Skip to content

Conversation

@hroyrh
Copy link

@hroyrh hroyrh commented Sep 17, 2025

When read-only root filesystem is enabled for ironic-image based containers, the path /var/lib/ironic/master_iso_images becomes read-only. We need to change the path to custom data directory so that changes can be made to this path for updating image cache.

e-minguez and others added 30 commits February 4, 2025 11:20
Signed-off-by: e-minguez <e.minguez@gmail.com>
This simple change allows us to build ironic containers using
CS10 base images, adding that as supported OS.
This has been tested locally and in CI.

Signed-off-by: Riccardo Pittau <elfosardo@gmail.com>
…ixes metal3-io#627

Signed-off-by: Brian Oldfield <boldfield@nvidia.com>
Signed-off-by: Brian Oldfield <boldfield@nvidia.com>
Signed-off-by: Brian Oldfield <boldfield@nvidia.com>
Signed-off-by: Brian Oldfield <boldfield@nvidia.com>
Signed-off-by: Brian Oldfield <boldfield@nvidia.com>
Passing a password in clear text is an obviously bad idea. Add support
for mounting a secret and deprecate the clear text approach.

This change also makes it a fatal error to not pass the password.
Our mariadb-image does not support empty passwords anyway, and we should
not rely on anyone actually using "change_me" without realizing it.

Signed-off-by: Dmitry Tantsur <dtantsur@protonmail.com>
⚠️ Deprecate passing MARIADB_PASSWORD in favour of mounting a secret
✨ Install shim-pkg explicitly and add support for CentOS Stream 10
The new entrypoints rundatabase-upgrade and runonline-data-migrations are
designed to be run as a Job every time Ironic is upgraded. See also:
https://docs.openstack.org/ironic/latest/admin/upgrade-guide.html

Signed-off-by: Dmitry Tantsur <dtantsur@protonmail.com>
Signed-off-by: Dmitry Tantsur <dtantsur@protonmail.com>
Previously, it defaults to true for a split API/conductor deployment,
but this mode is no longer supported. Most deployments use a single
Ironic process and SQLite as a backend.

Update README with the relevant parameters.

Signed-off-by: Dmitry Tantsur <dtantsur@protonmail.com>
If upgrades are managed by IrSO, Ironic should not do them again.
In an environment with several Ironic instances it will cause a race.

Signed-off-by: Dmitry Tantsur <dtantsur@protonmail.com>
⚠️ Set IRONIC_USE_MARIADB to false by default in all cases
🌱 Refactoring: add a helper for restarting a service on certificate update
…efined

Signed-off-by: Brian Oldfield <boldfield@nvidia.com>
✨ Add scripts to run database upgrades and online migrations
We release sushy-tools 2.0.0 last week, let's update the version
we use in Metal3

Signed-off-by: Iury Gregory Melo Ferreira <imelofer@redhat.com>
…ig-tweaks

🐛 Allow override of `http_url`, etc for different network topologies
Signed-off-by: Riccardo Pittau <elfosardo@gmail.com>
This commit:
 - Introduces an environment variable that will cause all configuration files
   to be relocated under the specified location.
 - Introduces a .gitignore file in order to exclude temporary files from
   version control.
 - Converts the probes to be parameterized via environment variables thus
   removes the need for jinja templates.
 - A few configuration template files that were copied to /etc during image
   building have been moved to /tmp to keep the root of /etc more organized.

This commit is needed in order to turn the ironic container compatible with
K8s readOnlyRootFilesystem pod security context.

Signed-off-by: Adam Rozman <adam.rozman@est.tech>
Signed-off-by: Riccardo Pittau <elfosardo@gmail.com>
🌱 Update virtualbmc version to 3.2.0
✨ Add build ironic-image with CentOS Stream 10
✨ Add support for custom configuration directories
This reverts commit d534678.

Newly added syntax breaks the builds for entire repo. We have 5 images
built here, so I'm reverting this and we'll reintroduce the patch.

