ART-14453: Use rpm-ostree install directly in legacy build pipeline by locriandev · Pull Request #1935 · openshift/os

locriandev · 2026-05-13T07:51:23Z

Summary

Per feedback on #1932, this PR updates the legacy build pipeline to use rpm-ostree install directly instead of rpm-ostree experimental compose treefile-apply with packages-openshift.yaml.

Changes

build-node-image.sh — Replace rpm-ostree experimental compose treefile-apply with direct rpm-ostree install command, embedding all postprocess steps inline
packages-openshift.yaml — Removed (no longer needed)
All postprocess steps from packages-openshift.yaml are now embedded inline in build-node-image.sh

Related: #1932

openshift-ci · 2026-05-13T07:51:28Z

@locriandev: GitHub didn't allow me to request PR reviews from the following users: openshift/team-coreos.

Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

Summary

Per feedback on #1932, this PR updates the legacy build pipeline to use rpm-ostree install directly instead of rpm-ostree experimental compose treefile-apply with packages-openshift.yaml.

Changes

build-node-image.sh — Replace rpm-ostree experimental compose treefile-apply with direct rpm-ostree install command, embedding all postprocess steps inline

packages-openshift.yaml — Removed (no longer needed)

Key details

All postprocess steps from packages-openshift.yaml are now embedded inline in build-node-image.sh

Maintains OPENSHIFT_VERSION="5.0" for the master branch

Preserves SCOS/OKD variant detection using ID and VERSION_ID heuristic (centos-10 → SCOS, everything else → RHCOS)

Net change: 97 insertions, 176 deletions

This aligns the legacy pipeline with the approach taken in the Konflux build path (#1932), making both pipelines use the same direct installation method.

Related: #1932

/cc @openshift/team-coreos

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci-robot · 2026-05-13T07:54:25Z

@locriandev: This pull request references ART-14453 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

Per feedback on #1932, this PR updates the legacy build pipeline to use rpm-ostree install directly instead of rpm-ostree experimental compose treefile-apply with packages-openshift.yaml.

Changes

build-node-image.sh — Replace rpm-ostree experimental compose treefile-apply with direct rpm-ostree install command, embedding all postprocess steps inline

packages-openshift.yaml — Removed (no longer needed)

All postprocess steps from packages-openshift.yaml are now embedded inline in build-node-image.sh

Related: #1932

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

travier · 2026-05-13T08:20:55Z

Maybe we should go one step further and use dnf directly?

travier · 2026-05-13T08:22:40Z

Something is off here:

Updating metadata for 'rhel-9-baseos'...done
Updating metadata for 'rhel-9-appstream'...done
Updating metadata for 'rhel-9-nfv'...done
Updating metadata for 'rhel-9-highavailability'...done
Updating metadata for 'rhel-9-fast-datapath'...done
Updating metadata for 'rhel-9-codeready-builder-rpms'...done
Updating metadata for 'rhel-9-server-ose'...done
Updating metadata for 'rhel-9.8-early-kernel'...done
Updating metadata for 'rhel-9-baseos-ppc64le'...done
Updating metadata for 'rhel-9-appstream-ppc64le'...done
Updating metadata for 'rhel-9-fast-datapath-ppc64le'...done
Updating metadata for 'rhel-9-server-ose-ppc64le'...done
Updating metadata for 'rhel-9-codeready-builder-rpms-ppc64le'...done
Updating metadata for 'rhel-9-baseos-s390x'...done
Updating metadata for 'rhel-9-appstream-s390x'...done
Updating metadata for 'rhel-9-fast-datapath-s390x'...done
Updating metadata for 'rhel-9-server-ose-s390x'...done
Updating metadata for 'rhel-9-codeready-builder-rpms-s390x'...done
Updating metadata for 'rhel-9-baseos-aarch64'...done
Updating metadata for 'rhel-9-appstream-aarch64'...done
Updating metadata for 'rhel-9-fast-datapath-aarch64'...done
Updating metadata for 'rhel-9-server-ose-aarch64'...done
Updating metadata for 'rhel-9-codeready-builder-rpms-aarch64'...done
Updating metadata for 'rhel-10.2-baseos'...done
error: Updating rpm-md repo 'rhel-10.2-baseos': cannot update repo 'rhel-10.2-baseos': Cannot download repomd.xml: Cannot download repodata/repomd.xml: All mirrors were tried; Last error: Status code: 401 for http://base-5-0-rhel102.ocp.svc.cluster.local/rhel-10.2-baseos/repodata/repomd.xml (IP: 172.30.30.122)

locriandev · 2026-05-13T08:33:53Z

@travier Thanks for the feedback!

Re: dnf adoption

I have not strong opinions on this, as I understand it the adoption of rpm-ostree install came out as a suggestion from last meeting's notes.

Re: the repo 401 errors

Good catch! The issue was that ci/get-ocp-repo.sh fetches repos for both rhel-9 and rhel-10.2 and concatenates them together. With the old packages-openshift.yaml approach, the conditional-include section would only enable repos matching the OS version. Now with direct rpm-ostree install, all repos were being accessed.

I've pushed a fix (a4808ee) that disables repos not matching the current OS version:

rhel-9.8 builds: disable rhel-10.2 and centos repos
rhel-10.2 builds: disable rhel-9 and centos repos
centos-10 builds: disable all rhel repos

This should resolve the 401 errors.

dustymabe · 2026-05-15T03:18:36Z

Thank you for working on this. I've done some review and have some local changes, but also see there are some things that need to change in this repo before we land this. I've opened #1936 for that.

