bundle.sh

#!/bin/bash
# Run on a STAGING host with internet access to docker.io. Pulls the HySDS
# images at ${HYSDS_VERSION} (from .env), builds the hello-world PGE image on
# top, and saves the set into a transferable OCI tarball for delivery to an
# offline target.
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
cd "$SCRIPT_DIR"

# Load HYSDS_VERSION. .env takes precedence over .env.example.
if [[ -f .env ]]; then
  # shellcheck disable=SC1091
  set -a; source .env; set +a
else
  echo "WARNING: .env not found, falling back to .env.example defaults"
  # shellcheck disable=SC1091
  set -a; source .env.example; set +a
fi
: "${HYSDS_VERSION:?HYSDS_VERSION not set}"

HELLO_WORLD_TAG="docker.io/hysds/hello-world:v1.0"
HYSDS_UI_REF="${HYSDS_UI_REF:-v1.3.1}"
HYSDS_UI_TAG="localhost/hysds_ui:${HYSDS_UI_REF}"
DASHBOARDS_TAG="docker.io/opensearchproject/opensearch-dashboards:${OPENSEARCH_VERSION:-2.15.0}"
OPENSEARCH_TAG="docker.io/opensearchproject/opensearch:${OPENSEARCH_VERSION:-2.15.0}"

BASE_IMAGES=(
  "docker.io/hysds/mozart:${HYSDS_VERSION}"
  "docker.io/hysds/grq:${HYSDS_VERSION}"
  "docker.io/hysds/metrics:${HYSDS_VERSION}"
  "docker.io/hysds/verdi:${HYSDS_VERSION}"
  "docker.io/hysds/pge-base:${HYSDS_VERSION}"
  "docker.io/hysds/rabbitmq:${HYSDS_VERSION}"
  "docker.io/hysds/redis:${HYSDS_VERSION}"
  "$OPENSEARCH_TAG"
  "$DASHBOARDS_TAG"
)
BUNDLE="hysds-${HYSDS_VERSION}-bundle.tar"

command -v podman >/dev/null || { echo "podman not found"; exit 1; }

echo "==> Pulling ${#BASE_IMAGES[@]} base images from docker.io..."
for img in "${BASE_IMAGES[@]}"; do
  echo "  $img"
  podman pull "$img"
done

echo "==> Building $HELLO_WORLD_TAG (FROM hysds/pge-base:${HYSDS_VERSION})..."
podman build \
  --build-arg "HYSDS_VERSION=${HYSDS_VERSION}" \
  -t "$HELLO_WORLD_TAG" \
  "$SCRIPT_DIR/hello-world"

MOZART_EXT_TAG="localhost/hysds-mozart-ext:${HYSDS_VERSION}"
echo "==> Building $MOZART_EXT_TAG (adds logstash-output-opensearch plugin)..."
podman build \
  --build-arg "HYSDS_VERSION=${HYSDS_VERSION}" \
  -t "$MOZART_EXT_TAG" \
  "$SCRIPT_DIR/mozart"

METRICS_EXT_TAG="localhost/hysds-metrics-ext:${HYSDS_VERSION}"
echo "==> Building $METRICS_EXT_TAG (adds logstash-output-opensearch plugin)..."
podman build \
  --build-arg "HYSDS_VERSION=${HYSDS_VERSION}" \
  -t "$METRICS_EXT_TAG" \
  "$SCRIPT_DIR/metrics"

