forked from infra/ansible
secure-boot: clean up old bkernel role and add 2 more builders
We are no longer using the bkernel role (using the old card thats in buildhw-x86-01), so this removes that role and mentions of it. Also, because we are urgently building kernels all the time now, add one more buildhw-x86 and one more buildhw-a64 to secure-boot channel so we can build more/faster kernels. Signed-off-by: Kevin Fenzi <kevin@scrye.com>
This commit is contained in:
parent
73dc88c487
commit
af80a6a3a0
10 changed files with 10 additions and 113 deletions
|
|
@ -401,10 +401,9 @@ buildvm-ppc64le-30.rdu3.fedoraproject.org
|
|||
buildvm-ppc64le-31.rdu3.fedoraproject.org
|
||||
buildvm-ppc64le-32.rdu3.fedoraproject.org
|
||||
|
||||
[bkernel]
|
||||
buildhw-x86-01.rdu3.fedoraproject.org
|
||||
|
||||
[secureboot]
|
||||
buildhw-x86-01.rdu3.fedoraproject.org
|
||||
buildhw-a64-01.rdu3.fedoraproject.org
|
||||
buildhw-x86-02.rdu3.fedoraproject.org
|
||||
buildhw-a64-02.rdu3.fedoraproject.org
|
||||
|
||||
|
|
@ -467,7 +466,7 @@ buildvm
|
|||
buildvm_aarch64
|
||||
buildvm_ppc64le
|
||||
buildvm_s390x
|
||||
bkernel
|
||||
secureboot
|
||||
|
||||
[builders_stg:children]
|
||||
buildhw_ppc64le_stg
|
||||
|
|
|
|||
|
|
@ -817,7 +817,7 @@ colo_virt
|
|||
value
|
||||
staging
|
||||
builders
|
||||
bkernel
|
||||
secureboot
|
||||
buildvmhost
|
||||
|
||||
[groupc]
|
||||
|
|
|
|||
|
|
@ -1,10 +1,10 @@
|
|||
---
|
||||
- import_playbook: "/srv/web/infra/ansible/playbooks/include/happy_birthday.yml"
|
||||
vars:
|
||||
myhosts: "buildhw:bkernel:buildhw_stg"
|
||||
myhosts: "buildhw:buildhw_stg"
|
||||
|
||||
- name: make koji builder(s) on raw hw
|
||||
hosts: buildhw:bkernel:buildhw_stg
|
||||
hosts: buildhw:buildhw_stg
|
||||
remote_user: root
|
||||
gather_facts: true
|
||||
|
||||
|
|
@ -67,18 +67,14 @@
|
|||
|
||||
- koji_builder
|
||||
|
||||
- role: bkernel
|
||||
when: "'bkernel' in group_names"
|
||||
|
||||
- role: siguldry/pesign_bridge
|
||||
when: inventory_hostname.startswith(('buildhw-x86-02','buildhw-a64-02'))
|
||||
|
||||
- { role: linux-system-roles.nbde_client, when: "inventory_hostname.startswith(('bkernel', 'buildhw'))" }
|
||||
- { role: serial-console, when: "inventory_hostname.startswith(('bkernel', 'buildhw-x86'))" }
|
||||
- { role: linux-system-roles.nbde_client, when: "inventory_hostname.startswith(('buildhw'))" }
|
||||
- { role: serial-console, when: "inventory_hostname.startswith(('buildhw-x86'))" }
|
||||
- hosts
|
||||
- ipa/client
|
||||
- role: sudo
|
||||
when: not inventory_hostname.startswith(('bkernel', 'buildhw-x86-01.rdu3'))
|
||||
|
||||
- role: keytab/service
|
||||
kt_location: /etc/kojid/kojid.keytab
|
||||
|
|
|
|||
|
|
@ -33,7 +33,6 @@
|
|||
}
|
||||
- ipa/client
|
||||
- role: sudo
|
||||
when: not inventory_hostname.startswith('bkernel') and env == 'production'
|
||||
- koji_builder
|
||||
- role: nfs/client
|
||||
mnt_dir: '/mnt/koji/ostree'
|
||||
|
|
|
|||
|
|
@ -46,7 +46,7 @@
|
|||
- rootpw
|
||||
- base
|
||||
when:
|
||||
- not inventory_hostname.startswith(('buildvm-','buildhw-','bkernel','compose'))
|
||||
- not inventory_hostname.startswith(('buildvm-','buildhw-','compose'))
|
||||
- not inventory_hostname.startswith('copr')
|
||||
|
||||
- name: Add ansible root key
|
||||
|
|
|
|||
|
|
@ -1,2 +0,0 @@
|
|||
unset HISTFILE
|
||||
set HISTSIZE=0
|
||||
|
|
@ -1,2 +0,0 @@
|
|||
kojibuilder
|
||||
pesign
|
||||
|
|
@ -1,70 +0,0 @@
|
|||
---
|
||||
- name: Add pkgs for bkernel boxes
|
||||
ansible.builtin.package:
|
||||
state: present
|
||||
name:
|
||||
- pesign
|
||||
- ccid
|
||||
- pcsc-lite
|
||||
- pcsc-lite-libs
|
||||
