Skip to content

Commit 845e083

Browse files
mprycmpryc
authored
Merge pull request #172 from openshift-cherrypick-robot/cherry-pick-169-to-oadp-1.6
[oadp-1.6] Prepare oadp-cli for Konflux onboarding into OADP 1.6
2 parents 57da54a + 0b7bde0 commit 845e083

2 files changed

Lines changed: 235 additions & 7 deletions

File tree

‎docs/konflux-onboarding.md‎

Lines changed: 228 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,228 @@
1+
# Onboarding a New OADP Component to Konflux
2+
3+
This document describes the end-to-end process for adding a new image component to the OADP release stream, built via Konflux.
4+
5+
## Overview
6+
7+
OADP ships as a set of container images built by Red Hat's Konflux build system. The build configuration lives in [openshift-eng/ocp-build-data](https://github.com/openshift-eng/ocp-build-data) on product-specific branches (e.g. `oadp-1.5`, `oadp-1.6`). Source code is pulled from private mirrors in the `openshift-priv` GitHub org.
8+
9+
```
10+
Source repo (migtools/oadp-cli)
11+
|
12+
| auto-mirrored
13+
v
14+
Private mirror (openshift-priv/migtools-oadp-cli)
15+
|
16+
| Konflux pulls source + builds image
17+
v
18+
Build config (ocp-build-data oadp-1.6 branch)
19+
|
20+
| image pushed to
21+
v
22+
Delivery repo (registry.redhat.io/oadp/oadp-cli-rhel9)
23+
|
24+
| released via RPA
25+
v
26+
Stage / Prod registries
27+
```
28+
29+
## Repositories Involved
30+
31+
| Repository | Purpose | Where |
32+
|---|---|---|
33+
| **Source repo** (e.g. `migtools/oadp-cli`) | Component source code + `konflux.Dockerfile` | GitHub |
34+
| **openshift/release** | Whitelist config for `openshift-priv` mirror creation | [GitHub](https://github.com/openshift/release) |
35+
| **openshift-priv/migtools-\<repo\>** | Private mirror of source repo (ART's midstream) | GitHub (restricted) |
36+
| **openshift-eng/ocp-build-data** | Build configuration (image YAMLs, group config, streams) | [GitHub](https://github.com/openshift-eng/ocp-build-data) |
37+
| **releng/pyxis-repo-configs** | Delivery/Comet repo definitions | [GitLab (internal)](https://gitlab.cee.redhat.com/releng/pyxis-repo-configs) |
38+
| **Stage/Prod RPAs** | Release pipeline access for the image | Internal |
39+
40+
## Step-by-Step Process
41+
42+
### Step 1: Create the openshift-priv mirror
43+
44+
**Repo:** `openshift/release`
45+
**File:** `core-services/openshift-priv/_whitelist.yaml`
46+
47+
Add your repo under the appropriate org section. For `migtools` repos:
48+
49+
```yaml
50+
migtools:
51+
- oadp-cli # <-- add your repo here
52+
- oadp-non-admin
53+
# ...
54+
```
55+
56+
**Reference PR:** [openshift/release#68955](https://github.com/openshift/release/pull/68955) (ART-14080: whitelist MTC & OADP repos)
57+
58+
After the PR merges, the mirror at `openshift-priv/migtools-<repo-name>` is auto-created within ~3-4 hours. ART can then perform a test build.
59+
60+
**Naming convention:** repos under `migtools/` are mirrored as `openshift-priv/migtools-<repo-name>`.
61+
62+
### Step 2: Prepare the source repo
63+
64+
Your source repo needs a `konflux.Dockerfile` that follows the standard OADP build pattern:
65+
66+
```dockerfile
67+
FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_golang_1.25 AS builder
68+
69+
COPY . /workspace
70+
WORKDIR /workspace
71+
72+
ENV GOEXPERIMENT=strictfipsruntime
73+
74+
RUN CGO_ENABLED=1 GOOS=linux go build -mod=readonly -a -tags strictfipsruntime \
75+
-o /workspace/bin/<your-binary> ./<your-cmd-path>/
76+
77+
FROM registry.redhat.io/ubi9/ubi:latest
78+
79+
RUN dnf -y install openssl && dnf -y reinstall tzdata && dnf clean all
80+
81+
COPY --from=builder /workspace/bin/<your-binary> /usr/local/bin/<your-binary>
82+
COPY LICENSE /licenses/
83+
84+
LABEL description="<description>"
85+
LABEL io.k8s.description="<description>"
86+
LABEL io.k8s.display-name="<display name>"
87+
LABEL io.openshift.tags="oadp,migration,backup"
88+
LABEL summary="<summary>"
89+
```
90+
91+
Key requirements:
92+
- **Builder image:** `brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_golang_1.25`
93+
- **FIPS compliance:** `CGO_ENABLED=1`, `GOEXPERIMENT=strictfipsruntime`, `-tags strictfipsruntime`
94+
- **Build flags:** `-mod=readonly` (hermetic builds don't allow network fetches)
95+
- **Runtime base:** `registry.redhat.io/ubi9/ubi:latest`
96+
- **Use `dnf`** not `microdnf` -- ART auto-replaces `dnf` with `microdnf` at build time via ocp-build-data modifications