Signed-off-by: Tuomo Tanskanen <tuomo.tanskanen@est.tech>
🐛 Revert "Add build ironic-image with CentOS Stream 10"
Signed-off-by: Lennart Jern <lennart.jern@est.tech>
@hroyrh
Copy link
Author

hroyrh commented Nov 12, 2025

/retest-required

1 similar comment
@hroyrh
Copy link
Author

hroyrh commented Nov 13, 2025

/retest-required

@hroyrh
Copy link
Author

hroyrh commented Nov 13, 2025

/unhold

@openshift-ci openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Nov 13, 2025
@elfosardo elfosardo mentioned this pull request Nov 14, 2025
# NOTE(hroyrh): after a discussion with dtantsur, we have decided to not
# update metal3/ironic-image repo with the change in this downstream
# pr - https://github.com/openshift/ironic-image/pull/702, since the change
# is specific to openshift
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this look good ?

@elfosardo
Copy link

/test prevalidation-images

@elfosardo
Copy link

/test prevalidation-e2e-metal-ipi-bm-prevalidation prevalidation-e2e-metal-ipi-ovn-ipv6-prevalidation prevalidation-e2e-metal-ipi-virtualmedia-prevalidation

@elfosardo
Copy link

/test prevalidation-e2e-metal-ipi-bm-prevalidation

@hroyrh
Copy link
Author

hroyrh commented Nov 20, 2025

/retest-required

@hroyrh hroyrh changed the title METAL-1569: Use custom data directory to store the master iso images on ironic-conductor node Use custom data directory to store the master iso images on ironic-conductor node Nov 20, 2025
@openshift-ci-robot openshift-ci-robot removed the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Nov 20, 2025
@openshift-ci-robot
Copy link

@hroyrh: No Jira issue is referenced in the title of this pull request.
To reference a jira issue, add 'XYZ-NNN:' to the title of this pull request and request another refresh with /jira refresh.

Details

In response to this:

When read-only root filesystem is enabled for ironic-image based containers, the path /var/lib/ironic/master_iso_images becomes read-only. We need to change the path to custom data directory so that changes can be made to this path for updating image cache.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@hroyrh
Copy link
Author

hroyrh commented Nov 21, 2025

The master-iso-images path related change was cherry-picked and merge in a separate pr - #722
Just doing the upstream sync now.

@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 21, 2025
@hroyrh hroyrh changed the title Use custom data directory to store the master iso images on ironic-conductor node NO-ISSUE: Upstream sync Nov 21, 2025
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Nov 21, 2025
@openshift-ci-robot
Copy link

@hroyrh: This pull request explicitly references no jira issue.

Details

In response to this:

When read-only root filesystem is enabled for ironic-image based containers, the path /var/lib/ironic/master_iso_images becomes read-only. We need to change the path to custom data directory so that changes can be made to this path for updating image cache.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-merge-robot openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 21, 2025
@openshift-ci
Copy link

openshift-ci bot commented Dec 2, 2025

@hroyrh: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/okd-scos-e2e-aws-ovn dd0e07d link false /test okd-scos-e2e-aws-ovn
ci/prow/check-requirements 9fecf05 link true /test check-requirements
ci/prow/prevalidation-e2e-metal-ipi-ovn-ipv6-prevalidation 9fecf05 link true /test prevalidation-e2e-metal-ipi-ovn-ipv6-prevalidation
ci/prow/prevalidation-e2e-metal-ipi-virtualmedia-prevalidation 9fecf05 link true /test prevalidation-e2e-metal-ipi-virtualmedia-prevalidation
ci/prow/prevalidation-images 9fecf05 link true /test prevalidation-images
ci/prow/prevalidation-e2e-metal-ipi-bm-prevalidation 9fecf05 link true /test prevalidation-e2e-metal-ipi-bm-prevalidation
ci/prow/images 9fecf05 link true /test images
ci/prow/okd-scos-images 9fecf05 link true /test okd-scos-images
ci/prow/e2e-metal-ipi-ovn-ipv6 9fecf05 link true /test e2e-metal-ipi-ovn-ipv6
ci/prow/e2e-metal-ipi-virtualmedia 9fecf05 link true /test e2e-metal-ipi-virtualmedia
ci/prow/e2e-metal-ipi-bm 9fecf05 link true /test e2e-metal-ipi-bm

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Dec 2, 2025
@openshift-merge-robot
Copy link

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD.

Projects

None yet

Development

Successfully merging this pull request may close these issues.