From ae9230c37f13f0d8cfe9447d269dd39ba3780aec Mon Sep 17 00:00:00 2001 From: James Antill Date: Thu, 16 Apr 2026 01:15:50 -0400 Subject: [PATCH 001/269] Cleanup the nftables files, using includes. Rename the tables to be cle_ prefixed/unique. This allows people to run cle nftables and firewalld etc. Signed-off-by: James Antill --- inventory/group_vars/all | 6 + roles/base/templates/nftables/_nft_accept_beg | 14 ++ roles/base/templates/nftables/_nft_accept_end | 7 + .../base/templates/nftables/_nft_accept_http | 6 + .../templates/nftables/_nft_accept_monitoring | 15 ++ .../base/templates/nftables/_nft_accept_ports | 16 ++ .../nftables/_nft_accept_proxy_ports | 17 ++ roles/base/templates/nftables/_nft_accept_ssh | 6 + roles/base/templates/nftables/_nft_accept_std | 12 + roles/base/templates/nftables/_nft_accept_vpn | 24 ++ .../base/templates/nftables/_nft_block_rules | 9 + .../base/templates/nftables/_nft_blocked_ips | 9 + .../base/templates/nftables/_nft_custom_rules | 9 + roles/base/templates/nftables/_nft_drop_beg | 17 ++ roles/base/templates/nftables/_nft_drop_std | 12 + roles/base/templates/nftables/_nft_nat | 15 ++ roles/base/templates/nftables/nftables | 130 ++-------- roles/base/templates/nftables/nftables-ipv6 | 39 +-- .../base/templates/nftables/nftables.bastion | 170 +++---------- .../templates/nftables/nftables.kojibuilder | 233 ++++++++---------- roles/base/templates/nftables/nftables.osuosl | 55 +---- roles/base/templates/nftables/nftables.releng | 89 ++----- roles/base/templates/nftables/nftables.sign | 21 +- .../base/templates/nftables/nftables.staging | 52 +--- ...nftables.storinator01.fedorainfracloud.org | 70 ++---- .../nftables.torrent02.fedoraproject.org | 88 ++----- 26 files changed, 451 insertions(+), 690 deletions(-) create mode 100644 roles/base/templates/nftables/_nft_accept_beg create mode 100644 roles/base/templates/nftables/_nft_accept_end create mode 100644 roles/base/templates/nftables/_nft_accept_http create mode 100644 roles/base/templates/nftables/_nft_accept_monitoring create mode 100644 roles/base/templates/nftables/_nft_accept_ports create mode 100644 roles/base/templates/nftables/_nft_accept_proxy_ports create mode 100644 roles/base/templates/nftables/_nft_accept_ssh create mode 100644 roles/base/templates/nftables/_nft_accept_std create mode 100644 roles/base/templates/nftables/_nft_accept_vpn create mode 100644 roles/base/templates/nftables/_nft_block_rules create mode 100644 roles/base/templates/nftables/_nft_blocked_ips create mode 100644 roles/base/templates/nftables/_nft_custom_rules create mode 100644 roles/base/templates/nftables/_nft_drop_beg create mode 100644 roles/base/templates/nftables/_nft_drop_std create mode 100644 roles/base/templates/nftables/_nft_nat diff --git a/inventory/group_vars/all b/inventory/group_vars/all index 90e9a4b647..229e9f8e64 100644 --- a/inventory/group_vars/all +++ b/inventory/group_vars/all @@ -155,6 +155,12 @@ nftables: True nft_custom6_rules: [] nft_custom_rules: [] nft_nat_rules: [] +# Table names for nft +# Note that the ip/ip6 prefix here means we only look at IPv4/IPv6 packets. +nft_table_filter: "ip cle_infra_filter" +nft_table_nat: "ip cle_infra_nat" +nft_table_raw: "ip cle_infra_raw" +nft_table6_filter: "ip6 cle_infra_filter" # default network block device encryption settings for linux-system-roles/nbde_client nbde: true nbde_device: /dev/md2 diff --git a/roles/base/templates/nftables/_nft_accept_beg b/roles/base/templates/nftables/_nft_accept_beg new file mode 100644 index 0000000000..aa5c8f2236 --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_beg @@ -0,0 +1,14 @@ +# {{ ansible_managed }} +# _nft_accept_beg +# Setup an ip filter table with default accept policy, and the std. allow rules. + +# Set small Table Names. +# We need the big global ones so we can use them in *_rules but, that would be +# a lot in these files. +{% set _tn = nft_table_filter %} +{% set _tnat = nft_table_nat %} + +add table {{_tn}} +add chain {{_tn}} INPUT { type filter hook input priority 0; policy accept; } +add chain {{_tn}} FORWARD { type filter hook forward priority 0; policy accept; } +add chain {{_tn}} OUTPUT { type filter hook output priority 0; policy accept; } diff --git a/roles/base/templates/nftables/_nft_accept_end b/roles/base/templates/nftables/_nft_accept_end new file mode 100644 index 0000000000..da906e3462 --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_end @@ -0,0 +1,7 @@ +# _nft_accept_end +# Default accept policy, standard end rules +# This kind of makes it default drop, but the spelling is weird. + +# otherwise kick everything out +add rule {{_tn}} INPUT counter reject with icmp type host-prohibited +add rule {{_tn}} FORWARD counter reject with icmp type host-prohibited diff --git a/roles/base/templates/nftables/_nft_accept_http b/roles/base/templates/nftables/_nft_accept_http new file mode 100644 index 0000000000..564243a11c --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_http @@ -0,0 +1,6 @@ +# _nft_accept_http +# Accept HTTP(s) + +add rule {{_tn}} INPUT ct state new tcp dport 80 counter accept +add rule {{_tn}} INPUT ct state new tcp dport 443 counter accept + diff --git a/roles/base/templates/nftables/_nft_accept_monitoring b/roles/base/templates/nftables/_nft_accept_monitoring new file mode 100644 index 0000000000..2f61227b25 --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_monitoring @@ -0,0 +1,15 @@ +# _nft_accept_monitoring +# Default accept policy, let things be monitored + +# for nrpe - allow it from nocs +add rule {{_tn}} INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept +# FIXME - this is the global nat-ip and we need the noc01-specific ip +add rule {{_tn}} INPUT ip saddr 38.145.60.16 tcp dport 5666 counter accept +add rule {{_tn}} INPUT ip saddr 38.145.60.15 tcp dport 5666 counter accept +add rule {{_tn}} INPUT ip saddr 10.3.163.10 tcp dport 5666 counter accept +add rule {{_tn}} INPUT ip saddr 10.3.166.10 tcp dport 5666 counter accept +# zabbix01 +add rule {{_tn}} INPUT tcp dport 10051 counter accept +add rule {{_tn}} INPUT ip saddr 10.3.163.198 tcp dport 10050 counter accept + diff --git a/roles/base/templates/nftables/_nft_accept_ports b/roles/base/templates/nftables/_nft_accept_ports new file mode 100644 index 0000000000..0583fb9104 --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_ports @@ -0,0 +1,16 @@ +# _nft_accept_ports +# Default accept policy, accept host defined tcp/udp ports + +# if the host/group defines incoming tcp_ports - allow them +{% if tcp_ports is defined %} +{% for port in tcp_ports %} +add rule {{_tn}} INPUT tcp dport {{ port }} counter accept +{% endfor %} +{% endif %} + +# if the host/group defines incoming udp_ports - allow them +{% if udp_ports is defined %} +{% for port in udp_ports %} +add rule {{_tn}} INPUT udp dport {{ port }} counter accept +{% endfor %} +{% endif %} diff --git a/roles/base/templates/nftables/_nft_accept_proxy_ports b/roles/base/templates/nftables/_nft_accept_proxy_ports new file mode 100644 index 0000000000..24f8c14037 --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_proxy_ports @@ -0,0 +1,17 @@ +# _nft_accept_proxy_ports +# Default accept policy, deal with proxy ports (if defined) + +# if there are any proxy-only tcp_ports - allow them +{% if proxy_tcp_ports is defined %} +{% for port in proxy_tcp_ports %} +{% for proxy in (groups['proxies'] + groups['proxies_internal']) %} +{% if hostvars[proxy]['datacenter'] == "phx2" and 'ansible_eth0' in hostvars[proxy] %} +add rule {{_tn}} INPUT ip saddr {{ hostvars[proxy]['ansible_eth0']['ipv4']['address'] }} tcp dport {{ port }} counter accept +{% else %} +add rule {{_tn}} INPUT ip saddr {{ hostvars[proxy]['ansible_tun0']['ipv4']['address'] }} tcp dport {{ port }} counter accept +{% endif %} +{% endfor %} +# nagios +add rule {{_tn}} INPUT ip saddr 10.3.163.10 tcp dport {{ port }} counter accept +{% endfor %} +{% endif %} diff --git a/roles/base/templates/nftables/_nft_accept_ssh b/roles/base/templates/nftables/_nft_accept_ssh new file mode 100644 index 0000000000..24f0093058 --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_ssh @@ -0,0 +1,6 @@ +# _nft_accept_ssh +# Accept ssh + +# allow ssh - always +add rule {{_tn}} INPUT ct state new tcp dport 22 counter accept + diff --git a/roles/base/templates/nftables/_nft_accept_std b/roles/base/templates/nftables/_nft_accept_std new file mode 100644 index 0000000000..493da9a8ae --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_std @@ -0,0 +1,12 @@ +# _nft_accept_std +# Standard accept lines, SSH is _not_ here. + +# allow ping and traceroute +add rule {{_tn}} INPUT ip protocol icmp counter accept + +# localhost is fine +add rule {{_tn}} INPUT iifname "lo" counter accept + +# Established connections allowed +add rule {{_tn}} INPUT ct state related,established counter accept +add rule {{_tn}} OUTPUT ct state related,established counter accept diff --git a/roles/base/templates/nftables/_nft_accept_vpn b/roles/base/templates/nftables/_nft_accept_vpn new file mode 100644 index 0000000000..826c9bbae6 --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_vpn @@ -0,0 +1,24 @@ +# _nft_accept_vpn +# Default accept policy, vpn stuff. +# NOTE: That the end of this file rejects all other VPN traffic. + +{% if vpn %} +# +# We want to have all vpn hosts reject most things from the 'less secure' vpn network +# +{% if inventory_hostname in groups['ipa'] %} +# Allow all vpn hosts to talk to the ipa servers for auth +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 80 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 88 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 389 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 443 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 464 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 636 counter accept + +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 udp dport 88 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 udp dport 464 counter accept +{% endif %} + +# Reject all further connections from less secure vpn +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited +{% endif %} diff --git a/roles/base/templates/nftables/_nft_block_rules b/roles/base/templates/nftables/_nft_block_rules new file mode 100644 index 0000000000..1e78f98ba3 --- /dev/null +++ b/roles/base/templates/nftables/_nft_block_rules @@ -0,0 +1,9 @@ +# _nft_block_rules +# Default accept policy, standard end rules + +{% if nft_block_rules is defined %} +# if there are block rules - put them in as-is +{% for rule in nft_block_rules %} +{{ rule }} +{% endfor %} +{% endif %} diff --git a/roles/base/templates/nftables/_nft_blocked_ips b/roles/base/templates/nftables/_nft_blocked_ips new file mode 100644 index 0000000000..9f6b23d4fb --- /dev/null +++ b/roles/base/templates/nftables/_nft_blocked_ips @@ -0,0 +1,9 @@ +# _nft_blocked_ips +# Probably only use for: Default drop policy + +# if the blocked_ips is defined - drop them +{% if blocked_ips is defined %} +{% for ip in blocked_ips %} +add rule {{_tn}} INPUT ip saddr {{ ip }} counter drop +{% endfor %} +{% endif %} diff --git a/roles/base/templates/nftables/_nft_custom_rules b/roles/base/templates/nftables/_nft_custom_rules new file mode 100644 index 0000000000..bf63274c8a --- /dev/null +++ b/roles/base/templates/nftables/_nft_custom_rules @@ -0,0 +1,9 @@ +# _nft_custom_rules +# Probably only use for: Default accept policy + +# if there are custom rules - put them in as-is +{% if nft_custom_rules is defined %} +{% for rule in nft_custom_rules %} +{{ rule }} +{% endfor %} +{% endif %} diff --git a/roles/base/templates/nftables/_nft_drop_beg b/roles/base/templates/nftables/_nft_drop_beg new file mode 100644 index 0000000000..3663d11ed4 --- /dev/null +++ b/roles/base/templates/nftables/_nft_drop_beg @@ -0,0 +1,17 @@ +# {{ ansible_managed }} +# _nft_drop_beg +# Setup an ip filter table with default drop policy. +# +# Note that there's no _nft_drop_end because _nft_accept_end drops everything +# and we don't need that. + +# Set small Table Names. +# We need the big global ones so we can use them in *_rules but, that would be +# a lot in these files. +{% set _tn = nft_table_filter %} +{% set _tnat = nft_table_nat %} + +add table {{_tn}} +add chain {{_tn}} INPUT { type filter hook input priority 0; policy drop; } +add chain {{_tn}} FORWARD { type filter hook forward priority 0; policy drop; } +add chain {{_tn}} OUTPUT { type filter hook output priority 0; policy drop; } diff --git a/roles/base/templates/nftables/_nft_drop_std b/roles/base/templates/nftables/_nft_drop_std new file mode 100644 index 0000000000..f0bbb6dee1 --- /dev/null +++ b/roles/base/templates/nftables/_nft_drop_std @@ -0,0 +1,12 @@ +# _nft_drop_std +# Std. allow rules for the drop policy + + +{% include '_nft_accept_std' %} + +# MORE loopback allowed +add rule {{_tn}} OUTPUT oifname "lo" counter accept +add rule {{_tn}} INPUT iifname "virbr0" counter accept +add rule {{_tn}} OUTPUT oifname "virbr0" counter accept +add rule {{_tn}} INPUT ip daddr 127.0.0.0/8 counter accept +add rule {{_tn}} OUTPUT ip daddr 127.0.0.0/8 counter accept diff --git a/roles/base/templates/nftables/_nft_nat b/roles/base/templates/nftables/_nft_nat new file mode 100644 index 0000000000..f185cb2a4e --- /dev/null +++ b/roles/base/templates/nftables/_nft_nat @@ -0,0 +1,15 @@ +# _nft_nat +# Setup forwarding via. "ip nat" table, if we have nat rules. + +{% if nft_nat_rules is defined %} + +add table {{_tnat}} +add chain {{_tnat}} PREROUTING { type nat hook prerouting priority {{_nft_prio_preroute}}; policy accept; } +add chain {{_tnat}} INPUT { type nat hook input priority {{_nft_prio_input}}; policy accept; } +add chain {{_tnat}} OUTPUT { type nat hook output priority {{_nft_prio_output}}; policy accept; } +add chain {{_tnat}} POSTROUTING { type nat hook postrouting priority {{_nft_prio_postroute}}; policy accept; } + +{% for rule in nft_nat_rules %} +{{ rule }} +{% endfor %} +{% endif %} diff --git a/roles/base/templates/nftables/nftables b/roles/base/templates/nftables/nftables index a8631a84d1..90806de03c 100644 --- a/roles/base/templates/nftables/nftables +++ b/roles/base/templates/nftables/nftables @@ -1,127 +1,29 @@ # {{ ansible_managed }} -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy accept; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; } +# {{ template_path }} -# allow ping and traceroute -add rule ip filter INPUT ip protocol icmp counter accept +{% include '_nft_accept_beg' %} -# localhost is fine -add rule ip filter INPUT iifname "lo" counter accept +{% include '_nft_accept_std' %} -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept -add rule ip filter OUTPUT ct state related,established counter accept +{% include '_nft_accept_ssh' %} -# allow ssh - always -add rule ip filter INPUT ct state new tcp dport 22 counter accept +{% include '_nft_accept_monitoring' %} -# for nrpe - allow it from nocs -add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept -# FIXME - this is the global nat-ip and we need the noc01-specific ip -add rule ip filter INPUT ip saddr 38.145.60.16 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.60.15 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.3.163.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.3.166.10 tcp dport 5666 counter accept -# zabbix01 -add rule ip filter INPUT tcp dport 10051 counter accept -add rule ip filter INPUT ip saddr 10.3.163.198 tcp dport 10050 counter accept +{% include '_nft_accept_vpn' %} -{% if env != 'staging' and datacenter == 'iad2' and inventory_hostname not in groups['staging_friendly'] %} -# -# In the iad2 datacenter, both production and staging hosts are in different -# vlans, and different subnets. However, just as a precaution, we want prod machines to -# reject connections from any staging host just in case there's some globally enabled port. -# There are however a few hosts in production we have marked 'staging-friendly' -# that we do allow staging to talk to for mostly read-only data they need. -# -add rule ip filter INPUT ip saddr 10.3.166.0/24 counter reject with icmp type host-prohibited -add rule ip filter INPUT ip saddr 10.3.167.0/24 counter reject with icmp type host-prohibited -{% endif %} +{% include '_nft_block_rules' %} -{% if vpn %} -# -# We want to have all vpn hosts reject most things from the 'less secure' vpn network -# -{% if inventory_hostname == 'log01.iad2.fedoraproject.org' %} -# Allow all vpn hosts to talk to the log server for rsyslog -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 514 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport 25826 counter accept -{% endif %} -{% if inventory_hostname in groups['ipa'] %} -# Allow all vpn hosts to talk to the ipa servers for auth -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 80 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 88 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 389 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 443 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 464 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 636 counter accept +{% include '_nft_accept_ports' %} -add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport 88 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport 464 counter accept -{% endif %} -# Reject all further connections from less secure vpn -add rule ip filter INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited -{% endif %} +{% include '_nft_accept_proxy_ports' %} +{% include '_nft_custom_rules' %} -{% if nft_block_rules is defined %} -# if there are block rules - put them in as-is -{% for rule in nft_block_rules %} -{{ rule }} -{% endfor %} -{% endif %} -# if the host/group defines incoming tcp_ports - allow them -{% if tcp_ports is defined %} -{% for port in tcp_ports %} -add rule ip filter INPUT tcp dport {{ port }} counter accept -{% endfor %} -{% endif %} +{% include '_nft_accept_end' %} -# if the host/group defines incoming udp_ports - allow them -{% if udp_ports is defined %} -{% for port in udp_ports %} -add rule ip filter INPUT udp dport {{ port }} counter accept -{% endfor %} -{% endif %} +{% set _nft_prio_preroute = "-100" %} +{% set _nft_prio_input = "100" %} +{% set _nft_prio_output = "-100" %} +{% set _nft_prio_postroute = "100" %} -# if there are any proxy-only tcp_ports - allow them -{% if proxy_tcp_ports is defined %} -{% for port in proxy_tcp_ports %} -{% for proxy in (groups['proxies'] + groups['proxies_internal']) %} -{% if hostvars[proxy]['datacenter'] == "phx2" and 'ansible_eth0' in hostvars[proxy] %} -add rule ip filter INPUT ip saddr {{ hostvars[proxy]['ansible_eth0']['ipv4']['address'] }} tcp dport {{ port }} counter accept -{% else %} -add rule ip filter INPUT ip saddr {{ hostvars[proxy]['ansible_tun0']['ipv4']['address'] }} tcp dport {{ port }} counter accept -{% endif %} -{% endfor %} -# nagios -add rule ip filter INPUT ip saddr 10.3.163.10 tcp dport {{ port }} counter accept -{% endfor %} -{% endif %} - -# if there are custom rules - put them in as-is -{% if nft_custom_rules is defined %} -{% for rule in nft_custom_rules %} -{{ rule }} -{% endfor %} -{% endif %} - -# otherwise kick everything out -add rule ip filter INPUT counter reject with icmp type host-prohibited -add rule ip filter FORWARD counter reject with icmp type host-prohibited - -{% if nft_nat_rules is defined %} - -add table ip nat -add chain ip nat PREROUTING { type nat hook prerouting priority -100; policy accept; } -add chain ip nat INPUT { type nat hook input priority 100; policy accept; } -add chain ip nat OUTPUT { type nat hook output priority -100; policy accept; } -add chain ip nat POSTROUTING { type nat hook postrouting priority 100; policy accept; } - -{% for rule in nft_nat_rules %} -{{ rule }} -{% endfor %} -{% endif %} +{% include '_nft_nat' %} diff --git a/roles/base/templates/nftables/nftables-ipv6 b/roles/base/templates/nftables/nftables-ipv6 index c1fa235ccf..09dc65915e 100644 --- a/roles/base/templates/nftables/nftables-ipv6 +++ b/roles/base/templates/nftables/nftables-ipv6 @@ -1,48 +1,51 @@ # {{ ansible_managed }} -add table ip6 filter -add chain ip6 filter INPUT { type filter hook input priority 0; policy accept; } -add chain ip6 filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip6 filter OUTPUT { type filter hook output priority 0; policy accept; } + +# Set small Table Names. +# We need the big global ones so we can use them in *_rules but, that would be +# a lot in these files. +{% set _tn6 = nft_table6_filter %} + +add table {{_tn6}} +add chain {{_tn6}} INPUT { type filter hook input priority 0; policy accept; } +add chain {{_tn6}} FORWARD { type filter hook forward priority 0; policy accept; } +add chain {{_tn6}} OUTPUT { type filter hook output priority 0; policy accept; } # loopback allowed -add rule ip6 filter INPUT iifname "lo" counter accept +add rule {{_tn6}} INPUT iifname "lo" counter accept # Accept ping and traceroute (needs icmp) -add rule ip6 filter INPUT meta l4proto ipv6-icmp counter accept +add rule {{_tn6}} INPUT meta l4proto ipv6-icmp counter accept # Established connections allowed -add rule ip6 filter INPUT ct state related,established counter accept +add rule {{_tn6}} INPUT ct state related,established counter accept # Established connections allowed -add rule ip6 filter OUTPUT ct state related,established counter accept +add rule {{_tn6}} OUTPUT ct state related,established counter accept # allow dhcp6d from aws -add rule ip6 filter INPUT ip6 daddr fe80::/64 udp sport 547 udp dport 546 counter accept +add rule {{_tn6}} INPUT ip6 daddr fe80::/64 udp sport 547 udp dport 546 counter accept # if the blocked_ips is defined - drop them {% if blocked_ip_v6 is defined %} {% for ip in blocked_ip_v6 %} -add rule ip6 filter INPUT ip6 saddr {{ ip }} counter drop +add rule {{_tn6}} INPUT ip6 saddr {{ ip }} counter drop {% endfor %} {% endif %} # allow ssh - always -add rule ip6 filter INPUT ct state new tcp dport 22 counter accept - -# for nrpe (if we want noc02 to be able to get into remote systems) -#add rule ip6 filter INPUT ip6 saddr 2600:2701:4000:5211:dead:beef:fe:fed9 tcp dport 5666 counter accept +add rule {{_tn6}} INPUT ct state new tcp dport 22 counter accept # if the host/group defines incoming tcp_ports - allow them {% if tcp_ports is defined %} {% for port in tcp_ports %} -add rule ip6 filter INPUT tcp dport {{ port }} counter accept +add rule {{_tn6}} INPUT tcp dport {{ port }} counter accept {% endfor %} {% endif %} # if the host/group defines incoming udp_ports - allow them {% if udp_ports is defined %} {% for port in udp_ports %} -add rule ip6 filter INPUT udp dport {{ port }} counter accept +add rule {{_tn6}} INPUT udp dport {{ port }} counter accept {% endfor %} {% endif %} @@ -54,5 +57,5 @@ add rule ip6 filter INPUT udp dport {{ port }} counter accept {% endif %} # otherwise kick everything out -add rule ip6 filter INPUT counter reject with icmpv6 type admin-prohibited -add rule ip6 filter FORWARD counter reject with icmpv6 type admin-prohibited +add rule {{_tn6}} INPUT counter reject with icmpv6 type admin-prohibited +add rule {{_tn6}} FORWARD counter reject with icmpv6 type admin-prohibited diff --git a/roles/base/templates/nftables/nftables.bastion b/roles/base/templates/nftables/nftables.bastion index bbdc4878df..4eb3cfd6fa 100644 --- a/roles/base/templates/nftables/nftables.bastion +++ b/roles/base/templates/nftables/nftables.bastion @@ -1,155 +1,53 @@ # {{ ansible_managed }} -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy accept; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; } +# {{ template_path }} -# allow ping and traceroute -add rule ip filter INPUT ip protocol icmp counter accept +{% include '_nft_accept_beg' %} -# localhost is fine -add rule ip filter INPUT iifname "lo" counter accept +{% include '_nft_accept_std' %} -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept -add rule ip filter OUTPUT ct state related,established counter accept +{% include '_nft_accept_ssh' %} -# allow ssh - always -add rule ip filter INPUT ct state new tcp dport 22 counter accept - -# for nrpe - allow it from nocs -add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept -# FIXME - this is the global nat-ip and we need the noc01-specific ip -add rule ip filter INPUT ip saddr 38.145.60.16 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.60.15 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.3.163.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.3.166.10 tcp dport 5666 counter accept -# zabbix01 -add rule ip filter INPUT tcp dport 10051 counter accept -add rule ip filter INPUT ip saddr 10.3.163.198 tcp dport 10050 counter accept - -{% if env != 'staging' and datacenter == 'iad2' and inventory_hostname not in groups['staging_friendly'] %} -# -# In the iad2 datacenter, both production and staging hosts are in different -# vlans, and different subnets. However, just as a precaution, we want prod machines to -# reject connections from any staging host just in case there's some globally enabled port. -# There are however a few hosts in production we have marked 'staging-friendly' -# that we do allow staging to talk to for mostly read-only data they need. -# -add rule ip filter INPUT ip saddr 10.3.166.0/24 counter reject with icmp type host-prohibited -add rule ip filter INPUT ip saddr 10.3.167.0/24 counter reject with icmp type host-prohibited -{% endif %} - -{% if vpn %} -# -# We want to have all vpn hosts reject most things from the 'less secure' vpn network -# -{% if inventory_hostname == 'log01.iad2.fedoraproject.org' %} -# Allow all vpn hosts to talk to the log server for rsyslog -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 514 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport 25826 counter accept -{% endif %} -{% if inventory_hostname in groups['ipa'] %} -# Allow all vpn hosts to talk to the ipa servers for auth -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 80 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 88 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 389 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 443 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 464 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 636 counter accept - -add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport 88 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport 464 counter accept -{% endif %} -# Reject all further connections from less secure vpn -add rule ip filter INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited -{% endif %} +{% include '_nft_accept_monitoring' %} # smtp rules we want to allow vpn and out internal networks and mimecast -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 192.168.1.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 192.168.0.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.1.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.0.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 10.3.160.0/19 tcp dport 25 counter accept +# This rejects all VPN traffic at the end. +{% include '_nft_accept_vpn' %} + +add rule {{_tn}} INPUT ip saddr 10.3.160.0/19 tcp dport 25 counter accept # s390x builders/virthost -add rule ip filter INPUT ip saddr 10.1.102.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 10.1.102.0/24 tcp dport 25 counter accept # redhat mxes -add rule ip filter INPUT ip saddr 10.30.177.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 10.30.29.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 10.30.177.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 10.30.29.0/24 tcp dport 25 counter accept # mimecast ips from # https://community.mimecast.com/s/article/email-security-cloud-gateway-data-centers-and-urls?r=297&ui-knowledge-components-aura-actions.KnowledgeArticleVersionCreateDraftFromOnlineAction.createDraftFromOnlineArticle=1 -add rule ip filter INPUT ip saddr 170.10.128.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 170.10.129.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 170.10.130.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 170.10.131.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 170.10.132.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 170.10.133.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 207.211.30.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 207.211.31.0/25 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 205.139.110.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 205.139.111.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 216.205.24.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 63.128.21.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 207.211.30.40/26 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 170.10.128.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 170.10.129.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 170.10.130.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 170.10.131.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 170.10.132.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 170.10.133.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 207.211.30.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 207.211.31.0/25 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 205.139.110.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 205.139.111.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 216.205.24.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 63.128.21.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 207.211.30.40/26 tcp dport 25 counter accept -{% if nft_block_rules is defined %} -# if there are block rules - put them in as-is -{% for rule in nft_block_rules %} -{{ rule }} -{% endfor %} -{% endif %} +{% include '_nft_block_rules' %} -# if the host/group defines incoming tcp_ports - allow them -{% if tcp_ports is defined %} -{% for port in tcp_ports %} -add rule ip filter INPUT tcp dport {{ port }} counter accept -{% endfor %} -{% endif %} +{% include '_nft_accept_ports' %} -# if the host/group defines incoming udp_ports - allow them -{% if udp_ports is defined %} -{% for port in udp_ports %} -add rule ip filter INPUT udp dport {{ port }} counter accept -{% endfor %} -{% endif %} +{% include '_nft_accept_proxy_ports' %} -# if there are any proxy-only tcp_ports - allow them -{% if proxy_tcp_ports is defined %} -{% for port in proxy_tcp_ports %} -{% for proxy in (groups['proxies'] + groups['proxies_internal']) %} -{% if hostvars[proxy]['datacenter'] == "phx2" and 'ansible_eth0' in hostvars[proxy] %} -add rule ip filter INPUT ip saddr {{ hostvars[proxy]['ansible_eth0']['ipv4']['address'] }} tcp dport {{ port }} counter accept -{% else %} -add rule ip filter INPUT ip saddr {{ hostvars[proxy]['ansible_tun0']['ipv4']['address'] }} tcp dport {{ port }} counter accept -{% endif %} -{% endfor %} -# nagios -add rule ip filter INPUT ip saddr 10.3.163.10 tcp dport {{ port }} counter accept -{% endfor %} -{% endif %} +{% include '_nft_custom_rules' %} -# if there are custom rules - put them in as-is -{% if nft_custom_rules is defined %} -{% for rule in nft_custom_rules %} -{{ rule }} -{% endfor %} -{% endif %} +{% include '_nft_accept_end' %} -# otherwise kick everything out -add rule ip filter INPUT counter reject with icmp type host-prohibited -add rule ip filter FORWARD counter reject with icmp type host-prohibited - -{% if nft_nat_rules is defined %} - -add table ip nat -add chain ip nat PREROUTING { type nat hook prerouting priority -100; policy accept; } -add chain ip nat INPUT { type nat hook input priority 100; policy accept; } -add chain ip nat OUTPUT { type nat hook output priority -100; policy accept; } -add chain ip nat POSTROUTING { type nat hook postrouting priority 100; policy accept; } - -{% for rule in nft_nat_rules %} -{{ rule }} -{% endfor %} -{% endif %} +{% include '_nft_nat' %} diff --git a/roles/base/templates/nftables/nftables.kojibuilder b/roles/base/templates/nftables/nftables.kojibuilder index dbdbfd1412..3b4c0ea2a0 100644 --- a/roles/base/templates/nftables/nftables.kojibuilder +++ b/roles/base/templates/nftables/nftables.kojibuilder @@ -1,40 +1,20 @@ # {{ ansible_managed }} -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy drop; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy drop; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy drop; } +# {{ template_path }} -# loopback allowed -add rule ip filter INPUT iifname "lo" counter accept -add rule ip filter OUTPUT oifname "lo" counter accept -add rule ip filter INPUT iifname "virbr0" counter accept -add rule ip filter OUTPUT oifname "virbr0" counter accept -add rule ip filter INPUT ip daddr 127.0.0.0/8 counter accept -add rule ip filter OUTPUT ip daddr 127.0.0.0/8 counter accept +{% include '_nft_drop_beg' %} -# Accept ping and traceroute (needs icmp) -add rule ip filter INPUT ip protocol icmp counter accept -add rule ip filter OUTPUT ip protocol icmp counter accept +{% include '_nft_drop_std' %} -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept -add rule ip filter OUTPUT ct state related,established counter accept - -# if the blocked_ips is defined - drop them -{% if blocked_ips is defined %} -{% for ip in blocked_ips %} -add rule ip filter INPUT ip saddr {{ ip }} counter drop -{% endfor %} -{% endif %} +{% include '_nft_blocked_ips' %} {% if host in groups['osbuild'] %} # osbuild api for osbuild koji plugin #!