Merge pull request #1511 from mike-nguyen/417_bump_version_manifest

COS-2769: bump version to 4.17

c9s-mirror.repo

@@ -0,0 +1,35 @@
+# These are the official c9s repos. They are slower to update, but contain older
+# versions of packages, which is useful when pinning for lack of a "coreos-pool"
+# equivalent. They are unused when no pinning is needed.
+
+[c9s-baseos-mirror]
+name=CentOS Stream 9 - BaseOS
+baseurl=http://mirror.stream.centos.org/9-stream/BaseOS/$basearch/os
+gpgcheck=1
+repo_gpgcheck=0
+enabled=1
+gpgkey=file:///usr/share/distribution-gpg-keys/centos/RPM-GPG-KEY-CentOS-Official
+
+[c9s-appstream-mirror]
+name=CentOS Stream 9 - AppStream
+baseurl=http://mirror.stream.centos.org/9-stream/AppStream/$basearch/os
+gpgcheck=1
+repo_gpgcheck=0
+enabled=1
+gpgkey=file:///usr/share/distribution-gpg-keys/centos/RPM-GPG-KEY-CentOS-Official
+
+[c9s-nfv-mirror]
+name=CentOS Stream 9 - NFV
+baseurl=http://mirror.stream.centos.org/9-stream/NFV/$basearch/os
+gpgcheck=1
+repo_gpgcheck=0
+enabled=1
+gpgkey=file:///usr/share/distribution-gpg-keys/centos/RPM-GPG-KEY-CentOS-Official
+
+[c9s-rt-mirror]
+name=CentOS Stream 9 - RT
+baseurl=http://mirror.stream.centos.org/9-stream/RT/$basearch/os
+gpgcheck=1
+repo_gpgcheck=0
+enabled=1
+gpgkey=file:///usr/share/distribution-gpg-keys/centos/RPM-GPG-KEY-CentOS-Official

ci/prow-entrypoint.sh

@@ -90,7 +90,7 @@ prepare_repos() {
             # Assume C9S/SCOS if the version does not match known values for RHEL
             # Temporary workaround until we have all packages for SCOS
             curl --fail -L "http://base-${ocpver_mut}-rhel94.ocp.svc.cluster.local" -o "src/config/tmp.repo"
-            awk '/rhel-9.4-server-ose-4.16/,/^$/' "src/config/tmp.repo" > "src/config/ocp.repo"
+            awk '/rhel-9.4-server-ose-4.17/,/^$/' "src/config/tmp.repo" > "src/config/ocp.repo"
             cat src/config/ocp.repo
             rm "src/config/tmp.repo"
             ;;
@@ -167,13 +167,18 @@ validate() {
     workdir="$(mktemp -d)"
     echo "Using $workdir as working directory"
 
+    # for `git config --global` below
+    export HOME=${workdir}
+
     # Figure out if we are running from the COSA image or directly from the Prow src image
     if [[ -d /src/github.com/openshift/os ]]; then
         cd "$workdir"
+        git config --global --add safe.directory /src/github.com/openshift/os
         git clone /src/github.com/openshift/os os
     elif [[ -d ./.git ]]; then
         srcdir="${PWD}"
         cd "$workdir"
+        git config --global --add safe.directory "${srcdir}/.git"
         git clone "${srcdir}" os
     else
         echo "Could not found source directory"

docs/faq.md

@@ -132,6 +132,7 @@ RHCOS/OCP version | RHEL version
 4.14 | 9.2 EUS
 4.15 | 9.2 EUS
 4.16 | 9.4 EUS
+4.17 | 9.4 EUS
 
