test/images with tailor [8]: add container and direct-streaming image configs

tests/tailor-images/README.md

@@ -49,6 +49,10 @@ remote source.
 The current families are:
 
 - `azl-installer`
+- `azurelinux-direct-streaming-testimage`
+- `foreign-direct-streaming-testimage`
+- `trident-container-installer`
+- `trident-container-testimage`
 - `trident-functest`
 - `trident-installer`
 - `trident-testimage`

tests/tailor-images/azurelinux-direct-streaming-testimage/by-arch/arm64.yaml

@@ -0,0 +1,2 @@
+base:
+  $include: ../common/matrix/base-core-arm64.yaml

tests/tailor-images/azurelinux-direct-streaming-testimage/image.yaml

@@ -0,0 +1,20 @@
+name: azurelinux-direct-streaming-testimage
+
+matrix:
+  arch: [amd64, arm64]
+
+base:
+  ref: baremetal
+
+outputs:
+  - format: baremetal-image
+
+rpmSources:
+  - ../../../bin/RPMS
+  - ../../../artifacts/rpm-overrides
+
+extraDependencies:
+  - ../common
+
+config:
+  $include: ./tailor/baseimg.yaml

tests/tailor-images/azurelinux-direct-streaming-testimage/tailor/baseimg.yaml

@@ -0,0 +1,68 @@
+storage:
+  bootType: efi
+  disks:
+  - partitionTableType: gpt
+    maxSize: 15G
+    partitions:
+    - id: esp
+      type: esp
+      size: 50M
+      label: esp
+    - id: root-a
+      size: 4G
+      type: root
+      label: root-a
+    - id: root-b
+      size: 4G
+      type: root
+      label: root-b
+    - id: swap
+      size: 2G
+      type: swap
+      label: swap
+  filesystems:
+  - deviceId: esp
+    type: fat32
+    mountPoint:
+      path: /boot/efi
+      options: umask=0077
+  - deviceId: root-a
+    type: ext4
+    mountPoint:
+      path: /
+os:
+  bootloader:
+    resetType: hard-reset
+  hostname: trident-rawcosi-testimage
+  selinux:
+    mode: permissive
+  kernelCommandLine:
+    extraCommandLine:
+    - console=tty0
+    - console=ttyS0
+    - rd.info
+    - log_buf_len=1M
+  packages:
+    install:
+    - curl
+    - dnf
+    - efibootmgr
+    - iproute
+    - iptables
+    - lsof
+    - mdadm
+    - netplan
+    - openssh-server
+    - tpm2-tools
+    - vim
+    - audit
+    - device-mapper
+    - dosfstools
+    - lvm2
+    - veritysetup
+    - ntfs-3g
+    - ntfsprogs
+    - selinux-policy
+  services:
+    enable:
+    - sshd

tests/tailor-images/foreign-direct-streaming-testimage/by-arch+source/arm64+ubuntu-2204.yaml

@@ -0,0 +1,7 @@
+base:
+  $set:
+    ref: ubuntu_2204_arm64
+
+outputs:
+  $replace:
+    - format: baremetal-image

tests/tailor-images/foreign-direct-streaming-testimage/by-arch+source/arm64+ubuntu-2404.yaml

@@ -0,0 +1,7 @@
+base:
+  $set:
+    ref: ubuntu_2404_arm64
+
+outputs:
+  $replace:
+    - format: baremetal-image

tests/tailor-images/foreign-direct-streaming-testimage/by-source/gb200-2404.yaml

@@ -0,0 +1,7 @@
+base:
+  $set:
+    ref: gb200_2404_arm64
+
+outputs:
+  $replace:
+    - format: baremetal-image

tests/tailor-images/foreign-direct-streaming-testimage/by-source/ubuntu-2404.yaml

@@ -0,0 +1,7 @@
+base:
+  $set:
+    ref: ubuntu_2404_amd64
+
+outputs:
+  $replace:
+    - format: baremetal-image

tests/tailor-images/foreign-direct-streaming-testimage/image.yaml

@@ -0,0 +1,16 @@
+name: foreign-direct-streaming-testimage
+operation: convert
+
+matrix:
+  arch: [amd64, arm64]
+  source: [ubuntu-2204, ubuntu-2404, gb200-2404]
+
+selectors:
+  exclude:
+    - { arch: amd64, source: gb200-2404 }
+
+base:
+  ref: ubuntu_2204_amd64
+
+outputs:
+  - format: baremetal-image

