Repository navigation
tests/images with tailor [2]: add parallel tailor image configs - #843
Draft
bfjelds (bfjelds) wants to merge 26 commits into
Draft
bfjelds (bfjelds) wants to merge 26 commits into
bfjelds (bfjelds) wants to merge 26 commits into
Conversation
|
Azure Pipelines: 1 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
bfjelds (bfjelds)
changed the title
bfjelds (bfjelds)
force-pushed
the
user/bfjelds/tailor-image-configs
branch
2 times, most recently
from
October 11, 2026 00:06
f66dcca to
ffe79c2
Compare
This was referenced Oct 12, 2026
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The ACL-agent qcow2 is enabled prematurely, the Azure verity VHD loses its dual-slot layout, and shared dependencies are missing from Tailor fingerprints.
4 open findings
What changed in this PR
Adds parallel Tailor configurations for legacy test-image families while preserving historical artifact names and specialized VM layouts.
Changes:
- Defines Tailor matrices, selectors, outputs, and shared image fragments.
- Migrates installer, VM, verity, container, and direct-streaming assets.
- Restores scripts and adds documentation for Tailor-based builds.
| File | Description |
|---|---|
tests/tailor-images/trident-vm-testimage/README.md |
Documents VM variants and outputs. |
tests/tailor-images/trident-vm-testimage/include/uki-verity-scripts.yaml |
Defines UKI post-customization scripts. |
tests/tailor-images/trident-vm-testimage/include/uki-verity-os-common.yaml |
Adds shared UKI OS configuration. |
tests/tailor-images/trident-vm-testimage/include/storage-usr-verity.yaml |
Defines usr-verity A/B storage. |
tests/tailor-images/trident-vm-testimage/include/storage-root-verity.yaml |
Defines root-verity A/B storage. |
tests/tailor-images/trident-vm-testimage/include/storage-grub.yaml |
Defines regular GRUB storage. |
tests/tailor-images/trident-vm-testimage/include/storage-grub-verity.yaml |
Defines GRUB verity update storage. |
tests/tailor-images/trident-vm-testimage/include/storage-grub-verity-base.yaml |
Restores dual-slot GRUB verity storage. |
tests/tailor-images/trident-vm-testimage/include/storage-acl-agent.yaml |
Defines ACL-agent persistent storage. |
tests/tailor-images/trident-vm-testimage/include/grub-verity-scripts.yaml |
Defines GRUB verity update scripts. |
tests/tailor-images/trident-vm-testimage/include/grub-verity-os-common.yaml |
Adds shared GRUB verity OS settings. |
tests/tailor-images/trident-vm-testimage/include/grub-verity-base-scripts.yaml |
Defines base-image scripts. |
tests/tailor-images/trident-vm-testimage/include/grub-verity-base-os-common.yaml |
Adds base-image OS settings. |
tests/tailor-images/trident-vm-testimage/include/grub-scripts.yaml |
Defines regular GRUB scripts. |
tests/tailor-images/trident-vm-testimage/image.yaml |
Defines the VM image matrix. |
tests/tailor-images/trident-vm-testimage/by-scenario/usr-verity.yaml |
Configures usr-verity outputs. |
tests/tailor-images/trident-vm-testimage/by-scenario/root-verity+usr-verity+acl-agent.yaml |
Shares UKI settings across scenarios. |
tests/tailor-images/trident-vm-testimage/by-scenario/root-verity.yaml |
Configures root-verity output. |
tests/tailor-images/trident-vm-testimage/by-scenario/grub.yaml |
Configures regular GRUB images. |
tests/tailor-images/trident-vm-testimage/by-scenario/grub-verity+grub-verity-azure.yaml |
Shares GRUB verity configuration. |
tests/tailor-images/trident-vm-testimage/by-scenario/grub-verity.yaml |
Configures GRUB verity COSI. |
tests/tailor-images/trident-vm-testimage/by-scenario/grub-verity-base.yaml |
Configures dual-slot qcow2. |
tests/tailor-images/trident-vm-testimage/by-scenario/grub-verity-azure.yaml |
Configures Azure verity outputs. |
tests/tailor-images/trident-vm-testimage/by-scenario/acl-agent.yaml |
Configures ACL-agent outputs. |
