Skip to content

USHIFT-7408: Use rich dep for kernel-modules-extra to support kernel-rt - #7116

Open
agullon wants to merge 2 commits into
openshift:mainfrom
agullon:USHIFT-7408-rich-dep
Open

USHIFT-7408: Use rich dep for kernel-modules-extra to support kernel-rt#7116
agullon wants to merge 2 commits into
openshift:mainfrom
agullon:USHIFT-7408-rich-dep

Conversation

@agullon

@agullon agullon commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Change Requires: kernel-modules-extra to Requires: (kernel-modules-extra or kernel-rt-modules-extra) so that the dependency resolver picks whichever variant matches the installed kernel
  • Re-enable the rhel98-source-tuned ostree blueprint that was disabled due to the missing kernel-rt package
  • Re-enable the el98-src@low-latency presubmit scenario that was disabled due to the missing kernel-rt package

Problem

The plain Requires: kernel-modules-extra pulls in kernel-core (regular kernel) even when kernel-rt is the intended kernel. This causes rpm-ostree compose postprocess to fail with Multiple vmlinuz- because both vmlinuz-*+rt and vmlinuz-* are present in the boot directory.

Fix

RPM rich dependencies (or) let the solver pick kernel-modules-extra when the regular kernel is installed, or kernel-rt-modules-extra when kernel-rt is installed. Neither pulls in the wrong kernel.

OS Kernel RPM picks Effect
RHEL 9 + regular kernel-core kernel-modules-extra No-op (iptables modules already in kernel-modules-core)
RHEL 9 + kernel-rt kernel-rt-core kernel-rt-modules-extra No-op
RHEL 10 + regular kernel-core kernel-modules-extra Gets iptables modules for OVN-K
RHEL 10 + kernel-rt kernel-rt-core kernel-rt-modules-extra Gets iptables modules for OVN-K

Test plan

  • e2e-aws-tests passes (tuned ostree image builds with kernel-rt without dual-kernel failure)
  • e2e-aws-tests-arm passes (no kernel-rt on ARM, regular path works)
  • Low-latency presubmit scenario runs successfully

🤖 Generated with Claude Code

Summary by CodeRabbit

  • New Features

    • Added an image blueprint for a RHEL 9.8 MicroShift “source-tuned” image (rhel-9.8-microshift-source-tuned).
    • Pre-configures required RPMs, MicroShift services, firewall settings, and MicroShift/tuned configuration files.
    • Enables real-time kernel customization only on x86_64.
    • Added a new low-latency EL98 presubmit scenario to create/remove a tuned-boot VM and run ordered Robot test suites after multiple boots.
  • Bug Fixes

    • Improved kernel-extra RPM dependency handling by conditionally selecting the correct extra modules for standard vs real-time kernels.

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 28, 2026
@openshift-ci-robot

openshift-ci-robot commented Jul 28, 2026

Copy link
Copy Markdown

@agullon: This pull request references USHIFT-7408 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

  • Change Requires: kernel-modules-extra to Requires: (kernel-modules-extra or kernel-rt-modules-extra) so that the dependency resolver picks whichever variant matches the installed kernel
  • Re-enable the rhel98-source-tuned ostree blueprint that was disabled due to the missing kernel-rt package

Problem

The plain Requires: kernel-modules-extra pulls in kernel-core (regular kernel) even when kernel-rt is the intended kernel. This causes rpm-ostree compose postprocess to fail with Multiple vmlinuz- because both vmlinuz-*+rt and vmlinuz-* are present in the boot directory.

Fix

RPM rich dependencies (or) let the solver pick kernel-modules-extra when the regular kernel is installed, or kernel-rt-modules-extra when kernel-rt is installed. Neither pulls in the wrong kernel.

OS Kernel RPM picks Effect
RHEL 9 + regular kernel-core kernel-modules-extra No-op (iptables modules already in kernel-modules-core)
RHEL 9 + kernel-rt kernel-rt-core kernel-rt-modules-extra No-op
RHEL 10 + regular kernel-core kernel-modules-extra Gets iptables modules for OVN-K
RHEL 10 + kernel-rt kernel-rt-core kernel-rt-modules-extra Gets iptables modules for OVN-K

Test plan

  • e2e-aws-tests passes (tuned ostree image builds with kernel-rt without dual-kernel failure)
  • e2e-aws-tests-arm passes (no kernel-rt on ARM, regular path works)

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@coderabbitai

coderabbitai Bot commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

Walkthrough

The RPM now selects standard or RT kernel module dependencies. A new RHEL 9.8 source-tuned image blueprint and presubmit scenario define the image contents, VM lifecycle, boot readiness check, and ordered Robot test execution.