# WARNING: This is very different... # -A OUTPUT -p tcp --dport 443 -m set --match-set osbuildapi dst -j ACCEPT -add set ip filter osbuildapi { type ipv4_addr ; size 65536; } +add set {{_tn}} osbuildapi { type ipv4_addr ; size 65536; } -add rule ip filter OUTPUT tcp dport 443 ip daddr @osbuildapi accept +add rule {{_tn}} OUTPUT tcp dport 443 ip daddr @osbuildapi accept # Then in the update script... # nft flush set global osbuildapi @@ -47,155 +27,144 @@ add rule ip filter OUTPUT tcp dport 443 ip daddr @osbuildapi accept # kojipkgs {% if host in groups['buildvm_s390x'] %} -add rule ip filter OUTPUT ip daddr 10.16.0.17 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.0.35 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.1.102.24 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.1.102.50 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.3.169.106 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.3.169.107 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.0.17 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.0.35 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.1.102.24 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.1.102.50 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.169.106 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.169.107 tcp dport 80 counter accept {% endif %} # tang for buildhw -add rule ip filter OUTPUT ip daddr 10.3.163.37 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.38 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.37 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.38 tcp dport 80 counter accept # DNS -add rule ip filter OUTPUT ip daddr 10.3.163.33 udp dport 53 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.33 tcp dport 53 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.34 udp dport 53 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.34 tcp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.33 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.33 tcp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.34 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.34 tcp dport 53 counter accept # bastion smtp -add rule ip filter OUTPUT ip daddr 10.3.163.31 tcp dport 25 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.31 tcp dport 25 counter accept # infra.fp.o -add rule ip filter OUTPUT ip daddr 10.3.163.35 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.35 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.35 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.35 tcp dport 443 counter accept # rsyslog out to log01 -add rule ip filter OUTPUT ip daddr 10.3.163.39 tcp dport 514 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.39 tcp dport 514 counter accept # SSH -add rule ip filter INPUT ip saddr 10.3.160.0/19 tcp dport 22 counter accept -add rule ip filter OUTPUT ip daddr 10.3.160.0/19 tcp sport 22 counter accept +add rule {{_tn}} INPUT ip saddr 10.3.160.0/19 tcp dport 22 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.160.0/19 tcp sport 22 counter accept {% if inventory_hostname.startswith (('buildvm-s390x-11', 'buildvm-s390x-12', 'buildvm-s390x-13')) %} # Allow SSHFS binding to koji01 -add rule ip filter OUTPUT ip daddr 10.3.169.104 tcp dport 22 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.169.104 tcp dport 22 counter accept {% endif %} # http to pull sources from pkgs lookaside -#add rule ip filter OUTPUT ip daddr 10.5.125.44 tcp dport 80 counter accept +#add rule {{_tn}} OUTPUT ip daddr 10.5.125.44 tcp dport 80 counter accept # https git on pagure,io -add rule ip filter OUTPUT ip daddr 8.43.85.76 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 8.43.85.76 tcp dport 443 counter accept # admin.fedoraproject.org for fas (proyx(1)01 and proxy(1)10) {% if host in groups['staging'] %} -add rule ip filter OUTPUT ip daddr 10.3.166.74 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.74 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.75 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.75 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.74 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.74 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.75 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.75 tcp dport 443 counter accept {% endif %} -add rule ip filter OUTPUT ip daddr 10.3.163.74 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.74 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.75 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.75 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.76 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.76 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.77 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.77 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.74 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.74 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.75 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.75 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.76 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.76 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.77 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.77 tcp dport 443 counter accept # ipa client ports {% if host in groups['staging'] %} -add rule ip filter OUTPUT ip daddr 10.3.166.21 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.63 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.21 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.63 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.21 tcp dport 389 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.63 tcp dport 389 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.21 tcp dport 636 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.63 tcp dport 636 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.21 tcp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.63 tcp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.21 udp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.63 udp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.21 tcp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.63 tcp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.21 udp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.63 udp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.21 udp dport 53 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.63 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.21 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.63 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.21 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.63 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.21 tcp dport 389 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.63 tcp dport 389 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.21 tcp dport 636 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.63 tcp dport 636 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.21 tcp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.63 tcp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.21 udp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.63 udp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.21 tcp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.63 tcp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.21 udp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.63 udp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.21 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.63 udp dport 53 counter accept {% else %} -add rule ip filter OUTPUT ip daddr 10.3.163.54 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.55 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.104 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.54 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.55 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.104 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.54 tcp dport 389 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.55 tcp dport 389 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.104 tcp dport 389 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.54 tcp dport 636 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.55 tcp dport 636 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.104 tcp dport 636 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.54 tcp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.55 tcp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.104 tcp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.54 udp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.55 udp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.104 udp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.54 tcp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.55 tcp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.104 tcp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.54 udp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.55 udp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.104 udp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.54 udp dport 53 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.55 udp dport 53 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.104 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.54 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.55 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.104 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.54 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.55 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.104 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.54 tcp dport 389 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.55 tcp dport 389 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.104 tcp dport 389 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.54 tcp dport 636 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.55 tcp dport 636 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.104 tcp dport 636 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.54 tcp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.55 tcp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.104 tcp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.54 udp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.55 udp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.104 udp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.54 tcp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.55 tcp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.104 tcp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.54 udp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.55 udp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.104 udp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.54 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.55 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.104 udp dport 53 counter accept {% endif %} {% if host in groups['staging'] %} # Allow nfs from koji01 -add rule ip filter INPUT ip daddr 10.3.167.64 tcp dport 2049 counter accept -add rule ip filter OUTPUT ip daddr 10.3.167.64 tcp dport 2049 counter accept +add rule {{_tn}} INPUT ip daddr 10.3.167.64 tcp dport 2049 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.167.64 tcp dport 2049 counter accept {% endif %} #nfs to vtap-fedora-nfs01.storage.phx2.redhat.com - a little to wide-open - but # kinda necessary -add rule ip filter INPUT ip saddr 10.3.162.11 counter accept -add rule ip filter OUTPUT ip daddr 10.3.162.11 counter accept +add rule {{_tn}} INPUT ip saddr 10.3.162.11 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.162.11 counter accept #!# NOTE: tcp/udp doesn't translate without a port?? -add rule ip filter INPUT ip saddr 10.3.162.12 counter accept -add rule ip filter OUTPUT ip daddr 10.3.162.12 counter accept -add rule ip filter INPUT ip saddr 10.3.162.13 counter accept -add rule ip filter OUTPUT ip daddr 10.3.162.13 counter accept -add rule ip filter INPUT ip saddr 10.3.162.14 counter accept -add rule ip filter OUTPUT ip daddr 10.3.162.14 counter accept +add rule {{_tn}} INPUT ip saddr 10.3.162.12 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.162.12 counter accept +add rule {{_tn}} INPUT ip saddr 10.3.162.13 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.162.13 counter accept +add rule {{_tn}} INPUT ip saddr 10.3.162.14 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.162.14 counter accept # ntp -add rule ip filter OUTPUT ip daddr 10.3.163.31 udp dport 123 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.32 udp dport 123 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.31 udp dport 123 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.32 udp dport 123 counter accept # dhcp -add rule ip filter OUTPUT ip daddr 10.3.163.10 udp dport 67 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.10 udp dport 67 counter accept # s390x builders ssh -add rule ip filter INPUT ip saddr 10.3.0.0/16 tcp dport 22 counter accept -add rule ip filter OUTPUT ip daddr 10.3.0.0/16 tcp sport 22 counter accept +add rule {{_tn}} INPUT ip saddr 10.3.0.0/16 tcp dport 22 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.0.0/16 tcp sport 22 counter accept -# if the host/group defines incoming tcp_ports - allow them -{% for port in tcp_ports %} -add rule ip filter INPUT tcp dport {{ port }} counter accept -{% endfor %} +{% include '_nft_accept_ports' %} -# if the host/group defines incoming udp_ports - allow them -{% for port in udp_ports %} -add rule ip filter INPUT udp dport {{ port }} counter accept -{% endfor %} - -# if there are custom rules - put them in as-is -{% for rule in nft_custom_rules %} -{{ rule }} -{% endfor %} +{% include '_nft_custom_rules' %} diff --git a/roles/base/templates/nftables/nftables.osuosl b/roles/base/templates/nftables/nftables.osuosl index e3ab7b4cfc..9c375f38d0 100644 --- a/roles/base/templates/nftables/nftables.osuosl +++ b/roles/base/templates/nftables/nftables.osuosl @@ -1,25 +1,11 @@ # {{ ansible_managed }} -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy accept; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; } +# {{ template_path }} -# allow ping and traceroute -add rule ip filter INPUT ip protocol icmp counter accept +{% include '_nft_accept_beg' %} -# localhost is fine -add rule ip filter INPUT iifname "lo" counter accept +{% include '_nft_accept_std' %} -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept -add rule ip filter OUTPUT ct state related,established counter accept - -# if the blocked_ips is defined - drop them -{% if blocked_ips is defined %} -{% for ip in blocked_ips %} -add rule ip filter INPUT ip saddr {{ ip }} counter drop -{% endfor %} -{% endif %} +{% include '_nft_blocked_ips' %} # allow ssh only from needed ips # vpn in from tun0 @@ -27,35 +13,10 @@ add rule ip filter INPUT iifname "tun0" ip saddr 192.168.0.0/24 ct state new tcp # external ip for iad2 add rule ip filter INPUT ip saddr 38.145.60.0/24 ct state new tcp dport 22 counter accept -# for nrpe - allow it from nocs -add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept -# FIXME - this is the global nat-ip and we need the noc01-specific ip -add rule ip filter INPUT ip saddr 38.145.60.15 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.60.16 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.3.163.10 tcp dport 5666 counter accept +{% include '_nft_accept_monitoring' %} -# if the host/group defines incoming tcp_ports - allow them -{% if tcp_ports is defined %} -{% for port in tcp_ports %} -add rule ip filter INPUT tcp dport {{ port }} counter accept -{% endfor %} -{% endif %} +{% include '_nft_accept_ports' %} -# if the host/group defines incoming udp_ports - allow them -{% if udp_ports is defined %} -{% for port in udp_ports %} -add rule ip filter INPUT udp dport {{ port }} counter accept -{% endfor %} -{% endif %} +{% include '_nft_custom_rules' %} -# if there are custom rules - put them in as-is -{% if nft_custom_rules is defined %} -{% for rule in nft_custom_rules %} -{{ rule }} -{% endfor %} -{% endif %} - -# otherwise kick everything out -add rule ip filter INPUT counter reject with icmp type host-prohibited -add rule ip filter FORWARD counter reject with icmp type host-prohibited +{% include '_nft_accept_end' %} diff --git a/roles/base/templates/nftables/nftables.releng b/roles/base/templates/nftables/nftables.releng index 5ca033a2e2..eac603212a 100644 --- a/roles/base/templates/nftables/nftables.releng +++ b/roles/base/templates/nftables/nftables.releng @@ -1,87 +1,50 @@ # {{ ansible_managed }} +# {{ template_path }} + # # NOTE: Chaging this template updates iptables on all releng hosts :) # Please check with sysadmin-main before pushing out an update here. # -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy drop; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; } -# loopback allowed -add rule ip filter INPUT iifname "lo" counter accept +# NOTE: We don't use _nft_accept_beg because INPUT policy default is drop -# Accept ping and traceroute (needs icmp) -add rule ip filter INPUT ip protocol icmp counter accept +# Set small Table Names. +# We need the big global ones so we can use them in *_rules but, that would be +# a lot in these files. +{% set _tn = nft_table_filter %} +{% set _tnat = nft_table_nat %} -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept +add table {{_tn}} +add chain {{_tn}} INPUT { type filter hook input priority 0; policy drop; } +add chain {{_tn}} FORWARD { type filter hook forward priority 0; policy accept; } +add chain {{_tn}} OUTPUT { type filter hook output priority 0; policy accept; } -# Overwrite any global rules -# for nrpe - allow it from nocs -add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept -# FIXME - this is the global nat-ip and we need the noc01-specific ip -add rule ip filter INPUT ip saddr 38.145.60.16 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.60.15 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.3.163.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.3.166.10 tcp dport 5666 counter accept -# Zabbix -add rule ip filter INPUT tcp dport 10051 counter accept -add rule ip filter INPUT ip saddr 10.3.163.198 tcp dport 10050 counter accept +{% include '_nft_accept_std' %} -# if the blocked_ips is defined - drop them -{% if blocked_ips is defined %} -{% for ip in blocked_ips %} -add rule ip filter INPUT ip saddr {{ ip }} counter drop -{% endfor %} -{% endif %} +{% include '_nft_accept_monitoring' %} + +{% include '_nft_blocked_ips' %} # SSH #!# NOTE: Do we still need/wants these 13+ years later? # ssh block against uni in .cz where problem(s) have been cited # added by skvidal on jan 24 2011 - as per request from spot -add rule ip filter INPUT ip saddr 147.251.0.0/16 tcp dport 22 counter reject +add rule {{_tn}} INPUT ip saddr 147.251.0.0/16 tcp dport 22 counter reject # matches last rule for a service we want blocked -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 22 counter reject with tcp reset -add rule ip filter INPUT tcp dport 22 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 22 counter reject with tcp reset +add rule {{_tn}} INPUT tcp dport 22 counter accept # Allow all netapp traffic -add rule ip filter INPUT ip saddr 10.3.162.0/24 counter accept +add rule {{_tn}} INPUT ip saddr 10.3.162.0/24 counter accept +{% include '_nft_accept_ssh' %} -# Custom Services +{% include '_nft_accept_http' %} -# Services TCP -add rule ip filter INPUT tcp dport 22 counter accept -add rule ip filter INPUT tcp dport 80 counter accept -add rule ip filter INPUT tcp dport 443 counter accept +{% include '_nft_accept_ports' %} -# Services UDP +{% include '_nft_custom_rules' %} -# more services we use - ports for random services and TG listeners. -# if the host/group defines incoming tcp_ports - allow them -{% if tcp_ports is defined %} -{% for port in tcp_ports %} -add rule ip filter INPUT tcp dport {{ port }} counter accept -{% endfor %} -{% endif %} +{% include '_nft_accept_vpn' %} -# if the host/group defines incoming udp_ports - allow them -{% if udp_ports is defined %} -{% for port in udp_ports %} -add rule ip filter INPUT udp dport {{ port }} counter accept -{% endfor %} -{% endif %} - -# if there are custom rules - put them in as-is -{% if nft_custom_rules is defined %} -{% for rule in nft_custom_rules %} -{{ rule }} -{% endfor %} -{% endif %} - -# Extra protection for 192.168.100.x vpn hosts. -add rule ip filter INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited - -add rule ip filter INPUT counter reject with icmp type host-prohibited +{% include '_nft_accept_end' %} diff --git a/roles/base/templates/nftables/nftables.sign b/roles/base/templates/nftables/nftables.sign index cb26a74942..e551e2f20f 100644 --- a/roles/base/templates/nftables/nftables.sign +++ b/roles/base/templates/nftables/nftables.sign @@ -1,22 +1,11 @@ # {{ ansible_managed }} -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy accept; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; } +# {{ template_path }} -# loopback allowed -add rule ip filter INPUT iifname "lo" counter accept +{% include '_nft_accept_beg' %} -# Accept ping and traceroute (needs icmp) -add rule ip filter INPUT ip protocol icmp counter accept - -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept +{% include '_nft_accept_std' %} # Allow connections from client/server -add rule ip filter INPUT tcp dport 44333-44334 counter accept - -# otherwise kick everything out -add rule ip filter INPUT counter reject with icmp type host-prohibited -add rule ip filter FORWARD counter reject with icmp type host-prohibited +add rule {{_tn}} INPUT tcp dport 44333-44334 counter accept +{% include '_nft_accept_end' %} diff --git a/roles/base/templates/nftables/nftables.staging b/roles/base/templates/nftables/nftables.staging index 3d13e3e928..564f9a8e09 100644 --- a/roles/base/templates/nftables/nftables.staging +++ b/roles/base/templates/nftables/nftables.staging @@ -1,43 +1,18 @@ # {{ ansible_managed }} -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy accept; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; } +# {{ template_path }} -# allow ping and traceroute -add rule ip filter INPUT ip protocol icmp counter accept +{% include '_nft_accept_beg' %} -# localhost is fine -add rule ip filter INPUT iifname "lo" counter accept +{% include '_nft_accept_std' %} -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept -add rule ip filter OUTPUT ct state related,established counter accept +{% include '_nft_accept_ssh' %} -# allow ssh - always -add rule ip filter INPUT ct state new tcp dport 22 counter accept +{% include '_nft_accept_monitoring' %} -# for nrpe - allow it from nocs -add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept -# FIXME - this is the global nat-ip and we need the noc01-specific ip -add rule ip filter INPUT ip saddr 38.145.60.16 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.60.15 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.3.163.10 tcp dport 5666 counter accept -# zabbix01.stg -add rule ip filter INPUT tcp dport 10051 counter accept -add rule ip filter INPUT ip saddr 10.3.166.61 tcp dport 10050 counter accept +{% include '_nft_accept_ports' %} - -# if the host/group defines incoming tcp_ports - allow them -{% for port in tcp_ports %} -add rule ip filter INPUT tcp dport {{ port }} counter accept -{% endfor %} - -# if the host/group defines incoming udp_ports - allow them -{% for port in udp_ports %} -add rule ip filter INPUT udp dport {{ port }} counter accept -{% endfor %} +# NOTE: This uses proxies_stg and not proxies. Also the VPN bits. ... so unique +# include '_nft_accept_proxy_ports' # if there are any proxy-only tcp_ports - allow them {% if proxy_tcp_ports is defined %} @@ -54,15 +29,8 @@ add rule ip filter INPUT ip saddr {{ hostvars[proxy]['ansible_eth0']['ipv4']['ad {% endfor %} {% endif %} -# if there are custom rules - put them in as-is -{% if nft_custom_rules is defined %} -{% for rule in nft_custom_rules %} -{{ rule }} -{% endfor %} -{% endif %} +{% include '_nft_custom_rules' %} -# otherwise kick everything out -add rule ip filter INPUT counter reject with icmp type host-prohibited -add rule ip filter FORWARD counter reject with icmp type host-prohibited +{% include '_nft_accept_end' %} # No nat rules diff --git a/roles/base/templates/nftables/nftables.storinator01.fedorainfracloud.org b/roles/base/templates/nftables/nftables.storinator01.fedorainfracloud.org index 4e1885a941..bd8e00f81d 100644 --- a/roles/base/templates/nftables/nftables.storinator01.fedorainfracloud.org +++ b/roles/base/templates/nftables/nftables.storinator01.fedorainfracloud.org @@ -1,42 +1,23 @@ # {{ ansible_managed }} -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy accept; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; } +# {{ template_path }} -# allow ping and traceroute -add rule ip filter INPUT ip protocol icmp counter accept +{% include '_nft_accept_beg' %} -# localhost is fine -add rule ip filter INPUT iifname "lo" counter accept +{% include '_nft_accept_std' %} -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept -add rule ip filter OUTPUT ct state related,established counter accept +{% include '_nft_accept_ssh' %} -# if the blocked_ips is defined - drop them -{% if blocked_ips is defined %} -{% for ip in blocked_ips %} -add rule ip filter INPUT ip saddr {{ ip }} counter drop -{% endfor %} -{% endif %} +{% include '_nft_accept_monitoring' %} -# allow ssh - always -add rule ip filter INPUT ct state new tcp dport 22 counter accept +{% include '_nft_blocked_ips' %} -# for nrpe - allow it from nocs -add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept -# FIXME - this is the global nat-ip and we need the noc01-specific ip -add rule ip filter INPUT ip saddr 38.145.60.16 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.60.15 tcp dport 5666 counter accept -# NOTE: we don't allow 10.3.163.10 / 10.3.166.10 or zabbix? +# NOTE: This is _nft_accept_ports but with special variables. # if the host/group defines incoming tcp_ports - allow them # NOTE: These are specific to eth0 {% if tcp_ports_eth0 is defined %} {% for port in tcp_ports_eth0 %} -add rule ip filter INPUT iifname "eth0" tcp dport {{ port }} counter accept +add rule {{_tn}} INPUT iifname "eth0" tcp dport {{ port }} counter accept {% endfor %} {% endif %} @@ -44,7 +25,7 @@ add rule ip filter INPUT iifname "eth0" tcp dport {{ port }} counter accept # NOTE: These are specific to eth0 {% if udp_ports_eth0 is defined %} {% for port in udp_ports_eth0 %} -add rule ip filter INPUT iifname "eth0" udp dport {{ port }} counter accept +add rule {{_tn}} INPUT iifname "eth0" udp dport {{ port }} counter accept {% endfor %} {% endif %} @@ -52,7 +33,7 @@ add rule ip filter INPUT iifname "eth0" udp dport {{ port }} counter accept # NOTE: These are specific to eth1 {% if tcp_ports_eth1 is defined %} {% for port in tcp_ports_eth1 %} -add rule ip filter INPUT iifname "eth1" tcp dport {{ port }} counter accept +add rule {{_tn}} INPUT iifname "eth1" tcp dport {{ port }} counter accept {% endfor %} {% endif %} @@ -60,30 +41,19 @@ add rule ip filter INPUT iifname "eth1" tcp dport {{ port }} counter accept # NOTE: These are specific to eth1 {% if udp_ports_eth1 is defined %} {% for port in udp_ports_eth1 %} -add rule ip filter INPUT iifname "eth1" udp dport {{ port }} counter accept +add rule {{_tn}} INPUT iifname "eth1" udp dport {{ port }} counter accept {% endfor %} {% endif %} +a -# if there are custom rules - put them in as-is -{% if nft_custom_rules is defined %} -{% for rule in nft_custom_rules %} -{{ rule }} -{% endfor %} -{% endif %} +{% include '_nft_custom_rules' %} -# otherwise kick everything out -add rule ip filter INPUT counter reject with icmp type host-prohibited -add rule ip filter FORWARD counter reject with icmp type host-prohibited +{% include '_nft_accept_end' %} -{% if nft_nat_rules %} -#!# FIXME: These are different priority to iptables template... -add table ip nat -add chain ip nat PREROUTING { type nat hook prerouting priority 0; policy accept; } -add chain ip nat INPUT { type nat hook input priority 0; policy accept; } -add chain ip nat OUTPUT { type nat hook output priority 0; policy accept; } -add chain ip nat POSTROUTING { type nat hook postrouting priority 0; policy accept; } +# Why are these different from nftables?? +{% set _nft_prio_preroute = "0" %} +{% set _nft_prio_input = "0" %} +{% set _nft_prio_output = "0" %} +{% set _nft_prio_postroute = "0" %} -{% for rule in nft_nat_rules %} -{{ rule }} -{% endfor %} -{% endif %} +{% include '_nft_nat' %} diff --git a/roles/base/templates/nftables/nftables.torrent02.fedoraproject.org b/roles/base/templates/nftables/nftables.torrent02.fedoraproject.org index 21f105432f..17ab8a187b 100644 --- a/roles/base/templates/nftables/nftables.torrent02.fedoraproject.org +++ b/roles/base/templates/nftables/nftables.torrent02.fedoraproject.org @@ -1,87 +1,31 @@ # {{ ansible_managed }} -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy accept; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; } +# {{ template_path }} -# allow ping and traceroute -add rule ip filter INPUT ip protocol icmp counter accept +{% include '_nft_accept_beg' %} -# localhost is fine -add rule ip filter INPUT iifname "lo" counter accept +{% include '_nft_accept_std' %} -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept -add rule ip filter OUTPUT ct state related,established counter accept +{% include '_nft_accept_ssh' %} -# if the blocked_ips is defined - drop them -{% if blocked_ips is defined %} -{% for ip in blocked_ips %} -add rule ip filter INPUT ip saddr {{ ip }} counter drop -{% endfor %} -{% endif %} +{% include '_nft_accept_monitoring' %} -# allow ssh - always -add rule ip filter INPUT ct state new tcp dport 22 counter accept +{% include '_nft_blocked_ips' %} -# for nrpe - allow it from nocs -add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept -# FIXME - this is the global nat-ip and we need the noc01-specific ip -add rule ip filter INPUT ip saddr 38.145.60.16 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.60.15 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.3.163.10 tcp dport 5666 counter accept -# NOTE: This doesn't include 10.3.166.10 -# NOTE: This doesn't include zabbix. +{% include '_nft_accept_ports' %} -{% if env != 'staging' and datacenter == 'phx2' and inventory_hostname not in groups['staging_friendly'] %} -# -# In the phx2 datacenter, both production and staging hosts are in the same -# subnet/vlan. We want production hosts to reject connectons from staging group hosts -# to prevent them from interfering with production. There are however a few hosts in -# production we have marked 'staging-friendly' that we do allow staging to talk to for -# mostly read-only data they need. -# -{% for host in groups['staging']|sort %} -{% if 'eth0_ip' in hostvars[host] %}# {{ host }} -add rule ip filter INPUT ip saddr {{ hostvars[host]['eth0_ip'] }} counter reject with icmp type host-prohibited -{% else %}# {{ host }} has no 'eth0_ip' listed -{% endif %} -{% endfor %} -{% endif %} +{% include '_nft_custom_rules' %} +{% include '_nft_accept_end' %} -# if the host/group defines incoming tcp_ports - allow them -{% if tcp_ports is defined %} -{% for port in tcp_ports %} -add rule ip filter INPUT tcp dport {{ port }} counter accept -{% endfor %} -{% endif %} +# This is the special bit for torrents... +{% set _tnr = nft_table_raw %} -# if the host/group defines incoming udp_ports - allow them -{% if udp_ports is defined %} -{% for port in udp_ports %} -add rule ip filter INPUT udp dport {{ port }} counter accept -{% endfor %} -{% endif %} - -# if there are custom rules - put them in as-is -{% if nft_custom_rules is defined %} -{% for rule in nft_custom_rules %} -{{ rule }} -{% endfor %} -{% endif %} - -# otherwise kick everything out -add rule ip filter INPUT counter reject with icmp type host-prohibited -add rule ip filter FORWARD counter reject with icmp type host-prohibited - -add table ip raw -add chain ip raw PREROUTING { type filter hook prerouting priority -300; policy accept; } -add chain ip raw OUTPUT { type filter hook output priority -300; policy accept; } +add table {{_tnr}} +add chain {{_tnr}} PREROUTING { type filter hook prerouting priority -300; policy accept; } +add chain {{_tnr}} OUTPUT { type filter hook output priority -300; policy accept; } # # We don't want to track all the torrent tracker connections, there's too many. # -add rule ip raw PREROUTING tcp dport 6969 counter notrack -add rule ip raw OUTPUT tcp sport 6969 counter notrack +add rule {{_tnr}} PREROUTING tcp dport 6969 counter notrack +add rule {{_tnr}} OUTPUT tcp sport 6969 counter notrack From 3821ea36b5795c0e79f49abad9a7e67eace16c1f Mon Sep 17 00:00:00 2001 From: James Antill Date: Fri, 1 May 2026 12:23:28 -0400 Subject: [PATCH 002/269] Cleanup nft merge. Chg osbuildapi and nft_custom_rules to use nft_table_filter. Signed-off-by: James Antill --- inventory/group_vars/autosign | 2 +- inventory/group_vars/autosign_hardware | 2 +- inventory/group_vars/bastion | 4 +- inventory/group_vars/bastion_stg | 4 +- inventory/group_vars/batcave | 4 +- inventory/group_vars/bodhi_backend | 2 +- inventory/group_vars/bodhi_backend_stg | 2 +- inventory/group_vars/certgetter | 4 +- inventory/group_vars/certgetter_stg | 4 +- inventory/group_vars/copr_hypervisor | 14 +- inventory/group_vars/copr_keygen_aws | 8 +- inventory/group_vars/copr_keygen_dev_aws | 8 +- inventory/group_vars/download | 2 +- inventory/group_vars/ipa | 2 +- inventory/group_vars/ipatuura_stg | 4 +- inventory/group_vars/ipsilon | 4 +- inventory/group_vars/ipsilon_rdu3 | 4 +- inventory/group_vars/ipsilon_stg | 4 +- inventory/group_vars/ipsilon_stg_rdu3 | 4 +- inventory/group_vars/kernel_qa | 2 +- inventory/group_vars/koji | 4 +- inventory/group_vars/kojipkgs | 4 +- inventory/group_vars/openqa_tap_workers | 6 +- inventory/group_vars/os_proxies | 6 +- inventory/group_vars/pagure | 58 +++---- inventory/group_vars/people | 2 +- inventory/group_vars/proxies | 160 +++++++++--------- inventory/group_vars/proxies_stg | 62 +++---- inventory/group_vars/rabbitmq | 16 +- inventory/group_vars/rabbitmq_stg | 16 +- inventory/group_vars/retrace | 4 +- inventory/group_vars/value | 10 +- inventory/group_vars/value_stg | 12 +- .../host_vars/db-fas01.rdu3.fedoraproject.org | 18 +- .../db-fas01.stg.rdu3.fedoraproject.org | 2 +- .../db-koji01.rdu3.fedoraproject.org | 8 +- .../db-koji01.stg.rdu3.fedoraproject.org | 2 +- .../db-riscv-koji01.rdu3.fedoraproject.org | 2 +- .../host_vars/db01.rdu3.fedoraproject.org | 2 +- .../host_vars/db01.stg.rdu3.fedoraproject.org | 2 +- .../host_vars/noc01.rdu3.fedoraproject.org | 10 +- .../nftables/_nft_accept_staging_friends | 13 ++ roles/base/templates/nftables/nftables | 2 + .../base/templates/nftables/nftables.bastion | 2 + .../templates/nftables/nftables.kojibuilder | 30 ++-- .../templates/osbuildapi-update-nft.sh | 14 +- 46 files changed, 284 insertions(+), 267 deletions(-) create mode 100644 roles/base/templates/nftables/_nft_accept_staging_friends diff --git a/inventory/group_vars/autosign b/inventory/group_vars/autosign index 02cd91ccd1..73f28d9e59 100644 --- a/inventory/group_vars/autosign +++ b/inventory/group_vars/autosign @@ -10,7 +10,7 @@ ansible_ifcfg_allowlist: # Make connections from signing bridges stateless, they break sigul connections # https://bugzilla.redhat.com/show_bug.cgi?id=1283364 custom_rules: ['-A INPUT --proto tcp --sport 44334 --source 10.16.169.120 -j ACCEPT'] -nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept'] host_group: autosign ipa_client_shell_groups: - sysadmin-releng diff --git a/inventory/group_vars/autosign_hardware b/inventory/group_vars/autosign_hardware index b4c54b6aeb..27344fac30 100644 --- a/inventory/group_vars/autosign_hardware +++ b/inventory/group_vars/autosign_hardware @@ -2,5 +2,5 @@ # Make connections from signing bridges stateless, they break sigul connections # https://bugzilla.redhat.com/show_bug.cgi?id=1283364 custom_rules: ['-A INPUT --proto tcp --sport 44334 --source 10.16.169.120 -j ACCEPT'] -nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept'] host_group: autosign diff --git a/inventory/group_vars/bastion b/inventory/group_vars/bastion index f3c30b4447..35edd27445 100644 --- a/inventory/group_vars/bastion +++ b/inventory/group_vars/bastion @@ -8,8 +8,8 @@ # custom_rules: ['-A INPUT -s 192.168.100/24 -j REJECT --reject-with icmp-host-prohibited', '-A INPUT -s 10.0.0.0/8 -p udp -m udp --dport 123 -j ACCEPT'] nft_block_rules: - - 'add rule ip filter INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited' - - 'add rule ip filter INPUT ip saddr 10.0.0.0/8 udp dport 123 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.0.0.0/8 udp dport 123 counter accept' # # This host is externally reachable # diff --git a/inventory/group_vars/bastion_stg b/inventory/group_vars/bastion_stg index f1d08f0366..b7bce13f2d 100644 --- a/inventory/group_vars/bastion_stg +++ b/inventory/group_vars/bastion_stg @@ -19,8 +19,8 @@ batcave_ipa_client_shell_groups: [] # custom_rules: ['-A INPUT -s 192.168.100/24 -j REJECT --reject-with icmp-host-prohibited', '-A INPUT -s 10.0.0.0/8 -p udp -m udp --dport 123 -j ACCEPT'] nft_block_rules: - - 'add rule ip filter INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited' - - 'add rule ip filter INPUT ip saddr 10.0.0.0/8 udp dport 123 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.0.0.0/8 udp dport 123 counter accept' # # Set this to get fasjson-client cron to make the aliases file # diff --git a/inventory/group_vars/batcave b/inventory/group_vars/batcave index 51a5358481..96d324dd68 100644 --- a/inventory/group_vars/batcave +++ b/inventory/group_vars/batcave @@ -4,8 +4,8 @@ ansible_base: /srv/web/infra # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' # # This host is externally reachable # diff --git a/inventory/group_vars/bodhi_backend b/inventory/group_vars/bodhi_backend index 5e58673e3b..c0b4170202 100644 --- a/inventory/group_vars/bodhi_backend +++ b/inventory/group_vars/bodhi_backend @@ -7,7 +7,7 @@ bodhi_message_routing_keys: # Make connections from signing bridges stateless, they break sigul connections # https://bugzilla.redhat.com/show_bug.cgi?id=1283364 custom_rules: ['-A INPUT --proto tcp --sport 44334 --source 10.5.125.71 -j ACCEPT'] -nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.5.125.71 tcp sport 44334 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.5.125.71 tcp sport 44334 counter accept'] host_group: bodhi2 ipa_client_shell_groups: - sysadmin-bodhi diff --git a/inventory/group_vars/bodhi_backend_stg b/inventory/group_vars/bodhi_backend_stg index 3a8266fd26..e9f7b60028 100644 --- a/inventory/group_vars/bodhi_backend_stg +++ b/inventory/group_vars/bodhi_backend_stg @@ -9,7 +9,7 @@ bodhi_message_routing_keys: # https://bugzilla.redhat.com/show_bug.cgi?id=1283364 # this is sign-bridge01.rdu3 ip 10.16.169.120 custom_rules: ['-A INPUT --proto tcp --sport 44334 --source 10.16.169.120 -j ACCEPT'] -nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept'] host_group: bodhi2 ipa_client_shell_groups: - sysadmin-bodhi diff --git a/inventory/group_vars/certgetter b/inventory/group_vars/certgetter index d4988816fb..c1710af73f 100644 --- a/inventory/group_vars/certgetter +++ b/inventory/group_vars/certgetter @@ -3,8 +3,8 @@ # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' lvm_size: 20000 mem_size: 2048 num_cpus: 2 diff --git a/inventory/group_vars/certgetter_stg b/inventory/group_vars/certgetter_stg index 177cf1b29b..0f6bf890d9 100644 --- a/inventory/group_vars/certgetter_stg +++ b/inventory/group_vars/certgetter_stg @@ -3,8 +3,8 @@ # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' lvm_size: 20000 mem_size: 2048 num_cpus: 2 diff --git a/inventory/group_vars/copr_hypervisor b/inventory/group_vars/copr_hypervisor index 7a2fe21d09..05b3bccb2d 100644 --- a/inventory/group_vars/copr_hypervisor +++ b/inventory/group_vars/copr_hypervisor @@ -31,13 +31,13 @@ nbde_client_bindings: libvirt_host: "{{ inventory_hostname }}" nft_custom_rules: - - add rule ip filter INPUT iifname virbr0 udp dport bootps accept - - add rule ip filter INPUT iifname virbr0 udp dport 53 accept - - add rule ip filter INPUT iifname virbr0 tcp dport ssh accept - - add rule ip filter FORWARD iifname "virbr0" oif != "virbr0" counter accept - - add rule ip filter FORWARD iifname "virbr0" ct state new counter accept - - add rule ip filter FORWARD ct state established,related counter accept - - add rule ip filter FORWARD ip protocol icmp counter accept + - add rule {{nft_table_filter}} INPUT iifname virbr0 udp dport bootps accept + - add rule {{nft_table_filter}} INPUT iifname virbr0 udp dport 53 accept + - add rule {{nft_table_filter}} INPUT iifname virbr0 tcp dport ssh accept + - add rule {{nft_table_filter}} FORWARD iifname "virbr0" oif != "virbr0" counter accept + - add rule {{nft_table_filter}} FORWARD iifname "virbr0" ct state new counter accept + - add rule {{nft_table_filter}} FORWARD ct state established,related counter accept + - add rule {{nft_table_filter}} FORWARD ip protocol icmp counter accept zabbix_macros: CPU.UTIL.CRIT: 100 diff --git a/inventory/group_vars/copr_keygen_aws b/inventory/group_vars/copr_keygen_aws index d5c426591b..e94a546e1a 100644 --- a/inventory/group_vars/copr_keygen_aws +++ b/inventory/group_vars/copr_keygen_aws @@ -9,10 +9,10 @@ custom_rules: - '-A INPUT -p tcp -m tcp -s 172.30.2.105 --dport 80 -j ACCEPT' - '-A INPUT -p tcp -m tcp -s 172.30.2.105 --dport 5167 -j ACCEPT' nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 52.44.175.77 tcp dport 80 counter accept' - - 'add rule ip filter INPUT ip saddr 52.44.175.77 tcp dport 5167 counter accept' - - 'add rule ip filter INPUT ip saddr 172.30.2.105 tcp dport 80 counter accept' - - 'add rule ip filter INPUT ip saddr 172.30.2.105 tcp dport 5167 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 52.44.175.77 tcp dport 80 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 52.44.175.77 tcp dport 5167 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 172.30.2.105 tcp dport 80 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 172.30.2.105 tcp dport 5167 counter accept' freezes: false tcp_ports: [22, # node_exporter/prometheus diff --git a/inventory/group_vars/copr_keygen_dev_aws b/inventory/group_vars/copr_keygen_dev_aws index e64237e875..33308f4ee9 100644 --- a/inventory/group_vars/copr_keygen_dev_aws +++ b/inventory/group_vars/copr_keygen_dev_aws @@ -9,10 +9,10 @@ custom_rules: - '-A INPUT -p tcp -m tcp -s 18.208.10.131 --dport 80 -j ACCEPT' - '-A INPUT -p tcp -m tcp -s 18.208.10.131 --dport 5167 -j ACCEPT' nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 172.30.2.11 tcp dport 80 counter accept' - - 'add rule ip filter INPUT ip saddr 172.30.2.11 tcp dport 5167 counter accept' - - 'add rule ip filter INPUT ip saddr 18.208.10.131 tcp dport 80 counter accept' - - 'add rule ip filter INPUT ip saddr 18.208.10.131 tcp dport 5167 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 172.30.2.11 tcp dport 80 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 172.30.2.11 tcp dport 5167 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 18.208.10.131 tcp dport 80 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 18.208.10.131 tcp dport 5167 counter accept' freezes: false tcp_ports: [22, # node_exporter/prometheus diff --git a/inventory/group_vars/download b/inventory/group_vars/download index 2e0512579b..e4ae40fcaf 100644 --- a/inventory/group_vars/download +++ b/inventory/group_vars/download @@ -111,7 +111,7 @@ ipa_host_group_desc: Download servers nagios_Check_Services: swap: false nft_block_rules: - - 'add rule ip filter INPUT ip saddr 212.143.41.