbootDeploymentList)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||
func (in *NetbootDeploymentList) DeepCopyObject() runtime.Object {
|
||||
if c := in.DeepCopy(); c != nil {
|
||||
return c
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *NetbootDeploymentSpec) DeepCopyInto(out *NetbootDeploymentSpec) {
|
||||
*out = *in
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NetbootDeploymentSpec.
|
||||
func (in *NetbootDeploymentSpec) DeepCopy() *NetbootDeploymentSpec {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(NetbootDeploymentSpec)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *NetbootDeploymentStatus) DeepCopyInto(out *NetbootDeploymentStatus) {
|
||||
*out = *in
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NetbootDeploymentStatus.
|
||||
func (in *NetbootDeploymentStatus) DeepCopy() *NetbootDeploymentStatus {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(NetbootDeploymentStatus)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *OSArtifact) DeepCopyInto(out *OSArtifact) {
|
||||
*out = *in
|
||||
|
||||
@@ -3,17 +3,20 @@
|
||||
# It should be run by config/default
|
||||
resources:
|
||||
- bases/build.kairos.io_osartifacts.yaml
|
||||
- bases/build.kairos.io_netbootdeployments.yaml
|
||||
#+kubebuilder:scaffold:crdkustomizeresource
|
||||
|
||||
patchesStrategicMerge:
|
||||
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix.
|
||||
# patches here are for enabling the conversion webhook for each CRD
|
||||
#- patches/webhook_in_osartifacts.yaml
|
||||
#- patches/webhook_in_netbootdeployments.yaml
|
||||
#+kubebuilder:scaffold:crdkustomizewebhookpatch
|
||||
|
||||
# [CERTMANAGER] To enable cert-manager, uncomment all the sections with [CERTMANAGER] prefix.
|
||||
# patches here are for enabling the CA injection for each CRD
|
||||
#- patches/cainjection_in_osartifacts.yaml
|
||||
#- patches/cainjection_in_netbootdeployments.yaml
|
||||
#+kubebuilder:scaffold:crdkustomizecainjectionpatch
|
||||
|
||||
# the following config is for teaching kustomize how to do kustomization for CRDs.
|
||||
|
||||
@@ -0,0 +1,7 @@
|
||||
# The following patch adds a directive for certmanager to inject CA into the CRD
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
|
||||
name: netbootdeployments.build.kairos.io
|
||||
16
config/crd/patches/webhook_in_netbootdeployments.yaml
Normal file
16
config/crd/patches/webhook_in_netbootdeployments.yaml
Normal file
@@ -0,0 +1,16 @@
|
||||
# The following patch enables a conversion webhook for the CRD
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: netbootdeployments.build.kairos.io
|
||||
spec:
|
||||
conversion:
|
||||
strategy: Webhook
|
||||
webhook:
|
||||
clientConfig:
|
||||
service:
|
||||
namespace: system
|
||||
name: webhook-service
|
||||
path: /convert
|
||||
conversionReviewVersions:
|
||||
- v1
|
||||
@@ -16,7 +16,6 @@ bases:
|
||||
- ../crd
|
||||
- ../rbac
|
||||
- ../manager
|
||||
- ../nginx
|
||||
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
|
||||
# crd/kustomization.yaml
|
||||
#- ../webhook
|
||||
@@ -73,16 +72,3 @@ vars:
|
||||
# kind: Service
|
||||
# version: v1
|
||||
# name: webhook-service
|
||||
|
||||
vars:
|
||||
- name: NGINX_NAMESPACE
|
||||
objref:
|
||||
kind: Namespace
|
||||
name: system
|
||||
apiVersion: v1
|
||||
|
||||
- name: ARTIFACT_COPIER_ROLE
|
||||
objref:
|
||||
kind: Role
|
||||
name: artifactCopier
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
|
||||
@@ -38,7 +38,3 @@ spec:
|
||||
- "--health-probe-bind-address=:8081"
|
||||
- "--metrics-bind-address=127.0.0.1:8080"
|
||||
- "--leader-elect"
|
||||
- "--copy-to-namespace=$(NGINX_NAMESPACE)"
|
||||
- "--copy-role=$(ARTIFACT_COPIER_ROLE)"
|
||||
- --copy-to-pod-label=app.kubernetes.io/name=osbuilder-nginx
|
||||
- --copy-to-path="/usr/share/nginx/html"
|
||||
|
||||
@@ -1,7 +1,74 @@
|
||||
bases:
|
||||
- ../default
|
||||
# Adds namespace to all resources.
|
||||
namespace: osartifactbuilder-operator-system
|
||||
|
||||
images:
|
||||
- name: quay.io/kairos/osbuilder
|
||||
newName: quay.io/kairos/osbuilder
|
||||
newTag: test
|
||||
# Value of this field is prepended to the
|
||||
# names of all resources, e.g. a deployment named
|
||||
# "wordpress" becomes "alices-wordpress".
|
||||
# Note that it should also match with the prefix (text before '-') of the namespace
|
||||
# field above.
|
||||
namePrefix: osartifactbuilder-operator-
|
||||
|
||||
# Labels to add to all resources and selectors.
|
||||
#commonLabels:
|
||||
# someName: someValue
|
||||
|
||||
bases:
|
||||
- ../crd
|
||||
- ../rbac
|
||||
- ../manager
|
||||
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
|
||||
# crd/kustomization.yaml
|
||||
#- ../webhook
|
||||
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. 'WEBHOOK' components are required.
|
||||
#- ../certmanager
|
||||
# [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
|
||||
#- ../prometheus
|
||||
|
||||
patchesStrategicMerge:
|
||||
# Protect the /metrics endpoint by putting it behind auth.
|
||||
# If you want your controller-manager to expose the /metrics
|
||||
# endpoint w/o any authn/z, please comment the following line.
|
||||
- manager_auth_proxy_patch.yaml
|
||||
|
||||
# Mount the controller config file for loading manager configurations
|
||||
# through a ComponentConfig type
|
||||
#- manager_config_patch.yaml
|
||||
|
||||
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
|
||||
# crd/kustomization.yaml
|
||||
#- manager_webhook_patch.yaml
|
||||
|
||||
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'.
|
||||
# Uncomment 'CERTMANAGER' sections in crd/kustomization.yaml to enable the CA injection in the admission webhooks.
|
||||
# 'CERTMANAGER' needs to be enabled to use ca injection
|
||||
#- webhookcainjection_patch.yaml
|
||||
|
||||
# the following config is for teaching kustomize how to do var substitution
|
||||
vars:
|
||||
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER' prefix.
|
||||
#- name: CERTIFICATE_NAMESPACE # namespace of the certificate CR
|
||||
# objref:
|
||||
# kind: Certificate
|
||||
# group: cert-manager.io
|
||||
# version: v1
|
||||
# name: serving-cert # this name should match the one in certificate.yaml
|
||||
# fieldref:
|
||||
# fieldpath: metadata.namespace
|
||||
#- name: CERTIFICATE_NAME
|
||||
# objref:
|
||||
# kind: Certificate
|
||||
# group: cert-manager.io
|
||||
# version: v1
|
||||
# name: serving-cert # this name should match the one in certificate.yaml
|
||||
#- name: SERVICE_NAMESPACE # namespace of the service
|
||||
# objref:
|
||||
# kind: Service
|
||||
# version: v1
|
||||
# name: webhook-service
|
||||
# fieldref:
|
||||
# fieldpath: metadata.namespace
|
||||
#- name: SERVICE_NAME
|
||||
# objref:
|
||||
# kind: Service
|
||||
# version: v1
|
||||
# name: webhook-service
|
||||
|
||||
40
config/dev/manager_auth_proxy_patch.yaml
Normal file
40
config/dev/manager_auth_proxy_patch.yaml
Normal file
@@ -0,0 +1,40 @@
|
||||
# This patch inject a sidecar container which is a HTTP proxy for the
|
||||
# controller manager, it performs RBAC authorization against the Kubernetes API using SubjectAccessReviews.
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: controller-manager
|
||||
namespace: system
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
containers:
|
||||
- name: kube-rbac-proxy
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
# TODO(user): uncomment for common cases that do not require escalating privileges
|
||||
# capabilities:
|
||||
# drop:
|
||||
# - "ALL"
|
||||
image: gcr.io/kubebuilder/kube-rbac-proxy:v0.11.0
|
||||
args:
|
||||
- "--secure-listen-address=0.0.0.0:8443"
|
||||
- "--upstream=http://127.0.0.1:8080/"
|
||||
- "--logtostderr=true"
|
||||
- "--v=0"
|
||||
ports:
|
||||
- containerPort: 8443
|
||||
protocol: TCP
|
||||
name: https
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 5m
|
||||
memory: 64Mi
|
||||
- name: manager
|
||||
args:
|
||||
- "--health-probe-bind-address=:8081"
|
||||
- "--metrics-bind-address=127.0.0.1:8080"
|
||||
- "--leader-elect"
|
||||
21
config/dev/manager_config_patch.yaml
Normal file
21
config/dev/manager_config_patch.yaml
Normal file
@@ -0,0 +1,21 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: controller-manager
|
||||
namespace: system
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
containers:
|
||||
- name: manager
|
||||
imagePullPolicy: Never
|
||||
args:
|
||||
- "--config=controller_manager_config.yaml"
|
||||
volumeMounts:
|
||||
- name: manager-config
|
||||
mountPath: /controller_manager_config.yaml
|
||||
subPath: controller_manager_config.yaml
|
||||
volumes:
|
||||
- name: manager-config
|
||||
configMap:
|
||||
name: manager-config
|
||||
@@ -1,8 +1,6 @@
|
||||
resources:
|
||||
- manager.yaml
|
||||
|
||||
namespace: system
|
||||
|
||||
generatorOptions:
|
||||
disableNameSuffixHash: true
|
||||
|
||||
|
||||
@@ -9,6 +9,7 @@ apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: controller-manager
|
||||
namespace: system
|
||||
labels:
|
||||
control-plane: controller-manager
|
||||
spec:
|
||||
|
||||
@@ -1,41 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: nginx-public
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 3Gi
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: nginx
|
||||
labels:
|
||||
app.kubernetes.io/name: osbuilder-nginx
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: osbuilder-nginx
|
||||
replicas: 1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: osbuilder-nginx
|
||||
spec:
|
||||
containers:
|
||||
- image: nginx
|
||||
name: nginx
|
||||
volumeMounts:
|
||||
- mountPath: "/usr/share/nginx/html"
|
||||
name: nginx-public
|
||||
ports:
|
||||
- containerPort: 80
|
||||
serviceAccountName: controller-manager
|
||||
terminationGracePeriodSeconds: 10
|
||||
volumes:
|
||||
- name: nginx-public
|
||||
persistentVolumeClaim:
|
||||
claimName: nginx-public
|
||||
@@ -1,4 +0,0 @@
|
||||
resources:
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
- role.yaml
|
||||
@@ -1,18 +0,0 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: artifactCopier
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- list
|
||||
- get
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods/exec
|
||||
verbs:
|
||||
- create
|
||||
@@ -1,12 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: osbuilder-nginx
|
||||
spec:
|
||||
type: NodePort
|
||||
selector:
|
||||
app.kubernetes.io/name: osbuilder-nginx
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 80
|
||||
targetPort: 80
|
||||
24
config/rbac/netbootdeployment_editor_role.yaml
Normal file
24
config/rbac/netbootdeployment_editor_role.yaml
Normal file
@@ -0,0 +1,24 @@
|
||||
# permissions for end users to edit netbootdeployments.
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: netbootdeployment-editor-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- build.kairos.io
|
||||
resources:
|
||||
- netbootdeployments
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- build.kairos.io
|
||||
resources:
|
||||
- netbootdeployments/status
|
||||
verbs:
