Skip to content

Commit deee8cc

Browse files
committed
AGENT-1193: Add mirror-path and registry-cert support for OVE ISO builds
Add support for using pre-mirrored images (--mirror-path) and custom registry certificates (--registry-cert) when building OVE ISOs. This allows building ISOs in disconnected environments without requiring oc-mirror to run during the build process. Note: mirror-path and registry-cert options are only available when using the script build method (AGENT_ISO_NO_REGISTRY_BUILD_METHOD=script). The container build method does not support these options. Changes: - Refactor create_agent_iso_no_registry() for better readability - Extract helper functions into agent/iso_no_registry.sh - Add mirror-path and registry-cert support to script build method - Pass mirror-path to skip oc-mirror execution in appliance - Pass registry certificate for custom registries with self-signed certs Assisted-by: Claude Sonnet 4.5 <noreply@anthropic.com>
1 parent 5901c75 commit deee8cc

6 files changed

Lines changed: 165 additions & 38 deletions

File tree

agent/04_agent_prepare_release.sh

Lines changed: 37 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,43 @@ source $SCRIPTDIR/agent/common.sh
1313
source $SCRIPTDIR/ocp_install_env.sh
1414
source $SCRIPTDIR/oc_mirror.sh
1515

16-
# Temporarily skip preparing the custom local release in case of OVE ISO
17-
if [[ "${AGENT_E2E_TEST_BOOT_MODE}" == "ISO_NO_REGISTRY" ]]; then
18-
exit 0
16+
early_deploy_validation
17+
write_pull_secret
18+
19+
# Release mirroring could be required by the subsequent steps
20+
# even if the current one will be skipped
21+
if [[ ! -z "${MIRROR_IMAGES}" && "${MIRROR_IMAGES,,}" != "false" ]]; then
22+
setup_release_mirror
23+
fi
24+
25+
# Prepare registry directory for appliance if using ISO_NO_REGISTRY
26+
if [[ ! -z "${MIRROR_IMAGES}" && "${MIRROR_IMAGES,,}" != "false" && "${AGENT_E2E_TEST_BOOT_MODE}" == "ISO_NO_REGISTRY" ]]; then
27+
echo "Preparing registry directory structure for appliance..."
28+
29+
# Create the cache directory structure expected by appliance
30+
# Appliance expects: mirror-path/cache/<version-arch> (ISO output)
31+
# Appliance will read registry data directly from mirror-path/data
32+
33+
# Extract version from release image to create cache subdirectory
34+
# Appliance creates cache dir in format: cache/<version>-<arch>
35+
VERSION=$(skopeo inspect --authfile ${PULL_SECRET_FILE} docker://${OPENSHIFT_RELEASE_IMAGE} | jq -r '.Labels["io.openshift.release"]')
36+
ARCH=$(uname -m)
37+
CACHE_SUBDIR="${VERSION}-${ARCH}"
38+
mkdir -p ${REGISTRY_DIR}/cache/${CACHE_SUBDIR}
39+
40+
# Copy YAML files and mapping.txt to registry directory so appliance can find them
41+
if [[ -d ${WORKING_DIR}/working-dir ]]; then
42+
cp -r ${WORKING_DIR}/working-dir ${REGISTRY_DIR}/
43+
fi
44+
45+
# Copy results directory containing mapping.txt
46+
for results_dir in ${WORKING_DIR}/results-*; do
47+
if [[ -d "$results_dir" ]]; then
48+
cp -r "$results_dir" ${REGISTRY_DIR}/
49+
fi
50+
done
51+
52+
echo "Registry directory prepared for appliance"
1953
fi
2054

2155
# To replace an image entry in the openshift release image, set <ENTRYNAME>_LOCAL_REPO so that:
@@ -34,15 +68,6 @@ fi
3468
# export ASSISTED_SERVICE_DOCKERFILE=Dockerfile.assisted-service.ocp
3569
# export ASSISTED_SERVICE_IMAGE=agent-installer-api-server
3670

37-
early_deploy_validation
38-
write_pull_secret
39-
40-
# Release mirroring could be required by the subsequent steps
41-
# even if the current one will be skipped
42-
if [[ ! -z "${MIRROR_IMAGES}" && "${MIRROR_IMAGES,,}" != "false" ]]; then
43-
setup_release_mirror
44-
fi
45-
4671
function build_local_release() {
4772
# Sanity checks
4873
if [[ -z "${MIRROR_IMAGES}" || "${MIRROR_IMAGES,,}" == "false" ]]; then

agent/06_agent_create_cluster.sh

Lines changed: 8 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ source $SCRIPTDIR/validation.sh
1414
source $SCRIPTDIR/release_info.sh
1515
source $SCRIPTDIR/agent/common.sh
1616
source $SCRIPTDIR/agent/iscsi_utils.sh
17+
source $SCRIPTDIR/agent/iso_no_registry.sh
1718

