sync to staging

build_image_aarch64/build_image_aarch64.yml

@@ -13,6 +13,9 @@
 # limitations under the License.
 ---
 
+- name: Check if upgrade is in progress
+  ansible.builtin.import_playbook: ../utils/upgrade_checkup.yml
+
 - name: Set_fact for fetch omnia config credentials
   hosts: localhost
   connection: local

build_image_aarch64/roles/image_creation/vars/main.yml

@@ -1,4 +1,4 @@
-# Copyright 2025 Dell Inc. or its subsidiaries. All Rights Reserved.
+# Copyright 2026 Dell Inc. or its subsidiaries. All Rights Reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -17,6 +17,7 @@ input_project_dir: "{{ hostvars['localhost']['input_project_dir'] }}"
 omnia_metadata_file: "/opt/omnia/.data/oim_metadata.yml"
 dir_permissions_644: "0644"
 dir_permissions_755: "0755"
+aarch64_local_tag: "aarch64-image-builder/ochami"
 openchami_dir: "/opt/omnia/openchami"
 openchami_clone_path: /opt/omnia/openchami/deployment-recipes
 job_retry: "120"
@@ -32,7 +33,7 @@ ochami_compute_mounts:
   - -v {{ openchami_work_dir }}/images/rhel-{{ item.key }}-{{ rhel_tag }}.yaml:/home/builder/config.yaml:z
 ochami_aarch64_image:
   - --entrypoint /bin/bash
-  - localhost/arm-image/ochami
+  - "localhost/{{ aarch64_local_tag }}"
 ochami_base_command:
   - -c 'update-ca-trust extract && image-build --config /home/builder/config.yaml --log-level DEBUG'
 

build_image_aarch64/roles/prepare_arm_node/tasks/main.yml

@@ -167,32 +167,42 @@
 
 - name: Build full Podman image path
   ansible.builtin.set_fact:
-    pulp_aarch_image: "{{ hostvars['localhost']['oim_pxe_ip'] }}:2225/dellhpcomniaaisolution/image-build-aarch64:1.1"
-
-- name: Pull aarch64 image using Podman
-  ansible.builtin.command:
-    cmd: "podman pull {{ pulp_aarch_image }}"
-  register: podman_pull_result
-  ignore_errors: true
-  changed_when: false
+    pulp_aarch_image: "{{ hostvars['localhost']['oim_pxe_ip'] }}:2225/{{ pulp_aarch64_image_name }}"
+
+- name: Pull and tag aarch64 image
+  block:
+    - name: Pull aarch64 image using Podman
+      containers.podman.podman_image:
+        name: "{{ pulp_aarch_image }}"
+        state: present
+      register: podman_pull_result
+      retries: "{{ pull_image_retries }}"
+      delay: "{{ pull_image_delay }}"
+      until: podman_pull_result is not failed
+      changed_when: false
+
+    - name: Tag pulled image
+      containers.podman.podman_tag:
+        image: "{{ pulp_aarch_image }}"
+        target_names:
+          - "{{ aarch64_local_tag }}"
+      changed_when: false
+
+  rescue:
+    - name: Fail if Podman pull failed
+      ansible.builtin.fail:
+        msg: "Failed to pull image {{ pulp_aarch_image }}"
+
+- name: Check if regctl binary exists
+  ansible.builtin.stat:
+    path: "{{ ochami_aarch_64_dir }}/regctl"
+  register: regctl_stat
+  delegate_to: localhost
 
-- name: Fail if Podman pull failed
+- name: Fail if regctl binary not found
   ansible.builtin.fail:
-    msg: "{{ aarch64_image_fail_msg }}"
-  when: podman_pull_result.rc != 0
-
-- name: Tag pulled image
-  ansible.builtin.command:
-    cmd: "podman tag {{ pulp_aarch_image }} arm-image/ochami"
-  when: podman_pull_result.rc == 0
-  changed_when: false
-
-- name: Download regctl binary to NFS shared path
-  ansible.builtin.get_url:
-    url: "{{ aarch64_regctl_url }}"
-    dest: "{{ ochami_aarch_64_dir }}/regctl"
-    mode: "{{ hostvars['localhost']['dir_permissions_755'] }}"
-  delegate_to: localhost
+    msg: "{{ regctl_not_found_msg }}"
+  when: not regctl_stat.stat.exists
 
 - name: Copy regctl binary to /usr/local/bin on target host
   ansible.builtin.copy:

build_image_aarch64/roles/prepare_arm_node/vars/main.yml

@@ -1,4 +1,4 @@
-# Copyright 2025 Dell Inc. or its subsidiaries. All Rights Reserved.
+# Copyright 2026 Dell Inc. or its subsidiaries. All Rights Reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -15,10 +15,13 @@
 
