packages: add managed and unmanaged subpackages in release#944
Conversation
There was a problem hiding this comment.
Not sure if we need this since we're not concerned with network initialisation in minios
There was a problem hiding this comment.
I'm still keep this since this is the one set the fix name for the network interface between the kernel space and user space just in case and we could remove this later if not needed.
There was a problem hiding this comment.
These rules, packages/minios/ephemeral-ebs-storage.rules, and packages/minios/ephemeral-storage.rules can be dropped or atleast modified since we don't expect to setup EBS volumes with the nested hypervisor.
There was a problem hiding this comment.
I don't expect needing to run logdog from inside the nested hypervisor.
| %description | ||
| %{summary}. | ||
|
|
||
| %package -n %{_cross_os}minios-corndog |
There was a problem hiding this comment.
%package corndog will append %{_cross_os}minios- to the package name. Same for certdog and ghostdog
| %description -n %{_cross_os}minios-brush | ||
| %{summary}. | ||
|
|
||
| %package -n %{_cross_os}minios-whippet |
There was a problem hiding this comment.
Missing Requires for whippet
|
|
||
|
|
||
|
|
||
| %package -n %{_cross_os}minios-brush |
| %cargo_build --manifest-path %{_builddir}/sources/Cargo.toml \ | ||
| -p ghostdog \ | ||
| -p corndog \ | ||
| -p certdog \ | ||
| -p brush \ | ||
| -p whippet \ | ||
| %{nil} |
There was a problem hiding this comment.
Instead of rebuilding these sources, can we depend on os-{ghostdog,corndog,etc}?
That way we don't have to build these packages twice
There was a problem hiding this comment.
Great idea. I was debating because that will introduce some dead config/template but I think that should be fine.
There was a problem hiding this comment.
Nit: There's a lot of extra newlines in this file
| # bootconfig snippets. | ||
|
|
||
| # TPM2-related services. | ||
|
|
||
| # TPM2-related drop-ins. |
There was a problem hiding this comment.
These comments can be dropped
There was a problem hiding this comment.
We don't need to include kernel-devel for nested hypervisor
|
|
||
| # Other drop-ins. | ||
| Source93: release-tmpfiles.conf | ||
| Source95: release-systemd-networkd.conf |
There was a problem hiding this comment.
Declared but not present or installed
| Source1101: systemd-resolved-service-env.conf | ||
| Source1102: systemd-networkd-service-env.conf |
There was a problem hiding this comment.
Same. Sources are declared but not present in the package files or installed.
|
forced push to address feedback. A con for reduce the double compilation will be inevitable pull in some died configuration file. |
|
forced pushed to fix the changes forget to add in the previous push. |
sky1122
force-pushed
the
mini
branch
2 times, most recently
from
5293384 to
e1d8f67
Compare
There was a problem hiding this comment.
a bloker for myself is removing the embedded testing image from here and spec file after the twoliter change merge and finish testing
| Requires: %{_cross_os}libkcapi | ||
| Requires: (%{name}-fips if %{_cross_os}image-feature(fips)) | ||
| Requires: (%{name}-crypt if %{_cross_os}image-feature(encrypted-storage)) | ||
| Requires: (%{_cross_os}release-managed if %{_cross_os}image-feature(no-unmanaged)) |
There was a problem hiding this comment.
a reminder for myself this will need to change after twoliter change update
sky1122
force-pushed
the
mini
branch
2 times, most recently
from
aba41a5 to
7fa9cd5
Compare
|
forced pushed to match with Twoliter PR image feature name; remove rebase wrong twoliter file. The testing image still embedded into the spec file. Will remove once the Twoliter feature name confirm. |
|
Please include inverted testing details as well - i.e., build, launch, test "managed" release instances |
|
forced pushed to change the spec file to refactored release package into a shared base with managed/unmanaged subpackages selected by first-party-stack image feature, using systemd drop-ins to extend base units for |
sky1122
force-pushed
the
mini
branch
2 times, most recently
from
34b0b3d to
16b7b88
Compare
|
force pushed(s) to rebase |
sky1122
changed the title
| # Create the filesystem on the partition, if it doesn't exist. | ||
| ExecStart=/usr/lib/systemd/systemd-makefs ${DATA_PARTITION_FILESYSTEM} ${DATA_PARTITION_BLOCK_DEVICE} |
There was a problem hiding this comment.
correct me if I'm wrong, but I was under the impression that the "unmanaged" image would not have a data partition
There was a problem hiding this comment.
The Formatted data partition will come up later provided by others and this one right now just do a no ops so yes I can move this to managed-release only.
| d /var/log/kdump 0700 root root - | ||
| T /var/log/kdump - - - - security.selinux=system_u:object_r:secret_t:s0 |
There was a problem hiding this comment.
why don't we include kdump in the unmanaged / guest? I would imagine we'd want insights into kernel panics there
There was a problem hiding this comment.
That's a good point! I will also includ kexec-tools and makedumpfile and then add kdump services/tmpfiles to the base package since the insights into kernel panics are important and they are the chain for that.
sky1122
force-pushed
the
mini
branch
2 times, most recently
from
5dcedc8 to
81d53db
Compare
|
force pushed to add |
| Requires: %{_cross_os}filesystem | ||
| Requires: %{_cross_os}findutils | ||
| Requires: %{_cross_os}glibc | ||
| Requires: %{_cross_os}grep |
There was a problem hiding this comment.
grep can probably stay in the release-managed package
There was a problem hiding this comment.
I will still prefer to keep the grep in both since grep is only 129KB and might be useful.
There was a problem hiding this comment.
I am unclear on the expected customer use of the unmanaged release package, which makes it hard to judge the extent to which we want to trim and split the packages.
I would question the addition of findutils, kexec-tools and makedumpfile as well since I don't expect a customer running any of the bundled binaries on a nested instance.
There was a problem hiding this comment.
Fair concern. These are ~585KB total and provide integration-time value. It give us inspect kernel behavior interactively and their usefulness is conditional on changing the runtime. The guest kernel-load path is still being defined across people, so having them on the base image reduces turnaround during bring-up. I think keep through integration still ok and we can revisit as an explicit trimming pass once the use case stabilizes.
Refactor the release package into a shared base with two mutually exclusive subpackages selected by the `first-party-stack` image feature: - release-managed: extends base units with systemd drop-ins for the settings API, updates, and repart-data partition discovery. Requires the full first-party stack (os package) and managed-only dependencies. - release-unmanaged: minimal configuration for variants without the first-party management stack. Requires only corndog, certdog, ghostdog, and whippet. The base release package contains shared systemd units in their minimal form. The managed subpackage layers additional ordering dependencies (reboot-if-required, settings-applier) and services via drop-in configs rather than maintaining separate copies of unit files. Signed-off-by: Jingwei Wang <jweiw@amazon.com>
|
forced pushed to address the feedback. |
3 participants
Description of changes:
Refactor the release package into a shared base with two mutually exclusive subpackages (release-managed and
release-unmanaged), selected automatically by the first-party-stack image feature.
The base release package contains the minimal set of shared systemd units, configs, and mounts used by both managed and unmanaged variants. The release-managed subpackage extends the base via systemd drop-ins (adding dependencies on reboot-if-required, settings-applier, and repart-data masking) and includes all managed-only services, mounts, templates, and configs. The release-unmanaged subpackage provides a minimal configuration for variants without the first-party management stack.
In some systemd config and rules there are few things I didn't delete because I'm not sure, but happy to hear any feedback.
Testing done:
fips related service
systemd is working
Docker Hello World
systemctl status
overlay mount status
partition
Terms of contribution:
By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.