4.2 Prefetch (Hermeto mapping)

Overview

Add Tekton Task prefetch-dependencies. Maven go-offline then mvn -o against in-cluster Nexus. This is not a Konflux Hermeto install. Image build stays OpenShift BuildConfig.

The seeded pipeline spring-boot-lw-poc-build-sign does not call this Task. You add it.

Why it matters

Compile must not reach the internet for jars. Lightwell GAVs prefetch from the enterprise proxy into .m2-offline. Then mvn -o consumes only that cache. Undeclared deps fail.

A Task that runs too late, or a mvn without -o, still hits the network. After 4.3 that network is gone. Clearinghouse Premier member GAVs prefetch the same way. They must already be in Nexus. Prefetch does not call packages.redhat.com itself.

What does it solve

  • Dependencies fetched from the internet at build time

  • A Task that runs too late

  • mvn without -o

Mapping vs Konflux

Konflux Hermeto versus workshop Task prefetch-dependencies

Do not pull quay.io/konflux-ci/hermeto. Do not rename the cluster object hermeto. The term map is in Konflux mapping.

Discover the Task

oc -n lightwell-tasks get task prefetch-dependencies
oc -n lightwell-tasks get configmap prefetch-dependencies-docs \
  -o jsonpath='{.data.example-pipeline-snippet\.yaml}'

Worked example (not the Check)

Named hermeto, uses pip, and runAfter: [acs-image-check] (too late). Paste-identical copy fails.

# Worked example ONLY — Konflux name, wrong ecosystem, wrong order.
- name: hermeto
  runAfter: [acs-image-check]
  taskRef:
    name: hermeto
  params:
    - name: pip-requirements
      value: requirements.txt

Your change: add the Task; Dockerfile mvn -o

  1. In Gitea .tekton/pipeline.yaml on lw-student/spring-boot-lw-poc, insert a task after lightwell-dep-gate and before openshift-build. Use cluster resolver, name: prefetch-dependencies, namespace: lightwell-tasks. Change openshift-build runAfter to include prefetch.

  2. Prefetch writes .m2-offline into the source workspace. Binary oc start-build --from-dir only puts that directory in the Docker context. COPY it (and settings.xml if you pass -s) into the build stage, then switch RUN mvn … package to offline. Paths must match the Task’s prefetch dir (userinfo prefetch_dir, default .m2-offline) and the Dockerfile WORKDIR:

COPY pom.xml ./
COPY src ./src
COPY settings.xml ./
COPY .m2-offline ./.m2-offline
RUN mvn -B -o -s settings.xml -Dmaven.repo.local=.m2-offline -DskipTests package

  1. Commit and push. Apply the Pipeline (not yet the successful 4.4 run) in lw-poc-build if it is not applied:

BUILD_NS="$(oc -n gitea get configmap demo-userinfo-gitea -o jsonpath='{.data.student_build_namespace}')"
cd /tmp/spring-boot-lw-poc
oc -n "${BUILD_NS}" apply -f .tekton/rbac.yaml
oc -n "${BUILD_NS}" apply -f .tekton/pipeline.yaml

oc apply registers the Pipeline object so 4.4 can create a PipelineRun. It does not pull Task images — that happens on the first PipelineRun. The prefetch Task image is still UBI OpenJDK on registry.access.redhat.com; hermetic here is in-cluster Nexus + mvn -o, plus the 4.1 ImageStream FROM lines. Do not treat this apply as an image cache before 4.3.

Check: Task wired; Central gone

BUILD_NS="$(oc -n gitea get configmap demo-userinfo-gitea -o jsonpath='{.data.student_build_namespace}')"
oc -n "${BUILD_NS}" get pipeline spring-boot-lw-poc-build-sign -o yaml | grep -A20 prefetch-dependencies | head -30
cd /tmp/spring-boot-lw-poc
git show HEAD:settings.xml | grep repo.maven.apache.org && echo 'STILL HAS CENTRAL' || echo 'Central gone'
git show HEAD:Dockerfile | grep -E 'mvn.*-o'
git show HEAD:Dockerfile | grep -E 'COPY .*m2-offline'

Pass when the live Pipeline includes prefetch-dependencies before openshift-build, settings have no Central, and the Dockerfile COPY`s `.m2-offline and uses mvn -o. Empty prefetch dir / undeclared deps fail later on mvn -o.

Fill the report

The Job also grades ConfigMap report-09-prefetch key hermeto_maps_to. Set it to prefetch-dependencies. Empty or REPLACE_ME fails even if cluster state is correct. Do not copy validate-docs.

oc -n lw-poc-validate edit configmap report-09-prefetch

The scored Check is Job validate-09-prefetch in lw-poc-validate. Direct nav URLs still work (honor system). Unlimited retries. There is no Solve.

Run the Validate Job
oc -n lw-poc-validate delete job validate-09-prefetch --ignore-not-found
TPL='job-09.yaml'
oc -n lw-poc-validate get configmap validate-job-templates \
  -o go-template="{{ index .data \"${TPL}\" }}" | oc create -f -
oc -n lw-poc-validate logs -f job/validate-09-prefetch

Expect CHECK PASSED: before you continue. CHECK FAILED: names the object to fix. Delete the Job and create it again as often as you need.

Honor system: 4.3 still opens.

Callout: pip prefetch

A PyPI app prefetches with pip download / pip install --offline against an internal --index-url (Lightwell PyPI on Nexus), not this Maven Task. The worked example uses pip on purpose so a paste fails. This Check is prefetch-dependencies + mvn -o.

Official documentation

Key takeaways

  • TSSC hermetic prefetch is a Tekton Task on this cluster. Do not install Konflux.

  • Lightwell Network / Clearinghouse Premier GAVs must already be in the proxy. oc apply of the Pipeline does not pull Task images.

cd ~/ocp5-rhacs-showroom
bash setup/lab-cleanup.sh --module tssc-09