Questions on FCOS Internals

[John Osborne]

Hi SMEs,

Iv'e been using Fedora CoreOS (FCOS) and I had some questions. Any help
would be greatly appreciated, thank you!

Q: Is there a way to pass FCOS an ignition file while it's running for the
next reboot? Or do you need to externally kill the machine and pass the
.ign file again through the firmware?

Q: Can you see the ignition file while the machine is running that was
passed during startup? Is it unmounted somewhere or in the initramfs.img
file?

Q: It looks like I can turn on automatic updates on FCOS by editing
/etc/rpm-ostreed.conf. Will that make my machine auto-reboot? When?

Q: How do rpm-ostree and ignition work together? Does rpm-ostree pull down
ostree updates on some sort of cronjob type schedule? Are the updates in an
OCI image (oscontainer)? Where is the image unpacked? How does ignition
know which image to use when it starts the machine?


-- 

John Osborne

CHIEF openshift architect, RHCE

Red Hat Public Sector <https://www.redhat.com>

josborne(a)redhat.com    M: 7037721090
<https://red.ht/sig>

[Andrew Jeddeloh]

I can answer 1, 2, and 4 off the top of my head:

>  Is there a way to pass FCOS an ignition file while it's running
> for the 
next reboot? Or do you need to externally kill the machine and pass the
.ign file again through the firmware?

That's sort of an anti-pattern and not supported. Ignition is only meant to
run on first boot, weird unexpected things might happen if you run it every
boot. It's not meant as a configuration management tool. That said, writing
the ignition firstboot file to /boot will trigger it to run again, just
beware this isn't a supported mode of operation. Also note that Ignition
doesn't always pull it's config from firmware. That's the case on qemu,
which I assume is what you're running, but on clouds it pulls it from the
cloud's metadata service. Finally, Ignition also can read a config off
/boot (which is how bare metal installs work) and will prefer that to
fetching it from a cloud provider.

>  Can you see the ignition file while the machine is running that was
passed during startup? Is it unmounted somewhere or in the initramfs.img
file?

On first boot it's at /run/ignition.json. It's not accessible on subsequent
boots.

>  How do rpm-ostree and ignition work together? Does rpm-ostree pull
> down 
ostree updates on some sort of cronjob type schedule? Are the updates in an
OCI image (oscontainer)? Where is the image unpacked? How does ignition
know which image to use when it starts the machine?

They don't. They're not really aware of each other and don't need to be.
Ignition only runs on first boot, not on every update, so no interaction is
needed.

 - Andrew

On Tue, Sep 24, 2019 at 10:52 AM John Osborne <josborne(a)redhat.com&gt; wrote:

>  Hi SMEs,
>
>  Iv'e been using Fedora CoreOS (FCOS) and I had some questions. Any help
>  would be greatly appreciated, thank you!
>
>  Q: Is there a way to pass FCOS an ignition file while it's running for the
>  next reboot? Or do you need to externally kill the machine and pass the
>  .ign file again through the firmware?
>
>  Q: Can you see the ignition file while the machine is running that was
>  passed during startup? Is it unmounted somewhere or in the initramfs.img
>  file?
>
>  Q: It looks like I can turn on automatic updates on FCOS by editing
>  /etc/rpm-ostreed.conf. Will that make my machine auto-reboot? When?
>
>  Q: How do rpm-ostree and ignition work together? Does rpm-ostree pull down
>  ostree updates on some sort of cronjob type schedule? Are the updates in an
>  OCI image (oscontainer)? Where is the image unpacked? How does ignition
>  know which image to use when it starts the machine?
>
>
>  --
>
>  John Osborne
>
>  CHIEF openshift architect, RHCE
>
>  Red Hat Public Sector <https://www.redhat.com>
>
>  josborne(a)redhat.com    M: 7037721090
>  <https://red.ht/sig>
>  _______________________________________________
>  CoreOS mailing list -- coreos(a)lists.fedoraproject.org
>  To unsubscribe send an email to coreos-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct:
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
>  https://lists.fedoraproject.org/archives/list/[e-mail]
>

[Nick Stielau]

On Tue, Sep 24, 2019 at 11:23 AM Andrew Jeddeloh <andrew.jeddeloh(a)redhat.com&gt;
wrote:

>  I can answer 1, 2, and 4 off the top of my head:
>
>  > Is there a way to pass FCOS an ignition file while it's running for the
>  next reboot? Or do you need to externally kill the machine and pass the
>  .ign file again through the firmware?
>
>  That's sort of an anti-pattern and not supported. Ignition is only meant
>  to run on first boot, weird unexpected things might happen if you run it
>  every boot. It's not meant as a configuration management tool. That said,
>  writing the ignition firstboot file to /boot will trigger it to run again,
>  just beware this isn't a supported mode of operation. Also note that
>  Ignition doesn't always pull it's config from firmware. That's the case on
>  qemu, which I assume is what you're running, but on clouds it pulls it from
>  the cloud's metadata service. Finally, Ignition also can read a config off
>  /boot (which is how bare metal installs work) and will prefer that to
>  fetching it from a cloud provider.
>
>  > Can you see the ignition file while the machine is running that was
>  passed during startup? Is it unmounted somewhere or in the initramfs.img
>  file?
>
>  On first boot it's at /run/ignition.json. It's not accessible on
>  subsequent boots.
>
>  > How do rpm-ostree and ignition work together? Does rpm-ostree pull down
>  ostree updates on some sort of cronjob type schedule? Are the updates in an
>  OCI image (oscontainer)? Where is the image unpacked? How does ignition
>  know which image to use when it starts the machine?
>
>  They don't. They're not really aware of each other and don't need to be.
>  Ignition only runs on first boot, not on every update, so no interaction is
>  needed.
>  
Others can add more detail, but there will be some client-side periodic
query to a Fedora CoreOS update server (running a version of Cincinnati,
the same update server that handles OCP OTA updates) to handle updates.  I
believe we won't use OCI which was a convenience for OCP OTA updates since
OCP has a very container-centric view of the world.