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 212.143.41.0/24 counter reject' primary_auth_source: ipa zabbix_macros: 'APACHE.STATUS.PORT': 443 # Proxies appear to ignore port 80 for apache-status diff --git a/inventory/group_vars/ipa b/inventory/group_vars/ipa index 0c023273a0..71f0c59e3d 100644 --- a/inventory/group_vars/ipa +++ b/inventory/group_vars/ipa @@ -1,7 +1,7 @@ --- # Define resources for this group of hosts here. custom_rules: ['-A INPUT -p udp -m udp -s 10.16.0.0/16 --dport 53 -j ACCEPT'] -nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.16.0.0/16 udp dport 53 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.16.0.0/16 udp dport 53 counter accept'] host_backup_targets: ['/var/lib/ipa/backup', '/var/log/dirsrv/slapd-FEDORAPROJECT-ORG'] ipa_client_shell_groups: - sysadmin-accounts diff --git a/inventory/group_vars/ipatuura_stg b/inventory/group_vars/ipatuura_stg index 3d09c4e75e..90d5d20b90 100644 --- a/inventory/group_vars/ipatuura_stg +++ b/inventory/group_vars/ipatuura_stg @@ -3,8 +3,8 @@ # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' ipa_host_group: ipatuura ipa_host_group_desc: IPA-tuura SCIM application ipa_client_shell_groups: diff --git a/inventory/group_vars/ipsilon b/inventory/group_vars/ipsilon index 74e9f97595..10d54c9dec 100644 --- a/inventory/group_vars/ipsilon +++ b/inventory/group_vars/ipsilon @@ -3,8 +3,8 @@ # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' ipa_host_group: ipsilon ipa_host_group_desc: Ipsilon SSO application ipsilon_db_host: "db-fas01.rdu3.fedoraproject.org" diff --git a/inventory/group_vars/ipsilon_rdu3 b/inventory/group_vars/ipsilon_rdu3 index 74e9f97595..10d54c9dec 100644 --- a/inventory/group_vars/ipsilon_rdu3 +++ b/inventory/group_vars/ipsilon_rdu3 @@ -3,8 +3,8 @@ # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' ipa_host_group: ipsilon ipa_host_group_desc: Ipsilon SSO application ipsilon_db_host: "db-fas01.rdu3.fedoraproject.org" diff --git a/inventory/group_vars/ipsilon_stg b/inventory/group_vars/ipsilon_stg index e911a21f10..8e1b0773b4 100644 --- a/inventory/group_vars/ipsilon_stg +++ b/inventory/group_vars/ipsilon_stg @@ -3,8 +3,8 @@ # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' ipa_host_group: ipsilon ipa_host_group_desc: Ipsilon SSO application ipa_client_shell_groups: diff --git a/inventory/group_vars/ipsilon_stg_rdu3 b/inventory/group_vars/ipsilon_stg_rdu3 index e911a21f10..8e1b0773b4 100644 --- a/inventory/group_vars/ipsilon_stg_rdu3 +++ b/inventory/group_vars/ipsilon_stg_rdu3 @@ -3,8 +3,8 @@ # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' ipa_host_group: ipsilon ipa_host_group_desc: Ipsilon SSO application ipa_client_shell_groups: diff --git a/inventory/group_vars/kernel_qa b/inventory/group_vars/kernel_qa index 593edfd488..cfee9501db 100644 --- a/inventory/group_vars/kernel_qa +++ b/inventory/group_vars/kernel_qa @@ -1,6 +1,6 @@ --- custom_rules: ['-A INPUT -p tcp -m tcp -s 192.168.122.0/24 --dport 2049 -j ACCEPT'] -nft_custom_rules: ['add rule ip filter INPUT ip saddr 192.168.122.0/24 tcp dport 2049 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 192.168.122.0/24 tcp dport 2049 counter accept'] freezes: false ipa_client_shell_groups: - sysadmin-kernel diff --git a/inventory/group_vars/koji b/inventory/group_vars/koji index 9f9b351aee..ec25cd2d60 100644 --- a/inventory/group_vars/koji +++ b/inventory/group_vars/koji @@ -5,8 +5,8 @@ custom_rules: [ '-A INPUT -d 224.0.0.0/8 -j ACCEPT', '-A INPUT -p vrrp -j ACCEPT'] # Needed for keepalived nft_custom_rules: - - 'add rule ip filter INPUT ip daddr 224.0.0.0/8 counter accept' - - 'add rule ip filter INPUT ip protocol vrrp counter accept' + - 'add rule {{nft_table_filter}} INPUT ip daddr 224.0.0.0/8 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip protocol vrrp counter accept' docker_registry: "candidate-registry.fedoraproject.org" ipa_client_shell_groups: - sysadmin-releng diff --git a/inventory/group_vars/kojipkgs b/inventory/group_vars/kojipkgs index b8e6a711bb..e73a655f8a 100644 --- a/inventory/group_vars/kojipkgs +++ b/inventory/group_vars/kojipkgs @@ -6,8 +6,8 @@ custom_rules: [ '-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] # Need for rsync from log01 for logs. nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' ipa_client_shell_groups: - sysadmin-noc - sysadmin-releng diff --git a/inventory/group_vars/openqa_tap_workers b/inventory/group_vars/openqa_tap_workers index ca322db3e0..7fb7eacf15 100644 --- a/inventory/group_vars/openqa_tap_workers +++ b/inventory/group_vars/openqa_tap_workers @@ -2,9 +2,9 @@ # uses interface definition from host vars custom_rules: ['-A FORWARD -i br0 -j ACCEPT', '-A FORWARD -m state -i {{ openqa_tap_iface }} -o br0 --state RELATED,ESTABLISHED -j ACCEPT', '-A INPUT -i br0 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter FORWARD iifname "br0" counter accept' - - 'add rule ip filter FORWARD iifname "{{ openqa_tap_iface }}" oifname "br0" ct state related,established counter accept' - - 'add rule ip filter INPUT iifname "br0" counter accept' + - 'add rule {{nft_table_filter}} FORWARD iifname "br0" counter accept' + - 'add rule {{nft_table_filter}} FORWARD iifname "{{ openqa_tap_iface }}" oifname "br0" ct state related,established counter accept' + - 'add rule {{nft_table_filter}} INPUT iifname "br0" counter accept' # for iptables rules...maybe other stuff in future? both staging # and prod workers are in this group host_group: openqa-tap-workers diff --git a/inventory/group_vars/os_proxies b/inventory/group_vars/os_proxies index 97579daf6a..6d857ed86c 100644 --- a/inventory/group_vars/os_proxies +++ b/inventory/group_vars/os_proxies @@ -6,10 +6,10 @@ custom_rules: [ '-A INPUT -p tcp --dport 22623 --src 38.145.48.0/27 -j ACCEPT'] nft_custom_rules: # Needed for keepalived - - 'add rule ip filter INPUT ip daddr 224.0.0.0/8 counter accept' - - 'add rule ip filter INPUT ip protocol vrrp counter accept' + - 'add rule {{nft_table_filter}} INPUT ip daddr 224.0.0.0/8 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip protocol vrrp counter accept' # machinectl api - - 'add rule ip filter INPUT ip saddr 38.145.48.0/27 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 38.145.48.0/27 tcp dport 22623 counter accept' datacenter: cloud host_group: cloud lvm_size: 20000 diff --git a/inventory/group_vars/pagure b/inventory/group_vars/pagure index eb711ff83c..10fdc94738 100644 --- a/inventory/group_vars/pagure +++ b/inventory/group_vars/pagure @@ -8,35 +8,35 @@ custom_rules: [ '-A INPUT -s 47.76.99.127/32 -j REJECT' ] nft_block_rules: - - 'add rule ip filter INPUT ip saddr 81.69.171.38 counter reject' - - 'add rule ip filter INPUT ip saddr 175.24.248.206 counter reject' - - 'add rule ip filter INPUT ip saddr 47.76.0.0/14 counter reject' - - 'add rule ip filter INPUT ip saddr 47.80.0.0/13 counter reject' - - 'add rule ip filter INPUT ip saddr 47.74.0.0/15 counter reject' - - 'add rule ip filter INPUT ip saddr 66.249.64.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.134.64.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.134.0.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.134.224.0/19 counter reject' - - 'add rule ip filter INPUT ip saddr 43.159.41.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.163.8.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.128.64.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.156.0.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.128.64.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.133.32.0/19 counter reject' - - 'add rule ip filter INPUT ip saddr 43.134.128.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.159.37.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.153.192.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.159.32.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.156.64.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.163.0.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 14.153.15.174 counter reject' - - 'add rule ip filter INPUT ip saddr 47.246.0.0/16 counter reject' - - 'add rule ip filter INPUT ip saddr 47.236.0.0/14 counter reject' - - 'add rule ip filter INPUT ip saddr 47.235.0.0/16 counter reject' - - 'add rule ip filter INPUT ip saddr 47.240.0.0/14 counter reject' - - 'add rule ip filter INPUT ip saddr 47.244.0.0/15 counter reject' - - 'add rule ip filter INPUT ip saddr 146.174.128.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 154.222.253.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 81.69.171.38 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 175.24.248.206 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.76.0.0/14 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.80.0.0/13 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.74.0.0/15 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 66.249.64.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.64.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.0.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.224.0/19 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.41.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.163.8.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.128.64.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.156.0.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.128.64.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.133.32.0/19 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.128.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.37.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.153.192.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.32.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.156.64.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.163.0.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 14.153.15.174 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.246.0.0/16 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.236.0.0/14 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.235.0.0/16 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.240.0.0/14 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.244.0.0/15 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 146.174.128.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 154.222.253.0/24 counter reject' # For the MOTD db_backup_dir: ['/backups'] dbs_to_backup: ['pagure'] diff --git a/inventory/group_vars/people b/inventory/group_vars/people index 0d8398988a..2bb85c5fc1 100644 --- a/inventory/group_vars/people +++ b/inventory/group_vars/people @@ -6,7 +6,7 @@ clamscan_paths: # For the MOTD # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] -nft_custom_rules: ['add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'] git_basepath: / git_daemon_user: nobody git_port: 9418 diff --git a/inventory/group_vars/proxies b/inventory/group_vars/proxies index 48354ae605..68a41a9592 100644 --- a/inventory/group_vars/proxies +++ b/inventory/group_vars/proxies @@ -34,90 +34,90 @@ custom_rules: [ '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.163.128 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.163.129 -j ACCEPT'] nft_block_rules: - - 'add rule ip filter INPUT ip saddr 81.69.171.38 counter reject' - - 'add rule ip filter INPUT ip saddr 175.24.248.206 counter reject' - - 'add rule ip filter INPUT ip saddr 47.76.0.0/14 counter reject' - - 'add rule ip filter INPUT ip saddr 47.80.0.0/13 counter reject' - - 'add rule ip filter INPUT ip saddr 47.74.0.0/15 counter reject' - - 'add rule ip filter INPUT ip saddr 66.249.64.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.134.64.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.134.0.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.134.224.0/19 counter reject' - - 'add rule ip filter INPUT ip saddr 43.159.41.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.163.8.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.128.64.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.156.0.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.128.64.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.133.32.0/19 counter reject' - - 'add rule ip filter INPUT ip saddr 43.134.128.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.159.37.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.153.192.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.159.32.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.156.64.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.163.0.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 14.153.15.174 counter reject' - - 'add rule ip filter INPUT ip saddr 47.246.0.0/16 counter reject' - - 'add rule ip filter INPUT ip saddr 47.236.0.0/14 counter reject' - - 'add rule ip filter INPUT ip saddr 47.235.0.0/16 counter reject' - - 'add rule ip filter INPUT ip saddr 47.240.0.0/14 counter reject' - - 'add rule ip filter INPUT ip saddr 47.244.0.0/15 counter reject' - - 'add rule ip filter INPUT ip saddr 152.53.36.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 66.249.69.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 159.138.218.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 188.75.180.46/32 counter reject' - - 'add rule ip filter INPUT ip saddr 2.57.121.144/32 counter reject' - - 'add rule ip filter INPUT ip saddr 45.78.192.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.0.0/19 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.32.0/21 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.40.0/21 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.48.0/20 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.64.0/20 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.80.0/21 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.88.0/22 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.92.0/23 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.95.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.96.0/23 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.98.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.128.0/19 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.160.0/20 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.176.0/21 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.184.0/21 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.185.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.186.0/23 counter reject' - - 'add rule ip filter INPUT ip saddr 34.159.191.146/32 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 81.69.171.38 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 175.24.248.206 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.76.0.0/14 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.80.0.0/13 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.74.0.0/15 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 66.249.64.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.64.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.0.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.224.0/19 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.41.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.163.8.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.128.64.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.156.0.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.128.64.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.133.32.0/19 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.128.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.37.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.153.192.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.32.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.156.64.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.163.0.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 14.153.15.174 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.246.0.0/16 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.236.0.0/14 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.235.0.0/16 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.240.0.0/14 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.244.0.0/15 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 152.53.36.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 66.249.69.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 159.138.218.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 188.75.180.46/32 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 2.57.121.144/32 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 45.78.192.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.0.0/19 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.32.0/21 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.40.0/21 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.48.0/20 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.64.0/20 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.80.0/21 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.88.0/22 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.92.0/23 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.95.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.96.0/23 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.98.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.128.0/19 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.160.0/20 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.176.0/21 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.184.0/21 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.185.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.186.0/23 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 34.159.191.146/32 counter reject' nft_custom_rules: # Need for rsync from log01 for logs. - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 209.132.181.102 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 209.132.181.102 tcp dport 873 counter accept' # allow varnish from localhost - - 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept' # also allow varnish from internal for purge requests - - 'add rule ip filter INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.120 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.121 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.122 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.123 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.124 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.125 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.126 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.65 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.127 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.128 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.129 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.120 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.121 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.122 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.123 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.124 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.125 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.126 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.65 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.127 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.128 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.129 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.120 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.121 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.122 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.123 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.124 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.125 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.126 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.65 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.127 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.128 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.129 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.120 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.121 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.122 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.123 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.124 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.125 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.126 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.65 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.127 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.128 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.129 tcp dport 22623 counter accept' external: true ipa_client_shell_groups: - fi-apprentice diff --git a/inventory/group_vars/proxies_stg b/inventory/group_vars/proxies_stg index ca008b80e5..dbac0ed582 100644 --- a/inventory/group_vars/proxies_stg +++ b/inventory/group_vars/proxies_stg @@ -11,44 +11,44 @@ custom_rules: [ '-A INPUT -p tcp -m tcp -s 192.168.1.0/24 --dport 6081 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 10.16.163.0/24 --dport 6081 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.115 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.116 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.117 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.118 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.119 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.120 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.121 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.122 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.123 -j ACCEPT'] nft_block_rules: - - 'add rule ip filter INPUT ip saddr 2.57.121.144/32 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 2.57.121.144/32 counter reject' nft_custom_rules: # Need for rsync from log01 for logs. - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' # allow varnish from localhost - - 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept' # also allow varnish from internal for purge requests - - 'add rule ip filter INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.115 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.116 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.117 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.118 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.119 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.120 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.121 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.122 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.123 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.115 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.116 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.117 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.118 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.119 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.120 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.121 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.122 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.123 tcp dport 22623 counter accept' # Need for rsync from log01 for logs. - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.50 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.50 tcp dport 873 counter accept' # allow varnish from localhost - - 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept' # also allow varnish from internal for purge requests - - 'add rule ip filter INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.115 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.116 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.117 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.118 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.119 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.120 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.121 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.122 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.123 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.115 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.116 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.117 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.118 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.119 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.120 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.121 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.122 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.123 tcp dport 22623 counter accept' external: true ipa_client_shell_groups: - fi-apprentice diff --git a/inventory/group_vars/rabbitmq b/inventory/group_vars/rabbitmq index 4965d0f9ad..4eb052b181 100644 --- a/inventory/group_vars/rabbitmq +++ b/inventory/group_vars/rabbitmq @@ -9,16 +9,16 @@ custom_rules: [ ] nft_custom_rules: # Neeed for rsync from log01 for logs. - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' # Inter-node traffic - - 'add rule ip filter INPUT ip saddr 10.16.163.78 tcp dport 25672 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.79 tcp dport 25672 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.80 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.78 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.79 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.80 tcp dport 25672 counter accept' # In RDU3 - - 'add rule ip filter INPUT ip saddr 10.16.163.78 tcp dport 25672 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.79 tcp dport 25672 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.80 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.78 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.79 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.80 tcp dport 25672 counter accept' ipa_host_group: rabbitmq ipa_host_group_desc: RabbitMQ service ipa_shell_groups: diff --git a/inventory/group_vars/rabbitmq_stg b/inventory/group_vars/rabbitmq_stg index c49e840c32..de7aae5d30 100644 --- a/inventory/group_vars/rabbitmq_stg +++ b/inventory/group_vars/rabbitmq_stg @@ -9,16 +9,16 @@ custom_rules: [ ] nft_custom_rules: # Neeed for rsync from log01 for logs. - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' # Inter-node traffic - - 'add rule ip filter INPUT ip saddr 10.16.166.78 tcp dport 25672 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.79 tcp dport 25672 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.80 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.78 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.79 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.80 tcp dport 25672 counter accept' # In RDU3 - - 'add rule ip filter INPUT ip saddr 10.16.166.78 tcp dport 25672 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.79 tcp dport 25672 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.80 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.78 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.79 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.80 tcp dport 25672 counter accept' ipa_host_group: rabbitmq ipa_host_group_desc: RabbitMQ service ipa_shell_groups: diff --git a/inventory/group_vars/retrace b/inventory/group_vars/retrace index 40975a18a6..7a655ce4a2 100644 --- a/inventory/group_vars/retrace +++ b/inventory/group_vars/retrace @@ -3,8 +3,8 @@ custom_rules: - '-A INPUT -p tcp -m tcp -s 10.5.78.11 --dport 2049 -j ACCEPT' - '-A INPUT -p tcp -m tcp -s 10.5.78.11 --dport 5432 -j ACCEPT' nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.5.78.11 tcp dport 2049 counter accept' - - 'add rule ip filter INPUT ip saddr 10.5.78.11 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.5.78.11 tcp dport 2049 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.5.78.11 tcp dport 5432 counter accept' env: production freezes: false ipa_client_shell_groups: diff --git a/inventory/group_vars/value b/inventory/group_vars/value index 6321063d96..9e794d8352 100644 --- a/inventory/group_vars/value +++ b/inventory/group_vars/value @@ -10,13 +10,13 @@ custom_rules: [ '-A INPUT -p tcp -m tcp -s 10.16.163.35 --dport 5050 -j ACCEPT'] nft_custom_rules: # Needed for rsync from log01 for logs. - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' # Needed to let nagios on noc01 and noc02 pipe alerts to zodbot here - - 'add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.20 tcp dport 5050 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.20 tcp dport 5050 counter accept' # batcave01 also needs access to announce commits. - - 'add rule ip filter INPUT ip saddr 10.16.163.35 tcp dport 5050 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.35 tcp dport 5050 counter accept' deployment_type: prod ipa_client_shell_groups: - fi-apprentice diff --git a/inventory/group_vars/value_stg b/inventory/group_vars/value_stg index 02e65cdfdf..b6c3cea5ba 100644 --- a/inventory/group_vars/value_stg +++ b/inventory/group_vars/value_stg @@ -10,14 +10,14 @@ custom_rules: [ '-A INPUT -p tcp -m tcp -s 10.16.163.35 --dport 5050 -j ACCEPT'] nft_custom_rules: # Neeed for rsync from log01 for logs. - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' # Needed to let nagios on noc01 and noc02 (noc01.stg) pipe alerts to zodbot here - - 'add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept' - - 'add rule ip filter INPUT ip saddr 152.19.134.192 tcp dport 5050 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 152.19.134.192 tcp dport 5050 counter accept' # batcave01 also needs access to announce commits. - - 'add rule ip filter INPUT ip saddr 10.16.163.35 tcp dport 5050 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.35 tcp dport 5050 counter accept' deployment_type: stg ipa_client_shell_groups: - fi-apprentice diff --git a/inventory/host_vars/db-fas01.rdu3.fedoraproject.org b/inventory/host_vars/db-fas01.rdu3.fedoraproject.org index 593c7e5fbe..795abe9429 100644 --- a/inventory/host_vars/db-fas01.rdu3.fedoraproject.org +++ b/inventory/host_vars/db-fas01.rdu3.fedoraproject.org @@ -4,17 +4,17 @@ # nft_custom_rules: # Openshift nodes (egress policy will block connection from non-authorized projects) - - 'add rule ip filter INPUT ip saddr 10.16.163.69 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.70 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.71 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.72 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.73 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.69 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.70 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.71 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.72 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.73 tcp dport 5432 counter accept' # noc01 needs to connect to check the db - - 'add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.10 tcp dport 5432 counter accept' # Ipsilon VMs - - 'add rule ip filter INPUT ip saddr 10.16.163.105 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.106 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.117 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.105 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.106 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.117 tcp dport 5432 counter accept' # This is a generic list, monitored by collectd databases: - fas2 diff --git a/inventory/host_vars/db-fas01.stg.rdu3.fedoraproject.org b/inventory/host_vars/db-fas01.stg.rdu3.fedoraproject.org index c8b25167e0..6cacb03829 100644 --- a/inventory/host_vars/db-fas01.stg.rdu3.fedoraproject.org +++ b/inventory/host_vars/db-fas01.stg.rdu3.fedoraproject.org @@ -5,7 +5,7 @@ # # TODO: lock it down more nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.166.0/24 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.0/24 tcp dport 5432 counter accept' # This is a generic list, monitored by collectd databases: - fas2 diff --git a/inventory/host_vars/db-koji01.rdu3.fedoraproject.org b/inventory/host_vars/db-koji01.rdu3.fedoraproject.org index 8b3fa3900a..28e3fe8db6 100644 --- a/inventory/host_vars/db-koji01.rdu3.fedoraproject.org +++ b/inventory/host_vars/db-koji01.rdu3.fedoraproject.org @@ -3,10 +3,10 @@ # Only allow postgresql access from the frontend node. # nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.169.104 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.169.105 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.169.10 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.104 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.105 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.10 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.10 tcp dport 5432 counter accept' # This is a generic list, monitored by collectd databases: - koji diff --git a/inventory/host_vars/db-koji01.stg.rdu3.fedoraproject.org b/inventory/host_vars/db-koji01.stg.rdu3.fedoraproject.org index 7c0ad3f451..2b120673a3 100644 --- a/inventory/host_vars/db-koji01.stg.rdu3.fedoraproject.org +++ b/inventory/host_vars/db-koji01.stg.rdu3.fedoraproject.org @@ -2,7 +2,7 @@ # # Only allow postgresql access from the frontend node. # -nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.16.167.64 tcp dport 5432 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.16.167.64 tcp dport 5432 counter accept'] # This is a generic list, monitored by collectd databases: - koji diff --git a/inventory/host_vars/db-riscv-koji01.rdu3.fedoraproject.org b/inventory/host_vars/db-riscv-koji01.rdu3.fedoraproject.org index 332c62b5a6..ddfa86353d 100644 --- a/inventory/host_vars/db-riscv-koji01.rdu3.fedoraproject.org +++ b/inventory/host_vars/db-riscv-koji01.rdu3.fedoraproject.org @@ -2,7 +2,7 @@ # This is a generic list, monitored by collectd custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.172.21 --dport 5432 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.172.21 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.172.21 tcp dport 5432 counter accept' databases: - koji datacenter: rdu3 diff --git a/inventory/host_vars/db01.rdu3.fedoraproject.org b/inventory/host_vars/db01.rdu3.fedoraproject.org index e4c6b175d9..f626ec2a52 100644 --- a/inventory/host_vars/db01.rdu3.fedoraproject.org +++ b/inventory/host_vars/db01.rdu3.fedoraproject.org @@ -2,7 +2,7 @@ # # We should narrow this down at some point # -nft_custom_rules: ['add rule ip filter INPUT tcp dport 5432 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT tcp dport 5432 counter accept'] # This is a generic list, monitored by collectd databases: - anitya diff --git a/inventory/host_vars/db01.stg.rdu3.fedoraproject.org b/inventory/host_vars/db01.stg.rdu3.fedoraproject.org index c8ade85061..687ac8513e 100644 --- a/inventory/host_vars/db01.stg.rdu3.fedoraproject.org +++ b/inventory/host_vars/db01.stg.rdu3.fedoraproject.org @@ -2,7 +2,7 @@ # # We should narrow this down at some point # -nft_custom_rules: ['add rule ip filter INPUT tcp dport 5432 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT tcp dport 5432 counter accept'] # This is a generic list, monitored by collectd databases: - askfedora diff --git a/inventory/host_vars/noc01.rdu3.fedoraproject.org b/inventory/host_vars/noc01.rdu3.fedoraproject.org index f8b1f05238..53e7ab1f17 100644 --- a/inventory/host_vars/noc01.rdu3.fedoraproject.org +++ b/inventory/host_vars/noc01.rdu3.fedoraproject.org @@ -6,13 +6,13 @@ custom_rules: [ '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT' ] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 192.168.1.20 tcp dport 5666 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.20 tcp dport 5666 counter accept' # needed to allow rsync from log01 - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' # needed to allow 8080 (firmware-proxy from iDRAC mgmt vlans - - 'add rule ip filter INPUT ip saddr 10.16.160.0/24 tcp dport 8080 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.161.0/24 tcp dport 8080 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.160.0/24 tcp dport 8080 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.161.0/24 tcp dport 8080 counter accept' datacenter: rdu3 eth0_ipv4_gw: 10.16.163.254 eth0_ipv4_ip: 10.16.163.10 diff --git a/roles/base/templates/nftables/_nft_accept_staging_friends b/roles/base/templates/nftables/_nft_accept_staging_friends new file mode 100644 index 0000000000..f7fd1a0a56 --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_staging_friends @@ -0,0 +1,13 @@ +# _nft_accept_staging_friends + +{% if env != 'staging' and datacenter == 'rdu3' and inventory_hostname not in groups['staging_friendly'] %} +# +# In the rdu3 datacenter, both production and staging hosts are in different +# vlans, and different subnets. However, just as a precaution, we want prod machines to +# reject connections from any staging host just in case there's some globally enabled port. +# There are however a few hosts in production we have marked 'staging-friendly' +# that we do allow staging to talk to for mostly read-only data they need. +# +add rule {{_tn}} INPUT ip saddr 10.16.166.0/24 counter reject with icmp type host-prohibited +add rule {{_tn}} INPUT ip saddr 10.16.167.0/24 counter reject with icmp type host-prohibited +{% endif %} diff --git a/roles/base/templates/nftables/nftables b/roles/base/templates/nftables/nftables index 00904a7306..8d96da9f4c 100644 --- a/roles/base/templates/nftables/nftables +++ b/roles/base/templates/nftables/nftables @@ -11,6 +11,8 @@ {% include '_nft_accept_vpn' %} +{% include '_nft_accept_staging_friends' %} + {% include '_nft_block_rules' %} {% include '_nft_accept_ports' %} diff --git a/roles/base/templates/nftables/nftables.bastion b/roles/base/templates/nftables/nftables.bastion index 4aabe7bb87..f3a3cde524 100644 --- a/roles/base/templates/nftables/nftables.bastion +++ b/roles/base/templates/nftables/nftables.bastion @@ -17,6 +17,8 @@ add rule {{_tn}} INPUT ip saddr 192.168.0.0/24 tcp dport 25 counter accept # This rejects all VPN traffic at the end. 192.168.100.0/24 {% include '_nft_accept_vpn' %} +{% include '_nft_accept_staging_friends' %} + add rule {{_tn}} INPUT ip saddr 10.3.160.0/19 tcp dport 25 counter accept {% if datacenter == 'rdu3' %} diff --git a/roles/base/templates/nftables/nftables.kojibuilder b/roles/base/templates/nftables/nftables.kojibuilder index 1a6a10a21c..8ad3424d09 100644 --- a/roles/base/templates/nftables/nftables.kojibuilder +++ b/roles/base/templates/nftables/nftables.kojibuilder @@ -31,33 +31,33 @@ add rule {{_tn}} OUTPUT ip daddr 10.16.0.17 tcp dport 80 counter accept add rule {{_tn}} OUTPUT ip daddr 10.16.0.35 tcp dport 80 counter accept add rule {{_tn}} OUTPUT ip daddr 10.1.102.24 tcp dport 80 counter accept add rule {{_tn}} OUTPUT ip daddr 10.1.102.50 tcp dport 80 counter accept -add rule {{_tn}} OUTPUT ip daddr 10.3.169.106 tcp dport 80 counter accept -add rule {{_tn}} OUTPUT ip daddr 10.3.169.107 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.169.106 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.169.107 tcp dport 80 counter accept {% endif %} # tang for buildhw -add rule {{_tn}} OUTPUT ip daddr 10.3.163.37 tcp dport 80 counter accept -add rule {{_tn}} OUTPUT ip daddr 10.3.163.38 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.37 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.38 tcp dport 80 counter accept # DNS -add rule {{_tn}} OUTPUT ip daddr 10.3.163.33 udp dport 53 counter accept -add rule {{_tn}} OUTPUT ip daddr 10.3.163.33 tcp dport 53 counter accept -add rule {{_tn}} OUTPUT ip daddr 10.3.163.34 udp dport 53 counter accept -add rule {{_tn}} OUTPUT ip daddr 10.3.163.34 tcp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.33 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.33 tcp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.34 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.34 tcp dport 53 counter accept # bastion smtp -add rule {{_tn}} OUTPUT ip daddr 10.3.163.31 tcp dport 25 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.31 tcp dport 25 counter accept # infra.fp.o -add rule {{_tn}} OUTPUT ip daddr 10.3.163.35 tcp dport 80 counter accept -add rule {{_tn}} OUTPUT ip daddr 10.3.163.35 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.35 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.35 tcp dport 443 counter accept # rsyslog out to log01 -add rule {{_tn}} OUTPUT ip daddr 10.3.163.39 tcp dport 514 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.39 tcp dport 514 counter accept # SSH -add rule {{_tn}} INPUT ip saddr 10.3.160.0/19 tcp dport 22 counter accept -add rule {{_tn}} OUTPUT ip daddr 10.3.160.0/19 tcp sport 22 counter accept +add rule {{_tn}} INPUT ip saddr 10.16.160.0/19 tcp dport 22 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.160.0/19 tcp sport 22 counter accept # add rdu3 ansible control host for now add rule {{_tn}} INPUT ip saddr 10.16.163.35/32 tcp dport 22 counter accept add rule {{_tn}} OUTPUT ip daddr 10.16.163.35/19 tcp sport 22 counter accept @@ -66,7 +66,7 @@ add rule {{_tn}} OUTPUT ip daddr 10.16.163.35/19 tcp sport 22 counter accept {% if inventory_hostname.startswith (('buildvm-s390x-11', 'buildvm-s390x-12', 'buildvm-s390x-13')) %} # Allow SSHFS binding to koji01 -add rule {{_tn}} OUTPUT ip daddr 10.3.169.104 tcp dport 22 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.169.104 tcp dport 22 counter accept {% endif %} # http to pull sources from pkgs lookaside diff --git a/roles/koji_builder/templates/osbuildapi-update-nft.sh b/roles/koji_builder/templates/osbuildapi-update-nft.sh index 7c729551ad..79fce3aa3a 100644 --- a/roles/koji_builder/templates/osbuildapi-update-nft.sh +++ b/roles/koji_builder/templates/osbuildapi-update-nft.sh @@ -14,16 +14,16 @@ # 2. Checking if it exists and failing with a "nice" message, if it doesn't. # 3. Waiting for it to exist. -# if ! nft list set ip filter osbuildapi >& /dev/null; then +# if ! nft list set {{nft_table_filter}} osbuildapi >& /dev/null; then # exit 0 # fi -if ! nft list set ip filter osbuildapi >& /dev/null; then - echo "OSBUILD: nft set ip filter osbuildapi: Doesn't exist" 1>&2; +if ! nft list set {{nft_table_filter}} osbuildapi >& /dev/null; then + echo "OSBUILD: nft set {{nft_table_filter}} osbuildapi: Doesn't exist" 1>&2; exit 2 fi -while ! nft list set ip filter osbuildapi >& /dev/null; do +while ! nft list set {{nft_table_filter}} osbuildapi >& /dev/null; do sleep 10 done @@ -47,15 +47,15 @@ NEWIDENTITYIPS=`echo "$RESOLVEQUERY" | grep link | sed -E 's/.