Use rocky 9.4 release train snapshots for builds

.github/workflows/fatimage.yml

@@ -39,6 +39,7 @@ jobs:
             "openstack.openhpc": "rocky-latest-RL9"
           }
         }
+      ARK_PASSWORD: ${{ secrets.ARK_PASSWORD }}
 
     steps:
       - uses: actions/checkout@v2

.github/workflows/nightlybuild.yml

@@ -37,6 +37,7 @@ jobs:
           "RL8": "Rocky-8-GenericCloud-Base-8.9-20231119.0.x86_64.qcow2",
           "RL9": "Rocky-9-GenericCloud-Base-9.4-20240523.0.x86_64.qcow2"
         }
+      ARK_PASSWORD: ${{ secrets.ARK_PASSWORD }}
 
     steps:
       - uses: actions/checkout@v2

ansible/.gitignore

@@ -64,3 +64,5 @@ roles/*
 !roles/k9s/**
 !roles/lustre/
 !roles/lustre/**
+!roles/release_train/
+!roles/release_train/**

ansible/roles/release_train/defaults/main.yml

@@ -0,0 +1,8 @@
+release_train_url_prefix: https://ark.stackhpc.com/pulp/content/rocky/9.4
+release_train_url_suffix: "x86_64/os/{{ release_train_timestamp }}/"
+# most stable from https://github.com/stackhpc/stackhpc-kayobe-config/blob/stackhpc/2024.1/etc/kayobe/pulp-repo-versions.yml
+# note that some timestamps can't be used because not all repos have snapshots for them
+release_train_timestamp: 20240816T002610
+release_train_auth: |
+  username = slurm-app-ci
+  password = {{ lookup('ansible.builtin.env', 'ARK_PASSWORD') }}

ansible/roles/release_train/tasks/revert_repos.yml

@@ -0,0 +1,19 @@
+---
+
+- name: Check for backup folder exists
+  stat:
+    path: /etc/yum.repos.d.backup
+  register: _stat_yum_backup_file
+
+- name: Fail if backup folder doesn't exist
+  assert:
+    that: _stat_yum_backup_file.stat.exists
+
+- name: Remove ark repos
+  ansible.builtin.file:
+    state: absent
+    path: /etc/yum.repos.d
+
+- name: Restore backup repos
+  ansible.builtin.shell:
+    cmd: mv /etc/yum.repos.d.backup /etc/yum.repos.d

ansible/roles/release_train/tasks/set_repos.yml

@@ -0,0 +1,22 @@
+---
+
+- name: Check for existing backup folder
+  stat:
+    path: /etc/yum.repos.d.backup
+  register: _stat_yum_backup_file
+
+- name: Backup existing package repos
+  ansible.builtin.copy:
+    remote_src: true
+    src: /etc/yum.repos.d/
+    dest: /etc/yum.repos.d.backup
+  when: not _stat_yum_backup_file.stat.exists
+
+- name: Replace package repos with release train repos
+  no_log: true
+  ansible.builtin.template:
+    src: "{{ item }}.j2"
+    dest: /etc/yum.repos.d/{{ item }}
+  loop:
+  - rocky-extras.repo
+  - rocky.repo