|
||||
- get
|
||||
20
config/rbac/netbootdeployment_viewer_role.yaml
Normal file
20
config/rbac/netbootdeployment_viewer_role.yaml
Normal file
@@ -0,0 +1,20 @@
|
||||
# permissions for end users to view netbootdeployments.
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: netbootdeployment-viewer-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- build.kairos.io
|
||||
resources:
|
||||
- netbootdeployments
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- build.kairos.io
|
||||
resources:
|
||||
- netbootdeployments/status
|
||||
verbs:
|
||||
- get
|
||||
@@ -5,31 +5,6 @@ metadata:
|
||||
creationTimestamp: null
|
||||
name: manager-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- serviceaccounts
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- "rbac.authorization.k8s.io"
|
||||
resources:
|
||||
- roles
|
||||
- rolebindings
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- build.kairos.io
|
||||
resources:
|
||||
@@ -65,30 +40,17 @@ rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- create
|
||||
- update
|
||||
- apiGroups:
|
||||
- "batch"
|
||||
- "apps"
|
||||
resources:
|
||||
- jobs
|
||||
- deployments
|
||||
verbs:
|
||||
- get
|
||||
- create
|
||||
- update
|
||||
# Temporary so that it can grant these permissions to the created role
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- list
|
||||
- get
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods/exec
|
||||
verbs:
|
||||
- create
|
||||
|
||||
6
config/samples/build_v1alpha1_netbootdeployment.yaml
Normal file
6
config/samples/build_v1alpha1_netbootdeployment.yaml
Normal file
@@ -0,0 +1,6 @@
|
||||
apiVersion: build.kairos.io/v1alpha1
|
||||
kind: NetbootDeployment
|
||||
metadata:
|
||||
name: netbootdeployment-sample
|
||||
spec:
|
||||
# TODO(user): Add fields here
|
||||
@@ -1,4 +1,5 @@
|
||||
## Append samples you want in your CSV to this file as resources ##
|
||||
resources:
|
||||
- build_v1alpha1_osartifact.yaml
|
||||
- build_v1alpha1_netbootdeployment.yaml
|
||||
#+kubebuilder:scaffold:manifestskustomizesamples
|
||||
|
||||
338
controllers/deployment.go
Normal file
338
controllers/deployment.go
Normal file
@@ -0,0 +1,338 @@
|
||||
/*
|
||||
Copyright 2022.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package controllers
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
|
||||
buildv1alpha1 "github.com/kairos-io/osbuilder/api/v1alpha1"
|
||||
appsv1 "k8s.io/api/apps/v1"
|
||||
v1 "k8s.io/api/core/v1"
|
||||
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
)
|
||||
|
||||
func genDeploymentLabel(s string) map[string]string {
|
||||
return map[string]string{
|
||||
"osbuild": "workload" + s,
|
||||
}
|
||||
}
|
||||
|
||||
// TODO: Handle registry auth
|
||||
// TODO: This shells out, but needs ENV_VAR with key refs mapping
|
||||
func unpackContainer(id, containerImage, pullImage string, pullOptions buildv1alpha1.Pull) v1.Container {
|
||||
return v1.Container{
|
||||
ImagePullPolicy: v1.PullAlways,
|
||||
Name: fmt.Sprintf("pull-image-%s", id),
|
||||
Image: containerImage,
|
||||
Command: []string{"/bin/bash", "-cxe"},
|
||||
Args: []string{
|
||||
fmt.Sprintf(
|
||||
"luet util unpack %s %s",
|
||||
pullImage,
|
||||
"/rootfs",
|
||||
),
|
||||
},
|
||||
VolumeMounts: []v1.VolumeMount{
|
||||
{
|
||||
Name: "rootfs",
|
||||
MountPath: "/rootfs",
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func createImageContainer(containerImage string, pushOptions buildv1alpha1.Push) v1.Container {
|
||||
return v1.Container{
|
||||
ImagePullPolicy: v1.PullAlways,
|
||||
Name: "create-image",
|
||||
Image: containerImage,
|
||||
Command: []string{"/bin/bash", "-cxe"},
|
||||
Args: []string{
|
||||
fmt.Sprintf(
|
||||
"tar -czvpf test.tar -C /rootfs . && luet util pack %s test.tar image.tar && mv image.tar /public",
|
||||
pushOptions.ImageName,
|
||||
),
|
||||
},
|
||||
VolumeMounts: []v1.VolumeMount{
|
||||
{
|
||||
Name: "rootfs",
|
||||
MountPath: "/rootfs",
|
||||
},
|
||||
{
|
||||
Name: "public",
|
||||
MountPath: "/public",
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func osReleaseContainer(containerImage string) v1.Container {
|
||||
return v1.Container{
|
||||
ImagePullPolicy: v1.PullAlways,
|
||||
Name: "os-release",
|
||||
Image: containerImage,
|
||||
Command: []string{"/bin/bash", "-cxe"},
|
||||
Args: []string{
|
||||
"cp -rfv /etc/os-release /rootfs/etc/os-release",
|
||||
},
|
||||
VolumeMounts: []v1.VolumeMount{
|
||||
{
|
||||
Name: "config",
|
||||
MountPath: "/etc/os-release",
|
||||
SubPath: "os-release",
|
||||
},
|
||||
{
|
||||
Name: "rootfs",
|
||||
MountPath: "/rootfs",
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func (r *OSArtifactReconciler) genDeployment(artifact buildv1alpha1.OSArtifact, svc *v1.Service) *appsv1.Deployment {
|
||||
// TODO: svc is unused, but could be used in the future to generate the Netboot URL
|
||||
objMeta := metav1.ObjectMeta{
|
||||
Name: artifact.Name,
|
||||
Namespace: artifact.Namespace,
|
||||
OwnerReferences: genOwner(artifact),
|
||||
}
|
||||
|
||||
pushImage := artifact.Spec.PushOptions.Push
|
||||
|
||||
privileged := false
|
||||
serviceAccount := false
|
||||
|
||||
cmd := fmt.Sprintf(
|
||||
"/entrypoint.sh --debug --name %s build-iso --date=false --output /public dir:/rootfs",
|
||||
artifact.Name,
|
||||
)
|
||||
|
||||
volumeMounts := []v1.VolumeMount{
|
||||
{
|
||||
Name: "public",
|
||||
MountPath: "/public",
|
||||
},
|
||||
{
|
||||
Name: "rootfs",
|
||||
MountPath: "/rootfs",
|
||||
},
|
||||
}
|
||||
|
||||
if artifact.Spec.GRUBConfig != "" {
|
||||
volumeMounts = append(volumeMounts, v1.VolumeMount{
|
||||
Name: "config",
|
||||
MountPath: "/iso/iso-overlay/boot/grub2/grub.cfg",
|
||||
SubPath: "grub.cfg",
|
||||
})
|
||||
}
|
||||
|
||||
cloudImgCmd := fmt.Sprintf(
|
||||
"/raw-images.sh /rootfs /public/%s.raw",
|
||||
artifact.Name,
|
||||
)
|
||||
|
||||
if artifact.Spec.CloudConfig != "" {
|
||||
volumeMounts = append(volumeMounts, v1.VolumeMount{
|
||||
Name: "config",
|
||||
MountPath: "/iso/iso-overlay/cloud_config.yaml",
|
||||
SubPath: "config",
|
||||
})
|
||||
|
||||
cloudImgCmd += " /iso/iso-overlay/cloud_config.yaml"
|
||||
}
|
||||
|
||||
if artifact.Spec.CloudConfig != "" || artifact.Spec.GRUBConfig != "" {
|
||||
cmd = fmt.Sprintf(
|
||||
"/entrypoint.sh --debug --name %s build-iso --date=false --overlay-iso /iso/iso-overlay --output /public dir:/rootfs",
|
||||
artifact.Name,
|
||||
)
|
||||
}
|
||||
|
||||
buildIsoContainer := v1.Container{
|
||||
ImagePullPolicy: v1.PullAlways,
|
||||
SecurityContext: &v1.SecurityContext{Privileged: &privileged},
|
||||
Name: "build-iso",
|
||||
Image: r.ToolImage,
|
||||
Command: []string{"/bin/bash", "-cxe"},
|
||||
Args: []string{
|
||||
cmd,
|
||||
},
|
||||
VolumeMounts: volumeMounts,
|
||||
}
|
||||
|
||||
buildCloudImageContainer := v1.Container{
|
||||
ImagePullPolicy: v1.PullAlways,
|
||||
SecurityContext: &v1.SecurityContext{Privileged: &privileged},
|
||||
Name: "build-cloud-image",
|
||||
Image: r.ToolImage,
|
||||
|
||||
Command: []string{"/bin/bash", "-cxe"},
|
||||
Args: []string{
|
||||
cloudImgCmd,
|
||||
},
|
||||
VolumeMounts: volumeMounts,
|
||||
}
|
||||
|
||||
if artifact.Spec.DiskSize != "" {
|
||||
buildCloudImageContainer.Env = []v1.EnvVar{{
|
||||
Name: "EXTEND",
|
||||
Value: artifact.Spec.DiskSize,
|
||||
}}
|
||||
}
|
||||
|
||||
extractNetboot := v1.Container{
|
||||
ImagePullPolicy: v1.PullAlways,
|
||||
SecurityContext: &v1.SecurityContext{Privileged: &privileged},
|
||||
Name: "build-netboot",
|
||||
Image: r.ToolImage,
|
||||
Command: []string{"/bin/bash", "-cxe"},
|
||||
Env: []v1.EnvVar{{
|
||||
Name: "URL",
|
||||
Value: artifact.Spec.NetbootURL,
|
||||
}},
|
||||
Args: []string{
|
||||
fmt.Sprintf(
|
||||
"/netboot.sh /public/%s.iso /public/%s",
|
||||
artifact.Name,
|
||||
artifact.Name,
|
||||
),
|
||||
},
|
||||
VolumeMounts: volumeMounts,
|
||||
}
|
||||
|
||||
buildAzureCloudImageContainer := v1.Container{
|
||||
ImagePullPolicy: v1.PullAlways,
|
||||
SecurityContext: &v1.SecurityContext{Privileged: &privileged},
|
||||
Name: "build-azure-cloud-image",
|
||||
Image: r.ToolImage,
|
||||
Command: []string{"/bin/bash", "-cxe"},
|
||||
Args: []string{
|
||||
fmt.Sprintf(
|
||||
"/azure.sh /public/%s.raw /public/%s.vhd",
|
||||
artifact.Name,
|
||||
artifact.Name,
|
||||
),
|
||||
},
|
||||
VolumeMounts: volumeMounts,
|
||||
}
|
||||
|
||||
buildGCECloudImageContainer := v1.Container{
|
||||
ImagePullPolicy: v1.PullAlways,
|
||||
SecurityContext: &v1.SecurityContext{Privileged: &privileged},
|
||||
Name: "build-gce-cloud-image",
|
||||
Image: r.ToolImage,
|
||||
Command: []string{"/bin/bash", "-cxe"},
|
||||
Args: []string{
|
||||
fmt.Sprintf(
|
||||
"/gce.sh /public/%s.raw /public/%s.gce.raw",
|
||||
artifact.Name,
|
||||
artifact.Name,
|
||||
),
|
||||
},
|
||||
VolumeMounts: volumeMounts,
|
||||
}
|
||||
|
||||
servingContainer := v1.Container{
|
||||
ImagePullPolicy: v1.PullAlways,
|
||||
SecurityContext: &v1.SecurityContext{Privileged: &privileged},
|
||||
Name: "serve",
|
||||
Ports: []v1.ContainerPort{v1.ContainerPort{Name: "http", ContainerPort: 80}},
|
||||
Image: r.ServingImage,
|
||||
VolumeMounts: []v1.VolumeMount{
|
||||
{
|
||||
Name: "public",
|
||||
MountPath: "/usr/share/nginx/html",
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
pod := v1.PodSpec{
|
||||
AutomountServiceAccountToken: &serviceAccount,
|
||||
Volumes: []v1.Volume{
|
||||
{
|
||||
Name: "public",
|
||||
VolumeSource: v1.VolumeSource{EmptyDir: &v1.EmptyDirVolumeSource{}},
|
||||
},
|
||||
{
|
||||
Name: "rootfs",
|
||||
VolumeSource: v1.VolumeSource{EmptyDir: &v1.EmptyDirVolumeSource{}},
|
||||
},
|
||||
{
|
||||
Name: "config",
|
||||
VolumeSource: v1.VolumeSource{
|
||||
ConfigMap: &v1.ConfigMapVolumeSource{
|
||||
LocalObjectReference: v1.LocalObjectReference{Name: artifact.Name}}},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
pod.InitContainers = []v1.Container{unpackContainer("baseimage", r.ToolImage, artifact.Spec.ImageName, artifact.Spec.PullOptions)}
|
||||
|
||||
for i, bundle := range artifact.Spec.Bundles {
|
||||
pod.InitContainers = append(pod.InitContainers, unpackContainer(fmt.Sprint(i), r.ToolImage, bundle, artifact.Spec.PullOptions))
|
||||
}
|
||||
|
||||
if artifact.Spec.OSRelease != "" {
|
||||
pod.InitContainers = append(pod.InitContainers, osReleaseContainer(r.ToolImage))
|
||||
|
||||
}
|
||||
|
||||
if artifact.Spec.ISO || artifact.Spec.Netboot {
|
||||
pod.InitContainers = append(pod.InitContainers, buildIsoContainer)
|
||||
}
|
||||
|
||||
if artifact.Spec.Netboot {
|
||||
pod.InitContainers = append(pod.InitContainers, extractNetboot)
|
||||
}
|
||||
|
||||
if artifact.Spec.CloudImage || artifact.Spec.AzureImage || artifact.Spec.GCEImage {
|
||||
pod.InitContainers = append(pod.InitContainers, buildCloudImageContainer)
|
||||
}
|
||||
|
||||
if artifact.Spec.AzureImage {
|
||||
pod.InitContainers = append(pod.InitContainers, buildAzureCloudImageContainer)
|
||||
}
|
||||
|
||||
if artifact.Spec.GCEImage {
|
||||
pod.InitContainers = append(pod.InitContainers, buildGCECloudImageContainer)
|
||||
}
|
||||
|
||||
if pushImage {
|
||||
pod.InitContainers = append(pod.InitContainers, createImageContainer(r.ToolImage, artifact.Spec.PushOptions))
|
||||
}
|
||||
|
||||
pod.Containers = []v1.Container{servingContainer}
|
||||
|
||||
deploymentLabels := genDeploymentLabel(artifact.Name)
|
||||
replicas := int32(1)
|
||||
|
||||
return &appsv1.Deployment{
|
||||
ObjectMeta: objMeta,
|
||||
|
||||
Spec: appsv1.DeploymentSpec{
|
||||
Selector: &metav1.LabelSelector{MatchLabels: deploymentLabels},
|
||||
Replicas: &replicas,
|
||||
Template: v1.PodTemplateSpec{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Labels: deploymentLabels,
|
||||
},
|
||||
Spec: pod,
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
@@ -1,533 +0,0 @@
|
||||
/*
|
||||
Copyright 2022.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package controllers
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"fmt"
|
||||
|
||||
buildv1alpha1 "github.com/kairos-io/osbuilder/api/v1alpha1"
|
||||
"github.com/pkg/errors"
|
||||
batchv1 "k8s.io/api/batch/v1"
|
||||
v1 "k8s.io/api/core/v1"
|
||||
rbacv1 "k8s.io/api/rbac/v1"
|
||||
|
||||
apierrors "k8s.io/apimachinery/pkg/api/errors"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
|
||||
"k8s.io/client-go/kubernetes/scheme"
|
||||
"k8s.io/client-go/tools/remotecommand"
|
||||
)
|
||||
|
||||
func genJobLabel(s string) map[string]string {
|
||||
return map[string]string{
|
||||
"osbuild": "workload" + s,
|
||||
}
|
||||
}
|
||||
|
||||
// TODO: Handle registry auth
|
||||
// TODO: This shells out, but needs ENV_VAR with key refs mapping
|
||||
// TODO: Cache downloaded images?