* ([0-9]+\.[0-9]+\ # Empty the filter: We do this at the end for a small window.` # NOTE: We aren't flushing old entries anymore. # See commit: e7b50aaee469fdded0ea650c7e7f4dd06e929609 -# nft flush set ip filter osbuildapi +# nft flush set {{nft_table_filter}} osbuildapi # Add the IPs... for j in $NEWIPS do - nft add element ip filter osbuildapi { $j } + nft add element {{nft_table_filter}} osbuildapi { $j } done for j in $NEWIDENTITYIPS do - nft add element ip filter osbuildapi { $j } + nft add element {{nft_table_filter}} osbuildapi { $j } done From ea2f954a44fd08a1117c13523a9d2bfc983416e5 Mon Sep 17 00:00:00 2001 From: Jakub Kadlcik Date: Wed, 22 Apr 2026 22:45:17 +0200 Subject: [PATCH 003/269] copr: fix the Pulp redirect script for devel repositories We dont have a ticket but the problem was discovered on the @asahi/kernel project and reported by @jannau. The use-case is > We use the devel repositories for fedora asahi remix to have a bodhi like > experience for copr projects and technically, they enable the repositores on user machines like this: https://pagure.io/fedora-asahi/asahi-repos/blob/26cab83/f/asahi-repos.spec#_149-160 --- .../templates/lighttpd/pulp-redirect.lua.j2 | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/roles/copr/backend/templates/lighttpd/pulp-redirect.lua.j2 b/roles/copr/backend/templates/lighttpd/pulp-redirect.lua.j2 index cd94270960..0fe68e8bb7 100644 --- a/roles/copr/backend/templates/lighttpd/pulp-redirect.lua.j2 +++ b/roles/copr/backend/templates/lighttpd/pulp-redirect.lua.j2 @@ -66,6 +66,17 @@ function pulp_url(copr_path) local split = string_split(copr_path, "/") + -- Nobody should use devel repositories on user machines but in reality, + -- some people do. In such case we need to transform + -- @asahi/kernel/fedora-43-x86_64/devel/ into + -- @asahi/kernel/fedora-43-x86_64-devel/ + -- This is not needed for devel repositories in Copr buildroots, because + -- copr-frontend does the same kind of transformation + if split[4] == "devel" then + split[3] = split[3] .. "-devel" + table.remove(split, 4) + end + if copr_path:sub(-4) ~= ".rpm" then -- This is easy for .xml files inside the repodata, because in Pulp they are -- located at the same place where they would be on Copr backend. @@ -74,14 +85,14 @@ function pulp_url(copr_path) -- This is the only thing that is needed to make `dnf copr enable` work, and -- for the repos to use the https://download.copr.fedorainfracloud.org CDN. -- This alone will not `dnf install` from the repos, though. See below. - url = url .. copr_path + url = url .. table.concat(split, "/") elseif split[4] == "Packages" then -- This is a .rpm file but the path already contains /Packages/, therefore -- we know that this is a `dnf install` situation. The repo already points -- to the correct path in Pulp, we just need to translate the CDN hostname -- to the Pulp hostname - url = url .. copr_path + url = url .. table.concat(split, "/") else -- This is a .rpm file but we are not accessing it through a repository. From e86df4d91b105e72328de5a6ff1bbc4b4b73cd22 Mon Sep 17 00:00:00 2001 From: Pedro Moura Date: Tue, 7 Apr 2026 19:36:27 -0300 Subject: [PATCH 004/269] waiverdb: moved deploymentconfig.yml.j2 to deployment.yml.j2 Signed-off-by: Pedro Moura --- ...loymentconfig.yml.j2 => deployment.yml.j2} | 60 +++++++++---------- 1 file changed, 28 insertions(+), 32 deletions(-) rename roles/openshift-apps/waiverdb/templates/{deploymentconfig.yml.j2 => deployment.yml.j2} (71%) diff --git a/roles/openshift-apps/waiverdb/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/waiverdb/templates/deployment.yml.j2 similarity index 71% rename from roles/openshift-apps/waiverdb/templates/deploymentconfig.yml.j2 rename to roles/openshift-apps/waiverdb/templates/deployment.yml.j2 index 1b234c474e..0b8a5bf65f 100644 --- a/roles/openshift-apps/waiverdb/templates/deploymentconfig.yml.j2 +++ b/roles/openshift-apps/waiverdb/templates/deployment.yml.j2 @@ -1,6 +1,6 @@ --- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: name: waiverdb-web labels: @@ -9,35 +9,41 @@ metadata: spec: replicas: 2 selector: - app: waiverdb - service: web + matchLabels: + app: waiverdb + service: web strategy: - type: Rolling - rollingParams: - pre: - failurePolicy: Abort - execNewPod: - containerName: web - command: - - /bin/sh - - -c - - >- - if [ -f /app/entrypoint.sh ]; - then /app/entrypoint.sh waiverdb db upgrade; - else waiverdb db upgrade; - fi - volumes: - - config-volume - - secret-volume + type: RollingUpdate + rollingUpdate: {} template: metadata: labels: app: waiverdb service: web + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"waiverdb:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"web\")].image"}]' spec: + initContainers: + - name: db-upgrade + image: image-registry.openshift-image-registry.svc:5000/waiverdb/waiverdb:latest + command: + - /bin/sh + - -c + - | + if [ -f /app/entrypoint.sh ]; + then /app/entrypoint.sh waiverdb db upgrade; + else waiverdb db upgrade; + fi + volumeMounts: + - name: config-volume + mountPath: /etc/waiverdb + readOnly: true + - name: secret-volume + mountPath: /etc/secret + readOnly: true containers: - name: web - image: waiverdb + image: image-registry.openshift-image-registry.svc:5000/waiverdb/waiverdb:latest ports: - containerPort: 8080 volumeMounts: @@ -109,13 +115,3 @@ spec: - name: fedora-messaging-key-volume secret: secretName: waiverdb-fedora-messaging-key - triggers: - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - web - from: - kind: ImageStreamTag - name: waiverdb:latest - - type: ConfigChange From e3e74bc7220d36c279634fc1c78ae83164345afe Mon Sep 17 00:00:00 2001 From: Pedro Moura Date: Tue, 7 Apr 2026 19:40:30 -0300 Subject: [PATCH 005/269] waiverdb: fix deployment reference Signed-off-by: Pedro Moura --- playbooks/openshift-apps/waiverdb.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/playbooks/openshift-apps/waiverdb.yml b/playbooks/openshift-apps/waiverdb.yml index 7ea818db13..85d690ff4d 100644 --- a/playbooks/openshift-apps/waiverdb.yml +++ b/playbooks/openshift-apps/waiverdb.yml @@ -110,8 +110,8 @@ - role: openshift/object object_app: waiverdb - object_template: deploymentconfig.yml.j2 - object_objectname: deploymentconfig.yml + object_template: deployment.yml.j2 + object_objectname: deployment.yml - role: openshift/rollout rollout_app: waiverdb From 81e1871023dea24a807c0160fbbbf62c25b27724 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Mon, 4 May 2026 13:02:27 -0700 Subject: [PATCH 006/269] waiverdb: add env to db-upgrade container Signed-off-by: Kevin Fenzi --- .../waiverdb/templates/deployment.yml.j2 | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/roles/openshift-apps/waiverdb/templates/deployment.yml.j2 b/roles/openshift-apps/waiverdb/templates/deployment.yml.j2 index 0b8a5bf65f..37a47616ac 100644 --- a/roles/openshift-apps/waiverdb/templates/deployment.yml.j2 +++ b/roles/openshift-apps/waiverdb/templates/deployment.yml.j2 @@ -41,6 +41,17 @@ spec: - name: secret-volume mountPath: /etc/secret readOnly: true + env: + - name: DATABASE_PASSWORD + valueFrom: + secretKeyRef: + name: waiverdb-secret + key: database-password + - name: SECRET_KEY + valueFrom: + secretKeyRef: + name: waiverdb-secret + key: flask-secret-key containers: - name: web image: image-registry.openshift-image-registry.svc:5000/waiverdb/waiverdb:latest From d0a17fb7cf2c1daf13ac562c79bd687d289cb03d Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Mon, 4 May 2026 13:12:54 -0700 Subject: [PATCH 007/269] compose-tracker: move to deployment from deploymentconfig This is another pull to move compose-tracker from deploymentconfig to deployment. Assisted by: claude Signed-off-by: Kevin Fenzi --- compose-tracker.yml | 67 +++++++++++++++++++ .../templates/deployment.yml.j2 | 45 +++++++++++++ 2 files changed, 112 insertions(+) create mode 100644 compose-tracker.yml create mode 100644 roles/openshift-apps/compose-tracker/templates/deployment.yml.j2 diff --git a/compose-tracker.yml b/compose-tracker.yml new file mode 100644 index 0000000000..9e3a6eef58 --- /dev/null +++ b/compose-tracker.yml @@ -0,0 +1,67 @@ +--- +- name: Make the app be real + hosts: os_control[0]:os_control_stg[0] + user: root + gather_facts: false + + vars_files: + - /srv/web/infra/ansible/vars/global.yml + - "/srv/private/ansible/vars.yml" + - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml + + roles: + - role: openshift/project + project_app: compose-tracker + project_description: Opens issues for failed Composes against https://forge.fedoraproject.org/releng/compose-tracker-issues + project_appowners: + - dustymabe + - mizdebsk + - humaton + - amedvede + tags: + - appowner + + - role: openshift/object + object_app: compose-tracker + object_template: secret.yml.j2 + object_objectname: secret.yml + + - role: openshift/object + object_app: compose-tracker + object_template: imagestream.yml.j2 + object_objectname: imagestream.yml + + - role: openshift/object + object_app: compose-tracker + object_template: buildconfig.yml.j2 + object_objectname: buildconfig.yml + + - role: openshift/start-build + start_build_app: compose-tracker + start_build_buildname: compose-tracker-build + start_build_objectname: compose-tracker-build + tags: + - never + - build + + - role: openshift/object + object_app: compose-tracker + object_template: deployment.yml.j2 + object_objectname: deployment.yml + + - role: openshift/rollout + rollout_app: compose-tracker + rollout_dcname: compose-tracker + tags: + - never + - rollout + + ############################################### + # actions to delete the project from OpenShift + ############################################### + # to run: sudo rbac-playbook -l os_control_stg[0] -t delete openshift-apps/compose-tracker.yml + - role: openshift/object-delete + object_delete_app: compose-tracker + object_delete_objecttype: project + object_delete_objectname: compose-tracker + tags: [never, delete] diff --git a/roles/openshift-apps/compose-tracker/templates/deployment.yml.j2 b/roles/openshift-apps/compose-tracker/templates/deployment.yml.j2 new file mode 100644 index 0000000000..5bdd3a20a0 --- /dev/null +++ b/roles/openshift-apps/compose-tracker/templates/deployment.yml.j2 @@ -0,0 +1,45 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: compose-tracker + name: compose-tracker + annotations: + image.openshift.io/triggers: >- + [{"from":{"kind":"ImageStreamTag","name":"compose-tracker-img:latest","namespace":"compose-tracker"},"fieldPath":"spec.template.spec.containers[?(@.name==\"compose-tracker\")].image","pause":"false"}] +spec: + replicas: 1 + selector: + matchLabels: + app: compose-tracker + template: + metadata: + labels: + app: compose-tracker + name: compose-tracker + spec: + containers: + - name: compose-tracker + image: image-registry.openshift-image-registry.svc:5000/compose-tracker/compose-tracker-img:latest + imagePullPolicy: IfNotPresent + envFrom: + - secretRef: + name: compose-tracker-forgejo-token + env: + - name: FORGEJO_NAMESPACE + value: "releng" + - name: FORGEJO_REPO + value: "compose-tracker-issues" + - name: FORGEJO_DOMAIN +{% if env == "staging" %} + value: "https://forge.stg.fedoraproject.org/" +{% else %} + value: "https://forge.fedoraproject.org/" +{% endif %} + # sleep infinity is useful for debugging environment issues + # comment out when not debugging +# args: ['infinity'] +# command: ['/usr/bin/sleep'] + resources: {} + restartPolicy: Always From cc8e2593609d0d68e8540f04a6eb665597e6a9d4 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Mon, 4 May 2026 13:20:20 -0700 Subject: [PATCH 008/269] compose-tracker: move stray playbook to the right place Signed-off-by: Kevin Fenzi --- compose-tracker.yml | 67 -------------------- playbooks/openshift-apps/compose-tracker.yml | 4 +- 2 files changed, 2 insertions(+), 69 deletions(-) delete mode 100644 compose-tracker.yml diff --git a/compose-tracker.yml b/compose-tracker.yml deleted file mode 100644 index 9e3a6eef58..0000000000 --- a/compose-tracker.yml +++ /dev/null @@ -1,67 +0,0 @@ ---- -- name: Make the app be real - hosts: os_control[0]:os_control_stg[0] - user: root - gather_facts: false - - vars_files: - - /srv/web/infra/ansible/vars/global.yml - - "/srv/private/ansible/vars.yml" - - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml - - roles: - - role: openshift/project - project_app: compose-tracker - project_description: Opens issues for failed Composes against https://forge.fedoraproject.org/releng/compose-tracker-issues - project_appowners: - - dustymabe - - mizdebsk - - humaton - - amedvede - tags: - - appowner - - - role: openshift/object - object_app: compose-tracker - object_template: secret.yml.j2 - object_objectname: secret.yml - - - role: openshift/object - object_app: compose-tracker - object_template: imagestream.yml.j2 - object_objectname: imagestream.yml - - - role: openshift/object - object_app: compose-tracker - object_template: buildconfig.yml.j2 - object_objectname: buildconfig.yml - - - role: openshift/start-build - start_build_app: compose-tracker - start_build_buildname: compose-tracker-build - start_build_objectname: compose-tracker-build - tags: - - never - - build - - - role: openshift/object - object_app: compose-tracker - object_template: deployment.yml.j2 - object_objectname: deployment.yml - - - role: openshift/rollout - rollout_app: compose-tracker - rollout_dcname: compose-tracker - tags: - - never - - rollout - - ############################################### - # actions to delete the project from OpenShift - ############################################### - # to run: sudo rbac-playbook -l os_control_stg[0] -t delete openshift-apps/compose-tracker.yml - - role: openshift/object-delete - object_delete_app: compose-tracker - object_delete_objecttype: project - object_delete_objectname: compose-tracker - tags: [never, delete] diff --git a/playbooks/openshift-apps/compose-tracker.yml b/playbooks/openshift-apps/compose-tracker.yml index 587d088d40..9e3a6eef58 100644 --- a/playbooks/openshift-apps/compose-tracker.yml +++ b/playbooks/openshift-apps/compose-tracker.yml @@ -46,8 +46,8 @@ - role: openshift/object object_app: compose-tracker - object_template: deploymentconfig.yml.j2 - object_objectname: deploymentconfig.yml + object_template: deployment.yml.j2 + object_objectname: deployment.yml - role: openshift/rollout rollout_app: compose-tracker From a00af9f5cd13c655a15a4c4e89683a95ae810b0d Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Mon, 4 May 2026 13:27:15 -0700 Subject: [PATCH 009/269] openshift: adjust rollout in playbooks for deployment instead of deploymentconfig Since we have moved (almost everything) to deployment, we need to adjust adjust these rollout commands to use deployment instead. Signed-off-by: Kevin Fenzi --- playbooks/openshift-apps/asknot.yml | 2 +- playbooks/openshift-apps/badges.yml | 2 +- playbooks/openshift-apps/bodhi.yml | 6 +++--- playbooks/openshift-apps/compose-tracker.yml | 2 +- playbooks/openshift-apps/coreos-cincinnati.yml | 2 +- playbooks/openshift-apps/datagrepper.yml | 2 +- playbooks/openshift-apps/discourse2fedmsg.yml | 2 +- playbooks/openshift-apps/fasjson.yml | 2 +- playbooks/openshift-apps/greenwave.yml | 4 ++-- playbooks/openshift-apps/mdapi.yml | 2 +- playbooks/openshift-apps/mirrormanager.yml | 2 +- playbooks/openshift-apps/noggin-centos.yml | 2 +- playbooks/openshift-apps/noggin.yml | 2 +- playbooks/openshift-apps/poddlers.yml | 2 +- playbooks/openshift-apps/release-monitoring.yml | 2 +- playbooks/openshift-apps/resultsdb.yml | 4 ++-- playbooks/openshift-apps/the-new-hotness.yml | 2 +- playbooks/openshift-apps/waiverdb.yml | 2 +- playbooks/openshift-apps/webhook2fedmsg.yml | 2 +- roles/openshift/rollout/tasks/main.yml | 2 +- 20 files changed, 24 insertions(+), 24 deletions(-) diff --git a/playbooks/openshift-apps/asknot.yml b/playbooks/openshift-apps/asknot.yml index 47470ed063..6437d921c3 100644 --- a/playbooks/openshift-apps/asknot.yml +++ b/playbooks/openshift-apps/asknot.yml @@ -64,7 +64,7 @@ - role: openshift/rollout rollout_app: asknot - rollout_dcname: asknot + rollout_dname: asknot tags: - never - rollout diff --git a/playbooks/openshift-apps/badges.yml b/playbooks/openshift-apps/badges.yml index 58a05b7338..3dd8dfb7d5 100644 --- a/playbooks/openshift-apps/badges.yml +++ b/playbooks/openshift-apps/badges.yml @@ -218,7 +218,7 @@ name: openshift/rollout vars: rollout_app: badges - rollout_dcname: "{{ dcname }}" + rollout_dname: "{{ dcname }}" loop: - fedbadges - tahrir diff --git a/playbooks/openshift-apps/bodhi.yml b/playbooks/openshift-apps/bodhi.yml index b2f288fbf8..d49366cf05 100644 --- a/playbooks/openshift-apps/bodhi.yml +++ b/playbooks/openshift-apps/bodhi.yml @@ -150,19 +150,19 @@ imagestream_imagename: bodhi-critpathcron - role: openshift/rollout rollout_app: bodhi - rollout_dcname: bodhi-web + rollout_dname: bodhi-web tags: - never - rollout - role: openshift/rollout rollout_app: bodhi - rollout_dcname: bodhi-consumer + rollout_dname: bodhi-consumer tags: - never - rollout - role: openshift/rollout rollout_app: bodhi - rollout_dcname: bodhi-celery + rollout_dname: bodhi-celery tags: - never - rollout diff --git a/playbooks/openshift-apps/compose-tracker.yml b/playbooks/openshift-apps/compose-tracker.yml index 9e3a6eef58..d228c51918 100644 --- a/playbooks/openshift-apps/compose-tracker.yml +++ b/playbooks/openshift-apps/compose-tracker.yml @@ -51,7 +51,7 @@ - role: openshift/rollout rollout_app: compose-tracker - rollout_dcname: compose-tracker + rollout_dname: compose-tracker tags: - never - rollout diff --git a/playbooks/openshift-apps/coreos-cincinnati.yml b/playbooks/openshift-apps/coreos-cincinnati.yml index bbbe7e77f6..71ef0bf45d 100644 --- a/playbooks/openshift-apps/coreos-cincinnati.yml +++ b/playbooks/openshift-apps/coreos-cincinnati.yml @@ -59,7 +59,7 @@ - role: openshift/rollout rollout_app: coreos-cincinnati - rollout_dcname: coreos-cincinnati + rollout_dname: coreos-cincinnati tags: [never, rollout] - role: openshift/object diff --git a/playbooks/openshift-apps/datagrepper.yml b/playbooks/openshift-apps/datagrepper.yml index f756298d63..61bfce72f0 100644 --- a/playbooks/openshift-apps/datagrepper.yml +++ b/playbooks/openshift-apps/datagrepper.yml @@ -108,7 +108,7 @@ # - role: openshift/rollout # rollout_app: datagrepper - # rollout_dcname: datagrepper + # rollout_dname: datagrepper # tags: # - never # - rollout diff --git a/playbooks/openshift-apps/discourse2fedmsg.yml b/playbooks/openshift-apps/discourse2fedmsg.yml index c0d15f1a28..1ed8ef73c1 100644 --- a/playbooks/openshift-apps/discourse2fedmsg.yml +++ b/playbooks/openshift-apps/discourse2fedmsg.yml @@ -80,7 +80,7 @@ # - role: openshift/rollout # rollout_app: discourse2fedmsg - # rollout_dcname: discourse2fedmsg + # rollout_dname: discourse2fedmsg # tags: # - never # - rollout diff --git a/playbooks/openshift-apps/fasjson.yml b/playbooks/openshift-apps/fasjson.yml index 748f19acd9..bf6a8ff5f5 100644 --- a/playbooks/openshift-apps/fasjson.yml +++ b/playbooks/openshift-apps/fasjson.yml @@ -119,7 +119,7 @@ # - role: openshift/rollout # rollout_app: noggin - # rollout_dcname: noggin + # rollout_dname: noggin # tags: # - never # - rollout diff --git a/playbooks/openshift-apps/greenwave.yml b/playbooks/openshift-apps/greenwave.yml index f09f1f92bd..1123ffd9b6 100644 --- a/playbooks/openshift-apps/greenwave.yml +++ b/playbooks/openshift-apps/greenwave.yml @@ -88,14 +88,14 @@ - role: openshift/rollout rollout_app: greenwave - rollout_dcname: greenwave-web + rollout_dname: greenwave-web tags: - never - rollout - role: openshift/rollout rollout_app: greenwave - rollout_dcname: greenwave-fedmsg-consumers + rollout_dname: greenwave-fedmsg-consumers tags: - never - rollout diff --git a/playbooks/openshift-apps/mdapi.yml b/playbooks/openshift-apps/mdapi.yml index 009b1b4ff2..44dd24f975 100644 --- a/playbooks/openshift-apps/mdapi.yml +++ b/playbooks/openshift-apps/mdapi.yml @@ -88,7 +88,7 @@ - role: openshift/rollout rollout_app: mdapi - rollout_dcname: mdapi + rollout_dname: mdapi tags: - never - rollout diff --git a/playbooks/openshift-apps/mirrormanager.yml b/playbooks/openshift-apps/mirrormanager.yml index 6a965741b8..13740f4be0 100644 --- a/playbooks/openshift-apps/mirrormanager.yml +++ b/playbooks/openshift-apps/mirrormanager.yml @@ -173,7 +173,7 @@ - role: openshift/rollout rollout_app: mirrormanager - rollout_dcname: frontend + rollout_dname: frontend tags: - never - rollout diff --git a/playbooks/openshift-apps/noggin-centos.yml b/playbooks/openshift-apps/noggin-centos.yml index 8f15a924dd..e3961ead0a 100644 --- a/playbooks/openshift-apps/noggin-centos.yml +++ b/playbooks/openshift-apps/noggin-centos.yml @@ -115,7 +115,7 @@ - role: openshift/rollout rollout_app: noggin-centos - rollout_dcname: noggin + rollout_dname: noggin tags: - never - rollout diff --git a/playbooks/openshift-apps/noggin.yml b/playbooks/openshift-apps/noggin.yml index 1bb8fac8db..b69649d1b9 100644 --- a/playbooks/openshift-apps/noggin.yml +++ b/playbooks/openshift-apps/noggin.yml @@ -111,7 +111,7 @@ - role: openshift/rollout rollout_app: noggin - rollout_dcname: noggin + rollout_dname: noggin tags: - never - rollout diff --git a/playbooks/openshift-apps/poddlers.yml b/playbooks/openshift-apps/poddlers.yml index c6101cdd6b..e8c19b1b3d 100644 --- a/playbooks/openshift-apps/poddlers.yml +++ b/playbooks/openshift-apps/poddlers.yml @@ -138,5 +138,5 @@ name: openshift/rollout vars: rollout_app: poddlers - rollout_dcname: "{{ item.name }}" + rollout_dname: "{{ item.name }}" loop: "{{ poddlers_toddlers }}" diff --git a/playbooks/openshift-apps/release-monitoring.yml b/playbooks/openshift-apps/release-monitoring.yml index a7d3e54376..ddda772552 100644 --- a/playbooks/openshift-apps/release-monitoring.yml +++ b/playbooks/openshift-apps/release-monitoring.yml @@ -67,7 +67,7 @@ object_objectname: deployment.yml - role: openshift/rollout rollout_app: release-monitoring - rollout_dcname: release-monitoring-web + rollout_dname: release-monitoring-web tags: - never - rollout diff --git a/playbooks/openshift-apps/resultsdb.yml b/playbooks/openshift-apps/resultsdb.yml index 64e6bb6cd1..a5d3f20f62 100644 --- a/playbooks/openshift-apps/resultsdb.yml +++ b/playbooks/openshift-apps/resultsdb.yml @@ -142,7 +142,7 @@ # rollouts - role: openshift/rollout rollout_app: resultsdb - rollout_dcname: "resultsdb-api" + rollout_dname: "resultsdb-api" failed_when: false tags: - never @@ -150,7 +150,7 @@ - role: openshift/rollout rollout_app: resultsdb - rollout_dcname: "resultsdb-frontend" + rollout_dname: "resultsdb-frontend" failed_when: false tags: - never diff --git a/playbooks/openshift-apps/the-new-hotness.yml b/playbooks/openshift-apps/the-new-hotness.yml index dd7c1a8708..7e2b4a5580 100644 --- a/playbooks/openshift-apps/the-new-hotness.yml +++ b/playbooks/openshift-apps/the-new-hotness.yml @@ -98,7 +98,7 @@ - role: openshift/rollout rollout_app: the-new-hotness - rollout_dcname: the-new-hotness + rollout_dname: the-new-hotness tags: - never - rollout diff --git a/playbooks/openshift-apps/waiverdb.yml b/playbooks/openshift-apps/waiverdb.yml index 85d690ff4d..07eadd498e 100644 --- a/playbooks/openshift-apps/waiverdb.yml +++ b/playbooks/openshift-apps/waiverdb.yml @@ -115,7 +115,7 @@ - role: openshift/rollout rollout_app: waiverdb - rollout_dcname: waiverdb-web + rollout_dname: waiverdb-web tags: - never - rollout diff --git a/playbooks/openshift-apps/webhook2fedmsg.yml b/playbooks/openshift-apps/webhook2fedmsg.yml index 448b9908bd..ce70ec5e6a 100644 --- a/playbooks/openshift-apps/webhook2fedmsg.yml +++ b/playbooks/openshift-apps/webhook2fedmsg.yml @@ -122,7 +122,7 @@ # - role: openshift/rollout # rollout_app: webhook2fedmsg - # rollout_dcname: webhook2fedmsg + # rollout_dname: webhook2fedmsg # tags: # - never # - rollout diff --git a/roles/openshift/rollout/tasks/main.yml b/roles/openshift/rollout/tasks/main.yml index 630aaae2a4..8e423698c9 100644 --- a/roles/openshift/rollout/tasks/main.yml +++ b/roles/openshift/rollout/tasks/main.yml @@ -1,3 +1,3 @@ --- - name: Run `oc rollout latest` - ansible.builtin.shell: oc -n {{rollout_app}} rollout latest {{rollout_dcname}} + ansible.builtin.shell: oc -n {{rollout_app}} rollout restart deployment {{rollout_dname}} From 1bdd2c4529ba2549bd322f48d56ab797793b8b63 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Mon, 4 May 2026 14:02:53 -0700 Subject: [PATCH 010/269] ai-review: set include_mr_summary false for shorter reviews This sets a config option that gets ai-code-review to generate shorter review text. It skips the MR Summary section and just posts the Detailed Code Review section. Signed-off-by: Adam Williamson --- .forgejo/workflows/ai-review.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.forgejo/workflows/ai-review.yaml b/.forgejo/workflows/ai-review.yaml index 0b4ec71952..cbe046dc54 100644 --- a/.forgejo/workflows/ai-review.yaml +++ b/.forgejo/workflows/ai-review.yaml @@ -11,5 +11,7 @@ jobs: uses: quality/workflows/.forgejo/workflows/ai-review.yml@main with: pr: ${{ forgejo.event.pull_request.number }} + config: | + include_mr_summary: false secrets: GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }} From b0f1e9a91d8493e0630114a76e86c6fd01a434eb Mon Sep 17 00:00:00 2001 From: Ryan Lerch Date: Tue, 5 May 2026 13:39:14 +1000 Subject: [PATCH 011/269] forge: add group team mappings for the magazine organization related: https://forge.fedoraproject.org/forge/forge/issues/551 Signed-off-by: Ryan Lerch --- roles/openshift-apps/forgejo/templates/values.yaml.j2 | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/roles/openshift-apps/forgejo/templates/values.yaml.j2 b/roles/openshift-apps/forgejo/templates/values.yaml.j2 index 66d1abc5fd..0a65faeed2 100644 --- a/roles/openshift-apps/forgejo/templates/values.yaml.j2 +++ b/roles/openshift-apps/forgejo/templates/values.yaml.j2 @@ -564,7 +564,9 @@ gitea: "forge-packaging-committee":{"packaging":["Committee"]}, "forge-packaging-packager":{"packaging":["Packager"]}, "forge-packaging-provenpackager":{"packaging":["ProvenPackager"]}, - "forge-dotnet-owners":{"dotnet":["Owners"]} + "forge-dotnet-owners":{"dotnet":["Owners"]}, + "forge-magazine-owners":{"magazine":["Owners"]}, + "forge-magazine-members":{"magazine":["Members"]} }' {% endif %} # - name: 'OAuth 1' From 40060e7e880a0ac9273ef3c587f4e81e3454db58 Mon Sep 17 00:00:00 2001 From: Ryan Lerch Date: Tue, 5 May 2026 14:14:41 +1000 Subject: [PATCH 012/269] forge: add group team mappings for the matrix org. resolves: https://forge.fedoraproject.org/forge/forge/issues/537 Signed-off-by: Ryan Lerch --- roles/openshift-apps/forgejo/templates/values.yaml.j2 | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/roles/openshift-apps/forgejo/templates/values.yaml.j2 b/roles/openshift-apps/forgejo/templates/values.yaml.j2 index 0a65faeed2..d599026449 100644 --- a/roles/openshift-apps/forgejo/templates/values.yaml.j2 +++ b/roles/openshift-apps/forgejo/templates/values.yaml.j2 @@ -566,7 +566,8 @@ gitea: "forge-packaging-provenpackager":{"packaging":["ProvenPackager"]}, "forge-dotnet-owners":{"dotnet":["Owners"]}, "forge-magazine-owners":{"magazine":["Owners"]}, - "forge-magazine-members":{"magazine":["Members"]} + "forge-magazine-members":{"magazine":["Members"]}, + "forge-matrix-owners":{"matrix":["Owners"]} }' {% endif %} # - name: 'OAuth 1' From 54db5a3f4a97a4d00f53befa5120d1525cf3617e Mon Sep 17 00:00:00 2001 From: Ryan Lerch Date: Tue, 5 May 2026 14:39:29 +1000 Subject: [PATCH 013/269] forge: add group team mappings for the hummingbird org Signed-off-by: Ryan Lerch --- roles/openshift-apps/forgejo/templates/values.yaml.j2 | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/roles/openshift-apps/forgejo/templates/values.yaml.j2 b/roles/openshift-apps/forgejo/templates/values.yaml.j2 index d599026449..fa07ae848c 100644 --- a/roles/openshift-apps/forgejo/templates/values.yaml.j2 +++ b/roles/openshift-apps/forgejo/templates/values.yaml.j2 @@ -567,7 +567,8 @@ gitea: "forge-dotnet-owners":{"dotnet":["Owners"]}, "forge-magazine-owners":{"magazine":["Owners"]}, "forge-magazine-members":{"magazine":["Members"]}, - "forge-matrix-owners":{"matrix":["Owners"]} + "forge-matrix-owners":{"matrix":["Owners"]}, + "forge-hummingbird-owners":{"hummingbird":["Owners"]} }' {% endif %} # - name: 'OAuth 1' From 66580813a665cfbde01a5bd180499e07eac2d886 Mon Sep 17 00:00:00 2001 From: Nikita Dubrovskii Date: Mon, 4 May 2026 19:36:47 +0200 Subject: [PATCH 014/269] coreos-ci: add azukku as appowners --- playbooks/openshift-apps/coreos-ci.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/playbooks/openshift-apps/coreos-ci.yml b/playbooks/openshift-apps/coreos-ci.yml index 94678e9004..e3e8c7d965 100644 --- a/playbooks/openshift-apps/coreos-ci.yml +++ b/playbooks/openshift-apps/coreos-ci.yml @@ -14,6 +14,7 @@ project_description: CoreOS CI Infrastructure appowners: - aaradhak + - azukku - dustymabe - hhei - jbtrystram From 0506d3a6456162d2705bc0eb634c25b769be3bac Mon Sep 17 00:00:00 2001 From: Michal Konecny Date: Wed, 22 Apr 2026 12:42:17 +0200 Subject: [PATCH 015/269] [postfix] Obfuscate the IP on smtp-auth server This will update configuration to clean Received header from e-mail forwarded by smtp-auth-iso01 server to prevent leaking of internal IPs. See https://forge.fedoraproject.org/infra/tickets/issues/12835 Signed-off-by: Michal Konecny --- .../postfix/header_checks_submission.smtp-auth | 2 ++ ...aster.cf.smtp-auth-iso01.rdu3.fedoraproject.org | 5 +++++ roles/base/tasks/postfix.yml | 14 ++++++++++++++ 3 files changed, 21 insertions(+) create mode 100644 roles/base/files/postfix/header_checks_submission.smtp-auth diff --git a/roles/base/files/postfix/header_checks_submission.smtp-auth b/roles/base/files/postfix/header_checks_submission.smtp-auth new file mode 100644 index 0000000000..54be7b608e --- /dev/null +++ b/roles/base/files/postfix/header_checks_submission.smtp-auth @@ -0,0 +1,2 @@ +# Remove the received header before forwarding e-mail +/^Received: .*/ IGNORE diff --git a/roles/base/files/postfix/master.cf/master.cf.smtp-auth-iso01.rdu3.fedoraproject.org b/roles/base/files/postfix/master.cf/master.cf.smtp-auth-iso01.rdu3.fedoraproject.org index fc602a7f78..13b4d0f81e 100644 --- a/roles/base/files/postfix/master.cf/master.cf.smtp-auth-iso01.rdu3.fedoraproject.org +++ b/roles/base/files/postfix/master.cf/master.cf.smtp-auth-iso01.rdu3.fedoraproject.org @@ -11,9 +11,14 @@ submission inet n - n - - smtpd -o smtpd_enforce_tls=yes -o smtpd_sasl_auth_enable=yes -o smtpd_client_restrictions=permit_sasl_authenticated,reject + -o cleanup_service_name=ascleanup #628 inet n - n - - qmqpd pickup fifo n - n 60 1 pickup cleanup unix n - n - 0 cleanup +ascleanup unix n - y - 0 cleanup + -o header_checks=pcre:/etc/postfix/header_checks_submission + -o mime_header_checks= + -o nested_header_checks= qmgr fifo n - n 300 1 qmgr #qmgr fifo n - n 300 1 oqmgr tlsmgr unix - - n 1000? 1 tlsmgr diff --git a/roles/base/tasks/postfix.yml b/roles/base/tasks/postfix.yml index 156064cf18..6f4dcf57f2 100644 --- a/roles/base/tasks/postfix.yml +++ b/roles/base/tasks/postfix.yml @@ -4,6 +4,7 @@ state: present name: - postfix + - postfix-pcre tags: - postfix @@ -69,6 +70,19 @@ - config - base +- name: Install /etc/postfix/header_checks_submission file + ansible.builtin.copy: + src: postfix/header_checks_submission.smtp-auth + dest: /etc/postfix/header_checks_submission + mode: "0644" + when: inventory_hostname.startswith("smtp-auth") + notify: + - Restart postfix + tags: + - postfix + - config + - base + - name: Deploy sender_access file ansible.builtin.copy: src: "{{ private }}/files/smtpd/sender_access.{{ postfix_group }}" From 72baeea32180c7cccdfc4bd55babef9104ffd2a7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Aur=C3=A9lien=20Bompard?= Date: Tue, 5 May 2026 11:51:42 +0200 Subject: [PATCH 016/269] Add a patch for Pagure MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Aurélien Bompard --- roles/distgit/pagure/defaults/main.