[READY] - signs server updates and microvm config

sarcasticadmin commented 7 months ago

Description of PR

Fixes: #588

Finally getting to some fixups for the sign server.

There does seem to be one small issue with the version of podman were on. I was getting the following error:

Mar 06 07:19:04 nixos systemd[1]: Failed to start podman-scale-signs.service.
Mar 06 07:19:04 nixos systemd[1]: podman-scale-signs.service: Scheduled restart job, restart counter is at 1.
Mar 06 07:19:04 nixos systemd[1]: Starting podman-scale-signs.service...
Mar 06 07:19:04 nixos podman-scale-signs-pre-start[1352]: time="2024-03-06T07:19:04Z" level=warning msg="Unmounting container \"scale-signs\" while attempting to delete storage: unmounting \"/var/lib/containers/storage/overlay/4ba7569c324a11522c4701ba4df172d7ad3b41081e734debae0bcae10385c891/merged\": invalid argument"
Mar 06 07:19:04 nixos podman-scale-signs-pre-start[1352]: Error: removing storage for container "scale-signs": unmounting "/var/lib/containers/storage/overlay/4ba7569c324a11522c4701ba4df172d7ad3b41081e734debae0bcae10385c891/merged": invalid argument
Mar 06 07:19:04 nixos podman-scale-signs-start[1362]: time="2024-03-06T07:19:04Z" level=warning msg="Unmounting container \"scale-signs\" while attempting to delete storage: unmounting \"/var/lib/containers/storage/overlay/4ba7569c324a11522c4701ba4df172d7ad3b41081e734debae0bcae10385c891/merged\": invalid argument"
Mar 06 07:19:04 nixos podman-scale-signs-start[1362]: Error: removing storage for container "scale-signs": unmounting "/var/lib/containers/storage/overlay/4ba7569c324a11522c4701ba4df172d7ad3b41081e734debae0bcae10385c891/merged": invalid argument
Mar 06 07:19:04 nixos podman[1362]: 2024-03-06 07:19:04.287926627 +0000 UTC m=+0.023734357 image pull 6f02b1de6904c70193a89391012ebbf1e3b0ea4d819d21609e060f973e825774 sarcasticadmin/scale-signs:1fc4dc5
Mar 06 07:19:04 nixos systemd[1]: podman-scale-signs.service: Main process exited, code=exited, status=125/n/a
Mar 06 07:19:04 nixos systemd[1]: podman-scale-signs.service: Failed with result 'exit-code'.

ref: https://github.com/containers/podman/discussions/19839

This seems to be fixed in the recent versions of podman but I dont think its worth trying to pump to existing lock file. Going to spin out a follow up issue in investigate this.

Its an easy workaround of running:

podman rm <image>

Previous Behavior

sign server was point secrets to /run which is ephemeral
no microvm config

New Behavior

sign server now point to /var/lib/secrets/
microvm config
bump to test 21x container image

Tests

The sign server was spun up on the new lenovo hypervisor hardware and is looking good with its persistent secret location (event though the API is technically broken:

kylerisse commented 6 months ago

This seems to be fixed in the recent versions of podman but I dont think its worth trying to pump to existing lock file. Going to spin out a follow up issue in investigate this.

Good call on not bumping lock file less than a week before show.

sarcasticadmin commented 6 months ago

Thanks for the review @kylerisse ! See you in a few days!

socallinuxexpo / scale-network