Container plugin meeting notes

Minutes
#1

November 23rd

1 Like
#2

November 29

#3

December 6

#4

January 10

#5

January 17

#6

January 24

  • https://github.com/pulp/pulp_container/pull/546#issuecomment-1016795721 ci reaches limit on docker pull

    • tests need changes, pulp-smash needs a setting to account for user/pass
      • [dkliban] this might not be possible for PRs because secrets are not available there for security issues. will investigate.
      • [matthias] will look into tests whether it is possible to download content less frequently
    • [ipanova] look whether it is possible to have a robot account or re-purpose one of our accounts

  • roles RBAC migration

    • translating the auto-generated groups may not be sufficient
    • add-permission needs to be translated to creator role
    • I’d like to have a review on the role layout before continuing writing the migration [tanya]
    • what to do with directly assigned permissions? maybe ask on pulpcore meeting for more insight
#7

January 31

Regrets: ipanova, x9c4.

  • testing registry

    • outcome - use some deprecated repo from RH registry and add basic signature assertions in the tests
    • long term - stand up in CI a small sigstore proxy to variously pass through valid and invalid signatures?
      • no, work with the real registry, and just mock data for bad signatures

  • CI reaches limit on docker pull

    • tests need changes, pulp-smash needs a setting to account for user/pass
      • [dkliban] this might not be possible for PRs because secrets are not available there for security issues. will investigate.
        • Not done yet, moving to the next week
      • [matthias] will look into tests whether it is possible to download content less frequently
    • [ipanova][done] look whether it is possible to have a robot account or re-purpose one of our accounts
      • service account does not seem to be different from regular account except for granting it read-only perms Service accounts | Docker Documentation TLDR; we can re-purpose one of the existing accounts
        • take Tanya’s
    • look into whether we can use GitHub registry so we’re not dependant on dockerhub?
      • AI: lmjachky
2 Likes
#8

secrets can’t be used on PRs,
one solution would be migrating tests to use images from github,
and keep only a few tests with docker that only runs nightly

On pulp_ansible most of our tests run on galaxy, but we have few tests that run on AH:

2 Likes
#9

February 7th

  • think of what to do with directly assigned rbac perms
    • copy-pasta form pulpcore meeting notes:
      • Idea: manage command to report “unmigrated” permissions and let the admin assign the roles via api
      • Create the command in pulp_container codebase
    • Matthias has found a way how to identify directly assigned rbac perms and translate them into roles during the migration
    • PR is ready for review
  • CI reaches limit on docker pull
    • tests need changes, pulp-smash needs a setting to account for user/pass
      • [dkliban] this might not be possible for PRs because secrets are not available there for security issues. will investigate.
      • [Matthias] will look into tests whether it is possible to download content less frequently
      • [Lubos] created PoC to move to Github Package Registry.
  • needs a volunteer to enable docker push in katello https://github.com/pulp/pulp_container/issues/558
  • can we create push repo ahead of push action?
    • need more info from katello
#10

February 14

  • Roles PR is ready for review
  • moved away from Dockerhub on our CI, should we also propagate this change to other branches?
    • 2.5, 2.8, 2.9, 2.10 yes
  • Enable docker push in katello https://github.com/pulp/pulp_container/issues/558 needs help with steps to reproduce
  • merging signing branch into main, a lot of conflicts to solve
  • doing various backports for the 2.5, 2.8, 2.9 and 2.10 branches + release
#11

February 21

  • PRs need review - repo blob mount and manifest list push
  • [matthias] will look whether signature code path needs any adjustments for the roles work
#12

February 28

  • some customers still seem to have issue with manifest_id null during sync - ipanova is looking into this
  • https://github.com/pulp/pulp_container/pull/605 we can remove some unnecessary db reset connection calls
  • enable push with remote user auth - PR is up from Lubos
  • what can we focus on next?
    • we should write some tests for the signing feature
    • sync of signatures is still in question how write tests → ask Tanya to re-fresh what has been decided/proposed
#13

March 7th

  • matthias is working on refactor sync pipeline
  • i’d like to cut 2.11 release. Waiting on remote user and push of manifest list PRs
  • ipanova will work on azure bug |https://bugzilla.redhat.com/show_bug.cgi?id=2026151
#14

March 14th

#15

March 21

  • sync pipeline refactor PR from Matthias is ready for review
  • CI is failing due change in core. Investigation is ongoing - Matthias and Brian are on it
  • ipanoved releaseed 2.11
  • ipanova submitted PR for sig policy docs
  • Lubos submitted PR for signature tests
  • Matthias refactores sometests to use pytest
  • Lubos is investigating CI intermittent failure related to tag
  • we got some bugs reported from a user who upgrated to 2.11
#16

This meeting was consolidated in favor of Pulp/Galaxy integration meeting