tests/tailor-images/trident-vm-testimage/by-arch+scenario/arm64+grub-verity.yaml |
Names ARM64 verity artifacts. |
tests/tailor-images/trident-vm-testimage/by-arch/arm64.yaml |
Selects the ARM64 base. |
tests/tailor-images/trident-vm-testimage/base/scripts/update-os-release.sh |
Updates image version metadata. |
tests/tailor-images/trident-vm-testimage/base/scripts/update-host-status.sh |
Initializes host status. |
tests/tailor-images/trident-vm-testimage/base/scripts/ssh-move-host-keys.sh |
Relocates SSH host keys. |
tests/tailor-images/trident-vm-testimage/base/scripts/prepare-update-config.sh |
Creates regular update configuration. |
tests/tailor-images/trident-vm-testimage/base/scripts/prepare-update-config-verity.sh |
Creates verity update configuration. |
tests/tailor-images/trident-vm-testimage/base/scripts/prepare-update-config-usrverity.sh |
Creates usr-verity update configuration. |
tests/tailor-images/trident-vm-testimage/base/scripts/post-install.sh |
Creates audit-log directories. |
tests/tailor-images/trident-vm-testimage/base/scripts/lsblk.sh |
Captures block-device information. |
tests/tailor-images/trident-vm-testimage/base/scripts/duid-type-to-link-layer.sh |
Adjusts network DUID behavior. |
tests/tailor-images/trident-vm-testimage/base/scripts/create-ssh-dirs.sh |
Creates persistent SSH directories. |
tests/tailor-images/trident-vm-testimage/base/scripts/create-rw-overlay-dirs.sh |
Creates writable overlay directories. |
tests/tailor-images/trident-vm-testimage/base/files/trident-acl-agent-override.conf |
Configures ACL-agent test behavior. |
tests/tailor-images/trident-vm-testimage/base/files/trident-acl-agent-cert-install.service |
Installs the test CA certificate. |
tests/tailor-images/trident-vm-testimage/base/files/sshd-keygen.service |
Generates persistent SSH host keys. |
tests/tailor-images/trident-vm-testimage/base/files/etc-mount.sh |
Mounts the writable /etc overlay. |
tests/tailor-images/trident-vm-testimage/base/files/etc-mount.service |
Runs the /etc overlay setup. |
tests/tailor-images/trident-vm-testimage/base/files/etc-mount-mic.service |
Adds MIC-specific overlay startup. |
tests/tailor-images/trident-vm-testimage/base/files/99-dhcp-eth0.network |
Configures DHCP for eth0. |
tests/tailor-images/trident-vm-testimage/base/files/.gitignore |
Ignores generated VM inputs. |
tests/tailor-images/trident-vm-testimage/base/.gitignore |
Ignores generated MIC configuration. |
tests/tailor-images/trident-verity-testimage/usr/files/dracut-nohostonly.conf |
Disables host-only initramfs generation. |
tests/tailor-images/trident-verity-testimage/README.md |
Documents verity image builds. |
tests/tailor-images/trident-verity-testimage/include/usr-storage.yaml |
Defines usr-verity storage. |
tests/tailor-images/trident-verity-testimage/include/usr-os-common.yaml |
Adds usr-verity OS settings. |
tests/tailor-images/trident-verity-testimage/include/root-storage.yaml |
Defines root-verity storage. |
tests/tailor-images/trident-verity-testimage/include/root-os-common.yaml |
Adds root-verity OS settings. |
tests/tailor-images/trident-verity-testimage/image.yaml |
Defines the verity image matrix. |
tests/tailor-images/trident-verity-testimage/by-mode/usr.yaml |
Enables signed UKI output. |
tests/tailor-images/trident-verity-testimage/by-mode/root.yaml |
Selects root-verity configuration. |
tests/tailor-images/trident-verity-testimage/by-deployment+mode/host+usr.yaml |
Configures host usr-verity. |
tests/tailor-images/trident-verity-testimage/by-deployment+mode/host+root.yaml |
Configures host root-verity. |
tests/tailor-images/trident-verity-testimage/by-deployment+mode/container+usr.yaml |
Configures container usr-verity. |
tests/tailor-images/trident-verity-testimage/by-deployment+mode/container+root.yaml |
Configures container root-verity. |
