manifest.yaml

rojig:
  license: MIT
  name: rhcos
  summary: OpenShift 4

# We inherit from Fedora CoreOS' base configuration
include:
  - fedora-coreos-config/manifests/ignition-and-ostree.yaml
  - fedora-coreos-config/manifests/file-transfer.yaml
  # RHCOS owned packages
  - rhcos-packages.yaml

arch-include:
  x86_64:
    - fedora-coreos-config/manifests/grub2-removals.yaml
    - fedora-coreos-config/manifests/bootupd.yaml
  ppc64le: fedora-coreos-config/manifests/grub2-removals.yaml
  aarch64:
    - fedora-coreos-config/manifests/grub2-removals.yaml
    - fedora-coreos-config/manifests/bootupd.yaml

# See README.md
# and https://github.com/openshift/release/blob/master/core-services/release-controller/README.md#rpm-mirrors
repos:
  - rhel-8-baseos
  - rhel-8-appstream
  - rhel-8-fast-datapath
  - rhel-8-server-ose

# We include hours/minutes to avoid version number reuse
automatic-version-prefix: "47.82.<date:%Y%m%d%H%M>"
# This ensures we're semver-compatible which OpenShift wants
automatic-version-suffix: "-"
mutate-os-release: "4.7"

documentation: false
initramfs-args:
  - "--no-hostonly"
  - "--add-drivers"
  - "mptspi vmw_pvscsi"
  - "--omit-drivers"
  - "nouveau"
  - "--omit"
  # we don't need root-on-NFS
  # see upstream: https://github.com/coreos/fedora-coreos-config/pull/60
  - "nfs"
  - "--add"
  - "iscsi"
  - "ignition"
  - "--add"
  - "ifcfg"
  - "--add"
  - "fips"
  # The current default in RHEL8 is network-legacy
 ## XXX: This does not work for now: https://github.com/dracutdevs/dracut/issues/798
 ## XXX: Temporarily use overlay.d/05rhcos/usr/lib/dracut/modules.d/29rhcos-need-network-manager/module-setup.sh
 #- "--add"
 #- "network-manager"
  - "--omit"
  - "network-legacy"

postprocess:
  - |
     #!/usr/bin/env bash
     set -xeo pipefail

     # Disable PasswordAuthentication in SSH
     sed -i "s|^PasswordAuthentication yes$|PasswordAuthentication no|g" /etc/ssh/sshd_config
     # Disable root login because don't do that.
     sed -i "s|^PermitRootLogin yes$|PermitRootLogin no|g" /etc/ssh/sshd_config
     # Enable ClientAliveInterval and set to 180 per https://bugzilla.redhat.com/show_bug.cgi?id=1701050
     sed -i "s|^#ClientAliveInterval 0$|ClientAliveInterval 180|g" /etc/ssh/sshd_config

     # TEMPORARY: Create /etc/vmware-tools/tools.conf to ensure RHCOS shows up properly in VMWare
     # See https://jira.coreos.com/browse/RHCOS-258
     if [ "$(uname -m)" == "x86_64" ]; then
     cat > /etc/vmware-tools/tools.conf <<'EOF'
     [guestosinfo]
     short-name = rhel8-64
     EOF
     fi

     # Nuke network.service from orbit
     # https://github.com/openshift/os/issues/117
     rm -rf /etc/rc.d/init.d/network /etc/rc.d/rc*.d/*network

     # We're not using resolved yet
     rm -f /usr/lib/systemd/system/systemd-resolved.service

     # Enable tmp-on-tmpfs by default because we don't want to have things
     # leak across reboots, it increases alignment with FCOS, and also fixes
     # the Live ISO.  First, verify that RHEL is still disabling.
     grep -q '# RHEL-only: Disable /tmp on tmpfs' /usr/lib/systemd/system/basic.target
     echo '# RHCOS-only: we follow the Fedora/upstream default' >> /usr/lib/systemd/system/basic.target
     echo 'Wants=tmp.mount' >> /usr/lib/systemd/system/basic.target

     # Let's have a non-boring motd, just like CL (although theirs is more subdued
     # nowadays compared to early versions with ASCII art).  One thing we do here
     # is add --- as a "separator"; the idea is that any "dynamic" information should
     # be below that.
     # See: https://projects.engineering.redhat.com/browse/COREOS-1029
     . /etc/os-release
     cat > /etc/motd <<EOF
     Red Hat Enterprise Linux CoreOS $VERSION
       Part of OpenShift ${OPENSHIFT_VERSION}, RHCOS is a Kubernetes native operating system
       managed by the Machine Config Operator (\`clusteroperator/machine-config\`).

