build-image.yaml

---
- hosts: builder
  become: no
  vars:
    upgrade: "false"
    rebase: "false"
    image_type: ""
    repo_url: ""
    quay_repo: ""
    parent_ref: ""

  tasks:
    - name: check partition size
      command: df -h
      ignore_errors: yes
      become: yes

    - name: check memory usage
      command: free -mh
      ignore_errors: yes
      become: yes

    - name: install required packages
      dnf:
        name:
          - osbuild-composer
          - weldr-client
          - jq
          - curl
          - skopeo
        state: latest
      become: yes

    # composer-cli output format changed since weldr-client 35.6
    - name: check weldr-client version
      shell: rpm -qa | grep weldr-client | awk -F '-' '{print $3}'
      register: package_result

    - set_fact:
        weldr_client_version: "{{ package_result.stdout }}"

    - name: create /etc/osbuild-composer/repositories folder
      file:
        path: /etc/osbuild-composer/repositories
        state: directory
      become: yes

    - name: copy rhel-88.json to /etc/osbuild-composer/repositories
      copy:
        src: "{{ playbook_dir }}/files/rhel-8-7-0.json"
        dest: /etc/osbuild-composer/repositories/rhel-87.json
      become: yes
      when: ansible_facts['distribution_version'] == "8.7"

    - name: copy rhel-88.json to /etc/osbuild-composer/repositories
      copy:
        src: "{{ playbook_dir }}/files/rhel-8-8-0.json"
        dest: /etc/osbuild-composer/repositories/rhel-88.json
      become: yes
      when: ansible_facts['distribution_version'] == "8.8"

    - name: copy rhel-92.json to /etc/osbuild-composer/repositories
      copy:
        src: "{{ playbook_dir }}/files/rhel-9-1-0.json"
        dest: /etc/osbuild-composer/repositories/rhel-91.json
      become: yes
      when: ansible_facts['distribution_version'] == "9.1"

    - name: copy rhel-92.json to /etc/osbuild-composer/repositories
      copy:
        src: "{{ playbook_dir }}/files/rhel-9-2-0.json"
        dest: /etc/osbuild-composer/repositories/rhel-92.json
      become: yes
      when: ansible_facts['distribution_version'] == "9.2"

    - name: copy rhel-88.json to /etc/osbuild-composer/repositories for rebase test
      copy:
        src: "{{ playbook_dir }}/files/rhel-8-8-0-sha512.json"
        dest: /etc/osbuild-composer/repositories/rhel-88.json
      become: yes
      when: ansible_facts['distribution_version'] == "9.2"

    - name: copy rhel-91.json to /etc/osbuild-composer/repositories for upgrade test
      copy:
        src: "{{ playbook_dir }}/files/rhel-9-1-0.json"
        dest: /etc/osbuild-composer/repositories/rhel-91.json
      become: yes
      when: ansible_facts['distribution_version'] == "9.2"

    - name: copy rhel-93.json to /etc/osbuild-composer/repositories
      copy:
        src: "{{ playbook_dir }}/files/rhel-9-3-0.json"
        dest: /etc/osbuild-composer/repositories/rhel-93.json
      become: yes
      when: ansible_facts['distribution_version'] == "9.3"

    - name: copy centos-stream-8.json to /etc/osbuild-composer/repositories
      copy:
        src: "{{ playbook_dir }}/files/centos-stream-8.json"
        dest: /etc/osbuild-composer/repositories/centos-8.json
      become: yes
      when: ansible_facts['distribution_version'] == "8"

    - name: copy centos-stream-8.json to /etc/osbuild-composer/repositories for rebase test
      copy:
        src: "{{ playbook_dir }}/files/centos-stream-8.json"
        dest: /etc/osbuild-composer/repositories/centos-8.json
      become: yes
      when: ansible_facts['distribution_version'] == "9"

    - name: copy centos-stream-9.json to /etc/osbuild-composer/repositories
      copy:
        src: "{{ playbook_dir }}/files/centos-stream-9.json"
        dest: /etc/osbuild-composer/repositories/centos-9.json
      become: yes
      when: ansible_facts['distribution_version'] == "9"