tests/tailor-images/trident-verity-testimage/by-deployment/host.yaml |
Adds host RPM sources. |
tests/tailor-images/trident-verity-testimage/by-deployment/container.yaml |
Clears host-only features. |
tests/tailor-images/trident-verity-testimage/base/trident-debug-log.sh |
Enables debug logging. |
tests/tailor-images/trident-verity-testimage/base/etc-mount.sh |
Creates the /etc overlay. |
tests/tailor-images/trident-verity-testimage/base/etc-mount.service |
Starts the overlay mount. |
tests/tailor-images/trident-verity-testimage/base/create-web-dir.sh |
Creates the test web directory. |
tests/tailor-images/trident-testimage/tailor/baseimg.yaml |
Migrates the standard image config. |
tests/tailor-images/trident-testimage/README.md |
Documents standard image builds. |
tests/tailor-images/trident-testimage/image.yaml |
Defines standard image outputs. |
tests/tailor-images/trident-testimage/by-arch/arm64.yaml |
Configures the ARM64 variant. |
tests/tailor-images/trident-testimage/base/post-install.sh |
Creates audit-log directories. |
tests/tailor-images/trident-installer/README.md |
Documents installer variants. |
tests/tailor-images/trident-installer/include/storage.yaml |
Defines installer storage. |
tests/tailor-images/trident-installer/include/kernel-args.yaml |
Defines installer kernel arguments. |
tests/tailor-images/trident-installer/include/common-packages.yaml |
Lists shared installer packages. |
tests/tailor-images/trident-installer/include/common-files.yaml |
Lists shared installer files. |
tests/tailor-images/trident-installer/image.yaml |
Defines the installer matrix. |
tests/tailor-images/trident-installer/by-variant/split.yaml |
Configures split installation. |
tests/tailor-images/trident-installer/by-variant/direct-streaming.yaml |
Configures direct streaming. |
tests/tailor-images/trident-installer/by-arch/arm64.yaml |
Names the ARM64 installer. |
tests/tailor-images/trident-installer/base/post-install.sh |
Prepares installer runtime links. |
tests/tailor-images/trident-installer/base/files/trident-split-install.service |
Runs staged installation. |
tests/tailor-images/trident-installer/base/files/trident-install.service |
Runs regular installation. |
tests/tailor-images/trident-installer/base/files/root.profile |
Opens installer logs at login. |
tests/tailor-images/trident-installer/base/files/rcp-agent.yaml |
Adds a patchable RCP placeholder. |
tests/tailor-images/trident-installer/base/files/pre-trident-script.sh |
Adds a patchable pre-install script. |
tests/tailor-images/trident-installer/base/files/direct-streaming-placeholder.conf |
Adds direct-streaming placeholder data. |
tests/tailor-images/trident-functest/tailor/baseimg.yaml |
Migrates the functional-test image. |
tests/tailor-images/trident-functest/image.yaml |
Defines functional-test output. |
tests/tailor-images/trident-container-testimage/tailor/baseimg.yaml |
Migrates container test configuration. |
tests/tailor-images/trident-container-testimage/README.md |
Documents container test builds. |
tests/tailor-images/trident-container-testimage/image.yaml |
Defines container test output. |
tests/tailor-images/trident-container-testimage/base/scripts/post-install.sh |
Creates audit-log directories. |
tests/tailor-images/trident-container-testimage/base/scripts/load-containerd-selinux-fix.sh |
Loads the container SELinux fix. |
tests/tailor-images/trident-container-testimage/base/files/trident-container.service |
Runs Trident in Docker. |
tests/tailor-images/trident-container-installer/tailor/baseimg.yaml |
Migrates container installer config. |
tests/tailor-images/trident-container-installer/README.md |
Documents container installer builds. |
tests/tailor-images/trident-container-installer/image.yaml |
Defines container installer output. |
tests/tailor-images/trident-container-installer/base/scripts/post-install.sh |
