Migrate to wolfi

common/library/module_utils/local_repo/config.py

@@ -86,6 +86,7 @@
     "x86_64": ["dnf", "info", "--quiet"],
     "aarch64": ["dnf", "info", "--quiet", "--forcearch=aarch64"]
 }
+PULP_RPM_PACKAGES_API = "/pulp/api/v3/content/rpm/packages/"
 
 # ----------------------------
 # Cleanup File Types
@@ -134,7 +135,18 @@
 ISO_TIMEOUT_MIN = 45    # minutes
 TASK_POLL_INTERVAL = 10  # seconds
 FILE_URI = "/pulp/api/v3/content/file/files/"
-PULP_SSL_CA_CERT = "/etc/pki/ca-trust/source/anchors/pulp_webserver.crt"
+
+import os
+
+def _get_ca_cert_path():
+    """Return CA cert path based on OS. Fedora/RHEL vs Wolfi/Debian."""
+    rhel_path = "/etc/pki/ca-trust/source/anchors/pulp_webserver.crt"
+    wolfi_path = "/usr/local/share/ca-certificates/pulp_webserver.crt"
+    if os.path.exists("/etc/pki/ca-trust/source/anchors"):
+        return rhel_path
+    return wolfi_path
+
+PULP_SSL_CA_CERT = _get_ca_cert_path()
 # ----------------------------
 # Used by download_image.py
 # ----------------------------

local_repo/roles/parse_and_download/tasks/create_metadata.yml

@@ -15,6 +15,13 @@
 - name: Clean DNF cache
   ansible.builtin.command: dnf clean all
   changed_when: false
+  when: ansible_facts['pkg_mgr'] | default('') in ['dnf', 'dnf4', 'dnf5', 'yum']
+
+- name: Clean apk cache
+  ansible.builtin.command: apk cache clean
+  changed_when: false
+  failed_when: false
+  when: ansible_facts['pkg_mgr'] | default('') == 'apk'
 
 - name: Remove pulp.repo if exists
   ansible.builtin.file:
@@ -25,6 +32,13 @@
   ansible.builtin.dnf:
     update_cache: true
   changed_when: false
+  when: ansible_facts['pkg_mgr'] | default('') in ['dnf', 'dnf4', 'dnf5', 'yum']
+
+- name: Regenerate apk package index
+  community.general.apk:
+    update_cache: true
+  changed_when: false
+  when: ansible_facts['pkg_mgr'] | default('') == 'apk'
 
 - name: Check for data folder existence
   ansible.builtin.stat:

local_repo/roles/parse_and_download/tasks/process_rpm_repo.yml

@@ -43,3 +43,10 @@
   ansible.builtin.dnf:
     update_cache: true
   changed_when: false
+  when: ansible_facts['pkg_mgr'] | default('') in ['dnf', 'dnf4', 'dnf5', 'yum']
+
+- name: Regenerate apk package index
+  community.general.apk:
+    update_cache: true
+  changed_when: false
+  when: ansible_facts['pkg_mgr'] | default('') == 'apk'

local_repo/roles/validation/tasks/prerequisites.yml

@@ -25,3 +25,10 @@
   loop:
     - "{{ ['max_parallel_downloads', dnf_max_parallel] }}"
     - "{{ ['strict', 'False'] }}"
+  when: ansible_facts['pkg_mgr'] | default('') in ['dnf', 'dnf4', 'dnf5', 'yum']
+
+- name: Refresh apk package index
+  community.general.apk:
+    update_cache: true
+  changed_when: false
+  when: ansible_facts['pkg_mgr'] | default('') == 'apk'

prepare_oim/roles/deploy_containers/pulp/tasks/create_pulp_config_https.yml

@@ -108,16 +108,92 @@
         state: file
       loop: "{{ cert_items.values() }}"
 
