CI networking cleanup - #2385
Draft
ckyrouac wants to merge 3 commits into
Draft
Conversation
Move all network-dependent operations into dedicated init steps so transient failures (registry timeouts, Koji 503s, etc.) surface early and don't abort a 3-hour test run mid-way. Changes by area: ci.yml: - install-tests: split 'Integration tests' into two steps: 'Build images and test binaries' (build + cargo compile) and 'Integration tests' (actual test execution). Both cargo build invocations now precede any test run, so a network-induced cargo failure is immediately identifiable. - test-baseconfigs: add missing 'Fetch external dependencies (with retry)' step (just build-fetch) before building the container, making it consistent with test-integration and test-upgrade. - test-container-export: add 'Fetch external dependencies (with retry)' step; split ISO download into a separate 'Build container and fetch Anaconda ISO' step (just fetch-anaconda-iso) before the test step. Justfile: - Add fetch-anaconda-iso target: downloads the Anaconda boot ISO with --retry 5 --retry-delay 30 so transient CDN failures are retried. The existing test-container-export target now asserts the ISO exists rather than downloading it, making the network/test boundary explicit. - Add bib_image and lbi_switch_images variables for images that must be pre-pulled on the GHA host (with retry) and exposed inside test VMs via --bind-storage-ro virtiofs, rather than pulled live during tests. - Extend build-fetch to pull bib_image and lbi_switch_images with retry. - Extend copy-lbi-to-rootful to include bib_image and lbi_switch_images (needed by the install-tests job which copies to root's storage). hack/provision-fetch.sh + hack/packages.txt: - Add skopeo to packages.txt (needed for busybox OCI pre-fetch below). - At the end of the fetch stage, use skopeo to download busybox as an OCI layout at /usr/share/bootc-test/busybox-oci. This runs within the network-allowed fetch layer so the busybox image is baked into the test container image and available to the test VM without a registry pull. tmt/tests/booted/readonly/030-test-composefs.nu: - Replace 'docker://busybox' pull with 'oci:/usr/share/bootc-test/ busybox-oci', using the pre-fetched OCI layout from provision-fetch.sh. tmt/tests/booted/test-bib-build.nu + tmt/plans/integration.fmf: - Add 'try_bind_storage: true' to the test's extra: block so xtask passes --bind-storage-ro to bcvk for plan-33. The BIB image (quay.io/centos-bootc/bootc-image-builder:latest) is pre-pulled on the GHA host and exposed via the virtiofs additionalimagestore, so 'podman run ... ' inside the VM finds it locally. tmt/tests/booted/test-logically-bound-switch.nu + tmt/plans/integration.fmf: - Add 'try_bind_storage: true' to the test's extra: block (plan-21). - In initial_setup, call 'bootc image pull-from-default-storage' for each bound image (ubi9/ubi-minimal:9.4, ubi9/ubi-minimal:9.3, alpine:latest) before building the derived container. These images are pre-pulled on the GHA host and visible inside the VM via additionalimagestore; pull-from-default-storage moves them into bootc's own storage so 'bootc switch' finds them there without a registry pull. tmt/plans/integration.fmf (Packit/OSCI path): - In the order-98 shell prepare step, copy hack/packit-reboot.yml to /tmp/packit-reboot.yml after extraction from the src.rpm. - Change the order-99 Ansible playbook reference from a live GitHub URL to /tmp/packit-reboot.yml, eliminating the live github.com fetch during Packit gating runs. Assisted-by: Claude (claude-opus-4-5-20251101)
Block outbound internet from tmt test VMs by passing --restrict-network (bcvk's new QEMU slirp restrict=on flag) unconditionally to every plan's bcvk libvirt run call. This prevents mid-run registry pulls from causing spurious failures in 3-hour test runs. The inbound SSH port-forward used by tmt to reach the VM is unaffected. All container images and binaries needed by tests must be pre-fetched in the build/fetch phase before VMs are launched. Assisted-by: OpenCode (claude-opus-4-5-20251101)
…alpine registry.access.redhat.com is not reachable through the sandbox proxy. Substitute docker.io/library/alpine at equivalent tags as a pullable stand-in for the LBI and LBI-switch test images. The LBI tests only verify that the named images are present in bootc storage after boot - they do not execute anything from the images - so any pullable OCI image is a valid substitute for local testing. Assisted-by: OpenCode (claude-opus-4-5)
Collaborator
|
xref bootc-dev/bcvk#311 since these are somewhat overlapping, although offhand I'm not familiar with what |
cgwalters
reviewed
Aug 18, 2026
| @@ -1,2 +1,2 @@ | |||
| [Image] | |||
| Image=registry.access.redhat.com/ubi9/podman:latest | |||
| Image=docker.io/library/alpine:latest | |||
Collaborator
There was a problem hiding this comment.
But this isn't podman anymore...
| podman images | ||
| podman image inspect localhost/bootc | from json | ||
|
|
||
| # Pre-seed the bound images used by this test into bootc's own storage. |
Collaborator
There was a problem hiding this comment.
The thing that worries me a bit about this is that the additional image store stuff is already somewhat special magic, and how AIS interacts with bootc/composefs storage and especially bootc's own use of AIS for LBIs...is...complicated.
I mean, isn't this change effectively subverting bootc's own image pulls?
In other words, I think we are still going to need tests that interact with registries directly.
The more I think about this the more I feel we should be using https://github.com/cgwalters/cstor-dist or so instead.
Collaborator
Author
There was a problem hiding this comment.
thanks for looking at this! I haven't given this much attention. I just wanted to push it up as a starting point. I agree using cstor-dist makes sense. I was working on that awhile ago on another branch. I'll try to merge that code into this PR.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Some AI generated changes to CI to remove network access during test execution. Opening as a draft to test and iterate.