Prepares installer links. |
tests/tailor-images/trident-container-installer/base/scripts/load-containerd-selinux-fix.sh |
Loads the container SELinux fix. |
tests/tailor-images/trident-container-installer/base/files/trident-container.service |
Runs containerized installation. |
tests/tailor-images/trident-container-installer/base/files/root.profile |
Opens container installer logs. |
tests/tailor-images/tailor.yaml |
Registers toolchains, bases, and images. |
tests/tailor-images/README.md |
Documents the Tailor workspace. |
tests/tailor-images/foreign-direct-streaming-testimage/image.yaml |
Defines foreign-image conversion matrix. |
tests/tailor-images/foreign-direct-streaming-testimage/by-source/ubuntu-2404.yaml |
Configures Ubuntu 24.04 conversion. |
tests/tailor-images/foreign-direct-streaming-testimage/by-source/gb200-2404.yaml |
Configures GB200 conversion. |
tests/tailor-images/foreign-direct-streaming-testimage/by-arch+source/arm64+ubuntu-2404.yaml |
Selects ARM64 Ubuntu 24.04. |
tests/tailor-images/foreign-direct-streaming-testimage/by-arch+source/arm64+ubuntu-2204.yaml |
Selects ARM64 Ubuntu 22.04. |
tests/tailor-images/common/matrix/base-core-arm64.yaml |
Shares the ARM64 base override. |
tests/tailor-images/common/files/use-grpc-client-commit.conf |
Overrides Trident commit behavior. |
tests/tailor-images/common/files/trident-container.service |
Provides shared container service. |
tests/tailor-images/common/files/sudoers-wheel |
Enables passwordless wheel access. |
tests/tailor-images/common/files/serial-getty@.service |
Provides serial root autologin. |
tests/tailor-images/common/files/override-placeholder.conf |
Adds a patchable service override. |
tests/tailor-images/common/files/getty@.service |
Provides console root autologin. |
tests/tailor-images/common/files/containerd-mmap-fix.cil |
Backports the SELinux map permission. |
tests/tailor-images/common/files/config-placeholder.yaml |
Adds patchable host configuration. |
tests/tailor-images/azurelinux-direct-streaming-testimage/tailor/baseimg.yaml |
Migrates Azure Linux streaming config. |
tests/tailor-images/azurelinux-direct-streaming-testimage/image.yaml |
Defines architecture-specific raw outputs. |
tests/tailor-images/azurelinux-direct-streaming-testimage/by-arch/arm64.yaml |
Selects the ARM64 base. |
tests/tailor-images/azl-installer/mos/scripts/startup-command.sh |
Sets the installer login shell. |
tests/tailor-images/azl-installer/mos/scripts/installation.sh |
Runs attended or unattended installation. |
tests/tailor-images/azl-installer/iso/files/config-placeholder.yaml |
Adds the installer config placeholder. |
tests/tailor-images/azl-installer/iso/.gitignore |
Ignores staged installer artifacts. |
tests/tailor-images/azl-installer/installer-iso.yaml |
Defines the Azure Linux installer ISO. |
tests/tailor-images/azl-installer/image.yaml |
Registers the Azure Linux installer. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
bfjelds (bfjelds)
force-pushed
the
user/bfjelds/tailor-image-configs
branch
from
October 12, 2026 18:12
1038eaa to
cde7b17
Compare
bfjelds (bfjelds)
force-pushed
the
user/bfjelds/tailor-image-configs
branch
from
October 12, 2026 20:14
8bb69cc to
2d0d8cc
Compare
bfjelds (bfjelds)
force-pushed
the
user/bfjelds/tailor-image-configs
branch
from
October 12, 2026 23:20
2d0d8cc to
61fa4af
Compare
bfjelds (bfjelds)
force-pushed
the
user/bfjelds/tailor-image-configs
branch
from
October 13, 2026 00:47
61fa4af to
634aa0f
Compare
bfjelds (bfjelds)
force-pushed
the
user/bfjelds/tailor-image-configs
branch
from
October 13, 2026 01:19
634aa0f to
86d03db
Compare
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
The broad boot, storage, signing, and service migration across 160 image files warrants final human validation despite no additional concrete defects found.