+    - name: Detect CA trust anchors directory
+      ansible.builtin.set_fact:
+        ca_trust_anchors_dir: >-
+          {{ '/etc/pki/ca-trust/source/anchors'
+             if ansible_facts['os_family'] | default('') in ['RedHat', 'Fedora']
+             else '/usr/local/share/ca-certificates' }}
+      when: ca_trust_anchors_dir is not defined
+
+    - name: Set anchors path
+      ansible.builtin.set_fact:
+        ca_trust_path: "{{ ca_trust_anchors_dir }}/pulp_webserver.crt"
+      when: ca_trust_path is not defined
+
+    - name: Ensure CA trust directory exists
+      ansible.builtin.file:
+        path: "{{ ca_trust_anchors_dir }}"
+        state: directory
+        mode: '0755'
+
     - name: Copy Pulp crt to container trust
       ansible.builtin.copy:
         src: "{{ pulp_cert_src }}"
         dest: "{{ ca_trust_path }}"
         mode: "{{ logs_dir_permission }}"
 
-    - name: Add Pulp Certificate to TrustStore
+    - name: Change group ownership of SSL certificate and key
+      ansible.builtin.file:
+        path: "{{ item }}"
+        group: pulp
+        state: file
+      loop: "{{ cert_items.values() }}"
+
+    # ── CA Trust: OS-aware cert installation ────────────────────────────────
+    # Fedora/RHEL: use update-ca-trust (native command exists)
+    # Wolfi/Other: directly append cert to system CA bundle (no command exists)
+
+    - name: Detect CA trust anchors directory
+      ansible.builtin.set_fact:
+        ca_trust_anchors_dir: >-
+          {{ '/etc/pki/ca-trust/source/anchors'
+             if ansible_facts['os_family'] | default('') in ['RedHat', 'Fedora']
+             else '/usr/local/share/ca-certificates' }}
+      when: ca_trust_anchors_dir is not defined
+
+    - name: Set anchors path
+      ansible.builtin.set_fact:
+        ca_trust_path: "{{ ca_trust_anchors_dir }}/pulp_webserver.crt"
+      when: ca_trust_path is not defined
+
+    - name: Ensure CA trust directory exists
+      ansible.builtin.file:
+        path: "{{ ca_trust_anchors_dir }}"
+        state: directory
+        mode: '0755'
+
+    - name: Copy Pulp crt to container trust
+      ansible.builtin.copy:
+        src: "{{ pulp_cert_src }}"
+        dest: "{{ ca_trust_path }}"
+        mode: "{{ logs_dir_permission }}"
+
+    - name: Add Pulp Certificate to TrustStore (RHEL/Fedora)
       ansible.builtin.command:
         cmd: update-ca-trust extract
       changed_when: false
+      when: ansible_facts['os_family'] | default('') in ['RedHat', 'Fedora']
+
+    - name: Add Pulp Certificate to TrustStore (Wolfi/Other)
+      ansible.builtin.shell: |
+        cat "{{ ca_trust_path }}" >> /etc/ssl/certs/ca-certificates.crt
+      changed_when: false
+      when: ansible_facts['os_family'] | default('') not in ['RedHat', 'Fedora']
+
+    # ── End CA Trust ────────────────────────────────────────────────────────
+
+    - name: Create a track file
+      ansible.builtin.file:
+        path: "{{ track_file_path }}"
+        state: touch
+        mode: "{{ logs_dir_permission }}"
+
+    - name: Record current timestamp in track file
+      ansible.builtin.copy:
+        dest: "{{ track_file_path }}"
+        content: "Timestamp: {{ ansible_date_time.iso8601 }}"
+        mode: "{{ logs_dir_permission }}"
 
     - name: Create a track file
       ansible.builtin.file:

prepare_oim/roles/deploy_containers/pulp/vars/main.yml

@@ -138,7 +138,6 @@ generate_cert_cmd: >
   -addext {{ cert_san }}
 
 pulp_cert_src: "/opt/omnia/pulp/settings/certs/pulp_webserver.crt"
-ca_trust_path: "/etc/pki/ca-trust/source/anchors/"
 
 # Usage: reload_pulp_nginx.yml
 nginx_reload_cmd: "nginx -s reload"

prepare_oim/roles/prepare_oim_validation/tasks/validate_network_spec.yml

@@ -79,14 +79,22 @@
     success_msg: "{{ admin_nic_ip_success_msg }}"
   when: fetch_oim_hostname.stdout in oim_hostname
 
