infra/ansible
23
7
Fork 52
Code Pull requests 11 Activity Actions

[distgit] Fix the group #3244

Closed
zlopez wants to merge 1 commit from zlopez/ansible:fix_pagure_group into main
pull from: zlopez/ansible:fix_pagure_group
merge into: infra:main
Conversation 7 Commits 1 Files changed 4 +15 -15
zlopez commented 2026-03-26 12:27:42 +00:00
Owner
Copy link

The pagure user on distgit is now in xpackager group and same is the
ownership of most of the folders used by pagure. This change is
reflecting that in ansible.

Signed-off-by: Michal Konecny mkonecny@redhat.com

The pagure user on distgit is now in xpackager group and same is the ownership of most of the folders used by pagure. This change is reflecting that in ansible. Signed-off-by: Michal Konecny <mkonecny@redhat.com>
zlopez commented 2026-03-26 12:31:28 +00:00
Author
Owner
Copy link

I will leave this open for people to react as I don't know the reasoning behind xpackager group. As on pkgs01.rdu3.fedoraproject.org getent group packager returns plenty of users and getent group xpackager only xpagure. But trying id pagure will show:

uid=1000(pagure) gid=1494358698(xpackager) groups=1494358698(xpackager)

Same for few other users I tried on the machine.

I also only touched the file permissions and exec permissions on the machine. Didn't touched pagure configs as I assume the packager FAS group is correct there.

I will leave this open for people to react as I don't know the reasoning behind `xpackager` group. As on `pkgs01.rdu3.fedoraproject.org` `getent group packager` returns plenty of users and `getent group xpackager` only `xpagure`. But trying `id pagure` will show: ``` uid=1000(pagure) gid=1494358698(xpackager) groups=1494358698(xpackager) ``` Same for few other users I tried on the machine. I also only touched the file permissions and exec permissions on the machine. Didn't touched pagure configs as I assume the packager FAS group is correct there.
zlopez force-pushed fix_pagure_group from c31d368c95
Some checks failed
Linter / yamllint (pull_request) Successful in 25s
Details
Linter / ansible-lint (pull_request) Failing after 41s
Details
to 021ffcdeb6
All checks were successful
Linter / yamllint (pull_request) Successful in 24s
Details
Linter / ansible-lint (pull_request) Successful in 45s
Details
2026-03-26 13:01:02 +00:00 Compare
zlopez requested review from kevin 2026-03-30 07:46:01 +00:00
kevin commented 2026-03-30 16:51:58 +00:00
Owner
Copy link

So, the reason for this happened when we migrated to rdu3.

The problem is that the 'packager' group is defined in ipa/ldap, but also locally on pkgs01 with a different/lower gid.
So, there were permissions issues because some things were in the ipa packager group and some things were in the local group and since they had different guid's they couldn't share permissions.

I think @james was the one who made the local ones 'xpackager' to make it clear which one we wanted (the local one).

I suppose we could push this to codify that change, or perhaps we could figure out a way to merge them back into one group (either by blocking the ipa one or changing the uid of the files owned by the local one to match the ipa one?)

@james any thoughts here or memory of the issue?

So, the reason for this happened when we migrated to rdu3. The problem is that the 'packager' group is defined in ipa/ldap, but also locally on pkgs01 with a different/lower gid. So, there were permissions issues because some things were in the ipa packager group and some things were in the local group and since they had different guid's they couldn't share permissions. I think @james was the one who made the local ones 'xpackager' to make it clear which one we wanted (the local one). I suppose we could push this to codify that change, or perhaps we could figure out a way to merge them back into one group (either by blocking the ipa one or changing the uid of the files owned by the local one to match the ipa one?) @james any thoughts here or memory of the issue?
james commented 2026-03-31 16:58:13 +00:00
Member
Copy link

Yeh, it was DC move time and nothing worked and I didn't know why ... I hacked it into the new local group, and it seemed to work afterwards ;)

IIRC both the local and ipa packager groups had the same name and GID, but depending on what asked they would only get either the group members from local or ipa. I assume in iad2 the group membership was merged somehow. Not sure if that was a lost config. change or a difference in behaviour from some package upgrade (I think we upgraded the OS as part of the move outage).

It felt like we should be able to still merge the local/ipa group, but I didn't know how to (then or now). This change to make the change permanent seems fine to me.

Yeh, it was DC move time and nothing worked and I didn't know why ... I hacked it into the new local group, and it seemed to work afterwards ;) IIRC both the local and ipa packager groups had the same name and GID, but depending on what asked they would only get either the group members from local or ipa. I assume in iad2 the group membership was merged somehow. Not sure if that was a lost config. change or a difference in behaviour from some package upgrade (I think we upgraded the OS as part of the move outage). It felt like we should be able to still merge the local/ipa group, but I didn't know how to (then or now). This change to make the change permanent seems fine to me.
kevin commented 2026-04-01 23:23:30 +00:00
Owner
Copy link

So, in that case would it make sense to remove/drop the local group entirely and try and use the ipa group for everything?

We could test this in staging and see how things work?