     WARNING: Direct SSH access to machines is not recommended; instead,
     make configuration changes via \`machineconfig\` objects:
       https://docs.openshift.com/container-platform/${OPENSHIFT_VERSION}/architecture/architecture-rhcos.html

     ---
     EOF
  - |
    #!/usr/bin/env bash
    set -xeuo pipefail
    # manually modify SELinux booleans that are needed for OCP use cases
    semanage boolean --modify --on container_use_cephfs      # RHBZ#1694045
    semanage boolean --modify --on virt_use_samba            # RHBZ#1754825

  # https://bugzilla.redhat.com/show_bug.cgi?id=1762509
  - |
    #!/usr/bin/env bash
    sed -i -e 's,echo "rd.neednet=1",true,' /usr/lib/dracut/modules.d/60clevis/module-setup.sh

  # https://gitlab.cee.redhat.com/coreos/redhat-coreos/merge_requests/812
  # https://bugzilla.redhat.com/show_bug.cgi?id=1796537
  - |
    #!/usr/bin/bash
    mkdir -p /usr/share/containers/oci/hooks.d

  # This is part of e.g. fedora-repos in Fedora; we now want to include it by default
  # so that the MCO can use it by default and not trip over SELinux issues trying
  # to create it.
  - |
    #!/usr/bin/bash
    mkdir -p /etc/yum.repos.d

  # This updates the PAM configuration to reference all of the SSSD modules.
  # Removes the `authselect` binary afterwards since `authselect` does not play well with `nss-altfiles`
  # (https://github.com/pbrezina/authselect/issues/48).
  # https://bugzilla.redhat.com/show_bug.cgi?id=1774154
  # NOTE: This is a temporary hack which should be updated after switching to systemd-sysusers
  - |
    #!/usr/bin/env bash
    set -xeuo pipefail
    # use `authselect test` since `authselect select` wants to copy to `/var` too
    authselect test sssd --nsswitch | tail -n +2 > /etc/nsswitch.conf
    for pam_file in system-auth password-auth smartcard-auth fingerprint-auth postlogin; do
      authselect test sssd --${pam_file} | tail -n +2 > /etc/pam.d/${pam_file}
    done
    rm -f $(which authselect)

  # Stop shipping a baked initiator name in the image; this should be generated
  # at runtime. We have a service which does this
  # (coreos-generate-iscsi-initiatorname.service) until it's done properly
  # upstream (see https://bugzilla.redhat.com/show_bug.cgi?id=1493296).
  - |
     #!/usr/bin/env bash
     set -xeuo pipefail

     # NB: we don't use -f here so we break when this is no longer needed
     rm -v /etc/iscsi/initiatorname.iscsi

etc-group-members:
  - wheel
  - sudo
  - systemd-journal
  - adm
ignore-removed-users:
  - root
ignore-removed-groups:
  - root
check-passwd:
  type: "file"
  filename: "passwd"
check-groups:
  type: "file"
  filename: "group"

exclude-packages:
  # https://bugzilla.redhat.com/show_bug.cgi?id=1798278
  - subscription-manager
  # And this one shouldn't come in
  - dnf
  # https://github.com/coreos/rpm-ostree/pull/1789/files/a0cd999a8acd5b40ec1024a794a642916fbc8ff8#diff-fc2076dc46933204a7a798f544ce3734
  # People need to use `rpm-ostree kargs` instead.
  - grubby