1819
early_deploy_validation
1920

@@ -82,30 +83,6 @@ function create_config_image() {
8283
cp -r ${config_image_dir}/auth ${asset_dir}
8384
}
8485

85-
function create_agent_iso_no_registry() {
86-
local asset_dir=${1}
87-
88-
AGENT_ISO_BUILDER_IMAGE=$(getAgentISOBuilderImage)
89-
90-
id=$(podman create --pull always --authfile "${PULL_SECRET_FILE}" "${AGENT_ISO_BUILDER_IMAGE}") && podman cp "${id}":/src "${asset_dir}" && podman rm "${id}"
91-
92-
# Update release_info.json as its needed by CI tests
93-
save_release_info ${OPENSHIFT_RELEASE_IMAGE} ${OCP_DIR}
94-
95-
# Create agent ISO without registry a.k.a. OVE ISO
96-
pushd .
97-
cd "${asset_dir}"/src
98-
# Build the ISO in the container image
99-
make build-ove-iso-container PULL_SECRET_FILE="${PULL_SECRET_FILE}" RELEASE_IMAGE_URL="${OPENSHIFT_RELEASE_IMAGE}" ARCH=${ARCH}
100-
# Retrieve ISO from container
101-
./hack/iso-from-container.sh
102-
local iso_name="agent-ove.${ARCH}.iso"
103-
echo "Moving ${iso_name} to ${asset_dir}"
104-
mv ./output-iso/${iso_name} "${asset_dir}"
105-
rm -rf "${asset_dir}"/src
106-
popd
107-
}
108-
10986
function assert_agent_no_registry_iso_size(){
11087
agent_iso_no_registry=$(get_agent_iso_no_registry)
11188
iso_size=$(stat -c%s "$agent_iso_no_registry")
@@ -639,6 +616,13 @@ case "${AGENT_E2E_TEST_BOOT_MODE}" in
639616
cleanup_diskspace_agent_iso_noregistry ${asset_dir}
640617
fi
641618

619+
# Clean up registry data to save disk space after ISO is created
620+
if [[ "${MIRROR_IMAGES}" == "true" ]]; then
621+
echo "Cleaning up registry data at ${REGISTRY_DIR} to save disk space"
622+
sudo rm -rf ${REGISTRY_DIR}/data
623+
echo "Registry data cleanup complete"
624+
fi
625+
642626
attach_agent_iso_no_registry master $NUM_MASTERS
643627
attach_agent_iso_no_registry worker $NUM_WORKERS
644628
attach_agent_iso_no_registry arbiter $NUM_ARBITERS

agent/common.sh

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@ export AGENT_ROOT_DEVICE_HINTS=${AGENT_ROOT_DEVICE_HINTS:-""}
1515
export AGENT_BM_HOSTS_IN_INSTALL_CONFIG=${AGENT_BM_HOSTS_IN_INSTALL_CONFIG:-"false"}
1616

1717
export AGENT_MINIMAL_ISO=${AGENT_MINIMAL_ISO:-"false"}
18+
# OVE ISO build method: "script" uses build-ove-image.sh, "container" uses Dockerfile-based build
19+
export AGENT_ISO_NO_REGISTRY_BUILD_METHOD=${AGENT_ISO_NO_REGISTRY_BUILD_METHOD:-"container"}
1820