>   - Andrew
>
>  On Tue, Sep 24, 2019 at 10:52 AM John Osborne <josborne(a)redhat.com&gt; wrote:
>
> > Hi SMEs,
> >
> > Iv'e been using Fedora CoreOS (FCOS) and I had some questions. Any help
> > would be greatly appreciated, thank you!
> >
> > Q: Is there a way to pass FCOS an ignition file while it's running for
> > the next reboot? Or do you need to externally kill the machine and pass the
> > .ign file again through the firmware?
> >
> > Q: Can you see the ignition file while the machine is running that was
> > passed during startup? Is it unmounted somewhere or in the initramfs.img
> > file?
> >
> > Q: It looks like I can turn on automatic updates on FCOS by editing
> > /etc/rpm-ostreed.conf. Will that make my machine auto-reboot? When?
> >
> > Q: How do rpm-ostree and ignition work together? Does rpm-ostree pull
> > down ostree updates on some sort of cronjob type schedule? Are the updates
> > in an OCI image (oscontainer)? Where is the image unpacked? How does
> > ignition know which image to use when it starts the machine?
> >
> >
> > --
> >
> > John Osborne
> >
> > CHIEF openshift architect, RHCE
> >
> > Red Hat Public Sector <https://www.redhat.com>
> >
> > josborne(a)redhat.com    M: 7037721090
> > <https://red.ht/sig>
> > _______________________________________________
> > CoreOS mailing list -- coreos(a)lists.fedoraproject.org
> > To unsubscribe send an email to coreos-leave(a)lists.fedoraproject.org
> > Fedora Code of Conduct:
> > https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> > https://lists.fedoraproject.org/archives/list/[e-mail]
> >
>  _______________________________________________
>  CoreOS mailing list -- coreos(a)lists.fedoraproject.org
>  To unsubscribe send an email to coreos-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct:
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
>  https://lists.fedoraproject.org/archives/list/[e-mail]
>  

-- 
-----
Nick Stielau
He - Him - His
SFO, OpenShift

[Benjamin Gilbert]

On Tue, Sep 24, 2019 at 1:52 PM John Osborne <josborne(a)redhat.com&gt; wrote:

>  Q: It looks like I can turn on automatic updates on FCOS by editing
>  /etc/rpm-ostreed.conf. Will that make my machine auto-reboot? When?
>  
Automatic updates are handled by Zincati, which receives information about
new updates and then drives rpm-ostree to apply them.  They're enabled by
default, via the Zincati service and not rpm-ostreed.conf.  By default,
your machine will automatically reboot after applying an update, though you
can configure Zincati to e.g. request permission from an external system
first.


>  Are the updates in an OCI image (oscontainer)? Where is the image
>  unpacked? How does ignition know which image to use when it starts the
>  machine?
>  
Updates are pulled from an ostree repo.  Fedora CoreOS ships fresh boot
images for every release, so on the first boot we just start the OS version
shipped in the disk image without applying any updates first.  After an
update, rpm-ostree configures the bootloader to boot into the new OS
version.

--Benjamin Gilbert

[John Osborne]

Thanks everyone for the helpful replies!

On Wed, Sep 25, 2019 at 2:07 PM Benjamin Gilbert <bgilbert(a)redhat.com&gt;
wrote:

>  On Tue, Sep 24, 2019 at 1:52 PM John Osborne
> <josborne(a)redhat.com&gt; wrote:
>
> > Q: It looks like I can turn on automatic updates on FCOS by editing
> > /etc/rpm-ostreed.conf. Will that make my machine auto-reboot? When?
> >
>
>  Automatic updates are handled by Zincati, which receives information about
>  new updates and then drives rpm-ostree to apply them.  They're enabled by
>  default, via the Zincati service and not rpm-ostreed.conf.  By default,
>  your machine will automatically reboot after applying an update, though you
>  can configure Zincati to e.g. request permission from an external system
>  first.
>
>
> > Are the updates in an OCI image (oscontainer)? Where is the image
> > unpacked? How does ignition know which image to use when it starts the
> > machine?
> >
>
>  Updates are pulled from an ostree repo.  Fedora CoreOS ships fresh boot
>  images for every release, so on the first boot we just start the OS version
>  shipped in the disk image without applying any updates first.  After an
>  update, rpm-ostree configures the bootloader to boot into the new OS
>  version.
>
>  --Benjamin Gilbert
>
>  
-- 

John Osborne

CHIEF openshift architect, RHCE

Red Hat Public Sector <https://www.redhat.com>

josborne(a)redhat.com    M: 7037721090
<https://red.ht/sig>