Fix 'include_role' usage in rabbitmq setup

Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>

rh-pre-commit.version: 2.4.0
rh-pre-commit.check-secrets: ENABLED

playbooks/openshift-apps/elnbuildsync.yml

@@ -0,0 +1,107 @@
+---
+- name: Set up the database
+  hosts: apps_dbserver_stg:apps_dbserver
+  gather_facts: no
+  become: yes
+  become_user: postgres
+  vars_files:
+    - /srv/web/infra/ansible/vars/global.yml
+    - /srv/private/ansible/vars.yml
+    - /srv/web/infra/ansible/vars/apps/elnbuildsync.yml
+    - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml
+
+  tasks:
+    - name: ELNBuildSync DB user
+      community.postgresql.postgresql_user:
+        name: "{{ ebs_db_user }}"
+        password: "{{ (env == 'production') | ternary(ebs_db_password, ebs_stg_db_password) }}"
+
+    - name: ELNBuildSync database creation
+      community.postgresql.postgresql_db:
+        name: "{{ ebs_db_name }}"
+        owner: "{{ ebs_db_user }}"
+        encoding: UTF-8
+
+- name: Deploy the application
+  hosts: os_control[0]:os_control_stg[0]
+  user: root
+  gather_facts: false
+  vars_files:
+    - /srv/web/infra/ansible/vars/global.yml
+    - /srv/private/ansible/vars.yml
+    - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml
+
+  pre_tasks:
+    - name: Set up ELN RabbitMQ queue
+      ansible.builtin.include_role:
+        name: rabbit/queue
+      vars:
+        queue_username: distrobuildsync-eln
+        user_sent_topics: ^$
+        queue_name: distrobuildsync-eln
+        # TTL: 10 days (in miliseconds)
+        queue_message_ttl: 864000000
+        queue_routing_keys:
+          - "#.buildsys.repo.init"
+          - "#.buildsys.repo.done"
+          - "#.buildsys.tag"
+          - "#.buildsys.task.state.change"
+          - "org.fedoraproject.{{ env_short }}.elnbuildsync.#"
+      when: env != 'staging'
+
+  roles:
+  - role: openshift/project
+    project_app: elnbuildsync
+    project_description: ELNBuildSync is a tool that listens for Fedora Rawhide builds and re-builds them in the Fedora ELN build environment.
+    project_appowners:
+    - sgallagh
+    - yselkowitz
+    tags:
+      - appowners
+
+  - role: openshift/object
+    object_app: elnbuildsync
+    object_file: imagestream.yml
+    object_objectname: imagestream.yml
+
+  - role: openshift/object
+    object_app: elnbuildsync
+    object_template: buildconfig.yml.j2
+    object_objectname: buildconfig.yml
+
+  - role: openshift/object
+    object_app: elnbuildsync
+    object_template: keytab.yml.j2
+    object_objectname: keytab.yml
+
+  - role: openshift/object
+    object_app: elnbuildsync
+    object_template: fedora-messaging-config.yml.j2
+    object_objectname: fedora-messaging-config.yml
+
+  - role: openshift/object
+    object_app: elnbuildsync
+    object_template: ebs-config.yml.j2
+    object_objectname: ebs-config.yml
+
+  - role: openshift/start-build
+    start_build_app: elnbuildsync
+    start_build_buildname: elnbuildsync-build
+    start_build_objectname: elnbuildsync-build
+    tags:
+    - never
+    - build
+
+  - role: openshift/route
+    route_app: elnbuildsync
+    route_name: elnbuildsync
+    route_host: "elnbuildsync{{ env_suffix }}.fedoraproject.org"
+    route_serviceport: 8080-tcp
+    route_servicename: elnbuildsync
+    route_annotations:
+      haproxy.router.openshift.io/set-forwarded-headers: replace
+
+  - role: openshift/object
+    object_app: elnbuildsync
+    object_template: deployment.yml.j2
+    object_objectname: deployment.yml

