PE-8787 PE-9173: upgrade kairos v4.1.2 & kairos-init v0.16.1

.arg.template

@@ -53,3 +53,41 @@ FORCE_INTERACTIVE_INSTALL=false
 # AUTO_ENROLL_SECUREBOOT_KEYS=false     # Set to true to automatically enroll certificates on devices in Setup Mode, useful for flashing devices without user interaction
 
 # DRBD_VERSION=9.2.13  # This variable is required for Piraeus pack for drbd module installtion.
+
+# NVIDIA GPU driver pre-install (for running the NVIDIA GPU Operator in air-gapped
+# environments with driver.enabled=false). Bakes the datacenter driver + DKMS
+# kernel modules into the Ubuntu base image so GPU nodes need no host-side network.
+# See scripts/install-nvidia-drivers.sh for details.
+# INSTALL_NVIDIA_GPU_DRIVERS=true
+# NVIDIA_DRIVER_BRANCH=580                  # Driver branch (check: apt-cache search 'nvidia-headless-.*-server')
+# NVIDIA_DRIVER_TYPE=open                   # open | proprietary. Default "open" (REQUIRED on Hopper/Blackwell,
+#                                            safe on Turing/Ampere/Ada). Set "proprietary" only for pre-Turing GPUs.
+# NVIDIA_USE_CUDA_REPO=true                 # Add NVIDIA CUDA network repo at build time (has every -server branch)
+# NVIDIA_INSTALL_FABRICMANAGER=false        # true for NVSwitch / HGX systems
+# NVIDIA_INSTALL_CONTAINER_TOOLKIT=false    # true to also pre-install nvidia-container-toolkit on host (then toolkit.enabled=false)
+# NVIDIA_REBUILD_INITRD=true                # Rebuild initrd so the nouveau blacklist applies at early boot
+
+# AMD Instinct GPU driver pre-install (for running the AMD GPU Operator in air-gapped
+# environments with driver.enable=false). Mutually exclusive with the NVIDIA options
+# above. See scripts/install-amdgpu-drivers.sh and docs/amd-gpu-airgapped.md for details.
+# INSTALL_AMD_GPU_DRIVERS=true
+# AMDGPU_DRIVER_SOURCE=dkms                  # dkms | inbox. "dkms" bakes AMD's amdgpu-dkms
+#                                            #   built against the image kernel (recommended
+#                                            #   for Instinct/MI silicon). "inbox" uses the
+#                                            #   in-tree amdgpu module from linux-modules-*
+#                                            #   and skips the AMD apt repo entirely — use
+#                                            #   when the DKMS build fails against your image
+#                                            #   kernel (see docs).
+# AMDGPU_DRIVER_RELEASE=7.2.1                # Only used with dkms mode. amdgpu-install
+#                                            #   release marker. Default 7.2.1 pairs with
+#                                            #   GPU Operator v1.5.0 (ROCm 7.2.1). AMD also
+#                                            #   publishes driver-release-marker paths like
+#                                            #   30.30.1 / 30.30.4 / 31.30; either form works.
+#                                            #   31.x is tech-preview -- do not mix with a
+#                                            #   production operator. See the version-
+#                                            #   alignment table in docs/amd-gpu-airgapped.md.
+# AMDGPU_REBUILD_INITRD=false                # Default false. amdgpu is intentionally
+#                                            #   kept out of the initrd (multi-GPU init
+#                                            #   emits enough udev events to time out
+#                                            #   dracut-initqueue). It loads after
+#                                            #   switch-root via modules-load.d.

