Sync Omnia 2.2 changes to main

.ansible-lint

@@ -4,3 +4,4 @@ skip_list:
   - fqcn[canonical]
   - internal-error
   - role-name[path]
+  - load-failure

.github/workflows/ansible-lint.yml

@@ -7,8 +7,10 @@ on:
       - staging
       - release_1.7.1
       - pub/build_stream
-      - pub/v2.1_rc1
-      - pub/q1_dev
+      - pub/q2_dev
+      - pub/telemetry
+      - pub/q2_upgrade
+      - pub/q2_ansible
 
 jobs:
   build:
@@ -30,7 +32,7 @@ jobs:
 
       - name: Install Ansible Collections from requirements.yml
         run: |
-          ansible-galaxy collection install -r .config/requirements.yml --force
+          ansible-galaxy collection install -r .config/requirements.yml --force --clear-response-cache
 
       - name: Run ansible-lint
         uses: ansible/ansible-lint@main

.github/workflows/pylint.yml

@@ -7,8 +7,10 @@ on:
       - staging
       - release_1.7.1
       - pub/build_stream
-      - pub/v2.1_rc1
-      - pub/q1_dev
+      - pub/q2_dev
+      - pub/telemetry
+      - pub/q2_upgrade
+      - pub/q2_ansible
 
 jobs:
   build:

.gitignore

@@ -1,4 +1,16 @@
 /.idea/
 /docs/build/
 **/__pycache__/
-.venv
+.venv
+
+# IDE
+.vscode/
+
+# Documentation
+AGENTS.md
+
+# BuildStream
+build_stream/MagicMock/
+build_stream/pyproject.toml
+build_stream/tests/demo/demo_client_credentials.json
+build_stream/update_playbook_watcher.sh

ansible.cfg

@@ -7,8 +7,11 @@ forks = 5
 timeout = 180
 executable = /bin/bash
 display_skipped_hosts = false
-library = discovery/library:common/library/modules
-#inventory = /opt/omnia/omnia_inventory/cluster_layout
+deprecation_warnings = false
+show_task_path_on_failure = false
+stdout_callback = omnia_default
+callback_plugins = common/callback_plugins
+library = common/library/modules
 module_utils = common/library/module_utils
 
 [persistent_connection]

build_image_aarch64/ansible.cfg

@@ -5,6 +5,11 @@ host_key_checking = false
 forks = 5
 timeout = 180
 executable = /bin/bash
+interpreter_python = /usr/bin/python3
+deprecation_warnings = false
+show_task_path_on_failure = false
+stdout_callback = omnia_default
+callback_plugins = ../common/callback_plugins
 library = ../common/library/modules
 module_utils = ../common/library/module_utils
 

build_image_aarch64/build_image_aarch64.yml

@@ -20,11 +20,20 @@
   hosts: localhost
   connection: local
   tags: always
+  vars:
+    build_tags:
+      - "build_aarch_image"
+  pre_tasks:
+    - name: Check if config file exists
+      ansible.builtin.set_fact:
+        build_tags:
+          - "software_config"
+      when: functional_groups is defined
   tasks:
     - name: Set dynamic run tags including 'build_aarch_image'
       when: not config_file_status | default(false) | bool
       ansible.builtin.set_fact:
-        omnia_run_tags: "{{ (ansible_run_tags | default([]) + ['build_aarch_image']) | unique }}"
+        omnia_run_tags: "{{ (ansible_run_tags | default([]) | list + build_tags | default([]) | list) | unique }}"
         cacheable: true
 
 - name: Invoke validate_config.yml to perform L1 and L2 validations with build_image tag
@@ -41,7 +50,7 @@
     openchami_vars_suppport: true
     omnia_metadata_support: true
 
-- name: Load build_stream configuration
+- name: Load build_stream and storage configuration
   hosts: localhost
   connection: local
   gather_facts: false
@@ -52,6 +61,18 @@
         file: "{{ input_project_dir }}/build_stream_config.yml"
       failed_when: false
 
+    - name: Include storage_config.yml
+      block:
+        - name: Include storage_config.yml file
+          ansible.builtin.include_vars:
+            file: "{{ input_project_dir }}/storage_config.yml"
+          no_log: true
+      rescue:
+        - name: Set default storage backend if storage_config.yml not found
+          ansible.builtin.set_fact:
+            s3_configurations:
+              provider: "minio"
+
     - name: Set build_stream variables from extra_vars
       ansible.builtin.set_fact:
         build_stream_job_id: "{{ job_id | default('') }}"
@@ -125,14 +146,24 @@
   roles:
     - prepare_arm_node
 
+- name: Pre-flight SELinux policy fix on aarch64 node
+  hosts: admin_aarch64
+  connection: ssh
+  gather_facts: false
+  tasks:
+    - name: Install SELinux policy module for container runtime
+      ansible.builtin.include_role:
+        name: image_creation
+        tasks_from: preflight_selinux_check.yml
+
 - name: Fetch packages for aarch64
   hosts: localhost
   connection: local
   gather_facts: false
   roles:
     - fetch_packages
 