    - name: start osbuild-composer.socket
      systemd:
        name: osbuild-composer.socket
        state: started
      become: yes

    - name: check fdo-admin-cli
      shell: rpm -qa | grep fdo-admin-cli
      register: fdo_installed
      ignore_errors: True
      check_mode: False
      changed_when: False

    - block:
        # install fdo-client and fdo-init as a workaround of bug
        # https://bugzilla.redhat.com/show_bug.cgi?id=2230537
        - name: install fdo-admin-cli and pip
          dnf:
            name:
              - fdo-admin-cli
              - fdo-client
              - fdo-init
              - python3-pip
            state: latest
          become: yes

        - name: install yq
          pip:
            name: yq
          become: yes

        - name: start fdo service
          systemd:
            name: fdo-aio
            state: started
          become: yes

        - name: config re-encrypt
          command: '/usr/local/bin/yq -iy ".service_info.diskencryption_clevis |= [{disk_label: \"/dev/vda3\", reencrypt: true, binding: {pin: \"tpm2\", config: \"{}\"}}]" /etc/fdo/aio/configs/serviceinfo_api_server.yml'
          become: yes

        - name: restart fdo-aio service
          systemd:
            name: fdo-aio
            state: restarted
          become: yes

      when:
        - fdo_installed.rc == 1
        - image_type == "edge-simplified-installer" or image_type == "iot-simplified-installer"

    # Change to /etc/fdo folder to workaround issue https://bugzilla.redhat.com/show_bug.cgi?id=2026795#c24
    - name: config fdo user onboarding
      shell: |
        /usr/local/bin/yq -iy '.service_info.initial_user |= {username: "fdouser", sshkeys: ["ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCzxo5dEcS+LDK/OFAfHo6740EyoDM8aYaCkBala0FnWfMMTOq7PQe04ahB0eFLS3IlQtK5bpgzxBdFGVqF6uT5z4hhaPjQec0G3+BD5Pxo6V+SxShKZo+ZNGU3HVrF9p2V7QH0YFQj5B8F6AicA3fYh2BVUFECTPuMpy5A52ufWu0r4xOFmbU7SIhRQRAQz2u4yjXqBsrpYptAvyzzoN4gjUhNnwOHSPsvFpWoBFkWmqn0ytgHg3Vv9DlHW+45P02QH1UFedXR2MqLnwRI30qqtaOkVS+9rE/dhnR+XPpHHG+hv2TgMDAuQ3IK7Ab5m/yCbN73cxFifH4LST0vVG3Jx45xn+GTeHHhfkAfBSCtya6191jixbqyovpRunCBKexI5cfRPtWOitM3m7Mq26r7LpobMM+oOLUm4p0KKNIthWcmK9tYwXWSuGGfUQ+Y8gt7E0G06ZGbCPHOrxJ8lYQqXsif04piONPA/c9Hq43O99KPNGShONCS9oPFdOLRT3U= ostree-image-test"]}' /etc/fdo/aio/configs/serviceinfo_api_server.yml
        echo "fdouser ALL=(ALL) NOPASSWD: ALL" > /etc/fdo/fdouser
        /usr/local/bin/yq -iy '.service_info.files |= [{path: "/etc/sudoers.d/fdouser", source_path: "/etc/fdo/fdouser"}]' /etc/fdo/aio/configs/serviceinfo_api_server.yml
      become: yes
      when:
        - fdo_installed.rc == 1
        - image_type == "edge-simplified-installer" or image_type == "iot-simplified-installer"
        - (ansible_facts['distribution'] == 'RedHat' and ansible_facts ['distribution_version'] is version('9.2', '>=')) or (ansible_facts['distribution'] == 'CentOS' or ansible_facts ['distribution_version'] is version('9', '=='))

