manifest.yaml

rojig:
  license: MIT
  name: rhcos
  summary: OpenShift 4

# We inherit from Fedora CoreOS' base configuration
include:
  - fedora-coreos-config/manifests/ignition-and-ostree.yaml
  - fedora-coreos-config/manifests/file-transfer.yaml
  - fedora-coreos-config/manifests/networking-tools.yaml
  - fedora-coreos-config/manifests/system-configuration.yaml
  - fedora-coreos-config/manifests/user-experience.yaml
  - fedora-coreos-config/manifests/shared-workarounds.yaml
  # RHCOS owned packages
  - rhcos-packages.yaml

ostree-layers:
  - overlay/01fcos
  - overlay/02fcos-nouveau
  - overlay/05rhcos
  - overlay/06gcp-routes
  - overlay/15rhcos-logrotate
  - overlay/15rhcos-tuned-bits
  - overlay/20platform-chrony
  - overlay/21dhcp-chrony
  - overlay/25rhcos-azure-udev

arch-include:
  x86_64:
    - fedora-coreos-config/manifests/grub2-removals.yaml
    - fedora-coreos-config/manifests/bootupd.yaml
  ppc64le: fedora-coreos-config/manifests/grub2-removals.yaml
  aarch64:
    - fedora-coreos-config/manifests/grub2-removals.yaml
    - fedora-coreos-config/manifests/bootupd.yaml

# See README.md
# and https://github.com/openshift/release/blob/master/core-services/release-controller/README.md#rpm-mirrors
repos:
  - rhel-8-baseos
  - rhel-8-appstream
  - rhel-8-fast-datapath
  - rhel-8-server-ose

# https://bugzilla.redhat.com/show_bug.cgi?id=1938928
rpmdb: bdb

# We include hours/minutes to avoid version number reuse
automatic-version-prefix: "411.86.<date:%Y%m%d%H%M>"
# This ensures we're semver-compatible which OpenShift wants
automatic-version-suffix: "-"
# Keep this is sync with the version in postprocess
mutate-os-release: "4.11"

documentation: false
initramfs-args:
  - "--no-hostonly"
  - "--omit-drivers"
  - "nouveau"
  - "--omit"
  # we don't need root-on-NFS
  # see upstream: https://github.com/coreos/fedora-coreos-config/pull/60
  - "nfs"
  - "--add"
  - "iscsi"
  - "ignition"
  - "--add"
  - "ifcfg"
  - "--add"
  - "fips"
  # The current default in RHEL8 is network-legacy
 ## XXX: This does not work for now: https://github.com/dracutdevs/dracut/issues/798
 ## XXX: Temporarily use overlay.d/05rhcos/usr/lib/dracut/modules.d/29rhcos-need-network-manager/module-setup.sh
 #- "--add"
 #- "network-manager"
  - "--omit"
  - "network-legacy"

postprocess:
  - |
     #!/usr/bin/env bash
     set -xeo pipefail

     # Disable PasswordAuthentication in SSH
     sed -i "s|^PasswordAuthentication yes$|PasswordAuthentication no|g" /etc/ssh/sshd_config
     # Disable root login because don't do that.
     sed -i "s|^PermitRootLogin yes$|PermitRootLogin no|g" /etc/ssh/sshd_config
     # Enable ClientAliveInterval and set to 180 per https://bugzilla.redhat.com/show_bug.cgi?id=1701050
     sed -i "s|^#ClientAliveInterval 0$|ClientAliveInterval 180|g" /etc/ssh/sshd_config

     # TEMPORARY: Create /etc/vmware-tools/tools.conf to ensure RHCOS shows up properly in VMWare
     # See https://jira.coreos.com/browse/RHCOS-258
     if [ "$(uname -m)" == "x86_64" ]; then
     cat > /etc/vmware-tools/tools.conf <<'EOF'
     [guestosinfo]
     short-name = rhel8-64
     EOF
     fi

     # TEMPORARY: Fix file permission for cpictl until fix is backported to RHEL 8.6
     # See https://bugzilla.redhat.com/show_bug.cgi?id=2024102
     if [ "$(uname -m)" == "s390x" ]; then
     [ "$(stat -c '%a' /usr/lib/s390-tools/cpictl)" == "755" ] && echo "Permission for /usr/lib/s390-tools/cpictl is fixed, remove temporary hack"
     chmod 755 /usr/lib/s390-tools/cpictl
     fi