.earthlyignore

@@ -1,2 +1,6 @@
 local/
-build/*
+build/*
+# Whitelist AMD driver artifacts (produced by scripts/prebuild-amdgpu-artifact.sh
+# and consumed by the base-image target via COPY). Without this exception,
+# `build/*` above would hide the tarball from Earthly's build context.
+!build/amdgpu-artifact-*.tar.gz

.github/workflows/base-images.yaml

@@ -2,11 +2,205 @@ name: Build Kairos Init Base Images
 
 on:
   workflow_dispatch:
+    inputs:
+      base_os_image:
+        description: "Base OS Image"
+        required: false
+        type: string
+        default: ""
+      kairos_init_image:
+        description: "Kairos Init Image (its version tags the built base images)"
+        required: false
+        type: string
+        default: "quay.io/kairos/kairos-init:v0.16.2"
+      arch:
+        description: "Architecture"
+        required: false
+        type: choice
+        options:
+          - amd64
+          - arm64
+        default: "amd64"
+      model:
+        description: "Model"
+        required: false
+        type: string
+        default: "generic"
+      kairos_version:
+        description: "Kairos Version (passed to kairos-init --version; not used in the image tag)"
+        required: false
+        type: string
+        default: "v4.1.2"
+      trusted_boot:
+        description: "Trusted Boot"
+        required: false
+        type: boolean
+        default: false
+      registry_prefix:
+        description: "Registry prefix for output images"
+        required: false
+        type: string
+        default: "us-east1-docker.pkg.dev/spectro-images/dev/pe-8787/edge"
 