0 open findings
1 resolved since last review
🧠 Review effort: Balanced
Copy the new tailor-based image definitions into tests/tailor-images as a self-contained workspace that can be validated and dry-run independently of the existing tests/images tree. The old tests/images tree remains untouched in this change. Only the new tailor manifest, per-family image definitions, and the support files and helper YAML fragments they reference are copied over. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Update the copied workspace documentation examples so they consistently reference the standalone tests/tailor-images manifest rather than the original tests/images path. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Several support files were byte-identical copies maintained separately in each image family directory (getty@.service/serial-getty@.service across azl-installer, trident-installer, and trident-container-installer; use-grpc-client-commit.conf and sudoers-wheel across trident-testimage, trident-verity-testimage, and trident-vm-testimage; config-placeholder.yaml and override-placeholder.conf between trident-installer and trident-container-installer; containerd-mmap-fix.cil and load-containerd-selinux-fix.sh between trident-container-installer and trident-container-testimage; trident-container.service between trident-verity-testimage's host and container deployments; post-install.sh between trident-container-testimage and trident-testimage). Move one canonical copy of each into a new tests/tailor-images/common/ directory (files/ and scripts/ subdirectories) and repoint every reference at the shared copy via a ../common/... relative path - verified this resolves correctly both in tailor's rendered Image Customizer config and in a real (non-dry-run) image build, since tailor mounts the whole tests/tailor-images/ workspace root read-only into the build container, so a path that stays within the workspace (unlike a path escaping it entirely, which is not mounted) resolves correctly. Also remove three files that turned out to be unreferenced by any config in either location they existed (trident-verity-testimage/base/etc.mount, trident-vm-testimage/base/etc.mount, and azurelinux-direct-streaming-testimage/base/post-install.sh) - dead weight left over from copying each family's full support-file tree during the initial tailor-images split, not wired into any image.yaml/by-*/include fragment. Left two look-alikes deliberately unmerged after checking their content differs: trident-container-installer's trident-container.service (hash differs from trident-verity-testimage's) and azl-installer's config-placeholder.yaml (hash differs from trident-installer's) - same filename, different content, not safe to share. The by-arch/arm64.yaml matrix fragment (identical 3-line content in four families) was NOT moved to common/: tailor's $include directive errors with "must be resolved before merge" when used under the base: key (unlike under config:), so this one stays duplicated as the simplest correct option. Verified: `tailor validate` (all 30 cells valid, same count/names as before), `tailor build --dry-run` for a representative cell per touched family, a real `tailor build` of trident-installer confirming the shared files are actually readable at runtime inside the IC container, and `tailor render` inspection confirming the rendered config correctly resolves the new common/ paths. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Now that tools/tailor resolves $include under base: before merge (previous commit, PR #842), the four identical by-arch/arm64.yaml fragments (azurelinux-direct-streaming-testimage, trident-installer, trident-testimage, trident-vm-testimage) can point at one shared common/matrix/base-core-arm64.yaml snippet instead of repeating `base: { $set: { ref: core_arm64 } }` verbatim in each family. Verified: `tailor validate` (same 30 cells as before), and a dry-run/render of an arm64 cell confirming the rendered Image Customizer invocation still resolves --image-file to artifacts/core_arm64.vhdx and --platform to linux/arm64 exactly as before this change. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…t need them Several VM test scenarios (grub-verity, usr-verity, acl-agent, grub-verity-azure) need a "clean install" base disk image in addition to their existing .cosi A/B-update payload, previously produced by a raw `docker run` Makefile section invoking Image Customizer directly against the pre-tailor per-scenario YAML (now deleted). Append the missing output format to each affected scenario fragment's `outputs:` list (qcow2 for the first three, vhd-fixed - which tailor names `.vhd` on disk, matching the legacy filename - for grub-verity-azure) so tailor produces both formats from the exact same cell content; the Makefile/legacy_targets.py side of this migration lands separately. Also: - remove the dangling `extraDependencies: - ./base` from trident-functest, azurelinux-direct-streaming-testimage, and trident-testimage's image.yaml - each family's base/ directory is now either nonexistent (trident-functest never had one) or was emptied by the file-deduplication commit, and Image Customizer's own signing preflight (and tailor's extraDependencies check) both reject a declared dependency path that doesn't exist on disk. - revert the file-deduplication commit's sharing of post-install.sh and load-containerd-selinux-fix.sh specifically: Image Customizer requires every `scripts.postCustomization[].path` to resolve under the image's own config directory (confirmed via a real build failure: "script file is not under config directory"), unlike `additionalFiles.source`, which has no such restriction (already proven working for every other deduplicated file). These two scripts go back to small per-family duplicates; every other shared common/ file is unaffected. Verified: `tailor validate` (30 -> 34 cells, +4 for the new qcow2/vhd-fixed cells, otherwise unchanged) and real (non-dry-run) builds of the three new qcow2 cells (grub-verity, usr-verity, acl-agent), each producing both the existing .cosi and the new .qcow2 artifact from one invocation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…tion Nearly all .sh files under tests/tailor-images had their executable bit (755) silently dropped to 644 during the testimages.py -> tailor migration (likely lost during file moves/copies). This caused etc-mount.service (which execs etc-mount.sh directly, no shell wrapper) to fail to start at boot, breaking the root-verity container deployment and contributing to post-boot configuration failures. Restored 755 on all scripts that were 755 upstream on main; left the handful that were already 644 upstream unchanged.