So, in that case would it make sense to remove/drop the local group entirely and try and use the ipa group for everything? We could test this in staging and see how things work?
zlopez commented 2026-04-02 08:12:51 +00:00
Author
Owner
Copy link

Should I close this PR then and open a ticket instead about the issue?

Should I close this PR then and open a ticket instead about the issue?
kevin commented 2026-04-02 18:28:30 +00:00
Owner
Copy link

I guess so? We could also just change this pr to only affect staging and use it to test with?

I guess so? We could also just change this pr to only affect staging and use it to test with?
zlopez commented 2026-04-07 07:31:38 +00:00
Author
Owner
Copy link

Let me close this, as this PR actually reflects the current state of staging and production. The playbook as it is is probably what we want.

Let me close this, as this PR actually reflects the current state of staging and production. The playbook as it is is probably what we want.
zlopez closed this pull request 2026-04-07 07:31:38 +00:00
All checks were successful
Linter / yamllint (pull_request) Successful in 24s
Details
Linter / ansible-lint (pull_request) Successful in 45s
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
kevin
Labels
Clear labels   
ai-review-please
label for requesting AI code review

  
freeze-break-request

   
post-freeze
  
Backlog Status
Needs Review
 Work items that have been created or updated but need review, refinement, or approval before they can be considered ready for sprint planning.

  
Backlog Status
Ready
 Work items that have been reviewed, refined, and are ready to be committed to a sprint. These items have clear requirements and can be worked on immediately when capacity is available.

  
chore
Work that needs to be done but doesn't add new functionality or fix bugs. Maintenance tasks that keep the system running smoothly and the codebase clean.

  
documentation
Work focused on creating, updating, or improving documentation for users, developers, or system administrators.

  
points
01
 A task that is simple, small, and has very little uncertainty. It should be easy enough for any team member to pick up and complete quickly, without a lot of discussion or research.

  
points
02
 This is a task that is slightly more complex or larger than a "1." It might involve two or three simple steps, but the outcome is still very clear and there's little uncertainty.

  
points
03
 Medium-sized task with some noticeable complexity. It might require a bit more thought or collaboration. The steps are well-defined, but it's not a trivial change.

  
points
05
 A significant piece of work. It has more complexity and a higher degree of uncertainty than smaller tasks. It might require some research, a design discussion, or collaboration across multiple teams.

  
points
08
 Complex task with a lot of uncertainty. It's often the largest size that a team will consider for a single sprint. It likely requires a detailed breakdown and multiple team members to complete.

  
points
13
 Any task that feels like it's a "13" or more is considered an Epic. These are too large and uncertain to be worked on in a single sprint and should be broken down.

  
Priority
High
 This is for work that is critical and needs to be addressed in the next sprint. It's often for urgent bugs, important features, or a major piece of technical debt that is blocking other work.

  
Priority
Low
 This is for work that is good to do but not urgent. It's a candidate for being worked on when there's extra time or when it rises in importance. It can stay in the backlog for a longer period.

  
Priority
Medium
 This is for important work that should be done soon, but isn't as urgent as a high-priority item. It will likely be considered for the next 1-2 sprints.

  
Sprint Status
Blocked
 Work items that cannot progress due to external dependencies, blockers, or issues that need resolution.

  
Sprint Status
Done
 Work items that have been completed, reviewed, and integrated. No further work is needed within the current sprint.

  
Sprint Status
In Progress
 Work items currently being worked on by a team member. Active development, research, or implementation is happening.

  
Sprint Status
Review
 Work items that are complete but need review, testing, or approval before being marked as done.

  
Sprint Status
To Do
 Work items that are committed to the sprint but haven't been started yet. These items are ready to be picked up by team members.

  
Technical Debt
Work that addresses shortcuts, workarounds, or suboptimal implementations that were done previously to meet deadlines. These items improve code quality, maintainability, or performance without adding new features.

  
Work Item
Bug
 Issues where the system is not working as intended or designed. Bugs represent deviations from expected behavior.

  
Work Item
Epic
 Large initiatives that are broken down into multiple smaller work items (user stories, tasks, bugs). Epics represent significant features or projects that span multiple sprints.

  
Work Item
Spike
 Time-boxed research, investigation, or proof-of-concept work to reduce uncertainty or explore solutions. Spikes help inform future development decisions.

  
Work Item
Task
 Used to break down larger user stories into smaller, manageable implementation pieces. They focus on the specific technical steps needed to deliver the user story's value.

  
Work Item
User Story
 User-facing features or functionality that can be framed from a user perspective, describing what someone wants to accomplish and why.

No labels
ai-review-please
freeze-break-request
post-freeze
Backlog Status
Needs Review
Backlog Status
Ready
chore
documentation
points
01
points
02
points
03
points
05
points
08
points
13
Priority
High
Priority
Low
Priority
Medium
Sprint Status
Blocked
Sprint Status
Done
Sprint Status
In Progress
Sprint Status
Review
Sprint Status
To Do
Technical Debt
Work Item
Bug
Work Item
Epic
Work Item
Spike
Work Item
Task
Work Item
User Story
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
3 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
infra/ansible!3244
No description provided.