     # Nuke network.service from orbit
     # https://github.com/openshift/os/issues/117
     rm -rf /etc/rc.d/init.d/network /etc/rc.d/rc*.d/*network

     # We're not using resolved yet
     rm -f /usr/lib/systemd/system/systemd-resolved.service

     # Enable tmp-on-tmpfs by default because we don't want to have things
     # leak across reboots, it increases alignment with FCOS, and also fixes
     # the Live ISO.  First, verify that RHEL is still disabling.
     grep -q '# RHEL-only: Disable /tmp on tmpfs' /usr/lib/systemd/system/basic.target
     echo '# RHCOS-only: we follow the Fedora/upstream default' >> /usr/lib/systemd/system/basic.target
     echo 'Wants=tmp.mount' >> /usr/lib/systemd/system/basic.target
  - |
     #!/usr/bin/env bash
     set -xeo pipefail

     # Ensure that /etc/issue.d exists for console-login-helper-messages
     # This can be removed once we rebase to RHEL 9
     install -d -m 0755 /etc/issue.d
  - |
     #!/usr/bin/env bash
     set -xeo pipefail

     # Tweak /usr/lib/os-release
     grep -v "OSTREE_VERSION" /etc/os-release > /usr/lib/os-release.rhel
     OCP_RELEASE="4.11"
     (
     . /etc/os-release
     cat > /usr/lib/os-release <<EOF
     NAME="${NAME} CoreOS"
     ID="rhcos"
     ID_LIKE="rhel fedora"
     VERSION="${OSTREE_VERSION}"
     VERSION_ID="${OCP_RELEASE}"
     PLATFORM_ID="${PLATFORM_ID}"
     PRETTY_NAME="${NAME} CoreOS ${OSTREE_VERSION} (Ootpa)"
     ANSI_COLOR="${ANSI_COLOR}"
     CPE_NAME="cpe:/o:redhat:enterprise_linux:8::coreos"
     HOME_URL="${HOME_URL}"
     DOCUMENTATION_URL="https://docs.openshift.com/container-platform/${OCP_RELEASE}/"
     BUG_REPORT_URL="https://bugzilla.redhat.com/"
     REDHAT_BUGZILLA_PRODUCT="OpenShift Container Platform"
     REDHAT_BUGZILLA_PRODUCT_VERSION="${OCP_RELEASE}"
     REDHAT_SUPPORT_PRODUCT="OpenShift Container Platform"
     REDHAT_SUPPORT_PRODUCT_VERSION="${OCP_RELEASE}"
     OPENSHIFT_VERSION="${OCP_RELEASE}"
     RHEL_VERSION="${VERSION_ID}"
     OSTREE_VERSION="${OSTREE_VERSION}"
     EOF
     )
     rm -f /etc/os-release
     ln -s ../usr/lib/os-release /etc/os-release

     # Tweak /etc/system-release, /etc/system-release-cpe & /etc/redhat-release
     (
     . /etc/os-release
     cat > /usr/lib/system-release-cpe <<EOF
     ${CPE_NAME}
     EOF
     cat > /usr/lib/system-release <<EOF
     ${NAME} release ${VERSION_ID}
     EOF
     rm -f /etc/system-release-cpe /etc/system-release /etc/redhat-release
     ln -s /usr/lib/system-release-cpe /etc/system-release-cpe
     ln -s /usr/lib/system-release /etc/system-release
     ln -s /usr/lib/system-release /etc/redhat-release
     )

     # Tweak /usr/lib/issue
     cat > /usr/lib/issue <<EOF
     \S \S{VERSION_ID}
     EOF
     rm -f /etc/issue /etc/issue.net
     ln -s /usr/lib/issue /etc/issue
     ln -s /usr/lib/issue /etc/issue.net

     # Let's have a non-boring motd, just like CL (although theirs is more subdued
     # nowadays compared to early versions with ASCII art).  One thing we do here
     # is add --- as a "separator"; the idea is that any "dynamic" information should
     # be below that.
     # See: https://projects.engineering.redhat.com/browse/COREOS-1029
     . /etc/os-release
     cat > /etc/motd <<EOF
     Red Hat Enterprise Linux CoreOS $VERSION
       Part of OpenShift ${OPENSHIFT_VERSION}, RHCOS is a Kubernetes native operating system
       managed by the Machine Config Operator (\`clusteroperator/machine-config\`).