-- name: Compute network address using ipcalc
-  ansible.builtin.command: "/usr/bin/ipcalc -n {{ admin_nic_ip }}/{{ admin_netmask_bits }}"
-  register: network_address_output
-  changed_when: false
+# - name: Compute network address using ipcalc
+#   ansible.builtin.command: "/usr/bin/ipcalc -n {{ admin_nic_ip }}/{{ admin_netmask_bits }}"
+#   register: network_address_output
+#   changed_when: false
+
+# - name: Extract network address
+#   ansible.builtin.set_fact:
+#     admin_net_addr: "{{ network_address_output.stdout.split('=')[1] }}"
+
+- name: Compute network address
+  ansible.builtin.set_fact:
+    network_address: "{{ (admin_nic_ip + '/' + (admin_netmask_bits | string)) | ansible.utils.ipaddr('network') }}"
 
-- name: Extract network address
+- name: Set admin_net_addr from computed network address
   ansible.builtin.set_fact:
-    admin_net_addr: "{{ network_address_output.stdout.split('=')[1] }}"
+    admin_net_addr: "{{ network_address }}"
 
 - name: Initialize network_interface_type
   ansible.builtin.set_fact:

provision/roles/k8s_config/tasks/create_k8s_config_nfs.yml

@@ -200,15 +200,36 @@
     nfs_subdir_external_provisioner_pkg: "{{ k8s_packages_json['service_kube_control_plane_first']['cluster'] | selectattr('type', 'equalto', 'tarball') | selectattr('package', 'search', 'nfs-subdir-external-provisioner') | map(attribute='package') | join }}" # noqa: yaml[line-length]
     whereabouts_pkg: "{{ k8s_packages_json['service_kube_control_plane_first']['cluster'] | selectattr('type', 'equalto', 'git') | selectattr('package', 'search', 'whereabouts') | map(attribute='package') | join }}" # noqa: yaml[line-length]
 
+- name: Detect CA trust anchors directory
+  ansible.builtin.set_fact:
+    ca_trust_anchors_dir: >-
+      {{ '/etc/pki/ca-trust/source/anchors'
+         if ansible_facts['os_family'] | default('') in ['RedHat', 'Fedora']
+         else '/usr/local/share/ca-certificates' }}
+  when: ca_trust_anchors_dir is not defined
+
+- name: Set anchors path
+  ansible.builtin.set_fact:
+    anchors_path: "{{ ca_trust_anchors_dir }}/pulp_webserver.crt"
+  when: anchors_path is not defined
+
 - name: Copy pulp webserver certificate to target host
   ansible.builtin.copy:
     src: "{{ pulp_webserver_cert_path }}"
     dest: "{{ anchors_path }}"
     mode: "{{ file_mode }}"
   become: true
 
+- name: Detect CA trust update command
+  ansible.builtin.set_fact:
+    ca_trust_cmd: >-
+      {{ 'update-ca-trust'
+         if ansible_facts['os_family'] | default('') in ['RedHat', 'Fedora']
+         else 'update-ca-certificates' }}
+  when: ca_trust_cmd is not defined
+
 - name: Update CA trust on target host
-  ansible.builtin.command: update-ca-trust
+  ansible.builtin.command: "{{ ca_trust_cmd }}"
   register: update_ca
   changed_when: false
 

provision/roles/k8s_config/vars/main.yml

@@ -27,7 +27,6 @@ whereabouts_git_url: "{{ offline_git_path }}/{{ whereabouts_pkg }}/{{ whereabout
 file_mode: "0644"
 ha_config_file: "{{ input_project_dir }}/high_availability_config.yml"
 pulp_webserver_cert_path: "/opt/omnia/pulp/settings/certs/pulp_webserver.crt"
-anchors_path: "/etc/pki/ca-trust/source/anchors/pulp_webserver.crt"
 
 # Usage: create_node_dir.yml
 nodes_yaml: "{{ hostvars['localhost']['oim_shared_path'] }}/omnia/openchami/workdir/nodes/nodes.yaml"