-- name: Openchmi build image for aarch_64
+- name: Openchami build image for aarch64
   hosts: localhost
   connection: local
   gather_facts: false

build_image_aarch64/roles/fetch_packages/tasks/fetch_packages.yml

@@ -66,6 +66,13 @@
             | items2dict
           }}
 
+    - name: Extract service_k8s_version from software_config.json
+      ansible.builtin.set_fact:
+        service_k8s_version: >-
+          {{ (lookup('file', software_config_file_path) | from_json).softwares
+             | selectattr('name', 'equalto', 'service_k8s')
+             | map(attribute='version') | first | default('') }}
+
     - name: Debug software directory compute_images_dict
       ansible.builtin.debug:
         var: compute_images_dict

build_image_aarch64/roles/fetch_packages/tasks/fetch_pulp_repos.yml

@@ -17,7 +17,7 @@
   block:
     - name: Fetch pulp endpoints for aarch64
       ansible.builtin.command: >
-        pulp rpm distribution list --field name,base_url
+        pulp rpm distribution list --field name,base_url --limit 1000
       register: pulp_endpoints
       changed_when: false
 

build_image_aarch64/roles/fetch_packages/vars/main.yml

@@ -16,7 +16,7 @@
 
 metadata_file_path: "/opt/omnia/offline_repo/.data/localrepo_metadata.yml"
 local_repo_check_msg: |
-  Failure: metadata file is not present at path {{ metadata_file_path }}.
+  Failure: metadata file is not present at path {{ metadata_file_path }} inside omnia_core container.
   Please make sure that local_repo.yml playbook is executed successfully.
 input_project_dir: "{{ hostvars['localhost']['input_project_dir'] }}"
 functional_groups_file_path: "{{ hostvars['localhost']['functional_groups_config_path'] | default('/opt/omnia/.data/functional_groups_config.yml') }}"
@@ -25,7 +25,7 @@ aarch64_build_image_completion_msg: |
   The playbook build_image_aarch64.yml has been completed successfully.
   To boot x86_64 and aarch64 nodes execute discovery/discovery.yml playbook.
 functional_group_absent_msg: |
-  Failure: No aarch64 functional groups found in functional_group_config.yml input file.
+  Failure: No aarch64 functional groups found in functional_group_config.yml input file inside omnia_core container.
   Please make sure aarch64 functional_group should be present in input file functional_group_config.yml
   to execute build_image_aarch64.yml successfully.
 build_stream_prerequisite_fail_msg: |

build_image_aarch64/roles/image_creation/files/omnia-crun-bpf.te

@@ -0,0 +1,15 @@
+module omnia-crun-bpf 1.0;
+
+require {
+    type init_t;
+    type container_runtime_t;
+    class bpf prog_run;
+}
+
+#============= init_t ==============
+# Fix: container-selinux policy regression on RHEL 10.2 (kernel 6.12+, crun 1.27+).
+# systemd (init_t) needs prog_run on container_runtime_t bpf programs to install
+# eBPF device filters on container cgroups. Without this, Podman containers fail:
+#   "crun: systemd failed to install eBPF device filter on cgroup ..."
+# Retire this module once an updated container-selinux ships the fix.
+allow init_t container_runtime_t:bpf prog_run;

build_image_aarch64/roles/image_creation/tasks/build_base_image.yml

@@ -13,13 +13,6 @@
 #  limitations under the License.
 ---
 
-- name: Normalize build stream inputs for base image
-  ansible.builtin.set_fact:
-    enable_build_stream: "{{ enable_build_stream | default(false) | bool }}"
-    build_stream_job_id: "{{ build_stream_job_id | default('') }}"
-    image_key: "{{ image_key | default('') }}"
-    base_image_suffix: ""
-
 - name: Set base image suffix when build stream inputs present
   ansible.builtin.set_fact:
     base_image_suffix: "_{{ build_stream_job_id }}-{{ image_key | default('') }}"
@@ -29,63 +22,93 @@
     - (build_stream_job_id | default('') | length) > 0
     - (image_key | default('') | length) > 0
 
-- name: Create temporary inventory with ochami group
-  ansible.builtin.copy:
-    dest: "{{ aarch64_inventory_file }}"
-    content: |
-      [ochami]
-      {{ groups['admin_aarch64'] | join('\n') }}
-    mode: "{{ hostvars['localhost']['file_permissions_644'] }}"
+- name: Create ochami images directory
+  ansible.builtin.file:
+    path: "{{ openchami_work_dir }}/images"
+    state: directory
+    mode: "{{ dir_permissions_755 }}"
+  delegate_to: "{{ aarch64_build_host }}"
+  connection: ssh
 
