Skip to content

WIP: Use a registry with TMT tests #1847

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
ckyrouac wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

WIP: Use a registry with TMT tests #1847

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
427aca3
Tmt test refactor READMEs
ckyrouac Dec 11, 2025
5009041
Code changes for tmt test refactor
ckyrouac Dec 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .dockerignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,3 +25,4 @@
!target/packages/
# And finally of course all the Rust sources
!crates/
!hack/
3 changes: 3 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,3 +5,6 @@ bootc.tar.zst

# Added by cargo
/target

# Registry TLS certificates (generated at build time)
/hack/.registry-certs
Copy link
Collaborator

@cgwalters cgwalters Dec 11, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm ok with this but note the secure-boot keys which are similar are in target which I feel is cleaner; basically it's the default directory for build-time artifacts.

17 changes: 17 additions & 0 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,5 +74,22 @@ RUN --mount=type=bind,from=packaging,target=/run/packaging \
--mount=type=bind,from=packages,target=/build-packages \
--network=none \
/run/packaging/install-rpm-and-setup /build-packages
# Install registry CA certificate for secure registry access in tests
RUN --mount=type=bind,from=src,target=/run/src <<EORUN
set -xeuo pipefail
# Install the registry CA certificate if it exists
# This allows test VMs to trust the registry's TLS certificate
ls -la /run/src/src
Copy link
Contributor

@gemini-code-assist gemini-code-assist bot Dec 11, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

This ls command appears to be for debugging and can be removed.

if [ -f /run/src/src/hack/.registry-certs/ca.pem ]; then
echo "Installing registry CA certificate to trust store..."
cp /run/src/src/hack/.registry-certs/ca.pem /usr/share/pki/ca-trust-source/anchors/bootc-registry-ca.crt
update-ca-trust
echo "✓ Registry CA certificate installed"
else
echo "Note: Registry CA certificate not found - registry will need --tls-verify=false"
echo "To enable secure registry access, run: hack/setup-registry-certs.sh"
exit 1
fi
Comment on lines +83 to +92
Copy link
Collaborator

@cgwalters cgwalters Dec 11, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is all 100% fine as is but I think it'd be cleaner and clearer written like this:

if test '!' -f /run/src/src/hack/.registry-certs/ca.pem; then
  echo "hack/setup-registry-certs.sh must be invoked" 1>&2; exit 1
fi
cp /run/src/src/hack/.registry-certs/ca.pem /usr/share/pki/ca-trust-source/anchors/bootc-registry-ca.crt
update-ca-trust

The idea is we check for exceptions/errors first, and the "happy path" is the default one.

EORUN
# Finally, testour own linting
RUN bootc container lint --fatal-warnings
21 changes: 18 additions & 3 deletions Justfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,8 @@ base_img := "localhost/bootc"
integration_img := base_img + "-integration"
# Has a synthetic upgrade
integration_upgrade_img := integration_img + "-upgrade"
# Registry image for multi-VM testing
integration_registry_img := integration_img + "-registry"

# ostree: The default
# composefs-sealeduki-sdboot: A system with a sealed composefs using systemd-boot
Expand All @@ -41,6 +43,7 @@ buildargs := "--build-arg=base=" + base + " --build-arg=variant=" + variant
# Note commonly you might want to override the base image via e.g.
# `just build --build-arg=base=quay.io/fedora/fedora-bootc:42`
build: package
./hack/setup-registry-certs.sh
podman build {{base_buildargs}} -t {{base_img}}-bin {{buildargs}} .
./tests/build-sealed {{variant}} {{base_img}}-bin {{base_img}} {{buildroot_base}}

Expand Down Expand Up @@ -98,7 +101,9 @@ copy-packages-from PATH:

# This container image has additional testing content and utilities
build-integration-test-image: build
cd hack && podman build {{base_buildargs}} -t {{integration_img}}-bin -f Containerfile .
# Generate TLS certificates for registry trust (idempotent - skips if exists)
./hack/setup-registry-certs.sh
podman build {{base_buildargs}} -t {{integration_img}}-bin -f hack/Containerfile .
./tests/build-sealed {{variant}} {{integration_img}}-bin {{integration_img}} {{buildroot_base}}
# Keep these in sync with what's used in hack/lbi
podman pull -q --retry 5 --retry-delay 5s quay.io/curl/curl:latest quay.io/curl/curl-base:latest registry.access.redhat.com/ubi9/podman:latest
Expand Down Expand Up @@ -140,18 +145,28 @@ validate:
#
# To run an individual test, pass it as an argument like:
# `just test-tmt readonly`
test-tmt *ARGS: build-integration-test-image _build-upgrade-image
test-tmt *ARGS: build-integration-test-image _build-upgrade-image _build-registry-image
@just test-tmt-nobuild {{ARGS}}

# Generate a local synthetic upgrade
_build-upgrade-image:
cat tmt/tests/Dockerfile.upgrade | podman build -t {{integration_upgrade_img}}-bin --from={{integration_img}}-bin -
./tests/build-sealed {{variant}} {{integration_upgrade_img}}-bin {{integration_upgrade_img}} {{buildroot_base}}

# Build a registry VM image for multi-VM testing
# Uses Podman Quadlet for idiomatic container-as-service setup
_build-registry-image:
# Generate TLS certificates for the registry (idempotent - skips if exists)
./hack/setup-registry-certs.sh
# Build registry image with Quadlet configuration
# Pre pull registry container to be used as a LBI
podman pull quay.io/libpod/registry:2.8.2
Copy link
Collaborator

@cgwalters cgwalters Dec 11, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not a blocker but we'll need to ensure stuff like this is tagged so that renovate can handle bumping it. Probably best as a Justfile variable at the top too.

I would also say we should not use that specific container image which I think is only for the podman team's CI. https://github.com/distribution/distribution is part of CNCF too, but obviously there's a lot of choices for registries.

podman build -t {{integration_registry_img}} -f hack/Containerfile.registry --build-arg=base={{buildroot_base}} .

# Assume the localhost/bootc-integration image is up to date, and just run tests.
# Useful for iterating on tests quickly.
test-tmt-nobuild *ARGS:
cargo xtask run-tmt --env=BOOTC_variant={{variant}} --upgrade-image={{integration_upgrade_img}} {{integration_img}} {{ARGS}}
cargo xtask run-tmt --env=BOOTC_variant={{variant}} --upgrade-image={{integration_upgrade_img}} --registry-image={{integration_registry_img}} {{integration_img}} {{ARGS}}

# Cleanup all test VMs created by tmt tests
tmt-vm-cleanup:
Expand Down
Loading
Loading