tests/tailor-images/tailor.yaml

@@ -65,6 +65,10 @@ baseImages:
 images:
   members:
     - azl-installer
+    - azurelinux-direct-streaming-testimage
+    - foreign-direct-streaming-testimage
+    - trident-container-installer
+    - trident-container-testimage
     - trident-functest
     - trident-installer
     - trident-testimage

tests/tailor-images/trident-container-installer/README.md

@@ -0,0 +1,21 @@
+# Trident Container Installer ISO Test Image
+
+This image is used in the Trident test pipelines. At startup, it loads a
+specified version of a container, which must be provided. Trident runs from
+this container. The configuration for Trident can be patched into the ISO by
+replacing it with the placeholder file (config-placeholder).
+
+This image does **not** include Trident RPMs — Trident is loaded from a
+container at boot.
+
+## Building
+
+From the repo root, run:
+
+```bash
+cargo run --manifest-path tools/tailor/Cargo.toml --   --manifest tests/tailor-images/tailor.yaml   build trident-container-installer --output-dir ./artifacts
+```
+
+Output is written to `artifacts/trident-container-installer_amd64_iso.iso` by default
+(tailor publishes under the cell's slug).
+Use `--output-dir <path>` to change the output location.

tests/tailor-images/trident-container-installer/base/files/root.profile

@@ -0,0 +1,2 @@
+# Open journalctl immediately after autologin
+journalctl -f --no-tail -u trident-container

tests/tailor-images/trident-container-installer/base/files/trident-container.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=Trident Agent
+Requires=docker.service
+After=network.target network-online.target systemd-udev-settle.service docker.service
+
+[Service]
+Type=oneshot
+ExecStartPre=/bin/bash -c "set -e; mkdir -p /var/lib/trident"
+ExecStartPre=/bin/bash -c "set -e; if ! docker image ls | grep -q 'trident/trident'; then curl $(grep -oP '^\s*phonehome: \\K.*(?=phonehome)' /etc/trident/config.yaml)files/trident-container.tar.gz -o /var/lib/trident/trident-container.tar.gz -f; fi"
+ExecStartPre=/bin/bash -c "set -e; if ! docker image ls | grep -q 'trident/trident'; then docker load --input /var/lib/trident/trident-container.tar.gz; fi"
+ExecStart=docker run --name trident_container --pull=never --rm --privileged -v /etc/trident:/etc/trident -v /etc/pki:/etc/pki:ro -v /run/initramfs/live:/trident_cdrom -v /var/lib/trident:/var/lib/trident -v /var/log:/var/log -v /:/host -v /dev:/dev -v /run:/run -v /sys:/sys --pid host --ipc host trident/trident:latest install --verbosity TRACE
+StandardOutput=journal+console
+StandardError=journal+console
+
+[Install]
+WantedBy=multi-user.target

tests/tailor-images/trident-container-installer/base/scripts/load-containerd-selinux-fix.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+# Load SELinux policy module that grants the 'map' permission on
+# container_runtime_t:file for container engines.  This fixes containerd
+# 2.2+ MountManager bbolt mmap() denials under enforcing mode.
+semodule -i /usr/share/selinux/packages/containerd-mmap-fix.cil

tests/tailor-images/trident-container-installer/base/scripts/post-install.sh

@@ -0,0 +1,15 @@
+# Add the necessary directories for the audit logs so that auditd can start
+mkdir -p /var/log/audit
+# Use more intuitive path for the ISO mount
+ln -s -T /run/initramfs/live /trident_cdrom
+
+# Load the config from the CDROM so that the user can patch it
+if [ ! -d /etc/trident ]; then
+    mkdir /etc/trident
+fi
+ln -s -T /trident_cdrom/trident-config.yaml /etc/trident/config.yaml
+
+if [ ! -d /etc/systemd/system/trident-container.service.d ]; then
+    mkdir /etc/systemd/system/trident-container.service.d
+fi
+ln -s -T /trident_cdrom/trident-override.conf /etc/systemd/system/trident-container.service.d/override.conf

tests/tailor-images/trident-container-installer/image.yaml

@@ -0,0 +1,14 @@
+name: trident-container-installer
+
+base:
+  ref: baremetal
+
+outputs:
+  - format: iso
+
+extraDependencies:
+  - ./base
+  - ../common
+
+config:
+  $include: ./tailor/baseimg.yaml