|
||||
func unpackContainer(id, containerImage, pullImage string, pullOptions buildv1alpha1.Pull) v1.Container {
|
||||
return v1.Container{
|
||||
ImagePullPolicy: v1.PullAlways,
|
||||
Name: fmt.Sprintf("pull-image-%s", id),
|
||||
Image: containerImage,
|
||||
Command: []string{"/bin/bash", "-cxe"},
|
||||
Args: []string{
|
||||
fmt.Sprintf(
|
||||
"luet util unpack %s %s",
|
||||
pullImage,
|
||||
"/rootfs",
|
||||
),
|
||||
},
|
||||
VolumeMounts: []v1.VolumeMount{
|
||||
{
|
||||
Name: "rootfs",
|
||||
MountPath: "/rootfs",
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func pushImageName(artifact buildv1alpha1.OSArtifact) string {
|
||||
pushName := artifact.Spec.PushOptions.ImageName
|
||||
if pushName != "" {
|
||||
return pushName
|
||||
}
|
||||
return artifact.Name
|
||||
}
|
||||
|
||||
func createImageContainer(containerImage string, artifact buildv1alpha1.OSArtifact) v1.Container {
|
||||
imageName := pushImageName(artifact)
|
||||
|
||||
return v1.Container{
|
||||
ImagePullPolicy: v1.PullAlways,
|
||||
Name: "create-image",
|
||||
Image: containerImage,
|
||||
Command: []string{"/bin/bash", "-cxe"},
|
||||
Args: []string{
|
||||
fmt.Sprintf(
|
||||
"tar -czvpf test.tar -C /rootfs . && luet util pack %[1]s test.tar %[2]s.tar && chmod +r %[2]s.tar && mv %[2]s.tar /artifacts",
|
||||
imageName,
|
||||
artifact.Name,
|
||||
),
|
||||
},
|
||||
VolumeMounts: []v1.VolumeMount{
|
||||
{
|
||||
Name: "rootfs",
|
||||
MountPath: "/rootfs",
|
||||
},
|
||||
{
|
||||
Name: "artifacts",
|
||||
MountPath: "/artifacts",
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func createPushToServerImageContainer(containerImage string, artifactPodInfo ArtifactPodInfo) v1.Container {
|
||||
command := fmt.Sprintf("tar cf - -C artifacts/ . | kubectl exec -i -n %s $(kubectl get pods -l %s -n %s --no-headers -o custom-columns=\":metadata.name\" | head -n1) -- tar xf - -C %s", artifactPodInfo.Namespace, artifactPodInfo.Label, artifactPodInfo.Namespace, artifactPodInfo.Path)
|
||||
fmt.Printf("command = %+v\n", command)
|
||||
|
||||
return v1.Container{
|
||||
ImagePullPolicy: v1.PullAlways,
|
||||
Name: "push-to-server",
|
||||
Image: containerImage,
|
||||
Command: []string{"/bin/bash", "-cxe"},
|
||||
Args: []string{command},
|
||||
VolumeMounts: []v1.VolumeMount{
|
||||
{
|
||||
Name: "rootfs",
|
||||
MountPath: "/rootfs",
|
||||
},
|
||||
{
|
||||
Name: "artifacts",
|
||||
MountPath: "/artifacts",
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func osReleaseContainer(containerImage string) v1.Container {
|
||||
return v1.Container{
|
||||
ImagePullPolicy: v1.PullAlways,
|
||||
Name: "os-release",
|
||||
Image: containerImage,
|
||||
Command: []string{"/bin/bash", "-cxe"},
|
||||
Args: []string{
|
||||
"cp -rfv /etc/os-release /rootfs/etc/os-release",
|
||||
},
|
||||
VolumeMounts: []v1.VolumeMount{
|
||||
{
|
||||
Name: "config",
|
||||
MountPath: "/etc/os-release",
|
||||
SubPath: "os-release",
|
||||
},
|
||||
{
|
||||
Name: "rootfs",
|
||||
MountPath: "/rootfs",
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func (r *OSArtifactReconciler) genJob(artifact buildv1alpha1.OSArtifact) *batchv1.Job {
|
||||
objMeta := genObjectMeta(artifact)
|
||||
|
||||
privileged := false
|
||||
serviceAccount := true
|
||||
|
||||
cmd := fmt.Sprintf(
|
||||
"/entrypoint.sh --debug --name %s build-iso --date=false --output /artifacts dir:/rootfs",
|
||||
artifact.Name,
|
||||
)
|
||||
|
||||
volumeMounts := []v1.VolumeMount{
|
||||
{
|
||||
Name: "artifacts",
|
||||
MountPath: "/artifacts",
|
||||
},
|
||||
{
|
||||
Name: "rootfs",
|
||||
MountPath: "/rootfs",
|
||||
},
|
||||
}
|
||||
|
||||
if artifact.Spec.GRUBConfig != "" {
|
||||
volumeMounts = append(volumeMounts, v1.VolumeMount{
|
||||
Name: "config",
|
||||
MountPath: "/iso/iso-overlay/boot/grub2/grub.cfg",
|
||||
SubPath: "grub.cfg",
|
||||
})
|
||||
}
|
||||
|
||||
cloudImgCmd := fmt.Sprintf(
|
||||
"/raw-images.sh /rootfs /artifacts/%s.raw",
|
||||
artifact.Name,
|
||||
)
|
||||
|
||||
if artifact.Spec.CloudConfig != "" {
|
||||
volumeMounts = append(volumeMounts, v1.VolumeMount{
|
||||
Name: "config",
|
||||
MountPath: "/iso/iso-overlay/cloud_config.yaml",
|
||||
SubPath: "config",
|
||||
})
|
||||
|
||||
cloudImgCmd += " /iso/iso-overlay/cloud_config.yaml"
|
||||
}
|
||||
|
||||
if artifact.Spec.CloudConfig != "" || artifact.Spec.GRUBConfig != "" {
|
||||
cmd = fmt.Sprintf(
|
||||
"/entrypoint.sh --debug --name %s build-iso --date=false --overlay-iso /iso/iso-overlay --output /artifacts dir:/rootfs",
|
||||
artifact.Name,
|
||||
)
|
||||
}
|
||||
|
||||
buildIsoContainer := v1.Container{
|
||||
ImagePullPolicy: v1.PullAlways,
|
||||
SecurityContext: &v1.SecurityContext{Privileged: &privileged},
|
||||
Name: "build-iso",
|
||||
Image: r.ToolImage,
|
||||
Command: []string{"/bin/bash", "-cxe"},
|
||||
Args: []string{
|
||||
cmd,
|
||||
},
|
||||
VolumeMounts: volumeMounts,
|
||||
}
|
||||
|
||||
buildCloudImageContainer := v1.Container{
|
||||
ImagePullPolicy: v1.PullAlways,
|
||||
SecurityContext: &v1.SecurityContext{Privileged: &privileged},
|
||||
Name: "build-cloud-image",
|
||||
Image: r.ToolImage,
|
||||
|
||||
Command: []string{"/bin/bash", "-cxe"},
|
||||
Args: []string{
|
||||
cloudImgCmd,
|
||||
},
|
||||
VolumeMounts: volumeMounts,
|
||||
}
|
||||
|
||||
if artifact.Spec.DiskSize != "" {
|
||||
buildCloudImageContainer.Env = []v1.EnvVar{{
|
||||
Name: "EXTEND",
|
||||
Value: artifact.Spec.DiskSize,
|
||||
}}
|
||||
}
|
||||
|
||||
extractNetboot := v1.Container{
|
||||
ImagePullPolicy: v1.PullAlways,
|
||||
SecurityContext: &v1.SecurityContext{Privileged: &privileged},
|
||||
Name: "build-netboot",
|
||||
Image: r.ToolImage,
|
||||
Command: []string{"/bin/bash", "-cxe"},
|
||||
Env: []v1.EnvVar{{
|
||||
Name: "URL",
|
||||
Value: artifact.Spec.NetbootURL,
|
||||
}},
|
||||
Args: []string{
|
||||
fmt.Sprintf(
|
||||
"/netboot.sh /artifacts/%s.iso /artifacts/%s",
|
||||
artifact.Name,
|
||||
artifact.Name,
|
||||
),
|
||||
},
|
||||
VolumeMounts: volumeMounts,
|
||||
}
|
||||
|
||||
buildAzureCloudImageContainer := v1.Container{
|
||||
ImagePullPolicy: v1.PullAlways,
|
||||
SecurityContext: &v1.SecurityContext{Privileged: &privileged},
|
||||
Name: "build-azure-cloud-image",
|
||||
Image: r.ToolImage,
|
||||
Command: []string{"/bin/bash", "-cxe"},
|
||||
Args: []string{
|
||||
fmt.Sprintf(
|
||||
"/azure.sh /artifacts/%s.raw /artifacts/%s.vhd",
|
||||
artifact.Name,
|
||||
artifact.Name,
|
||||
),
|
||||
},
|
||||
VolumeMounts: volumeMounts,
|
||||
}
|
||||
|
||||
buildGCECloudImageContainer := v1.Container{
|
||||
ImagePullPolicy: v1.PullAlways,
|
||||
SecurityContext: &v1.SecurityContext{Privileged: &privileged},
|
||||
Name: "build-gce-cloud-image",
|
||||
Image: r.ToolImage,
|
||||
Command: []string{"/bin/bash", "-cxe"},
|
||||
Args: []string{
|
||||
fmt.Sprintf(
|
||||
"/gce.sh /artifacts/%s.raw /artifacts/%s.gce.raw",
|
||||
artifact.Name,
|
||||
artifact.Name,
|
||||
),
|
||||
},
|
||||
VolumeMounts: volumeMounts,
|
||||
}
|
||||
|
||||
pod := v1.PodSpec{
|
||||
AutomountServiceAccountToken: &serviceAccount,
|
||||
ServiceAccountName: objMeta.Name,
|
||||
RestartPolicy: v1.RestartPolicyNever,
|
||||
Volumes: []v1.Volume{
|
||||
{
|
||||
Name: "artifacts",
|
||||
VolumeSource: v1.VolumeSource{EmptyDir: &v1.EmptyDirVolumeSource{}},
|
||||
},
|
||||
{
|
||||
Name: "rootfs",
|
||||
VolumeSource: v1.VolumeSource{EmptyDir: &v1.EmptyDirVolumeSource{}},
|
||||
},
|
||||
{
|
||||
Name: "config",
|
||||
VolumeSource: v1.VolumeSource{
|
||||
ConfigMap: &v1.ConfigMapVolumeSource{
|
||||
LocalObjectReference: v1.LocalObjectReference{Name: artifact.Name}}},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
pod.InitContainers = []v1.Container{unpackContainer("baseimage", r.ToolImage, artifact.Spec.ImageName, artifact.Spec.PullOptions)}
|
||||
|
||||
for i, bundle := range artifact.Spec.Bundles {
|
||||
pod.InitContainers = append(pod.InitContainers, unpackContainer(fmt.Sprint(i), r.ToolImage, bundle, artifact.Spec.PullOptions))
|
||||
}
|
||||
|
||||
if artifact.Spec.OSRelease != "" {
|
||||
pod.InitContainers = append(pod.InitContainers, osReleaseContainer(r.ToolImage))
|
||||
}
|
||||
|
||||
if artifact.Spec.ISO || artifact.Spec.Netboot {
|
||||
pod.InitContainers = append(pod.InitContainers, buildIsoContainer)
|
||||
}
|
||||
|
||||
if artifact.Spec.Netboot {
|
||||
pod.InitContainers = append(pod.InitContainers, extractNetboot)
|
||||
}
|
||||
|
||||
if artifact.Spec.CloudImage || artifact.Spec.AzureImage || artifact.Spec.GCEImage {
|
||||
pod.InitContainers = append(pod.InitContainers, buildCloudImageContainer)
|
||||
}
|
||||
|
||||
if artifact.Spec.AzureImage {
|
||||
pod.InitContainers = append(pod.InitContainers, buildAzureCloudImageContainer)
|
||||
}
|
||||
|
||||
if artifact.Spec.GCEImage {
|
||||
pod.InitContainers = append(pod.InitContainers, buildGCECloudImageContainer)
|
||||
}
|
||||
|
||||
pod.InitContainers = append(pod.InitContainers, createImageContainer(r.ToolImage, artifact))
|
||||
|
||||
pod.Containers = []v1.Container{
|
||||
createPushToServerImageContainer(r.CopierImage, r.ArtifactPodInfo),
|
||||
}
|
||||
|
||||
jobLabels := genJobLabel(artifact.Name)
|
||||
|
||||
job := batchv1.Job{
|
||||
ObjectMeta: objMeta,
|
||||
Spec: batchv1.JobSpec{
|
||||
Template: v1.PodTemplateSpec{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Labels: jobLabels,
|
||||
},
|
||||
Spec: pod,
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
return &job
|
||||
}
|
||||
|
||||
// createServiceAccount creates a service account that has the permissions to
|
||||
// copy the artifacts to the http server Pod. This service account is used for
|
||||
// the "push to server" container.
