infra/tickets

Fork 1

Migrate ELNBuildSync to Fedora Infrastructure OpenShift #13139

New issue

Closed

opened 2026-02-10 23:43:17 +00:00 by sgallagh · 7 comments

sgallagh commented

2026-02-10 23:43:17 +00:00

Description of request

The Fedora ELN team is currently maintaining the ELNBuildSync (aka EBS) service inside Red Hat using an OpenShift cluster meant for internal CentOS Stream usage. We are currently in the process of adding proper OIDC support to it, at which point we would like to move it to public hosting where it will be available to the general public.

What we're looking for is:

Permission to host two instances on Fedora's OpenShift, one for production and one for testing.
Client ID and Client Secret for use with Fedora's staging OpenID Connect setup.
Client ID and Client Secret for use with Fedora's production OpenID Connect setup.
Appropriate network configuration for EBS to access Koji, Bodhi and dist-git.
Stable hostnames such as elnbuildsync.fedorainfracloud.org for both the production and staging instances (needed for the OIDC setup).
A PostgreSQL database (expected storage requirements of less than 1GiB per year).

The people responsible for maintenance and upkeep will be Stephen Gallagher (@sgallagh) and Yaakov Selkowitz (@yselkowitz) initially. Access to the restricted portions of the application (such as the build submission endpoint) will be restricted to members of the eln group in FAS.

### Description of request The Fedora ELN team is currently maintaining the ELNBuildSync (aka EBS) service inside Red Hat using an OpenShift cluster meant for internal CentOS Stream usage. We are currently in the process of adding proper [OIDC support](https://gitlab.com/redhat/centos-stream/ci-cd/distrosync/distrobuildsync/-/merge_requests/110) to it, at which point we would like to move it to public hosting where it will be available to the general public. What we're looking for is: 1. Permission to host two instances on Fedora's OpenShift, one for production and one for testing. 2. Client ID and Client Secret for use with Fedora's staging OpenID Connect setup. 3. Client ID and Client Secret for use with Fedora's production OpenID Connect setup. 4. Appropriate network configuration for EBS to access Koji, Bodhi and dist-git. 5. Stable hostnames such as elnbuildsync.fedorainfracloud.org for both the production and staging instances (needed for the OIDC setup). 6. A PostgreSQL database (expected storage requirements of less than 1GiB per year). The people responsible for maintenance and upkeep will be Stephen Gallagher (@sgallagh) and Yaakov Selkowitz (@yselkowitz) initially. Access to the restricted portions of the application (such as the build submission endpoint) will be restricted to members of the `eln` group in FAS.

zlopez added the

labels

2026-02-11 08:49:14 +00:00

sgallagh commented

2026-03-04 17:53:32 +00:00

Author

ELNBuildSync has landed support for authentication via OpenID Connect.

Can we get an estimate on when (and how) we might be able to get access to Fedora's OpenShift, please?

ELNBuildSync has [landed support](https://gitlab.com/redhat/centos-stream/ci-cd/distrosync/distrobuildsync/-/merge_requests/110) for authentication via OpenID Connect. Can we get an estimate on when (and how) we might be able to get access to Fedora's OpenShift, please?

kevin commented

2026-03-04 20:57:19 +00:00

Owner

Please see: https://docs.fedoraproject.org/en-US/infra/developer_guide/openshift/#_openshift

Our applications are all deployed via ansible.

You can look in our ansible repo under roles/openshift-apps/ and playbooks/openshift-apps to see how this is setup. Basically your config is under roles and the playbook deploys them. If you want to make a initial pr that just deploys to staging we can try things out there. Please let us know if / when you have questions...

Please see: https://docs.fedoraproject.org/en-US/infra/developer_guide/openshift/#_openshift Our applications are all deployed via ansible. You can look in our ansible repo under roles/openshift-apps/ and playbooks/openshift-apps to see how this is setup. Basically your config is under roles and the playbook deploys them. If you want to make a initial pr that just deploys to staging we can try things out there. Please let us know if / when you have questions...

sgallagh commented

2026-03-04 20:59:57 +00:00

Author

@kevin I can try, but I still need at least the OIDC and psql connection information, I think?

kevin commented

2026-03-04 21:32:01 +00:00

Owner

Yeah. We can get you those when you are ready.
We have a oidc request template here and for database we have a general db01/db01.stg instance we can add a db for you on.

Yeah. We can get you those when you are ready. We have a oidc request template here and for database we have a general db01/db01.stg instance we can add a db for you on.

sgallagh referenced this issue

2026-05-14 16:30:58 +00:00

Add yselkowitz to list to notify when ELN builds fail #11833

sgallagh referenced this issue from infra/ansible

2026-05-28 02:27:36 +00:00

Deploy ELNBuildSync to Fedora Infrastructure #3374

sgallagh commented

2026-05-28 02:42:47 +00:00

Author

infra/ansible#3374 is now out for review.

https://forge.fedoraproject.org/infra/ansible/pulls/3374 is now out for review.

james self-assigned this

2026-06-29 14:12:24 +00:00

james added this to the Sprint ( 2026-06-29 to 2026-07-12) project

2026-06-29 14:27:28 +00:00

james commented

2026-07-08 19:08:02 +00:00

Member

Going to close this one, as it's working in both stg/prod. ... they'll be more updates, and maybe more tickets, but still nice to close tickets before the end of time ;)

james closed this issue

2026-07-08 19:08:02 +00:00

sgallagh commented

2026-07-08 19:19:26 +00:00

Author

Agreed, the migration is complete. Further work will be separate. Thanks again for all the help!

zlopez referenced this issue

2026-07-09 12:43:46 +00:00

Add yselkowitz to list to notify when ELN builds fail #11833