 ## Q: How do I determine what version of an RPM is included in an RHCOS release?
 

extensions-rhel-9.4.yaml

@@ -9,7 +9,7 @@ extensions:
       - x86_64
       - aarch64
     repos:
-      - rhel-9.4-server-ose-4.16
+      - rhel-9.4-server-ose-4.17
     packages:
       - crun-wasm
   # https://github.com/coreos/fedora-coreos-tracker/issues/1504
@@ -69,7 +69,7 @@ extensions:
       - x86_64
       - s390x
     repos:
-      - rhel-9.4-server-ose-4.16
+      - rhel-9.4-server-ose-4.17
     packages:
       - kata-containers
   # https://issues.redhat.com/browse/COS-2402

kola-denylist.yaml

@@ -18,6 +18,10 @@
   osversion:
     - c9s
 
+# we're missing a cri-o rebuild for 4.17, which blocks on buildroot issues
+- pattern: ext.config.version.rhaos-pkgs-match-openshift
+  tracker: https://issues.redhat.com/browse/RHEL-35883
+
 # This test is failing only in prow, so it's skipped by prow
 # but not denylisted here so it can run on the rhcos pipeline
 #- pattern: iso-offline-install-iscsi.ibft.bios

manifest-c9s.yaml

@@ -13,6 +13,7 @@ variables:
 include:
   - common.yaml
   - packages-openshift.yaml
+  - overrides-c9s.yaml
 
 # Starting from here, everything should be specific to SCOS
 
@@ -27,14 +28,14 @@ repos:
   # CentOS Cloud SIG repo for cri-o, cri-tools and conmon-rs
   - c9s-sig-cloud-okd
   # Include RHCOS 9 repo for oc, hyperkube
-  - rhel-9.4-server-ose-4.16
+  - rhel-9.4-server-ose-4.17
 
 # We include hours/minutes to avoid version number reuse
-automatic-version-prefix: "416.9.<date:%Y%m%d%H%M>"
+automatic-version-prefix: "417.9.<date:%Y%m%d%H%M>"
 # This ensures we're semver-compatible which OpenShift wants
 automatic-version-suffix: "-"
 # Keep this is sync with the version in postprocess
-mutate-os-release: "4.16"
+mutate-os-release: "4.17"
 
 postprocess:
   - |

manifest-rhel-9.4.yaml

@@ -21,14 +21,14 @@ repos:
   - rhel-9.4-appstream
   - rhel-9.4-fast-datapath
   # Include RHCOS 9 repo for oc, kubelet
-  - rhel-9.4-server-ose-4.16
+  - rhel-9.4-server-ose-4.17
 
 # We include hours/minutes to avoid version number reuse
-automatic-version-prefix: "416.94.<date:%Y%m%d%H%M>"
+automatic-version-prefix: "417.94.<date:%Y%m%d%H%M>"
 # This ensures we're semver-compatible which OpenShift wants
 automatic-version-suffix: "-"
 # Keep this is sync with the version in postprocess
-mutate-os-release: "4.16"
+mutate-os-release: "4.17"
 
 postprocess:
   - |
@@ -101,7 +101,7 @@ repo-packages:
   - repo: rhel-9.4-appstream
     packages:
       - nss-altfiles
-  - repo: rhel-9.4-server-ose-4.16
+  - repo: rhel-9.4-server-ose-4.17
     packages:
       - conmon-rs
       - cri-o

overrides-c9s.yaml

@@ -0,0 +1,12 @@
+# This is a poor man's version of an override lockfile for c9s. When needed, we
+# can enable the mirror repos here (which hold older RPMs) and list the NEVRs
+# we need in the `packages` section. When not needed. Empty or comment out this
+# file (except this comment).
+
+repos:
+  - c9s-baseos-mirror
+  - c9s-appstream-mirror
+
+packages:
+  # https://github.com/openshift/os/issues/1514
+  - selinux-policy-38.1.36-1.el9

packages-openshift.yaml

@@ -91,7 +91,7 @@ postprocess:
     #!/usr/bin/env bash
     set -xeuo pipefail
     cat >> /usr/lib/os-release <<EOF
-    OPENSHIFT_VERSION="4.16"
+    OPENSHIFT_VERSION="4.17"
     EOF
 
   - |