 # input files
 input_project_dir: "{{ hostvars['localhost']['input_project_dir'] }}"
+pulp_aarch64_image_name: "dellhpcomniaaisolution/image-build-aarch64:1.1"
+aarch64_local_tag: "aarch64-image-builder/ochami"
+pull_image_retries: "3"
+pull_image_delay: "10"
 network_spec: "{{ input_project_dir }}/network_spec.yml"
 ochami_aarch_64_dir: "/opt/omnia/openchami/aarch64"
 pulp_repo_store_path: "{{ ochami_aarch_64_dir }}/pulp.repo"
-aarch64_regctl_url: "https://github.com/regclient/regclient/releases/latest/download/regctl-linux-arm64"
 pulp_repo_file_path: "/etc/yum.repos.d/pulp.repo"
 pulp_webserver_cert_path: "/opt/omnia/pulp/settings/certs/pulp_webserver.crt"
 anchors_path: "/etc/pki/ca-trust/source/anchors/pulp_webserver.crt"
@@ -39,3 +42,6 @@ aarch64_image_fail_msg: >
   Unable to pull the Ochami aarch64 image builder image.
   Make sure you have added the default package for aarch64 in the software_config.json file and ran local_repo.yml.
   If not, add that package and rerun local_repo.yml.
+regctl_not_found_msg: >
+  regctl binary not found at {{ ochami_aarch_64_dir }}/regctl.
+  Please run prepare_oim.yml playbook to download the regctl binary.

build_image_x86_64/build_image_x86_64.yml

@@ -1,4 +1,4 @@
-# Copyright 2025 Dell Inc. or its subsidiaries. All Rights Reserved.
+# Copyright 2026 Dell Inc. or its subsidiaries. All Rights Reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -13,6 +13,9 @@
 # limitations under the License.
 ---
 
+- name: Check if upgrade is in progress
+  ansible.builtin.import_playbook: ../utils/upgrade_checkup.yml
+
 - name: Set_fact for fetch omnia config credentials
   hosts: localhost
   connection: local
@@ -80,7 +83,7 @@
     - name: Tag OpenCHAMI image
       ansible.builtin.include_role:
         name: image_creation
-        tasks_from: build_image_tag.yml
+        tasks_from: prepare_pulp_image.yml
 
 - name: OpenCHAMI build image for x86_64
   hosts: localhost

build_image_x86_64/roles/image_creation/tasks/prepare_pulp_image.yml

@@ -0,0 +1,79 @@
+# Copyright 2026 Dell Inc. or its subsidiaries. All Rights Reserved.
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+---
+
+# Load network specification
+- name: Load network spec file
+  ansible.builtin.include_vars:
+    file: "{{ network_spec }}"
+  register: include_network_spec
+  no_log: true
+
+- name: Fail if network spec cannot be loaded
+  ansible.builtin.fail:
+    msg: "{{ network_spec_syntax_fail_msg }} Error: {{ include_network_spec.message }}"
+  when: include_network_spec is failed
+
+# Parse network spec data
+- name: Parse network spec
+  ansible.builtin.set_fact:
+    network_data: "{{ network_data | default({}) | combine({item.key: item.value}) }}"
+  with_dict: "{{ Networks }}"
+
+# Set PXE IP fact
+- name: Set PXE IP fact
+  ansible.builtin.set_fact:
+    oim_pxe_ip: "{{ network_data.admin_network.primary_oim_admin_ip }}"
+    cacheable: true
+
+# Copy pulp certificate and update CA trust
+- name: Copy pulp webserver certificate to anchors
+  ansible.builtin.copy:
+    src: "{{ pulp_webserver_cert_path }}"
+    dest: "{{ anchors_path }}"
+    mode: "{{ dir_permissions_644 }}"
+  become: true
+
+- name: Update CA trust
+  ansible.builtin.command: update-ca-trust
+  register: update_ca
+  changed_when: false
+
+- name: Build full Podman image path for x86_64
+  ansible.builtin.set_fact:
+    pulp_x86_image: "{{ oim_pxe_ip }}:2225/{{ pulp_x86_64_image_name }}"
+
+- name: Pull and tag x86_64 image
+  block:
+    - name: Pull x86_64 image using Podman
+      containers.podman.podman_image:
+        name: "{{ pulp_x86_image }}"
+        state: present
+      register: pull_result
+      retries: "{{ pull_image_retries }}"
+      delay: "{{ pull_image_delay }}"
+      until: pull_result is not failed
+      changed_when: false
+
+    - name: Tag pulled image for x86_64 build
+      containers.podman.podman_tag:
+        image: "{{ pulp_x86_image }}"
+        target_names:
+          - "{{ x86_64_local_tag }}"
+      changed_when: false
+
+  rescue:
+    - name: Fail if Podman pull failed
+      ansible.builtin.fail:
+        msg: "Failed to pull image {{ pulp_x86_image }}."