|
||||
func (r *OSArtifactReconciler) createCopierServiceAccount(ctx context.Context, objMeta metav1.ObjectMeta) error {
|
||||
sa, err := r.clientSet.CoreV1().
|
||||
ServiceAccounts(objMeta.Namespace).Get(ctx, objMeta.Name, metav1.GetOptions{})
|
||||
if sa == nil || apierrors.IsNotFound(err) {
|
||||
t := true
|
||||
_, err := r.clientSet.CoreV1().ServiceAccounts(objMeta.Namespace).Create(ctx,
|
||||
&v1.ServiceAccount{
|
||||
ObjectMeta: objMeta,
|
||||
AutomountServiceAccountToken: &t,
|
||||
}, metav1.CreateOptions{})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
return err
|
||||
}
|
||||
|
||||
// func (r *OSArtifactReconciler) createCopierRole(ctx context.Context, objMeta metav1.ObjectMeta) error {
|
||||
// role, err := r.clientSet.RbacV1().
|
||||
// Roles(objMeta.Namespace).
|
||||
// Get(ctx, objMeta.Name, metav1.GetOptions{})
|
||||
// if role == nil || apierrors.IsNotFound(err) {
|
||||
// _, err := r.clientSet.RbacV1().Roles(objMeta.Namespace).Create(ctx,
|
||||
// &rbacv1.Role{
|
||||
// ObjectMeta: objMeta,
|
||||
// Rules: []rbacv1.PolicyRule{
|
||||
// // TODO: The actual permissions we need is that to copy to a Pod.
|
||||
// // The Pod is on another namespace, so we need a cluster wide permission.
|
||||
// // This can get viral because the controller needs to have the permissions
|
||||
// // if it is to grant them to the Job.
|
||||
// {
|
||||
// Verbs: []string{"list"},
|
||||
// APIGroups: []string{""},
|
||||
// Resources: []string{"pods"},
|
||||
// },
|
||||
// },
|
||||
// },
|
||||
// metav1.CreateOptions{},
|
||||
// )
|
||||
// if err != nil {
|
||||
// return err
|
||||
// }
|
||||
// }
|
||||
|
||||
// return err
|
||||
// }
|
||||
|
||||
func (r *OSArtifactReconciler) createCopierRoleBinding(ctx context.Context, objMeta metav1.ObjectMeta) error {
|
||||
newrb := &rbacv1.RoleBinding{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: objMeta.Name,
|
||||
Namespace: r.ArtifactPodInfo.Namespace,
|
||||
// TODO: We can't have cross-namespace owners. The role binding will have to deleted explicitly by the reconciler (finalizer?)
|
||||
// OwnerReferences: objMeta.OwnerReferences,
|
||||
},
|
||||
RoleRef: rbacv1.RoleRef{
|
||||
APIGroup: "rbac.authorization.k8s.io",
|
||||
Kind: "Role",
|
||||
Name: r.ArtifactPodInfo.Role,
|
||||
},
|
||||
Subjects: []rbacv1.Subject{
|
||||
{
|
||||
Kind: "ServiceAccount",
|
||||
Name: objMeta.Name,
|
||||
Namespace: objMeta.Namespace,
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
rb, err := r.clientSet.RbacV1().
|
||||
RoleBindings(r.ArtifactPodInfo.Namespace).
|
||||
Get(ctx, objMeta.Name, metav1.GetOptions{})
|
||||
if rb == nil || apierrors.IsNotFound(err) {
|
||||
_, err := r.clientSet.RbacV1().
|
||||
RoleBindings(r.ArtifactPodInfo.Namespace).
|
||||
Create(ctx, newrb, metav1.CreateOptions{})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
return err
|
||||
}
|
||||
|
||||
// createRBAC creates a ServiceAccount, and a binding to the CopierRole so that
|
||||
// the container that copies the artifacts to the http server Pod has the
|
||||
// permissions to do so.
|
||||
func (r *OSArtifactReconciler) createRBAC(ctx context.Context, artifact buildv1alpha1.OSArtifact) error {
|
||||
objMeta := genObjectMeta(artifact)
|
||||
|
||||
err := r.createCopierServiceAccount(ctx, objMeta)
|
||||
if err != nil {
|
||||
return errors.Wrap(err, "creating a service account")
|
||||
}
|
||||
|
||||
err = r.createCopierRoleBinding(ctx, objMeta)
|
||||
if err != nil {
|
||||
return errors.Wrap(err, "creating a role binding for the copy-role")
|
||||
}
|
||||
|
||||
return err
|
||||
}
|
||||
|
||||
// removeRBAC deletes the role binding between the service account of this artifact
|
||||
// and the CopierRole. The ServiceAccount is removed automatically through the Owner
|
||||
// relationship with the OSArtifact. The RoleBinding can't have it as an owner
|
||||
// because it is in a different Namespace.
|
||||
func (r *OSArtifactReconciler) removeRBAC(ctx context.Context, artifact buildv1alpha1.OSArtifact) error {
|
||||
err := r.clientSet.RbacV1().RoleBindings(r.ArtifactPodInfo.Namespace).
|
||||
Delete(ctx, artifact.Name, metav1.DeleteOptions{})
|
||||
// Ignore not found. No need to do anything.
|
||||
if err != nil && apierrors.IsNotFound(err) {
|
||||
return nil
|
||||
}
|
||||
|
||||
return err
|
||||
}
|
||||
|
||||
func (r *OSArtifactReconciler) removeArtifacts(ctx context.Context, artifact buildv1alpha1.OSArtifact) error {
|
||||
//Finding Pods using labels
|
||||
fmt.Printf("r.ArtifactPodInfo = %+v\n", r.ArtifactPodInfo.Label)
|
||||
pods, err := r.clientSet.CoreV1().Pods(r.ArtifactPodInfo.Namespace).
|
||||
List(ctx, metav1.ListOptions{LabelSelector: r.ArtifactPodInfo.Label})
|
||||
if err != nil {
|
||||
return errors.Wrap(err, fmt.Sprintf("listing pods with label %s in namespace %s", r.ArtifactPodInfo.Label, r.ArtifactPodInfo.Namespace))
|
||||
}
|
||||
if len(pods.Items) < 1 {
|
||||
return errors.New("No artifact pod found")
|
||||
}
|
||||
pod := pods.Items[0]
|
||||
|
||||
stdout, stderr, err := r.executeRemoteCommand(r.ArtifactPodInfo.Namespace, pod.Name, fmt.Sprintf("rm -rf %s/%s.*", r.ArtifactPodInfo.Path, artifact.Name))
|
||||
if err != nil {
|
||||
return errors.Wrap(err, fmt.Sprintf("%s\n%s", stdout, stderr))
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (r *OSArtifactReconciler) executeRemoteCommand(namespace, podName, command string) (string, string, error) {
|
||||
buf := &bytes.Buffer{}
|
||||
errBuf := &bytes.Buffer{}
|
||||
request := r.clientSet.CoreV1().RESTClient().
|
||||
Post().
|
||||
Namespace(namespace).
|
||||
Resource("pods").
|
||||
Name(podName).
|
||||
SubResource("exec").
|
||||
VersionedParams(&v1.PodExecOptions{
|
||||
Command: []string{"/bin/sh", "-c", command},
|
||||
Stdin: false,
|
||||
Stdout: true,
|
||||
Stderr: true,
|
||||
TTY: true,
|
||||
}, scheme.ParameterCodec)
|
||||
|
||||
exec, err := remotecommand.NewSPDYExecutor(r.restConfig, "POST", request.URL())
|
||||
if err != nil {
|
||||
return "", "", err
|
||||
}
|
||||
err = exec.Stream(remotecommand.StreamOptions{
|
||||
Stdout: buf,
|
||||
Stderr: errBuf,
|
||||
})
|
||||
if err != nil {
|
||||
return "", "", fmt.Errorf("%w Failed executing command %s on %v/%v", err, command, namespace, podName)
|
||||
}
|
||||
|
||||
return buf.String(), errBuf.String(), nil
|
||||
}
|
||||
99
controllers/netboot-deployment.go
Normal file
99
controllers/netboot-deployment.go
Normal file
@@ -0,0 +1,99 @@
|
||||
/*
|
||||
Copyright 2022.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package controllers
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
|
||||
buildv1alpha1 "github.com/kairos-io/osbuilder/api/v1alpha1"
|
||||
appsv1 "k8s.io/api/apps/v1"
|
||||
v1 "k8s.io/api/core/v1"
|
||||
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
)
|
||||
|
||||
func (r *NetbootDeploymentReconciler) genDeployment(artifact buildv1alpha1.NetbootDeployment) *appsv1.Deployment {
|
||||
// TODO: svc is unused, but could be used in the future to generate the Netboot URL
|
||||
objMeta := metav1.ObjectMeta{
|
||||
Name: artifact.Name,
|
||||
Namespace: artifact.Namespace,
|
||||
OwnerReferences: genNetbootOwner(artifact),
|
||||
}
|
||||
|
||||
privileged := false
|
||||
serviceAccount := false
|
||||
|
||||
servingContainer := v1.Container{
|
||||
ImagePullPolicy: v1.PullAlways,
|
||||
SecurityContext: &v1.SecurityContext{Privileged: &privileged},
|
||||
Name: "serve",
|
||||
Args: []string{
|
||||
|
||||
"boot",
|
||||
fmt.Sprintf(),
|
||||
fmt.Sprintf(),
|
||||
fmt.Sprintf(),
|
||||
},
|
||||
Image: r.Image,
|
||||
VolumeMounts: []v1.VolumeMount{
|
||||
{
|
||||
Name: "config",
|
||||
MountPath: "/files/config.yaml",
|
||||
SubPath: "cloudconfig",
|
||||
},
|
||||
},
|
||||
}
|
||||
// boot /files/kairos-core-opensuse-kernel /files/kairos-core-opensuse-initrd --cmdline='rd.neednet=1 ip=dhcp rd.cos.disable root=live:https://github.com/kairos-io/provider-kairos/releases/download/v1.2.0/kairos-alpine-ubuntu-v1.2.0-k3sv1.20.15+k3s1.squashfs netboot nodepair.enable config_url={{ ID "/files/config.yaml" }} console=tty1 console=ttyS0 console=tty0'
|
||||
pod := v1.PodSpec{
|
||||
HostNetwork: true,
|
||||
AutomountServiceAccountToken: &serviceAccount,
|
||||
Volumes: []v1.Volume{
|
||||
{
|
||||
Name: "config",
|
||||
VolumeSource: v1.VolumeSource{
|
||||
ConfigMap: &v1.ConfigMapVolumeSource{
|
||||
LocalObjectReference: v1.LocalObjectReference{Name: fmt.Sprintf("%s-netboot", artifact.Name)}}},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
pod.Containers = []v1.Container{servingContainer}
|
||||
|
||||
deploymentLabels := genNetDeploymentLabel(artifact.Name)
|
||||
replicas := int32(1)
|
||||
|
||||
return &appsv1.Deployment{
|
||||
ObjectMeta: objMeta,
|
||||
|
||||
Spec: appsv1.DeploymentSpec{
|
||||
Selector: &metav1.LabelSelector{MatchLabels: deploymentLabels},
|
||||
Replicas: &replicas,
|
||||
Template: v1.PodTemplateSpec{
|
||||
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Labels: deploymentLabels,
|
||||
},
|
||||
Spec: pod,
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
func genNetDeploymentLabel(s string) map[string]string {
|
||||
return map[string]string{
|
||||
"netboot": "serve" + s,
|
||||
}
|
||||
}
|
||||
145
controllers/netbootdeployment_controller.go
Normal file
145
controllers/netbootdeployment_controller.go
Normal file
@@ -0,0 +1,145 @@
|
||||
/*
|
||||
Copyright 2022.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package controllers
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
|
||||
v1 "k8s.io/api/core/v1"
|
||||
apierrors "k8s.io/apimachinery/pkg/api/errors"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/runtime"
|
||||
"k8s.io/apimachinery/pkg/runtime/schema"
|
||||
"k8s.io/client-go/kubernetes"
|
||||
ctrl "sigs.k8s.io/controller-runtime"
|
||||
"sigs.k8s.io/controller-runtime/pkg/client"
|
||||
"sigs.k8s.io/controller-runtime/pkg/log"
|
||||
|
||||
buildv1alpha1 "github.com/kairos-io/osbuilder/api/v1alpha1"
|
||||
)
|
||||
|
||||
// NetbootDeploymentReconciler reconciles a NetbootDeployment object
|
||||
type NetbootDeploymentReconciler struct {
|
||||
client.Client
|
||||
clientSet *kubernetes.Clientset
|
||||
|
||||
Image string
|
||||
Scheme *runtime.Scheme
|
||||
}
|
||||
|
||||
//+kubebuilder:rbac:groups=build.kairos.io,resources=netbootdeployments,verbs=get;list;watch;create;update;patch;delete
|
||||
//+kubebuilder:rbac:groups=build.kairos.io,resources=netbootdeployments/status,verbs=get;update;patch
|
||||
//+kubebuilder:rbac:groups=build.kairos.io,resources=netbootdeployments/finalizers,verbs=update
|
||||
|
||||
// Reconcile is part of the main kubernetes reconciliation loop which aims to
|
||||
// move the current state of the cluster closer to the desired state.
