4.2 Prefetch (Hermeto mapping)

On this page you prove that the compile step resolves Lightwell libraries from a cache that was filled inside the trust boundary, before the image build runs.

Track 4 is the hermetic build. This is the second page. 4.1 Source forbid-list removed the public fetches from the active files. Konflux calls the prefetch step Hermeto, also known as Cachi2, and runs it inside a hermetic Buildah sandbox. This cluster does not install Konflux. The same control is Tekton Task prefetch-dependencies in namespace lightwell-tasks: Maven dependency:go-offline, then mvn -o, against in-cluster Nexus. The image build stays an OpenShift BuildConfig. The seeded pipeline spring-boot-lw-poc-build-sign does not call the Task yet. You add it.

Why this control exists

A hermetic build means the compile cannot reach the internet for jars. The Task fills .m2-offline from the enterprise proxy. The Dockerfile copies that directory and runs Maven offline. An undeclared dependency fails at mvn -o, because the cache has nothing to serve it. That is the control a customer calls Hermeto on hosted Konflux.

Task order is part of the control. Prefetch runs after lightwell-dep-gate and before openshift-build. A Task that runs after the image build, or a mvn without -o, still hits the network. After 4.3 that network is gone.

Lightwell Clearinghouse Premier member GAVs prefetch the same way. They are already in Nexus. The Task does not call packages.redhat.com.

Konflux Hermeto versus workshop Task prefetch-dependencies

The figure is the name mapping. The left box is Hermeto, which is not installed here. The right box is Task prefetch-dependencies. Pulling quay.io/konflux-ci/hermeto, or renaming the cluster object to hermeto, fails the Check. The full term map is Appendix: Konflux mapping.

A Python application prefetches with pip download or pip install --offline against an internal --index-url on Nexus. The worked example below uses pip so a paste fails. This Check is prefetch-dependencies and mvn -o.

In a customer engagement on hosted Konflux, the product name is Hermeto. You are proving the control: an offline resolve from a trusted proxy, implemented here as a namespaced Task.

Learning objectives

By the end of this module, you will be able to:

  • Insert Task prefetch-dependencies after lightwell-dep-gate and before openshift-build

  • Copy .m2-offline into the image build and run mvn -o

  • Show that settings.xml no longer points at Maven Central

  • Map the customer-engagement name Hermeto to this Task, including for a Premier GAV already in the proxy

The Task you wire

Success is a Task object in namespace lightwell-tasks, and a YAML snippet that shows the parameter shape. The snippet is documentation. The scored pipeline uses the cluster Task name prefetch-dependencies.

Read the Task and the snippet
oc -n lightwell-tasks get task prefetch-dependencies
oc -n lightwell-tasks get configmap prefetch-dependencies-docs \
  -o jsonpath='{.data.example-pipeline-snippet\.yaml}'

The block below is the same idea under the Konflux name, on the wrong ecosystem, and in the wrong order. A paste of this task fails the Check.

# Worked example ONLY — Konflux name, wrong ecosystem, wrong order.
- name: hermeto
  runAfter: [acs-image-check]
  taskRef:
    name: hermeto
  params:
    - name: pip-requirements
      value: requirements.txt

Your change

In .tekton/pipeline.yaml on lw-student/spring-boot-lw-poc, insert a task after lightwell-dep-gate and before openshift-build. Resolve it from the cluster: name: prefetch-dependencies, namespace: lightwell-tasks. Change the openshift-build runAfter so it includes that prefetch task.

The Task writes .m2-offline into the source workspace. oc start-build --from-dir puts that directory in the Docker build context. The Dockerfile still has to COPY it. Copy pom.xml, src, settings.xml, and .m2-offline, then run Maven offline. The directory name is userinfo prefetch_dir, which defaults to .m2-offline, and it has to match the Dockerfile WORKDIR.

Prefetch is the third task in spring-boot-lw-poc-build-sign. openshift-build runs after it. The crossed-out task is the paste that fails the Check.

Pipeline spring-boot-lw-poc-build-sign with prefetch-dependencies before openshift-build 
COPY pom.xml ./
COPY src ./src
COPY settings.xml ./
COPY .m2-offline ./.m2-offline
RUN mvn -B -o -s settings.xml -Dmaven.repo.local=.m2-offline -DskipTests package

Commit and push that pipeline and Dockerfile. Then apply the Pipeline in the build namespace so 4.4 can create a PipelineRun. Success is pipeline.tekton.dev/spring-boot-lw-poc-build-sign applied. The apply registers the object. It does not pull Task images. Those pulls happen on the first PipelineRun. The prefetch Task image is still UBI OpenJDK on registry.access.redhat.com. Hermetic, on this page, means in-cluster Nexus plus mvn -o, and the ImageStream FROM lines from 4.1. This apply is not an image cache you complete before 4.3 Build NetworkPolicy.

Apply the Pipeline
BUILD_NS="$(oc -n gitea get configmap demo-userinfo-gitea -o jsonpath='{.data.student_build_namespace}')"
cd /tmp/spring-boot-lw-poc
oc -n "${BUILD_NS}" apply -f .tekton/rbac.yaml
oc -n "${BUILD_NS}" apply -f .tekton/pipeline.yaml

Check

Success is a live Pipeline that lists prefetch-dependencies before openshift-build, a committed settings.xml with no repo.maven.apache.org, and a Dockerfile that copies .m2-offline and runs mvn with -o. An empty prefetch directory, or a dependency the pom does not declare, fails later when mvn -o runs.

BUILD_NS="$(oc -n gitea get configmap demo-userinfo-gitea -o jsonpath='{.data.student_build_namespace}')"
oc -n "${BUILD_NS}" get pipeline spring-boot-lw-poc-build-sign -o yaml | grep -A20 prefetch-dependencies | head -30
cd /tmp/spring-boot-lw-poc
git show HEAD:settings.xml | grep repo.maven.apache.org && echo 'STILL HAS CENTRAL' || echo 'Central gone'
git show HEAD:Dockerfile | grep -E 'mvn.*-o'
git show HEAD:Dockerfile | grep -E 'COPY .*m2-offline'
Fill the report

The Job also grades ConfigMap report-09-prefetch key hermeto_maps_to. Set it to prefetch-dependencies. Empty or REPLACE_ME fails even if cluster state is correct. Do not copy validate-docs.

oc -n lw-poc-validate edit configmap report-09-prefetch

The scored Check is Job validate-09-prefetch in lw-poc-validate. Direct nav URLs still work (honor system). Unlimited retries. There is no Solve.

Run the Validate Job
oc -n lw-poc-validate delete job validate-09-prefetch --ignore-not-found
TPL='job-09.yaml'
oc -n lw-poc-validate get configmap validate-job-templates \
  -o go-template="{{ index .data \"${TPL}\" }}" | oc create -f -
oc -n lw-poc-validate logs -f job/validate-09-prefetch

Expect CHECK PASSED: before you continue. CHECK FAILED: names the object to fix. Delete the Job and create it again as often as you need.

The Validate Job grades the wired Task and the offline Maven lines. The next page still opens if you skip this one. Lightwell Network and Clearinghouse Premier GAVs have to already be in the proxy. Applying the Pipeline does not pull the Task images.

Official documentation

Key takeaways

  • Hermetic prefetch on this cluster is Task prefetch-dependencies. Konflux is not installed.

  • The Task runs before openshift-build, and the Dockerfile consumes .m2-offline with mvn -o.

  • The GAVs, including a Premier member GAV, are already in the proxy when prefetch runs.