zuul-providers/zuul.d/image-build-jobs.yaml

- job:
    name: opendev-build-diskimage-base
    description: |
      The abstract base job for building VM images used in OpenDev's Zuul

      If the variable ``image_upload_secret`` is provided (as a
      secret) this job will upload the resulting image (this should be
      done in image build pipelines).  Otherwise, it will only build
      the image without uploading it (this can be useful for check
      pipelines).
    parent: build-diskimage
    timeout: 7200
    post-timeout: 7200
    abstract: true
    # Temporarily fix the image build jobs to run on the nodepool
    # label without using nodesets so that we can change the nodeset
    # definitions without triggering image rebuilds during the
    # transition.
    nodeset:
      nodes:
        - name: ubuntu-noble
          label: ubuntu-noble
    pre-run:
      - playbooks/opendev-build-diskimage-base/pre.yaml
    post-run:
      - playbooks/opendev-build-diskimage-base/post.yaml
    files:
      - 'dib-elements/.*'
      - 'playbooks/opendev-build-diskimage-base/.*'
      - 'roles/make-source-repositories-cache/.*'
    vars:
      # TODO(corvus): This will eventually be supplied by Zuul
      build_diskimage_formats:
        - qcow2
        - raw
        - vhd
      # /opt/dib_tmp is an ephemeral disk if present
      build_diskimage_image_root: "/opt/dib_tmp/dib-images"
      build_diskimage_elements: &base_elements
        - vm
        - simple-init
        - openstack-repos
        - nodepool-base
        - growroot
        - infra-package-needs
      build_diskimage_environment:
        TMPDIR: /opt/dib_tmp
        ELEMENTS_PATH: "{{ ansible_user_dir }}/{{ zuul.projects['opendev.org/opendev/zuul-providers'].src_dir }}/dib-elements"
        # TODO: Do we want streaming logs?
        DIB_QUIET: '0'
        DIB_NO_TMPFS: '1'
        DIB_CHECKSUM: '1'
        DIB_IMAGE_CACHE: /opt/dib_cache
        DIB_JOURNAL_SIZE: '512'
        DIB_GRUB_TIMEOUT: '0'
        GIT_HTTP_LOW_SPEED_TIME: '300'
        GIT_HTTP_LOW_SPEED_LIMIT: '1000'
        DIB_SHOW_IMAGE_USAGE: '1'
        ZUUL_USER_SSH_PUBLIC_KEY: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDh5u0DWNi0d3uqI82izAxVTUTrGl36L3szEqV9WrilGmxaTtp9X7HrktJ5J+rvxQqz39llTf1v7iYA4CNKto/48RBAB0mKEEI4x4iw+fu/BLU7nu7ewSfXLUxHahxaTgIk2KcbegknD5NzMjalyfNfgTPDGv8BjwHeeNdZmJMBvPFGu6fO48M4yK1tiQn0kAkaH4oII/M4pyF8vy9tPTODAD7RvnMvQAb08LZZvE/IPzJAHNXFRb1v+DBa38fOvdyaz/nibrsxiOWZxQVLgjYciUeDy1xvXADaWlqvxmLy+90LHbJFbGxK4AN0mWfwBiUMVyxZjkun39pjTNl2k09OhOq+R52UqnehMc4eBdZCddnCUq4/efbFCJkqe5wY+SE8fYybJjauUL64zyrwf6yfWkXvPVHWa9Y+NCmvH8PCBUcsQnwO7l/Yb4N+8+u6zkODyuc9wLAY+DpnptE3plXtvUs5negC4fvJSnOHpWXuoi9yzp7IlPf6fSjMMDQo0JjCYJwazdzqrIH2VSCcfHAqWF0ECR8IgwZV1bp0xFe0UN0Gjsgkozqf8rvs1AYyTSeD19Wg9j+crTke8E1sfoI/qFzHwzBQFKJ+2l0cs7pZWJBARlhbt1j1IouS2aH+74xwsavRhBz4IsFTPqWiP6JTrgk5cgKRnTqInzNfdaLeUw== zuul-worker@openstack.org"

- job:
    name: opendev-build-diskimage-base-debuntu
    description: |
      An abstract base job for building Debian or Ubuntu based VM images
    parent: opendev-build-diskimage-base
    abstract: true
    vars:
      build_diskimage_environment:
        DIB_APT_LOCAL_CACHE: '0'
        DIB_DISABLE_APT_CLEANUP: '1'
        DIB_DEBOOTSTRAP_EXTRA_ARGS: '--no-check-gpg'