- Split acl-agent.yaml into a cosi (update) scenario that enables trident-acl-agent.service by default, and a new acl-agent-base.yaml qcow2 scenario that does not: the real A/B reboot lands on a different root than the one SSHed into pre-stage, so the service can only safely auto-enable on the update target. - Split grub-verity-azure.yaml the same way: a cosi update scenario keeps the single-slot layout, and a new grub-verity-azure-base.yaml vhd-fixed scenario gets the dual-slot layout via a new grub-verity-base+grub-verity-azure-base.yaml disjunction fragment, mirroring the existing grub-verity-base split. - Add ../common to extraDependencies in every image family that references common/ files, so edits to shared files correctly invalidate the fingerprint cache. - Fix README.md: drop the stale legacy-map.json reference (removed before this migration was split into stacked PRs). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Include acl-agent-base in the root-verity+usr-verity+acl-agent disjunction fragment (renamed to .../acl-agent+acl-agent-base.yaml), which it was missing from -- it had no UKI os-common/scripts, no systemd-boot, and no previewFeatures: uki, breaking the qcow2. - Restore a qcow2-producing grub-base scenario, matching the pre-migration baseimg-grub.yaml/updateimg-grub.yaml split: the base image is dual-slot (storage-grub.yaml, unchanged), the cosi update target gets its own single-slot layout (new storage-grub-update.yaml) instead of borrowing the base's. - Fix README.md wording: trident-verity-testimage's output uses each variant's configured outputs[].name, not the cell slug; the VM testimage's "With verity" update row had a copy-pasted Regular path. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…, README Per the row-13 decision to remove outputs[].name from tailor entirely (prior commit), all 34 per-image `name:` overrides across these configs are now unsupported/unknown fields -- remove them (cells now publish under their slug; the Make layer maps legacy filenames, next commit). Also fixes three additional review findings: - trident-vm-testimage's arm64+grub-verity composite declared a qcow2 output alongside cosi, but the matched scenario is the single-slot update layout (no arm64 "-base" dual-slot scenario exists -- arm64 is excluded from grub-verity-base in image.yaml's matrix). Legacy arm64 only ever produced a COSI; drop the qcow2 entry. - grub-verity-azure-base.yaml overrode hostname to the update image's value (trident-vm-testimg) instead of the inherited base hostname from grub-verity-base-os-common.yaml (trident-vm-verity-testimg). Drop the override. - trident-vm-testimage/README.md's fixed-vhd row named a Make target that doesn't exist (trident-vm-grub-verity-testimage.vhd); the real target is trident-vm-grub-verity-azure-testimage.vhd. - trident-verity-testimage/README.md's direct-build note described the old outputs[].name-based clone filenames; updated to the actual slug-based ones. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Fixes three more review findings: - grub-verity-azure-base.yaml used the generic QEMU grub-verity-base storage sizing instead of the Azure base image's legacy layout (15G disk cap, 16M ESP, growable /srv vs. the QEMU include's no cap, 512M ESP, fixed 128M /srv). Added a dedicated storage-grub-verity-azure-base.yaml include carrying the legacy sizes and selected it here. - trident-container-installer/README.md, trident-container-testimage/README.md, and trident-testimage/README.md documented the removed legacy basename as the direct-build output path; a non-matrix (or arch-only) cell's slug always carries the resolved arch/format, so the real output is e.g. trident-container-installer_amd64_iso.iso, not trident-container-installer.iso. Updated all three to the slug-based paths. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