ansible/roles/release_train/templates/rocky-extras.repo.j2

@@ -0,0 +1,65 @@
+# rocky-extras.repo
+#
+# The mirrorlist system uses the connecting IP address of the client and the
+# update status of each mirror to pick current mirrors that are geographically
+# close to the client.  You should use this for Rocky updates unless you are
+# manually picking other mirrors.
+#
+# If the mirrorlist does not work for you, you can try the commented out
+# baseurl line instead.
+
+[extras]
+name=Rocky Linux $releasever - Extras
+baseurl={{ release_train_url_prefix }}/extras/{{ release_train_url_suffix }}
+gpgcheck=1
+enabled=1
+countme=1
+metadata_expire=6h
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-9
+{{ release_train_auth }}
+
+[extras-debuginfo]
+name=Rocky Linux $releasever - Extras Debug
+mirrorlist=https://mirrors.rockylinux.org/mirrorlist?arch=$basearch&repo=extras-$releasever-debug$rltype
+#baseurl=http://dl.rockylinux.org/$contentdir/$releasever/extras/$basearch/debug/tree/
+gpgcheck=1
+enabled=0
+metadata_expire=6h
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-9
+
+[extras-source]
+name=Rocky Linux $releasever - Extras Source
+mirrorlist=https://mirrors.rockylinux.org/mirrorlist?arch=$basearch&repo=extras-$releasever-source$rltype
+#baseurl=http://dl.rockylinux.org/$contentdir/$releasever/extras/source/tree/
+gpgcheck=1
+enabled=0
+metadata_expire=6h
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-9
+
+[plus]
+name=Rocky Linux $releasever - Plus
+mirrorlist=https://mirrors.rockylinux.org/mirrorlist?arch=$basearch&repo=plus-$releasever$rltype
+#baseurl=http://dl.rockylinux.org/$contentdir/$releasever/plus/$basearch/os/
+gpgcheck=1
+enabled=0
+countme=1
+metadata_expire=6h
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-9
+
+[plus-debuginfo]
+name=Rocky Linux $releasever - Plus - Debug
+mirrorlist=https://mirrors.rockylinux.org/mirrorlist?arch=$basearch&repo=plus-$releasever-debug$rltype
+#baseurl=http://dl.rockylinux.org/$contentdir/$releasever/plus/$basearch/debug/tree/
+gpgcheck=1
+enabled=0
+metadata_expire=6h
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-9
+
+[plus-source]
+name=Rocky Linux $releasever - Plus - Source
+mirrorlist=https://mirrors.rockylinux.org/mirrorlist?arch=source&repo=plus-$releasever-source$rltype
+#baseurl=http://dl.rockylinux.org/$contentdir/$releasever/plus/source/tree/
+gpgcheck=1
+enabled=0
+metadata_expire=6h
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-9