97+
- **License:** Copy `LICENSE` to `/licenses/`
98+
99+
### Step 3: Create the delivery repo
100+
101+
**Repo:** `gitlab.cee.redhat.com/releng/pyxis-repo-configs`
102+
**Path:** `products/oadp/oadp.yaml`
103+
104+
For OADP, this is the first delivery repo created post-Konflux migration, so the `products/oadp/` directory needs to be created. Reference `products/ocp/` or `products/mta/` for the file format.
105+
106+
Add an entry for your new image (e.g. `oadp/oadp-cli-rhel9`).
107+
108+
### Step 4: Add to stage and prod RPAs
109+
110+
Add the new image as a component in the stage and prod RPA configurations. This allows the image to be released through the pipeline to stage and production registries.
111+
112+
### Step 5: Add build config to ocp-build-data
113+
114+
**Repo:** `openshift-eng/ocp-build-data`
115+
**Branch:** `oadp-1.6` (or whichever release stream)
116+
117+
#### 5a. Create image config
118+
119+
Create `images/<your-component>.yml`:
120+
121+
```yaml
122+
cachito:
123+
packages:
124+
gomod:
125+
- path: .
126+
content:
127+
source:
128+
dockerfile: konflux.Dockerfile
129+
git:
130+
branch:
131+
target: oadp-1.6
132+
url: git@github.com:openshift-priv/migtools-<your-repo>.git
133+
web: https://github.com/migtools/<your-repo>
134+
modifications:
135+
- action: replace
136+
match: "dnf -y"
137+
replacement: "microdnf -y"
138+
- action: replace
139+
match: "dnf clean all"
140+
replacement: "microdnf clean all"
141+
distgit:
142+
component: <your-component>-container
143+
branch: rhaos-{MAJOR}.{MINOR}-rhel-9
144+
delivery:
145+
delivery_repo_names:
146+
- oadp/<your-delivery-repo>
147+
for_payload: false
148+
enabled_repos:
149+
- rhel-9-appstream-rpms
150+
- rhel-9-baseos-rpms
151+
from:
152+
builder:
153+
- stream: rhel-9-golang
154+
member: base-rhel9
155+
name: oadp/<your-delivery-repo>
156+
owners:
157+
- oadp-maintainers@redhat.com
158+
dependents:
159+
- oadp-operator
160+
konflux:
161+
cachi2:
162+
lockfile:
163+
rpms:
164+
- tzdata
165+
jira:
166+
project: OADP
167+
component: <your-component>-container
168+
```
169+
170+
#### 5b. Add public_upstreams mapping
171+
172+
In `group.yml`, add the mapping between the private mirror and public repo:
173+
174+
```yaml
175+
public_upstreams:
176+
# ... existing entries ...
177+
- private: "https://github.com/openshift-priv/migtools-<your-repo>"
178+
public: "https://github.com/migtools/<your-repo>"
179+
```
180+
181+
### Step 6: Wire into the operator bundle
182+
183+
Add the new image as a `relatedImage` in the OADP operator's CSV/bundle so it ships when the operator is installed.
184+
185+
## Build System Details
186+
187+
### How Konflux builds work for OADP
188+
189+
- **No `.tekton/` or `.konflux/` directories needed** in source repos -- pipelines are managed externally by ART tooling
190+
- **No cachi2 lockfiles needed in-repo** -- cachi2 dependency resolution is handled externally based on ocp-build-data config
191+
- **Hermetic builds:** network is blocked during build. Dependencies are prefetched by Konflux/cachi2 before the build starts
192+
- **Multi-arch:** images are built for x86_64, aarch64, ppc64le, s390x
193+
194+
### ocp-build-data branch structure
195+
196+
OADP uses product-level branches, not per-component branches:
197+
198+
```
199+
ocp-build-data/
200+
oadp-1.5/ <-- all OADP 1.5 components
201+
oadp-1.6/ <-- all OADP 1.6 components
202+
```
203+
204+
Each branch contains:
205+
- `group.yml` -- shared config (Go version, arches, RHEL repos, Konflux settings, OCP targets)
206+
- `streams.yml` -- base image references (golang builder, UBI, ose-cli)
207+
- `images/` -- per-component build configs
208+
- `releases.yml` -- release assembly config (may be empty)
209+
210+
### Key config in group.yml
211+
212+
```yaml
213+
konflux:
214+
cachi2:
215+
enabled: true
216+
gomod_version_patch: true
217+
lockfile:
218+
force: true
219+
sast:
220+
enabled: true
221+
network_mode: hermetic
222+
```
223+
224+
## References
225+
226+
- [ART Konflux onboarding docs](https://art-docs.engineering.redhat.com/konflux/onboard-external-operators/) (internal, requires cert)
227+
- [openshift/release#68955](https://github.com/openshift/release/pull/68955) -- reference PR for whitelist additions
228+
- [openshift-eng/ocp-build-data](https://github.com/openshift-eng/ocp-build-data) -- build configuration repo

