ocpvirt-rhel9-imagelisted

Point this environment's OpenShift Virtualization at the published CIS L1 hardened RHEL 9 golden containerdisk. Creates a DataImportCron that populates the rhel9-cis-l1 DataSource alongside the stock rhel9, so Terraform clones the hardened image by default. No pull secret needed — the quay repo is public. Fully reversible. Runs playbooks/link_rhel9_image.yml. TRIGGER when: the user asks to enable or update the hardened RHEL 9 image, wants to repoint to a new RHEL 9 golden image tag, says VMs are booting the stock RHEL 9 cloud image instead of the hardened one, asks about the rhel9-cis-l1 DataSource, or asks about issue #202. SKIP: if the user wants the WINDOWS golden image — that is ocpvirt-windows-image — or wants to BUILD the golden image, which is ericcames/image.builder.pipeline.
ericcames/sales.demos · ★ 1 · DevOps & Infrastructure · score 67

Install: claude install-skill ericcames/sales.demos

# ocpvirt-rhel9-image Links an environment to the published RHEL 9 CIS L1 hardened golden image. Takes about **2 minutes** for the cron to import and the DataSource to report Ready. This skill contains **no logic**. All the work is in [`playbooks/link_rhel9_image.yml`](../../../playbooks/link_rhel9_image.yml). ## What it does 1. Reads the HyperConverged CR and asserts CNV is installed. 2. Adds a `rhel9-cis-l1-image-cron` DataImportCron template to the HyperConverged CR, pointing at the containerdisk in `quay_rhel9_image`. 3. Waits for the `rhel9-cis-l1` DataSource to report `Ready=True`. 4. Verifies the backing volume (VolumeSnapshot or PVC) is usable. 5. Reports the result. ## This is the consumer half. It does not build anything. | | Owns | |---|---| | **This skill** | Pointing a cluster at the published image | | The producer (`ericcames/image.builder.pipeline`) | Building and publishing the containerdisk | The contract between them is one string: `quay_rhel9_image` in `inventory/group_vars/<env>/connection.yml`. The playbook asserts it is non-empty and rejects placeholder values. ## No pull secret needed The quay repository is **public** (#208), so CDI pulls the image without credentials. This is the key difference from the Windows twin (`ocpvirt-windows-image`), which needs a pull secret because Windows media cannot be redistributed publicly. ## Why a separate DataSource The stock `rhel9` DataSource is managed by CNV's built-in DataImportCron, which pulls t