1921
export BOND_CONFIG=${BOND_CONFIG:-"none"}
2022

agent/iso_no_registry.sh

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
# OVE (OpenShift Virtualization Edition) ISO building utilities
5+
# Functions for creating agent ISOs without embedded registry
6+
7+
# Check if using a custom registry (not upstream quay.io or CI registry)
8+
function is_custom_registry() {
9+
[[ ! "${OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE}" =~ quay\.io ]] && \
10+
[[ ! "${OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE}" =~ registry\.ci\.openshift\.org ]]
11+
}
12+
13+
# Determine release image URL based on mirror configuration
14+
function get_release_image_url() {
15+
if [[ "${MIRROR_IMAGES}" == "true" ]]; then
16+
echo "${OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE}"
17+
else
18+
echo "${OPENSHIFT_RELEASE_IMAGE}"
19+
fi
20+
}
21+
22+
# Build OVE ISO using script method
23+
function build_ove_iso_script() {
24+
local asset_dir=$1
25+
local release_image_url=$2
26+
local mirror_path_arg=$3
27+
local registry_cert_arg=$4
28+
29+
./hack/build-ove-image.sh \
30+
--pull-secret-file "${PULL_SECRET_FILE}" \
31+
--release-image-url "${release_image_url}" \
32+
--ssh-key-file "${SSH_KEY_FILE}" \
33+
--dir "${asset_dir}" \
34+
${mirror_path_arg} \
35+
${registry_cert_arg}
36+
}
37+
38+
# Build OVE ISO using container method
39+
function build_ove_iso_container() {
40+
local asset_dir=$1
41+
local release_image_url=$2
42+
43+
# Build ISO in container
44+
make build-ove-iso-container \
45+
PULL_SECRET_FILE="${PULL_SECRET_FILE}" \
46+
RELEASE_IMAGE_URL="${release_image_url}" \
47+
ARCH=${ARCH}
48+
49+
# Extract ISO from container
50+
./hack/iso-from-container.sh
51+
52+
# Move to asset directory
53+
local iso_name="agent-ove.${ARCH}.iso"
54+
echo "Moving ${iso_name} to ${asset_dir}"
55+
mv ./output-iso/${iso_name} "${asset_dir}"
56+
}
57+
58+
# Create agent ISO without registry (OVE ISO)
59+
function create_agent_iso_no_registry() {
60+
local asset_dir=${1}
61+
62+
# Update release_info.json as its needed by CI tests
63+
save_release_info ${OPENSHIFT_RELEASE_IMAGE} ${OCP_DIR}
64+
65+
AGENT_ISO_BUILDER_IMAGE=$(getAgentISOBuilderImage)
66+
67+
# Extract agent-iso-builder source from container
68+
id=$(podman create --pull always --authfile "${PULL_SECRET_FILE}" "${AGENT_ISO_BUILDER_IMAGE}") && \
69+
podman cp "${id}":/src "${asset_dir}" && \
70+
podman rm "${id}"
71+
72+
pushd .
73+
cd "${asset_dir}"/src
74+
75+
# Determine release image URL
76+
local release_image_url=$(get_release_image_url)
77+
if [[ "${MIRROR_IMAGES}" == "true" ]]; then
78+
echo "Using mirrored release image: ${release_image_url}"
79+
else
80+
echo "Using upstream release image: ${release_image_url}"
81+
fi
82+
83+
# Prepare mirror and certificate arguments for script build method
84+
local mirror_path_arg=""
85+
local registry_cert_arg=""
86+
87+
if [[ "${MIRROR_IMAGES}" == "true" ]]; then
88+
echo "Using pre-mirrored images from ${REGISTRY_DIR}"
89+
mirror_path_arg="--mirror-path ${REGISTRY_DIR}"
90+
91+
# Add registry certificate if using custom registry
92+
if is_custom_registry && [[ -f "${REGISTRY_DIR}/certs/${REGISTRY_CRT}" ]]; then
93+
registry_cert_arg="--registry-cert ${REGISTRY_DIR}/certs/${REGISTRY_CRT}"
94+
fi
95+
fi
96+
97+
# Build OVE ISO using selected method
98+
if [[ "${AGENT_ISO_NO_REGISTRY_BUILD_METHOD}" == "script" ]]; then
99+
build_ove_iso_script "${asset_dir}" "${release_image_url}" "${mirror_path_arg}" "${registry_cert_arg}"
100+
else
101+
build_ove_iso_container "${asset_dir}" "${release_image_url}"
102+
fi
103+
104+
rm -rf "${asset_dir}"/src
105+
popd
106+
}

config_example.sh

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -870,11 +870,20 @@ set -x
870870
# AGENT_E2E_TEST_BOOT_MODE is set to ISO_NO_REGISTRY.
871871
# AGENT_CLEANUP_ISO_BUILDER_CACHE_LOCAL_DEV is useful for reclaiming disk space when building agent OVE ISO locally
872872
# by deleting all the files from the working directory, example ocp/ostest/iso_builder except the generated OVE ISO.
873-
# Set to 'true' to enable the cleanup.
873+
# Set to 'true' to enable the cleanup.
874874
# Default behavior (unset or any value other than 'yes') is to skip cleanup.
875875
# Recommended to set to true for local dev/test purposes and unset in CI.
876876
# export AGENT_CLEANUP_ISO_BUILDER_CACHE_LOCAL_DEV=false
877877

878+
# AGENT_ISO_NO_REGISTRY_BUILD_METHOD controls which method is used to build the OVE ISO when
879+
# AGENT_E2E_TEST_BOOT_MODE is set to ISO_NO_REGISTRY.
880+
# Options:
881+
# 'container' (default) - Uses containerized Dockerfile-based build (required for CI/build pipelines)
882+
# 'script' - Uses build-ove-image.sh script directly (faster for local development/debugging)
883+
# The container method is required in CI/build pipeline environments where nested podman is not supported.
884+
# The script method is recommended for local development as it allows faster iteration and easier debugging.
885+
# export AGENT_ISO_NO_REGISTRY_BUILD_METHOD=container
886+
878887
# Specifies the hostname of the node that should be identified and set as the rendezvous node
879888
# during the OVE cluster installation process. This node acts as the bootstrap node in the cluster.
880889
# Accepts only master nodes.

ocp_install_env.sh

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,8 @@ function extract_command() {
5151
cmd="oc"
5252
fi
5353

54-
mv "${extract_dir}/${cmd}" "${outdir}"
54+
mkdir -p "${outdir}"
55+
mv "${extract_dir}/${cmd}" "${outdir}/"
5556
}
5657

5758
# Let's always grab the `oc` from the release we're using.

0 commit comments

Comments
 (0)