Once that merges I can rebase this and also add a commit or two on top to simplify the repo management if that is OK with you.

travier · 2026-05-21T07:58:18Z

#1936 has been merged. Can you rebase this one?

Replace rpm-ostree experimental compose treefile-apply with direct rpm-ostree install and inline postprocess steps. This aligns the legacy build-node-image.sh with the Konflux approach while maintaining support for SCOS/OKD variant detection. Changes: - Replace treefile-apply with rpm-ostree install command - Move all postprocess steps from packages-openshift.yaml inline - Remove packages-openshift.yaml (no longer needed) - Keep OPENSHIFT_VERSION=5.0 for master branch - Preserve SCOS/OKD detection using ID and VERSION_ID heuristic Related: openshift#1932 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED

When using rpm-ostree install directly, all repos from ci/get-ocp-repo.sh (which fetches both rhel-9 and rhel-10.2 repos) were being accessed, causing 401 errors when trying to access repos for the wrong OS version. This commit adds logic to disable repos that don't match the current OS: - rhel-9.8 builds: disable rhel-10.2 and centos repos - rhel-10.2 builds: disable rhel-9 and centos repos - centos-10 builds: disable all rhel repos This replicates the conditional-include logic from packages-openshift.yaml. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED

This way when we update for newer releases we don't need to update the script, but just the build-args. In other words, this keeps the definitions for things out of the script.

Help explain a bit more what they are used for.

We don't really need the `10` conditional.

If we mount the secret.repo into /run/src/secret.repo instead of /etc/yum.repos.d/secret.repo then it will get picked up by `cat /run/src/*.repo >> /etc/yum.repos.d/git.repo` which will allow for modifications to be made to the repo on disk (read/write), which we currently do for SCOS.

dustymabe · 2026-05-21T16:16:46Z

I talked to @locriandev this morning and force pushed up some changes here.

Ultimately a lot of small cleanups and two big changes:

use dnf instead of rpm-ostree
define the yum repo names in build-args so they are explicitly defined for each variant rather than relying on heuristics inside the script to filter out the ones we didn't want.

I think the new simplified format should serve us better.

@locriandev @jlebon - can you review this ?

dustymabe · 2026-05-21T16:30:49Z

sigh. I guess expanding the use of build-args here is going to require adapting openshift/release@912602f

jlebon

Nice, general approach LGTM!

This effectively closes #1850.

openshift-ci · 2026-05-21T18:28:06Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jlebon, locriandev

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [jlebon]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Instead of rpm-ostree install we can use dnf directly. Also let's define the names of the repos we want to use for each variant in the build-args themselves, which will remove the heuristics we were doing previously inside the build-node-image.sh script to filter out the ones we didn't want.

openshift-ci · 2026-05-21T18:56:05Z

@locriandev: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/okd-scos-images	`b70494e`	link	true	`/test okd-scos-images`
ci/prow/images	`b70494e`	link	true	`/test images`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

We added the OPENSHIFT_VERSION and YUM_REPO_NAMES build args in openshift/os#1935 so let's add them here. Also drop the quay.io/openshift-release-dev/ocp-v4.0-art-dev:c9s-coreos references because we don't have that defined in our containerfile anymore.

locriandev changed the title ~~Use rpm-ostree install directly in legacy build pipeline~~ ART-14453: Use rpm-ostree install directly in legacy build pipeline May 13, 2026

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label May 13, 2026

openshift-ci Bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label May 21, 2026

locriandev force-pushed the rpm-ostree-install-legacy branch from a4808ee to fdca987 Compare May 21, 2026 13:51

openshift-ci Bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label May 21, 2026

locriandev and others added 6 commits May 21, 2026 10:53

set OPENSHIFT_VERSION in build-args

9f15796

This way when we update for newer releases we don't need to update the script, but just the build-args. In other words, this keeps the definitions for things out of the script.

build-args: add comments for IMAGE_{NAME,CPE}

2bbeec4

Help explain a bit more what they are used for.

build-node-image: SCOS is any CentOS

d9e319d

We don't really need the `10` conditional.

dustymabe force-pushed the rpm-ostree-install-legacy branch from fdca987 to 0f99d7e Compare May 21, 2026 16:14

jlebon approved these changes May 21, 2026

View reviewed changes

Comment thread build-node-image.sh Outdated

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 21, 2026

dustymabe mentioned this pull request May 21, 2026

openshift/os: adapt for more build-args changes openshift/release#79631

Open

dustymabe force-pushed the rpm-ostree-install-legacy branch from 0f99d7e to b70494e Compare May 21, 2026 18:44

Conversation

locriandev commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Uh oh!

openshift-ci Bot commented May 13, 2026

Summary

Changes

Key details

Uh oh!

openshift-ci-robot commented May 13, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Uh oh!

travier commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

travier commented May 13, 2026

Uh oh!

locriandev commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Re: dnf adoption

Re: the repo 401 errors

Uh oh!

dustymabe commented May 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

travier commented May 21, 2026

Uh oh!

dustymabe commented May 21, 2026

Uh oh!

dustymabe commented May 21, 2026

Uh oh!

jlebon left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

openshift-ci Bot commented May 21, 2026

Uh oh!

openshift-ci Bot commented May 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

locriandev commented May 13, 2026 •

edited

Loading

openshift-ci-robot commented May 13, 2026 •

edited by openshift-ci Bot

Loading

travier commented May 13, 2026 •

edited

Loading

locriandev commented May 13, 2026 •

edited

Loading

dustymabe commented May 15, 2026 •

edited

Loading