|
||||
// TODO(user): Modify the Reconcile function to compare the state specified by
|
||||
// the NetbootDeployment object against the actual cluster state, and then
|
||||
// perform operations to make the cluster state reflect the state specified by
|
||||
// the user.
|
||||
//
|
||||
// For more details, check Reconcile and its Result here:
|
||||
// - https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.12.2/pkg/reconcile
|
||||
func (r *NetbootDeploymentReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
|
||||
logger := log.FromContext(ctx)
|
||||
var netboot buildv1alpha1.NetbootDeployment
|
||||
if err := r.Get(ctx, req.NamespacedName, &netboot); err != nil {
|
||||
if apierrors.IsNotFound(err) {
|
||||
return ctrl.Result{}, nil
|
||||
}
|
||||
return ctrl.Result{}, err
|
||||
}
|
||||
|
||||
logger.Info(fmt.Sprintf("Reconciling %v", netboot))
|
||||
// generate configmap required for building a custom image
|
||||
desiredConfigMap := r.genConfigMap(netboot)
|
||||
logger.Info(fmt.Sprintf("Checking configmap %v", netboot))
|
||||
|
||||
cfgMap, err := r.clientSet.CoreV1().ConfigMaps(req.Namespace).Get(ctx, desiredConfigMap.Name, metav1.GetOptions{})
|
||||
if cfgMap == nil || apierrors.IsNotFound(err) {
|
||||
logger.Info(fmt.Sprintf("Creating service %v", desiredConfigMap))
|
||||
|
||||
cfgMap, err = r.clientSet.CoreV1().ConfigMaps(req.Namespace).Create(ctx, desiredConfigMap, metav1.CreateOptions{})
|
||||
if err != nil {
|
||||
logger.Error(err, "Failed while creating cfgmap")
|
||||
return ctrl.Result{}, err
|
||||
}
|
||||
return ctrl.Result{Requeue: true}, err
|
||||
}
|
||||
if err != nil {
|
||||
return ctrl.Result{Requeue: true}, err
|
||||
}
|
||||
|
||||
desiredDeployment := r.genDeployment(netboot)
|
||||
deployment, err := r.clientSet.AppsV1().Deployments(req.Namespace).Get(ctx, desiredDeployment.Name, metav1.GetOptions{})
|
||||
if deployment == nil || apierrors.IsNotFound(err) {
|
||||
logger.Info(fmt.Sprintf("Creating Deployment %v", deployment))
|
||||
|
||||
deployment, err = r.clientSet.AppsV1().Deployments(req.Namespace).Create(ctx, desiredDeployment, metav1.CreateOptions{})
|
||||
if err != nil {
|
||||
logger.Error(err, "Failed while creating deployment")
|
||||
return ctrl.Result{}, nil
|
||||
}
|
||||
|
||||
return ctrl.Result{Requeue: true}, nil
|
||||
}
|
||||
if err != nil {
|
||||
return ctrl.Result{Requeue: true}, err
|
||||
}
|
||||
|
||||
// TODO(user): your logic here
|
||||
|
||||
return ctrl.Result{}, nil
|
||||
}
|
||||
|
||||
// SetupWithManager sets up the controller with the Manager.
|
||||
func (r *NetbootDeploymentReconciler) SetupWithManager(mgr ctrl.Manager) error {
|
||||
|
||||
clientset, err := kubernetes.NewForConfig(mgr.GetConfig())
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
r.clientSet = clientset
|
||||
|
||||
return ctrl.NewControllerManagedBy(mgr).
|
||||
For(&buildv1alpha1.NetbootDeployment{}).
|
||||
Complete(r)
|
||||
}
|
||||
|
||||
func genNetbootOwner(artifact buildv1alpha1.NetbootDeployment) []metav1.OwnerReference {
|
||||
return []metav1.OwnerReference{
|
||||
*metav1.NewControllerRef(&artifact.ObjectMeta, schema.GroupVersionKind{
|
||||
Group: buildv1alpha1.GroupVersion.Group,
|
||||
Version: buildv1alpha1.GroupVersion.Version,
|
||||
Kind: "NetbootDeployment",
|
||||
}),
|
||||
}
|
||||
}
|
||||
|
||||
func (r *NetbootDeploymentReconciler) genConfigMap(artifact buildv1alpha1.NetbootDeployment) *v1.ConfigMap {
|
||||
return &v1.ConfigMap{
|
||||
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: fmt.Sprintf("%s-netboot", artifact.Name),
|
||||
Namespace: artifact.Namespace,
|
||||
OwnerReferences: genNetbootOwner(artifact),
|
||||
},
|
||||
Data: map[string]string{
|
||||
"cloudconfig": artifact.Spec.CloudConfig,
|
||||
}}
|
||||
}
|
||||
@@ -25,42 +25,22 @@ import (
|
||||
"github.com/pkg/errors"
|
||||
apierrors "k8s.io/apimachinery/pkg/api/errors"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/runtime"
|
||||
"k8s.io/apimachinery/pkg/runtime/schema"
|
||||
"k8s.io/client-go/kubernetes"
|
||||
"k8s.io/client-go/rest"
|
||||
"sigs.k8s.io/cluster-api/util/patch"
|
||||
ctrl "sigs.k8s.io/controller-runtime"
|
||||
"sigs.k8s.io/controller-runtime/pkg/client"
|
||||
"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
|
||||
"sigs.k8s.io/controller-runtime/pkg/log"
|
||||
)
|
||||
|
||||
const FinalizerName = "build.kairos.io/osbuilder-finalizer"
|
||||
|
||||
type ArtifactPodInfo struct {
|
||||
Label string
|
||||
Namespace string
|
||||
Path string
|
||||
Role string
|
||||
}
|
||||
|
||||
// OSArtifactReconciler reconciles a OSArtifact object
|
||||
type OSArtifactReconciler struct {
|
||||
client.Client
|
||||
Scheme *runtime.Scheme
|
||||
restConfig *rest.Config
|
||||
clientSet *kubernetes.Clientset
|
||||
ServingImage, ToolImage, CopierImage string
|
||||
ArtifactPodInfo ArtifactPodInfo
|
||||
}
|
||||
|
||||
func genObjectMeta(artifact buildv1alpha1.OSArtifact) metav1.ObjectMeta {
|
||||
return metav1.ObjectMeta{
|
||||
Name: artifact.Name,
|
||||
Namespace: artifact.Namespace,
|
||||
OwnerReferences: genOwner(artifact),
|
||||
}
|
||||
Scheme *runtime.Scheme
|
||||
clientSet *kubernetes.Clientset
|
||||
ServingImage, ToolImage string
|
||||
}
|
||||
|
||||
func genOwner(artifact buildv1alpha1.OSArtifact) []metav1.OwnerReference {
|
||||
@@ -77,12 +57,6 @@ func genOwner(artifact buildv1alpha1.OSArtifact) []metav1.OwnerReference {
|
||||
//+kubebuilder:rbac:groups=build.kairos.io,resources=osartifacts/status,verbs=get;update;patch
|
||||
//+kubebuilder:rbac:groups=build.kairos.io,resources=osartifacts/finalizers,verbs=update
|
||||
|
||||
// TODO: Is this ^ how I should have created rbac permissions for the controller?
|
||||
// - git commit all changes
|
||||
// - generate code with kubebuilder
|
||||
// - check if my permissions were removed
|
||||
// - do it properly
|
||||
|
||||
// Reconcile is part of the main kubernetes reconciliation loop which aims to
|
||||
// move the current state of the cluster closer to the desired state.
|
||||
// TODO(user): Modify the Reconcile function to compare the state specified by
|
||||
@@ -105,22 +79,17 @@ func (r *OSArtifactReconciler) Reconcile(ctx context.Context, req ctrl.Request)
|
||||
|
||||
logger.Info(fmt.Sprintf("Reconciling %v", osbuild))
|
||||
|
||||
stop, err := r.handleFinalizer(ctx, &osbuild)
|
||||
if err != nil || stop {
|
||||
return ctrl.Result{}, err
|
||||
}
|
||||
|
||||
// generate configmap required for building a custom image
|
||||
desiredConfigMap := r.genConfigMap(osbuild)
|
||||
logger.Info(fmt.Sprintf("Checking configmap %v", osbuild))
|
||||
|
||||
cfgMap, err := r.clientSet.CoreV1().ConfigMaps(req.Namespace).Get(ctx, desiredConfigMap.Name, metav1.GetOptions{})
|
||||
cfgMap, err := r.clientSet.CoreV1().ConfigMaps(req.Namespace).Get(ctx, desiredConfigMap.Name, v1.GetOptions{})
|
||||
if cfgMap == nil || apierrors.IsNotFound(err) {
|
||||
logger.Info(fmt.Sprintf("Creating config map %v", desiredConfigMap))
|
||||
logger.Info(fmt.Sprintf("Creating service %v", desiredConfigMap))
|
||||
|
||||
_, err = r.clientSet.CoreV1().ConfigMaps(req.Namespace).Create(ctx, desiredConfigMap, metav1.CreateOptions{})
|
||||
cfgMap, err = r.clientSet.CoreV1().ConfigMaps(req.Namespace).Create(ctx, desiredConfigMap, v1.CreateOptions{})
|
||||
if err != nil {
|
||||
logger.Error(err, "Failed while creating config map")
|
||||
logger.Error(err, "Failed while creating svc")
|
||||
return ctrl.Result{}, err
|
||||
}
|
||||
return ctrl.Result{Requeue: true}, err
|
||||
@@ -129,21 +98,34 @@ func (r *OSArtifactReconciler) Reconcile(ctx context.Context, req ctrl.Request)
|
||||
return ctrl.Result{Requeue: true}, err
|
||||
}
|
||||
|
||||
logger.Info(fmt.Sprintf("Checking deployment %v", osbuild))
|
||||
desiredService := genService(osbuild)
|
||||
logger.Info(fmt.Sprintf("Checking service %v", osbuild))
|
||||
|
||||
err = r.createRBAC(ctx, osbuild)
|
||||
svc, err := r.clientSet.CoreV1().Services(req.Namespace).Get(ctx, desiredService.Name, v1.GetOptions{})
|
||||
if svc == nil || apierrors.IsNotFound(err) {
|
||||
logger.Info(fmt.Sprintf("Creating service %v", desiredService))
|
||||
|
||||
svc, err = r.clientSet.CoreV1().Services(req.Namespace).Create(ctx, desiredService, v1.CreateOptions{})
|
||||
if err != nil {
|
||||
logger.Error(err, "Failed while creating svc")
|
||||
return ctrl.Result{}, err
|
||||
}
|
||||
|
||||
return ctrl.Result{Requeue: true}, err
|
||||
}
|
||||
if err != nil {
|
||||
return ctrl.Result{Requeue: true}, err
|
||||
}
|
||||
logger.Info(fmt.Sprintf("Checking deployment %v", osbuild))
|
||||
|
||||
desiredJob := r.genJob(osbuild)
|
||||
job, err := r.clientSet.BatchV1().Jobs(req.Namespace).Get(ctx, desiredJob.Name, metav1.GetOptions{})
|
||||
if job == nil || apierrors.IsNotFound(err) {
|
||||
logger.Info(fmt.Sprintf("Creating Job %v", job))
|
||||
desiredDeployment := r.genDeployment(osbuild, svc)
|
||||
deployment, err := r.clientSet.AppsV1().Deployments(req.Namespace).Get(ctx, desiredDeployment.Name, v1.GetOptions{})
|
||||
if deployment == nil || apierrors.IsNotFound(err) {
|
||||
logger.Info(fmt.Sprintf("Creating Deployment %v", deployment))
|
||||
|
||||
_, err = r.clientSet.BatchV1().Jobs(req.Namespace).Create(ctx, desiredJob, metav1.CreateOptions{})
|
||||
deployment, err = r.clientSet.AppsV1().Deployments(req.Namespace).Create(ctx, desiredDeployment, v1.CreateOptions{})
|
||||
if err != nil {
|
||||
logger.Error(err, "Failed while creating job")
|
||||
logger.Error(err, "Failed while creating deployment")
|
||||
return ctrl.Result{}, nil
|
||||
}
|
||||
|
||||
@@ -161,7 +143,7 @@ func (r *OSArtifactReconciler) Reconcile(ctx context.Context, req ctrl.Request)
|
||||
if err != nil {
|
||||
return ctrl.Result{}, err
|
||||
}
|
||||
if job.Status.Succeeded > 0 {
|
||||
if deployment.Status.ReadyReplicas == deployment.Status.Replicas {
|
||||
copy.Status.Phase = "Ready"
|
||||
} else if copy.Status.Phase != "Building" {
|
||||
copy.Status.Phase = "Building"
|
||||
@@ -184,66 +166,13 @@ func (r *OSArtifactReconciler) Reconcile(ctx context.Context, req ctrl.Request)
|
||||
// SetupWithManager sets up the controller with the Manager.