    # disable selinux as a workaround of bug https://bugzilla.redhat.com/show_bug.cgi?id=2026795
    - name: disable selinux
      command: setenforce 0
      become: yes
      when:
        - fdo_installed.rc == 1
        - image_type == "edge-simplified-installer" or image_type == "iot-simplified-installer"
        - (ansible_facts['distribution'] == 'RedHat' and ansible_facts ['distribution_version'] is version('9.3', '==')) or (ansible_facts['distribution'] == 'CentOS' or ansible_facts ['distribution_version'] is version('9', '=='))

    - name: restart fdo service
      systemd:
        name: fdo-aio
        state: restarted
      become: yes
      when:
        - fdo_installed.rc == 1
        - image_type == "edge-simplified-installer" or image_type == "iot-simplified-installer"
        - (ansible_facts['distribution'] == 'RedHat' and ansible_facts ['distribution_version'] is version('9.2', '>=')) or (ansible_facts['distribution'] == 'CentOS' or ansible_facts ['distribution_version'] is version('9', '=='))

    - name: get current date and time
      command: date +'%Y-%m-%d %H:%M:%S'
      register: date_result

    - set_fact:
        start_time: "{{ date_result.stdout }}"

    - name: copy blueprint.toml to builder
      copy:
        src: /tmp/blueprint.toml
        dest: /tmp/blueprint.toml

    - name: push blueprint
      command: composer-cli blueprints push /tmp/blueprint.toml
      become: yes

    - name: get blueprint name
      command: composer-cli blueprints list
      become: yes
      register: bp_name_result

    - set_fact:
        bp_name: "{{ bp_name_result.stdout }}"

    - name: depsolve blueprint
      command: "composer-cli blueprints depsolve {{ bp_name }}"
      become: yes

    - name: start commit image or fedora container image building
      shell: "composer-cli --json compose start-ostree --ref {{ ostree_ref }} {{ bp_name }} {{ image_type }} | tee /tmp/{{ image_type }}-compose-start"
      become: yes
      when:
        - image_type == "edge-commit" or image_type == "iot-commit" or ((image_type == "edge-container" or image_type == "iot-container") and quay_repo == "")
        - upgrade == "false"
        - rebase == "false"

    - name: copy quay_config.toml to builder
      copy:
        src: /tmp/quay_config.toml
        dest: /tmp/quay_config.toml
      when:
        - image_type == "edge-container"
        - quay_repo != ""
        - upgrade == "false"

    - name: start container image building with auto-upload enabled
      shell: "composer-cli --json compose start-ostree --ref {{ ostree_ref }} {{ bp_name }} {{ image_type }} {{ quay_repo }} /tmp/quay_config.toml | tee /tmp/{{ image_type }}-compose-start"
      become: yes
      when:
        - image_type == "edge-container"
        - quay_repo != ""
        - upgrade == "false"

    - name: start installer or raw image building
      shell: "composer-cli --json compose start-ostree --ref {{ ostree_ref }} --url {{ repo_url }} {{ bp_name }} {{ image_type }} | tee /tmp/{{ image_type }}-compose-start"
      become: yes
      when:
        - image_type == "edge-installer" or image_type == "iot-installer" or image_type == "edge-raw-image" or image_type == "iot-raw-image" or image_type == "edge-simplified-installer" or image_type == "iot-simplified-installer"
        - upgrade == "false"

    - name: start upgrade image building
      shell: "composer-cli --json compose start-ostree --ref {{ ostree_ref }} --url {{ repo_url }} {{ bp_name }} {{ image_type }} | tee /tmp/{{ image_type }}-compose-start"
      become: yes
      when: upgrade == "true"

    - name: start rebase image building
      shell: "composer-cli --json compose start-ostree --ref {{ ostree_ref }} --parent {{ parent_ref }} --url {{ repo_url }} {{ bp_name }} {{ image_type }} | tee /tmp/{{ image_type }}-compose-start"
      become: yes
      when: rebase == "true"

    - name: start minimal raw image building
      shell: "composer-cli --json compose start {{ bp_name }} {{ image_type }} | tee /tmp/{{ image_type }}-compose-start"
      become: yes
      when: image_type == "minimal-raw"