tailor/baseimg.yaml references base/post-install.sh, but only ../common was declared, so editing that script left the fingerprint unchanged and could reuse a cached image with the old script contents. Matches the other migrated families (trident-verity-testimage, trident-container-testimage). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- grub.yaml (regular, non-verity update image) was missing the use-grpc-client-commit.conf override that the legacy updateimg-grub.yaml had and that grub-verity still carries; without it, rollback tests exercised the wrong trident commit path. - README.md: the update-image table described single .cosi file outputs as directory globs; document the actual make command/output path. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
direct-streaming.yaml removed trident-install from services.enable but never added it to services.disable (unlike the legacy baseimg-direct-streaming.yaml, which had both). Not enabling a unit does not prevent a package preset from auto-enabling it, so trident-install.service could start alongside rcp-agent and launch the normal installer path on a direct-streaming image. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
root-verity.yaml only declared a cosi output, but the legacy baseimg-root-verity.yaml also built a bootable dual-slot qcow2 base image (the Makefile had a dedicated artifacts/trident-vm-root-verity-testimage.qcow2 rule). A prior qcow2/vhd-fixed-output migration added qcow2 to grub-verity, usr-verity, acl-agent, and grub-verity-azure but never to root-verity, silently dropping the capability to build this base image via Tailor. Add format: qcow2 alongside the existing cosi output, mirroring the single-scenario, dual-format pattern already used by usr-verity.yaml (root-verity, like usr-verity, only ever had one legacy config, not a separate base/update split like grub-verity). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…om ACL images - grub-verity-azure.yaml (update/COSI scenario) was removing netplan, but the legacy updateimg-grub-verity-azure.yaml explicitly installed it; only the base-image counterpart should drop it, and grub-verity-azure-base.yaml already does. Removing the here restores network-configuration support after a COSI update. - acl-agent.yaml and acl-agent-base.yaml inherit trident-service from the shared uki-verity-os-common.yaml include (meant for root-verity/ usr-verity), but legacy ACL-agent configs only ever installed trident-acl. Explicitly trident-service from both ACL fragments so these images don't also enable the normal trident.service boot-time commit path alongside trident-acl-agent. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
bin/trident-mos.iso and the default run-netlaunch flow depended on
tests/images/trident-mos/*, deleted by the legacy-workspace cleanup --
confirmed via 9+ recurring Copilot review summaries and a real build
attempt ("No rule to make target ..."). trident-mos was never migrated
to Tailor in the first place, unlike every other test image.
Add tests/tailor-images/trident-mos/ (image.yaml, iso.yaml, files/,
post-install.sh), mirroring the legacy iso.yaml 1:1: same storage
layout, packages, hostname, and the rcp-agent/netlaunch-driven service
set (enables rcp-agent + tridentd.socket, disables trident-install --
distinct from trident-installer's standard auto-install flow). Reuses
already-migrated common/files/{getty@.service,serial-getty@.service,
config-placeholder.yaml} (confirmed byte-identical to legacy).
The legacy config referenced packaging/, tools/cmd/rcp-agent/, and
bin/rcp-agent directly via repo-root-relative paths -- that worked
under the old raw invocation, but tailor's IC
container only bind-mounts the workspace root, the output directory,
and explicitly-declared base/rpmSources paths (confirmed via a real
build attempt and tailor-exec's push_out_of_workspace_inputs, which
only special-cases those two). Copied the static packaging files
locally into files/ (matching every other migrated image's existing
convention), and reference the rcp-agent binary via
../../../artifacts/rcp-agent -- staged there by the Makefile before
invoking tailor, same as trident-installer's direct-streaming variant
already does -- since a built artifact can't be copied into the
workspace ahead of time.
