bfjelds (bfjelds) · Oct 26, 2026
@@ -60,3 +60,4 @@ The current families are:
 - `trident-installer`
 - `trident-testimage`
 - `trident-verity-testimage`
+- `trident-vm-testimage`
@@ -73,3 +73,4 @@ images:
     - trident-installer
     - trident-testimage
     - trident-verity-testimage
+    - trident-vm-testimage
@@ -0,0 +1,31 @@
+# Trident VM Test Image
+
+This image is used for testing Trident adopting an already produced image (e.g.
+generated by MIC). It is based on the baremetal
+image and adds Trident as well as its dependencies. It also adds openssh-server
+to allow for remote access. Finally, it contains duplicate set of partitions to
+setup the disk layout for A/B update.
+
+Available images:
+
+- regular
+
+## Additional Prerequisites
+
+- Artifacts
+  - **Trident RPMs**: expected in `bin/RPMS/**/*.rpm`. Can be created with
+    `make bin/trident-rpms.tar.gz`
+
+## Building
+
+To build the base image, run:
+
+| Image type | Make command | Output path |
+| ---------- | ------------ | ----------- |
+| Regular | `make artifacts/trident-vm-grub-testimage.qcow2` | `artifacts/trident-vm-grub-testimage.qcow2` |
+
+To build the update images, run:
+
+| Image type | Make command | Output path |
+| ---------- | ------------ | ----------- |
+| Regular | `make artifacts/trident-vm-grub-testimage.cosi` | `artifacts/trident-vm-grub-testimage.cosi` |
@@ -0,0 +1 @@
+mic-config.yaml
@@ -0,0 +1,3 @@
+host_status.yaml
+config.yaml
+id_rsa.pub
@@ -0,0 +1,6 @@
+[Match]
+Name=eth0
+
+[Network]
+DHCP=yes
+IPv6AcceptRA=no
@@ -0,0 +1,15 @@
+[Unit]
+Description=/etc Mount Service
+DefaultDependencies=no
+Conflicts=umount.target
+Before=local-fs.target umount.target
+Requires=var-lib-trident\x2doverlay.mount
+After=var-lib-trident\x2doverlay.mount
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=etc-mount.sh commit-machine-id
+
+[Install]
+WantedBy=local-fs.target
@@ -0,0 +1,17 @@
+[Unit]
+Description=/etc Mount Service
+DefaultDependencies=no
+Conflicts=umount.target
+Before=local-fs.target umount.target systemd-networkd.service
+Requires=etc.mount
+After=etc.mount
+Requires=var-lib-trident\x2doverlay.mount
+After=var-lib-trident\x2doverlay.mount
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=etc-mount.sh
+
+[Install]
+WantedBy=local-fs.target
@@ -0,0 +1,24 @@
+#!/bin/bash
+
+set -ex
+
+# TODO: figure out why we are missing systemd-machine-id-commit service, which should automate this
+if [ "$1" == "commit-machine-id" ]; then
+    MACHINEID=`cat /etc/machine-id`
+    echo $MACHINEID
+    # if machine-id has a mount point, unmount it
+    if grep -q /etc/machine-id /proc/mounts; then
+        umount /etc/machine-id
+    fi
+fi
+
+mount -t overlay overlay -o lowerdir=/etc,upperdir=/var/lib/trident-overlay/etc-rw/upper,workdir=/var/lib/trident-overlay/etc-rw/work /etc
+# Workaround for dracut overlayfs module mounting /etc overlay as 755 on clean install and
+# 750 on abupdate
+chmod o+rx /etc
+
+if [ "$1" == "commit-machine-id" ]; then
+    echo Committing machine-id
+    echo $MACHINEID > /etc/machine-id
+    cat /etc/machine-id
+fi
@@ -0,0 +1,14 @@
+[Unit]
+Description=Generate sshd host keys
+ConditionPathExists=|!/srv/etc/ssh/ssh_host_rsa_key
+ConditionPathExists=|!/srv/etc/ssh/ssh_host_ecdsa_key
+ConditionPathExists=|!/srv/etc/ssh/ssh_host_ed25519_key
+Before=sshd.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/bin/ssh-keygen -A -f /srv
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,2 @@
+mkdir -p /var/lib/trident-overlay/etc-rw/upper
+mkdir -p /var/lib/trident-overlay/etc-rw/work
@@ -0,0 +1,3 @@
+# Move the SSH host keys off the read-only /etc directory, so that sshd can run.
