CASMHMS-6018 Pre-signed URL support root=live:

[rustydb]

Summary and Scope

EXPLAIN WHY THIS PR IS NECESSARY. WHAT IS IMPACTED?
IS THIS A NEW FEATURE OR CRITICAL BUG FIX? SUMMARIZE WHAT CHANGED.

For CSM Application, Compute, and Hypervisor images there is a need offer boot support for native dracut.

Native dracut uses the root=live:<url> parameter to determine where to pull the LIVE image from. Since our images are served from private S3 buckets, we use pre-signed URLs to facilitate image pulls on our nodes. Currently we only provide pre-signed URLs to the metal.server command line parameter, in order to support dracut's own LIVE image booting we need to support the root=live:<url> parameter as well.

DOES THIS CHANGE INVOLVE ANY SCHEME CHANGES? Y/N

No.

REMINDER: HAVE YOU INCREMENTED VERSION NUMBERS? E.G., .spec, Chart.yaml, .version, CHANGELOG.md

Yes.

REMINDER 2: HAVE YOU UPDATED THE COPYRIGHT PER hpe GUIDELINES: (C) Copyright 2014-2021 Hewlett Packard Enterprise Development LP ? Y/N

N/A

Issues and Related PRs

LIST AND CHARACTERIZE RELATIONSHIP TO JIRA ISSUES AND OTHER PULL REQUESTS. BE SURE LIST DEPENDENCIES.

• Resolves CASMHMS-6018

Testing

Tested on:

• mug

WHAT WAS THE EXTENT OF TESTING PERFORMED? MANUAL VERSUS AUTOMATED TESTS (UNIT/SMOKE/OTHER)
HOW WERE CHANGES VERIFIED TO BE SUCCESSFUL?

Images using metal.server and root=live:<url> successfully booted.

Prior to this change, root=live:s3:// was not being replaced with a pre-signed URL:

http://rgw-vip.nmn/boot-images/hypervisor/0.5.37/kernel... ok
http://rgw-vip.nmn/boot-images/hypervisor/0.5.37/initrd... ok
[    0.172832][    T0] DMAR: [Firmware Bug]: No firmware reserved region can cover this RMRR [0x00000000683c5000-0x00000000683c7fff], contact BIOS vendor for fixes
[    5.120122][ T1116] dracut: FATAL: Don't know how to handle 'root=live:s3://boot-images/hypervisor/0.5.37/rootfs'
[    5.130593][ T1116] dracut: Refusing to continue
[    5.137004] dracut-cmdline[1116]: Warning:
Warning: dracut: FATAL: Don't know how to handle 'root=live:s3://boot-images/hypervisor/0.5.37/rPress Enter for maintenance

Following this change the URL was updated accordingly and the node received a pre-signed URL at root=live:<pre-signed URL>.

Risks and Mitigations

This is low-risk, it adds a new expression to the regex for matching applicable command line parameters to replace. The original regular expression still matches the same tokens.

[github-actions]

👋 Hey! Here is the image we built for you (Artifactory Link):

artifactory.algol60.net/csm-docker/unstable/cray-bss-hmth-test:1.25.0-20230523193649.3d629e8

Use podman or docker to pull it down and inspect locally:

podman pull artifactory.algol60.net/csm-docker/unstable/cray-bss-hmth-test:1.25.0-20230523193649.3d629e8

Or, use this script to pull the image from the build server to a dev system:

Dev System Pull Script

Note the following script only applies to systems running CSM 1.2 or later.

#!/usr/bin/env bash

IMAGE=artifactory.algol60.net/csm-docker/unstable/cray-bss-hmth-test:1.25.0-20230523193649.3d629e8

podman run --rm --network host  \
    quay.io/skopeo/stable copy \
    --src-tls-verify=false \
    --dest-tls-verify=false \
    --dest-username "$(kubectl -n nexus get secret nexus-admin-credential -o json | jq -r '.data.username | @base64d')" \
    --dest-password "$(kubectl -n nexus get secret nexus-admin-credential -o json | jq -r '.data.password | @base64d')" \
    docker://$IMAGE \
    docker://registry.local/$IMAGE

Snyk Report

Coming soon

Software Bill of Materials

cosign download sbom artifactory.algol60.net/csm-docker/unstable/cray-bss-hmth-test:1.25.0-20230523193649.3d629e8 > container_image.spdx

If you don't have cosign, then you can get it here.

Note: this SHA is the merge of 0a1196f and the PR base branch. Good luck and make rocket go now! 🌮 🚀

[github-actions]

👋 Hey! Here is the image we built for you (Artifactory Link):

artifactory.algol60.net/csm-docker/unstable/cray-bss:1.25.0-20230523193637.3d629e8

Use podman or docker to pull it down and inspect locally:

podman pull artifactory.algol60.net/csm-docker/unstable/cray-bss:1.25.0-20230523193637.3d629e8

Or, use this script to pull the image from the build server to a dev system:

Dev System Pull Script

Note the following script only applies to systems running CSM 1.2 or later.

#!/usr/bin/env bash

IMAGE=artifactory.algol60.net/csm-docker/unstable/cray-bss:1.25.0-20230523193637.3d629e8

podman run --rm --network host  \
    quay.io/skopeo/stable copy \
    --src-tls-verify=false \
    --dest-tls-verify=false \
    --dest-username "$(kubectl -n nexus get secret nexus-admin-credential -o json | jq -r '.data.username | @base64d')" \
    --dest-password "$(kubectl -n nexus get secret nexus-admin-credential -o json | jq -r '.data.password | @base64d')" \
    docker://$IMAGE \
    docker://registry.local/$IMAGE

Snyk Report

Coming soon

Software Bill of Materials

cosign download sbom artifactory.algol60.net/csm-docker/unstable/cray-bss:1.25.0-20230523193637.3d629e8 > container_image.spdx

If you don't have cosign, then you can get it here.

Note: this SHA is the merge of 0a1196f and the PR base branch. Good luck and make rocket go now! 🌮 🚀