    - name: get compose uuid for new weldr-client
      command: jq -r '.[0].body.build_id' "/tmp/{{ image_type }}-compose-start"
      register: compose_uuid_result
      when: weldr_client_version is version('35.6', '>=')

    - set_fact:
        compose_uuid: "{{ compose_uuid_result.stdout }}"
      when: weldr_client_version is version('35.6', '>=')

    - name: get compose uuid for old weldr-client
      command: jq -r '.body.build_id' "/tmp/{{ image_type }}-compose-start"
      register: compose_uuid_result
      when: weldr_client_version is version('35.6', '<')

    - set_fact:
        compose_uuid: "{{ compose_uuid_result.stdout }}"
      when: weldr_client_version is version('35.6', '<')

    - name: collect image building log no matter success or fail
      block:
        - name: wait until image building finished
          command: composer-cli compose status
          become: yes
          register: compose_status
          retries: 60
          delay: 50
          until: "'FINISHED' in compose_status.stdout"
      always:
        - name: check partition size
          command: df -h
          ignore_errors: yes
          become: yes

        - name: check memory usage
          command: free -mh
          ignore_errors: yes
          become: yes

        - name: show worker log
          command: "journalctl -a --no-pager --since '{{ start_time }}' -u osbuild-worker@1.service"
          become: yes

        - name: collect compose log
          shell: "composer-cli compose log {{ compose_uuid }} | tee /tmp/osbuild-{{ ansible_facts['distribution'] }}-{{ ansible_facts['distribution_version'] }}-{{ compose_uuid }}.log > /dev/null"
          become: yes

        - name: fetch log file back
          fetch:
            src: "/tmp/osbuild-{{ ansible_facts['distribution'] }}-{{ ansible_facts['distribution_version'] }}-{{ compose_uuid }}.log"
            dest: "/tmp/osbuild-{{ ansible_facts['distribution'] }}-{{ ansible_facts['distribution_version'] }}-{{ compose_uuid }}.log"
            flat: yes

    - name: download ostree image
      command: "composer-cli compose image {{ compose_uuid }}"
      args:
        chdir: /home/admin
      become: yes
      when: quay_repo == ""

    - name: grant read permission to commit image file
      file:
        path: "/home/admin/{{ compose_uuid }}-commit.tar"
        owner: admin
        group: admin
        mode: '0644'
      become: yes
      when: image_type == "edge-commit" or image_type == "iot-commit"

    - name: grant read permission to container image file
      file:
        path: "/home/admin/{{ compose_uuid }}-container.tar"
        owner: admin
        group: admin
        mode: '0644'
      become: yes
      when:
        - quay_repo == ""
        - image_type == "edge-container" or image_type == "iot-container"

    - name: grant read permission to installer image file
      file:
        path: "/home/admin/{{ compose_uuid }}-installer.iso"
        owner: admin
        group: admin
        mode: '0644'
      become: yes
      when:
        - image_type == "edge-installer" or image_type == "iot-installer"

    - name: grant read permission to raw image file
      file:
        path: "/home/admin/{{ compose_uuid }}-image.raw.xz"
        owner: admin
        group: admin
        mode: '0644'
      become: yes
      when:
        - image_type == "edge-raw-image" or image_type == "iot-raw-image"

    - name: grant read permission to simplified installer image file
      file:
        path: "/home/admin/{{ compose_uuid }}-simplified-installer.iso"
        owner: admin
        group: admin
        mode: '0644'
      become: yes
      when:
        - image_type == "edge-simplified-installer" or image_type == "iot-simplified-installer"

    - name: grant read permission to minimal raw image file
      file:
        path: "/home/admin/{{ compose_uuid }}-raw.img"
        owner: admin
        group: admin
        mode: '0644'
      become: yes
      when:
        - image_type == "minimal-raw"

    - name: remove image
      command: "composer-cli compose delete {{ compose_uuid }}"
      become: yes

    - name: remove blueprint
      command: "composer-cli blueprints delete {{ bp_name }}"
      become: yes