konflux.Containerfile.download renamed to konflux.Dockerfile

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,22 @@
11
# Konflux hermetic build for the kubectl-oadp download server
2-
# Dependencies are prefetched by the Konflux pipeline (Hermeto) and injected
3-
# into the build context before this Containerfile runs.
2+
# Dependencies are prefetched by the Konflux pipeline (cachi2) and injected
3+
# into the build context before this Dockerfile runs.
44

55
FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_golang_1.25 AS builder
66

77
COPY . /workspace
88
WORKDIR /workspace
99

10-
ENV GOEXPERIMENT=strictfipsruntime
11-
12-
# Build release archives for all platforms
10+
# Build release archives for all platforms (CGO_ENABLED=0 for cross-platform
11+
# portability — CLI binaries run on user machines outside the FIPS boundary)
1312
RUN make release-archives && \
1413
mkdir -p /archives && \
1514
mv *.tar.gz *.sha256 /archives/ && \
1615
rm -rf /root/.cache/go-build /tmp/* release-build/
1716

18-
# Build the download server (FIPS-compliant)
19-
RUN CGO_ENABLED=1 GOOS=linux go build -mod=mod -a -tags strictfipsruntime \
17+
# Build the download server (FIPS-compliant, runs in-cluster on RHEL)
18+
RUN CGO_ENABLED=1 GOEXPERIMENT=strictfipsruntime GOOS=linux \
19+
go build -mod=readonly -a -tags strictfipsruntime \
2020
-o /workspace/bin/download-server ./cmd/downloads/ && \
2121
go clean -cache -modcache -testcache && \
2222
rm -rf /root/.cache/go-build /go/pkg

0 commit comments

Comments
 (0)