     WARNING: Direct SSH access to machines is not recommended; instead,
     make configuration changes via \`machineconfig\` objects:
       https://docs.openshift.com/container-platform/${OPENSHIFT_VERSION}/architecture/architecture-rhcos.html

     ---
     EOF
  - |
    #!/usr/bin/env bash
    set -xeuo pipefail
    # manually modify SELinux booleans that are needed for OCP use cases
    semanage boolean --modify --on container_use_cephfs      # RHBZ#1694045
    semanage boolean --modify --on virt_use_samba            # RHBZ#1754825

  # https://gitlab.cee.redhat.com/coreos/redhat-coreos/merge_requests/812
  # https://bugzilla.redhat.com/show_bug.cgi?id=1796537
  - |
    #!/usr/bin/bash
    mkdir -p /usr/share/containers/oci/hooks.d

  # This is part of e.g. fedora-repos in Fedora; we now want to include it by default
  # so that the MCO can use it by default and not trip over SELinux issues trying
  # to create it.
  - |
    #!/usr/bin/bash
    mkdir -p /etc/yum.repos.d

  # This updates the PAM configuration to reference all of the SSSD modules.
  # Removes the `authselect` binary afterwards since `authselect` does not play well with `nss-altfiles`
  # (https://github.com/pbrezina/authselect/issues/48).
  # https://bugzilla.redhat.com/show_bug.cgi?id=1774154
  # NOTE: This is a temporary hack which should be updated after switching to systemd-sysusers
  - |
    #!/usr/bin/env bash
    set -xeuo pipefail
    # use `authselect test` since `authselect select` wants to copy to `/var` too
    authselect test sssd --nsswitch | tail -n +2 > /etc/nsswitch.conf
    for pam_file in system-auth password-auth smartcard-auth fingerprint-auth postlogin; do
      authselect test sssd --${pam_file} | tail -n +2 > /etc/pam.d/${pam_file}
    done
    rm -f $(which authselect)

  # Stop shipping a baked initiator name in the image; this should be generated
  # at runtime. We have a service which does this
  # (coreos-generate-iscsi-initiatorname.service) until it's done properly
  # upstream (see https://bugzilla.redhat.com/show_bug.cgi?id=1493296).
  - |
     #!/usr/bin/env bash
     set -xeuo pipefail

     # NB: we don't use -f here so we break when this is no longer needed
     rm -v /etc/iscsi/initiatorname.iscsi

etc-group-members:
  - wheel
  - sudo
  - systemd-journal
  - adm
ignore-removed-users:
  - root
ignore-removed-groups:
  - root
check-passwd:
  type: "file"
  filename: "passwd"
check-groups:
  type: "file"
  filename: "group"

exclude-packages:
  # https://bugzilla.redhat.com/show_bug.cgi?id=1798278
  - subscription-manager
  # And this one shouldn't come in
  - dnf
  # https://github.com/coreos/rpm-ostree/pull/1789/files/a0cd999a8acd5b40ec1024a794a642916fbc8ff8#diff-fc2076dc46933204a7a798f544ce3734
  # People need to use `rpm-ostree kargs` instead.
  - grubby
  # udisks2 is a fwupd recommends only need for encrypted swap checks
  - udisks2
  # dhcp-client is recommended by chrony for handling NTP servers given out via
  # DHCP, but we have a NM dispatcher script that is doing that
  # See: https://bugzilla.redhat.com/show_bug.cgi?id=1930468
  # See: https://bugzilla.redhat.com/show_bug.cgi?id=1800901
  - dhcp-client