Changes

Source-tuned presubmit

Layer / File(s) Summary
RT-aware kernel dependencies
packaging/rpm/microshift.spec
The RPM conditionally requires standard or RT extra kernel modules according to the installed kernel variant.
Tuned image blueprint
test/image-blueprints/layer2-presubmit/group1/rhel98-source-tuned.toml
The blueprint defines RHEL 9.8 packages, x86_64 RT kernel customization, services, firewall settings, and MicroShift and tuned configuration files.
Presubmit VM and test execution
test/scenarios/presubmits/el98-src@low-latency.sh
The scenario creates and removes the tuned VM, waits for two boots, and runs ordered Robot suites with failure gating.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: copejon, jogeo

🚥 Pre-merge checks | ✅ 15
✅ Passed checks (15 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed No Ginkgo test titles were added or modified; the PR only changes a spec, a TOML blueprint, and a shell scenario script.
Test Structure And Quality ✅ Passed No Ginkgo test code was changed; the PR only touches an RPM spec, a TOML blueprint, and a shell scenario script, so this check is not applicable.
Microshift Test Compatibility ✅ Passed No new Ginkgo tests were added; the PR only re-enables a shell scenario and blueprint, so there are no MicroShift API/feature compatibility issues to flag.
Single Node Openshift (Sno) Test Compatibility ✅ Passed No new Ginkgo e2e tests were added; the PR only re-enables existing blueprint/scenario files and changes an RPM spec dependency.
Topology-Aware Scheduling Compatibility ✅ Passed Only an RPM spec, an image blueprint, and a VM test script changed; none add operator/controller scheduling constraints or topology-dependent pod placement.
Ote Binary Stdout Contract ✅ Passed No Go/OTE binary code changed; the PR only updates RPM/TOML/shell assets, so there are no process-level stdout writes to violate the contract.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed No new Ginkgo e2e test code was added; the changed test artifact is a shell scenario, and it has no IPv4-only parsing or public-network calls.
No-Weak-Crypto ✅ Passed Touched files only change deps/config/test flow; no MD5/SHA1/DES/RC4/ECB, custom crypto, or secret comparisons were found.
Container-Privileges ✅ Passed Changed files are a TOML blueprint and bash scenario; neither adds privileged/root/host-namespace or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs ✅ Passed The changed files add no sensitive logging; the only new output is a generic timeout message, and no secrets/PII/internal data are echoed.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the dependency change to support kernel-rt.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@openshift-ci

openshift-ci Bot commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: agullon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 28, 2026

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packaging/rpm/microshift.spec`:
- Around line 87-90: Update the RPM dependency near the kernel module
requirement so it is variant-aware: regular kernel installations must require
kernel-modules-extra, while RT installations must require
kernel-rt-modules-extra. Replace the current broad OR dependency with the
appropriate conditional or package metadata mechanism, preserving the RHEL 9
no-op behavior.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 1bd429ef-78c9-4d9b-9043-d4d74206d387

📥 Commits

Reviewing files that changed from the base of the PR and between fef2239 and f94f566.

📒 Files selected for processing (2)
  • packaging/rpm/microshift.spec
  • test/image-blueprints/layer2-presubmit/group1/rhel98-source-tuned.toml

Comment thread packaging/rpm/microshift.spec Outdated
@agullon
agullon force-pushed the USHIFT-7408-rich-dep branch 2 times, most recently from 4e5996a to 2bc8f29 Compare July 29, 2026 06:57
agullon added 2 commits July 29, 2026 08:59
…kernel-rt

RHEL 10 moved iptables compat kernel modules (nft_compat, xt_CT) from
kernel-modules-core to kernel-modules-extra. Use conditional rich
dependencies so that each variant is gated on its own kernel-core
package — installing MicroShift on a kernel-rt system does not pull
in the regular kernel (and vice-versa).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

pre-commit.check-secrets: ENABLED
Re-enable the tuned ostree blueprint and the low-latency presubmit
scenario that were disabled due to the missing kernel-rt package.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

pre-commit.check-secrets: ENABLED
@agullon
agullon force-pushed the USHIFT-7408-rich-dep branch from 2bc8f29 to 0f8740e Compare July 29, 2026 06:59

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/scenarios/presubmits/el98-src`@low-latency.sh:
- Around line 1-4: Update the shell prologue in the presubmit script to use the
mandated #!/usr/bin/bash shebang and add set -euo pipefail immediately
afterward, before the environment exports.
- Around line 27-29: Update the timeout branch in the VM-waiting function to
return failure instead of calling exit, so control returns to the sourced
scenario harness and allows scenario_remove_vms to run. Preserve the timeout
message and failure status.
- Line 20: In the presubmit scenario, update the start_time declaration to
separate the readonly local declaration from the date command assignment,
preserving the existing timestamp value while allowing command-substitution
failures to surface and avoiding ShellCheck SC2155.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: ca11ef40-f5b5-4398-89c4-4f6fd57ae50a

📥 Commits

Reviewing files that changed from the base of the PR and between 4e5996a and 0f8740e.