roles/openshift-apps/elnbuildsync/files/imagestream.yml

@@ -0,0 +1,11 @@
+---
+apiVersion: image.openshift.io/v1
+items:
+  - apiVersion: image.openshift.io/v1
+    kind: ImageStream
+    metadata:
+      name: elnbuildsync
+      labels:
+        build: elnbuildsync
+kind: List
+metadata: {}

roles/openshift-apps/elnbuildsync/files/service.yml

@@ -0,0 +1,20 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: elnbuildsync
+  name: elnbuildsync
+  namespace: eln-ops
+spec:
+  ports:
+  - name: 8080-tcp
+    port: 8080
+    protocol: TCP
+    targetPort: 8080
+  selector:
+    app: elnbuildsync
+  sessionAffinity: None
+  type: ClusterIP
+status:
+  loadBalancer: {}

roles/openshift-apps/elnbuildsync/templates/buildconfig.yml.j2

@@ -0,0 +1,28 @@
+---
+apiVersion: build.openshift.io/v1
+items:
+- apiVersion: build.openshift.io/v1
+  kind: BuildConfig
+  metadata:
+    labels:
+      build: elnbuildsync-build
+    name: elnbuildsync-build
+  spec:
+    runPolicy: Serial
+    source:
+      type: git
+      git:
+        uri: "{{ ebs_upstream_repo }}"
+        ref: "{{ ebs_upstream_ref }}"
+    strategy:
+      type: Docker
+      dockerStrategy:
+        dockerfilePath: Dockerfile
+    triggers:
+    - type: ImageChange
+    output:
+      to:
+        kind: ImageStreamTag
+        name: "elnbuildsync:{{ ebs_upstream_ref }}"
+kind: List
+metadata: {}

roles/openshift-apps/elnbuildsync/templates/deployment.yml.j2

@@ -0,0 +1,70 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: elnbuildsync
+  name: elnbuildsync
+  namespace: elnbuildsync
+spec:
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: elnbuildsync
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        app: elnbuildsync
+    spec:
+      containers:
+      - name: elnbuildsync
+        image: "image-registry.openshift-image-registry.svc:5000/elnbuildsync/elnbuildsync:{{ ebs_upstream_ref }}"
+        startupProbe:
+          httpGet:
+            path: /startup
+            port: 8080
+          failureThreshold: 60
+          periodSeconds: 10
+        livenessProbe:
+          httpGet:
+            path: /alive
+            port: 8080
+          initialDelaySeconds: 600
+          periodSeconds: 20
+          timeoutSeconds: 10
+        imagePullPolicy: Always
+        ports:
+        - containerPort: 8080
+          protocol: TCP
+        resources: {}
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /keytab
+          name: keytab
+        - mountPath: /etc/elnbuildsync
+          name: ebs-config
+        - mountPath: /etc/fedora-messaging
+          name: fedora-messaging-config
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      terminationGracePeriodSeconds: 30
+      volumes:
+      - name: keytab
+        secret:
+          defaultMode: 420
+          secretName: keytab
+      - name: ebs-config
+        secret:
+          defaultMode: 420
+          secretName: ebs-config
+      - name: fedora-messaging-config
+        secret:
+          defaultMode: 420
+          secretName: fedora-messaging-config

roles/openshift-apps/elnbuildsync/templates/ebs-config.yml.j2

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ebs-config
+stringData:
+  ebs_db_pw: "{{ (env == 'production')|ternary(ebs_db_password, ebs_stg_db_password) }}"
+  ebs_smtp_pw: '{{ ebs_smtp_password }}'
+type: Opaque

roles/openshift-apps/elnbuildsync/templates/fedora-messaging-config.yml.j2

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: fedora-messaging-config
+stringData:
+  config.toml: |-
+    {{ ebs_fedora_messaging_config | indent(4) }}
+  cacert.pem: |-
+    {{ ebs_fedora_messaging_cacert | indent(4) }}
+  elnbuildsync.crt: |-
+    {{ ebs_fedora_messaging_client_pem | indent(4) }}
+  elnbuildsync.key: |-
+    {{ ebs_fedora_messaging_client_key | indent(4) }}

roles/openshift-apps/elnbuildsync/templates/keytab.yml.j2

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+
+metadata:
+  name: keytab
+data:
+  distrobaker.keytab: '{{ ebs_keytab_secret }}'
+type: Opaque

roles/rabbitmq_cluster/tasks/apps.yml

@@ -7,7 +7,7 @@
 ---
 - name: CoreOS user
   run_once: true
-  include_role:
+  ansible.builtin.include_role:
     name: rabbit/user
   vars:
     user_name: coreos{{ env_suffix }}
@@ -15,7 +15,7 @@
 