# Try to maintain this list ordering by "in RHEL, then not in RHEL".
# To verify, disable all repos except the ootpa ones and then comment
# out the bottom and run `coreos-assembler build`.
packages:
 # Dependency of iscsi
 - hostname
 # For growing root partition
 - cloud-utils-growpart
 # Contains SCTP (https://bugzilla.redhat.com/show_bug.cgi?id=1718049)
 # and it's not really going to be worth playing the "where's my kernel module"
 # game long term.  If we ship it we support it, etc.
 - kernel-modules-extra
 # Audit
 - audit
 # SELinux
 - selinux-policy-targeted
 # System setup
 - passwd
 # SSH
 - openssh-server openssh-clients
 # Containers
 - podman
 - containernetworking-plugins
 - runc
 - skopeo
 # Pinned due to cosa on Fedora not honoring RHEL 8 modules as expected
 - container-selinux
 - cri-o cri-tools
 # Networking
 - nfs-utils
 - openvswitch2.13
 - NetworkManager dnsmasq
 - NetworkManager-ovs
 - NetworkManager-team teamd
 - lvm2 iscsi-initiator-utils sg3_utils
 - device-mapper-multipath
 - xfsprogs e2fsprogs mdadm
 - cryptsetup
 - cifs-utils
 # Interactive Networking configuration during coreos-install
 - NetworkManager-tui
 # Time sync
 - chrony
 # Extra runtime
 - logrotate
 - sssd shadow-utils
 # Common tools used by scripts and admins interactively
 - sudo coreutils less tar xz gzip bzip2 rsync tmux jq
 - nmap-ncat net-tools bind-utils strace
 - bash-completion
 # Editors
 - vim-minimal nano
 # Red Hat CA certs
 - subscription-manager-rhsm-certificates
 # rdma-core cleanly covers some key bare metal use cases
 - rdma-core
 # Used on the bootstrap node
 - systemd-journal-remote
 # Extras
 - systemd-journal-gateway
 # RHEL7 compatibility
 - compat-openssl10
 # LUKS/Encryption support
 - clevis clevis-luks clevis-dracut cryptsetup-reencrypt tpm2-tools
 # Used to update PAM configuration to work with SSSD
 # https://bugzilla.redhat.com/show_bug.cgi?id=1774154
 - authselect
 # Dracut module dependencies
 - bsdtar
 # BELOW HERE ARE PACKAGES NOT IN RHEL
 # OpenShift OKD
 #- origin-node origin-hyperkube origin-clients
 # OpenShift
 - openshift-hyperkube openshift-clients
 # Gluster - Used for Openshift e2e gluster testcases
 # Reverts https://gitlab.cee.redhat.com/coreos/redhat-coreos/merge_requests/367 and add it for all arches
 - glusterfs-fuse
 # Needed for kernel-devel extension: https://bugzilla.redhat.com/show_bug.cgi?id=1885408
 # x86_64 and s390x have these packages installed as dependencies of other packages, ppc64le does not
 # FIXME: once the below BZs have been resolved to remove perl dependencies, this can be done in the extensions script
 # https://bugzilla.redhat.com/show_bug.cgi?id=1877905
 # https://bugzilla.redhat.com/show_bug.cgi?id=1886201
 - perl-interpreter

packages-x86_64:
  # Temporary add of open-vm-tools. Should be removed when containerized
  - open-vm-tools
  - irqbalance
  # Until we sort out 4.2 -> 4.3 upgrades, we need to carry this.
  # See also https://github.com/ostreedev/ostree/pull/1929
  - ostree-grub2

packages-ppc64le:
  - irqbalance

remove-from-packages:
  - - filesystem
    - "/usr/share/backgrounds"
  # https://bugzilla.redhat.com/show_bug.cgi?id=1762509
  # https://bugzilla.redhat.com/show_bug.cgi?id=1727058
  - - initscripts
    - "/"
  # In newer dracut-network dhclient isn't required if you have NM 1.20
  # https://github.com/dracutdevs/dracut/commit/e863807
  # Let's go ahead and get rid of it now.
  - - dhcp-client
    # we want to delete all files ("/") but can't because
    # `remove-from-packages` is being overzealous:
    # https://github.com/coreos/rpm-ostree/issues/2068
    - "/etc/dhcp/dhclient.conf"
    - "/etc/NetworkManager/dispatcher.d/11-dhclient"
    - "/usr/lib64/pm-utils/sleep.d/56dhclient"
    - "/usr/sbin/dhclient"
    - "/usr/sbin/dhclient-script"