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/roles/distgit/pagure/defaults/main.yml b/roles/distgit/pagure/defaults/main.yml index 8a2e959e0b..df3114f21d 100644 --- a/roles/distgit/pagure/defaults/main.yml +++ b/roles/distgit/pagure/defaults/main.yml @@ -3,4 +3,5 @@ pagure_patches: - b50d32b7c92f131ebcc3b633de6c6e91e28297ec - 5529 - readme-include + - 26bc9746 From 15a6768ad7e3fffe91507f380cdf7c572dab335c Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Tue, 5 May 2026 15:01:16 +0100 Subject: [PATCH 017/269] Zabbix: Update IPA template to include healthcheck items/triggers Signed-off-by: Greg Sutcliffe --- .../ipa/server/files/zabbix/template-ipa.yml | 384 ++++++++++++++++++ 1 file changed, 384 insertions(+) diff --git a/roles/ipa/server/files/zabbix/template-ipa.yml b/roles/ipa/server/files/zabbix/template-ipa.yml index c5cd7590c6..670766c363 100644 --- a/roles/ipa/server/files/zabbix/template-ipa.yml +++ b/roles/ipa/server/files/zabbix/template-ipa.yml @@ -31,6 +31,382 @@ zabbix_export: name: 'IPA Backups out of date' opdata: 'Last IPA backup: {ITEM.LASTVALUE}' priority: HIGH + - uuid: a96ec3f5464447ea81acbd970c2c4317 + name: 'IPA Healthcheck - certmonger status' + type: DEPENDENT + key: ipa.heathcheck.certmonger + delay: '0' + valuemap: + name: 'Service status' + preprocessing: + - type: PROMETHEUS_PATTERN + parameters: + - 'ipa_service_state{service="certmonger"}' + - value + - '' + master_item: + key: 'vfs.file.contents[/etc/zabbix/ipa-healthcheck.log]' + tags: + - tag: component + value: ipa + - tag: type + value: healthcheck + triggers: + - uuid: 7bd9b1b5c2b949feb7f02f34b3469534 + expression: 'last(/IPA Monitoring/ipa.heathcheck.certmonger)=0' + name: 'IPA Healthcheck - Certmonger is not running' + priority: AVERAGE + tags: + - tag: scope + value: availability + - uuid: dc2c79b597244634a0af1b69929bae04 + name: 'IPA Healthcheck - chronyd status' + type: DEPENDENT + key: ipa.heathcheck.chronyd + delay: '0' + valuemap: + name: 'Service status' + preprocessing: + - type: PROMETHEUS_PATTERN + parameters: + - 'ipa_service_state{service="chronyd"}' + - value + - '' + master_item: + key: 'vfs.file.contents[/etc/zabbix/ipa-healthcheck.log]' + tags: + - tag: component + value: ipa + - tag: type + value: healthcheck + triggers: + - uuid: ecfe65f4a9d04728a959255918262ae8 + expression: 'last(/IPA Monitoring/ipa.heathcheck.chronyd)=0' + name: 'IPA Healthcheck - Chronyd is not running' + priority: AVERAGE + tags: + - tag: scope + value: availability + - uuid: debd42eea62d43d98ba6d40cf250ef84 + name: 'IPA Healthcheck - criticals' + type: DEPENDENT + key: ipa.heathcheck.critical + delay: '0' + preprocessing: + - type: PROMETHEUS_PATTERN + parameters: + - 'ipa_healthcheck{result="CRITICAL"}' + - value + - '' + error_handler: CUSTOM_VALUE + error_handler_params: '0' + master_item: + key: 'vfs.file.contents[/etc/zabbix/ipa-healthcheck.log]' + tags: + - tag: component + value: ipa + - tag: type + value: healthcheck + - uuid: d1945ad2ed56480c946feb7b06650567 + name: 'IPA Healthcheck - dirsrv status' + type: DEPENDENT + key: ipa.heathcheck.dirsrv + delay: '0' + valuemap: + name: 'Service status' + preprocessing: + - type: PROMETHEUS_PATTERN + parameters: + - 'ipa_service_state{service="dirsrv"}' + - value + - '' + master_item: + key: 'vfs.file.contents[/etc/zabbix/ipa-healthcheck.log]' + tags: + - tag: component + value: ipa + - tag: type + value: healthcheck + triggers: + - uuid: b7efb68e7ee1404b966144818f432fbf + expression: 'last(/IPA Monitoring/ipa.heathcheck.dirsrv)=0' + name: 'IPA Healthcheck - Dirsrv is not running' + priority: AVERAGE + tags: + - tag: scope + value: availability + - uuid: 7aba7dae57994c718eae5a91810e5de3 + name: 'IPA Healthcheck - errors' + type: DEPENDENT + key: ipa.heathcheck.errors + delay: '0' + preprocessing: + - type: PROMETHEUS_PATTERN + parameters: + - 'ipa_healthcheck{result="ERROR"}' + - value + - '' + error_handler: CUSTOM_VALUE + error_handler_params: '0' + master_item: + key: 'vfs.file.contents[/etc/zabbix/ipa-healthcheck.log]' + tags: + - tag: component + value: ipa + - tag: type + value: healthcheck + triggers: + - uuid: f48be409cff9497d85090c0d01a4b3c7 + expression: 'last(/IPA Monitoring/ipa.heathcheck.errors)>0' + name: 'IPA Healthcheck - Errors reported' + priority: HIGH + - uuid: 5072ed9c95fc4dd8ab498b22c03e2d68 + name: 'IPA Healthcheck - gssproxy status' + type: DEPENDENT + key: ipa.heathcheck.gssproxy + delay: '0' + valuemap: + name: 'Service status' + preprocessing: + - type: PROMETHEUS_PATTERN + parameters: + - 'ipa_service_state{service="gssproxy"}' + - value + - '' + master_item: + key: 'vfs.file.contents[/etc/zabbix/ipa-healthcheck.log]' + tags: + - tag: component + value: ipa + - tag: type + value: healthcheck + triggers: + - uuid: beeea8f684a241c4972501f9a58515f7 + expression: 'last(/IPA Monitoring/ipa.heathcheck.gssproxy)=0' + name: 'IPA Healthcheck - GSSproxy is not running' + priority: AVERAGE + tags: + - tag: scope + value: availability + - uuid: 38432d1a65a448e3aa0c14dbea5502a6 + name: 'IPA Healthcheck - httpd status' + type: DEPENDENT + key: ipa.heathcheck.httpd + delay: '0' + valuemap: + name: 'Service status' + preprocessing: + - type: PROMETHEUS_PATTERN + parameters: + - 'ipa_service_state{service="httpd"}' + - value + - '' + master_item: + key: 'vfs.file.contents[/etc/zabbix/ipa-healthcheck.log]' + tags: + - tag: component + value: ipa + - tag: type + value: healthcheck + triggers: + - uuid: a204143b9ac94b7c9d3a71a54b8149c3 + expression: 'last(/IPA Monitoring/ipa.heathcheck.httpd)=0' + name: 'IPA Healthcheck - HTTPd is not running' + priority: AVERAGE + tags: + - tag: scope + value: availability + - uuid: 4211bbb549354421a3f223b5bdbb0ddc + name: 'IPA Healthcheck - ipa_otpd status' + type: DEPENDENT + key: ipa.heathcheck.ipa_otpd + delay: '0' + valuemap: + name: 'Service status' + preprocessing: + - type: PROMETHEUS_PATTERN + parameters: + - 'ipa_service_state{service="ipa_otpd"}' + - value + - '' + master_item: + key: 'vfs.file.contents[/etc/zabbix/ipa-healthcheck.log]' + tags: + - tag: component + value: ipa + - tag: type + value: healthcheck + triggers: + - uuid: f7e5b0ac99da49d6bbd6eaf5b522e20c + expression: 'last(/IPA Monitoring/ipa.heathcheck.ipa_otpd)=0' + name: 'IPA Healthcheck - IPA-OTPd is not running' + priority: AVERAGE + tags: + - tag: scope + value: availability + - uuid: 5ad91fe41cc64843b414e9de89505ef6 + name: 'IPA Healthcheck - kadmin status' + type: DEPENDENT + key: ipa.heathcheck.kadmin + delay: '0' + valuemap: + name: 'Service status' + preprocessing: + - type: PROMETHEUS_PATTERN + parameters: + - 'ipa_service_state{service="kadmin"}' + - value + - '' + master_item: + key: 'vfs.file.contents[/etc/zabbix/ipa-healthcheck.log]' + tags: + - tag: component + value: ipa + - tag: type + value: healthcheck + triggers: + - uuid: efa252721828486697c667a003237ef2 + expression: 'last(/IPA Monitoring/ipa.heathcheck.kadmin)=0' + name: 'IPA Healthcheck - KAdmin is not running' + priority: AVERAGE + tags: + - tag: scope + value: availability + - uuid: d2c1f01faa7441bdb9757725728cf3f8 + expression: 'last(/IPA Monitoring/ipa.heathcheck.kadmin)=0' + name: 'IPA Healthcheck - Krb5kdc is not running' + priority: AVERAGE + tags: + - tag: scope + value: availability + - uuid: 713f0ae284ee49eb9335bedd14f2c986 + expression: 'last(/IPA Monitoring/ipa.heathcheck.kadmin)=0' + name: 'IPA Healthcheck - PKI-Tomcat is not running' + priority: AVERAGE + tags: + - tag: scope + value: availability + - uuid: 1c787c3c0acb4c51b2c2747cf4dfbf4a + name: 'IPA Healthcheck - krb5kdc status' + type: DEPENDENT + key: ipa.heathcheck.krb5kdc + delay: '0' + valuemap: + name: 'Service status' + preprocessing: + - type: PROMETHEUS_PATTERN + parameters: + - 'ipa_service_state{service="krb5kdc"}' + - value + - '' + master_item: + key: 'vfs.file.contents[/etc/zabbix/ipa-healthcheck.log]' + tags: + - tag: component + value: ipa + - tag: type + value: healthcheck + - uuid: bfcf381c945e45b2b1c7bdabebc9886d + name: 'IPA Healthcheck - sssd status' + type: DEPENDENT + key: ipa.heathcheck.sssd + delay: '0' + valuemap: + name: 'Service status' + preprocessing: + - type: PROMETHEUS_PATTERN + parameters: + - 'ipa_service_state{service="sssd"}' + - value + - '' + master_item: + key: 'vfs.file.contents[/etc/zabbix/ipa-healthcheck.log]' + tags: + - tag: component + value: ipa + - tag: type + value: healthcheck + triggers: + - uuid: df7c3371fc904515915c50e4b3d3b0ce + expression: 'last(/IPA Monitoring/ipa.heathcheck.sssd)=0' + name: 'IPA Healthcheck - SSSd is not running' + priority: AVERAGE + tags: + - tag: scope + value: availability + - uuid: 78857b815aa344bbbdbe6e36a9005657 + name: 'IPA Healthcheck - pki-tomcat status' + type: DEPENDENT + key: ipa.heathcheck.tomcat + delay: '0' + valuemap: + name: 'Service status' + preprocessing: + - type: PROMETHEUS_PATTERN + parameters: + - 'ipa_service_state{service="pki_tomcatd"}' + - value + - '' + master_item: + key: 'vfs.file.contents[/etc/zabbix/ipa-healthcheck.log]' + tags: + - tag: component + value: ipa + - tag: type + value: healthcheck + - uuid: 604059d7f8ca4062aec34a7fbe8f5b62 + name: 'IPA Healthcheck - warnings' + type: DEPENDENT + key: ipa.heathcheck.warning + delay: '0' + preprocessing: + - type: PROMETHEUS_PATTERN + parameters: + - 'ipa_healthcheck{result="WARNING"}' + - value + - '' + error_handler: CUSTOM_VALUE + error_handler_params: '0' + master_item: + key: 'vfs.file.contents[/etc/zabbix/ipa-healthcheck.log]' + tags: + - tag: component + value: ipa + - tag: type + value: healthcheck + - uuid: a44655ad1c974ea28ef22634afa1ca01 + name: 'IPA Healthcheck raw output' + type: ZABBIX_ACTIVE + key: 'vfs.file.contents[/etc/zabbix/ipa-healthcheck.log]' + delay: 5m + history: 1h + value_type: TEXT + trends: '0' + timeout: 15s + tags: + - tag: component + value: ipa + - tag: type + value: healthcheck + - uuid: 93b94a89acdb40f6a40fe5a1bfd49b49 + name: 'IPA Healthcheck logfile age' + type: ZABBIX_ACTIVE + key: 'vfs.file.time[/etc/zabbix/ipa-healthcheck.log]' + delay: 5m + history: 7d + units: unixtime + description: 'Verify the ipa-healthcheck cron is still running' + tags: + - tag: component + value: ipa + - tag: type + value: fileage + triggers: + - uuid: 2429f94bc41845a09a7f7ef5277e836c + expression: 'change(/IPA Monitoring/vfs.file.time[/etc/zabbix/ipa-healthcheck.log])>600' + name: 'IPA Healthcheck logfile is too old' + priority: AVERAGE + description: 'The healthcheck cron should run every 300s' - uuid: b6f2575965414e9b8a50e7e2a2aec586 name: 'http-ipa-internal check' type: ZABBIX_ACTIVE @@ -51,3 +427,11 @@ zabbix_export: tags: - tag: application value: ipa + valuemaps: + - uuid: 59ebe776ee264da79ea1af894847fbe3 + name: 'Service status' + mappings: + - value: '1' + newvalue: Up + - value: '0' + newvalue: Down From 0d4d72dadfa635e9ab1f1e977a19883b9b39346a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kamil=20P=C3=A1ral?= Date: Mon, 4 May 2026 14:44:54 +0200 Subject: [PATCH 018/269] blockerbugs: drop a "short-term patch" after 5 years --- .../files/20210914-patched-bz_interface.py | 276 ------------------ roles/blockerbugs/tasks/main.yml | 7 - 2 files changed, 283 deletions(-) delete mode 100644 roles/blockerbugs/files/20210914-patched-bz_interface.py diff --git a/roles/blockerbugs/files/20210914-patched-bz_interface.py b/roles/blockerbugs/files/20210914-patched-bz_interface.py deleted file mode 100644 index 1f5b0ae480..0000000000 --- a/roles/blockerbugs/files/20210914-patched-bz_interface.py +++ /dev/null @@ -1,276 +0,0 @@ -# Copyright 2012, Red Hat, Inc -# -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License along -# with this program; if not, write to the Free Software Foundation, Inc., -# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. -# -# Authors: -# Tim Flink - -"""Common methods for obtaining blocker/FE information from Bugzilla""" - -import logging -import datetime -from typing import Optional, Any - -import bugzilla -from bugzilla.bug import Bug as bzBug -from xmlrpc.client import Fault - -from blockerbugs import app - -# rhbz has been updated to have a max of 20 results returned -BUGZILLA_QUERY_LIMIT = 20 - -base_query = {'o1': 'anywords', - 'f1': 'blocked', - 'query_format': 'advanced', - 'extra_fields': ['flags'], - 'limit': BUGZILLA_QUERY_LIMIT} - -class BZInterfaceError(Exception): - """A custom wrapper for XMLRPC errors from Bugzilla""" - - def __init__(self, msg): - self.msg = msg - - def __str__(self): - return repr(self.msg) - - -class BlockerBugs(): - """The main class for querying Bugzilla""" - - def __init__(self, user: Optional[str] = None, password: Optional[str] = None, - url: Optional[str] = 'https://bugzilla.redhat.com/xmlrpc.cgi', - bz: Optional[bugzilla.Bugzilla] = None, - logger: Optional[logging.Logger] = None) -> None: - """:param user: Username to log in as. Use `None` for anonymous access. - :param password: User password. Use `None` for anonymous access. - :param url: Bugzilla API url. - :param bz: `Bugzilla` instance. Created automatically if not provided. If provided, - the `user`, `password` and `url` values are ignored. - :param logger: A custom `Logger` instance. Otherwise a default Logger is created. - """ - self.logger = logger or logging.getLogger('bz_interface') - self.bz: bugzilla.Bugzilla = bz - if not bz: - if not (user and password): - self.bz = bugzilla.Bugzilla(url=url, - cookiefile=None, - tokenfile=None) - else: - self.bz = bugzilla.Bugzilla(url=url, - user=user, - password=password, - cookiefile=None, - tokenfile=None) - self.logger.info('Using bugzilla URL: %s' % url) - - # https://bugzilla.stage.redhat.com/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED - # &bug_status=POST&bug_status=MODIFIED&classification=Fedora&component=anaconda&f1=component - # &o1=changedafter&product=Fedora&query_format=advanced&v1=2013-03-21%2012%3A25&version=19 - def get_bz_query(self, tracker: int, last_update: datetime.datetime = None, offset: int = 0 - ) -> dict[str, Any]: - """Build a Bugzilla query to retrieve all necessary info about all bugs which block the - `tracker` bug. - - :param last_update: If provided, the query is modified to ask only about bugs which have - recent modifications; otherwise asks about all bugs. - :offset: offset to the query instead of just getting the first N results - :returns: a dict which can be fed into `bugzilla.Bugzilla.query()`. - """ - query = {} - query.update(base_query) - query['v1'] = str(tracker) - - if last_update: - last_update_string = last_update.strftime("%Y-%m-%d %H:%M GMT") - - # Since this is kind of confusing, the idea here is to only grab only - # the bugs whose whiteboard, blocks or dependson has changed since - # the last sync or any bugs that have been created in the last day. - - # keep in mind that OP -> open parenthesis, CP -> closed parenthesis - # and the OR is to make sure that a bug is returned if ANY of the - # changed after conditions are met - - # FIXME: This seems to be tremendously slowing down Bugzilla5 - # Related: https://forge.fedoraproject.org/quality/blockerbugs/issues/184 - query.update({ - 'f2': 'OP', - 'j2': 'OR', - 'f3': 'blocked', - 'o3': 'changedafter', - 'v3': last_update_string, - 'f4': 'status_whiteboard', - 'o4': 'changedafter', - 'v4': last_update_string, - 'f5': 'bug_status', - 'o5': 'changedafter', - 'v5': last_update_string, - 'f6': 'dependson', - 'o6': 'changedafter', - 'v6': last_update_string, - 'f7': 'creation_ts', - 'o7': 'greaterthaneq', - 'v7': last_update_string, - 'f8': 'short_desc', - 'o8': 'changedafter', - 'v8': last_update_string, - 'f9': 'component', - 'o9': 'changedafter', - 'v9': last_update_string, - 'f10': 'CP' - }) - - # update query with the offset to use, no change in behavior if the default 0 is used - query.update({'offset': offset}) - - return query - - def query_tracker(self, tracker: int, last_update: Optional[datetime.datetime] = None - ) -> list[bzBug]: - """Perform a Bugzilla query and retrieve all necessary info about all bugs which block the - `tracker` bug (i.e. Blocker or FE bugs). - - :param last_update: If provided, the query is modified to ask only about bugs which have - recent modifications; otherwise asks about all bugs. - """ - - buglist = [] - last_query_len = BUGZILLA_QUERY_LIMIT - - - # this is a hotfix hack to work around the sudden config change in rhbz where the max - # number of bugs returned for a query is 20 - # it seems to be working for now but may need more work going forward - while last_query_len == BUGZILLA_QUERY_LIMIT: - - new_query = self.get_bz_query(tracker, last_update, offset=len(buglist)) - new_buglist = self.bz.query(new_query) - buglist.extend(new_buglist) - last_query_len = len(new_buglist) - - return buglist - - def query_prioritized(self) -> list[bzBug]: - """Perform a Bugzilla query and retrieve all necessary info about all Prioritized bugs.""" - # https://bugzilla.redhat.com/buglist.cgi?bug_status=__open__& - # f1=flagtypes.name&o1=substring&query_format=advanced&v1=fedora_prioritized_bug%2B - query = self.bz.url_to_query( - "{}buglist.cgi?bug_status=__open__&f1=flagtypes.name&o1=substring" - "&query_format=advanced&v1=fedora_prioritized_bug%2B".format( - app.config['BUGZILLA_URL'])) - buglist = self.bz.query(query) - return buglist - - def get_deps(self, bugid: int) -> list[int]: - """Retrieve bug dependencies. - - :returns: A list of ticket numbers which `bugid` depends on. - """ - return self.bz.getbug(bugid).dependson - - -class BlockerProposal(): - def __init__(self, bz, bugid, trackers, is_blocker=False, is_fe=False, bz_user=''): - self.bz = bz - self.bugid = bugid - self.trackers = trackers - self.is_blocker = is_blocker - self.is_fe = is_fe - self.bz_user = bz_user - self.bugid_ok = False - self.proposal_ok = False - self.bugdata = None - self.blocks = None - - self.log = logging.getLogger('bz_interface.bugproposal') - - def get_bugdata(self): - # get bug data, will raise XMLRPC fault if the bug does not exist - try: - self.bugdata = self.bz.getbug(self.bugid) - except Fault as e: - if e.faultCode == 101: - raise BZInterfaceError(e.faultString) - else: - raise - - def get_tracker_type(self): - if self.is_blocker and self.is_fe: - return 'Blocker and Freeze Exception' - if self.is_blocker: - return 'Blocker' - if self.is_fe: - return 'Freeze Exception' - if self.is_prioritized: - return 'PrioritizedBug' - - def propose_bugs(self, bz_user, milestone_name, justification): - comment = ['Proposed as a', self.get_tracker_type(), 'for', milestone_name, 'by', - bz_user, 'using the blocker tracking app because:\n\n', - justification] - tracker_bugs = [] - if self.is_blocker: - tracker_bugs.append(self.trackers['blocker']) - if self.is_fe: - tracker_bugs.append(self.trackers['fe']) - self.log.info('comment: %s' % comment) - try: - self._do_proposal(tracker_bugs, self.bugid, ' '.join(comment), self.bz_user) - except Fault as e: - if e.faultCode == 51: - # bugzilla account does not exist, this should happen very rarely, if ever - # so just redo the call with nothing to add to cc - # TODO - it might be useful to ask the user to re-associate accounts again here - self._do_proposal(tracker_bugs, self.bugid, ' '.join(comment), '') - else: - raise BZInterfaceError(e.faultString) - - def _do_proposal(self, tracker, proposed_bugid, comment, bz_user): - bug_update = self.bz.build_update(blocks_add=tracker, - cc_add=[bz_user], - comment=comment) - self.bz.update_bugs(proposed_bugid, bug_update) - - def check_proposed_bug(self): - if not self.bugdata: - self.get_bugdata() - - # check to make sure that bug is not already CLOSED - bug_status = self.bugdata.bug_status - if 'CLOSED' in bug_status.split(): - raise BZInterfaceError('Bug %i is CLOSED: %s' % (self.bugid, bug_status)) - - def get_blocks(self): - if not self.bugdata: - self.get_bugdata() - self.blocks = self.bugdata.blocked - - def check_blocker_proposal(self): - if not self.blocks: - self.get_blocks() - - if self.trackers['blocker'] in self.blocks: - return False - return True - - def check_fe_proposal(self): - if not self.blocks: - self.get_blocks() - - if self.trackers['fe'] in self.blocks: - return False - return True diff --git a/roles/blockerbugs/tasks/main.yml b/roles/blockerbugs/tasks/main.yml index 2475a1bdf9..81efc80ebe 100644 --- a/roles/blockerbugs/tasks/main.yml +++ b/roles/blockerbugs/tasks/main.yml @@ -77,10 +77,3 @@ tags: - config - blockerbugs - -# this is a "short-term" patch that won't be needed for future versions of blockerbugs -- name: Patch bz_interface to work with rhbz changes - ansible.builtin.copy: src=20210914-patched-bz_interface.py dest=/usr/lib/python3.9/site-packages/blockerbugs/util/bz_interface.py - when: master_blockerbugs_node - tags: - - blockerbugs From 49bec860257f9d74b77531ae41526665cde2ab5d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kamil=20P=C3=A1ral?= Date: Mon, 4 May 2026 14:58:36 +0200 Subject: [PATCH 019/269] blockerbugs: drop unneeded variables after Pagure->Forge migration Related: https://forge.fedoraproject.org/quality/blockerbugs/issues/296 --- .../templates/blockerbugs-settings.py.j2 | 6 ----- .../blockerbugs/templates/cron.yml.j2 | 24 ------------------- .../blockerbugs/templates/deployment.yml.j2 | 24 ------------------- 3 files changed, 54 deletions(-) diff --git a/roles/blockerbugs/templates/blockerbugs-settings.py.j2 b/roles/blockerbugs/templates/blockerbugs-settings.py.j2 index 36c3adcdae..d192585074 100644 --- a/roles/blockerbugs/templates/blockerbugs-settings.py.j2 +++ b/roles/blockerbugs/templates/blockerbugs-settings.py.j2 @@ -8,12 +8,6 @@ BUGZILLA_XMLRPC = BUGZILLA_URL + 'xmlrpc.cgi' BODHI_URL = '{{ blockerbugs_bodhi_url }}' BLOCKERBUGS_URL = '{{ blockerbugs_url }}' BLOCKERBUGS_API = "{}api/v0/".format(BLOCKERBUGS_URL) -PAGURE_URL = '{{ blockerbugs_pagure_url }}' -PAGURE_API = PAGURE_URL + '/api/0/' -PAGURE_REPO_TOKEN = "{{ blockerbugs_pagure_repo_token_secret }}" -PAGURE_REPO_WEBHOOK_KEY = "{{ blockerbugs_pagure_repo_webhook_key_secret }}" -PAGURE_REPO = "fedora-qa/blocker-review" -PAGURE_BOT_USERNAME = 'blockerbot' {% if env == "staging" %} FAS_FLASK_COOKIE_REQUIRES_HTTPS = False diff --git a/roles/openshift-apps/blockerbugs/templates/cron.yml.j2 b/roles/openshift-apps/blockerbugs/templates/cron.yml.j2 index 8019f924af..6976c63981 100644 --- a/roles/openshift-apps/blockerbugs/templates/cron.yml.j2 +++ b/roles/openshift-apps/blockerbugs/templates/cron.yml.j2 @@ -37,16 +37,8 @@ spec: value: "{{ stg_blockerbugs_db_password }}" - name: SECRET_KEY value: "{{ stg_blockerbugs_secret_key }}" - - name: PAGURE_REPO_TOKEN - value: "{{ stg_blockerbugs_pagure_repo_token_secret }}" - - name: PAGURE_REPO_WEBHOOK_KEY - value: "{{ stg_blockerbugs_pagure_repo_webhook_key_secret }}" - name: BUGZILLA_API_KEY value: "{{ stg_blockerbugs_bz_api_key }}" - - name: PAGURE_URL - value: "https://stg.pagure.io/" - - name: PAGURE_API - value: "https://stg.pagure.io/api/0/" - name: BUGZILLA_URL value: "https://bugzilla.stage.redhat.com" - name: FORGEJO_BOT_ACCESS_TOKEN @@ -58,16 +50,8 @@ spec: value: "{{ prod_blockerbugs_db_password }}" - name: SECRET_KEY value: "{{ prod_blockerbugs_secret_key }}" - - name: PAGURE_REPO_TOKEN - value: "{{ prod_blockerbugs_pagure_repo_token_secret }}" - - name: PAGURE_REPO_WEBHOOK_KEY - value: "{{ prod_blockerbugs_pagure_repo_webhook_key_secret }}" - name: BUGZILLA_API_KEY value: "{{ prod_blockerbugs_bz_api_key }}" - - name: PAGURE_URL - value: "https://pagure.io/" - - name: PAGURE_API - value: "https://pagure.io/api/0/" - name: BUGZILLA_URL value: "https://bugzilla.redhat.com" - name: FORGEJO_BOT_ACCESS_TOKEN @@ -83,12 +67,6 @@ spec: value: "https://admin{{ env_suffix }}.fedoraproject.org/accounts/" - name: FAS_ADMIN_GROUP value: "qa-admin" - - name: PAGURE_BOT_USERNAME - value: "blockerbot" - - name: PAGURE_BOT_ENABLED - value: "True" - - name: PAGURE_REPO - value: "fedora-qa/blocker-review" - name: FORGEJO_REPO value: "quality/blocker-review" - name: FORGEJO_BOT_USERNAME @@ -101,8 +79,6 @@ spec: value: "https://forge{{ env_suffix }}.fedoraproject.org/api/v1/" - name: FORGEJO_ADMIN_ORG value: "quality" - - name: FORGEJO_ADMIN_TEAM - value: "members" - name: BODHI_URL value: "https://bodhi{{ env_suffix }}.fedoraproject.org/" - name: OPENSHIFT_PROD diff --git a/roles/openshift-apps/blockerbugs/templates/deployment.yml.j2 b/roles/openshift-apps/blockerbugs/templates/deployment.yml.j2 index 1d8f51ee53..fe66813a5c 100644 --- a/roles/openshift-apps/blockerbugs/templates/deployment.yml.j2 +++ b/roles/openshift-apps/blockerbugs/templates/deployment.yml.j2 @@ -46,16 +46,8 @@ spec: value: "{{ stg_blockerbugs_db_password }}" - name: SECRET_KEY value: "{{ stg_blockerbugs_secret_key }}" - - name: PAGURE_REPO_TOKEN - value: "{{ stg_blockerbugs_pagure_repo_token_secret }}" - - name: PAGURE_REPO_WEBHOOK_KEY - value: "{{ stg_blockerbugs_pagure_repo_webhook_key_secret }}" - name: BUGZILLA_API_KEY value: "{{ stg_blockerbugs_bz_api_key }}" - - name: PAGURE_URL - value: "https://stg.pagure.io/" - - name: PAGURE_API - value: "https://stg.pagure.io/api/0/" - name: BUGZILLA_URL value: "https://bugzilla.stage.redhat.com" - name: FORGEJO_BOT_ACCESS_TOKEN @@ -67,16 +59,8 @@ spec: value: "{{ prod_blockerbugs_db_password }}" - name: SECRET_KEY value: "{{ prod_blockerbugs_secret_key }}" - - name: PAGURE_REPO_TOKEN - value: "{{ prod_blockerbugs_pagure_repo_token_secret }}" - - name: PAGURE_REPO_WEBHOOK_KEY - value: "{{ prod_blockerbugs_pagure_repo_webhook_key_secret }}" - name: BUGZILLA_API_KEY value: "{{ prod_blockerbugs_bz_api_key }}" - - name: PAGURE_URL - value: "https://pagure.io/" - - name: PAGURE_API - value: "https://pagure.io/api/0/" - name: BUGZILLA_URL value: "https://bugzilla.redhat.com" - name: FORGEJO_BOT_ACCESS_TOKEN @@ -92,12 +76,6 @@ spec: value: "https://admin{{ env_suffix }}.fedoraproject.org/accounts/" - name: FAS_ADMIN_GROUP value: "qa-admin" - - name: PAGURE_BOT_USERNAME - value: "blockerbot" - - name: PAGURE_BOT_ENABLED - value: "True" - - name: PAGURE_REPO - value: "fedora-qa/blocker-review" - name: FORGEJO_REPO value: "quality/blocker-review" - name: FORGEJO_BOT_USERNAME @@ -110,8 +88,6 @@ spec: value: "https://forge{{ env_suffix }}.fedoraproject.org/api/v1/" - name: FORGEJO_ADMIN_ORG value: "quality" - - name: FORGEJO_ADMIN_TEAM - value: "members" - name: BODHI_URL value: "https://bodhi{{ env_suffix }}.fedoraproject.org/" - name: OPENSHIFT_PROD From ba172de77ea7bf9a6330caf8f328922cb8d23f1e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timoth=C3=A9e=20Ravier?= Date: Tue, 5 May 2026 23:56:54 +0200 Subject: [PATCH 020/269] roles/bodhi2/pungi: Update config_url with new forge location See: https://forge.fedoraproject.org/atomic-desktops/config.git --- .../backend/templates/pungi.rpm.conf.j2 | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/roles/bodhi2/backend/templates/pungi.rpm.conf.j2 b/roles/bodhi2/backend/templates/pungi.rpm.conf.j2 index f0958ded74..4d762624f9 100644 --- a/roles/bodhi2/backend/templates/pungi.rpm.conf.j2 +++ b/roles/bodhi2/backend/templates/pungi.rpm.conf.j2 @@ -181,7 +181,7 @@ ostree = { [% else %] "treefile": "fedora-silverblue.yaml", [% endif %] - "config_url": "https://pagure.io/workstation-ostree-config.git", + "config_url": "https://forge.fedoraproject.org/atomic-desktops/config.git", "config_branch": "f[[ release.version ]]", "repo": {{ repos }}, "ostree_repo": "/mnt/koji/compose/ostree/repo", @@ -203,7 +203,7 @@ ostree = { [% else %] "treefile": "fedora-kinoite.yaml", [% endif %] - "config_url": "https://pagure.io/workstation-ostree-config.git", + "config_url": "https://forge.fedoraproject.org/atomic-desktops/config.git", "config_branch": "f[[ release.version ]]", "repo": {{ repos }}, "ostree_repo": "/mnt/koji/compose/ostree/repo", @@ -225,7 +225,7 @@ ostree = { [% else %] "treefile": "fedora-sericea.yaml", [% endif %] - "config_url": "https://pagure.io/workstation-ostree-config.git", + "config_url": "https://forge.fedoraproject.org/atomic-desktops/config.git", "config_branch": "f[[ release.version ]]", "repo": {{ repos }}, "ostree_repo": "/mnt/koji/compose/ostree/repo", @@ -243,7 +243,7 @@ ostree = { [% else %] "treefile": "fedora-onyx.yaml", [% endif %] - "config_url": "https://pagure.io/workstation-ostree-config.git", + "config_url": "https://forge.fedoraproject.org/atomic-desktops/config.git", "config_branch": "f[[ release.version ]]", "repo": {{ repos }}, "ostree_repo": "/mnt/koji/compose/ostree/repo", @@ -258,7 +258,7 @@ ostree = { "unified_core": True, "runroot_packages": ["selinux-policy-targeted"], "treefile": "cosmic-atomic-ostree.yaml", - "config_url": "https://pagure.io/workstation-ostree-config.git", + "config_url": "https://forge.fedoraproject.org/atomic-desktops/config.git", "config_branch": "f[[ release.version ]]", "repo": {{ repos }}, "ostree_repo": "/mnt/koji/compose/ostree/repo", @@ -272,7 +272,7 @@ ostree = { ostree_container = { "^Silverblue$": { "version": "!VERSION_FROM_VERSION_DATE_RESPIN", - "config_url": "https://pagure.io/workstation-ostree-config.git", + "config_url": "https://forge.fedoraproject.org/atomic-desktops/config.git", "config_branch": "f[[ release.version ]]", "repo": {{ repos }}, [% if release.version_int >= 41 %] @@ -289,7 +289,7 @@ ostree_container = { }, "^Kinoite$": { "version": "!VERSION_FROM_VERSION_DATE_RESPIN", - "config_url": "https://pagure.io/workstation-ostree-config.git", + "config_url": "https://forge.fedoraproject.org/atomic-desktops/config.git", "config_branch": "f[[ release.version ]]", "repo": {{ repos }}, [% if release.version_int >= 41 %] @@ -306,7 +306,7 @@ ostree_container = { }, "^Sericea$": { "version": "!VERSION_FROM_VERSION_DATE_RESPIN", - "config_url": "https://pagure.io/workstation-ostree-config.git", + "config_url": "https://forge.fedoraproject.org/atomic-desktops/config.git", "config_branch": "f[[ release.version ]]", "repo": {{ repos }}, [% if release.version_int >= 41 %] @@ -319,7 +319,7 @@ ostree_container = { }, "^Onyx$": { "version": "!VERSION_FROM_VERSION_DATE_RESPIN", - "config_url": "https://pagure.io/workstation-ostree-config.git", + "config_url": "https://forge.fedoraproject.org/atomic-desktops/config.git", "config_branch": "f[[ release.version ]]", "repo": {{ repos }}, [% if release.version_int >= 41 %] @@ -333,7 +333,7 @@ ostree_container = { [% if release.version_int >= 42 %] "^COSMIC-Atomic$": { "version": "!VERSION_FROM_VERSION_DATE_RESPIN", - "config_url": "https://pagure.io/workstation-ostree-config.git", + "config_url": "https://forge.fedoraproject.org/atomic-desktops/config.git", "config_branch": "f[[ release.version ]]", "repo": {{ repos }}, "treefile": "cosmic-atomic.yaml", From 621d586accdcc8e6f30d04a5fc9d0d3bef7e272b Mon Sep 17 00:00:00 2001 From: Michal Konecny Date: Tue, 24 Mar 2026 15:29:40 +0100 Subject: [PATCH 021/269] [bodhi] Update for quay.io flatpaks This adds authentication file for flatpak quay.io bots and also adds quay.io to `container.destination_registry`. Signed-off-by: Michal Konecny --- roles/bodhi2/base/tasks/main.yml | 11 +++++++++++ roles/bodhi2/base/templates/flatpak-bot-auth.json.j2 | 12 ++++++++++++ roles/bodhi2/base/templates/production.ini.j2 | 8 ++++---- 3 files changed, 27 insertions(+), 4 deletions(-) create mode 100644 roles/bodhi2/base/templates/flatpak-bot-auth.json.j2 diff --git a/roles/bodhi2/base/tasks/main.yml b/roles/bodhi2/base/tasks/main.yml index aae558451a..a95770cc31 100644 --- a/roles/bodhi2/base/tasks/main.yml +++ b/roles/bodhi2/base/tasks/main.yml @@ -36,6 +36,17 @@ - config - bodhi +- name: Copy auth file for quay.io + ansible.builtin.template: + src: flatpak-bot-auth.json.j2 + dest: /etc/bodhi/flatpak-bot-auth.json + owner: bodhi + group: root + mode: "0644" + tags: + - config + - bodhi + # Bodhi virtualhost in RabbitMQ - name: Configure the bodhi virtual host diff --git a/roles/bodhi2/base/templates/flatpak-bot-auth.json.j2 b/roles/bodhi2/base/templates/flatpak-bot-auth.json.j2 new file mode 100644 index 0000000000..224fc95f14 --- /dev/null +++ b/roles/bodhi2/base/templates/flatpak-bot-auth.json.j2 @@ -0,0 +1,12 @@ +{ + "auths": { + "quay.io": { +{% if env == 'staging' %} + "auth": {{ bodhi2_quayio_auth_stg }}, +{% else %} + "auth": {{ bodhi2_quayio_auth }}, +{% endif %} + "email": "" + } + } +} diff --git a/roles/bodhi2/base/templates/production.ini.j2 b/roles/bodhi2/base/templates/production.ini.j2 index 82f5155b10..4a5a297b15 100644 --- a/roles/bodhi2/base/templates/production.ini.j2 +++ b/roles/bodhi2/base/templates/production.ini.j2 @@ -204,13 +204,13 @@ pungi.extracmdline = --notification-script=/usr/bin/pungi-fedmsg-notification -- skopeo.cmd = /usr/bin/skopeo # Comma separated list of extra flags to pass to the skopeo copy command. -skopeo.extra_copy_flags = -a,--retry-times=10 +skopeo.extra_copy_flags = -a,--retry-times=10,--authfile=/etc/bodhi/flatpak-bot-auth.json # Container hostnames. You can specify a port as well, using the traditional syntax (i.e., localhost:5000). -# container.destination_registry = registry.fedoraproject.org -# container.source_registry = candidate-registry.fedoraproject.org +container.destination_registry = registry.fedoraproject.org quay.io/fedora-flatpaks +container.source_registry = candidate-registry.fedoraproject.org {% if env == 'staging' %} -container.destination_registry = registry.stg.fedoraproject.org quay.io/fedora-testingflatpak +container.destination_registry = registry.stg.fedoraproject.org quay.io/fedora-flatpaks-testing container.source_registry = candidate-registry.stg.fedoraproject.org {% endif %} From 3d39e9ed5a458dcbbfd5121fd958b7051d338a7e Mon Sep 17 00:00:00 2001 From: Michal Konecny Date: Thu, 26 Mar 2026 10:43:17 +0100 Subject: [PATCH 022/269] ][bodhi] Update the bodhi version Signed-off-by: Michal Konecny --- vars/apps/bodhi.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/vars/apps/bodhi.yml b/vars/apps/bodhi.yml index 5dc9b91e97..06236bc261 100644 --- a/vars/apps/bodhi.yml +++ b/vars/apps/bodhi.yml @@ -1,6 +1,6 @@ --- # Set the Bodhi variables -bodhi_version: "{{ (env == 'production')|ternary('25.11.3', '25.11.3') }}" +bodhi_version: "{{ (env == 'production')|ternary('26.4.0', '26.4.0') }}" bodhi_openshift_pods: 1 bodhi_openshift_pods_stg_consumers: 15 bodhi_sent_topics: ^org\.fedoraproject\.{{ env_short }}\.(bodhi|pungi)\..* From 85f227197ce3723978c4061172055935d50d4985 Mon Sep 17 00:00:00 2001 From: Michal Konecny Date: Wed, 6 May 2026 11:46:34 +0200 Subject: [PATCH 023/269] [bodhi] Add missing vars file to playbook Signed-off-by: Michal Konecny --- playbooks/groups/bodhi-backend.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/playbooks/groups/bodhi-backend.yml b/playbooks/groups/bodhi-backend.yml index f888a07e4d..bd8b46333e 100644 --- a/playbooks/groups/bodhi-backend.yml +++ b/playbooks/groups/bodhi-backend.yml @@ -25,6 +25,7 @@ - "/srv/web/infra/ansible/vars/all/FedoraRawhideNumber.yaml" - "/srv/private/ansible/vars.yml" - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml + - /srv/web/infra/ansible/vars/apps/bodhi.yml pre_tasks: - include_vars: dir=/srv/web/infra/ansible/vars/all/ ignore_files=README From 27e3392a20e1620859c35f15ebd4c6210a072850 Mon Sep 17 00:00:00 2001 From: Michal Konecny Date: Wed, 6 May 2026 13:12:21 +0200 Subject: [PATCH 024/269] Improve ansible-lint Why ignore the hardcoded paths, let's just create symlink, so they are found as they should be. Signed-off-by: Michal Konecny --- .forgejo/workflows/ci.