Promotion of 0.3.0 to main - #189
Merged
Merged
Conversation
- Remove reference to K8s images as they are not built directly with this tooling. - Added the pull request link to the changelog. - Added a date to the release - removed the duplicated release 0.2.0 from the rebase
DOC - os_builders: Update CHANGELOG
- Pakiti 2 is no longer being used. We need to move to Pakiti 3. - There is no repository or RPM providing this script. We have to download it from GitHub and install perl. To prevent supply chain attacks we will copy the script into our repository - All VMs should report to the "Cloud" site which members of the Cloud team have access to. - It is set to run as a cron job by the root user. It does not run on boot, this stops short lived VMs from polluting the Pakiti server. e.g. Rally VMs
update_keys.sh hangs indefinitely because the endpoint openstack.stfc.ac.uk:9999/admin_key_list was removed when we decommissioned lb5 and lb6. I've added a limit to the wget command so it only tries 5 times then errors. We still want to include this script because we will create a redirect / alternative solution that may use the same endpoint.
The EPEL repositories were removed during the change over to the new image builders. Some users automations relied on this package being present so I am adding it back to the Rocky images.
ENH - os_builders: Install EPEL repositories onto Rocky
This shrinks the image down by marking free blocks so the conversion can simply truncate these blocks in the qcow2 image. While disk space is cheap, this is free and slightly speeds up VM creation by using smaller images with less cruft being shipped around in the form of released blocks from the FS Skip adding to changelog, as this is not user-visible in any way as those blocks were released in the image build. It's purely a glance nova free little-win
BUG - os_builders: Fix hanging update_keys.sh
Add a link to the pakiti client script for traceability
By calling the script from /etc/cron.daily it will naturally smear all VMs as they are created at different times.
MAINT: Move to Pakiti 3
ENH: Run fstrim during image sysprep
add comment
The hostname command doesn't always set the hostname when the script runs. Changing to hostnamectl should make this more reliable
Slight tweak to the bash if statement to use better functionailty.
The nubes-bootcontext script now only calls 3 scripts rather than running some bash then running other scripts. This should make it more clear what the script is doing and easier to debug in the future.
The nubes boot service is quite racey as the service file is not set up correctly. Adding the hostname daemon to the wants and setting this as a oneshot type should make sure that: the service runs once at boot, runs after the hostname service is online and reports correctly to systemctl. Any retries is handled in the script logic.
The service is called nubes-boot and everything else should be named that too. It makes debugging confusing because the nubes-boot service calls the nubes-bootcontext script
We need to copy the update_cloud_users.sh script first before we start the nubes boot service. Otherwise nubes boot fails because the script doesn't exist.
We do not need to start this service when we build the image. It is enabled to start on boot. Starting it causes the build to fail as the admin key list endpoint doesn't exist which is expected.
We cannot run this task in the GitHub container as systemctl doesn't exist. So we need to skip it
This change should have been added to the changelog when it was made as it affects the disk image size.
Fix VM hostname scripts
This partially reverts commit 4f8f55b. Ubuntu have released a patch for the Ghostlock CVE 1 day after this mitigation was added. We should revert back to using the mainstream kernel.
The GitHub pipeline uses container to emulate a VM and run the config. Containers do not have systemd installed and so the task to enable qemu is not working. Add a check to not run this step when in a container
Revert "ENH: Add mitigation for 22.04 not having CVE-2026-43499"
DOC - os_builders: Add l3.imagecreate to CHANGELOG.md
I am changing this to a simple substitution rather than trying to use DNS lookups, it's prone to network failure and does not make any difference
BUG - os_builders: Remove network attempts to get DNS
Promotion for image builders version 0.3.0 to main. See CHANGELOG.md for details.
jose-caballero
approved these changes
Aug 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is the promotion PR for image builders version 0.3.0 to main. All features in this branch have been reviewed already. This PR completes the CHANGELOG.md with pull requests numbers and completes the RELEASE.md notes for the version.