infra/ansible
23
8
Fork 59
Code Pull requests 16 Activity Actions 3

ELNBuildSync: support staging RabbitMQ #3400

Merged
james merged 4 commits from sgallagh/infra-ansible:elnbuildsync-deploy into main 2026-06-11 18:13:33 +00:00
Conversation 8 Commits 4 Files changed 5 +6 -7
3 changed files with 6 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit d2a3de5315 - Show all commits

ELNBuildSync: Fix AMQP configuration
Some checks failed
Linter / yamllint (pull_request) Successful in 27s
Details
Linter / ansible-lint (pull_request) Failing after 1m8s
Details

Prev Next 
Feedback from code review:

* Drop unused routing key
* Remove hardcoded .prod.
* Sync with queue_routing_keys in the playbook
* Properly interpret Jinja variables

Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>

rh-pre-commit.version: 2.4.0
rh-pre-commit.check-secrets: ENABLED
Stephen Gallagher 2026-06-10 14:50:33 -04:00
commit d2a3de5315
Signed by untrusted user: sgallagh
GPG key ID: 45DB85A568286D11

1
playbooks/openshift-apps/elnbuildsync.yml
View file

@ -51,7 +51,6 @@
- "#.buildsys.repo.done"
- "#.buildsys.tag"
- "#.buildsys.task.state.change"
- "org.fedoraproject.{{ env_short }}.elnbuildsync.#"
tags:
- config
- fedora-messaging

10
roles/openshift-apps/elnbuildsync/templates/fedora-messaging-config.toml
View file

@ -2,7 +2,7 @@
# which simply prints messages to standard output.
#
# This file is in the TOML format.
amqp_url = "amqps://elnbuildsync:@rabbitmq{{ env_suffix}}.fedoraproject.org/%2Fpubsub"
amqp_url = "amqps://elnbuildsync{{ env_suffix }}:@rabbitmq{{ env_suffix}}.fedoraproject.org/%2Fpubsub"
callback = "fedora_messaging.example:printer"
passive_declares = true
@ -44,10 +44,10 @@ arguments = {}
queue = "elnbuildsync{{ env_suffix }}"
exchange = "amq.topic"
routing_keys = [
"org.fedoraproject.prod.buildsys.repo.init",
"org.fedoraproject.prod.buildsys.repo.done",
"org.fedoraproject.prod.buildsys.tag",
"org.fedoraproject.prod.buildsys.task.state.change"
"#.buildsys.repo.init",
"#.buildsys.repo.done",
"#.buildsys.tag",
"#.buildsys.task.state.change"
]
[consumer_config]

2
roles/openshift-apps/elnbuildsync/templates/fedora-messaging-config.yml.j2
View file

@ -4,7 +4,7 @@ metadata:
name: fedora-messaging-config
stringData:
config.toml: |-
{{ load_file('fedora-messaging-config.toml') | indent(4) }}
{{ lookup('template', 'fedora-messaging-config.toml') | indent(4) }}
cacert.pem: |-
sgallagh marked this conversation as resolved
kevin commented 2026-06-09 23:09:20 +00:00
Copy link

Instead of inlining these... set them as secrets, ie, look at for example:
playbooks/openshift-apps/fedocal.yml

and the openshift/secret-file role calls there.
Then they are secrets, which I think might be better than adding them here?

Instead of inlining these... set them as secrets, ie, look at for example: playbooks/openshift-apps/fedocal.yml and the openshift/secret-file role calls there. Then they are secrets, which I think might be better than adding them here?
sgallagh commented 2026-06-10 12:40:36 +00:00
Copy link

I'm not entirely sure what you're saying here. This entire YAML is defining a Kubernetes Secret object. It's doing what the openshift/secret-file role does under the hood, except it's adding all of the certificates to a single Secret (and thus directory) rather than individual directories.

I can switch to using openshift/secret-file, but it seems less efficient. And if you want me to give ebs-config.yml.j2 the same treatment, that will actually require code changes to EBS, because they expect them to both to be in a default location /etc/elnbuildsync.

I'm not entirely sure what you're saying here. This entire YAML is defining a Kubernetes Secret object. It's doing what the `openshift/secret-file` role does under the hood, except it's adding all of the certificates to a single Secret (and thus directory) rather than individual directories. I *can* switch to using `openshift/secret-file`, but it seems less efficient. And if you want me to give `ebs-config.yml.j2` the same treatment, that will actually require code changes to EBS, because they expect them to both to be in a default location `/etc/elnbuildsync`.
{{ (env == 'staging') | ternary(ebs_fedora_messaging_stg_cacert, ebs_fedora_messaging_cacert) | indent(4) }}
elnbuildsync.crt: |-