Distributing Kickstart Files as OCI Artifacts
This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee.
Summary
Fedora distributed as bootable container ships via OCI registry. Installation is typically done by conversion into a VM image or ISO installer via osbuild (image builder), however, booting from network is a useful workflow for bare-metal fleet deployments. Required files to perform such installation are not available in the OCI repository.
Owner
- Name: Ina Panova, Lukáš Zapletal
- Email: <ipanova@redhat.com>, <lzap@redhat.com>
Current status
- Targeted release: Fedora Linux 42
- Last updated: 2024-09-10
- [Announced]
- [<will be assigned by the Wrangler> Discussion thread]
- FESCo issue: <will be assigned by the Wrangler>
- Tracker bug: <will be assigned by the Wrangler>
- Release notes tracker: <will be assigned by the Wrangler>
Detailed Description
Fedora bootable container is shipped via OCI registries without any supplementary files for automated kickstart installations. The files needed for this workflow are typically: bootloader, anaconda kernel, initramdisk and anaconda main image. These files can be found in regular Fedora RPM repository, for example in case of x86_64 architecture:
Some files are distributed unsigned in the images/ directory, others are signed and need to be extracted from RPM packages. A complete ISO "netboot" image is also available for network installations, the image can be customized using mkksiso tool found in Fedora.
The main goal of this change is to start publishing the mentioned file as OCI commits or also known OCI artifacts for each Fedora version and architecture. Buildah/Podman will be used for creating such manifest and pushing it to OCI registry.
There are currently no support for downloading OCI artifacts with podman and the feature is being discussed upstream, however, Fedora contains golang-oras tool which understands the OCI artifact format. This tool can be used by Fedora users to consume the content:
$ oras pull quay.io/lzapletal/fedora-bootfiles:40-amd64 Downloaded 80c3fe2ae106 boot.iso Downloaded a3b7052d7b2f grubx64.efi Downloaded fff4b2feeef3 pxelinux.0 Downloaded 4773d74d87c2 shimx64.efi Downloaded 09cf5df01619 vmlinuz Downloaded 8ea1dd040e97 initrd.img Restored 80c3fe2ae106 install.img Pulled quay.io/lzapletal/fedora-bootfiles:40-amd64 Digest: sha256:0306e10fd556e12ce8c3674150bceb88c0917b74b63c37eecc17070b3b30003b
There is a manifest specification of such content describing required annotations.
Benefit to Fedora
The change solves the situation for Fedora bootable containers users who currently need to find matching Fedora RPM repositories and use various tools like curl or rpm2cpio and cpio to download required files.
Users of regular (RPM) Fedora spin will benefit as well since bare-metal provisioning workflows, scripts or tools can be further simplified. All the content will be also signed by GPG which is not the case for some (executable) files today.
Using OCI artifacts also enables us to distribute the files in the Fedora bootable container registry if needed in the future: quay.io/fedora/fedora-bootc.
Scope
- Proposal owners: prepare CI/CD pipeline for fully automated build and push of artifacts, integrate the published repositories with related open-source project Foreman and Pulp
- Release engineering: create new repository in fedora namespace #12152
Documentation
TBD
The newly created repository will be features in documentation of several projects that will make use of it:
- osbuild
- foreman
- pulp
Release Notes
TBD