Registered in tailor.yaml's images.members (explicit allowlist, not a
bare glob). Verified with a real end-to-end build producing a working
265 MiB ISO. The Makefile routing (bin/trident-mos.iso -> this image)
lands in #844.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…e README - trident-mos consumes three files from ../common (getty units, config-placeholder.yaml) but omitted it from extraDependencies, so Tailor's fingerprint never covered them -- an edit to a shared common/ file could reuse a stale ISO. Added ../common, matching every other migrated family. - README.md's "current families" list predated trident-mos; added it. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
/etc/trident and /var/lib/kubelet are persistent, part-labeled partitions shared by both A/B roots (see storage-acl-agent.yaml), not per-root filesystems. The actual reason systemctl enable --now on the old root has no effect on the new one is that the enablement symlink it writes lives under the root filesystem itself, which the real A/B reboot does not carry forward. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
….service (split from 9148f30 -- the config-file portion only; the extra_dependencies double-hashing fix and image-yaml.md doc now live on PR842, which owns those source files) The comment claimed /etc lives on an overlay backed by nonexistent per-slot trident-overlay-a/-b partitions. storage-acl-agent.yaml defines no such overlay -- /etc is just part of the plain A/B-swapped root-a/root-b filesystem directly. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
(split from cf436a6 -- the tests/tailor-images/README.md portion only; the Cell::extra_dependencies doc-comment fix now lives on PR842, which owns that source file) tests/tailor-images/README.md said the legacy testimages.py/builder/ flow "has been removed" -- it still exists on this branch, removal is a later PR in the stack. Reworded to describe this workspace as the parallel replacement until that cleanup lands. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Image Customizer requires path-based postCustomization scripts to be executable; these were committed as mode 0664, so the affected builds would fail before producing output: - trident-container-installer/base/scripts/load-containerd-selinux-fix.sh - trident-container-testimage/base/scripts/load-containerd-selinux-fix.sh - trident-mos/post-install.sh (registered as a path-based script in iso.yaml) chmod +x all three. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The migrated grub-verity-azure scenario included the generic storage-grub-verity.yaml, which has no disks[].maxSize -- the generic grub-verity update intentionally has none, but the legacy Azure update image (updateimg-grub-verity-azure.yaml) always capped at 7G, giving it a fixed update-image layout. Without the cap, the migrated Azure COSI could inherit the core base disk size instead. Add an Azure-specific storage-grub-verity-azure.yaml (a copy of the generic include plus the 7G cap) and point the Azure scenario at it, leaving the generic (non-Azure) scenario untouched. Verified via `tailor export`: the Azure variant now renders maxSize: 7G, the generic variant still renders none.
Wire artifacts/rpm-overrides (created by the pipeline for dev RPM builds, but never consumed) into rpmSources for every family that already reads bin/RPMS, matching the old Makefile recipes' order. trident-verity-testimage's host.yaml was previously missing it, unlike the other host-build families.
…g-testimage Follow-up to the prior commit wiring artifacts/rpm-overrides into rpmSources for host-build families: azurelinux-direct-streaming-testimage reads bin/RPMS too and was missed. Moved here from PR 844, which had picked it up incidentally in an unrelated review-findings commit.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
grub.yaml's grpc-client-commit override, the direct-streaming image's disabled install service, an Azure base-image hostname override bug, and the qemu grub-verity base-image disk layout -- the last one fixes a servicing/rollback regression where the rewritten image booted into the provision ISO instead of the installed disktrident-mosto the Tailor workspace (it was never migrated originally) and fix its dependency trackingtrident-testimage's./base,trident-mos's../common) and usedirect-streaming.yaml's fragment-scopedextraDependencies(now functional once tests/images with tailor [1]: tailor changes: fix image build arguments and signing #842 adds schema support for it)Stack
Validation
[GITHUB]-trident-pr-e2e: https://dev.azure.com/mariner-org/ECF/_build/results?buildId=1223932 (run once on the last PR in the stack -- tests/images with tailor [5]: move tests/tailor-images to tests/images #846's branch contains every commit from this PR through tests/images with tailor [5]: move tests/tailor-images to tests/images #846, so one pipeline run validates the whole stack instead of 5 redundant ones)