+SSH_VAR_DIR="/srv/etc/ssh/"
+mkdir -p "$SSH_VAR_DIR"
@@ -0,0 +1 @@
+sed -i 's/#DUIDType=vendor/DUIDType=link-layer/' /etc/systemd/networkd.conf
@@ -0,0 +1 @@
+lsblk --json --output-all --bytes
@@ -0,0 +1,2 @@
+# Add the necessary directories for the audit logs so that auditd can start
+mkdir -p /var/log/audit
@@ -0,0 +1,9 @@
+CONFIG_PATH=/var/lib/trident/update-config.yaml
+DOWNLOAD_URL_PREFIX="http://192.168.122.1:8000"
+
+cp /etc/trident/config.yaml $CONFIG_PATH
+cat <<EOF >> $CONFIG_PATH
+image:
+  url: $DOWNLOAD_URL_PREFIX/usrverity.cosi
+  sha384: ignored
+EOF
@@ -0,0 +1,36 @@
+CONFIG_PATH=/var/lib/trident/update-config.yaml
+DOWNLOAD_URL_PREFIX="http://192.168.122.1:8000"
+
+cat <<EOF > $CONFIG_PATH
+image:
+  url: $DOWNLOAD_URL_PREFIX/verity.cosi
+  sha384: ignored
+EOF
+
+INTERFACE_MASK='enp*'
+if [ "$1" == "eth0" ]; then
+  INTERFACE_MASK="$1"
+fi
+
+if [ "$1" != "uki" ]; then
+  cat <<EOF >> $CONFIG_PATH
+scripts:
+  postConfigure:
+    - name: rw-overlay
+      runOn: [all]
+      content: |
+        mkdir -p /var/lib/trident-overlay/etc-rw/upper && mkdir -p /var/lib/trident-overlay/etc-rw/work
+EOF
+fi
+
+cat <<EOF >> $CONFIG_PATH
+internalParams:
+  allowUnusedFilesystems: true
+EOF
+
+if [ "$1" == "uki" ]; then
+  cat <<EOF >> $CONFIG_PATH
+  uki: true
+  disableGrubNoprefixCheck: true
+EOF
+fi
@@ -0,0 +1,9 @@
+CONFIG_PATH=/var/lib/trident/update-config.yaml
+DOWNLOAD_URL_PREFIX="http://192.168.122.1:8000"
+
+cp /etc/trident/config.yaml $CONFIG_PATH
+cat <<EOF >> $CONFIG_PATH
+image:
+  url: $DOWNLOAD_URL_PREFIX/regular.cosi
+  sha384: ignored
+EOF
@@ -0,0 +1,9 @@
+# Move the SSH host keys off the read-only /etc directory, so that sshd can run.
+SSH_VAR_DIR="/srv/etc/ssh/"
+
+cat << EOF >> /etc/ssh/sshd_config
+
+HostKey $SSH_VAR_DIR/ssh_host_rsa_key
+HostKey $SSH_VAR_DIR/ssh_host_ecdsa_key
+HostKey $SSH_VAR_DIR/ssh_host_ed25519_key
+EOF
@@ -0,0 +1 @@
+trident offline-initialize
@@ -0,0 +1,2 @@
+printf -v DATE '%(%Y%m%d)T' -1
+sed -i "s/VERSION=\".*\"/VERSION=\"$DATE\"/" /etc/os-release
@@ -0,0 +1,6 @@
+base:
+  $include: ../common/matrix/base-core-arm64.yaml
+
+outputs:
+  $replace:
+    - format: cosi
@@ -0,0 +1,56 @@
+# Base (qcow2) counterpart to grub.yaml, matching the pre-migration
+# baseimg-grub.yaml / updateimg-grub.yaml split: the base image is a
+# dual-slot A/B layout (storage-grub.yaml, unchanged), while the cosi
+# update target uses a single slot (storage-grub-update.yaml).