-- name: Create aarch64_base_image.log as a file
+- name: Create aarch64 base image log file
   ansible.builtin.file:
     path: "{{ openchami_aarch64_base_image_log_path }}"
     state: touch
     mode: "{{ dir_permissions_644 }}"
+  delegate_to: "{{ aarch64_build_host }}"
+  connection: ssh
 
-- name: Load the openchami image vars
+- name: Render aarch64 base image build config
   ansible.builtin.template:
-    src: "{{ openchami_base_image_vars_template }}"
-    dest: "{{ openchami_aarch64_base_image_vars_path }}"
+    src: "{{ role_path }}/templates/images/rhel-base-config.yaml.j2"
+    dest: "{{ openchami_work_dir }}/images/{{ rhel_aarch64_base_image_name }}-{{ rhel_tag }}.yaml"
     mode: "{{ dir_permissions_644 }}"
+  delegate_to: "{{ aarch64_build_host }}"
+  connection: ssh
 
-- name: Invoking Openchami playbook for rhel-base image build
-  ansible.builtin.shell: |
-    set -o pipefail
-    ansible-playbook {{ openchami_clone_path }}/dell/podman-quadlets/image.yaml \
-    -i {{ aarch64_inventory_file }} -v \
-    --extra-vars "@{{ openchami_aarch64_base_image_vars_path }}" \
-    --tags base_image -v | \
-    /usr/bin/tee {{ openchami_aarch64_base_image_log_path }}
-  async: 3600  # Set async timeout (e.g., 1 hour)
-  poll: 0  # Non-blocking (continue the playbook without waiting for completion)
-  register: base_image_build
-  changed_when: true
-
-- name: Wait for rhel-base image OpenCHAMI jobs to finish
+- name: Build and verify aarch64 base osimage
   block:
-    - name: Wait for rhel-base image OpenCHAMI jobs to finish
+    - name: Build aarch64 base osimage
+      ansible.builtin.shell:
+        cmd: |
+          set -o pipefail
+          podman run --rm --device /dev/fuse --network host \
+            {{ ochami_mounts | join(' ') }} \
+            {{ ochami_aarch64_image | join(' ') }} \
+            {{ ochami_base_command | join(' ') }} \
+            > '{{ openchami_aarch64_base_image_log_path }}' 2>&1
+      delegate_to: "{{ aarch64_build_host }}"
+      connection: ssh
+      async: "{{ job_async }}"
+      poll: 0
+      register: base_image_build
+      changed_when: true
+
+    - name: Wait for aarch64 base image build to complete
       ansible.builtin.async_status:
         jid: "{{ base_image_build.ansible_job_id }}"
+      delegate_to: "{{ aarch64_build_host }}"
+      connection: ssh
       register: job_result
       until: job_result.finished
       retries: "{{ job_retry }}"
       delay: "{{ job_delay }}"
+
+    - name: Verify the aarch64 base osimage in registry
+      ansible.builtin.command:
+        cmd: "/usr/local/bin/regctl repo ls --limit 500 {{ oim_node_name }}.{{ domain_name }}:5000"
+      delegate_to: "{{ aarch64_build_host }}"
+      connection: ssh
+      changed_when: false
+      register: verify_base_osimage
+
+    - name: Fail if aarch64 base osimage not created
+      ansible.builtin.fail:
+        msg: "Failed to build base osimage {{ oim_node_name }}/{{ rhel_aarch64_base_image_name }}"
+      when: (oim_node_name + '/' + rhel_aarch64_base_image_name) not in verify_base_osimage.stdout_lines
+
+    - name: Verify aarch64 base osimage output
+      ansible.builtin.debug:
+        msg: "{{ verify_base_osimage.stdout_lines }}"
+
   rescue:
     - name: Fail the build if the base image build fails
       ansible.builtin.fail:
-        msg: |
-          {{ base_image_failure_msg }}
+        msg: "{{ base_image_failure_msg }}"
 
   always:
-    - name: Remove generated base image vars file
-      ansible.builtin.file:
-        path: "{{ openchami_aarch64_base_image_vars_path }}"
-        state: absent
-
-    - name: Set openchami SELinux context
+    - name: Set openchami SELinux context for Local flow
       ansible.builtin.command: chcon -R system_u:object_r:container_file_t:s0 "{{ oim_shared_path }}/omnia/openchami"
       changed_when: true
       delegate_to: oim
       connection: ssh
       failed_when: false
+      when: omnia_share_option == 'Local'
+
+    - name: Set openchami SELinux context for NFS internal flow
+      ansible.builtin.command: chcon -R system_u:object_r:container_file_t:s0 "{{ nfs_server_share_path }}/omnia/openchami"
+      changed_when: true
+      delegate_to: oim
+      connection: ssh
+      failed_when: false
+      when: omnia_share_option == 'NFS' and nfs_type | default('') == 'internal'