OCI bootable artifacts update

Development
1

Hello,

we are moving forward with the idea of distributing PXE files via OCI registries. We have filed a Fedora Change and we have a working testing pipeline for distributing the files:

https://fedoraproject.org/wiki/Changes/KickstartOciArtifacts

The artifacts are extracted and pushed via buildah tool, there is still no download artifact support in podman but upstream is discussing the idea. In the meantime, tool from Fedora named golang-oras can be used to download artifacts:

$ oras pull quay.io/pulp/fedora-kickstart-artifacts:40-amd64
Downloading 8ea1dd040e97 initrd.img
Downloading 80c3fe2ae106 boot.iso
Downloading a3b7052d7b2f grubx64.efi
Downloaded  a3b7052d7b2f grubx64.efi
Downloading fff4b2feeef3 pxelinux.0
Downloaded  fff4b2feeef3 pxelinux.0
Downloading 4773d74d87c2 shimx64.efi
Downloaded  4773d74d87c2 shimx64.efi
Downloading 09cf5df01619 vmlinuz
Downloaded  80c3fe2ae106 boot.iso
Downloaded  09cf5df01619 vmlinuz
Downloaded  8ea1dd040e97 initrd.img
Restored    80c3fe2ae106 install.img
Pulled quay.io/pulp/fedora-kickstart-artifacts:40-amd64
Digest: sha256:0306e10fd556e12ce8c3674150bceb88c0917b74b63c37eecc17070b3b30003b

The namespace is temporary, we will move the repo into pulp project for the time being and hopefully the change is accepted and the final artifacts will be pushed in the official fedora namespace.

We want to do a followup for RHEL and CentOS Stream. Once Fedora Change is accepted and the pipeline is final, including signing with GPG keys, I will update the Foreman repo doing the same thing for non-RH OSes.

Cheers!

3 Likes
2
1 Like
3

Update:

Podman tool now contains a command that does pulling:

mkdir /tmp/artifacts

podman artifact extract quay.io/pulp/fedora-kickstart-artifacts:40-amd64 /tmp/artifacts/
Getting image source signatures
Copying blob 4773d74d87c2 done   |
Copying blob 8ea1dd040e97 done   |
...

ls /tmp/artifacts/
boot.iso  grubx64.efi  initrd.img  install.img  pxelinux.0  shimx64.efi  vmlinuz
2 Likes
4

So I understand correctly - the big benefit to using these boot/kickstart files as OCI artifacts is that you can avoid having to sync a Kickstart RPM repository? Which then enables the user to perform all automation via native container workflows?

Iā€™m just catching up now on the idea here, but it sounds like Katello should consider this as a core provisioning workflow to support when development shifts to improving the image mode provisioning story.

Just as Katello exposes boot files today from kickstart repositories during provisioning, it could distribute the kickstart artifacts from these new OCI repos.

1 Like
5

Hello, sorry for the late reply.

Yes, the idea is for bootc systems, there are no RPM repositories everything is a container.

Yeah that is the idea, in fact, I just posted a lengthy post that explores HTTPS EFI boot provisioning where PXE files from KS repos are actually made irrelevant (they are unused, only the RPMs) and this is exactly what it needs to effectively download these files into Pulp.

I will link the article in this thread.

1 Like
6

It is this article: Strict SecureBoot/HTTPS Provisioning of Bare-Metal and VMs

1 Like