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.forgejo/workflows/ci.yaml b/.forgejo/workflows/ci.yaml index 9e409437b3..780339659e 100644 --- a/.forgejo/workflows/ci.yaml +++ b/.forgejo/workflows/ci.yaml @@ -54,6 +54,11 @@ jobs: with: fetch-depth: 0 + - name: Create symlink to overcome absolute paths + run: | + mkdir -p /srv/web/infra/ + ln -s /workspace/infra/ansible /srv/web/infra/ansible + - name: Get changed files id: changed-files uses: https://code.forgejo.org/tj-actions/changed-files@v47 From cc862368ddfe2730f52435b8c4e1f7f8ebe5ef51 Mon Sep 17 00:00:00 2001 From: Anton Medvedev Date: Wed, 6 May 2026 16:09:21 +0200 Subject: [PATCH 025/269] feat: add metrics for forge stage Signed-off-by: Anton Medvedev --- roles/openshift-apps/forgejo/templates/values.yaml.j2 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/openshift-apps/forgejo/templates/values.yaml.j2 b/roles/openshift-apps/forgejo/templates/values.yaml.j2 index fa07ae848c..770409ebf7 100644 --- a/roles/openshift-apps/forgejo/templates/values.yaml.j2 +++ b/roles/openshift-apps/forgejo/templates/values.yaml.j2 @@ -401,9 +401,9 @@ gitea: ## @param gitea.metrics.serviceMonitor.enabled Enable Forgejo metrics service monitor ## @param gitea.metrics.serviceMonitor.namespace Namespace in which Prometheus is running metrics: - enabled: false + enabled: {% if env == 'staging' %}true{% else %}false{% endif %} serviceMonitor: - enabled: false + enabled: {% if env == 'staging' %}true{% else %}false{% endif %} namespace: '' # additionalLabels: # prometheus-release: prom1 From 587aa356d0c03e8da6b43def64bf02e53d353579 Mon Sep 17 00:00:00 2001 From: Anton Medvedev Date: Wed, 6 May 2026 16:45:16 +0200 Subject: [PATCH 026/269] fix: fixing metrix values for forge helm Signed-off-by: Anton Medvedev --- roles/openshift-apps/forgejo/templates/values.yaml.j2 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/openshift-apps/forgejo/templates/values.yaml.j2 b/roles/openshift-apps/forgejo/templates/values.yaml.j2 index 770409ebf7..869a9c8db0 100644 --- a/roles/openshift-apps/forgejo/templates/values.yaml.j2 +++ b/roles/openshift-apps/forgejo/templates/values.yaml.j2 @@ -401,9 +401,9 @@ gitea: ## @param gitea.metrics.serviceMonitor.enabled Enable Forgejo metrics service monitor ## @param gitea.metrics.serviceMonitor.namespace Namespace in which Prometheus is running metrics: - enabled: {% if env == 'staging' %}true{% else %}false{% endif %} + enabled: "{{ (env == 'production') | ternary(forgejo_metrics, forgejo_stg_metrics) }}" serviceMonitor: - enabled: {% if env == 'staging' %}true{% else %}false{% endif %} + enabled: "{{ (env == 'production') | ternary(forgejo_metrics_servicemonitor, forgejo_stg_metrics_servicemonitor) }}" namespace: '' # additionalLabels: # prometheus-release: prom1 From 5b3385240ad6179733cb877e2c0f1536bae07c05 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Wed, 6 May 2026 10:44:08 -0700 Subject: [PATCH 027/269] Update openqa Fedora release versions in host vars Note I live upgrade these systems, so they've actually been on F43 for months. This is just making the vars reflect reality (and fixing it so if we do redeploy them, we deploy the right release). Signed-off-by: Adam Williamson --- inventory/host_vars/openqa-lab01.rdu3.fedoraproject.org | 2 +- inventory/host_vars/openqa01.rdu3.fedoraproject.org | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/inventory/host_vars/openqa-lab01.rdu3.fedoraproject.org b/inventory/host_vars/openqa-lab01.rdu3.fedoraproject.org index 27203f1501..37210a6ed6 100644 --- a/inventory/host_vars/openqa-lab01.rdu3.fedoraproject.org +++ b/inventory/host_vars/openqa-lab01.rdu3.fedoraproject.org @@ -5,7 +5,7 @@ datacenter: rdu3 eth0_ipv4_gw: 10.16.174.254 eth0_ipv4_ip: 10.16.174.57 -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/42/Server/x86_64/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/43/Server/x86_64/os/ ############################################################ # install ############################################################ diff --git a/inventory/host_vars/openqa01.rdu3.fedoraproject.org b/inventory/host_vars/openqa01.rdu3.fedoraproject.org index ba01b72976..0b532ca810 100644 --- a/inventory/host_vars/openqa01.rdu3.fedoraproject.org +++ b/inventory/host_vars/openqa01.rdu3.fedoraproject.org @@ -5,7 +5,7 @@ datacenter: rdu3 eth0_ipv4_gw: 10.16.174.254 eth0_ipv4_ip: 10.16.174.52 -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/42/Server/x86_64/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/43/Server/x86_64/os/ ############################################################ # install ############################################################ From 09af2093f580cdb4212a6323fcfb7f6ef12e8a94 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Wed, 6 May 2026 11:06:54 -0700 Subject: [PATCH 028/269] bodhi / backend: quote tokens in sokpeo auth file Signed-off-by: Kevin Fenzi --- roles/bodhi2/base/templates/flatpak-bot-auth.json.j2 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/bodhi2/base/templates/flatpak-bot-auth.json.j2 b/roles/bodhi2/base/templates/flatpak-bot-auth.json.j2 index 224fc95f14..db4061fe89 100644 --- a/roles/bodhi2/base/templates/flatpak-bot-auth.json.j2 +++ b/roles/bodhi2/base/templates/flatpak-bot-auth.json.j2 @@ -2,9 +2,9 @@ "auths": { "quay.io": { {% if env == 'staging' %} - "auth": {{ bodhi2_quayio_auth_stg }}, + "auth": "{{ bodhi2_quayio_auth_stg }}", {% else %} - "auth": {{ bodhi2_quayio_auth }}, + "auth": "{{ bodhi2_quayio_auth }}", {% endif %} "email": "" } From e4321ec9c3092339b1d0284df85a323287d8750b Mon Sep 17 00:00:00 2001 From: David Kirwan Date: Wed, 6 May 2026 19:57:55 +0100 Subject: [PATCH 029/269] communishift: Disable project playbook Signed-off-by: David Kirwan --- .../manual/communishift_disable_project.yml | 24 +- ...eanup-administration-shutdown-services.yml | 139 ++++-- .../tasks/call-helm.yaml | 28 ++ .../tasks/create-zabbix-proxy-namespace.yaml | 11 + .../zabbix_openshift_proxy/tasks/main.yaml | 8 + .../templates/dist-git-namespace.yaml.j2 | 5 + .../templates/zabbix-values.yaml.j2 | 466 ++++++++++++++++++ 7 files changed, 649 insertions(+), 32 deletions(-) create mode 100644 roles/zabbix/zabbix_openshift_proxy/tasks/call-helm.yaml create mode 100644 roles/zabbix/zabbix_openshift_proxy/tasks/create-zabbix-proxy-namespace.yaml create mode 100644 roles/zabbix/zabbix_openshift_proxy/tasks/main.yaml create mode 100644 roles/zabbix/zabbix_openshift_proxy/templates/dist-git-namespace.yaml.j2 create mode 100644 roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 diff --git a/playbooks/manual/communishift_disable_project.yml b/playbooks/manual/communishift_disable_project.yml index a97a15f528..6d8b5e8da9 100644 --- a/playbooks/manual/communishift_disable_project.yml +++ b/playbooks/manual/communishift_disable_project.yml @@ -1,7 +1,13 @@ --- # Communishift project disable / shutdown path (inventory + per-project eligibility). -# Uses communishift_projects and each entry's do_not_delete to skip exempt namespaces. -# Currently logs intent; scale-to-zero in the role is still commented out. +# Uses communishift_projects from inventory (e.g. inventory/group_vars/all) and each +# entry's do_not_delete to skip exempt namespaces. +# +# Default: report only (no API scale). To apply scale-to-zero on eligible namespaces: +# ansible-playbook .../communishift_disable_project.yml --tags communishift_disable_project \ +# -e communishift_disable_shutdown=true +# +# Run with an inventory that merges group_vars/all so communishift_projects is defined. # # Run disable tasks only: # ansible-playbook .../communishift_disable_project.yml --tags communishift_disable_project @@ -15,9 +21,21 @@ - "/srv/private/ansible/vars.yml" - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml + pre_tasks: + - name: Require communishift_projects from inventory + ansible.builtin.assert: + that: + - communishift_projects is defined + - communishift_projects is mapping + fail_msg: > + communishift_projects is missing. Run with an inventory that loads + inventory/group_vars/all (e.g. ansible-playbook -i path/to/inventory ...). + tags: + - always + tasks: - name: Communishift project shutdown (eligible projects) - include_role: + ansible.builtin.include_role: name: communishift tasks_from: cleanup-administration-shutdown-services apply: diff --git a/roles/communishift/tasks/cleanup-administration-shutdown-services.yml b/roles/communishift/tasks/cleanup-administration-shutdown-services.yml index 950016227a..8d0a230eab 100644 --- a/roles/communishift/tasks/cleanup-administration-shutdown-services.yml +++ b/roles/communishift/tasks/cleanup-administration-shutdown-services.yml @@ -1,35 +1,116 @@ --- -- name: Check if this project should be deleted +- name: Set Communishift shutdown context for this project ansible.builtin.set_fact: - should_not_delete: "{{ item.value.do_not_delete | default(false) }}" + communishift_namespace: "{{ item.value.name }}" + communishift_protected: "{{ item.value.do_not_delete | default(false) | bool }}" -- name: Debug - debug: - msg: "Project {{ item.value.name }} marked for shutdown" - when: "not should_not_delete" +- name: Skip shutdown for protected Communishift project + ansible.builtin.debug: + msg: "Skipping {{ communishift_namespace }} (do_not_delete is true)" + when: communishift_protected | bool +- name: Report eligible project (dry run, no API scale) + ansible.builtin.debug: + msg: >- + Would scale workloads to 0 in {{ communishift_namespace }} + (use -e communishift_disable_shutdown=true to apply). + when: + - not (communishift_protected | bool) + - not (communishift_disable_shutdown | default(false) | bool) +- name: Scale down workloads in eligible Communishift namespace + when: + - not (communishift_protected | bool) + - communishift_disable_shutdown | default(false) | bool + block: + - name: List Deployments + kubernetes.core.k8s_info: + api_key: "{{ communishift_ocp_api_token }}" + host: "{{ communishift_ocp_api_host }}" + api_version: apps/v1 + kind: Deployment + namespace: "{{ communishift_namespace }}" + register: communishift_deployments -#- name: Loop over each project and scale its deployments to 0 -# block: -# - name: Get list of deployments in the current project -# kubernetes.core.k8s_info: -# kind: Deployment -# api_version: apps/v1 -# namespace: "{{ item }}" -# register: deployment_list -# loop: "{{ projects_list }}" -# -# - name: Scale each deployment to 0 replicas -# kubernetes.core.k8s_scale: -# api_version: apps/v1 -# kind: Deployment -# name: "{{ dep.metadata.name }}" -# namespace: "{{ item.item }}" # item.item is the project from the outer loop -# replicas: 0 -# wait: true # Optional: wait for scale to complete -# loop: "{{ deployment_list.results | selectattr('resources', 'defined') | map(attribute='resources') | flatten }}" -# loop_control: -# loop_var: dep -# when: deployment_list.results is defined and deployment_list.results | length > 0 -# when: projects_list is defined and projects_list | length > 0 + - name: Scale Deployments to zero + kubernetes.core.k8s_scale: + api_key: "{{ communishift_ocp_api_token }}" + host: "{{ communishift_ocp_api_host }}" + api_version: apps/v1 + kind: Deployment + name: "{{ scale_target.metadata.name }}" + namespace: "{{ communishift_namespace }}" + replicas: 0 + wait: true + loop: "{{ communishift_deployments.resources | default([]) }}" + loop_control: + loop_var: scale_target + + - name: List DeploymentConfigs + kubernetes.core.k8s_info: + api_key: "{{ communishift_ocp_api_token }}" + host: "{{ communishift_ocp_api_host }}" + api_version: apps.openshift.io/v1 + kind: DeploymentConfig + namespace: "{{ communishift_namespace }}" + register: communishift_deploymentconfigs + + - name: Scale DeploymentConfigs to zero + kubernetes.core.k8s_scale: + api_key: "{{ communishift_ocp_api_token }}" + host: "{{ communishift_ocp_api_host }}" + api_version: apps.openshift.io/v1 + kind: DeploymentConfig + name: "{{ scale_target.metadata.name }}" + namespace: "{{ communishift_namespace }}" + replicas: 0 + wait: true + loop: "{{ communishift_deploymentconfigs.resources | default([]) }}" + loop_control: + loop_var: scale_target + + - name: List StatefulSets + kubernetes.core.k8s_info: + api_key: "{{ communishift_ocp_api_token }}" + host: "{{ communishift_ocp_api_host }}" + api_version: apps/v1 + kind: StatefulSet + namespace: "{{ communishift_namespace }}" + register: communishift_statefulsets + + - name: Scale StatefulSets to zero + kubernetes.core.k8s_scale: + api_key: "{{ communishift_ocp_api_token }}" + host: "{{ communishift_ocp_api_host }}" + api_version: apps/v1 + kind: StatefulSet + name: "{{ scale_target.metadata.name }}" + namespace: "{{ communishift_namespace }}" + replicas: 0 + wait: true + loop: "{{ communishift_statefulsets.resources | default([]) }}" + loop_control: + loop_var: scale_target + + - name: List DaemonSets + kubernetes.core.k8s_info: + api_key: "{{ communishift_ocp_api_token }}" + host: "{{ communishift_ocp_api_host }}" + api_version: apps/v1 + kind: DaemonSet + namespace: "{{ communishift_namespace }}" + register: communishift_daemonsets + + - name: Scale DaemonSets to zero + kubernetes.core.k8s_scale: + api_key: "{{ communishift_ocp_api_token }}" + host: "{{ communishift_ocp_api_host }}" + api_version: apps/v1 + kind: DaemonSet + name: "{{ scale_target.metadata.name }}" + namespace: "{{ communishift_namespace }}" + replicas: 0 + wait: true + loop: "{{ communishift_daemonsets.resources | default([]) }}" + loop_control: + loop_var: scale_target diff --git a/roles/zabbix/zabbix_openshift_proxy/tasks/call-helm.yaml b/roles/zabbix/zabbix_openshift_proxy/tasks/call-helm.yaml new file mode 100644 index 0000000000..00416c9ecd --- /dev/null +++ b/roles/zabbix/zabbix_openshift_proxy/tasks/call-helm.yaml @@ -0,0 +1,28 @@ +--- +- name: Generate the zabbix-values.yaml from template + ansible.builtin.template: + src: "values.yaml.j2" + dest: "/root/ocp4/openshift-apps/zabbix-proxy/zabbix-values.yaml" + mode: "0770" + + +- name: Git clone the Zabbix Helm Chart + ansible.builtin.git: + repo: "https://codeberg.org/fedora/forgejo-helm.git" + dest: /tmp/zabbix-kubernetes-helm + +- name: Build Helm chart dependencies + ansible.builtin.command: + cmd: helm dependency update + chdir: /tmp/zabbix-kubernetes-helm/ + changed_when: true + +- name: Deploy Forgejo chart from local path + kubernetes.core.helm: + name: zabbix + create_namespace: true + chart_ref: /tmp/zabbix-kubernetes-helm/ + release_name: zabbix + release_namespace: zabbix + values_files: + - "/root/ocp4/openshift-apps/zabbix-proxy/zabbix-values.yaml" diff --git a/roles/zabbix/zabbix_openshift_proxy/tasks/create-zabbix-proxy-namespace.yaml b/roles/zabbix/zabbix_openshift_proxy/tasks/create-zabbix-proxy-namespace.yaml new file mode 100644 index 0000000000..803b578e29 --- /dev/null +++ b/roles/zabbix/zabbix_openshift_proxy/tasks/create-zabbix-proxy-namespace.yaml @@ -0,0 +1,11 @@ +--- +- name: Generate the zabbix-proxy-namespace.yaml from template + ansible.builtin.template: + src: "zabbix-proxy-namespace.yaml.j2" + dest: "/root/ocp4/openshift-apps/zabbix-proxy/zabbix-proxy-namespace.yaml" + mode: "0770" + +- name: Deploy the zabbix-proxy-namespace.yaml config + kubernetes.core.k8s: + state: present + src: "/root/ocp4/openshift-apps/zabbix-proxy/zabbix-proxy-namespace.yaml" diff --git a/roles/zabbix/zabbix_openshift_proxy/tasks/main.yaml b/roles/zabbix/zabbix_openshift_proxy/tasks/main.yaml new file mode 100644 index 0000000000..6e9f797c56 --- /dev/null +++ b/roles/zabbix/zabbix_openshift_proxy/tasks/main.yaml @@ -0,0 +1,8 @@ +--- +- name: Ensures /root/ocp4/openshift-apps/zabbix-proxy/ dir exists + ansible.builtin.file: + path: "/root/ocp4/openshift-apps/zabbix-proxy/" + state: directory + +- include_tasks: create-zabbix-proxy-namespace.yaml +- include_tasks: call-helm.yaml diff --git a/roles/zabbix/zabbix_openshift_proxy/templates/dist-git-namespace.yaml.j2 b/roles/zabbix/zabbix_openshift_proxy/templates/dist-git-namespace.yaml.j2 new file mode 100644 index 0000000000..1e14b419eb --- /dev/null +++ b/roles/zabbix/zabbix_openshift_proxy/templates/dist-git-namespace.yaml.j2 @@ -0,0 +1,5 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: "dist-git" diff --git a/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 b/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 new file mode 100644 index 0000000000..c9abf5e88f --- /dev/null +++ b/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 @@ -0,0 +1,466 @@ +## nameOverride -- Override name of app +nameOverride: "" +## fullnameOverride -- Override the full qualified app name +fullnameOverride: "" +## kubeStateMetrics.enabled -- If true, deploys the kube-state-metrics deployment +kubeStateMetrics: + enabled: true + +## Service account for Kubernetes API +rbac: + ## rbac.create Specifies whether the RBAC resources should be created + create: true + additionalRulesForClusterRole: [] + ## - apiGroups: [ "" ] + ## resources: + ## - nodes/proxy + ## verbs: [ "get", "list", "watch" ] +serviceAccount: + ## serviceAccount.create Specifies whether a service account should be created + create: true + ## serviceAccount.name The name of the service account to use. If not set name is generated using the fullname template + name: "" + + +## **Zabbix proxy** configurations +zabbixProxy: + ## Enable use of **Zabbix proxy** + enabled: true + securityContext: + runAsNonRoot: false # Must be false because agent often needs root for host access + # runAsUser: 0 # Explicit root if needed (default is often root) + # fsGroup: 0 # Optional +# Container-level securityContext + containerSecurityContext: + allowPrivilegeEscalation: false # Satisfies one violation (safe to set false) + privileged: false # Ensure not privileged (chart probably doesn't set it) + capabilities: + drop: + - ALL # Drop all extra caps (helps restricted) + seccompProfile: + type: RuntimeDefault # Or "Localhost" if you have a profile + # runAsNonRoot: false # Usually pod-level overrides, but can duplicate + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + resources: {} + image: + ## Zabbix proxy Docker image name + repository: zabbix/zabbix-proxy-sqlite3 + ## Tag of Docker image of Zabbix proxy + tag: alpine-7.0.17 + pullPolicy: IfNotPresent + ## List of dockerconfig secrets names to use when pulling images. Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## https://kubernetes.io/docs/concepts/containers/images/#using-a-private-registry + pullSecrets: [] + + env: + ## The variable allows to switch Zabbix proxy mode. By default, value is 0 - active proxy. Allowed values are 0 and 1. + - name: ZBX_PROXYMODE + value: 0 + ## Zabbix proxy hostname + - name: ZBX_HOSTNAME + value: openshift-cluster-proxy + ## Zabbix server host + ## If ProxyMode is set to active mode: + ## IP address or DNS name of Zabbix server to get configuration data from and send data to. + + ## If ProxyMode is set to passive mode: + ## List of comma delimited IP addresses, optionally in CIDR notation, or DNS names of Zabbix server. Incoming connections will be accepted only from the addresses listed here. If IPv6 support is enabled then '127.0.0.1', '::127.0.0.1', '::ffff:127.0.0.1' are treated equally and '::/0' will allow any IPv4 or IPv6 address. '0.0.0.0/0' can be used to allow any IPv4 address. + ## Example: Server=127.0.0.1,192.168.1.0/24,::1,2001:db8::/32,zabbix.example.com + + ## Note that since version 6.0 the variable ZBX_SERVER_PORT is not supported anymore. Instead, add a colon (:) followed by the port number to the end of ZBX_SERVER_HOST value. + - name: ZBX_SERVER_HOST + value: "zabbix01.stg.rdu3.fedoraproject.org:10051" + ## Security settings + #- name: ZBX_TLSCONNECT + # value: "psk" + - name: ZBX_TLSACCEPT + value: "unencrypted,psk" + - name: ZBX_TLSPSKIDENTITY + value: "Fedora" + ## The variable is used to specify debug level. By default, value is 3 + - name: ZBX_DEBUGLEVEL + value: 3 + ## Cache size + - name: ZBX_CACHESIZE + value: 128M + ## This variable is specified amount of pre-forked instances of Java pollers. By default, value is 0. If zabbixJavaGateway enable value is 5. + - name: ZBX_STARTJAVAPOLLERS + value: 0 + ## How often the proxy retrieves configuration data from Zabbix server in seconds. Active proxy parameter. Ignored for passive proxies. + - name: ZBX_PROXYCONFIGFREQUENCY + value: 10 + ## List can be extended with other environment variables listed here: https://github.com/zabbix/zabbix-docker/tree/7.0/Dockerfiles/proxy-sqlite3#other-variables + ## For example: + ## The variable is list of comma separated loadable Zabbix modules. + ## - name: ZBX_LOADMODULE + ## value : dummy1.so,dummy2.so + + ## The startupProbe, livenessProbe, readinessProbe variables + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/ + + livenessProbe: + enabled: true + tcpSocket: + port: zabbix-proxy + initialDelaySeconds: 10 + timeoutSeconds: 3 + failureThreshold: 3 + periodSeconds: 10 + successThreshold: 1 + + readinessProbe: + enabled: false + tcpSocket: + port: zabbix-proxy + initialDelaySeconds: 10 + timeoutSeconds: 3 + failureThreshold: 3 + periodSeconds: 10 + successThreshold: 1 + + startupProbe: + enabled: true + tcpSocket: + port: zabbix-proxy + initialDelaySeconds: 30 + timeoutSeconds: 3 + failureThreshold: 5 + periodSeconds: 10 + successThreshold: 1 + + service: + annotations: {} + labels: {} + ## Type of service for Zabbix proxy + type: ClusterIP + ## Port to expose service + port: 10051 + ## Port of application pod + targetPort: 10051 + ## Zabbix proxy Ingress externalIPs with optional path + ## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips + ## Must be provided if ProxyMode is set to passive mode + externalIPs: [] + ## Loadbalancer IP + ## Only use if service.type is "LoadBalancer" + loadBalancerIP: "" + loadBalancerSourceRanges: [] + + + ## Node selector for Zabbix proxy + nodeSelector: {} + + ## Tolerations configuration for Zabbix proxy + tolerations: {} + + ## Affinity configuration for Zabbix proxy + affinity: {} + + persistentVolume: + ## If true, Zabbix proxy will create/use a Persistent Volume Claim + ## + enabled: true + + ## Zabbix proxy data Persistent Volume access modes + ## Must match those of existing PV or dynamic provisioner + ## Ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ + ## + accessModes: + - ReadWriteOnce + + ## Zabbix proxy data Persistent Volume Claim annotations + ## + annotations: {} + + ## Zabbix proxy data Persistent Volume existing claim name + ## Requires zabbixProxy.persistentVolume.enabled: true + ## If defined, PVC must be created manually before volume will be bound + existingClaim: "zabbix-zabbix-helm-chart-proxy" + + ## Zabbix proxy data Persistent Volume mount root path + ## + mountPath: /data + + ## Zabbix proxy data Persistent Volume size + ## + size: 2Gi + + ## Zabbix proxy data Persistent Volume Storage Class + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. (gp2 on AWS, standard on + ## GKE, AWS & OpenStack) + ## + storageClass: "ocs-storagecluster-ceph-rbd" + + ## Zabbix proxy data Persistent Volume Binding Mode + ## If defined, volumeBindingMode: + ## If undefined (the default) or set to null, no volumeBindingMode spec is + ## set, choosing the default mode. + ## + volumeBindingMode: "" + + ## Subdirectory of Zabbix proxy data Persistent Volume to mount + ## Useful if the volume's root directory is not empty + ## + subPath: "" + +## **Zabbix agent** configurations +zabbixAgent: + ## Enable use of Zabbix agent + enabled: true + ## Set resource requests/limits for Zabbix agents + resources: {} + ## requests: + ## cpu: 100m + ## memory: 54Mi + ## limits: + ## cpu: 100m + ## memory: 54Mi + + securityContext: + runAsNonRoot: true # Must be false because agent often needs root for host access + # runAsUser: 0 # Explicit root if needed (default is often root) + # fsGroup: 0 # Optional + # fsGroup: 65534 + # runAsGroup: 65534 + # runAsNonRoot: true + # runAsUser: 65534 + + containerSecurityContext: + allowPrivilegeEscalation: false # Satisfies one violation (safe to set false) + privileged: false # Ensure not privileged (chart probably doesn't set it) + capabilities: + drop: + - ALL # Drop all extra caps (helps restricted) + seccompProfile: + type: RuntimeDefault # Or "Localhost" if you have a profile + # runAsNonRoot: false # Usually pod-level overrides, but can duplicate + ## capabilities: + ## add: + ## - SYS_TIME + + ## Expose the service to the host network + hostNetwork: true + + # Specify dns configuration options for agent containers e.g ndots + ## ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config + dnsConfig: {} + # options: + # - name: ndots + # value: "1" + + ## Share the host process ID namespace + hostPID: true + ## If true, agent pods mounts host / at /host/root + ## + hostRootFsMount: true + extraHostVolumeMounts: [] + ## - name: + ## hostPath: + ## mountPath: + ## readOnly: true|false + ## mountPropagation: None|HostToContainer|Bidirectional + image: + ## Zabbix agent Docker image name + repository: zabbix/zabbix-agent2 + ## Tag of Docker image of Zabbix agent + tag: alpine-7.0.17 + pullPolicy: IfNotPresent + ## List of dockerconfig secrets names to use when pulling images. Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## https://kubernetes.io/docs/concepts/containers/images/#using-a-private-registry + pullSecrets: [] + env: + ## Zabbix server host + - name: ZBX_SERVER_HOST + value: zabbix01.stg.rdu3.fedoraproject.org + ## Zabbix server port + - name: ZBX_SERVER_PORT + value: 10051 + ## This variable is boolean (true or false) and enables or disables feature of passive checks. By default, value is true + - name: ZBX_PASSIVE_ALLOW + value: true + ## This variable is boolean (true or false) and enables or disables feature of active checks + - name: ZBX_ACTIVE_ALLOW + value: false + ## The variable is used to specify debug level, from 0 to 5 + - name: ZBX_DEBUGLEVEL + value: 3 + ## The variable is used to specify timeout for processing checks. By default, value is 4. + - name: ZBX_TIMEOUT + value: 4 + ## List can be extended with other environment variables listed here: https://github.com/zabbix/zabbix-docker/tree/7.0/Dockerfiles/agent2/alpine#other-variables + ## For example: + ## The variable is comma separated list of allowed Zabbix server or proxy hosts for connections to Zabbix agent 2 container. You may specify port of Zabbix server or Zabbix proxy in such syntax: zabbix-server:10061,zabbix-proxy:10072 + ## - name: ZBX_ACTIVESERVERS + ## value: '' + ## The variable is comma separated list of allowed Zabbix server or proxy hosts for connections to Zabbix agent 2 container. + ## - name: ZBX_PASSIVESERVERS + ## value: 0.0.0.0/0 + ## The variable is list of comma separated loadable Zabbix modules. It works with volume /var/lib/zabbix/modules. + ## - name: ZBX_LOADMODULE + ## value: '' + + ## The startupProbe, livenessProbe, readinessProbe variables + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/ + + livenessProbe: + enabled: true + tcpSocket: + port: zabbix-agent + initialDelaySeconds: 10 + timeoutSeconds: 3 + failureThreshold: 3 + periodSeconds: 10 + successThreshold: 1 + + readinessProbe: + enabled: false + tcpSocket: + port: zabbix-agent + initialDelaySeconds: 10 + timeoutSeconds: 3 + failureThreshold: 3 + periodSeconds: 10 + successThreshold: 1 + + startupProbe: + enabled: true + tcpSocket: + port: zabbix-agent + initialDelaySeconds: 10 + periodSeconds: 5 + timeoutSeconds: 3 + failureThreshold: 5 + + ## Node selector for Agent. Only supports Linux. + nodeSelector: + kubernetes.io/os: linux + + ## Tolerations configuration + tolerations: + - effect: NoSchedule + key: node-role.kubernetes.io/control-plane + ## Affinity configuration + affinity: {} + serviceAccount: + ## Specifies whether a ServiceAccount should be created + create: true + ## The name of the ServiceAccount to use. + ## If not set and create is true, a name is generated using the fullname template + name: "" + annotations: {} + imagePullSecrets: [] + automountServiceAccountToken: false + + service: + type: ClusterIP + port: 10050 + targetPort: 10050 + nodePort: 10050 + portName: zabbix-agent + listenOnAllInterfaces: true + annotations: + agent.zabbix/monitor: "true" + + rbac: + ## If true, create & use RBAC resources + ## + create: true + ## If true, create & use Pod Security Policy resources + ## https://kubernetes.io/docs/concepts/policy/pod-security-policy/ + ## PodSecurityPolicies disabled by default because they are deprecated in Kubernetes 1.21 and will be removed in Kubernetes 1.25. + ## If you are using PodSecurityPolicies you can enable the previous behaviour by setting `rbac.pspEnabled: true` + pspEnabled: false + pspAnnotations: {} + +## **Zabbix Java Gateway** configurations +zabbixJavaGateway: + ## Enable use of **Zabbix Java Gateway** + enabled: false + containerSecurityContext: {} + ## Resource management for Pods and Containers. + ## More details: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers + resources: {} + image: + ## Zabbix Java Gateway Docker image name. + repository: zabbix/zabbix-java-gateway + ## Tag of Docker image of Zabbix Java Gateway Docker + tag: alpine-7.0.17 + pullPolicy: IfNotPresent + ## List of dockerconfig secrets names to use when pulling images. Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## https://kubernetes.io/docs/concepts/containers/images/#using-a-private-registry + pullSecrets: [] + + env: + ## This variable is specified amount of pollers. By default, value is 5 + - name: ZBX_START_POLLERS + value: 5 + ## This variable is used to specify timeout for outgoing connections. By default, value is 3 + - name: ZBX_TIMEOUT + value: 3 + ## This variable is used to specify log level. By default, value is info. Possible values: trace, debug, info, warn, error, all, off + - name: ZBX_DEBUGLEVEL + value: info + ## List can be extended with other environment variables listed here: https://github.com/zabbix/zabbix-docker/tree/7.0/Dockerfiles/java-gateway/alpine + + ## The startupProbe, livenessProbe, readinessProbe variables + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/ + + livenessProbe: + enabled: true + tcpSocket: + port: zabbix-jmx + initialDelaySeconds: 10 + timeoutSeconds: 3 + failureThreshold: 3 + periodSeconds: 10 + successThreshold: 1 + + readinessProbe: + enabled: false + tcpSocket: + port: zabbix-jmx + initialDelaySeconds: 10 + timeoutSeconds: 3 + failureThreshold: 3 + periodSeconds: 10 + successThreshold: 1 + + startupProbe: + enabled: true + tcpSocket: + port: zabbix-jmx + initialDelaySeconds: 30 + timeoutSeconds: 3 + failureThreshold: 5 + periodSeconds: 10 + successThreshold: 1 + + service: + annotations: {} + labels: {} + ## Type of service for Zabbix Java Gateway + type: ClusterIP + ## Port to expose service + port: 10052 + externalIPs: [] + ## Loadbalancer IP + ## Only use if service.type is "LoadBalancer" + loadBalancerIP: "" + loadBalancerSourceRanges: [] + loadBalancerClass: "" + sessionAffinity: None + + ## Node selector for Zabbix Java Gateway + nodeSelector: {} + + ## Tolerations configurations for Zabbix Java Gateway + tolerations: {} + + ## Affinity configurations for Zabbix Java Gateway + affinity: {} From e6491b5cba3f0f926c3c67ae4242a41c21381b62 Mon Sep 17 00:00:00 2001 From: David Kirwan Date: Wed, 6 May 2026 20:11:29 +0100 Subject: [PATCH 030/269] communishift: Send email notification when disabling projects Signed-off-by: David Kirwan --- .../manual/communishift_disable_project.yml | 34 ++++++++++++ .../communishift_send_email_notifications.yml | 2 +- ...nistration-send-disabled-notifications.yml | 53 +++++++++++++++++++ 3 files changed, 88 insertions(+), 1 deletion(-) create mode 100644 roles/communishift/tasks/cleanup-administration-send-disabled-notifications.yml diff --git a/playbooks/manual/communishift_disable_project.yml b/playbooks/manual/communishift_disable_project.yml index 6d8b5e8da9..08ae52ff3b 100644 --- a/playbooks/manual/communishift_disable_project.yml +++ b/playbooks/manual/communishift_disable_project.yml @@ -7,6 +7,11 @@ # ansible-playbook .../communishift_disable_project.yml --tags communishift_disable_project \ # -e communishift_disable_shutdown=true # +# Tenant “disabled” emails (FASJSON BCC, same SMTP path as communishift_send_email_notifications.yml) run after +# shutdown when communishift_disable_shutdown=true, unless skipped (see below). Preview mail targets without SMTP: +# ... -e communishift_disabled_notifications_dry_run=true +# To skip kinit/FASJSON + disabled emails entirely (scale only): -e communishift_disabled_notifications_skip=true +# # Run with an inventory that merges group_vars/all so communishift_projects is defined. # # Run disable tasks only: @@ -34,6 +39,19 @@ - always tasks: + - name: Communishift Retrieve FASJSON data (for disabled notices) + ansible.builtin.include_role: + name: communishift + tasks_from: cleanup-administration-retrieve-data + apply: + tags: + - communishift_disable_project + when: + - not (communishift_disabled_notifications_skip | default(false) | bool) + - (communishift_disable_shutdown | default(false) | bool) or (communishift_disabled_notifications_dry_run | default(false) | bool) + tags: + - communishift_disable_project + - name: Communishift project shutdown (eligible projects) ansible.builtin.include_role: name: communishift @@ -42,3 +60,19 @@ tags: - communishift_disable_project loop: "{{ lookup('dict', communishift_projects) }}" + tags: + - communishift_disable_project + + - name: Communishift send project disabled notices + ansible.builtin.include_role: + name: communishift + tasks_from: cleanup-administration-send-disabled-notifications + apply: + tags: + - communishift_disable_project + loop: "{{ lookup('dict', communishift_projects) }}" + when: + - not (communishift_disabled_notifications_skip | default(false) | bool) + - (communishift_disable_shutdown | default(false) | bool) or (communishift_disabled_notifications_dry_run | default(false) | bool) + tags: + - communishift_disable_project diff --git a/playbooks/manual/communishift_send_email_notifications.yml b/playbooks/manual/communishift_send_email_notifications.yml index b42ccf1012..2fb0733444 100644 --- a/playbooks/manual/communishift_send_email_notifications.yml +++ b/playbooks/manual/communishift_send_email_notifications.yml @@ -1,6 +1,6 @@ --- # Sends Fedora Communishift lifecycle emails to project admins (FASJSON BCC). -# Notifications only — see communishift_disable_project.yml for shutdown-related tasks. +# Notifications only — see communishift_disable_project.yml for shutdown and post-disable tenant emails. # # Run notifications only: # ansible-playbook .../communishift_send_email_notifications.yml --tags communishift_send_notifications diff --git a/roles/communishift/tasks/cleanup-administration-send-disabled-notifications.yml b/roles/communishift/tasks/cleanup-administration-send-disabled-notifications.yml new file mode 100644 index 0000000000..1820b5c1f1 --- /dev/null +++ b/roles/communishift/tasks/cleanup-administration-send-disabled-notifications.yml @@ -0,0 +1,53 @@ +--- +# Sent after workloads are scaled down; requires communishift_project_emails (FASJSON) on the host. +- name: Set Communishift disabled-notice context for this project + ansible.builtin.set_fact: + communishift_dn_protected: "{{ item.value.do_not_delete | default(false) | bool }}" + +- name: Send Communishift project disabled notices to tenants + community.general.mail: + host: localhost + port: 25 + subject: "Fedora Communishift: project {{ item.value.name }} has been disabled" + body: > + Dear Fedora Communishift Project Administrators (BCC'd), + + + This message confirms that the Communishift project {{ item.value.name }} has been disabled: workloads in + this namespace have been scaled to zero as part of the Fedora Communishift cleanup aligned with the + post-release process. + + Persistent data volumes and configuration objects may still exist in the cluster; retrieve anything you still + need according to Openshift documentation. The project may be deleted in a later step of the same process. + + If you believe this action was taken in error, open a ticket with the Fedora Infrastructure team: + https://forge.fedoraproject.org/infra/tickets + + Please reference the project name and describe the issue. + from: admin@fedoraproject.org + to: "infrastructure@lists.fedoraproject.org" + bcc: "{{ communishift_project_emails[item.value.name]['email_list'] }}" + cc: admin@fedoraproject.org + headers: + - Reply-To=admin@fedoraproject.org + charset: us-ascii + when: + - not communishift_dn_protected + - communishift_disable_shutdown | default(false) | bool + - not communishift_disabled_notifications_dry_run | default(false) + tags: + - communishift_disable_project + +- name: Communishift disabled notice (dry-run preview, mail not sent) + ansible.builtin.debug: + msg: + dry_run: true + project: "{{ item.value.name }}" + to: infrastructure@lists.fedoraproject.org + bcc: "{{ communishift_project_emails[item.value.name]['email_list'] }}" + subject: "Fedora Communishift: project {{ item.value.name }} has been disabled" + when: + - not communishift_dn_protected + - communishift_disabled_notifications_dry_run | default(false) + tags: + - communishift_disable_project From 10ad96ad9d18ad9f866a9b71ba8aa31b95dd67cd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20Such=C3=BD?= Date: Wed, 6 May 2026 08:47:16 +0200 Subject: [PATCH 031/269] copr: more packages to powerful builder --- roles/copr/frontend/templates/copr.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/copr/frontend/templates/copr.conf b/roles/copr/frontend/templates/copr.conf index bbe58b5e5a..7fbca8005f 100644 --- a/roles/copr/frontend/templates/copr.conf +++ b/roles/copr/frontend/templates/copr.conf @@ -290,7 +290,7 @@ EXTRA_BUILDCHROOT_TAGS = [{ "tags": ["on_demand_powerful"], },{ # packages that always takes time to build - "pattern": ".*/.*/.*/(firefox|thunderbird)$", + "pattern": ".*/.*/.