USHIFT-6978: install dracut-fips in RHEL 9 bootc FIPS images#6662
USHIFT-6978: install dracut-fips in RHEL 9 bootc FIPS images#6662agullon wants to merge 3 commits into
Conversation
On RHEL 9, the fips dracut module is in the separate dracut-fips package. Without it, the initramfs does not contain the fips module and the lsinitrd FIPS validation check fails. On RHEL 10+, this module was merged into the base dracut package and is always present. Add dracut-fips to both RHEL 9 FIPS containerfiles (presubmit and release) so the FIPS test passes consistently across RHEL versions. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> pre-commit.check-secrets: ENABLED
|
@agullon: This pull request references USHIFT-6978 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
added
the
jira/valid-reference
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: agullon The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
/test e2e-aws-tests-bootc-release-el9 |
|
/test e2e-aws-tests-cache |
|
/test e2e-aws-tests-bootc-release-el9 |
…fips package On RHEL 9.8, dracut-fips was merged into the base dracut package, making `dnf install dracut-fips` a no-op. The fips dracut module files are present on disk but dracut is not configured to include them in the initramfs, causing the lsinitrd FIPS validation to fail. Replace the dracut-fips package install with an explicit dracut config file that ensures the fips module is included in the initramfs when bootc generates it during deployment. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> pre-commit.check-secrets: ENABLED
|
/test e2e-aws-tests-cache |
|
/test e2e-aws-tests-bootc-release-el9 |
|
@agullon: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
Summary
dracut-fipsin RHEL 9 bootc FIPS containerfiles (presubmit and release)fipsdracut module is in the separatedracut-fipspackage — without it the initramfs lacks the module and thelsinitrdFIPS check failsdracutpackage and is always presentTest plan
el98-lrel@ai-model-serving-online-fipsscenario passes on RHEL 9 bootcJira: https://issues.redhat.com/browse/USHIFT-6978
🤖 Generated with Claude Code