build_image_x86_64/roles/image_creation/vars/main.yml

@@ -12,7 +12,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 ---
-image_build_el10: "docker.io/dellhpcomniaaisolution/image-build-el10:1.0"
+pulp_x86_64_image_name: "dellhpcomniaaisolution/image-build-el10:1.0"
+x86_64_local_tag: "x86_64-image-builder/ochami"
 pull_image_retries: "3"
 pull_image_delay: "10"
 input_project_dir: "{{ hostvars['localhost']['input_project_dir'] }}"
@@ -23,6 +24,9 @@ openchami_dir: "/opt/omnia/openchami"
 openchami_clone_path: /opt/omnia/openchami/deployment-recipes
 job_retry: "120"
 job_delay: "30"
+network_spec: "{{ input_project_dir }}/network_spec.yml"
+pulp_webserver_cert_path: "/opt/omnia/pulp/settings/certs/pulp_webserver.crt"
+anchors_path: "/etc/pki/ca-trust/source/anchors/pulp_webserver.crt"
 openchami_work_dir: "{{ oim_shared_path }}/omnia/openchami/workdir"
 ochami_mounts:
   - --user 0 --privileged
@@ -35,7 +39,7 @@ ochami_compute_mounts:
 
 ochami_x86_64_image:
   - --entrypoint /bin/bash
-  - docker.io/dellhpcomniaaisolution/image-build-el10:1.0
+  - "localhost/{{ x86_64_local_tag }}"
 ochami_base_command:
   - -c 'update-ca-trust extract && image-build --config /home/builder/config.yaml --log-level DEBUG'
 
@@ -54,3 +58,5 @@ compute_image_failure_msg: |
 # build_compute_image.yml
 openchami_compute_image_vars_template: "{{ role_path }}/templates/compute_images_templates.j2"
 openchami_compute_image_vars_path: "/opt/omnia/openchami/compute_images_template.yaml"
+
+network_spec_syntax_fail_msg: "Failed to load network_spec.yml due to syntax error"

common/library/module_utils/input_validation/common_utils/config.py

@@ -33,6 +33,17 @@
 OMNIA_ENTITLEMENT_PATH = '/opt/omnia/rhel_repo_certs/*.pem'
 OMNIA_REDHAT_REPO = '/opt/omnia/rhel_repo_certs/redhat.repo'
 
+# Supported functional groups for additional_packages per architecture
+ADDITIONAL_PACKAGES_SUPPORTED_SUBGROUPS = {
+    "x86_64": [
+        "slurm_control_node", "slurm_node", "login_node", "login_compiler_node",
+        "service_kube_control_plane", "service_kube_control_plane_first", "service_kube_node"
+    ],
+    "aarch64": [
+        "slurm_control_node", "slurm_node", "login_node", "login_compiler_node"
+    ]
+}
+
 # dict to hold the file names. If any file's name changes just change it here.
 files = {
     "local_repo_config": "local_repo_config.yml",
@@ -147,6 +158,7 @@
     "rpm": ["package", "repo_name"],
     "rpm_list": ["package_list", "repo_name"],
     "rpm_file": ["package", "url"],
+    "rpm_repo": ["package", "repo_name"],
     "ansible_galaxy_collection": ["package", "version"],
     "git": ["package", "version", "url"],
     "image": ["package", ["tag", "digest"]],  # Special: one of tag or digest

common/library/module_utils/input_validation/common_utils/en_us_validation_msg.py

@@ -1,4 +1,4 @@
-# Copyright 2025 Dell Inc. or its subsidiaries. All Rights Reserved.
+# Copyright 2026 Dell Inc. or its subsidiaries. All Rights Reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -384,6 +384,8 @@ def server_spec_network_key_fail_msg(nic_device):
                             "roles_config.yml")
 FEILD_MUST_BE_EMPTY = "feild must be empty."
 DUPLICATE_VIRTUAL_IP = "is already used. Please give unique virtual ip address"
+VIRTUAL_IP_SAME_AS_PRIMARY_OIM_ADMIN_IP = ("virtual_ip_address provided in high_availability_config.yml must not be the same as primary_oim_admin_ip in network_spec.yml. "
+                                           "Please provide a different virtual IP address.")
 INVALID_PASSIVE_NODE_SERVICE_TAG = "active node and passive node service tag cannot be same."
 GROUP_NOT_FOUND = "is not defined in the roles_config.yml. Please define the group in roles_config.yml"
 ROLE_NODE_FOUND = "is not defined in roles_config.yml. Please define the role in roles_config.yml"