 - name: CentOS CI
   run_once: true
-  include_role:
+  ansible.builtin.include_role:
     name: rabbit/queue
   vars:
     queue_username: centos-ci{{ env_suffix }}
@@ -28,7 +28,7 @@
 
 - name: OSCI
   run_once: true
-  include_role:
+  ansible.builtin.include_role:
     name: rabbit/queue
   vars:
     queue_username: osci-pipelines{{ env_suffix }}
@@ -52,7 +52,7 @@
 
 - name: Fedora Build Checks
   run_once: true
-  include_role:
+  ansible.builtin.include_role:
     name: rabbit/queue
   vars:
     queue_username: fedora-build-checks{{ env_suffix }}
@@ -62,7 +62,7 @@
 
 - name: Copr
   run_once: true
-  include_role:
+  ansible.builtin.include_role:
     name: rabbit/user
   vars:
     user_name: copr{{ env_suffix }}
@@ -70,7 +70,7 @@
 
 - name: CentOS Stream
   run_once: true
-  include_role:
+  ansible.builtin.include_role:
     name: rabbit/queue
   vars:
     queue_username: alt-src{{ env_suffix }}
@@ -86,7 +86,7 @@
 
 - name: CentOS Integration SIG
   run_once: true
-  include_role:
+  ansible.builtin.include_role:
     name: rabbit/user
   vars:
     user_name: centos-integration{{ env_suffix }}
@@ -95,7 +95,7 @@
 # CENTOS KOJI BEGIN
 - name: CentOS Stream Koji User
   run_once: true
-  include_role:
+  ansible.builtin.include_role:
     name: rabbit/user
   vars:
     user_name: centos-koji
@@ -103,7 +103,7 @@
 
 - name: CBS Koji User
   run_once: true
-  include_role:
+  ansible.builtin.include_role:
     name: rabbit/user
   vars:
     user_name: cbs{{ env_suffix }}
@@ -113,7 +113,7 @@
 # CENTOS RESULSDB BEGIN
 - name: CentOS ResultsDB User
   run_once: true
-  include_role:
+  ansible.builtin.include_role:
     name: rabbit/user
   vars:
     user_name: resultsdb-centos{{ env_suffix }}
@@ -124,7 +124,7 @@
 
 - name: CentOS Stream robosignatory queue
   run_once: true
-  include_role:
+  ansible.builtin.include_role:
     name: rabbit/queue
   vars:
     queue_username: centos-stream-robosignatory
@@ -140,32 +140,11 @@
 
 # CENTOS STREAM robosignatory END
 
-# ELN BEGIN
-
-- name: Eln queue
-  run_once: true
-  include_role:
-    name: rabbit/queue
-  vars:
-    queue_username: distrobuildsync-eln
-    user_sent_topics: ^$
-    queue_name: distrobuildsync-eln
-    # TTL: 10 days (in miliseconds)
-    queue_message_ttl: 864000000
-    queue_routing_keys:
-      - "#.buildsys.repo.init"
-      - "#.buildsys.repo.done"
-      - "#.buildsys.tag"
-      - "#.buildsys.task.state.change"
-  when: env != 'staging'
-
-# ELN END
-
 # ELN-CentOS Stream Syncing BEGIN
 
 - name: ELN-CS Sync queue
   run_once: true
-  include_role:
+  ansible.builtin.include_role:
     name: rabbit/queue
   vars:
     queue_username: eln-cxs-sync
@@ -180,7 +159,7 @@
 