+outputs:
+  $replace:
+    - format: qcow2
+config:
+  storage:
+    $include: ./include/storage-grub.yaml
+  os:
+    bootloader:
+      resetType: hard-reset
+    hostname: trident-vm-testimg
+    selinux:
+      mode: disabled
+    kernelCommandLine:
+      extraCommandLine:
+        - console=tty0
+        - console=tty1
+        - console=ttyS0
+        - rd.debug
+        - loglevel=6
+        - log_buf_len=1M
+        - systemd.journald.forward_to_console=1
+    packages:
+      install:
+        - dnf
+        - efibootmgr
+        - grub2-efi-binary
+        - iproute
+        - iptables
+        - jq
+        - openssh-server
+        - trident-service
+        - vim
+        - netplan
+    services:
+      enable:
+        - tridentd.socket
+    users:
+      - name: testuser
+        sshPublicKeyPaths:
+          - base/files/id_rsa.pub
+        secondaryGroups:
+          - wheel
+    additionalFiles:
+      - source: base/files/sshd-keygen.service
+        destination: /usr/lib/systemd/system/sshd-keygen.service
+      - source: base/files/99-dhcp-eth0.network
+        destination: /etc/systemd/network/99-dhcp-eth0.network
+      - source: ../common/files/sudoers-wheel
+        destination: /etc/sudoers.d/wheel
+  scripts:
+    postCustomization:
+      - $include: ./include/grub-base-scripts.yaml
@@ -0,0 +1,57 @@
+config:
+  storage:
+    $include: ./include/storage-grub-update.yaml
+  os:
+    bootloader:
+      resetType: hard-reset
+    hostname: trident-vm-testimg
+    selinux:
+      mode: disabled
+    kernelCommandLine:
+      extraCommandLine:
+        - console=tty0
+        - console=tty1
+        - console=ttyS0
+        - rd.debug
+        - loglevel=6
+        - log_buf_len=1M
+        - systemd.journald.forward_to_console=1
+    packages:
+      install:
+        - curl
+        - dnf
+        - efibootmgr
+        - grub2-efi-binary-noprefix
+        - iproute
+        - iptables
+        - jq
+        - lsof
+        - netplan
+        - openssh-server
+        - trident-service
+        - vim
+        - netplan
+      remove:
+        - grub2-efi-binary
+    services:
+      enable:
+        - trident
+        - tridentd.socket
+    users:
+      - name: testuser
+        sshPublicKeyPaths:
+          - base/files/id_rsa.pub
+        secondaryGroups:
+          - wheel
+    additionalFiles:
+      - source: base/files/sshd-keygen.service
+        destination: /usr/lib/systemd/system/sshd-keygen.service
+      - source: base/files/99-dhcp-eth0.network
+        destination: /etc/systemd/network/99-dhcp-eth0.network
+      - source: ../common/files/sudoers-wheel
+        destination: /etc/sudoers.d/wheel
+      - source: ../common/files/use-grpc-client-commit.conf
+        destination: /etc/systemd/system/trident.service.d/override.conf
+  scripts:
+    postCustomization:
+      - $include: ./include/grub-scripts.yaml
@@ -0,0 +1,25 @@
+name: trident-vm-testimage
+
+matrix:
+  arch: [amd64, arm64]
+  scenario: [grub, grub-base]
+
+selectors:
+  exclude:
+    - { arch: arm64, scenario: [grub-base] }
+
+base:
+  ref: qemu_guest
+
+outputs:
+  - format: cosi
+
+rpmSources:
+  - ../../../bin/RPMS
+  - ../../../artifacts/rpm-overrides
+
+extraDependencies:
+  - ./base
+  - ../common
+
+config: {}
@@ -0,0 +1,6 @@
+- path: base/scripts/post-install.sh
+- path: base/scripts/update-host-status.sh
+- path: base/scripts/prepare-update-config.sh
+- path: base/scripts/ssh-move-host-keys.sh
+- path: base/scripts/create-ssh-dirs.sh
+- path: base/scripts/duid-type-to-link-layer.sh
@@ -0,0 +1,4 @@
+- path: base/scripts/post-install.sh
+- path: base/scripts/ssh-move-host-keys.sh
+- path: base/scripts/duid-type-to-link-layer.sh
+- path: base/scripts/update-os-release.sh
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		mkdir -p /var/lib/trident-overlay/etc-rw/upper
		mkdir -p /var/lib/trident-overlay/etc-rw/work
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		sed -i 's/#DUIDType=vendor/DUIDType=link-layer/' /etc/systemd/networkd.conf
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		# Add the necessary directories for the audit logs so that auditd can start
		mkdir -p /var/log/audit
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		printf -v DATE '%(%Y%m%d)T' -1
		sed -i "s/VERSION=\".*\"/VERSION=\"$DATE\"/" /etc/os-release