|
||||
func (r *OSArtifactReconciler) SetupWithManager(mgr ctrl.Manager) error {
|
||||
|
||||
cfg := mgr.GetConfig()
|
||||
clientset, err := kubernetes.NewForConfig(cfg)
|
||||
clientset, err := kubernetes.NewForConfig(mgr.GetConfig())
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
r.restConfig = cfg
|
||||
r.clientSet = clientset
|
||||
|
||||
return ctrl.NewControllerManagedBy(mgr).
|
||||
For(&buildv1alpha1.OSArtifact{}).
|
||||
Complete(r)
|
||||
}
|
||||
|
||||
// Returns true if reconciliation should stop or false otherwise
|
||||
func (r *OSArtifactReconciler) handleFinalizer(ctx context.Context, osbuild *buildv1alpha1.OSArtifact) (bool, error) {
|
||||
// examine DeletionTimestamp to determine if object is under deletion
|
||||
if osbuild.DeletionTimestamp.IsZero() {
|
||||
// The object is not being deleted, so if it does not have our finalizer,
|
||||
// then lets add the finalizer and update the object. This is equivalent
|
||||
// registering our finalizer.
|
||||
if !controllerutil.ContainsFinalizer(osbuild, FinalizerName) {
|
||||
controllerutil.AddFinalizer(osbuild, FinalizerName)
|
||||
if err := r.Update(ctx, osbuild); err != nil {
|
||||
return true, err
|
||||
}
|
||||
}
|
||||
} else {
|
||||
// The object is being deleted
|
||||
if controllerutil.ContainsFinalizer(osbuild, FinalizerName) {
|
||||
// our finalizer is present, so lets handle any external dependency
|
||||
if err := r.finalize(ctx, osbuild); err != nil {
|
||||
// if fail to delete the external dependency here, return with error
|
||||
// so that it can be retried
|
||||
return true, err
|
||||
}
|
||||
|
||||
// remove our finalizer from the list and update it.
|
||||
controllerutil.RemoveFinalizer(osbuild, FinalizerName)
|
||||
if err := r.Update(ctx, osbuild); err != nil {
|
||||
return true, err
|
||||
}
|
||||
}
|
||||
|
||||
// Stop reconciliation as the item is being deleted
|
||||
return true, nil
|
||||
}
|
||||
|
||||
return false, nil
|
||||
}
|
||||
|
||||
// - Remove artifacts from the server Pod
|
||||
// - Delete role-binding (because it doesn't have the OSArtifact as an owner and won't be deleted automatically)
|
||||
func (r *OSArtifactReconciler) finalize(ctx context.Context, osbuild *buildv1alpha1.OSArtifact) error {
|
||||
if err := r.removeRBAC(ctx, *osbuild); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if err := r.removeArtifacts(ctx, *osbuild); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
39
controllers/service.go
Normal file
39
controllers/service.go
Normal file
@@ -0,0 +1,39 @@
|
||||
/*
|
||||
Copyright 2022.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package controllers
|
||||
|
||||
import (
|
||||
buildv1alpha1 "github.com/kairos-io/osbuilder/api/v1alpha1"
|
||||
v1 "k8s.io/api/core/v1"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
)
|
||||
|
||||
func genService(artifact buildv1alpha1.OSArtifact) *v1.Service {
|
||||
objMeta := metav1.ObjectMeta{
|
||||
Name: artifact.Name,
|
||||
Namespace: artifact.Namespace,
|
||||
OwnerReferences: genOwner(artifact),
|
||||
}
|
||||
return &v1.Service{
|
||||
ObjectMeta: objMeta,
|
||||
Spec: v1.ServiceSpec{
|
||||
Type: v1.ServiceTypeNodePort,
|
||||
Ports: []v1.ServicePort{{Name: "http", Port: int32(80)}},
|
||||
Selector: genDeploymentLabel(artifact.Name),
|
||||
},
|
||||
}
|
||||
}
|
||||
1
go.mod
1
go.mod
@@ -51,7 +51,6 @@ require (
|
||||
github.com/json-iterator/go v1.1.12 // indirect
|
||||
github.com/mailru/easyjson v0.7.6 // indirect
|
||||
github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
|
||||
github.com/moby/spdystream v0.2.0 // indirect
|
||||
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
||||
github.com/modern-go/reflect2 v1.0.2 // indirect
|
||||
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
||||
|
||||
6
go.sum
6
go.sum
@@ -82,7 +82,6 @@ github.com/antlr/antlr4/runtime/Go/antlr v0.0.0-20210826220005-b48c857c3a0e/go.m
|
||||
github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
|
||||
github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
|
||||
github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
|
||||
github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
|
||||
github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
|
||||
github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a h1:idn718Q4B6AGu/h5Sxe66HYVdqdGu2l9Iebqhi/AEoA=
|
||||
github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
|
||||
@@ -137,7 +136,6 @@ github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8
|
||||
github.com/docker/distribution v2.7.1+incompatible h1:a5mlkVzth6W5A4fOsS3D2EO5BUmsJpcB+cRlLU7cSug=
|
||||
github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
|
||||
github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
|
||||
github.com/elazarl/goproxy v0.0.0-20180725130230-947c36da3153 h1:yUdfgN0XgIJw7foRItutHYUIhlcKzcSf5vDpdhQAKTc=
|
||||
github.com/elazarl/goproxy v0.0.0-20180725130230-947c36da3153/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
|
||||
github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
|
||||
github.com/emicklei/go-restful v2.9.5+incompatible h1:spTtZBk5DYEvbxMVutUuTyh1Ao2r4iyvLdACqsl/Ljk=
|
||||
@@ -191,7 +189,6 @@ github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh
|
||||
github.com/go-openapi/swag v0.19.14 h1:gm3vOOXfiuw5i9p5N9xJvfjvuofpyvLA9Wr6QfK5Fng=
|
||||
github.com/go-openapi/swag v0.19.14/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ=
|
||||
github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
|
||||
github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 h1:p104kn46Q8WdvHunIJ9dAyjPVtrBPhSr3KT2yUst43I=
|
||||
github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
|
||||
github.com/gobuffalo/flect v0.2.4 h1:BSYA8+T60cdyq+vynaSUjqSVI9mDEg9ZfQUXKmfjo4I=
|
||||
github.com/gobuffalo/flect v0.2.4/go.mod h1:1ZyCLIbg0YD7sDkzvFdPoOydPtD8y9JQnrOROolUcM8=
|
||||
@@ -280,7 +277,6 @@ github.com/google/pprof v0.0.0-20210226084205-cbba55b83ad5/go.mod h1:kpwsk12EmLe
|
||||
github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
|
||||
github.com/google/pprof v0.0.0-20210601050228-01bbb1931b22/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
|
||||
github.com/google/pprof v0.0.0-20210609004039-a478d1d731e9/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
|
||||
github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 h1:K6RDEckDVWvDI9JAJYCmNdQXq6neHJOYx3V6jnqNEec=
|
||||
github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
|
||||
github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
|
||||
github.com/google/uuid v1.1.2 h1:EVhdT+1Kseyi1/pUmXKaFxYsDNy9RQYkMWRH68J/W7Y=
|
||||
@@ -377,7 +373,6 @@ github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh
|
||||
github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
|
||||
github.com/mitchellh/mapstructure v1.4.2 h1:6h7AQ0yhTcIsmFmnAwQls75jp2Gzs4iB8W7pjMO+rqo=
|
||||
github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
|
||||
github.com/moby/spdystream v0.2.0 h1:cjW1zVyyoiM0T7b6UoySUFqzXMoqRckQtXwGPiBhOM8=
|
||||
github.com/moby/spdystream v0.2.0/go.mod h1:f7i0iNDQJ059oMTcWxx8MA/zKFIuD/lY+0GqbN2Wy8c=
|
||||
github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6/go.mod h1:E2VnQOmVuvZB6UYnnDB0qG5Nq/1tD9acaOpo6xmt0Kw=
|
||||
github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
|
||||
@@ -831,7 +826,6 @@ golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
|
||||
golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
|
||||
golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
|
||||
golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
|
||||
golang.org/x/tools v0.1.10-0.20220218145154-897bd77cd717 h1:hI3jKY4Hpf63ns040onEbB3dAkR/H/P83hw1TG8dD3Y=
|
||||
golang.org/x/tools v0.1.10-0.20220218145154-897bd77cd717/go.mod h1:Uh6Zz+xoGYZom868N8YTex3t7RhtHDBrE8Gzo9bV56E=
|
||||
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
|
||||
28
main.go
28
main.go
@@ -52,22 +52,12 @@ func main() {
|
||||
var metricsAddr string
|
||||
var enableLeaderElection bool
|
||||
var probeAddr string
|
||||
var serveImage, toolImage, copierImage string
|
||||
var copyToPodLabel, copyToNamespace, copyToPath, copierRole string
|
||||
|
||||
var serveImage, toolImage string
|
||||
flag.StringVar(&metricsAddr, "metrics-bind-address", ":8080", "The address the metric endpoint binds to.")
|
||||
|
||||
flag.StringVar(&copierImage, "copier-image", "quay.io/kairos/kubectl", "The image that is used to copy artifacts to the server pod.")
|
||||
flag.StringVar(&serveImage, "serve-image", "nginx", "Serve image.")
|
||||
// It needs luet inside
|
||||
flag.StringVar(&toolImage, "tool-image", "quay.io/kairos/osbuilder-tools:latest", "Tool image.")
|
||||
|
||||
// Information on where to copy the artifacts
|
||||
flag.StringVar(©ToPodLabel, "copy-to-pod-label", "", "The label of the Pod to which artifacts should be copied.")
|
||||
flag.StringVar(©ToNamespace, "copy-to-namespace", "", "The namespace of the copy-to-pod-label Pod.")
|
||||
flag.StringVar(©ToPath, "copy-to-path", "", "The path under which to copy artifacts in the copy-to-pod-label Pod.")
