[OKD4.7] Install FCOS 34 kernel headers from kernel-devel via machine-config like in RHCOS

[devzeronull]

Hi,

is there a working way to install Fedora CoreOS Kernel-headers through a machineconfig in OKD?

The method as suggested with Red Hat CoreOS from OpenShift, described in falcosecurity/falco#1505, by deploying it with a machine config like:

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  labels:
    machineconfiguration.openshift.io/role: worker
  name: worker-extensions
spec:
  extensions:
    - kernel-devel

and

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  labels:
    machineconfiguration.openshift.io/role: master
  name: master-extensions
spec:
  extensions:
    - kernel-devel

doesn't seem to work, the MCO stucks degraded with missing packages:

error running rpm-ostree install --allow-inactive kernel-devel: Checking out tree fb99ff5...doneEnabled rpm-md repositories: coreos-extensionsrpm-md repo 'coreos-extensions' (cached); generated: 2021-06-29T10:22:06ZImporting rpm-md...doneerror: Packages not found: kernel-devel: exit status 1

Any productive-ready idea despite building custom images would be appreciated :)

Best regards

[vrutkovs]

You need to enable Fedora repos to allow rpm-ostree install additional packages

[vrutkovs]

(sorry for the delay)

Yeah, that's how we expect it to work. Is there any problem with that approach?

[achilles-git]

@vrutkovs if we enable the fedora repos by applying the above MachineConfig won't it break the OKD upgrades ???

[vrutkovs]

its quite possible - at least we test upgrades in CI with all repos disabled

[achilles-git]

OK
so is there any solution for this ???

what if we keep the extension (in this case kernel-devel) installed and remove the repo during the upgrade ?? how will it impact ???

or we can remove the machine config for the extension and repo then proceed with the upgrade, once the upgrade is completed again apply the machine config to enable the repo and install the kernel-devel package.

[yuanlinios]

The "kernel-devel" installed from fedora yum repo is 5.11.12. It does not match the one used by FCOS 5.14.9. How do you work around it?