search

coreos / coreos-assembler

Tooling container to assemble CoreOS-like systems
https://coreos.github.io/coreos-assembler/
Apache License 2.0
333 stars 165 forks source link

[rhcos-4.13] live-iso: Write kernel (and hmac) to /boot too #3750

Closed zaneb closed 5 months ago

zaneb commented 5 months ago

(backport of #3626)

This is useful in order to make the dracut FIPS module work. For ostree, we put the kernel stuff in /boot/ostree in order to namespace things. But non-ostree systems tend to use /boot directly, and that's what the dracut module is hardcoded to do.

Now we did add some logic in the dracut module which scrapes the grub-injected BOOT_IMAGE, except this doesn't work for how we generate the CoreOS Live ISO today because the filenames of the kernel don't include versions etc.

In the case of the Live ISO though we don't really need to "ostree namespace" things, so just hardlink the kernel binary and the hmac file into the traditional places in /boot.

We could not do this, and do it in our dracut module in the initramfs in fips mode only for the Live ISO, but that'd be way more ugly.

xref https://issues.redhat.com/browse/OCPBUGS-23907

(cherry picked from commit 86943ca026b37dd1e359e4bb91a68a41529dc20b)

openshift-ci[bot] commented 5 months ago

Hi @zaneb. Thanks for your PR.

I'm waiting for a coreos member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
zaneb commented 5 months ago

/cc @cgwalters