 - name: LogDetective - Packit
   run_once: true
-  include_role:
+  ansible.builtin.include_role:
     name: rabbit/user
   vars:
     user_name: logdetective-packit{{ env_suffix }}

vars/apps/elnbuildsync.yml

@@ -0,0 +1,107 @@
+---
+ebs_upstream_repo: https://github.com/fedora-eln/elnbuildsync.git
+ebs_upstream_ref: 1.1.0
+
+ebs_db_user: elnbuildsync
+ebs_db_name: elnbuildsync
+
+ebs_queue_username: distrobuildsync-eln
+
+ebs_fedora_messaging_config: |
+  # A basic configuration for Fedora's message broker, using the example callback
+  # which simply prints messages to standard output.
+  #
+  # This file is in the TOML format.
+  amqp_url = "amqps://fedora:@rabbitmq.fedoraproject.org/%2Fpubsub"
+  callback = "fedora_messaging.example:printer"
+  passive_declares = true
+
+  [tls]
+  ca_cert = "/etc/fedora-messaging/cacert.pem"
+  keyfile = "/etc/fedora-messaging/distrobuildsync-eln.key"
+  certfile = "/etc/fedora-messaging/distrobuildsync-eln.crt"
+
+  [client_properties]
+  app = "Example Application"
+  # Some suggested extra fields:
+  # URL of the project that provides this consumer
+  app_url = "https://github.com/fedora-infra/fedora-messaging"
+  # Contact emails for the maintainer(s) of the consumer - in case the
+  # broker admin needs to contact them, for e.g.
+  app_contacts_email = ["jcline@fedoraproject.org"]
+
+  [exchanges."amq.topic"]
+  type = "topic"
+  durable = true
+  auto_delete = false
+  arguments = {}
+
+  # Queue names *must* be in the normal UUID format: run "uuidgen" and use the
+  # output as your queue name. If your queue is not exclusive, anyone can connect
+  # and consume from it, causing you to miss messages, so do not share your queue
+  # name. Any queues that are not auto-deleted on disconnect are garbage-collected
+  # after approximately one hour.
+  #
+  # If you require a stronger guarantee about delivery, please talk to Fedora's
+  # Infrastructure team.
+  [queues.distrobuildsync-eln]
+  durable = true
+  auto_delete = false
+  exclusive = true
+  arguments = {}
+
+  [[bindings]]
+  queue = "distrobuildsync-eln"
+  exchange = "amq.topic"
+  routing_keys = [
+      "org.fedoraproject.prod.buildsys.repo.init",
+      "org.fedoraproject.prod.buildsys.repo.done",
+      "org.fedoraproject.prod.buildsys.tag",
+      "org.fedoraproject.prod.buildsys.task.state.change"
+      ]
+
+  [consumer_config]
+  example_key = "for my consumer"
+
+  [qos]
+  prefetch_size = 0
+  prefetch_count = 25
+
+  [log_config]
+  version = 1
+  disable_existing_loggers = true
+
+  [log_config.formatters.simple]
+  format = "[%(module)s %(levelname)s %(name)s] %(message)s"
+
+  [log_config.handlers.console]
+  class = "logging.StreamHandler"
+  formatter = "simple"
+  stream = "ext://sys.stdout"
+
+  [log_config.loggers.fedora_messaging]
+  level = "CRITICAL"
+  propagate = false
+  handlers = []
+
+  [log_config.loggers.twisted]
+  level = "CRITICAL"
+  propagate = false
+  handlers = ["console"]
+
+  [log_config.loggers.pika]
+  level = "CRITICAL"
+  propagate = false
+  handlers = ["console"]
+
+  # If your consumer sets up a logger, you must add a configuration for it
+  # here in order for the messages to show up. e.g. if it set up a logger
+  # called 'example_printer', you could do:
+  #[log_config.loggers.example_printer]
+  #level = "INFO"
+  #propagate = false
+  #handlers = ["console"]
+
+  [log_config.root]
+  level = "ERROR"
+  handlers = ["console"]