feat: --bake-images — pre-pulled multi-arch release-image store - #17
Merged
raghavendra-talur merged 4 commits intoAug 25, 2026
Merged
Conversation
Add the plumbing for opt-in image baking (--bake-images): the CLI flag, ClusterConfig.BakeImages, the ImageBaker interface + BakeSpec, store path helpers, the bake-image-store stage slot in the manager, ignition hooks (MachineConfig manifest + live-ISO merge), the ExtraDisk VM-spec support with libvirt ImportDisk, and fakes + app-level tests. The concrete baker and stage land in the follow-up commit. Also ignore the local .gstack/ tool-state directory. Signed-off-by: Raghavendra Talur <raghavendra.talur@gmail.com> Assisted-by: Claude Code/claude-fable-5
The wiring for --bake-images already landed (interfaces, deps, stages, config, CLI flag), but the concrete pieces it references were untracked. Add them so the tree builds on its own: - providers/openshift/baker.go: OpenShiftImageBaker. Enumerates the union of every supported release arch's pullspecs (amd64 + aarch64) so a baked store is multi-arch-correct, skopeo copy --all into a rootless overlay store, then virt-make-fs packs it into a labeled ext4 qcow2. Pure renderers for the storage.conf drop-in, mount unit, and master MachineConfig, plus live-ISO ignition merge. - stages/bakeimagestore: the bake-image-store stage. No-op unless the cluster opts in; preflights pull secret + skopeo/virt-make-fs on PATH. - docs/dev/image-baking.md: design + operator notes. Baking stays opt-in (--bake-images, default off). Assisted-by: Claude Code/claude-opus-4-8 Signed-off-by: Raghavendra Talur <raghavendra.talur@gmail.com>
The bake feature deferred its macOS half to the on-hardware phase. Wire it up end to end: - publish-pxe-assets merges the baked-store mount + CRI-O drop-in into the HTTP-served bootstrap ignition — the macOS equivalent of embed-ignition-iso's live-ISO merge on Linux. - The baker packs with mke2fs -d on darwin (no libguestfs on macOS; Homebrew e2fsprogs, keg paths probed) into a raw image — vfkit's virtio-blk takes raw, not qcow2 — sized from the overlay contents. ImageStoreDiskPath/ImageStoreVolName pick the extension per OS. - vfkit ImportDisk clones the cached store per cluster (APFS clonefile, plain-copy fallback) into the state dir; ExtraDisks attach after the primary disk in both boot phases; Delete removes the clone. vfkit has no read-only virtio-blk, so the per-cluster copy is the isolation. - bake-image-store preflight requires skopeo + mke2fs on darwin with a brew hint (skopeo + virt-make-fs unchanged on Linux). Validated on hardware: mke2fs -d pack produces a clean labeled ext4 image; the full darwin pipeline runs under --simulate. A real baked install needs ~40+ GB free disk — tracked in ROADMAP.md. Assisted-by: Claude Code/claude-fable-5 Signed-off-by: Raghavendra Talur <raghavendra.talur@gmail.com>
Assisted-by: Claude Code/claude-fable-5 Signed-off-by: Raghavendra Talur <raghavendra.talur@gmail.com>
raghavendra-talur
force-pushed
the
rtalur-bake-images-macos
branch
from
August 25, 2026 05:46
48705b4 to
dae6134
Compare
raghavendra-talur
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Opt-in
--bake-images: pre-pull the entire OCP release payload into a read-only, multi-arch (amd64 + aarch64) disk attached to the master, so the install never reaches quay.io for platform images. Built once per OCP version, shared across clusters.oc adm release infoenumerates every supported arch's pullspecs (union),skopeo copy --allinto a rootless overlay store, packed into a labeled ext4 image —virt-make-fs→ qcow2 on Linux (libvirt pool),mke2fs -d→ raw on macOS (vfkit's virtio-blk takes raw; no libguestfs on macOS, Homebrew e2fsprogs keg paths probed)./var/lib/baked-imagesand registered as a CRI-O additional image store — post-pivot via a master MachineConfig rendered into the node ignition, bootstrap via a merge into the live ignition (live-ISO on Linux, HTTP-servedconfig.ignon macOS).Docs:
docs/dev/image-baking.md. Remaining: a real-cluster validation that CRI-O serves from the store (needs ~40+ GB free disk; tracked inROADMAP.md).Test plan
make check— green (renderers, baker command construction, vfkit ImportDisk/ExtraDisks, stage preflights, app-level bake pipeline against fakes).--simulate; realmke2fs -dpack verified against e2fsprogs (clean labeled ext4 with the store contents).🤖 Generated with Claude Code