|
||||
flag.StringVar(&copierRole, "copy-role", "", "The name or the Kubernetes Role that has the permissions to copy artifacts to the copy-to-pod-label Pod")
|
||||
|
||||
flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
|
||||
flag.BoolVar(&enableLeaderElection, "leader-elect", false,
|
||||
"Enable leader election for controller manager. "+
|
||||
@@ -108,18 +98,18 @@ func main() {
|
||||
Client: mgr.GetClient(),
|
||||
ServingImage: serveImage,
|
||||
ToolImage: toolImage,
|
||||
CopierImage: copierImage,
|
||||
ArtifactPodInfo: controllers.ArtifactPodInfo{
|
||||
Label: copyToPodLabel,
|
||||
Namespace: copyToNamespace,
|
||||
Path: copyToPath,
|
||||
Role: copierRole,
|
||||
},
|
||||
Scheme: mgr.GetScheme(),
|
||||
Scheme: mgr.GetScheme(),
|
||||
}).SetupWithManager(mgr); err != nil {
|
||||
setupLog.Error(err, "unable to create controller", "controller", "OSArtifact")
|
||||
os.Exit(1)
|
||||
}
|
||||
if err = (&controllers.NetbootDeploymentReconciler{
|
||||
Client: mgr.GetClient(),
|
||||
Scheme: mgr.GetScheme(),
|
||||
}).SetupWithManager(mgr); err != nil {
|
||||
setupLog.Error(err, "unable to create controller", "controller", "NetbootDeployment")
|
||||
os.Exit(1)
|
||||
}
|
||||
//+kubebuilder:scaffold:builder
|
||||
|
||||
if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {
|
||||
|
||||
@@ -1,6 +0,0 @@
|
||||
{
|
||||
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
||||
"extends": [
|
||||
"config:base"
|
||||
]
|
||||
}
|
||||
@@ -1,10 +1,6 @@
|
||||
package e2e_test
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"fmt"
|
||||
"os/exec"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
. "github.com/onsi/ginkgo/v2"
|
||||
@@ -24,91 +20,20 @@ var _ = Describe("ISO build test", func() {
|
||||
err := kubectl.Apply("", "../../tests/fixtures/simple.yaml")
|
||||
Expect(err).ToNot(HaveOccurred())
|
||||
|
||||
itHasTheCorrectImage()
|
||||
itHasTheCorrectLabels()
|
||||
itCopiesTheArtifacts()
|
||||
Eventually(func() string {
|
||||
b, _ := kubectl.GetData("default", "osartifacts", "hello-kairos", "jsonpath={.spec.imageName}")
|
||||
return string(b)
|
||||
}, 2*time.Minute, 2*time.Second).Should(Equal("quay.io/kairos/core-opensuse:latest"))
|
||||
|
||||
By("deleting the custom resource", func() {
|
||||
err = kubectl.New().Delete("osartifacts", "-n", "default", "hello-kairos")
|
||||
Expect(err).ToNot(HaveOccurred())
|
||||
})
|
||||
|
||||
itCleansUpRoleBindings()
|
||||
itDeletesTheArtifacts()
|
||||
Eventually(func() string {
|
||||
b, _ := kubectl.GetData("default", "deployments", "hello-kairos", "jsonpath={.spec.template.metadata.labels.osbuild}")
|
||||
return string(b)
|
||||
}, 2*time.Minute, 2*time.Second).Should(Equal("workloadhello-kairos"))
|
||||
Eventually(func() string {
|
||||
b, _ := kubectl.GetData("default", "deployments", "hello-kairos", "jsonpath={.spec.status.unavailableReplicas}")
|
||||
return string(b)
|
||||
}, 15*time.Minute, 2*time.Second).ShouldNot(Equal("1"))
|
||||
})
|
||||
})
|
||||
|
||||
})
|
||||
|
||||
func itHasTheCorrectImage() {
|
||||
Eventually(func() string {
|
||||
b, _ := kubectl.GetData("default", "osartifacts", "hello-kairos", "jsonpath={.spec.imageName}")
|
||||
fmt.Printf("looking for image core-opensuse:latest = %+v\n", string(b))
|
||||
return string(b)
|
||||
}, 2*time.Minute, 2*time.Second).Should(Equal("quay.io/kairos/core-opensuse:latest"))
|
||||
}
|
||||
|
||||
func itHasTheCorrectLabels() {
|
||||
Eventually(func() string {
|
||||
b, _ := kubectl.GetData("default", "jobs", "hello-kairos", "jsonpath={.spec.template.metadata.labels.osbuild}")
|
||||
fmt.Printf("looking for label workloadhello-kairos = %+v\n", string(b))
|
||||
return string(b)
|
||||
}, 2*time.Minute, 2*time.Second).Should(Equal("workloadhello-kairos"))
|
||||
}
|
||||
|
||||
func itCopiesTheArtifacts() {
|
||||
nginxNamespace := "osartifactbuilder-operator-system"
|
||||
Eventually(func() string {
|
||||
podName := strings.TrimSpace(findPodsWithLabel(nginxNamespace, "app.kubernetes.io/name=osbuilder-nginx"))
|
||||
|
||||
out, _ := kubectl.RunCommandWithOutput(nginxNamespace, podName, "ls /usr/share/nginx/html")
|
||||
|
||||
return out
|
||||
}, 15*time.Minute, 2*time.Second).Should(MatchRegexp("hello-kairos.iso"))
|
||||
}
|
||||
|
||||
func itCleansUpRoleBindings() {
|
||||
nginxNamespace := "osartifactbuilder-operator-system"
|
||||
Eventually(func() string {
|
||||
rb := findRoleBindings(nginxNamespace)
|
||||
|
||||
return rb
|
||||
}, 3*time.Minute, 2*time.Second).ShouldNot(MatchRegexp("hello-kairos"))
|
||||
}
|
||||
|
||||
func itDeletesTheArtifacts() {
|
||||
nginxNamespace := "osartifactbuilder-operator-system"
|
||||
Eventually(func() string {
|
||||
podName := findPodsWithLabel(nginxNamespace, "app.kubernetes.io/name=osbuilder-nginx")
|
||||
|
||||
out, err := kubectl.RunCommandWithOutput(nginxNamespace, podName, "ls /usr/share/nginx/html")
|
||||
Expect(err).ToNot(HaveOccurred(), out)
|
||||
|
||||
return out
|
||||
}, 3*time.Minute, 2*time.Second).ShouldNot(MatchRegexp("hello-kairos.iso"))
|
||||
}
|
||||
|
||||
func findPodsWithLabel(namespace, label string) string {
|
||||
kubectlCommand := fmt.Sprintf("kubectl get pods -n %s -l %s --no-headers -o custom-columns=\":metadata.name\" | head -n1", namespace, label)
|
||||
cmd := exec.Command("bash", "-c", kubectlCommand)
|
||||
var out bytes.Buffer
|
||||
var stderr bytes.Buffer
|
||||
cmd.Stdout = &out
|
||||
cmd.Stderr = &stderr
|
||||
err := cmd.Run()
|
||||
Expect(err).ToNot(HaveOccurred(), stderr.String())
|
||||
|
||||
return strings.TrimSpace(out.String())
|
||||
}
|
||||
|
||||
func findRoleBindings(namespace string) string {
|
||||
kubectlCommand := fmt.Sprintf("kubectl get rolebindings -n %s --no-headers -o custom-columns=\":metadata.name\"", namespace)
|
||||
cmd := exec.Command("bash", "-c", kubectlCommand)
|
||||
var out bytes.Buffer
|
||||
var stderr bytes.Buffer
|
||||
cmd.Stdout = &out
|
||||
cmd.Stderr = &stderr
|
||||
err := cmd.Run()
|
||||
Expect(err).ToNot(HaveOccurred(), stderr.String())
|
||||
|
||||
return strings.TrimSpace(out.String())
|
||||
}
|
||||
|
||||
4
tests/fixtures/simple.yaml
vendored
4
tests/fixtures/simple.yaml
vendored
@@ -6,7 +6,7 @@ spec:
|
||||
imageName: "quay.io/kairos/core-opensuse:latest"
|
||||
iso: true
|
||||
bundles:
|
||||
- quay.io/kairos/packages:goreleaser-utils-1.13.1
|
||||
- quay.io/kairos/packages:goreleaser-utils-1.11.1
|
||||
grubConfig: |
|
||||
search --file --set=root /boot/kernel.xz
|
||||
set default=0
|
||||
@@ -49,4 +49,4 @@ spec:
|
||||
device: "/dev/sda"
|
||||
reboot: true
|
||||
poweroff: true
|
||||
auto: true # Required, for automated installations
|
||||
auto: true # Required, for automated installations
|
||||
@@ -1,24 +1,16 @@
|
||||
# https://quay.io/repository/kairos/packages?tab=tags&tag=latest
|
||||
ARG ELEMENTAL_CLI_VERSION=0.20221107.1
|
||||
ARG LEAP_VERSION=15.4
|
||||
ARG LUET_VERSION=0.33.0
|
||||
FROM quay.io/kairos/packages:elemental-cli-system-$ELEMENTAL_CLI_VERSION AS elemental
|
||||
FROM quay.io/luet/base:$LUET_VERSION AS luet
|
||||
|
||||
FROM opensuse/leap:$LEAP_VERSION as luet-install
|
||||
COPY --from=luet /usr/bin/luet /usr/bin/luet
|
||||
ENV LUET_NOLOCK=true
|
||||
ENV TMPDIR=/tmp
|
||||
COPY luet.yaml /etc/luet/luet.yaml
|
||||
RUN luet install -y system/elemental-cli
|
||||
RUN luet install -y livecd/grub2 --system-target /grub2
|
||||
RUN luet install -y livecd/grub2-efi-image --system-target /efi
|
||||
|
||||
# remove luet tmp files. Side effect of setting the system-target is that it treats it as a root fs
|
||||
RUN rm -Rf /grub2/var
|
||||
RUN rm -Rf /efi/var
|
||||
### TODO: Replace those naked Dockerfiles copies with luet install so we can keep track of all versioning with 1 repository tag
|
||||
### 1) Add the kairos repository with a reference
|
||||
### 2) populate folders accordingly
|
||||
|
||||
## amd64 Live CD artifacts
|
||||
FROM quay.io/kairos/packages:grub2-livecd-0.0.6 AS grub2
|
||||
FROM quay.io/kairos/packages:grub2-efi-image-livecd-0.0.6 AS efi
|
||||
FROM quay.io/kairos/packages:grub2-livecd-0.0.4 AS grub2
|
||||
FROM quay.io/kairos/packages:grub2-efi-image-livecd-0.0.4 AS efi
|
||||
|
||||
## RPI64
|
||||
|
||||
@@ -42,12 +34,12 @@ FROM quay.io/kairos/packages:grub-config-static-0.1 AS grub-raw-config
|
||||
FROM quay.io/kairos/packages:grub-artifacts-static-0.1 AS grub-raw-artifacts
|
||||
|
||||
FROM opensuse/leap:$LEAP_VERSION
|
||||
COPY --from=luet-install /usr/bin/elemental /usr/bin/elemental
|
||||
COPY --from=elemental /usr/bin/elemental /usr/bin/elemental
|
||||
COPY --from=luet /usr/bin/luet /usr/bin/luet
|
||||
|
||||
# ISO files
|
||||
COPY --from=luet-install /grub2 /grub2
|
||||
COPY --from=luet-install /efi /efi
|
||||
# x86_64 ISOs
|
||||
COPY --from=grub2 / /grub2
|
||||
COPY --from=efi / /efi
|
||||
|
||||
# RAW images
|
||||
COPY --from=grub-raw-efi / /raw/grub
|
||||
@@ -89,7 +81,6 @@ COPY ./add-cloud-init.sh /add-cloud-init.sh
|
||||
# ARM helpers
|
||||
COPY ./build-arm-image.sh /build-arm-image.sh
|
||||
COPY ./arm /arm
|
||||
COPY ./prepare_arm_images.sh /prepare_arm_images.sh
|
||||
|
||||
# RAW images helpers
|
||||
COPY ./gce.sh /gce.sh
|
||||
|
||||
@@ -7,13 +7,12 @@ set -ex
|
||||
load_vars() {
|
||||
|
||||
model=${MODEL:-odroid_c2}
|
||||
use_lvm=${USE_LVM:-false}
|
||||
|
||||
directory=${DIRECTORY:-}
|
||||
output_image="${OUTPUT_IMAGE:-arm.img}"
|
||||