*/(firefox|thunderbird|pytorch|llvm)$", "tags": ["on_demand_powerful"], }] {% endif %} From 565a59722b79cf224a2043cc52d034df54d67a9e Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Mon, 4 May 2026 13:36:25 -0700 Subject: [PATCH 032/269] resultsdb / resultsdb-ci-listener: convert from deploymentconfig to deployment This moves these two apps from deploymentconfig to deployment. Assisted-by: calude Signed-off-by: Kevin Fenzi --- .../openshift-apps/resultsdb-ci-listener.yml | 4 +- playbooks/openshift-apps/resultsdb.yml | 8 +-- ...oymentconfigs.yml.j2 => deployment.yml.j2} | 12 ++--- ...oymentconfigs.yml.j2 => deployment.yml.j2} | 54 +++++++++---------- ...oymentconfigs.yml.j2 => deployment.yml.j2} | 17 +++--- 5 files changed, 44 insertions(+), 51 deletions(-) rename roles/openshift-apps/resultsdb-ci-listener/templates/{deploymentconfigs.yml.j2 => deployment.yml.j2} (92%) rename roles/openshift-apps/resultsdb/templates/backend/{deploymentconfigs.yml.j2 => deployment.yml.j2} (84%) rename roles/openshift-apps/resultsdb/templates/frontend/{deploymentconfigs.yml.j2 => deployment.yml.j2} (84%) diff --git a/playbooks/openshift-apps/resultsdb-ci-listener.yml b/playbooks/openshift-apps/resultsdb-ci-listener.yml index 24404c3e50..e3b28622d1 100644 --- a/playbooks/openshift-apps/resultsdb-ci-listener.yml +++ b/playbooks/openshift-apps/resultsdb-ci-listener.yml @@ -81,5 +81,5 @@ - role: openshift/object object_app: resultsdb-ci-listener - object_template: deploymentconfigs.yml.j2 - object_objectname: deploymentconfigs.yml + object_template: deployment.yml.j2 + object_objectname: deployment.yml diff --git a/playbooks/openshift-apps/resultsdb.yml b/playbooks/openshift-apps/resultsdb.yml index a5d3f20f62..5e36a137de 100644 --- a/playbooks/openshift-apps/resultsdb.yml +++ b/playbooks/openshift-apps/resultsdb.yml @@ -92,8 +92,8 @@ - role: openshift/object object_app: resultsdb - object_template: backend/deploymentconfigs.yml.j2 - object_objectname: backend-deploymentconfigs.yml + object_template: backend/deployment.yml.j2 + object_objectname: backend-deployment.yml - role: openshift/object object_app: resultsdb @@ -123,8 +123,8 @@ - role: openshift/object object_app: resultsdb - object_template: frontend/deploymentconfigs.yml.j2 - object_objectname: frontend-deploymentconfigs.yml + object_template: frontend/deployment.yml.j2 + object_objectname: frontend-deployment.yml - role: openshift/object object_app: resultsdb diff --git a/roles/openshift-apps/resultsdb-ci-listener/templates/deploymentconfigs.yml.j2 b/roles/openshift-apps/resultsdb-ci-listener/templates/deployment.yml.j2 similarity index 92% rename from roles/openshift-apps/resultsdb-ci-listener/templates/deploymentconfigs.yml.j2 rename to roles/openshift-apps/resultsdb-ci-listener/templates/deployment.yml.j2 index 679360b502..17be007863 100644 --- a/roles/openshift-apps/resultsdb-ci-listener/templates/deploymentconfigs.yml.j2 +++ b/roles/openshift-apps/resultsdb-ci-listener/templates/deployment.yml.j2 @@ -1,6 +1,6 @@ --- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: name: "resultsdb-ci-listener" labels: @@ -8,9 +8,11 @@ metadata: spec: replicas: 1 selector: - app: resultsdb-ci-listener + matchLabels: + app: resultsdb-ci-listener strategy: - type: Rolling + type: RollingUpdate + rollingUpdate: {} template: metadata: labels: @@ -57,5 +59,3 @@ spec: - name: fedora-messaging-key-volume secret: secretName: resultsdb-ci-listener-fedora-messaging-key - triggers: - - type: ConfigChange diff --git a/roles/openshift-apps/resultsdb/templates/backend/deploymentconfigs.yml.j2 b/roles/openshift-apps/resultsdb/templates/backend/deployment.yml.j2 similarity index 84% rename from roles/openshift-apps/resultsdb/templates/backend/deploymentconfigs.yml.j2 rename to roles/openshift-apps/resultsdb/templates/backend/deployment.yml.j2 index a79576f8d3..ebcf6749f2 100644 --- a/roles/openshift-apps/resultsdb/templates/backend/deploymentconfigs.yml.j2 +++ b/roles/openshift-apps/resultsdb/templates/backend/deployment.yml.j2 @@ -1,6 +1,6 @@ --- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: name: "resultsdb-api" labels: @@ -9,15 +9,23 @@ metadata: spec: replicas: 2 selector: - app: resultsdb - service: api + matchLabels: + app: resultsdb + service: api strategy: - type: Rolling - rollingParams: - pre: - failurePolicy: Abort - execNewPod: - containerName: api + type: RollingUpdate + rollingUpdate: {} + template: + metadata: + labels: + service: api + app: resultsdb + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"resultsdb-api:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"api\")].image"}]' + spec: + initContainers: + - name: db-init + image: resultsdb-api command: - /bin/sh - -i @@ -37,15 +45,13 @@ spec: fi done exit 1 - volumes: - - config-volume - - httpd-config-volume - template: - metadata: - labels: - service: api - app: resultsdb - spec: + volumeMounts: + - name: config-volume + mountPath: /etc/resultsdb + readOnly: true + - name: httpd-config-volume + mountPath: /etc/httpd/conf.d + readOnly: true containers: - name: api image: resultsdb-api @@ -135,13 +141,3 @@ spec: - name: fedora-messaging-key-volume secret: secretName: resultsdb-fedora-messaging-key - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - api - from: - kind: ImageStreamTag - name: resultsdb-api:latest diff --git a/roles/openshift-apps/resultsdb/templates/frontend/deploymentconfigs.yml.j2 b/roles/openshift-apps/resultsdb/templates/frontend/deployment.yml.j2 similarity index 84% rename from roles/openshift-apps/resultsdb/templates/frontend/deploymentconfigs.yml.j2 rename to roles/openshift-apps/resultsdb/templates/frontend/deployment.yml.j2 index b796855ada..aed4e1d263 100644 --- a/roles/openshift-apps/resultsdb/templates/frontend/deploymentconfigs.yml.j2 +++ b/roles/openshift-apps/resultsdb/templates/frontend/deployment.yml.j2 @@ -1,6 +1,6 @@ --- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: name: "resultsdb-frontend" labels: @@ -9,10 +9,12 @@ metadata: spec: replicas: 2 selector: - app: resultsdb - service: web + matchLabels: + app: resultsdb + service: web strategy: - type: Rolling + type: RollingUpdate + rollingUpdate: {} template: metadata: labels: @@ -68,9 +70,6 @@ spec: path: /results?limit=0 port: 5002 - # Limit to 384MB memory. This is probably *not* enough but it is - # necessary in the current environment to allow for 2 replicas and - # rolling updates, without hitting the (very aggressive) memory quota. resources: limits: memory: 384Mi @@ -82,5 +81,3 @@ spec: - name: httpd-config-volume configMap: name: "resultsdb-frontend-httpd-config" - triggers: - - type: ConfigChange From b173990a47b8317e2b4990c0cf3e9b52ffa1cdd2 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Wed, 6 May 2026 13:49:13 -0700 Subject: [PATCH 033/269] resultsdb: specify correct registry to get image from Signed-off-by: Kevin Fenzi --- .../resultsdb/templates/backend/deployment.yml.j2 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/openshift-apps/resultsdb/templates/backend/deployment.yml.j2 b/roles/openshift-apps/resultsdb/templates/backend/deployment.yml.j2 index ebcf6749f2..17da418c61 100644 --- a/roles/openshift-apps/resultsdb/templates/backend/deployment.yml.j2 +++ b/roles/openshift-apps/resultsdb/templates/backend/deployment.yml.j2 @@ -25,7 +25,7 @@ spec: spec: initContainers: - name: db-init - image: resultsdb-api + image: image-registry.openshift-image-registry.svc:5000/resultsdb/resultsdb-api command: - /bin/sh - -i @@ -54,7 +54,7 @@ spec: readOnly: true containers: - name: api - image: resultsdb-api + image: image-registry.openshift-image-registry.svc:5000/resultsdb/resultsdb-api imagePullPolicy: Always env: - name: RESULTSDB_WSGI_SCRIPT_PATH From 9af0fa359e33a546e861ee177252bf9c0b9cca4a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20Such=C3=BD?= Date: Thu, 7 May 2026 10:09:10 +0200 Subject: [PATCH 034/269] copr: more packages to powerful builder --- roles/copr/frontend/templates/copr.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/copr/frontend/templates/copr.conf b/roles/copr/frontend/templates/copr.conf index 7fbca8005f..edf83f86aa 100644 --- a/roles/copr/frontend/templates/copr.conf +++ b/roles/copr/frontend/templates/copr.conf @@ -290,7 +290,7 @@ EXTRA_BUILDCHROOT_TAGS = [{ "tags": ["on_demand_powerful"], },{ # packages that always takes time to build - "pattern": ".*/.*/.*/(firefox|thunderbird|pytorch|llvm)$", + "pattern": ".*/.*/.*/(firefox|thunderbird|pytorch|llvm|gcc|kernel)$", "tags": ["on_demand_powerful"], }] {% endif %} From 1d53d6dd5afc3ac5ecaa8707776833a43957cdb8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20Such=C3=BD?= Date: Thu, 7 May 2026 10:22:28 +0200 Subject: [PATCH 035/269] copr: do the powerful builds only for selected arches --- roles/copr/frontend/templates/copr.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/copr/frontend/templates/copr.conf b/roles/copr/frontend/templates/copr.conf index edf83f86aa..b1e25a51f3 100644 --- a/roles/copr/frontend/templates/copr.conf +++ b/roles/copr/frontend/templates/copr.conf @@ -290,7 +290,7 @@ EXTRA_BUILDCHROOT_TAGS = [{ "tags": ["on_demand_powerful"], },{ # packages that always takes time to build - "pattern": ".*/.*/.*/(firefox|thunderbird|pytorch|llvm|gcc|kernel)$", + "pattern": ".*/.*/.*(x86_64|aarch64|ppc64le)/(firefox|thunderbird|pytorch|llvm|gcc|kernel)$", "tags": ["on_demand_powerful"], }] {% endif %} From 51e4282ff75961f2bef5eabcc135bf25bf63ea9b Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Thu, 7 May 2026 13:53:13 +0100 Subject: [PATCH 036/269] Migrate http-* proxy checks from Nagios to Zabbix Signed-off-by: Greg Sutcliffe --- roles/httpd/proxy/files/zabbix-template.yml | 189 ++++++++++++++++++ .../files/nagios/services/ssl.cfg | 7 - .../templates/nagios/services/websites.cfg.j2 | 57 +----- 3 files changed, 190 insertions(+), 63 deletions(-) diff --git a/roles/httpd/proxy/files/zabbix-template.yml b/roles/httpd/proxy/files/zabbix-template.yml index 9f9b9a79c6..b75a93a35f 100644 --- a/roles/httpd/proxy/files/zabbix-template.yml +++ b/roles/httpd/proxy/files/zabbix-template.yml @@ -29,6 +29,69 @@ zabbix_export: expression: 'now() - last(/Proxy HTTPd checks/vfs.file.time[/etc/httpd/ticketkey.tkey,modify]) > 7200' name: 'TicketKey age is more than two hours' priority: AVERAGE + - uuid: 9047878841c3403ebfd1352424ca96d7 + name: http-accounts + type: ZABBIX_ACTIVE + key: 'web.page.regexp[https://accounts.fedoraproject.org/healthz/ready,,,OK]' + delay: 5m + value_type: CHAR + trends: '0' + timeout: 6s + tags: + - tag: component + value: infra + triggers: + - uuid: 8830fee0972e42b0874bd1301c84bc58 + expression: 'last(/Proxy HTTPd checks/web.page.regexp[https://accounts.fedoraproject.org/healthz/ready,,,OK])<>"OK"' + name: 'http-accounts connection failed' + priority: AVERAGE + tags: + - tag: scope + value: availability + - tag: scope + value: connectivity + - uuid: facba1ec8a224d728f329e7cef2e3fa2 + name: http-bodhi + type: ZABBIX_ACTIVE + key: 'web.page.regexp[https://bodhi.fedoraproject.org/,,,Active Testers]' + delay: 5m + value_type: CHAR + trends: '0' + timeout: 10s + tags: + - tag: component + value: infra + triggers: + - uuid: 777798b8704c4eb8a9a90d8b0054a900 + expression: 'last(/Proxy HTTPd checks/web.page.regexp[https://bodhi.fedoraproject.org/,,,Active Testers])<>"Active Testers"' + name: 'http-bodhi connection failed' + priority: AVERAGE + tags: + - tag: scope + value: availability + - tag: scope + value: connectivity + - uuid: 4edb5b8c43484515b525c3653da78fd6 + name: http-docs.fedoraproject.org + type: ZABBIX_ACTIVE + key: 'web.page.regexp[https://docs.fedoraproject.org/en-US/docs/index.html,,,Antora]' + delay: 5m + value_type: CHAR + trends: '0' + timeout: 6s + tags: + - tag: component + value: infra + triggers: + - uuid: d2111d480e404b349f14f400ff2a693a + expression: 'last(/Proxy HTTPd checks/web.page.regexp[https://docs.fedoraproject.org/en-US/docs/index.html,,,Antora])<>"Antora"' + name: 'http-docs.fedoraproject.org connection failed' + priority: AVERAGE + tags: + - tag: scope + value: availability + - tag: scope + value: connectivity - uuid: 80960b21fa7146538d6ddd9a2ec78e84 name: http-fedoraproject.org type: ZABBIX_ACTIVE @@ -113,6 +176,111 @@ zabbix_export: value: availability - tag: scope value: connectivity + - uuid: 81fe4d1f57d24fbab33de37e21b45cfc + name: http-greenwave + type: ZABBIX_ACTIVE + key: 'web.page.regexp[https://greenwave-web-greenwave.apps.ocp.fedoraproject.org/api/v1.0/policies,,,bodhi_update_push_stable]' + delay: 5m + value_type: CHAR + trends: '0' + timeout: 6s + tags: + - tag: component + value: infra + triggers: + - uuid: ea8cf6f662e74b04ad0b18731bf966ef + expression: 'last(/Proxy HTTPd checks/web.page.regexp[https://greenwave-web-greenwave.apps.ocp.fedoraproject.org/api/v1.0/policies,,,bodhi_update_push_stable])<>"bodhi_update_push_stable"' + name: 'http-greenwave connection failed' + priority: AVERAGE + tags: + - tag: scope + value: availability + - tag: scope + value: connectivity + - uuid: 0979be4b524e4dd4a5735b5a7640a69c + name: http-ipsilon + type: ZABBIX_ACTIVE + key: 'web.page.regexp[https://id.fedoraproject.org/,,,your Fedora Account]' + delay: 5m + value_type: CHAR + trends: '0' + timeout: 6s + tags: + - tag: component + value: infra + triggers: + - uuid: 928062a012a54ce2b20a215c0d35e3af + expression: 'last(/Proxy HTTPd checks/web.page.regexp[https://id.fedoraproject.org/,,,your Fedora Account])<>"your Fedora Account"' + name: 'http-ipsilon connection failed' + priority: AVERAGE + tags: + - tag: scope + value: availability + - tag: scope + value: connectivity + - uuid: bffc1489f8014272963b30f258082960 + name: http-koschei + type: ZABBIX_ACTIVE + key: 'web.page.regexp[https://koschei.fedoraproject.org/,,,Package summary]' + delay: 5m + value_type: CHAR + trends: '0' + timeout: 6s + tags: + - tag: component + value: infra + triggers: + - uuid: ebe02ba799684a2aa1e9948d1b56bd68 + expression: 'last(/Proxy HTTPd checks/web.page.regexp[https://koschei.fedoraproject.org/,,,Package summary])<>"Package summary"' + name: 'http-koschei connection failed' + priority: AVERAGE + tags: + - tag: scope + value: availability + - tag: scope + value: connectivity + - uuid: 3434b19611b74ce49dbb4ebbae0e71a9 + name: http-mirrorlist + type: ZABBIX_ACTIVE + key: 'web.page.regexp[https://mirrors.fedoraproject.org/mirrorlist?repo=rawhide&arch=x86_64&country=global,,,development]' + delay: 5m + value_type: CHAR + trends: '0' + timeout: 6s + tags: + - tag: component + value: infra + triggers: + - uuid: 0d99a7de0ca94563b556cfc08eb39702 + expression: 'last(/Proxy HTTPd checks/web.page.regexp[https://mirrors.fedoraproject.org/mirrorlist?repo=rawhide&arch=x86_64&country=global,,,development])<>"development"' + name: 'http-mirrorlist connection failed' + priority: AVERAGE + tags: + - tag: scope + value: availability + - tag: scope + value: connectivity + - uuid: f3b7373f76f5430f817532aa33104387 + name: http-moby-regsitry + type: ZABBIX_ACTIVE + key: 'web.page.regexp[https://registry.fedoraproject.org/v2/,,,{}]' + delay: 5m + value_type: CHAR + trends: '0' + timeout: 6s + tags: + - tag: component + value: infra + triggers: + - uuid: 09fa67873d3745268a0a3f06c9c68a02 + expression: 'last(/Proxy HTTPd checks/web.page.regexp[https://registry.fedoraproject.org/v2/,,,{}])<>"{}"' + name: 'http-moby-gresitry connection failed' + priority: AVERAGE + tags: + - tag: scope + value: availability + - tag: scope + value: connectivity - uuid: dc1cf4b6e1a643e5802428a6d37ab36c name: http-release-monitoring.org type: ZABBIX_ACTIVE @@ -134,6 +302,27 @@ zabbix_export: value: availability - tag: scope value: connectivity + - uuid: d061c00b873f4777bc4f14679366062e + name: http-waiverdb + type: ZABBIX_ACTIVE + key: 'web.page.regexp[https://waiverdb-web-waiverdb.apps.ocp.fedoraproject.org/api/v1.0/waivers/,,,first]' + delay: 5m + value_type: CHAR + trends: '0' + timeout: 6s + tags: + - tag: component + value: infra + triggers: + - uuid: aaa3e2d4fb9d41cba1f5007c9521837d + expression: 'last(/Proxy HTTPd checks/web.page.regexp[https://waiverdb-web-waiverdb.apps.ocp.fedoraproject.org/api/v1.0/waivers/,,,first])<>"first"' + name: 'http-waiverdb connection failed' + priority: AVERAGE + tags: + - tag: scope + value: availability + - tag: scope + value: connectivity tags: - tag: application value: proxies diff --git a/roles/nagios_server/files/nagios/services/ssl.cfg b/roles/nagios_server/files/nagios/services/ssl.cfg index 676492111f..a4ede04233 100644 --- a/roles/nagios_server/files/nagios/services/ssl.cfg +++ b/roles/nagios_server/files/nagios/services/ssl.cfg @@ -74,13 +74,6 @@ define service { # ocp4 cluster stg -define service { - hostgroup_name oneproxy-stg - service_description https-ocp4-stg-cert - check_command check_ssl_cert!console-openshift-console.apps.ocp.stg.fedoraproject.org!25 - use defaulttemplate -} - define service { host_name retrace.fedoraproject.org service_description http-cert-retrace.fedoraproject.org diff --git a/roles/nagios_server/templates/nagios/services/websites.cfg.j2 b/roles/nagios_server/templates/nagios/services/websites.cfg.j2 index 1a157ba035..2b7480cde6 100644 --- a/roles/nagios_server/templates/nagios/services/websites.cfg.j2 +++ b/roles/nagios_server/templates/nagios/services/websites.cfg.j2 @@ -1,10 +1,3 @@ -define service { - hostgroup_name proxies - service_description http-ipsilon - check_command check_website_ssl!id.fedoraproject.org!/!your Fedora Account - use websitetemplate -} - define service { hostgroup_name proxies service_description http-mirrors.fedoraproject.org-mirrorlist @@ -13,46 +6,6 @@ define service { servicegroups mirrorlist } -define service { - hostgroup_name proxies - service_description http-docs.fedoraproject.org - check_command check_website_ssl!docs.fedoraproject.org!/en-US/docs/index.html!Antora - use websitetemplate -} - -define service { - hostgroup_name proxies_ocp4 - service_description http-accounts - check_command check_website_ssl!accounts.fedoraproject.org!/healthz/ready!OK - use websitetemplate -# servicegroups fas -} - -define service { - hostgroup_name proxies_ocp4 - service_description http-bodhi - check_command check_website_ssl!bodhi.fedoraproject.org!/!Fedora - max_check_attempts 8 - use websitetemplate - servicegroups bodhi -} - -define service { - hostgroup_name proxies_ocp4 - service_description http-bodhi2 - check_command check_website_ssl!bodhi.fedoraproject.org!/!Active Testers - max_check_attempts 8 - use websitetemplate -} - -define service { - hostgroup_name proxies - service_description http-koschei - check_command check_website_ssl!koschei.fedoraproject.org!/!Package summary - max_check_attempts 8 - use websitetemplate -} - define service { hostgroup_name proxies service_description http-moby-registry @@ -62,7 +15,7 @@ define service { } define service { - host_name registry-cdn + host_name registry-cdn service_description http-moby-registry-cdn check_command check_website_ssl!cdn.registry.fedoraproject.org!/v2/!{} max_check_attempts 8 @@ -129,14 +82,6 @@ define service { use internalwebsitetemplate } -#define service { -# hostgroup_name fas -# service_description http-accounts -# check_command check_website!localhost!/accounts/help/get_help/user_telephone!emergency -# use internalwebsitetemplate -# servicegroups fas -#} - define service { hostgroup_name ipa service_description http-ipa-internal From c8abf8630eb9cab460fa6ef41931f7c13946ca6e Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Thu, 7 May 2026 14:21:51 +0100 Subject: [PATCH 037/269] Zabbix: move more http-* checks Signed-off-by: Greg Sutcliffe --- .../templates/nagios/services/websites.cfg.j2 | 34 ------------------- 1 file changed, 34 deletions(-) diff --git a/roles/nagios_server/templates/nagios/services/websites.cfg.j2 b/roles/nagios_server/templates/nagios/services/websites.cfg.j2 index 2b7480cde6..c9626b778a 100644 --- a/roles/nagios_server/templates/nagios/services/websites.cfg.j2 +++ b/roles/nagios_server/templates/nagios/services/websites.cfg.j2 @@ -1,19 +1,3 @@ -define service { - hostgroup_name proxies - service_description http-mirrors.fedoraproject.org-mirrorlist - check_command check_website!mirrors.fedoraproject.org!/mirrorlist?repo=rawhide&arch=x86_64&country=global!development - use websitetemplate - servicegroups mirrorlist -} - -define service { - hostgroup_name proxies - service_description http-moby-registry - check_command check_website_ssl!registry.fedoraproject.org!/v2/!{} - max_check_attempts 8 - use websitetemplate -} - define service { host_name registry-cdn service_description http-moby-registry-cdn @@ -36,24 +20,6 @@ define service { use websitetemplate } -# Some openshift apps -define service { - hostgroup_name proxies - service_description http-waiverdb - check_command check_website_ssl!waiverdb-web-waiverdb.apps.ocp.fedoraproject.org!/api/v1.0/waivers/!first - max_check_attempts 8 - use websitetemplate -} - -define service { - hostgroup_name proxies - service_description http-greenwave - check_command check_website_ssl!greenwave-web-greenwave.apps.ocp.fedoraproject.org!/api/v1.0/policies!bodhi_update_push_stable - max_check_attempts 8 - use websitetemplate -} - -## ## Individual hosts define service { From 5d88d1abb3c6bc8be672f2a6219fd67e9b9a2d27 Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Thu, 7 May 2026 14:54:15 +0100 Subject: [PATCH 038/269] Nagios: remove Varnish/HAProxy items, these are already in Zabbix Signed-off-by: Greg Sutcliffe --- roles/nagios_server/files/nagios/services/haproxy.cfg | 6 ------ roles/nagios_server/files/nagios/services/procs.cfg | 7 ------- roles/nagios_server/tasks/main.yml | 1 - 3 files changed, 14 deletions(-) delete mode 100644 roles/nagios_server/files/nagios/services/haproxy.cfg diff --git a/roles/nagios_server/files/nagios/services/haproxy.cfg b/roles/nagios_server/files/nagios/services/haproxy.cfg deleted file mode 100644 index d4e87d0314..0000000000 --- a/roles/nagios_server/files/nagios/services/haproxy.cfg +++ /dev/null @@ -1,6 +0,0 @@ -define service { - hostgroup_name proxies - service_description Check proxies for oversubscription - check_command check_by_nrpe!check_haproxy_conns - use defaulttemplate -} diff --git a/roles/nagios_server/files/nagios/services/procs.cfg b/roles/nagios_server/files/nagios/services/procs.cfg index c58c106347..7c4a867649 100644 --- a/roles/nagios_server/files/nagios/services/procs.cfg +++ b/roles/nagios_server/files/nagios/services/procs.cfg @@ -1,10 +1,3 @@ -define service { - hostgroup proxies - service_description Varnish Process - check_command check_by_nrpe!check_varnish_proc - use defaulttemplate -} - define service { hostgroup sign_bridge service_description Sigul bridge Process diff --git a/roles/nagios_server/tasks/main.yml b/roles/nagios_server/tasks/main.yml index b91c26fd47..6200f8adf0 100644 --- a/roles/nagios_server/tasks/main.yml +++ b/roles/nagios_server/tasks/main.yml @@ -224,7 +224,6 @@ with_items: - copr.cfg - dns.cfg - - haproxy.cfg - memcached.cfg - nagios.cfg - pagure_redis.cfg From 20428c57eefa3581e97591e6939fbb02d509bafa Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Thu, 7 May 2026 15:47:10 -0700 Subject: [PATCH 039/269] certgetter01: move to fedora 44 Signed-off-by: Kevin Fenzi --- inventory/host_vars/certgetter01.rdu3.fedoraproject.org | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/inventory/host_vars/certgetter01.rdu3.fedoraproject.org b/inventory/host_vars/certgetter01.rdu3.fedoraproject.org index 479af39f2a..ca639e6cda 100644 --- a/inventory/host_vars/certgetter01.rdu3.fedoraproject.org +++ b/inventory/host_vars/certgetter01.rdu3.fedoraproject.org @@ -2,7 +2,7 @@ datacenter: rdu3 eth0_ipv4_gw: 10.16.163.254 eth0_ipv4_ip: 10.16.163.47 -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/42/Server/x86_64/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/x86_64/os/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora mem_size: 4096 vmhost: vmhost-x86-04.rdu3.fedoraproject.org From ac4774b57ed44b13e08ad3c3f298bf3c93d2e336 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Thu, 7 May 2026 15:58:13 -0700 Subject: [PATCH 040/269] ipsilon01.stg: move to fedora 44 Signed-off-by: Kevin Fenzi --- inventory/host_vars/ipsilon01.stg.rdu3.fedoraproject.org | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/inventory/host_vars/ipsilon01.stg.rdu3.fedoraproject.org b/inventory/host_vars/ipsilon01.stg.rdu3.fedoraproject.org index 6b94e08708..88838083ad 100644 --- a/inventory/host_vars/ipsilon01.stg.rdu3.fedoraproject.org +++ b/inventory/host_vars/ipsilon01.stg.rdu3.fedoraproject.org @@ -2,7 +2,7 @@ datacenter: rdu3 eth0_ipv4_gw: 10.16.166.254 eth0_ipv4_ip: 10.16.166.30 -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/42/Server/x86_64/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/x86_64/os/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora vmhost: vmhost-x86-04.stg.rdu3.fedoraproject.org volgroup: /dev/vg_guests From 8ede1564c821e8f19cb60410c9ce5ff5f864d6ac Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 8 May 2026 10:13:03 -0700 Subject: [PATCH 041/269] smtp-mm: add a fedoraproject transport to use the vpn Signed-off-by: Kevin Fenzi --- roles/base/files/postfix/transports.smtp-mm | 1 + 1 file changed, 1 insertion(+) diff --git a/roles/base/files/postfix/transports.smtp-mm b/roles/base/files/postfix/transports.smtp-mm index 8c6dd42673..6e5ee11e4a 100644 --- a/roles/base/files/postfix/transports.smtp-mm +++ b/roles/base/files/postfix/transports.smtp-mm @@ -4,6 +4,7 @@ redhat.com smtp:[mailman01.vpn.fedoraproject.org] lists2.fedoraproject.org smtp:[mailman01.vpn.fedoraproject.org] lists.pagure.io smtp:[mailman01.vpn.fedoraproject.org] fedorahosted.org smtp:[bastion.vpn.fedoraproject.org] +fedoraproject.org smtp:[bastion.vpn.fedoraproject.org] lists.stg.fedoraproject.org smtp:[bastion.vpn.fedoraproject.org] lists.stg.fedorahosted.org smtp:[bastion.vpn.fedoraproject.org] From 511f16d9d646249b2c4b3300d699c2269d3bf8cf Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 8 May 2026 10:22:29 -0700 Subject: [PATCH 042/269] base / postfix: fix handlers for postfix maps to use lmdb Signed-off-by: Kevin Fenzi --- handlers/restart_services.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/handlers/restart_services.yml b/handlers/restart_services.yml index 47bf9ebc04..73ef1bb14a 100644 --- a/handlers/restart_services.yml +++ b/handlers/restart_services.yml @@ -80,13 +80,13 @@ action: service name=network state=restarted - name: Rebuild postfix transport - ansible.builtin.command: /usr/sbin/postmap /etc/postfix/transport + ansible.builtin.command: /usr/sbin/postmap lmdb:/etc/postfix/transport - name: Rebuild postfix bysender - ansible.builtin.command: /usr/sbin/postmap /etc/postfix/bysender + ansible.builtin.command: /usr/sbin/postmap lmdb:/etc/postfix/bysender - name: Rebuild postfix tls_policy - ansible.builtin.command: /usr/sbin/postmap /etc/postfix/tls_policy + ansible.builtin.command: /usr/sbin/postmap lmdb:/etc/postfix/tls_policy - name: Restart postfix service: name=postfix state=restarted From ef1592400d5cd7297bb5d73db7979a14c3527e54 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 8 May 2026 10:38:09 -0700 Subject: [PATCH 043/269] packager_alias: use lmdb for aliases Signed-off-by: Kevin Fenzi --- roles/packager_alias/files/package-owner-aliases.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/packager_alias/files/package-owner-aliases.sh b/roles/packager_alias/files/package-owner-aliases.sh index 9c62527bf7..0ae6a9bbcb 100755 --- a/roles/packager_alias/files/package-owner-aliases.sh +++ b/roles/packager_alias/files/package-owner-aliases.sh @@ -16,10 +16,10 @@ cp $output $dest chmod +r $output mv $output $dest /usr/sbin/restorecon /etc/postfix/package-owner -/usr/sbin/postalias /etc/postfix/package-owner +/usr/sbin/postalias lmdb:/etc/postfix/package-owner cp $moutput $mdest chmod +r $moutput mv $moutput $mdest /usr/sbin/restorecon /etc/postfix/package-maintainers -/usr/sbin/postalias /etc/postfix/package-maintainers +/usr/sbin/postalias lmdb:/etc/postfix/package-maintainers From ec0c9ed2206292139671f20f7ced33386d94e584 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 8 May 2026 10:56:17 -0700 Subject: [PATCH 044/269] pkgs: allow access to archive of git repos fixed for fsck issues See https://forge.fedoraproject.org/releng/tickets/issues/11822 for background Signed-off-by: Kevin Fenzi --- roles/distgit/pagure/files/pagure_cron.conf | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/roles/distgit/pagure/files/pagure_cron.conf b/roles/distgit/pagure/files/pagure_cron.conf index 361a68748a..cddf1b6dfd 100644 --- a/roles/distgit/pagure/files/pagure_cron.conf +++ b/roles/distgit/pagure/files/pagure_cron.conf @@ -5,3 +5,10 @@ Alias /extras /srv/cache/extras Require all granted +Alias /git-fsck-failing-repos-archive /srv/cache/git-fsck-failing-repos-archive + + Options Indexes FollowSymLinks + AllowOverride None + Require all granted + + From 72f01c98a78d5cd088af75a6af089a8ad63d1f2e Mon Sep 17 00:00:00 2001 From: Stephen Gallagher Date: Fri, 8 May 2026 11:27:43 -0400 Subject: [PATCH 045/269] amqp: Add queue for ELN->CS sync This will be used for setting up automatic syncing of ELN builds into CentOS Stream. Fixes: https://forge.fedoraproject.org/infra/tickets/issues/13226 Signed-off-by: Stephen Gallagher --- roles/rabbitmq_cluster/tasks/apps.yml | 34 +++++++++++++-------------- 1 file changed, 16 insertions(+), 18 deletions(-) diff --git a/roles/rabbitmq_cluster/tasks/apps.yml b/roles/rabbitmq_cluster/tasks/apps.yml index bf0a0b8fc1..c03fa1e9bd 100644 --- a/roles/rabbitmq_cluster/tasks/apps.yml +++ b/roles/rabbitmq_cluster/tasks/apps.yml @@ -161,24 +161,22 @@ # ELN END -# ELN CS BEGIN -# -# - name: Eln cs queue -# run_once: true -# include_role: -# name: rabbit/queue -# vars: -# queue_username: distrobuildsync-cs -# user_sent_topics: ^$ -# queue_name: distrobuildsync-cs -# # TTL: 10 days (in miliseconds) -# queue_message_ttl: 864000000 -# queue_routing_keys: -# - "#.buildsys.repo.init" -# - "#.buildsys.repo.done" -# - "#.buildsys.tag" -# -# ELN END +# ELN-CentOS Stream Syncing BEGIN + +- name: ELN-CS Sync queue + run_once: true + include_role: + name: rabbit/queue + vars: + queue_username: eln-cxs-sync + user_sent_topics: ^$ + queue_name: eln-cxs-sync + # TTL: 10 days (in miliseconds) + queue_message_ttl: 864000000 + queue_routing_keys: + - "#.buildsys.tag" + +# ELN-CentOS Stream Syncing END - name: LogDetective - Packit run_once: true From 2dc6e6ec68dcf1e81bf53a51c12b7cf1caa66506 Mon Sep 17 00:00:00 2001 From: Mattia Verga Date: Mon, 6 Apr 2026 11:29:59 +0200 Subject: [PATCH 046/269] bodhi-stg: add a valkey pod Signed-off-by: Mattia Verga --- roles/openshift-apps/bodhi/files/service.yml | 2 + .../bodhi/templates/buildconfig.yml.j2 | 22 +++++ .../bodhi/templates/deployment.yml.j2 | 87 +++++++++++++++++++ .../bodhi/templates/dockerfile-valkey | 33 +++++++ .../templates/valkey-docker-entrypoint.sh | 19 ++++ 5 files changed, 163 insertions(+) create mode 100644 roles/openshift-apps/bodhi/templates/dockerfile-valkey create mode 100644 roles/openshift-apps/bodhi/templates/valkey-docker-entrypoint.sh diff --git a/roles/openshift-apps/bodhi/files/service.yml b/roles/openshift-apps/bodhi/files/service.yml index e44d011aca..b1af97cc6f 100644 --- a/roles/openshift-apps/bodhi/files/service.yml +++ b/roles/openshift-apps/bodhi/files/service.yml @@ -13,3 +13,5 @@ spec: targetPort: 8080 selector: app: bodhi-web +# bodhi-valkey service is configured in deployment_yml.j2 +# because it exists only for staging, at the moment diff --git a/roles/openshift-apps/bodhi/templates/buildconfig.yml.j2 b/roles/openshift-apps/bodhi/templates/buildconfig.yml.j2 index 2bb0f66498..4da72744d5 100644 --- a/roles/openshift-apps/bodhi/templates/buildconfig.yml.j2 +++ b/roles/openshift-apps/bodhi/templates/buildconfig.yml.j2 @@ -49,5 +49,27 @@ items: to: kind: ImageStreamTag name: bodhi-critpathcron:latest +{% if env == "staging" %} +- apiVersion: build.openshift.io/v1 + kind: BuildConfig + metadata: + labels: + build: bodhi-valkey + name: bodhi-valkey + spec: + runPolicy: Serial + source: + dockerfile: |- + {{ load_file('dockerfile-valkey') | indent(8) }} + type: Dockerfile + strategy: + type: Docker + dockerStrategy: + noCache: True + output: + to: + kind: ImageStreamTag + name: bodhi-valkey:latest +{% endif %} kind: List metadata: {} diff --git a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 index 9487ebeafd..9344f7dde5 100644 --- a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 +++ b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 @@ -34,6 +34,17 @@ spec: - name: config-volume mountPath: /etc/bodhi readOnly: true +{% if env == "staging" %} + - name: wait-for-valkey + image: image-registry.openshift-image-registry.svc:5000/bodhi/bodhi-valkey:latest + command: ['/bin/sh', '-c', 'until valkey-cli -h bodhi-valkey -p 6379 -a "$BODHI_VALKEY_PASSWORD" ping; do echo "Waiting for Valkey..."; sleep 2; done'] + env: + - name: BODHI_VALKEY_PASSWORD + valueFrom: + secretKeyRef: + name: bodhi-valkey-secret + key: password +{% endif %} containers: - name: bodhi-web image: image-registry.openshift-image-registry.svc:5000/bodhi/bodhi-base:latest @@ -348,3 +359,79 @@ spec: - name: fedora-messaging-key-volume secret: secretName: bodhi-fedora-messaging-key +{% if env == "staging" %} +--- +# bodhi-valkey +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: bodhi-valkey + name: bodhi-valkey +spec: + replicas: 1 + selector: + matchLabels: + app: bodhi-valkey + strategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 25% + maxUnavailable: 25% + template: + metadata: + labels: + app: bodhi-valkey + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-valkey:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-valkey\")].image"}]' + spec: + containers: + - name: bodhi-valkey + image: image-registry.openshift-image-registry.svc:5000/bodhi/bodhi-valkey:latest + env: + - name: BODHI_VALKEY_PASSWORD + valueFrom: + secretKeyRef: + name: bodhi-valkey-secret + key: password + resources: {} + volumeMounts: + - name: bodhi-valkey-data-volume + mountPath: /data + ports: + - containerPort: 6379 + protocol: TCP + readinessProbe: + timeoutSeconds: 10 + initialDelaySeconds: 5 + periodSeconds: 60 + exec: + command: ['/bin/sh', '-c', 'valkey-cli -a "$BODHI_VALKEY_PASSWORD" ping'] + livenessProbe: + timeoutSeconds: 60 + initialDelaySeconds: 30 + periodSeconds: 120 + failureThreshold: 5 + exec: + command: ['/bin/sh', '-c', 'valkey-cli -a "$BODHI_VALKEY_PASSWORD" ping'] + volumes: + - name: bodhi-valkey-data-volume + persistentVolumeClaim: + claimName: "bodhi-valkey-storage{{ '-stg' if env == 'staging' else '' }}" +--- +# bodhi-valkey Service +apiVersion: v1 +kind: Service +metadata: + name: bodhi-valkey + labels: + app: bodhi-valkey +spec: + selector: + app: bodhi-valkey + ports: + - port: 6379 + targetPort: 6379 + protocol: TCP + type: ClusterIP +{% endif %} diff --git a/roles/openshift-apps/bodhi/templates/dockerfile-valkey b/roles/openshift-apps/bodhi/templates/dockerfile-valkey new file mode 100644 index 0000000000..aa9c793e36 --- /dev/null +++ b/roles/openshift-apps/bodhi/templates/dockerfile-valkey @@ -0,0 +1,33 @@ +{% if env == "staging" %} +FROM fedora:43 +{% else %} +FROM fedora:43 +{% endif %} + +LABEL \ + name="bodhi-valkey" \ + vendor="Fedora Infrastructure" \ + license="MIT" + +{% if env == "staging" %} +RUN curl -o /etc/yum.repos.d/infra-tags.repo https://infrastructure.fedoraproject.org/infra/ansible/files/common/fedora-infra-tags.repo +RUN curl -o /etc/yum.repos.d/infra-tags-stg.repo https://infrastructure.fedoraproject.org/infra/ansible/files/common/fedora-infra-tags-stg.repo +{% else %} +RUN curl -o /etc/yum.repos.d/infra-tags.repo https://infrastructure.fedoraproject.org/infra/ansible/files/common/fedora-infra-tags.repo +{% endif %} + +RUN dnf -y update && dnf install -y valkey && dnf clean all + +RUN chmod 0770 /etc/valkey +RUN mkdir /run/valkey && chown valkey:valkey /run/valkey + +RUN mkdir -m 0770 /data && chown valkey:0 /data +VOLUME /data +WORKDIR /data + +COPY valkey-docker-entrypoint.sh /usr/local/bin/ +ENTRYPOINT ["/usr/local/bin/valkey-docker-entrypoint.sh"] + +USER valkey +EXPOSE 6379 +CMD ["valkey-server"] diff --git a/roles/openshift-apps/bodhi/templates/valkey-docker-entrypoint.sh b/roles/openshift-apps/bodhi/templates/valkey-docker-entrypoint.sh new file mode 100644 index 0000000000..02dfb60ca5 --- /dev/null +++ b/roles/openshift-apps/bodhi/templates/valkey-docker-entrypoint.sh @@ -0,0 +1,19 @@ +#!/bin/sh + +cat /etc/valkey/valkey.conf | \ + sed \ + -e 's@^dir .*@dir /data@' \ + -e 's@^logfile .*@logfile ""@' \ + -e 's@^bind @# bind @' \ + > /etc/valkey/valkey-docker.conf + +if [ "${BODHI_VALKEY_PASSWORD+set}" = "set" ] ; then + echo "requirepass ${BODHI_VALKEY_PASSWORD}" >> /etc/valkey/valkey-docker.conf +fi + +if [ "$1" = "valkey-server" ] ; then + shift + set -- valkey-server /etc/valkey/valkey-docker.conf "$@" +fi + +exec "$@" From 5278566736b2bcdfe3eb38488da29e5d06c3c852 Mon Sep 17 00:00:00 2001 From: Mattia Verga Date: Sun, 10 May 2026 09:27:57 +0200 Subject: [PATCH 047/269] bodhi-stg: define bodhi-valkey image stream Signed-off-by: Mattia Verga --- .../bodhi/templates/imagestreams-tagged.yml.j2 | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/roles/openshift-apps/bodhi/templates/imagestreams-tagged.yml.j2 b/roles/openshift-apps/bodhi/templates/imagestreams-tagged.yml.j2 index 3826fc64a2..12b8053e56 100644 --- a/roles/openshift-apps/bodhi/templates/imagestreams-tagged.yml.j2 +++ b/roles/openshift-apps/bodhi/templates/imagestreams-tagged.yml.j2 @@ -22,3 +22,14 @@ items: name: staging referencePolicy: type: Source +{% if env == "staging" %} +- apiVersion: image.openshift.io/v1 + kind: ImageStream + metadata: + name: bodhi-valkey + labels: + build: bodhi-valkey + spec: + lookupPolicy: + local: false +{% endif %} From a58b8699eaafec48a88a061d7f2feabda84bde99 Mon Sep 17 00:00:00 2001 From: Mattia Verga Date: Sun, 10 May 2026 09:52:31 +0200 Subject: [PATCH 048/269] bodhi-stg: remove docker entrypoint Signed-off-by: Mattia Verga AI-assisted-by: Claude (Anthropic) --- .../bodhi/templates/deployment.yml.j2 | 2 ++ .../bodhi/templates/dockerfile-valkey | 5 +---- .../templates/valkey-docker-entrypoint.sh | 19 ------------------- 3 files changed, 3 insertions(+), 23 deletions(-) delete mode 100644 roles/openshift-apps/bodhi/templates/valkey-docker-entrypoint.sh diff --git a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 index 9344f7dde5..5e19af8f06 100644 --- a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 +++ b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 @@ -388,6 +388,8 @@ spec: containers: - name: bodhi-valkey image: image-registry.openshift-image-registry.svc:5000/bodhi/bodhi-valkey:latest + command: ["valkey-server"] + args: ["/etc/valkey/valkey.conf", "--requirepass", "$(BODHI_VALKEY_PASSWORD)"] env: - name: BODHI_VALKEY_PASSWORD valueFrom: diff --git a/roles/openshift-apps/bodhi/templates/dockerfile-valkey b/roles/openshift-apps/bodhi/templates/dockerfile-valkey index aa9c793e36..df51e2fdf2 100644 --- a/roles/openshift-apps/bodhi/templates/dockerfile-valkey +++ b/roles/openshift-apps/bodhi/templates/dockerfile-valkey @@ -25,9 +25,6 @@ RUN mkdir -m 0770 /data && chown valkey:0 /data VOLUME /data WORKDIR /data -COPY valkey-docker-entrypoint.sh /usr/local/bin/ -ENTRYPOINT ["/usr/local/bin/valkey-docker-entrypoint.sh"] - USER valkey EXPOSE 6379 -CMD ["valkey-server"] +CMD ["valkey-server", "/etc/valkey/valkey.conf"] diff --git a/roles/openshift-apps/bodhi/templates/valkey-docker-entrypoint.sh b/roles/openshift-apps/bodhi/templates/valkey-docker-entrypoint.sh deleted file mode 100644 index 02dfb60ca5..0000000000 --- a/roles/openshift-apps/bodhi/templates/valkey-docker-entrypoint.sh +++ /dev/null @@ -1,19 +0,0 @@ -#!/bin/sh - -cat /etc/valkey/valkey.conf | \ - sed \ - -e 's@^dir .*@dir /data@' \ - -e 's@^logfile .