# Try to maintain this list ordering by "in RHEL, then not in RHEL".
# To verify, disable all repos except the ootpa ones and then comment
# out the bottom and run `coreos-assembler build`.
# A lof of packages are inherited by the manifests included at the top.
packages:
 # We include the generic release package and tweak the os-release info in a
 # post-proces script
 - redhat-release
 # Contains SCTP (https://bugzilla.redhat.com/show_bug.cgi?id=1718049)
 # and it's not really going to be worth playing the "where's my kernel module"
 # game long term.  If we ship it we support it, etc.
 - kernel-modules-extra
 # Audit
 - audit
 # Containers
 - containernetworking-plugins
 # Pinned due to cosa on Fedora not honoring RHEL 8 modules as expected
 - container-selinux
 - cri-o cri-tools
 # Networking
 - nfs-utils
 - openvswitch2.17
 - dnsmasq
 - NetworkManager-ovs
 # Extra runtime
 - sssd
 # Common tools used by scripts and admins interactively
 - rsync tmux
 - nmap-ncat strace
 # Editors
 - nano
 # Red Hat CA certs
 - subscription-manager-rhsm-certificates
 # Used on the bootstrap node
 - systemd-journal-remote
 # Extras
 - systemd-journal-gateway
 # RHEL7 compatibility
 - compat-openssl10
 # Make sure we pull in at least clevis 15; it drops the rd.neednet=1 hardcode
 # and has a few other patches we need.
 # https://bugzilla.redhat.com/show_bug.cgi?id=1853651
 - "'clevis >= 15-1.el8' 'clevis-luks >= 15-1.el8' 'clevis-dracut >= 15-1.el8'"
 - cryptsetup-reencrypt tpm2-tools
 # Used to update PAM configuration to work with SSSD
 # https://bugzilla.redhat.com/show_bug.cgi?id=1774154
 - authselect
 # https://bugzilla.redhat.com/show_bug.cgi?id=1900759
 - qemu-guest-agent
 # BELOW HERE ARE PACKAGES NOT IN RHEL
 # OpenShift OKD
 #- origin-node origin-hyperkube origin-clients
 # OpenShift
 - openshift-hyperkube openshift-clients
 # Gluster - Used for Openshift e2e gluster testcases
 # Reverts https://gitlab.cee.redhat.com/coreos/redhat-coreos/merge_requests/367 and add it for all arches
 - glusterfs-fuse
 # Needed for kernel-devel extension: https://bugzilla.redhat.com/show_bug.cgi?id=1885408
 # x86_64 and s390x have these packages installed as dependencies of other packages, ppc64le does not
 # FIXME: once the below BZs have been resolved to remove perl dependencies, this can be done in the extensions script
 # https://bugzilla.redhat.com/show_bug.cgi?id=1877905
 # https://bugzilla.redhat.com/show_bug.cgi?id=1886201
 - perl-interpreter
 # https://github.com/coreos/fedora-coreos-tracker/issues/404
 # https://bugzilla.redhat.com/show_bug.cgi?id=1925698
 # https://github.com/openshift/machine-config-operator/pull/2421
 - conntrack-tools

repo-packages:
  # we always want the kernel from BaseOS
  - repo: rhel-8-baseos
    packages:
      - kernel
  # we want the one shipping in RHEL, not the equivalently versioned one in RHAOS
  - repo: rhel-8-appstream
    packages:
      - nss-altfiles
  - repo: rhel-8-server-ose
    packages:
      # Starting with 4.11, we are working with the Containers team to build
      # certain container-tools RPMs in the RHAOS branches for RHCOS + RHEL
      # worker nodes.
      - conmon
      - container-selinux
      - containernetworking-plugins
      - containers-common
      - criu
      - crun
      - fuse-overlayfs
      - podman
      - runc
      - skopeo
      - slirp4netns
      - toolbox

modules:
  enable:
    # qemu-guest-agent
    - virt:rhel

packages-x86_64:
  # Temporary add of open-vm-tools. Should be removed when containerized
  - open-vm-tools
  - irqbalance
  # Until we sort out 4.2 -> 4.3 upgrades, we need to carry this.
  # See also https://github.com/ostreedev/ostree/pull/1929
  - ostree-grub2
  # rdma-core cleanly covers some key bare metal use cases
  - rdma-core


packages-ppc64le:
  - irqbalance
  - librtas
  - powerpc-utils-core
  - ppc64-diag-rtas
  - rdma-core


remove-from-packages:
  - - filesystem
    - "/usr/share/backgrounds"
  # https://bugzilla.redhat.com/show_bug.cgi?id=1762509
  # https://bugzilla.redhat.com/show_bug.cgi?id=1727058
  - - initscripts
    - "/"
  # Remove the systemd unit; we only want the binary to be used
  # by MCD or kubelet.  See above.
  - - conntrack-tools
    - /usr/lib/systemd/system