Hermetic next - #166
Open
uril wants to merge 8 commits into
Open
Conversation
accounting for Containerfile unification, bumping buildroot Signed-off-by: Jakob Naucke <jnaucke@redhat.com> Assisted-by: AI
Signed-off-by: Jakob Naucke <jnaucke@redhat.com> Assisted-by: AI
Create MachineConfig, MachineConfigPool & MachineSet. Includes pluggable modules for TEE platforms, and Azure as a first module. Test with 1 & 2 replicas. Test with a replica after deletion. Operator components are deployed in the same cluster, i.e. no bootstrap functionality. Will not work until coreos/fedora-coreos-tracker#2191 is resolved, but already gets to Azure machine creation (with no ignition) in this state. Signed-off-by: Jakob Naucke <jnaucke@redhat.com> Assisted-by: AI
has an incompatible validation rule Signed-off-by: Jakob Naucke <jnaucke@redhat.com> Assisted-by: AI
Assisted-By: Claude Opus 4.8 Signed-off-by: Uri Lublin <uril@redhat.com>
The consolidated Containerfile dropped the `AS builder` label. Later stages use it e.g. `COPY --from=builder` / `FROM builder`. Upstream operator/Containerfile has `... AS builder`. Assisted-By: Claude Opus 4.8 Signed-off-by: Uri Lublin <uril@redhat.com>
Bumps the operator submodule from 1b8651e to 53fb1ed (upstream main). This pulls in the fix that adds the reference-values git dependency to operator/Cargo.lock, which is required for hermetic cargo builds: cachi2 prefetch is driven by Cargo.lock and cannot resolve the missing dep offline. (`cargo fetch --locked` now succeeds.) Also refreshes drift-cache/Containerfile to match the upstream Containerfile, whose distribution stages moved fedora:43 -> fedora-minimal:43. The downstream Containerfile already uses ubi9/ubi-minimal for those stages, so no logic change is mirrored there (per the sync-operator-submodule skill). Assisted-By: Claude Opus 4.8 Signed-off-by: Uri Lublin <uril@redhat.com>
Activate cachi2 prefetch + network isolation for all build components.
- .tekton: set hermetic=true and prefetch-input on the 6 build components
(operands: gomod+cargo+generic; bundle: gomod+rpm+generic; buildroot: rpm).
FBC is left unchanged (already hermetic, no prefetch needed).
- reference-values: vendor as a git submodule (pinned commit) and COPY it in the
compute-pcrs-data stage instead of `git clone` in the Containerfile.
- Containerfile: copy the cachi2-injected operator/.cargo config into the build
workdir so offline cargo resolves the vendored crates; prefetch controller-gen
and kopium (musl static) via cachi2 'generic' and place them where 'make crds-rs'
expects, so it never hits the network.
- Containerfile.bundle: fetch yq, operator-sdk and controller-gen via cachi2
'generic' ; keep the SHA256 verification.
- rpm prefetch: add per-component lockfiles:
.konflux/buildroot/rpms.{in,lock}.yaml (rust toolchain, base ubi9/go-toolset)
.konflux/bundle/rpms.{in,lock}.yaml (git/make/golang, base ubi9/ubi)
and point each component's rpm prefetch-input at its path.
- artifacts.lock.yaml: controller-gen, kopium, yq, operator-sdk.
Assisted-By: Claude Opus 4.8
Signed-off-by: Uri Lublin <uril@redhat.com>
uril
force-pushed
the
hermetic_next
branch
2 times, most recently
from
August 29, 2026 22:40
ea4125d to
56a5cb5
Compare
Jakob-Naucke
pushed a commit
to Jakob-Naucke/confidential-clusters-operator
that referenced
this pull request
Sep 1, 2026
Activate network isolation for buildroot.
- .tekton: set hermetic=true and prefetch-input on buildroot
- rpm prefetch: add per-component lockfiles:
.konflux/buildroot/rpms.{in,lock}.yaml (rust toolchain, base ubi9/go-toolset)
Changes selectively taken from confidential-clusters#166.
Assisted-By: Claude Opus 4.8
Signed-off-by: Jakob Naucke <jnaucke@redhat.com>
Jakob-Naucke
added a commit
to Jakob-Naucke/confidential-clusters-operator
that referenced
this pull request
Sep 1, 2026
Activate network isolation for buildroot, which is already required for releasing a new buildroot, so that we can merge confidential-clusters#168. - .tekton: set hermetic=true and prefetch-input on buildroot - rpm prefetch: add per-component lockfiles: .konflux/buildroot/rpms.{in,lock}.yaml (rust toolchain, base ubi9/go-toolset) Most changes selectively taken from confidential-clusters#166, then expanded with perl-core in the buildroot. Assisted-By: Claude Opus 4.8 Signed-off-by: Jakob Naucke <jnaucke@redhat.com> Co-authored-by: Uri Lublin <uril@redhat.com>
Jakob-Naucke
added a commit
to Jakob-Naucke/confidential-clusters-operator
that referenced
this pull request
Sep 1, 2026
Activate network isolation for buildroot, which is already required for releasing a new buildroot, so that we can merge confidential-clusters#168. - .tekton: set hermetic=true and prefetch-input on buildroot - rpm prefetch: add per-component lockfiles: .konflux/buildroot/rpms.{in,lock}.yaml (rust toolchain, base ubi9/go-toolset) Most changes selectively taken from confidential-clusters#166, then expanded with perl-core in the buildroot. Assisted-By: Claude Opus 4.8 Signed-off-by: Jakob Naucke <jnaucke@redhat.com> Co-authored-by: Uri Lublin <uril@redhat.com>
Jakob-Naucke
added a commit
to Jakob-Naucke/confidential-clusters-operator
that referenced
this pull request
Sep 1, 2026
Activate network isolation for buildroot, which is already required for releasing a new buildroot, so that we can merge confidential-clusters#168. - .tekton: set hermetic=true and prefetch-input on buildroot - rpm prefetch: add per-component lockfiles: .konflux/buildroot/rpms.{in,lock}.yaml (rust toolchain, base ubi9/go-toolset) Most changes selectively taken from confidential-clusters#166, then expanded with perl-core in the buildroot. Assisted-By: Claude Opus 4.8 Signed-off-by: Jakob Naucke <jnaucke@redhat.com> Co-authored-by: Uri Lublin <uril@redhat.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Enabling hermetic builds, by pulling all the sources and tools needed for the build in a 'prefetch' step, such that the 'build' step can be done with no network.
I call it 'next' since it sits on top of PR!162