 jobs:
   generate-matrix:
-    runs-on: ubuntu-latest
+    runs-on: Luet-BigRunner
+    outputs:
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
-      - name: Generate Matrix
+      - name: Generate build matrix
+        id: set-matrix
         run: |
-          echo "Hello"
+          python3 << 'EOF'
+          import json
+          import os
+
+          base_os_image = "${{ github.event.inputs.base_os_image }}"
+          registry_prefix = "${{ github.event.inputs.registry_prefix }}"
+          arch = "${{ github.event.inputs.arch }}"
+          model = "${{ github.event.inputs.model }}"
+          kairos_init_image = "${{ github.event.inputs.kairos_init_image }}"
+          trusted_boot = "${{ github.event.inputs.trusted_boot }}" == "true"
+
+          def kairos_init_version(image):
+              """Version component of the kairos-init image reference.
+
+              Base images are tagged with the kairos-init version (not the
+              Kairos version) because kairos-init is what determines the
+              layout and contents of the produced image. Earthfile's
+              KAIROS_INIT_VERSION must match this.
+              """
+              ref = image.rsplit('/', 1)[-1]
+              if '@' in ref:  # digest form: kairos-init@sha256:abc...
+                  return ref.split('@', 1)[1].replace(':', '-')
+              if ':' in ref:
+                  return ref.split(':', 1)[1]
+              return 'latest'
+
+          init_version = kairos_init_version(kairos_init_image)
+          print(f"Tagging with kairos-init version: {init_version}")
+
+          matrix = []
+
+          if base_os_image:
+              # Custom base OS image
+              simple_name = base_os_image.split('/')[-1].replace(':', '-')
+              tag = f"{registry_prefix}/kairos-custom:{simple_name}-core-{arch}-{model}-{init_version}"
+              if trusted_boot:
+                  tag += "-uki"
+
+              matrix.append({
+                  "base_os": base_os_image,
+                  "tag": tag,
+              })
+
+          elif trusted_boot:
+              # UKI builds - only Ubuntu 24.04
+              tag = f"{registry_prefix}/kairos-ubuntu:24.04-core-{arch}-{model}-{init_version}-uki"
+              matrix.append({
+                  "base_os": "ubuntu:24.04",
+                  "tag": tag,
+              })
+
+          else:
+              # Standard builds - all combinations
+              combinations = [
+                  ("ubuntu:20.04", "kairos-ubuntu:20.04-core"),
+                  ("ubuntu:22.04", "kairos-ubuntu:22.04-core"),
+                  ("ubuntu:24.04", "kairos-ubuntu:24.04-core"),
+                  ("opensuse/leap:15.6", "kairos-opensuse:leap-15.6-core"),
+                  ("registry.suse.com/suse/sle-micro-rancher/5.4:latest", "kairos-slem:5.4-core"),
+              ]
+
+              for base_os, tag_prefix in combinations:
+                  tag = f"{registry_prefix}/{tag_prefix}-{arch}-{model}-{init_version}"
+                  matrix.append({
+                      "base_os": base_os,
+                      "tag": tag,
+                  })
+
+          matrix_json = json.dumps(matrix)
+          print(f"Generated matrix: {matrix_json}")
+
+          with open(os.environ['GITHUB_OUTPUT'], 'a') as f:
+              f.write(f"matrix={matrix_json}\n")
+          EOF
+
+  kairosify:
+    needs: generate-matrix
+    runs-on: Luet-BigRunner
+    strategy:
+      matrix:
+        include: ${{ fromJson(needs.generate-matrix.outputs.matrix) }}
+      fail-fast: false
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to registry
+        run: echo "${{ secrets.US_EAST_JSON_KEY_B64 }}" | base64 -d | docker login -u _json_key --password-stdin us-east1-docker.pkg.dev
+
+      - name: Build and push kairosify image
+        uses: docker/bake-action@v6
+        with:
+          files: docker-bake-kairosify.hcl
+          targets: kairosify
+          push: true
+          set: |
+            kairosify.platform=linux/${{ github.event.inputs.arch }}
+            kairosify.args.BASE_OS_IMAGE=${{ matrix.base_os }}
+            kairosify.args.KAIROS_INIT_IMAGE=${{ github.event.inputs.kairos_init_image }}
+            kairosify.args.KAIROS_VERSION=${{ github.event.inputs.kairos_version }}
+            kairosify.args.TRUSTED_BOOT=${{ github.event.inputs.trusted_boot }}
+            kairosify.args.MODEL=${{ github.event.inputs.model }}
+            kairosify.tags=${{ matrix.tag }}
+        env:
+          DOCKER_BUILD_SUMMARY: false
+
+      - name: Save build result
+        run: |
+          mkdir -p /tmp/results
+          echo "${{ matrix.tag }}" >> /tmp/results/built_tags.txt
+
+      - name: Upload build results
+        uses: actions/upload-artifact@v4
+        with:
+          name: build-result-${{ strategy.job-index }}-${{ hashFiles('**/matrix.*') }}
+          path: /tmp/results/built_tags.txt
+
+  collect-outputs:
+    needs: kairosify
+    runs-on: Luet-BigRunner
+    outputs:
+      built_tags: ${{ steps.combine-tags.outputs.tags }}
+    steps:
+      - name: Download all build results
+        uses: actions/download-artifact@v4
+        with:
+          pattern: build-result-*
+          path: /tmp/results
+
+      - name: Combine all tags
+        id: combine-tags
+        run: |
+          ALL_TAGS=$(find /tmp/results -name "*.txt" -type f -exec cat {} \; | grep -v '^$' | jq -R -s -c 'split("\n") | map(select(length > 0))')
+          echo "tags=$ALL_TAGS" >> $GITHUB_OUTPUT
+          echo "All built tags: $ALL_TAGS"
+
+      - name: Summary
+        run: |
+          echo "## Kairosify Build Summary" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**Input Parameters:**" >> $GITHUB_STEP_SUMMARY
+          echo "- Base OS Image: ${{ github.event.inputs.base_os_image || 'Default combinations' }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Kairos Init Image: ${{ github.event.inputs.kairos_init_image }} (its version tags the built images)" >> $GITHUB_STEP_SUMMARY
+          echo "- Architecture: ${{ github.event.inputs.arch }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Model: ${{ github.event.inputs.model }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Kairos Version: ${{ github.event.inputs.kairos_version }} (passed to kairos-init --version)" >> $GITHUB_STEP_SUMMARY
+          echo "- Trusted Boot: ${{ github.event.inputs.trusted_boot }}" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**Built Images:**" >> $GITHUB_STEP_SUMMARY
+          echo '${{ steps.combine-tags.outputs.tags }}' | jq -r '.[] | "- " + .' >> $GITHUB_STEP_SUMMARY