Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

overlay.d/15fcos: add a migration script to move to OCI images #3355

Open
wants to merge 1 commit into
base: testing-devel
Choose a base branch
from
Open

overlay.d/15fcos: add a migration script to move to OCI images #3355

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
99 changes: 99 additions & 0 deletions overlay.d/15fcos/usr/libexec/coreos-oci-rebase
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,99 @@
#!/bin/bash

# This is a migration script to move FCOS to OCI transport
#
# Users that have disabled Zincati or use a non default ostree remote
# won't be migrated, but a MOTD will be displayed.
# This should be shipped as a barrier-release.
#
# see https://fedoraproject.org/wiki/Changes/CoreOSOstree2OCIUpdates
# and https://github.com/coreos/fedora-coreos-tracker/issues/1823


# Maybe the machine is already on an OCI deployment
booted_imgref=$(rpm-ostree status --json --booted | jq -r '.deployments[0]."container-image-reference"')

if [ "$booted_imgref" != "null" ]; then
echo "The booted deployement is already an OCI container."
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
echo "The booted deployement is already an OCI container."
echo "The booted deployment is already an OCI container."

exit 0
fi

# check if the origin was changed
origin=$(rpm-ostree status --json --booted | jq -r '.deployments[0].origin' | cut -d ':' -f 1)
origin_url=$(ostree remote show-url "$origin")
if [ "$origin_url" != "https://ostree.fedoraproject.org" ]; then
write_motd
exit 0
fi

# If Zincati is disabled, do nothing
if ! systemctl is-enabled --quiet zincati; then
write_motd
exit 0
fi

# Proceed with the migration by faking the origin file,
# so at the next update, Zincati will pull the OCI image

# get the currently booted ostree checksum
checksum=$(rpm-ostree status --booted --json | jq -r '.deployments[0].checksum')
# fetch the SHA checksum of the matching OCI image for the booted deployment
version=$(rpm-ostree status --booted --json | jq -r '.deployments[0].version')
stream=$(rpm-ostree status --booted --json | jq -r '.deployments[0]."base-commit-meta"."fedora-coreos.stream"')
arch=$(arch)
cincinnati_url="https://raw-updates.coreos.fedoraproject.org/v1/graph?basearch=$arch&stream=$stream&oci=true"
imgref=$(curl "$cincinnati_url" -s | jq --arg VERSION "$version" -r '.nodes[] | select(.version==$VERSION) | .payload')
Comment on lines +44 to +45
Copy link
Member

@dustymabe dustymabe Feb 28, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should make a failure here nonfatal. IIUC the reason for the curl is more cosmetic than anything else (so rpm-ostree status shows something not unexpected), but if it fails for whatever reason I think we should continue the migration.

Things that could cause this to fail could be complicated network environments like proxies, or maybe wifi where the NIC hasn't come up fully yet or something.



# Empty the current origin
tmpfile=$(mktemp)
sed -e '/^refspec=/d' \
-e '/^baserefspec=/d' /ostree/deploy/fedora-coreos/deploy/"$checksum".0.origin > "$tmpfile"

{
echo "container-image-reference=ostree-remote-image:fedora:registry:$imgref"
echo "custom-url=ostree-remote-image:fedora:registry:$imgref"
echo "custom-description=Fedora CoreOS testing stream"
} >> "$tmpfile"

mount -o remount,rw /sysroot

# Replace the origin with our crafted one
cp "$tmpfile" /ostree/deploy/fedora-coreos/deploy/"$checksum".0.origin


# Restart Zincati
systemctl restart zincati
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this happening here leads to temporary problems.. basically if there is an update available $now (which I guess is unlikely but could be the case when older systems are jumping through this new barrier we are going to create) then zincati will do it's thing and rpm-ostree will too, but if rpm-ostreed hasn't timed out and deactivated since we wrote the custom origin file then it will complain:

Feb 27 22:01:40 cosa-devsh rpm-ostree[3917]: Txn Deploy on /org/projectatomic/rpmostree1/fedora_coreos failed: Cannot look up version while tracking a container image reference

Maybe we should restart rpm-ostreed here too just to make sure it's picked up the new custom origin?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Interesting scenario, I didn't thought of that.
This definitely requires more testing in these corner cases.


write_motd () {

# Change the output color to yellow
warn=$(echo -e '\033[0;33m')
# No color
nc=$(echo -e '\033[0m')

motd_path=/run/motd.d/40-fcos-oci-rebase.motd

cat << EOF > "${motd_path}"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we should have a separate script that writes out the MOTD and it should run on every boot unless the user has neutered it by touching a stamp file.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

basically we can roll out the MOTD script later (i.e. like a month in to F42 or something).

${warn}
##########################################################################
WARNING: Fedora CoreOS will be distributed through OCI images, to better
align with the bootable containers initiative.
The OSTree repository is expected to be retired after the Fedora 43
release.

The migration service detected this system either have automatic updates
disabled or is using a non-default ostree origin URL.

The following command will rebase your system to the latest $stream release:
sudo rpm-ostree rebase <insert image>

See more details at <link to documentation page>

To disable this warning, use:
sudo systemctl disable coreos-oci-migration.service
##########################################################################
${nc}
EOF

}
Loading