- opensc
|
||||
- nss-tools
|
||||
tags:
|
||||
- bkernel
|
||||
|
||||
- name: Enable pcscd
|
||||
service: name=pcscd state=started enabled=true
|
||||
tags:
|
||||
- bkernel
|
||||
|
||||
- name: Setup opensc in pcscd
|
||||
ansible.builtin.shell: modutil -dbdir /etc/pki/pesign -list | grep -q OpenSC || modutil -force -dbdir /etc/pki/pesign -add opensc -libfile /usr/lib64/pkcs11/opensc-pkcs11.so
|
||||
check_mode: no
|
||||
changed_when: "1 != 1"
|
||||
tags:
|
||||
- bkernel
|
||||
|
||||
- name: Setup pesign users config
|
||||
ansible.builtin.copy: src=pesign-users dest=/etc/pesign/users mode=0600 owner=root group=root
|
||||
tags:
|
||||
- bkernel
|
||||
|
||||
- name: Enable pesign
|
||||
service: name=pesign state=started enabled=true
|
||||
tags:
|
||||
- bkernel
|
||||
|
||||
- name: /var/run/pesign directory perms (kojibuilder)
|
||||
acl: path=/var/run/pesign entity=kojibuilder etype=user permissions=rwx recursive=true state=present
|
||||
tags:
|
||||
- bkernel
|
||||
|
||||
- name: /var/run/pesign directory perms (pesign)
|
||||
acl: path=/var/run/pesign default=true entity=pesign etype=group permissions=rwx recursive=true state=present
|
||||
tags:
|
||||
- bkernel
|
||||
|
||||
- name: /var/run/pesign socket perms (kojibuilder)
|
||||
acl: path=/var/run/pesign/socket entity=kojibuilder etype=user permissions=rwx recursive=true state=present
|
||||
tags:
|
||||
- bkernel
|
||||
|
||||
- name: /var/run/pesign socket perms (pesign)
|
||||
acl: path=/var/run/pesign/socket default=true entity=pesign etype=group permissions=rwx recursive=true state=present
|
||||
tags:
|
||||
- bkernel
|
||||
|
||||
- name: When you awake you will remember nothing
|
||||
ansible.builtin.copy: src=history_off.sh dest=/etc/profile.d/history_off.sh mode=0644
|
||||
tags:
|
||||
- bkernel
|
||||
|
||||
- name: Mock site-defaults.cfg
|
||||
ansible.builtin.template:
|
||||
src: bkernel-site-defaults.cfg
|
||||
dest: /etc/mock/site-defaults.cfg
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: mock
|
||||
tags:
|
||||
- bkernel
|
||||
|
|
@ -1,23 +0,0 @@
|
|||
# mount the pesign socket into the chroot
|
||||
config_opts['plugin_conf']['bind_mount_opts']['dirs'].append(('/var/run/pesign', '/var/run/pesign' ))
|
||||
config_opts['nspawn_args'] += ['--bind=/var/run/pesign']
|
||||
config_opts['plugin_conf']['package_state_enable'] = False
|
||||
config_opts['macros']['%bugurl'] = 'https://bugz.fedoraproject.org/%name'
|
||||
#config_opts['nosync'] = True
|
||||
#config_opts['nosync_force'] = True
|
||||
config_opts['dnf_common_opts'] = ['--setopt=install_weak_deps=0']
|
||||
config_opts['environment']['LANG'] = 'C.UTF-8'
|
||||
config_opts['use_bootstrap'] = False
|
||||
config_opts['dnf_warning'] = False
|
||||
|
||||
# dnf group install with '--allowerasing' is still to be released:
|
||||
# https://github.com/rpm-software-management/dnf5/pull/1174
|
||||
config_opts["dnf5_avoid_opts"] = {
|
||||
"group": ["--allowerasing"],
|
||||
}
|
||||
|
||||
config_opts['plugin_conf']['rpmautospec_enable'] = True
|
||||
config_opts['plugin_conf']['rpmautospec_opts'] = {
|
||||
'requires': ['rpmautospec'],
|
||||
'cmd_base': ['/usr/bin/rpmautospec', 'process-distgit'],
|
||||
}
|
||||
|
|
@ -226,7 +226,7 @@
|
|||
|
||||
- name: Mock site-defaults.cfg
|
||||
ansible.builtin.template: src=builders/site-defaults.cfg dest=/etc/mock/site-defaults.cfg mode=0644 owner=root group=mock
|
||||
when: not inventory_hostname.startswith(('bkernel'))
|
||||
when: "'secureboot' not in group_names"
|
||||
tags:
|
||||
- koji_builder
|
||||
- site-defaults
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue