- Shipped
- September 23, 2026 at 8:25 AM UTC
- Author
- Kamo
- Commit
- dda7160
build-golden-image.sh said "Run by CI (see ../../.forgejo/workflows/)". No such workflow was ever written. It needs libguestfs, qemu-img and virt-customize, none of which are installed on the machine this repo is worked on, and there is no container runtime there either — so the one artefact the whole app depends on had no path to existing. That is how the first person to assign a computer found out. The build runs in the cluster instead, which is the one place already equipped for it: the nodes run KubeVirt and expose /dev/kvm through the devices.kubevirt.io/kvm device plugin, so libguestfs is hardware-accelerated rather than emulating for hours. The job writes into the golden PVC directly, because vm/datavolume-template clones with source.pvc and a CDI clone of a Filesystem volume copies its contents — so any claim holding disk.img is a valid source. That removes the HTTP hosting step, the upload credential and a second copy of a multi-gigabyte file. golden-datavolume.yaml stays for an image built somewhere else. Three things worth knowing from writing it: The scripts travel as ConfigMaps rather than a git clone, so the job needs no credential. They mount read-only with no execute bit, so they are copied to a writable path before virt-customize --run can execute them. The build happens in scratch and only the finished file is copied into the claim. The script writes a 20 GB working qcow2 and then qemu-img convert -c writes a second compressed one beside it; doing that in the golden claim would need it to be twice the size of the image it ends up holding. VERSION is overridable now. The in-cluster path has to know the version BEFORE the build starts, because the claim carries it in its name and must exist for the job to write into, so the wrapper resolves Canonical's serial once and uses that one value for both. A rebuild of an existing version is refused rather than written into: a second write into a populated golden PVC is the failure that reaches every tenant at once.