# Lightweight-jobs image. Source is shipped *inside* the hysds/mozart image
# at /root/mozart/ops/lightweight-jobs-2.0.1, so extract via a throwaway
# container and build from the copy. Otherwise Figaro's on-demand dropdown
# shows only hello_world; these 13 system jobs (purge, retry, revoke,
# reprioritize, notify-by-email, wget, aws_get, ...) are how real HySDS
# operators drive cluster housekeeping.
LW_JOBS_TAG="docker.io/hysds/lightweight-jobs:${HYSDS_VERSION}"
echo "==> Building $LW_JOBS_TAG (extracts lightweight-jobs source from mozart image)..."
_lwtmp=$(mktemp -d)
_lwcid=$(podman create "docker.io/hysds/mozart:${HYSDS_VERSION}")
podman cp "${_lwcid}:/root/mozart/ops/lightweight-jobs-2.0.1" "${_lwtmp}/lightweight-jobs"
podman rm -f "${_lwcid}" >/dev/null
# Re-pin the Dockerfile's FROM to the versioned hysds/pge-base already in
# the bundle (stock is :develop).
sed -i.bak \
  "s|^FROM hysds/pge-base:.*|FROM docker.io/hysds/pge-base:${HYSDS_VERSION}|" \
  "${_lwtmp}/lightweight-jobs/docker/Dockerfile"
# Drop 'USER ops' — under rootless podman uid 10005 can't read verdi's
# bind-mounted celeryconfig.py (owned by the host user). Root-in-container
# maps back to the host user and resolves the permission issue.
sed -i.bak '/^USER ops$/d' "${_lwtmp}/lightweight-jobs/docker/Dockerfile"
# Replace the ENTRYPOINT. /entrypoint-pge-with-stats.sh chains through
# /docker-stats-on-exit-shim which is cgroup-v1-only; on cgroup-v2 hosts
# it exits 1 before the PGE command runs.
cat >> "${_lwtmp}/lightweight-jobs/docker/Dockerfile" <<'DF'

ENTRYPOINT ["/bin/bash", "-c", ". /entrypoint-pge-common.sh && exec \"$@\"", "--"]
DF
# Prepend $PWD to PYTHONPATH in each *.sh — verdi bind-mounts celeryconfig.py
# into the spawned container's CWD, but the stock scripts only put BASE_PATH
# on the path, so 'import celeryconfig' in purge.py/retry.py/etc. fails.
for _lwf in "${_lwtmp}/lightweight-jobs"/*.sh; do
  [[ -f "$_lwf" ]] || continue
  sed -i.bak 's|^export PYTHONPATH=\$BASE_PATH:\$PYTHONPATH|export PYTHONPATH=$PWD:$BASE_PATH:$PYTHONPATH|' "$_lwf"
done
podman build \
  -t "$LW_JOBS_TAG" \
  -f "${_lwtmp}/lightweight-jobs/docker/Dockerfile" \
  "${_lwtmp}/lightweight-jobs"
rm -rf "${_lwtmp}"

echo "==> Building $HYSDS_UI_TAG (clones hysds/hysds_ui@${HYSDS_UI_REF}, npm build)..."
podman build \
  --build-arg "HYSDS_UI_REF=${HYSDS_UI_REF}" \
  --build-arg "VENUE=${VENUE:-HySDS}" \
  -t "$HYSDS_UI_TAG" \
  "$SCRIPT_DIR/hysds_ui"

ALL_IMAGES=("${BASE_IMAGES[@]}" "$HELLO_WORLD_TAG" "$MOZART_EXT_TAG" "$METRICS_EXT_TAG" "$LW_JOBS_TAG" "$HYSDS_UI_TAG")

echo "==> Saving ${#ALL_IMAGES[@]} images to ${BUNDLE}..."
podman save --multi-image-archive -o "$BUNDLE" "${ALL_IMAGES[@]}"

echo "==> Compressing..."
gzip -f "$BUNDLE"

echo "==> Writing checksum..."
if command -v sha256sum >/dev/null; then
  sha256sum "${BUNDLE}.gz" > "${BUNDLE}.gz.sha256"
else
  shasum -a 256 "${BUNDLE}.gz" > "${BUNDLE}.gz.sha256"
fi

echo
echo "Bundle created:"
ls -lh "${BUNDLE}.gz" "${BUNDLE}.gz.sha256"
echo
echo "Transfer the following to the offline host alongside this repo:"
echo "  ${BUNDLE}.gz"
echo "  ${BUNDLE}.gz.sha256"