ansible/roles/release_train/templates/rocky.repo.j2

@@ -0,0 +1,93 @@
+# rocky.repo
+#
+# The mirrorlist system uses the connecting IP address of the client and the
+# update status of each mirror to pick current mirrors that are geographically
+# close to the client.  You should use this for Rocky updates unless you are
+# manually picking other mirrors.
+#
+# If the mirrorlist does not work for you, you can try the commented out
+# baseurl line instead.
+
+[baseos]
+name=Rocky Linux $releasever - BaseOS
+baseurl={{ release_train_url_prefix }}/BaseOS/{{ release_train_url_suffix }}
+gpgcheck=1
+enabled=1
+countme=1
+metadata_expire=6h
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-9
+{{ release_train_auth }}
+
+[baseos-debuginfo]
+name=Rocky Linux $releasever - BaseOS - Debug
+mirrorlist=https://mirrors.rockylinux.org/mirrorlist?arch=$basearch&repo=BaseOS-$releasever-debug$rltype
+#baseurl=http://dl.rockylinux.org/$contentdir/$releasever/BaseOS/$basearch/debug/tree/
+gpgcheck=1
+enabled=0
+metadata_expire=6h
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-9
+
+[baseos-source]
+name=Rocky Linux $releasever - BaseOS - Source
+mirrorlist=https://mirrors.rockylinux.org/mirrorlist?arch=source&repo=BaseOS-$releasever-source$rltype
+#baseurl=http://dl.rockylinux.org/$contentdir/$releasever/BaseOS/source/tree/
+gpgcheck=1
+enabled=0
+metadata_expire=6h
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-9
+
+[appstream]
+name=Rocky Linux $releasever - AppStream
+baseurl={{ release_train_url_prefix }}/AppStream/{{ release_train_url_suffix }}
+gpgcheck=1
+enabled=1
+countme=1
+metadata_expire=6h
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-9
+{{ release_train_auth }}
+
+[appstream-debuginfo]
+name=Rocky Linux $releasever - AppStream - Debug
+mirrorlist=https://mirrors.rockylinux.org/mirrorlist?arch=$basearch&repo=AppStream-$releasever-debug$rltype
+#baseurl=http://dl.rockylinux.org/$contentdir/$releasever/AppStream/$basearch/debug/tree/
+gpgcheck=1
+enabled=0
+metadata_expire=6h
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-9
+
+[appstream-source]
+name=Rocky Linux $releasever - AppStream - Source
+mirrorlist=https://mirrors.rockylinux.org/mirrorlist?arch=source&repo=AppStream-$releasever-source$rltype
+#baseurl=http://dl.rockylinux.org/$contentdir/$releasever/AppStream/source/tree/
+gpgcheck=1
+enabled=0
+metadata_expire=6h
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-9
+
+[crb]
+name=Rocky Linux $releasever - CRB
+baseurl={{ release_train_url_prefix }}/CRB/{{ release_train_url_suffix }}
+gpgcheck=1
+enabled=0
+countme=1
+metadata_expire=6h
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-9
+{{ release_train_auth }}
+
+[crb-debuginfo]
+name=Rocky Linux $releasever - CRB - Debug
+mirrorlist=https://mirrors.rockylinux.org/mirrorlist?arch=$basearch&repo=CRB-$releasever-debug$rltype
+#baseurl=http://dl.rockylinux.org/$contentdir/$releasever/CRB/$basearch/debug/tree/
+gpgcheck=1
+enabled=0
+metadata_expire=6h
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-9
+
+[crb-source]
+name=Rocky Linux $releasever - CRB - Source
+mirrorlist=https://mirrors.rockylinux.org/mirrorlist?arch=source&repo=CRB-$releasever-source$rltype
+#baseurl=http://dl.rockylinux.org/$contentdir/$releasever/CRB/source/tree/
+gpgcheck=1
+enabled=0
+metadata_expire=6h
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-9

environments/.stackhpc/hooks/post.yml

@@ -11,4 +11,13 @@
       with_items:
         - "/opt/ood/ondemand/root/usr/share/gems/3.1/ondemand/{{ ondemand_package_version }}-1/gems/bootstrap_form-2.7.0/test/dummy/Gemfile.lock"
         - "/opt/ood/ondemand/root/usr/share/gems/3.1/ondemand/{{ ondemand_package_version }}-1/gems/bootstrap_form-4.5.0/demo/yarn.lock"
-        - /var/www/ood/apps/sys/dashboard/node_modules/data-confirm-modal/Gemfile.lock
+        - /var/www/ood/apps/sys/dashboard/node_modules/data-confirm-modal/Gemfile.lock
+
+- hosts: builder
+  become: yes
+  tasks:
+    - name: Revert ark repos
+      ansible.builtin.include_role:
+        name: release_train
+        tasks_from: revert_repos.yml
+      when: ansible_distribution_major_version == "9" #TODO update role once RL8 config decided

environments/.stackhpc/hooks/pre.yml

@@ -17,3 +17,12 @@
         - "{{ lookup('env', 'APPLIANCES_ENVIRONMENT_ROOT') }}/inventory/hosts.yml"
         - "{{ lookup('env', 'APPLIANCES_ENVIRONMENT_ROOT') }}/inventory/group_vars/all/secrets.yml"
         - "{{ lookup('env', 'APPLIANCES_ENVIRONMENT_ROOT') }}/inventory/group_vars/all/test_user.yml"
+
+- hosts: builder
+  become: yes
+  tasks:
+    - name: Replace system repos with ark
+      ansible.builtin.include_role:
+        name: release_train
+        tasks_from: set_repos.yml
+      when: ansible_distribution_major_version == "9" #TODO update role once RL8 config decided