- job:
    name: opendev-build-diskimage-debian-bullseye
    description: |
      Build the OpenDev Debian bullseye VM image
    parent: opendev-build-diskimage-base-debuntu
    image-build-name: debian-bullseye
    vars:
      build_diskimage_image_name: debian-bullseye
      build_diskimage_elements:
        - *base_elements
        - debian-minimal
        - cache-devstack
      build_diskimage_environment:
        DIB_RELEASE: 'bullseye'
        DIB_DISTRIBUTION_MIRROR: 'https://{{ zuul_site_mirror_fqdn }}/debian'
        DIB_DEBIAN_SECURITY_MIRROR:
          'https://{{ zuul_site_mirror_fqdn }}/debian-security'
        DIB_BLOCK_DEVICE_CONFIG: |
          # Default single partition loopback
          - local_loop:
              name: image0

          - partitioning:
              base: image0
              label: mbr
              partitions:
                - name: root
                  flags: [ boot, primary ]
                  size: 100%
                  mkfs:
                    mount:
                      mount_point: /
                      fstab:
                        options: "defaults,nobarrier,noatime"
                        fsck-passno: 1

- job:
    name: opendev-build-diskimage-ubuntu-jammy
    description: |
      Build the OpenDev Ubuntu jammy VM image
    parent: opendev-build-diskimage-base-debuntu
    image-build-name: ubuntu-jammy
    vars:
      build_diskimage_image_name: ubuntu-jammy
      build_diskimage_elements:
        - *base_elements
        - ubuntu-minimal
        - cache-devstack
      build_diskimage_environment:
        DIB_RELEASE: 'jammy'
        DIB_DISTRIBUTION_MIRROR: 'https://{{ zuul_site_mirror_fqdn }}/ubuntu'
        DIB_DEBIAN_COMPONENTS: 'main,universe'
        # NOTE(ianw) 2022-05-20 : we have found a problem on some cloud
        # providers (OVH at least) where setting SSBD mitigation flags
        # seems to be disabled and this causes endless kernel tracebacks
        # from writing invalid flags into MSR registers, flooding the
        # logs.  By default spec_store_bypass_disable is set to
        # "seccomp" which means the kernel forces every seccomp() call
        # into this.  Setting it to prctl means userspace has to opt-in
        # with an explicit call.  This is actually the default on more
        # recent kernels; the reasons are many but the bug [1] goes
        # through it with links to relevant changes.
        #
        # While we try and sort out either backporting this to upstream
        # kernels or some other upstream workaround, we set
        # spec_store_bypass_disable=prctl here to avoid this problem in
        # our providers.  The other bits are just the dib defaults which
        # need to be replicated when overriding this.
        #
        # [1] https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1973839
        DIB_BOOTLOADER_DEFAULT_CMDLINE: 'nofb nomodeset gfxpayload=text spec_store_bypass_disable=prctl'

- job:
    name: opendev-build-diskimage-ubuntu-noble
    description: |
      Build the OpenDev Ubuntu noble VM image
    parent: opendev-build-diskimage-base-debuntu
    image-build-name: ubuntu-noble
    vars:
      build_diskimage_image_name: ubuntu-noble
      build_diskimage_elements:
        - *base_elements
        - ubuntu-minimal
        - cache-devstack
      build_diskimage_environment:
        DIB_RELEASE: 'noble'
        DIB_DISTRIBUTION_MIRROR: 'https://{{ zuul_site_mirror_fqdn }}/ubuntu'
        DIB_DEBIAN_COMPONENTS: 'main,universe'

- job:
    name: opendev-build-diskimage-ubuntu-noble-arm64
    description: |
      Build the OpenDev Ubuntu Noble arm64 VM image
    parent: opendev-build-diskimage-ubuntu-noble
    nodeset:
      nodes:
        - name: ubuntu-noble-arm64
          label: ubuntu-noble-arm64
    image-build-name: ubuntu-noble-arm64
    vars:
      build_diskimage_environment:
        DIB_DISTRIBUTION_MIRROR: 'https://{{ zuul_site_mirror_fqdn }}/ubuntu-ports'
      build_diskimage_image_name: ubuntu-noble-arm64