📒 Files selected for processing (3)
  • packaging/rpm/microshift.spec
  • test/image-blueprints/layer2-presubmit/group1/rhel98-source-tuned.toml
  • test/scenarios/presubmits/el98-src@low-latency.sh
🚧 Files skipped from review as they are similar to previous changes (2)
  • packaging/rpm/microshift.spec
  • test/image-blueprints/layer2-presubmit/group1/rhel98-source-tuned.toml

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/scenarios/presubmits/el98-src`@low-latency.sh:
- Around line 1-4: Update the shell prologue in the presubmit script to use the
mandated #!/usr/bin/bash shebang and add set -euo pipefail immediately
afterward, before the environment exports.
- Around line 27-29: Update the timeout branch in the VM-waiting function to
return failure instead of calling exit, so control returns to the sourced
scenario harness and allows scenario_remove_vms to run. Preserve the timeout
message and failure status.
- Line 20: In the presubmit scenario, update the start_time declaration to
separate the readonly local declaration from the date command assignment,
preserving the existing timestamp value while allowing command-substitution
failures to surface and avoiding ShellCheck SC2155.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: ca11ef40-f5b5-4398-89c4-4f6fd57ae50a

📥 Commits

Reviewing files that changed from the base of the PR and between 4e5996a and 0f8740e.

📒 Files selected for processing (3)
  • packaging/rpm/microshift.spec
  • test/image-blueprints/layer2-presubmit/group1/rhel98-source-tuned.toml
  • test/scenarios/presubmits/el98-src@low-latency.sh
🚧 Files skipped from review as they are similar to previous changes (2)
  • packaging/rpm/microshift.spec
  • test/image-blueprints/layer2-presubmit/group1/rhel98-source-tuned.toml
🛑 Comments failed to post (3)
test/scenarios/presubmits/el98-src@low-latency.sh (3)

1-4: 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

Add the required shell prologue.

Use the mandated shebang and strict-mode flags; otherwise setup failures can be masked by subsequent commands.

Proposed fix
-#!/bin/bash
+#!/usr/bin/bash
+set -euo pipefail

As per coding guidelines, shell scripts must use the #!/usr/bin/bash shebang and set -euo pipefail.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

#!/usr/bin/bash
set -euo pipefail

export SKIP_GREENBOOT=true
export TEST_RANDOMIZATION=none
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/scenarios/presubmits/el98-src`@low-latency.sh around lines 1 - 4, Update
the shell prologue in the presubmit script to use the mandated #!/usr/bin/bash
shebang and add set -euo pipefail immediately afterward, before the environment
exports.

Source: Coding guidelines


20-20: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/bash
set -euo pipefail

sed -n '1,120p' 'test/scenarios/presubmits/el98-src@low-latency.sh' | cat -n

Repository: openshift/microshift

Length of output: 1739


🏁 Script executed:

#!/usr/bin/bash
set -euo pipefail

bash --version | head -n 1
printf '\ncase1\n'
bash -c 'set -e; f(){ local -r x=$(false); echo "after local:$?"; }; f; echo "survived"' || echo "died"
printf '\ncase2\n'
bash -c 'set -e; f(){ local x; x=$(false); echo "after assign:$?"; }; f; echo "survived"' || echo "died"
printf '\ncase3\n'
bash -c 'set -e; f(){ local -r x=$(date +%s); echo "after local date:$? value=$x"; }; f; echo "survived"' || echo "died"

Repository: openshift/microshift

Length of output: 314


Split the declaration from the assignment. local -r start_time=$(date +%s) can hide a failed substitution under set -e and triggers ShellCheck SC2155; declare first, then assign.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/scenarios/presubmits/el98-src`@low-latency.sh at line 20, In the
presubmit scenario, update the start_time declaration to separate the readonly
local declaration from the date command assignment, preserving the existing
timestamp value while allowing command-substitution failures to surface and
avoiding ShellCheck SC2155.

Source: Coding guidelines


27-29: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Return from the function instead of exiting the sourced harness.

exit 1 can terminate scenario.sh before scenario_remove_vms runs, leaving the test VM behind after a timeout. Return the failure and let the scenario harness own cleanup and process termination.

-            exit 1
+            return 1
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

        if [ $(( $(date +%s) - start_time )) -gt 60 ]; then
            echo "Timed out waiting for VM having 2 boots"
            return 1
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/scenarios/presubmits/el98-src`@low-latency.sh around lines 27 - 29,
Update the timeout branch in the VM-waiting function to return failure instead
of calling exit, so control returns to the sourced scenario harness and allows
scenario_remove_vms to run. Preserve the timeout message and failure status.

@openshift-ci

openshift-ci Bot commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

@agullon: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-aws-tests-arm 0f8740e link true /test e2e-aws-tests-arm
ci/prow/e2e-aws-tests 0f8740e link true /test e2e-aws-tests

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@copejon

copejon commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

/test e2e-aws-tests
/test e2e-aws-tests-arm

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants