diff --git a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 new file mode 100644 index 0000000000..1da8e2a77f --- /dev/null +++ b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 @@ -0,0 +1,354 @@ +--- +# bodhi-web +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: bodhi + service: web + name: bodhi-web +spec: + replicas: {{ bodhi_openshift_pods }} + selector: + matchLabels: + app: bodhi-web + strategy: + type: Recreate + template: + metadata: + labels: + app: bodhi-web +{% if env == "staging" %} + monitoring-key: cpe +{% endif %} + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-base:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-web\")].image"}]' + spec: + initContainers: + - name: alembic-upgrade + image: bodhi-base:latest + command: ["/bin/sh", "-c"] + args: + - | + (/usr/bin/alembic-3 -c /etc/bodhi/alembic.ini current | grep -q "(head)") || ( cd /etc/bodhi && /usr/bin/alembic-3 -c /etc/bodhi/alembic.ini upgrade head) + volumeMounts: + - name: config-volume + mountPath: /etc/bodhi + readOnly: true + containers: + - name: bodhi-web + image: bodhi-base:latest + command: ["gunicorn"] + args: ["--paste", "/etc/bodhi/production.ini", "-b", "0.0.0.0:8080", "-w", "4", "--log-level", "DEBUG", "-k", "gthread", "--threads", "2", "--log-file=-"] + ports: + - containerPort: 8080 + name: web + resources: {} + volumeMounts: + - name: config-volume + mountPath: /etc/bodhi + readOnly: true + - name: bodhi-critpath-storage + mountPath: /etc/bodhi/critpath + readOnly: true + - name: keytab-volume + mountPath: /etc/keytabs + readOnly: true + - name: httpdir-volume + mountPath: /httpdir + - name: fedora-messaging-config-volume + mountPath: /etc/fedora-messaging + readOnly: true + - name: fedora-messaging-ca-volume + mountPath: /etc/pki/fedora-messaging/cacert.pem + subPath: cacert.pem + readOnly: true + - name: fedora-messaging-crt-volume + mountPath: /etc/pki/fedora-messaging/bodhi-cert.pem + subPath: bodhi-cert.pem + readOnly: true + - name: fedora-messaging-key-volume + mountPath: /etc/pki/fedora-messaging/bodhi-key.pem + subPath: bodhi-key.pem + readOnly: true + readinessProbe: + timeoutSeconds: 10 + initialDelaySeconds: 5 + periodSeconds: 60 + httpGet: + path: /healthz/ready + port: 8080 + livenessProbe: + timeoutSeconds: 60 + initialDelaySeconds: 30 + periodSeconds: 120 + failureThreshold: 5 + httpGet: + path: /healthz/live + port: 8080 + volumes: + - name: config-volume + configMap: + name: bodhi-configmap + - name: bodhi-critpath-storage + persistentVolumeClaim: + claimName: "bodhi-critpath-storage" + - name: keytab-volume + secret: + secretName: bodhi-keytab + - name: httpdir-volume + emptyDir: {} + - name: fedora-messaging-config-volume + configMap: + name: fedora-messaging-configmap + - name: fedora-messaging-ca-volume + secret: + secretName: bodhi-fedora-messaging-ca + - name: fedora-messaging-crt-volume + secret: + secretName: bodhi-fedora-messaging-crt + - name: fedora-messaging-key-volume + secret: + secretName: bodhi-fedora-messaging-key +--- +# bodhi-consumer +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: bodhi + service: consumer + name: bodhi-consumer +spec: +{% if env == 'staging' %} + replicas: {{ bodhi_openshift_pods_stg_consumers }} +{% else %} + replicas: {{ bodhi_openshift_pods }} +{% endif %} + selector: + matchLabels: + app: bodhi-consumer + strategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 25% + maxUnavailable: 25% + template: + metadata: + labels: + app: bodhi-consumer + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-base:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-consumer\")].image"}]' + spec: + containers: + - name: bodhi-consumer + image: bodhi-base:latest + command: ["/usr/bin/fedora-messaging"] + args: ["consume"] + resources: {} + volumeMounts: + - name: config-volume + mountPath: /etc/bodhi + readOnly: true + - name: bodhi-critpath-storage + mountPath: /etc/bodhi/critpath + readOnly: true + - name: keytab-volume + mountPath: /etc/keytabs + readOnly: true + - name: fedora-messaging-config-volume + mountPath: /etc/fedora-messaging + readOnly: true + - name: fedora-messaging-ca-volume + mountPath: /etc/pki/fedora-messaging/cacert.pem + subPath: cacert.pem + readOnly: true + - name: fedora-messaging-crt-volume + mountPath: /etc/pki/fedora-messaging/bodhi-cert.pem + subPath: bodhi-cert.pem + readOnly: true + - name: fedora-messaging-key-volume + mountPath: /etc/pki/fedora-messaging/bodhi-key.pem + subPath: bodhi-key.pem + readOnly: true + volumes: + - name: config-volume + configMap: + name: bodhi-configmap + - name: bodhi-critpath-storage + persistentVolumeClaim: + claimName: "bodhi-critpath-storage" + - name: keytab-volume + secret: + secretName: bodhi-keytab + - name: fedora-messaging-config-volume + configMap: + name: fedora-messaging-configmap + - name: fedora-messaging-ca-volume + secret: + secretName: bodhi-fedora-messaging-ca + - name: fedora-messaging-crt-volume + secret: + secretName: bodhi-fedora-messaging-crt + - name: fedora-messaging-key-volume + secret: + secretName: bodhi-fedora-messaging-key +--- +# bodhi-celery +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: bodhi + service: celery + name: bodhi-celery +spec: + replicas: {{ bodhi_openshift_pods }} + selector: + matchLabels: + app: bodhi-celery + strategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 25% + maxUnavailable: 25% + template: + metadata: + labels: + app: bodhi-celery + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-base:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-celery\")].image"}]' + spec: + containers: + - name: bodhi-celery + image: bodhi-base:latest + command: ["/usr/bin/celery"] + args: ["-A", "bodhi.server.tasks.app", "worker", "-l", "info", "-Q", "celery"] + resources: {} + volumeMounts: + - name: config-volume + mountPath: /etc/bodhi + readOnly: true + - name: bodhi-critpath-storage + mountPath: /etc/bodhi/critpath + readOnly: true + - name: keytab-volume + mountPath: /etc/keytabs + readOnly: true + - name: fedora-messaging-config-volume + mountPath: /etc/fedora-messaging + readOnly: true + - name: fedora-messaging-ca-volume + mountPath: /etc/pki/fedora-messaging/cacert.pem + subPath: cacert.pem + readOnly: true + - name: fedora-messaging-crt-volume + mountPath: /etc/pki/fedora-messaging/bodhi-cert.pem + subPath: bodhi-cert.pem + readOnly: true + - name: fedora-messaging-key-volume + mountPath: /etc/pki/fedora-messaging/bodhi-key.pem + subPath: bodhi-key.pem + readOnly: true + volumes: + - name: config-volume + configMap: + name: bodhi-configmap + - name: bodhi-critpath-storage + persistentVolumeClaim: + claimName: "bodhi-critpath-storage" + - name: keytab-volume + secret: + secretName: bodhi-keytab + - name: fedora-messaging-config-volume + configMap: + name: fedora-messaging-configmap + - name: fedora-messaging-ca-volume + secret: + secretName: bodhi-fedora-messaging-ca + - name: fedora-messaging-crt-volume + secret: + secretName: bodhi-fedora-messaging-crt + - name: fedora-messaging-key-volume + secret: + secretName: bodhi-fedora-messaging-key +--- +# bodhi-celery-beat +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: bodhi + service: celery-beat + name: bodhi-celery-beat +spec: + replicas: 1 + selector: + matchLabels: + app: bodhi-celery-beat + strategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 25% + maxUnavailable: 25% + template: + metadata: + labels: + app: bodhi-celery-beat + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-base:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-celery-beat\")].image"}]' + spec: + containers: + - name: bodhi-celery-beat + image: bodhi-base:latest + workingDir: "/tmp" + command: ["/usr/bin/celery"] + args: ["-A", "bodhi.server.tasks.app", "beat", "-l", "info"] + resources: {} + volumeMounts: + - name: config-volume + mountPath: /etc/bodhi + readOnly: true + - name: bodhi-critpath-storage + mountPath: /etc/bodhi/critpath + readOnly: true + - name: keytab-volume + mountPath: /etc/keytabs + readOnly: true + - name: fedora-messaging-config-volume + mountPath: /etc/fedora-messaging + readOnly: true + - name: fedora-messaging-ca-volume + mountPath: /etc/pki/fedora-messaging/cacert.pem + subPath: cacert.pem + readOnly: true + - name: fedora-messaging-crt-volume + mountPath: /etc/pki/fedora-messaging/bodhi-cert.pem + subPath: bodhi-cert.pem + readOnly: true + - name: fedora-messaging-key-volume + mountPath: /etc/pki/fedora-messaging/bodhi-key.pem + subPath: bodhi-key.pem + readOnly: true + volumes: + - name: config-volume + configMap: + name: bodhi-configmap + - name: bodhi-critpath-storage + persistentVolumeClaim: + claimName: "bodhi-critpath-storage" + - name: keytab-volume + secret: + secretName: bodhi-keytab + - name: fedora-messaging-config-volume + configMap: + name: fedora-messaging-configmap + - name: fedora-messaging-ca-volume + secret: + secretName: bodhi-fedora-messaging-ca + - name: fedora-messaging-crt-volume + secret: + secretName: bodhi-fedora-messaging-crt + - name: fedora-messaging-key-volume + secret: + secretName: bodhi-fedora-messaging-key diff --git a/roles/openshift-apps/bodhi/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/bodhi/templates/deploymentconfig.yml.j2 deleted file mode 100644 index 16689e8000..0000000000 --- a/roles/openshift-apps/bodhi/templates/deploymentconfig.yml.j2 +++ /dev/null @@ -1,436 +0,0 @@ ---- -apiVersion: apps.openshift.io/v1 -items: -- apiVersion: apps.openshift.io/v1 - kind: DeploymentConfig - metadata: - labels: - app: bodhi - service: web - name: bodhi-web - spec: - replicas: {{ bodhi_openshift_pods }} - selector: - deploymentconfig: bodhi-web - strategy: - activeDeadlineSeconds: 21600 - recreateParams: - mid: - execNewPod: - command: - - /bin/sh - - '-c' - - >- - (/usr/bin/alembic-3 -c /etc/bodhi/alembic.ini current | grep -q - "(head)") || ( cd /etc/bodhi && /usr/bin/alembic-3 -c - /etc/bodhi/alembic.ini upgrade head) - containerName: bodhi-web - volumes: - - config-volume - failurePolicy: Abort - timeoutSeconds: 600 - resources: {} - type: Recreate - template: - metadata: - creationTimestamp: null - labels: - app: bodhi-web - deploymentconfig: bodhi-web -{% if env == "staging" %} - monitoring-key: cpe -{% endif %} - spec: - containers: - - name: bodhi-web - image: bodhi-base:latest - command: ["gunicorn"] - # Don't use --preload, it causes threading errors with Fedora Messaging on Python 3.13 - # https://github.com/fedora-infra/fedora-messaging/issues/431 - args: ["--paste", "/etc/bodhi/production.ini", "-b", "0.0.0.0:8080", "-w", "4", "--log-level", "DEBUG", "-k", "gthread", "--threads", "2", "--log-file=-"] - ports: - - containerPort: 8080 - name: web - resources: {} - volumeMounts: - - name: config-volume - mountPath: /etc/bodhi - readOnly: true - - name: bodhi-critpath-storage - mountPath: /etc/bodhi/critpath - readOnly: true - - name: keytab-volume - mountPath: /etc/keytabs - readOnly: true - - name: httpdir-volume - mountPath: /httpdir - - name: fedora-messaging-config-volume - mountPath: /etc/fedora-messaging - readOnly: true - - name: fedora-messaging-ca-volume - mountPath: /etc/pki/fedora-messaging/cacert.pem - subPath: cacert.pem - readOnly: true - - name: fedora-messaging-crt-volume - mountPath: /etc/pki/fedora-messaging/bodhi-cert.pem - subPath: bodhi-cert.pem - readOnly: true - - name: fedora-messaging-key-volume - mountPath: /etc/pki/fedora-messaging/bodhi-key.pem - subPath: bodhi-key.pem - readOnly: true - readinessProbe: - timeoutSeconds: 10 - initialDelaySeconds: 5 - periodSeconds: 60 - httpGet: - path: /healthz/ready - port: 8080 - livenessProbe: - timeoutSeconds: 60 - initialDelaySeconds: 30 - periodSeconds: 120 - failureThreshold: 5 - httpGet: - path: /healthz/live - port: 8080 - volumes: - - name: config-volume - configMap: - name: bodhi-configmap - - name: bodhi-critpath-storage - persistentVolumeClaim: - claimName: "bodhi-critpath-storage" - - name: keytab-volume - secret: - secretName: bodhi-keytab - - name: httpdir-volume - emptyDir: {} - - name: fedora-messaging-config-volume - configMap: - name: fedora-messaging-configmap - - name: fedora-messaging-ca-volume - secret: - secretName: bodhi-fedora-messaging-ca - - name: fedora-messaging-crt-volume - secret: - secretName: bodhi-fedora-messaging-crt - - name: fedora-messaging-key-volume - secret: - secretName: bodhi-fedora-messaging-key - triggers: - - imageChangeParams: - automatic: true - containerNames: - - bodhi-web - from: - kind: ImageStreamTag - name: bodhi-base:latest - namespace: bodhi - type: ImageChange - - type: ConfigChange -kind: List -metadata: {} ---- -apiVersion: apps.openshift.io/v1 -items: -- apiVersion: apps.openshift.io/v1 - kind: DeploymentConfig - metadata: - labels: - app: bodhi - service: consumer - name: bodhi-consumer - spec: -{% if env == 'staging' %} - replicas: {{ bodhi_openshift_pods_stg_consumers }} -{% else %} - replicas: {{ bodhi_openshift_pods }} -{% endif %} - selector: - deploymentconfig: bodhi-consumer - strategy: - activeDeadlineSeconds: 21600 - recreateParams: - timeoutSeconds: 600 - resources: {} - rollingParams: - intervalSeconds: 1 - maxSurge: 25% - maxUnavailable: 25% - timeoutSeconds: 600 - updatePeriodSeconds: 1 - type: Rolling - template: - metadata: - creationTimestamp: null - labels: - app: bodhi-consumer - deploymentconfig: bodhi-consumer - spec: - containers: - - name: bodhi-consumer - image: bodhi-base:latest - command: ["/usr/bin/fedora-messaging"] - args: ["consume"] - resources: {} - volumeMounts: - - name: config-volume - mountPath: /etc/bodhi - readOnly: true - - name: bodhi-critpath-storage - mountPath: /etc/bodhi/critpath - readOnly: true - - name: keytab-volume - mountPath: /etc/keytabs - readOnly: true - - name: fedora-messaging-config-volume - mountPath: /etc/fedora-messaging - readOnly: true - - name: fedora-messaging-ca-volume - mountPath: /etc/pki/fedora-messaging/cacert.pem - subPath: cacert.pem - readOnly: true - - name: fedora-messaging-crt-volume - mountPath: /etc/pki/fedora-messaging/bodhi-cert.pem - subPath: bodhi-cert.pem - readOnly: true - - name: fedora-messaging-key-volume - mountPath: /etc/pki/fedora-messaging/bodhi-key.pem - subPath: bodhi-key.pem - readOnly: true - volumes: - - name: config-volume - configMap: - name: bodhi-configmap - - name: bodhi-critpath-storage - persistentVolumeClaim: - claimName: "bodhi-critpath-storage" - - name: keytab-volume - secret: - secretName: bodhi-keytab - - name: fedora-messaging-config-volume - configMap: - name: fedora-messaging-configmap - - name: fedora-messaging-ca-volume - secret: - secretName: bodhi-fedora-messaging-ca - - name: fedora-messaging-crt-volume - secret: - secretName: bodhi-fedora-messaging-crt - - name: fedora-messaging-key-volume - secret: - secretName: bodhi-fedora-messaging-key - triggers: - - imageChangeParams: - automatic: true - containerNames: - - bodhi-consumer - from: - kind: ImageStreamTag - name: bodhi-base:latest - namespace: bodhi - type: ImageChange - - type: ConfigChange -kind: List -metadata: {} ---- -apiVersion: apps.openshift.io/v1 -items: -- apiVersion: apps.openshift.io/v1 - kind: DeploymentConfig - metadata: - labels: - app: bodhi - service: celery - name: bodhi-celery - spec: - replicas: {{ bodhi_openshift_pods }} - selector: - deploymentconfig: bodhi-celery - strategy: - activeDeadlineSeconds: 21600 - recreateParams: - timeoutSeconds: 600 - resources: {} - rollingParams: - intervalSeconds: 1 - maxSurge: 25% - maxUnavailable: 25% - timeoutSeconds: 600 - updatePeriodSeconds: 1 - type: Rolling - template: - metadata: - creationTimestamp: null - labels: - app: bodhi-celery - deploymentconfig: bodhi-celery - spec: - containers: - - name: bodhi-celery - image: bodhi-base:latest - command: ["/usr/bin/celery"] - args: ["-A", "bodhi.server.tasks.app", "worker", "-l", "info", "-Q", "celery"] - resources: {} - volumeMounts: - - name: config-volume - mountPath: /etc/bodhi - readOnly: true - - name: bodhi-critpath-storage - mountPath: /etc/bodhi/critpath - readOnly: true - - name: keytab-volume - mountPath: /etc/keytabs - readOnly: true - - name: fedora-messaging-config-volume - mountPath: /etc/fedora-messaging - readOnly: true - - name: fedora-messaging-ca-volume - mountPath: /etc/pki/fedora-messaging/cacert.pem - subPath: cacert.pem - readOnly: true - - name: fedora-messaging-crt-volume - mountPath: /etc/pki/fedora-messaging/bodhi-cert.pem - subPath: bodhi-cert.pem - readOnly: true - - name: fedora-messaging-key-volume - mountPath: /etc/pki/fedora-messaging/bodhi-key.pem - subPath: bodhi-key.pem - readOnly: true - volumes: - - name: config-volume - configMap: - name: bodhi-configmap - - name: bodhi-critpath-storage - persistentVolumeClaim: - claimName: "bodhi-critpath-storage" - - name: keytab-volume - secret: - secretName: bodhi-keytab - - name: fedora-messaging-config-volume - configMap: - name: fedora-messaging-configmap - - name: fedora-messaging-ca-volume - secret: - secretName: bodhi-fedora-messaging-ca - - name: fedora-messaging-crt-volume - secret: - secretName: bodhi-fedora-messaging-crt - - name: fedora-messaging-key-volume - secret: - secretName: bodhi-fedora-messaging-key - triggers: - - imageChangeParams: - automatic: true - containerNames: - - bodhi-celery - from: - kind: ImageStreamTag - name: bodhi-base:latest - namespace: bodhi - type: ImageChange - - type: ConfigChange -kind: List -metadata: {} ---- -apiVersion: apps.openshift.io/v1 -items: -- apiVersion: apps.openshift.io/v1 - kind: DeploymentConfig - metadata: - labels: - app: bodhi - service: celery-beat - name: bodhi-celery-beat - spec: - # There must be only one celery-beat worker - replicas: 1 - selector: - deploymentconfig: bodhi-celery-beat - strategy: - activeDeadlineSeconds: 21600 - recreateParams: - timeoutSeconds: 600 - resources: {} - rollingParams: - intervalSeconds: 1 - maxSurge: 25% - maxUnavailable: 25% - timeoutSeconds: 600 - updatePeriodSeconds: 1 - type: Rolling - template: - metadata: - creationTimestamp: null - labels: - app: bodhi-celery-beat - deploymentconfig: bodhi-celery-beat - spec: - containers: - - name: bodhi-celery-beat - image: bodhi-base:latest - workingDir: "/tmp" - command: ["/usr/bin/celery"] - args: ["-A", "bodhi.server.tasks.app", "beat", "-l", "info"] - resources: {} - volumeMounts: - - name: config-volume - mountPath: /etc/bodhi - readOnly: true - - name: bodhi-critpath-storage - mountPath: /etc/bodhi/critpath - readOnly: true - - name: keytab-volume - mountPath: /etc/keytabs - readOnly: true - - name: fedora-messaging-config-volume - mountPath: /etc/fedora-messaging - readOnly: true - - name: fedora-messaging-ca-volume - mountPath: /etc/pki/fedora-messaging/cacert.pem - subPath: cacert.pem - readOnly: true - - name: fedora-messaging-crt-volume - mountPath: /etc/pki/fedora-messaging/bodhi-cert.pem - subPath: bodhi-cert.pem - readOnly: true - - name: fedora-messaging-key-volume - mountPath: /etc/pki/fedora-messaging/bodhi-key.pem - subPath: bodhi-key.pem - readOnly: true - volumes: - - name: config-volume - configMap: - name: bodhi-configmap - - name: bodhi-critpath-storage - persistentVolumeClaim: - claimName: "bodhi-critpath-storage" - - name: keytab-volume - secret: - secretName: bodhi-keytab - - name: fedora-messaging-config-volume - configMap: - name: fedora-messaging-configmap - - name: fedora-messaging-ca-volume - secret: - secretName: bodhi-fedora-messaging-ca - - name: fedora-messaging-crt-volume - secret: - secretName: bodhi-fedora-messaging-crt - - name: fedora-messaging-key-volume - secret: - secretName: bodhi-fedora-messaging-key - triggers: - - imageChangeParams: - automatic: true - containerNames: - - bodhi-celery-beat - from: - kind: ImageStreamTag - name: bodhi-base:latest - namespace: bodhi - type: ImageChange - - type: ConfigChange -kind: List -metadata: {}