# Img creation options. Size is in MB for all of the vars below
|
||||
size="${SIZE:-7608}"
|
||||
size="${SIZE:-7544}"
|
||||
state_size="${STATE_SIZE:-4992}"
|
||||
oem_size="${OEM_SIZE:-64}"
|
||||
recovery_size="${RECOVERY_SIZE:-2192}"
|
||||
default_active_size="${DEFAULT_ACTIVE_SIZE:-2400}"
|
||||
|
||||
@@ -102,7 +101,6 @@ usage()
|
||||
echo " --directory: (optional) A directory which will be used for active/passive/recovery system"
|
||||
echo " --model: (optional) The board model"
|
||||
echo " --efi-dir: (optional) A directory with files which will be added to the efi partition"
|
||||
echo " --use-lvm: (optional- no arguments) LVM will be used for the recovery and oem partitions and COS_OEM is enabled"
|
||||
exit 1
|
||||
}
|
||||
|
||||
@@ -189,9 +187,6 @@ while [ "$#" -gt 0 ]; do
|
||||
shift 1
|
||||
repo_type=$1
|
||||
;;
|
||||
--use-lvm)
|
||||
use_lvm=true
|
||||
;;
|
||||
-h)
|
||||
usage
|
||||
;;
|
||||
@@ -336,11 +331,7 @@ else
|
||||
sgdisk -n 1:8192:+16M -c 1:EFI -t 1:0700 ${output_image}
|
||||
fi
|
||||
sgdisk -n 2:0:+${state_size}M -c 2:state -t 2:8300 ${output_image}
|
||||
if [ "$use_lvm" == 'false' ]; then
|
||||
sgdisk -n 3:0:+${recovery_size}M -c 3:recovery -t 3:8300 ${output_image}
|
||||
else
|
||||
sgdisk -n 3:0:+$(( ${recovery_size} + ${oem_size} ))M -c 3:lvm -t 3:8e00 ${output_image}
|
||||
fi
|
||||
sgdisk -n 4:0:+64M -c 4:persistent -t 4:8300 ${output_image}
|
||||
|
||||
sgdisk -m 1:2:3:4 ${output_image}
|
||||
@@ -375,25 +366,12 @@ efi=${device}p1
|
||||
state=${device}p2
|
||||
recovery=${device}p3
|
||||
persistent=${device}p4
|
||||
oem_lv=/dev/mapper/KairosVG-oem
|
||||
recovery_lv=/dev/mapper/KairosVG-recovery
|
||||
|
||||
# Create partitions (RECOVERY, STATE, COS_PERSISTENT)
|
||||
mkfs.vfat -F 32 ${efi}
|
||||
fatlabel ${efi} COS_GRUB
|
||||
|
||||
if [ "$use_lvm" == 'false' ]; then
|
||||
mkfs.ext4 -F -L ${RECOVERY_LABEL} $recovery
|
||||
else
|
||||
pvcreate $recovery
|
||||
vgcreate KairosVG $recovery
|
||||
lvcreate -Z n -n oem -L ${oem_size} KairosVG
|
||||
lvcreate -Z n -n recovery -l 100%FREE KairosVG
|
||||
vgchange -ay
|
||||
vgmknodes
|
||||
mkfs.ext4 -F -L ${OEM_LABEL} $oem_lv
|
||||
mkfs.ext4 -F -L ${RECOVERY_LABEL} $recovery_lv
|
||||
fi
|
||||
mkfs.ext4 -F -L ${STATE_LABEL} $state
|
||||
mkfs.ext4 -F -L ${PERSISTENT_LABEL} $persistent
|
||||
|
||||
@@ -401,11 +379,7 @@ mkdir $WORKDIR/state
|
||||
mkdir $WORKDIR/recovery
|
||||
mkdir $WORKDIR/efi
|
||||
|
||||
if [ "$use_lvm" == 'false' ]; then
|
||||
mount $recovery $WORKDIR/recovery
|
||||
else
|
||||
mount $recovery_lv $WORKDIR/recovery
|
||||
fi
|
||||
mount $state $WORKDIR/state
|
||||
mount $efi $WORKDIR/efi
|
||||
|
||||
@@ -433,9 +407,6 @@ umount $WORKDIR/recovery
|
||||
umount $WORKDIR/state
|
||||
umount $WORKDIR/efi
|
||||
|
||||
if [ "$use_lvm" == 'true' ]; then
|
||||
vgchange -an
|
||||
fi
|
||||
sync
|
||||
|
||||
# Flash uboot and vendor-specific bits
|
||||
|
||||
@@ -1,24 +0,0 @@
|
||||
general:
|
||||
debug: false
|
||||
spinner_charset: 9
|
||||
logging:
|
||||
enable_emoji: false
|
||||
repositories:
|
||||
- name: "kairos"
|
||||
description: "kairos repository"
|
||||
type: "docker"
|
||||
arch: amd64
|
||||
cached: true
|
||||
priority: 2
|
||||
urls:
|
||||
- "quay.io/kairos/packages"
|
||||
reference: 20230413141357-repository.yaml
|
||||
- name: "kairos-arm64"
|
||||
description: "kairos repository arm64"
|
||||
type: "docker"
|
||||
arch: arm64
|
||||
cached: true
|
||||
priority: 2
|
||||
urls:
|
||||
- "quay.io/kairos/packages-arm64"
|
||||
reference: 20230413142104-repository.yaml
|
||||
@@ -1,128 +0,0 @@
|
||||
#!/bin/bash
|
||||
# This script prepares Kairos state, recovery, oem and pesistent partitions as img files.
|
||||
|
||||
set -e
|
||||
|
||||
# Temp dir used during build
|
||||
WORKDIR=$(mktemp -d --tmpdir arm-builder.XXXXXXXXXX)
|
||||
TARGET=$(mktemp -d --tmpdir arm-builder.XXXXXXXXXX)
|
||||
STATEDIR=$(mktemp -d --tmpdir arm-builder.XXXXXXXXXX)
|
||||
|
||||
: "${OEM_LABEL:=COS_OEM}"
|
||||
: "${RECOVERY_LABEL:=COS_RECOVERY}"
|
||||
: "${ACTIVE_LABEL:=COS_ACTIVE}"
|
||||
: "${PASSIVE_LABEL:=COS_PASSIVE}"
|
||||
: "${PERSISTENT_LABEL:=COS_PERSISTENT}"
|
||||
: "${SYSTEM_LABEL:=COS_SYSTEM}"
|
||||
: "${STATE_LABEL:=COS_STATE}"
|
||||
|
||||
size="${SIZE:-7544}"
|
||||
state_size="${STATE_SIZE:-4992}"
|
||||
recovery_size="${RECOVERY_SIZE:-2192}"
|
||||
default_active_size="${DEFAULT_ACTIVE_SIZE:-2400}"
|
||||
|
||||
container_image="${container_image:-quay.io/kairos/kairos-opensuse-leap-arm-rpi:v1.5.1-k3sv1.25.6-k3s1}"
|
||||
|
||||
ensure_dir_structure() {
|
||||
local target=$1
|
||||
for mnt in /sys /proc /dev /tmp /boot /usr/local /oem
|
||||
do
|
||||
if [ ! -d "${target}${mnt}" ]; then
|
||||
mkdir -p ${target}${mnt}
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
mkdir -p $WORKDIR/tmpefi
|
||||
|
||||
# Create the EFI partition FAT16 and include the EFI image and a basic grub.cfg
|
||||
truncate -s $((20*1024*1024)) bootloader/efi.img
|
||||
cp -rfv /arm/grub/efi/* $WORKDIR/tmpefi
|
||||
mkfs.fat -F16 -n COS_GRUB bootloader/efi.img
|
||||
mcopy -s -i bootloader/efi.img $WORKDIR/tmpefi/EFI ::EFI
|
||||
|
||||
mkdir -p ${STATEDIR}/cOS
|
||||
|
||||
dd if=/dev/zero of=${STATEDIR}/cOS/active.img bs=1M count=$default_active_size
|
||||
|
||||
mkfs.ext2 ${STATEDIR}/cOS/active.img -L ${ACTIVE_LABEL}
|
||||
|
||||
|
||||
LOOP=$(losetup --show -f ${STATEDIR}/cOS/active.img)
|
||||
if [ -z "$LOOP" ]; then
|
||||
echo "No device"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
mount -t ext2 $LOOP $TARGET
|
||||
|
||||
ensure_dir_structure $TARGET
|
||||
|
||||
# Download the container image
|
||||
if [ -z "$directory" ]; then
|
||||
echo ">>> Downloading container image"
|
||||
luet util unpack $container_image $TARGET
|
||||
else
|
||||
echo ">>> Copying files from $directory"
|
||||
rsync -axq --exclude='host' --exclude='mnt' --exclude='proc' --exclude='sys' --exclude='dev' --exclude='tmp' ${directory}/ $TARGET
|
||||
fi
|
||||
|
||||
umount $TARGET
|
||||
sync
|
||||
|
||||
losetup -d $LOOP
|
||||
|
||||
|
||||
echo ">> Preparing passive.img"
|
||||
cp -rfv ${STATEDIR}/cOS/active.img ${STATEDIR}/cOS/passive.img
|
||||
tune2fs -L ${PASSIVE_LABEL} ${STATEDIR}/cOS/passive.img
|
||||
|
||||
|
||||
# Preparing recovery
|
||||
echo ">> Preparing recovery.img"
|
||||
RECOVERY=$(mktemp -d --tmpdir arm-builder.XXXXXXXXXX)
|
||||
mkdir -p ${RECOVERY}/cOS
|
||||
cp -rfv ${STATEDIR}/cOS/active.img ${RECOVERY}/cOS/recovery.img
|
||||
tune2fs -L ${SYSTEM_LABEL} ${RECOVERY}/cOS/recovery.img
|
||||
|
||||
# Install real grub config to recovery
|
||||
cp -rfv /arm/grub/config/* $RECOVERY
|
||||
mkdir -p $RECOVERY/grub2
|
||||
cp -rfv /arm/grub/artifacts/* $RECOVERY/grub2
|
||||
|
||||
dd if=/dev/zero of=recovery_partition.img bs=1M count=$recovery_size
|
||||
dd if=/dev/zero of=state_partition.img bs=1M count=$state_size
|
||||
|
||||
mkfs.ext4 -F -L ${RECOVERY_LABEL} recovery_partition.img
|
||||
LOOP=$(losetup --show -f recovery_partition.img)
|
||||
mkdir -p $WORKDIR/recovery
|
||||
mount $LOOP $WORKDIR/recovery
|
||||
cp -arf $RECOVERY/* $WORKDIR/recovery
|
||||
umount $WORKDIR/recovery
|
||||
losetup -d $LOOP
|
||||
|
||||
mkfs.ext4 -F -L ${STATE_LABEL} state_partition.img
|
||||
LOOP=$(losetup --show -f state_partition.img)
|
||||
mkdir -p $WORKDIR/state
|
||||
mount $LOOP $WORKDIR/state
|
||||
cp -arf $STATEDIR/* $WORKDIR/state
|
||||
grub2-editenv $WORKDIR/state/grub_oem_env set "default_menu_entry=Kairos"
|
||||
umount $WORKDIR/state
|
||||
losetup -d $LOOP
|
||||
|
||||
cp -rfv state_partition.img bootloader/
|
||||
cp -rfv recovery_partition.img bootloader/
|
||||
|
||||
## Optional, prepare COS_OEM and COS_PERSISTENT
|
||||
|
||||
# Create the grubenv forcing first boot to be on recovery system
|
||||
mkdir -p $WORKDIR/oem
|
||||
cp -rfv /defaults.yaml $WORKDIR/oem/01_defaults.yaml
|
||||
|
||||
# Create a 64MB filesystem for OEM volume
|
||||
truncate -s $((64*1024*1024)) bootloader/oem.img
|
||||
mkfs.ext2 -L "${OEM_LABEL}" -d $WORKDIR/oem bootloader/oem.img
|
||||
|
||||
# Create a 2GB filesystem for COS_PERSISTENT volume
|
||||
truncate -s $((2048*1024*1024)) bootloader/persistent.img
|
||||
mkfs.ext2 -L "${PERSISTENT_LABEL}" bootloader/persistent.img
|
||||
@@ -10,7 +10,6 @@
|
||||
: "${OEM_LABEL:=COS_OEM}"
|
||||
: "${RECOVERY_LABEL:=COS_RECOVERY}"
|
||||
: "${EXTEND:=}"
|
||||
: "${RECOVERY_SIZE:=2048}"
|
||||
|
||||
DIRECTORY=$1
|
||||
OUT=${2:-disk.raw}
|
||||
@@ -35,8 +34,7 @@ mv recovery.squashfs /build/root/cOS/recovery.squashfs
|
||||
grub2-editenv /build/root/grub_oem_env set "default_menu_entry=Kairos"
|
||||
|
||||
# Create a 2GB filesystem for RECOVERY including the contents for root (grub config and squasfs container)
|
||||
# shellcheck disable=SC2004
|
||||
truncate -s $(($RECOVERY_SIZE*1024*1024)) rootfs.part
|
||||
truncate -s $((2048*1024*1024)) rootfs.part
|
||||
mkfs.ext2 -L "${RECOVERY_LABEL}" -d /build/root rootfs.part
|
||||
|
||||
# Create the EFI partition FAT16 and include the EFI image and a basic grub.cfg
|
||||
@@ -78,4 +76,4 @@ fi
|
||||
sgdisk -n 1:2048:+2M -c 1:legacy -t 1:EF02 $OUT
|
||||
sgdisk -n 2:0:+20M -c 2:UEFI -t 2:EF00 $OUT
|
||||
sgdisk -n 3:0:+64M -c 3:oem -t 3:8300 $OUT
|
||||
sgdisk -n 4:0:+${RECOVERY_SIZE}M -c 4:root -t 4:8300 $OUT
|
||||
sgdisk -n 4:0:+2048M -c 4:root -t 4:8300 $OUT
|
||||
|
||||
Reference in New Issue
Block a user