tests/tailor-images/trident-container-installer/tailor/baseimg.yaml

@@ -0,0 +1,71 @@
+storage:
+  bootType: efi
+  disks:
+  - partitionTableType: gpt
+    maxSize: 4G
+    partitions:
+    - id: esp
+      type: esp
+      size: 8M
+    - id: rootfs
+      size: grow
+  filesystems:
+  - deviceId: esp
+    type: fat32
+    mountPoint:
+      path: /boot/efi
+      options: umask=0077
+  - deviceId: rootfs
+    type: ext4
+    mountPoint:
+      path: /
+os:
+  bootloader:
+    resetType: hard-reset
+  hostname: trident-container-mos-testimg
+  packages:
+    install:
+    - curl
+    - device-mapper
+    - dnf
+    - docker-cli
+    - iproute
+    - iptables
+    - mdadm
+    - moby-engine
+    - openssh-server
+    - selinux-policy
+    - squashfs-tools
+    - tar
+    - vim
+  additionalFiles:
+  - source: ../common/files/getty@.service
+    destination: /usr/lib/systemd/system/getty@.service
+  - source: ../common/files/serial-getty@.service
+    destination: /usr/lib/systemd/system/serial-getty@.service
+  - source: base/files/root.profile
+    destination: /root/.profile
+  - source: base/files/trident-container.service
+    destination: /usr/lib/systemd/system/trident-container.service
+  - source: ../common/files/containerd-mmap-fix.cil
+    destination: /usr/share/selinux/packages/containerd-mmap-fix.cil
+  services:
+    enable:
+    - trident-container
+    - sshd
+scripts:
+  postCustomization:
+  - path: base/scripts/post-install.sh
+  - path: base/scripts/load-containerd-selinux-fix.sh
+iso:
+  additionalFiles:
+  - source: ../common/files/config-placeholder.yaml
+    destination: /trident-config.yaml
+  - source: ../common/files/override-placeholder.conf
+    destination: /trident-override.conf
+  kernelCommandLine:
+    extraCommandLine:
+    - enforcing=0
+    - console=tty0
+    - console=ttyS0
+    - rd.luks=0

tests/tailor-images/trident-container-testimage/README.md

@@ -0,0 +1,20 @@
+# Trident Container Test Image
+
+This image is an extension of the base baremetal image and includes various
+helper utilities along with Docker runtime. It also adds openssh-server to
+allow for remote access.
+
+This image does **not** include Trident RPMs — Trident runs from a container
+loaded at runtime.
+
+## Building
+
+From the repo root, run:
+
+```bash
+cargo run --manifest-path tools/tailor/Cargo.toml --   --manifest tests/tailor-images/tailor.yaml   build trident-container-testimage --output-dir ./artifacts
+```
+
+Output is written to `artifacts/trident-container-testimage_amd64_cosi.cosi` by default
+(tailor publishes under the cell's slug).
+Use `--output-dir <path>` to change the output location.

tests/tailor-images/trident-container-testimage/base/files/trident-container.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=Trident Agent
+Requires=docker.service
+After=network.target network-online.target systemd-udev-settle.service docker.service
+
+[Service]
+Type=oneshot
+ExecStartPre=/bin/bash -c "set -e; if ! docker image ls | grep -q 'trident/trident'; then docker load --input /var/lib/trident/trident-container.tar.gz; fi"
+# TODO: Remove line to enable SELinux, when bug #9508 is fixed.
+ExecStartPre=/bin/bash -c "sudo setenforce 0" 
+ExecStart=docker run --name trident_container --pull=never --rm --privileged -v /etc/trident:/etc/trident -v /var/lib/trident:/var/lib/trident -v /var/log:/var/log -v /:/host -v /dev:/dev -v /run:/run -v /sys:/sys --pid host --ipc host trident/trident:latest commit --verbosity DEBUG
+StandardOutput=journal+console
+StandardError=journal+console
+
+[Install]
+WantedBy=multi-user.target

tests/tailor-images/trident-container-testimage/base/scripts/load-containerd-selinux-fix.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+# Load SELinux policy module that grants the 'map' permission on
+# container_runtime_t:file for container engines.  This fixes containerd
+# 2.2+ MountManager bbolt mmap() denials under enforcing mode.
+semodule -i /usr/share/selinux/packages/containerd-mmap-fix.cil

tests/tailor-images/trident-container-testimage/base/scripts/post-install.sh

@@ -0,0 +1,2 @@
+# Add the necessary directories for the audit logs so that auditd can start
+mkdir -p /var/log/audit

tests/tailor-images/trident-container-testimage/image.yaml

@@ -0,0 +1,14 @@
+name: trident-container-testimage
+
+base:
+  ref: baremetal
+
+outputs:
+  - format: cosi
+
+extraDependencies:
+  - ./base
+  - ../common
+
+config:
+  $include: ./tailor/baseimg.yaml