*@logfile ""@' \ - -e 's@^bind @# bind @' \ - > /etc/valkey/valkey-docker.conf - -if [ "${BODHI_VALKEY_PASSWORD+set}" = "set" ] ; then - echo "requirepass ${BODHI_VALKEY_PASSWORD}" >> /etc/valkey/valkey-docker.conf -fi - -if [ "$1" = "valkey-server" ] ; then - shift - set -- valkey-server /etc/valkey/valkey-docker.conf "$@" -fi - -exec "$@" From 06fc965500b8bcf32ef026f3eefbb8ffb2ab7099 Mon Sep 17 00:00:00 2001 From: Mattia Verga Date: Sun, 10 May 2026 10:18:34 +0200 Subject: [PATCH 049/269] bodhi-stg: define bodhi-valkey-storage pvc Signed-off-by: Mattia Verga AI-assisted-by: Claude (Anthropic) --- playbooks/openshift-apps/bodhi.yml | 5 +++++ roles/openshift-apps/bodhi/templates/pvc_yml.j2 | 12 ++++++++++++ 2 files changed, 17 insertions(+) create mode 100644 roles/openshift-apps/bodhi/templates/pvc_yml.j2 diff --git a/playbooks/openshift-apps/bodhi.yml b/playbooks/openshift-apps/bodhi.yml index d49366cf05..0deba583fd 100644 --- a/playbooks/openshift-apps/bodhi.yml +++ b/playbooks/openshift-apps/bodhi.yml @@ -73,6 +73,11 @@ object_app: bodhi object_file: pvc.yml object_objectname: pvc.yml + - role: openshift/object + object_app: bodhi + object_template: pvc.yml.j2 + object_objectname: pvc-valkey.yml + when: env == "staging" - role: openshift/keytab keytab_app: bodhi keytab_key: koji-keytab diff --git a/roles/openshift-apps/bodhi/templates/pvc_yml.j2 b/roles/openshift-apps/bodhi/templates/pvc_yml.j2 new file mode 100644 index 0000000000..5c22bca00f --- /dev/null +++ b/roles/openshift-apps/bodhi/templates/pvc_yml.j2 @@ -0,0 +1,12 @@ +{% if env == "staging" %} +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: bodhi-valkey-storage-stg +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1Gi +{% endif %} From 4517eb2ed5272f5b187bf86edf32812706e8395a Mon Sep 17 00:00:00 2001 From: Mattia Verga Date: Sun, 10 May 2026 10:29:20 +0200 Subject: [PATCH 050/269] bodhi-stg: fix pvc template filename Signed-off-by: Mattia Verga --- roles/openshift-apps/bodhi/templates/{pvc_yml.j2 => pvc.yml.j2} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename roles/openshift-apps/bodhi/templates/{pvc_yml.j2 => pvc.yml.j2} (100%) diff --git a/roles/openshift-apps/bodhi/templates/pvc_yml.j2 b/roles/openshift-apps/bodhi/templates/pvc.yml.j2 similarity index 100% rename from roles/openshift-apps/bodhi/templates/pvc_yml.j2 rename to roles/openshift-apps/bodhi/templates/pvc.yml.j2 From ce9d8b38997c7599a58c8869969c4ae1b48cb2c5 Mon Sep 17 00:00:00 2001 From: Mattia Verga Date: Sun, 10 May 2026 21:13:08 +0200 Subject: [PATCH 051/269] bodhi-valkey: use fully qualified image name Signed-off-by: Mattia Verga --- roles/openshift-apps/bodhi/templates/dockerfile-valkey | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/openshift-apps/bodhi/templates/dockerfile-valkey b/roles/openshift-apps/bodhi/templates/dockerfile-valkey index df51e2fdf2..24fc416b3c 100644 --- a/roles/openshift-apps/bodhi/templates/dockerfile-valkey +++ b/roles/openshift-apps/bodhi/templates/dockerfile-valkey @@ -1,7 +1,7 @@ {% if env == "staging" %} -FROM fedora:43 +FROM quay.io/fedora/fedora:43 {% else %} -FROM fedora:43 +FROM quay.io/fedora/fedora:43 {% endif %} LABEL \ From 8c28aba425bb0360c532dd0302e5c1f42b7f6319 Mon Sep 17 00:00:00 2001 From: Akashdeep Dhar Date: Fri, 8 May 2026 09:26:29 +0530 Subject: [PATCH 052/269] mdapi: fix image trigger annote order on deploy metadata The `image.openshift.io/triggers` annotation was on the pod template metadata instead of the deployment metadata, so OpenShift's image trigger controller never detected ImageStream updates for auto-rollout. Basically, when the MDAPI playbook was re-executed after the repository `fedora-infra/ansible` was moved from Pagure to Forgejo, we have not had even a single rollout, even with all the image builds. Signed-off-by: Akashdeep Dhar --- roles/openshift-apps/mdapi/templates/deployment.yml.j2 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/openshift-apps/mdapi/templates/deployment.yml.j2 b/roles/openshift-apps/mdapi/templates/deployment.yml.j2 index 03286eb796..d94cc8185c 100644 --- a/roles/openshift-apps/mdapi/templates/deployment.yml.j2 +++ b/roles/openshift-apps/mdapi/templates/deployment.yml.j2 @@ -6,6 +6,8 @@ metadata: labels: app: mdapi service: mdapi + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"mdapi:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"mdapi\")].image"}]' spec: replicas: 1 selector: @@ -18,8 +20,6 @@ spec: labels: app: mdapi service: mdapi - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"mdapi:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"mdapi\")].image"}]' spec: containers: - name: mdapi From ec82c78f221a20c3185b74db9ea7cccb924801ed Mon Sep 17 00:00:00 2001 From: Mattia Verga Date: Mon, 11 May 2026 09:38:41 +0200 Subject: [PATCH 053/269] bodhi-stg: add secret definition Signed-off-by: Mattia Verga --- playbooks/openshift-apps/bodhi.yml | 5 +++++ .../bodhi/templates/deployment.yml.j2 | 16 ++++++++-------- .../openshift-apps/bodhi/templates/secret.yml.j2 | 7 +++++++ 3 files changed, 20 insertions(+), 8 deletions(-) create mode 100644 roles/openshift-apps/bodhi/templates/secret.yml.j2 diff --git a/playbooks/openshift-apps/bodhi.yml b/playbooks/openshift-apps/bodhi.yml index 0deba583fd..6cae605bf7 100644 --- a/playbooks/openshift-apps/bodhi.yml +++ b/playbooks/openshift-apps/bodhi.yml @@ -78,6 +78,11 @@ object_template: pvc.yml.j2 object_objectname: pvc-valkey.yml when: env == "staging" + - role: openshift/object + object_app: bodhi + object_template: secret.yml.j2 + object_objectname: secret.yml + when: env == "staging" - role: openshift/keytab keytab_app: bodhi keytab_key: koji-keytab diff --git a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 index 5e19af8f06..9400913252 100644 --- a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 +++ b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 @@ -37,12 +37,12 @@ spec: {% if env == "staging" %} - name: wait-for-valkey image: image-registry.openshift-image-registry.svc:5000/bodhi/bodhi-valkey:latest - command: ['/bin/sh', '-c', 'until valkey-cli -h bodhi-valkey -p 6379 -a "$BODHI_VALKEY_PASSWORD" ping; do echo "Waiting for Valkey..."; sleep 2; done'] + command: ['/bin/sh', '-c', 'until valkey-cli -h bodhi-valkey -p 6379 -a "$VALKEY_PASSWORD" ping; do echo "Waiting for Valkey..."; sleep 2; done'] env: - - name: BODHI_VALKEY_PASSWORD + - name: VALKEY_PASSWORD valueFrom: secretKeyRef: - name: bodhi-valkey-secret + name: valkey-secret key: password {% endif %} containers: @@ -389,12 +389,12 @@ spec: - name: bodhi-valkey image: image-registry.openshift-image-registry.svc:5000/bodhi/bodhi-valkey:latest command: ["valkey-server"] - args: ["/etc/valkey/valkey.conf", "--requirepass", "$(BODHI_VALKEY_PASSWORD)"] + args: ["/etc/valkey/valkey.conf", "--requirepass", "$(VALKEY_PASSWORD)"] env: - - name: BODHI_VALKEY_PASSWORD + - name: VALKEY_PASSWORD valueFrom: secretKeyRef: - name: bodhi-valkey-secret + name: valkey-secret key: password resources: {} volumeMounts: @@ -408,14 +408,14 @@ spec: initialDelaySeconds: 5 periodSeconds: 60 exec: - command: ['/bin/sh', '-c', 'valkey-cli -a "$BODHI_VALKEY_PASSWORD" ping'] + command: ['/bin/sh', '-c', 'valkey-cli -a "$VALKEY_PASSWORD" ping'] livenessProbe: timeoutSeconds: 60 initialDelaySeconds: 30 periodSeconds: 120 failureThreshold: 5 exec: - command: ['/bin/sh', '-c', 'valkey-cli -a "$BODHI_VALKEY_PASSWORD" ping'] + command: ['/bin/sh', '-c', 'valkey-cli -a "$VALKEY_PASSWORD" ping'] volumes: - name: bodhi-valkey-data-volume persistentVolumeClaim: diff --git a/roles/openshift-apps/bodhi/templates/secret.yml.j2 b/roles/openshift-apps/bodhi/templates/secret.yml.j2 new file mode 100644 index 0000000000..c5f17fad11 --- /dev/null +++ b/roles/openshift-apps/bodhi/templates/secret.yml.j2 @@ -0,0 +1,7 @@ +--- +kind: Secret +apiVersion: v1 +metadata: + name: valkey-secret +stringData: + password: {{ bodhi_valkey_secret }} From 6812986bef2210d533246d4e229e20272cc1e39d Mon Sep 17 00:00:00 2001 From: Mattia Verga Date: Mon, 11 May 2026 10:09:30 +0200 Subject: [PATCH 054/269] bodhi-stg: use f44 for bodhi-valkey Signed-off-by: Mattia Verga --- roles/openshift-apps/bodhi/templates/dockerfile-valkey | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/bodhi/templates/dockerfile-valkey b/roles/openshift-apps/bodhi/templates/dockerfile-valkey index 24fc416b3c..d552110377 100644 --- a/roles/openshift-apps/bodhi/templates/dockerfile-valkey +++ b/roles/openshift-apps/bodhi/templates/dockerfile-valkey @@ -1,5 +1,5 @@ {% if env == "staging" %} -FROM quay.io/fedora/fedora:43 +FROM quay.io/fedora/fedora:44 {% else %} FROM quay.io/fedora/fedora:43 {% endif %} From 6b9752397d42d982912a42f72a1a36e076d5033b Mon Sep 17 00:00:00 2001 From: Mattia Verga Date: Mon, 11 May 2026 10:13:14 +0200 Subject: [PATCH 055/269] bodhi-valkey: change liveness timeout Signed-off-by: Mattia Verga --- roles/openshift-apps/bodhi/templates/deployment.yml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 index 9400913252..e8fcf87111 100644 --- a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 +++ b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 @@ -410,7 +410,7 @@ spec: exec: command: ['/bin/sh', '-c', 'valkey-cli -a "$VALKEY_PASSWORD" ping'] livenessProbe: - timeoutSeconds: 60 + timeoutSeconds: 30 initialDelaySeconds: 30 periodSeconds: 120 failureThreshold: 5 From c6704f92dce604c97134ea8a352697e4f06d650d Mon Sep 17 00:00:00 2001 From: David Kirwan Date: Mon, 11 May 2026 12:24:18 +0100 Subject: [PATCH 056/269] communishift: added cleanup playbook cleanup-administration-delete-projects.yml Signed-off-by: David Kirwan --- .../manual/communishift_delete_projects.yml | 48 ++++ .../library/communishift_storage_efs.py | 233 ++++++++++++------ ...cleanup-administration-delete-projects.yml | 60 +++++ 3 files changed, 272 insertions(+), 69 deletions(-) create mode 100644 playbooks/manual/communishift_delete_projects.yml create mode 100644 roles/communishift/tasks/cleanup-administration-delete-projects.yml diff --git a/playbooks/manual/communishift_delete_projects.yml b/playbooks/manual/communishift_delete_projects.yml new file mode 100644 index 0000000000..6e0fbf015e --- /dev/null +++ b/playbooks/manual/communishift_delete_projects.yml @@ -0,0 +1,48 @@ +--- +# Communishift project deletion (inventory + per-project eligibility). +# Run after workloads are shut down via communishift_disable_project.yml. +# Uses communishift_projects from inventory (e.g. inventory/group_vars/all) and each +# entry's do_not_delete to skip exempt namespaces. +# +# Omitting communishift_delete_projects_dry_run applies changes. Preview removals only: +# ansible-playbook .../communishift_delete_projects.yml --tags communishift_delete_projects \ +# -e communishift_delete_projects_dry_run=true +# +# Explicit live delete: +# ansible-playbook .../communishift_delete_projects.yml --tags communishift_delete_projects \ +# -e communishift_delete_projects_dry_run=false +# +# Run with an inventory that merges group_vars/all so communishift_projects is defined. +# +- hosts: localhost + user: root + gather_facts: false + + vars_files: + - /srv/web/infra/ansible/vars/global.yml + - "/srv/private/ansible/vars.yml" + - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml + + pre_tasks: + - name: Require communishift_projects from inventory + ansible.builtin.assert: + that: + - communishift_projects is defined + - communishift_projects is mapping + fail_msg: > + communishift_projects is missing. Run with an inventory that loads + inventory/group_vars/all (e.g. ansible-playbook -i path/to/inventory ...). + tags: + - always + + tasks: + - name: Communishift delete eligible projects (namespace, EFS, group) + ansible.builtin.include_role: + name: communishift + tasks_from: cleanup-administration-delete-projects + apply: + tags: + - communishift_delete_projects + loop: "{{ lookup('dict', communishift_projects) }}" + tags: + - communishift_delete_projects diff --git a/roles/communishift/library/communishift_storage_efs.py b/roles/communishift/library/communishift_storage_efs.py index 949099aa94..1805ba373e 100644 --- a/roles/communishift/library/communishift_storage_efs.py +++ b/roles/communishift/library/communishift_storage_efs.py @@ -23,6 +23,13 @@ options: description: The name of the Communishift Project. required: true type: str + state: + description: Create access point or remove access points for this project from the filesystem. + type: str + default: present + choices: + - present + - absent aws_access_key_id: description: The AWS API access_key_id. required: true @@ -36,8 +43,11 @@ options: required: true type: str aws_efs_filesystem_id: - description: The AWS EFS FileSystemId of the resource that was previously created. - required: true + description: >- + The AWS EFS FileSystemId. Required when I(state=present). + Optional when I(state=absent); if omitted the filesystem is found by CreationToken matching I(project_name), + consistent with community.aws.efs I(name). + required: false type: str author: @@ -57,88 +67,143 @@ EXAMPLES = r""" {{create_efs_filesystem_response['efs']['file_system_id']}} register: create_efs_accesspoint_response ignore_errors: true + +- name: Delete access points for a Communishift project + communishift_storage_efs: + project_name: "{{ item.value.name }}" + state: absent + aws_access_key_id: "{{ communishift_efs_access_key }}" + aws_secret_access_key: "{{ communishift_efs_secret_key }}" + aws_region: "{{ communishift_region }}" """ RETURN = r""" - -# These are examples of possible return values, and in general should use other names for return values. accesspoint_id: - description: The AccessPointId returned by the AWS EFS API creation request. - type: str - returned: If the EFS Filesystem exists and the AccessPoint been successfully created or already exists. - sample: 'fsap-0938462b9b5f77388' -full_response: - description: The response returned by the AWS EFS boto3 client.create_access_point() or client.describe_access_points(). + description: The AccessPointId returned by create (present) when a single matching resource is summarized. type: str returned: If the EFS Filesystem exists and the AccessPoint has been successfully created or already exists. - sample: '{'ResponseMetadata': {'RequestId': '9c3d3e41-4332-4fe3-8388-f04ccf0400a2', 'HTTPStatusCode': 200, 'HTTPHeaders': {'x-amzn-requ -estid': '9c3d3e41-4332-4fe3-8388-f04ccf0400a2', 'content-type': 'application/json', 'content-length': '503', 'date': 'Tue, 16 -Aug 2022 10:17:43 GMT'}, 'RetryAttempts': 0}, 'ClientToken': 'communishift_storage_efs', 'Tags': [{'Key': 'communishift', 'Val -ue': 'projectname'}], 'AccessPointId': 'fsap-0938462b9b5f77388', 'AccessPointArn': 'arn:aws:elasticfilesystem:us-east-1:XXXXXXXXXXXX: -access-point/fsap-0938462b9b5f77388', 'FileSystemId': 'fs-0343e73f7765a503b', 'PosixUser': {'Uid': 50000, 'Gid': 50000} -, 'RootDirectory': {'Path': '/', 'CreationInfo': {'OwnerUid': 50000, 'OwnerGid': 50000, 'Permissions': '775'}}, 'OwnerId': 'XXXX', -'LifeCycleState': 'creating'}' +deleted_access_point_ids: + description: Access point IDs deleted in absent mode. + type: list + elements: str + returned: absent +full_response: + description: Creation response or describe payload (present) or summarized absent action. + type: raw msg: description: The output message that the module generates. type: str returned: always - sample: 'AWS EFS AccessPoint already exists.' """ from ansible.module_utils.basic import AnsibleModule -def run_module(): - # define available arguments/parameters a user can pass to the module - module_args = dict( - project_name=dict(type="str", required=True), - aws_access_key_id=dict(type="str", required=True), - aws_secret_access_key=dict(type="str", required=True), - aws_region=dict(type="str", required=True), - aws_efs_filesystem_id=dict(type="str", required=True), - ) - - # seed the result dict in the object - # we primarily care about changed and state - # changed is if this module effectively modified the target - # state will include any data that you want your module to pass back - # for consumption, for example, in a subsequent task - result = dict(changed=False, accesspoint_id="", full_response="", msg="") - - # the AnsibleModule object will be our abstraction working with Ansible - # this includes instantiation, a couple of common attr would be the - # args/params passed to the execution, as well as if the module - # supports check mode - module = AnsibleModule(argument_spec=module_args, supports_check_mode=True) - - # if the user is working with this module in only check mode we do not - # want to make any changes to the environment, just return the current - # state with no modifications - if module.check_mode: - module.exit_json(**result) - - efs_client = boto3.client( +def build_efs_client(params): + return boto3.client( "efs", - aws_access_key_id=module.params["aws_access_key_id"], - aws_secret_access_key=module.params["aws_secret_access_key"], - region_name=module.params["aws_region"], + aws_access_key_id=params["aws_access_key_id"], + aws_secret_access_key=params["aws_secret_access_key"], + region_name=params["aws_region"], ) + +def find_filesystem_id_by_creation_token(efs_client, creation_token): + paginator = efs_client.get_paginator("describe_file_systems") + for page in paginator.paginate(): + for fs in page.get("FileSystems", []): + if fs.get("CreationToken") == creation_token: + return fs["FileSystemId"] + return None + + +def matching_access_points(efs_client, filesystem_id, project_name): + expected_path = "/{0}".format(project_name) + matching = [] + paginator = efs_client.get_paginator("describe_access_points") + for page in paginator.paginate(FileSystemId=filesystem_id): + for ap in page.get("AccessPoints", []): + tags = {t["Key"]: t["Value"] for t in ap.get("Tags", [])} + if tags.get("communishift") != project_name: + continue + root_path = ap.get("RootDirectory", {}).get("Path", "") + if root_path != expected_path: + continue + matching.append(ap["AccessPointId"]) + return matching + + +def run_absent(module, efs_client, params, check_mode): + project_name = params["project_name"] + fs_id = params.get("aws_efs_filesystem_id") or "" + if not fs_id: + fs_id = find_filesystem_id_by_creation_token(efs_client, project_name) + if fs_id is None: + module.exit_json( + changed=False, + deleted_access_point_ids=[], + accesspoint_id="", + full_response=None, + msg="No EFS file system found with CreationToken matching project_name.", + ) + access_point_ids = matching_access_points(efs_client, fs_id, project_name) + if not access_point_ids: + module.exit_json( + changed=False, + deleted_access_point_ids=[], + accesspoint_id="", + full_response={"file_system_id": fs_id}, + msg="No matching Communishift-tagged access points to delete.", + ) + if check_mode: + module.exit_json( + changed=True, + deleted_access_point_ids=[], + access_points_that_would_be_deleted=access_point_ids, + accesspoint_id="", + full_response={"file_system_id": fs_id}, + msg="Check mode: would delete {0} access point(s)".format(len(access_point_ids)), + ) + deleted = [] + for ap_id in access_point_ids: + efs_client.delete_access_point(AccessPointId=ap_id) + deleted.append(ap_id) + module.exit_json( + changed=True, + deleted_access_point_ids=deleted, + accesspoint_id=deleted[-1] if deleted else "", + full_response={ + "file_system_id": fs_id, + "deleted_access_point_ids": deleted, + }, + msg="Deleted {0} Communishift EFS access point(s).".format(len(deleted)), + ) + + +def run_present(module, efs_client, params, check_mode): + fs_id = params["aws_efs_filesystem_id"] + if check_mode: + module.exit_json( + changed=False, + accesspoint_id="", + full_response=None, + msg="Check mode: would create access point if missing.", + ) try: response = efs_client.create_access_point( - ClientToken=module.params["project_name"], + ClientToken=params["project_name"], Tags=[ - {"Key": "communishift", "Value": module.params["project_name"]}, - {"Key": "Name", "Value": module.params["project_name"]}, + {"Key": "communishift", "Value": params["project_name"]}, + {"Key": "Name", "Value": params["project_name"]}, ], - FileSystemId=module.params["aws_efs_filesystem_id"], + FileSystemId=fs_id, PosixUser={ "Uid": 1001, "Gid": 1001, - "SecondaryGids": [ 0 ], + "SecondaryGids": [0], }, RootDirectory={ - "Path": f"/{ module.params['project_name'] }", + "Path": "/{0}".format(params["project_name"]), "CreationInfo": { "OwnerUid": 0, "OwnerGid": 0, @@ -147,19 +212,49 @@ def run_module(): }, ) - result["accesspoint_id"] = response["AccessPointId"] - result["full_response"] = response - result["changed"] = True - result["msg"] = "AWS EFS AccessPoint created successfully." - module.exit_json(**result) - except efs_client.exceptions.AccessPointAlreadyExists: - response = efs_client.describe_access_points( - FileSystemId=module.params["aws_efs_filesystem_id"] + module.exit_json( + changed=True, + accesspoint_id=response["AccessPointId"], + full_response=response, + deleted_access_point_ids=[], + msg="AWS EFS AccessPoint created successfully.", ) - result["accesspoint_id"] = response["AccessPoints"][0]["AccessPointId"] - result["full_response"] = response - result["msg"] = "AWS EFS AccessPoint already exists." - module.fail_json(**result) + except efs_client.exceptions.AccessPointAlreadyExists: + ap_ids = matching_access_points(efs_client, fs_id, params["project_name"]) + chosen = ap_ids[0] if ap_ids else "" + module.exit_json( + changed=False, + accesspoint_id=chosen, + full_response=ap_ids, + deleted_access_point_ids=[], + msg="AWS EFS AccessPoint already exists.", + ) + + +def run_module(): + module_args = dict( + project_name=dict(type="str", required=True), + state=dict(type="str", default="present", choices=["present", "absent"]), + aws_access_key_id=dict(type="str", required=True), + aws_secret_access_key=dict(type="str", required=True), + aws_region=dict(type="str", required=True), + aws_efs_filesystem_id=dict(type="str", required=False), + ) + + module = AnsibleModule(argument_spec=module_args, supports_check_mode=True) + + params = module.params + state = params["state"] + + if state == "present" and not params.get("aws_efs_filesystem_id"): + module.fail_json(msg="aws_efs_filesystem_id is required when state=present.") + + efs_client = build_efs_client(params) + + if state == "absent": + run_absent(module, efs_client, params, module.check_mode) + else: + run_present(module, efs_client, params, module.check_mode) def main(): diff --git a/roles/communishift/tasks/cleanup-administration-delete-projects.yml b/roles/communishift/tasks/cleanup-administration-delete-projects.yml new file mode 100644 index 0000000000..53cf25aa97 --- /dev/null +++ b/roles/communishift/tasks/cleanup-administration-delete-projects.yml @@ -0,0 +1,60 @@ +--- +- name: Set Communishift deletion context for this project + ansible.builtin.set_fact: + communishift_namespace: "{{ item.value.name }}" + communishift_protected: "{{ item.value.do_not_delete | default(false) | bool }}" + +- name: Skip delete for protected Communishift project + ansible.builtin.debug: + msg: "Skipping deletion for {{ communishift_namespace }} (do_not_delete is true)" + when: communishift_protected | bool + +- name: Dry-run - eligible project deletion preview + ansible.builtin.debug: + msg: >- + Would delete Namespace {{ communishift_namespace }}, Communishift EFS access points and filesystem {{ communishift_namespace }}, + and Group {{ communishift_namespace }}-admins (set -e communishift_delete_projects_dry_run=false to apply). + when: + - not communishift_protected | bool + - communishift_delete_projects_dry_run | default(false) | bool + +- name: Delete Communishift namespace cluster resources then AWS/OpenShift teardown + when: + - not communishift_protected | bool + - not (communishift_delete_projects_dry_run | default(false) | bool) + block: + - name: Remove Communishift Kubernetes namespace + kubernetes.core.k8s: + api_key: "{{ communishift_ocp_api_token }}" + host: "{{ communishift_ocp_api_host }}" + api_version: v1 + kind: Namespace + name: "{{ communishift_namespace }}" + state: absent + wait: true + + - name: Delete Communishift-tagged EFS access points for project + communishift_storage_efs: + project_name: "{{ communishift_namespace }}" + state: absent + aws_access_key_id: "{{ communishift_efs_access_key }}" + aws_secret_access_key: "{{ communishift_efs_secret_key }}" + aws_region: "{{ communishift_region }}" + + - name: Remove Communishift EFS filesystem (matches community.aws.efs creation token) + community.aws.efs: + aws_access_key: "{{ communishift_efs_access_key }}" + aws_secret_key: "{{ communishift_efs_secret_key }}" + region: "{{ communishift_region }}" + state: absent + name: "{{ communishift_namespace }}" + wait: true + + - name: Remove OpenShift group for project admins + community.okd.k8s: + api_key: "{{ communishift_ocp_api_token }}" + host: "{{ communishift_ocp_api_host }}" + name: "{{ communishift_namespace }}-admins" + api_version: user.openshift.io/v1 + kind: Group + state: absent From 9c2eeb276d461833a464e7be3b8b1dde3b35dec3 Mon Sep 17 00:00:00 2001 From: Mattia Verga Date: Mon, 11 May 2026 13:37:44 +0200 Subject: [PATCH 057/269] bodhi-stg: redirect valkey log to stdout Signed-off-by: Mattia Verga --- roles/openshift-apps/bodhi/templates/deployment.yml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 index e8fcf87111..c645cbe5c5 100644 --- a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 +++ b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 @@ -389,7 +389,7 @@ spec: - name: bodhi-valkey image: image-registry.openshift-image-registry.svc:5000/bodhi/bodhi-valkey:latest command: ["valkey-server"] - args: ["/etc/valkey/valkey.conf", "--requirepass", "$(VALKEY_PASSWORD)"] + args: ["/etc/valkey/valkey.conf", "--logfile", "", "--requirepass", "$(VALKEY_PASSWORD)"] env: - name: VALKEY_PASSWORD valueFrom: From 22005ff136288380ec84c29045ba5ca9ac06a0dd Mon Sep 17 00:00:00 2001 From: Mattia Verga Date: Mon, 11 May 2026 13:42:03 +0200 Subject: [PATCH 058/269] bodhi-stg: fix valkey conf Signed-off-by: Mattia Verga --- roles/openshift-apps/bodhi/templates/deployment.yml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 index c645cbe5c5..5445efcd1b 100644 --- a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 +++ b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 @@ -389,7 +389,7 @@ spec: - name: bodhi-valkey image: image-registry.openshift-image-registry.svc:5000/bodhi/bodhi-valkey:latest command: ["valkey-server"] - args: ["/etc/valkey/valkey.conf", "--logfile", "", "--requirepass", "$(VALKEY_PASSWORD)"] + args: ["/etc/valkey/valkey.conf", "--logfile", "", "--pidfile", "", "--unixsocket", "", "--requirepass", "$(VALKEY_PASSWORD)"] env: - name: VALKEY_PASSWORD valueFrom: From fc3816c7fe916dd648f33d42817226138157a727 Mon Sep 17 00:00:00 2001 From: Mattia Verga Date: Mon, 11 May 2026 13:48:01 +0200 Subject: [PATCH 059/269] bodhi: fix duplicated setting in stg Signed-off-by: Mattia Verga --- roles/bodhi2/base/templates/production.ini.j2 | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/roles/bodhi2/base/templates/production.ini.j2 b/roles/bodhi2/base/templates/production.ini.j2 index 4a5a297b15..c3b7d15d79 100644 --- a/roles/bodhi2/base/templates/production.ini.j2 +++ b/roles/bodhi2/base/templates/production.ini.j2 @@ -207,11 +207,12 @@ skopeo.cmd = /usr/bin/skopeo skopeo.extra_copy_flags = -a,--retry-times=10,--authfile=/etc/bodhi/flatpak-bot-auth.json # Container hostnames. You can specify a port as well, using the traditional syntax (i.e., localhost:5000). -container.destination_registry = registry.fedoraproject.org quay.io/fedora-flatpaks -container.source_registry = candidate-registry.fedoraproject.org {% if env == 'staging' %} container.destination_registry = registry.stg.fedoraproject.org quay.io/fedora-flatpaks-testing container.source_registry = candidate-registry.stg.fedoraproject.org +{% else %} +container.destination_registry = registry.fedoraproject.org quay.io/fedora-flatpaks +container.source_registry = candidate-registry.fedoraproject.org {% endif %} From d9aef74a12426bece24541109a06d5f9cb7f7b91 Mon Sep 17 00:00:00 2001 From: Mattia Verga Date: Mon, 11 May 2026 13:55:20 +0200 Subject: [PATCH 060/269] bodhi-stg: update to F44 and install valkey-cli Signed-off-by: Mattia Verga --- roles/openshift-apps/bodhi/templates/dockerfile-base | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/openshift-apps/bodhi/templates/dockerfile-base b/roles/openshift-apps/bodhi/templates/dockerfile-base index fd62514999..bb877d7dcb 100644 --- a/roles/openshift-apps/bodhi/templates/dockerfile-base +++ b/roles/openshift-apps/bodhi/templates/dockerfile-base @@ -1,5 +1,5 @@ {% if env == "staging" %} -FROM fedora:43 +FROM fedora:44 {% else %} FROM fedora:43 {% endif %} @@ -14,7 +14,7 @@ RUN curl -o /etc/yum.repos.d/infra-tags-stg.repo https://infrastructure.fedorapr RUN curl -o /etc/yum.repos.d/infra-tags.repo https://infrastructure.fedoraproject.org/infra/ansible/files/common/fedora-infra-tags.repo {% endif %} {% if env == "staging" %} -RUN dnf install -y bodhi-server python3-koji-fedoramessaging-messages python3-gunicorn sed --refresh +RUN dnf install -y bodhi-server python3-koji-fedoramessaging-messages python3-gunicorn sed valkey --refresh {% else %} RUN dnf install -y bodhi-server-{{bodhi_version}} python3-koji-fedoramessaging-messages python3-gunicorn sed {% endif %} From 2002267fcbc730907780a61a4b67db45aa60dcf5 Mon Sep 17 00:00:00 2001 From: David Kirwan Date: Mon, 11 May 2026 12:58:13 +0100 Subject: [PATCH 061/269] communishift: helper script for cleaning up removed group_vars projects Signed-off-by: David Kirwan --- scripts/README | 3 + scripts/communishift_prune_projects | 278 ++++++++++++++++++++++++++++ 2 files changed, 281 insertions(+) create mode 100755 scripts/communishift_prune_projects diff --git a/scripts/README b/scripts/README index 400203287f..eaf3f90789 100644 --- a/scripts/README +++ b/scripts/README @@ -1,3 +1,6 @@ +communishift_prune_projects - trims communishift_projects in group_vars/all (in-place + splice; only that mapping); see --help / --diff + ans-needs-reboot - check which hosts need to be rebooted due to kernel or other critical updates diff --git a/scripts/communishift_prune_projects b/scripts/communishift_prune_projects new file mode 100755 index 0000000000..9d4c3a9b9f --- /dev/null +++ b/scripts/communishift_prune_projects @@ -0,0 +1,278 @@ +#!/usr/bin/env python3 +""" +Prune communishift_projects under ansible/inventory/group_vars/all: + + - Keeps entries where do_not_delete is truthy (true / yes / 1 / on, case-insensitive strings). + - Removes every other child mapping under communishift_projects. + +Only the communishift_projects mapping (that key plus its body up to—but not including—the +next line at indentation 0) is rewritten. All other bytes in the file are preserved. + +Default: dry-run (no writes). Print summary; use --diff for a unified file diff. + +Dependencies: PyYAML (python3-pyyaml). + +Examples: + + ansible/scripts/communishift_prune_projects + ansible/scripts/communishift_prune_projects --diff + ansible/scripts/communishift_prune_projects --write +""" + +from __future__ import annotations + +import argparse +import difflib +import os +import re +import sys +from pathlib import Path +from tempfile import NamedTemporaryFile +from typing import Any, Dict, List, Mapping, Sequence, Tuple + +try: + import yaml +except ImportError as exc: + sys.stderr.write( + "This script requires PyYAML (install python3-pyyaml on this host).\n" + ) + raise SystemExit(1) from exc + + +_STANZA_START = re.compile(r"^([A-Za-z0-9_.-]+):\s*(?:\#.*)?\s*$") +_CHILD_INDENT = 2 + + +def ansible_truthy(value: Any) -> bool: + if isinstance(value, bool): + return value + if isinstance(value, str): + return value.strip().lower() in {"true", "yes", "1", "on"} + return False + + +def _expanded_indent(raw: str) -> int: + return len(raw.expandtabs()) - len(raw.expandtabs().lstrip(" ")) + + +def locate_communishift_block(lines: Sequence[str]) -> Tuple[int, int]: + start = None + for i, line in enumerate(lines): + if line.lstrip("\ufeff").startswith("communishift_projects:"): + start = i + break + if start is None: + raise ValueError('No root key line starting with "communishift_projects:"') + + root_indent = _expanded_indent(lines[start]) + j = start + 1 + n_lines = len(lines) + while j < n_lines: + line = lines[j] + if line.strip("\r\n") == "": + j += 1 + continue + if _expanded_indent(line) <= root_indent: + break + j += 1 + return start, j + + +def parse_stanza_blocks( + section_body: Sequence[str], +) -> Tuple[List[str], Dict[str, List[str]]]: + """ + Lines AFTER the communishift_projects: line. Preamble = comments/blanks/stanzas whose + first line is not a two-space child key line. + """ + preamble: List[str] = [] + blocks: Dict[str, List[str]] = {} + + idx = 0 + maximum = len(section_body) + while idx < maximum: + line = section_body[idx] + stripped_for_match = line.rstrip("\r\n") + indent = _expanded_indent(line) + matched = indent == _CHILD_INDENT and bool( + _STANZA_START.match(stripped_for_match.lstrip(" ")) + ) + if matched: + key_match = _STANZA_START.match(stripped_for_match.lstrip(" ")) + assert key_match is not None + key = key_match.group(1) + if key in blocks: + raise ValueError("Duplicate Communishift stanza key {0!r}".format(key)) + stanza_lines: List[str] = [line] + idx += 1 + while idx < maximum: + nxt = section_body[idx] + n_indent = _expanded_indent(nxt) + nn = _STANZA_START.match(nxt.rstrip("\r\n").lstrip(" ")) + if n_indent == _CHILD_INDENT and nn: + break + stanza_lines.append(nxt) + idx += 1 + blocks[key] = list(stanza_lines) + continue + + preamble.append(line) + idx += 1 + + return preamble, blocks + + +def stanza_keeps(meta: Any) -> bool: + return isinstance(meta, Mapping) and ansible_truthy(meta.get("do_not_delete")) + + +def load_projects_map(path: Path) -> Mapping[str, Any]: + raw = yaml.safe_load(path.read_text(encoding="utf-8")) + if not isinstance(raw, dict): + raise ValueError("YAML root must be a mapping") + proj = raw.get("communishift_projects") + if proj is None: + raise ValueError("communishift_projects missing from YAML") + if not isinstance(proj, dict): + raise ValueError("communishift_projects must be a mapping") + + return proj + + +def splice_communishift_projects( + text: str, + proj_data: Mapping[str, Any], +) -> Tuple[str, Dict[str, Any]]: + lines = text.splitlines(keepends=True) + start, end = locate_communishift_block(lines) + header_line = lines[start] + + body = lines[start + 1 : end] + preamble, blocks = parse_stanza_blocks(body) + + removed: List[str] = [] + skipped_non_mapping: List[str] = [] + kept_names: List[str] = [] + + for key in sorted(blocks.keys()): + meta = proj_data.get(key) + if not stanza_keeps(meta): + removed.append(key) + if not isinstance(meta, dict): + skipped_non_mapping.append(key) + continue + kept_names.append(str(meta.get("name", key))) + + sorted_kept = sorted(k for k in blocks if stanza_keeps(proj_data.get(k))) + new_section: List[str] = [header_line] + new_section.extend(preamble) + for k in sorted_kept: + new_section.extend(blocks[k]) + + after = "".join(lines[:start] + new_section + lines[end:]) + stats = { + "kept_count": len(sorted_kept), + "kept_names": sorted(kept_names), + "removed": removed, + "skipped_non_mapping": skipped_non_mapping, + } + return after, stats + + +def main(argv: List[str]) -> int: + ansible_root = Path(__file__).resolve().parent.parent + parser = argparse.ArgumentParser(description=__doc__) + parser.add_argument( + "--group-vars", + type=Path, + default=ansible_root / "inventory" / "group_vars" / "all", + help="YAML file defining communishift_projects", + ) + parser.add_argument( + "--diff", + action="store_true", + help="Print unified diff of the whole file", + ) + parser.add_argument( + "--write", + action="store_true", + help="Write the updated file", + ) + args = parser.parse_args(argv) + + group_vars_path = Path(args.group_vars) + original_text = group_vars_path.read_text(encoding="utf-8") + + try: + proj_data = load_projects_map(group_vars_path) + except ValueError as err: + sys.stderr.write("{0}: {1}\n".format(group_vars_path, err)) + return 1 + + try: + after_text, stats = splice_communishift_projects(original_text, proj_data) + except ValueError as err: + sys.stderr.write("{0}: {1}\n".format(group_vars_path, err)) + return 1 + + print("File: {0}".format(group_vars_path)) + extra = "" + if stats["skipped_non_mapping"]: + extra = " (+ {0} non-mapping skipped)".format(len(stats["skipped_non_mapping"])) + + print( + "Keeping {0} project stanza(s){1}".format(stats["kept_count"], extra), + ) + if stats["kept_names"]: + print(" " + ", ".join(sorted(stats["kept_names"]))) + + print("Removing {0} stanza key(s)".format(len(stats["removed"]))) + for name in sorted(stats["removed"], key=lambda s: str(s).lower()): + print(" - {0}".format(name)) + + if args.diff: + sys.stdout.writelines( + difflib.unified_diff( + original_text.splitlines(True), + after_text.splitlines(True), + fromfile="{0} (before)".format(group_vars_path), + tofile="{0} (after)".format(group_vars_path), + ) + ) + + if after_text == original_text: + print("\nNo changes needed.") + return 0 + + if not args.write: + print("\nDry-run only — no file modified. Pass --write to apply.") + return 0 + + fh = NamedTemporaryFile( + mode="w", + encoding="utf-8", + suffix=".tmp", + prefix="communishift-prune.", + dir=str(group_vars_path.parent), + delete=False, + ) + tmp_path = fh.name + try: + fh.write(after_text) + fh.flush() + os.fsync(fh.fileno()) + fh.close() + os.replace(tmp_path, group_vars_path) + except OSError: + fh.close() + try: + os.unlink(tmp_path) + except OSError: + pass + raise + print("\nUpdated {0}".format(group_vars_path)) + return 0 + + +if __name__ == "__main__": + raise SystemExit(main(sys.argv[1:])) From d99f6f030e7efe33365be25f87f9f4b2966ce651 Mon Sep 17 00:00:00 2001 From: David Kirwan Date: Mon, 11 May 2026 13:10:35 +0100 Subject: [PATCH 062/269] communishift: debugging efs config Signed-off-by: David Kirwan --- .../library/communishift_storage_efs.py | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/roles/communishift/library/communishift_storage_efs.py b/roles/communishift/library/communishift_storage_efs.py index 1805ba373e..2c15d1a9e7 100644 --- a/roles/communishift/library/communishift_storage_efs.py +++ b/roles/communishift/library/communishift_storage_efs.py @@ -120,9 +120,15 @@ def find_filesystem_id_by_creation_token(efs_client, creation_token): def matching_access_points(efs_client, filesystem_id, project_name): expected_path = "/{0}".format(project_name) matching = [] - paginator = efs_client.get_paginator("describe_access_points") - for page in paginator.paginate(FileSystemId=filesystem_id): - for ap in page.get("AccessPoints", []): + + # describe_access_points has no botocore paginator on many versions (OperationNotPageableError). + marker = None + while True: + kw = {"FileSystemId": filesystem_id} + if marker: + kw["Marker"] = marker + response = efs_client.describe_access_points(**kw) + for ap in response.get("AccessPoints", []): tags = {t["Key"]: t["Value"] for t in ap.get("Tags", [])} if tags.get("communishift") != project_name: continue @@ -130,6 +136,10 @@ def matching_access_points(efs_client, filesystem_id, project_name): if root_path != expected_path: continue matching.append(ap["AccessPointId"]) + + marker = response.get("NextMarker") or response.get("NextToken") + if not marker: + break return matching From d02937cc70e0bc5d717722bcffb289a0b9075baa Mon Sep 17 00:00:00 2001 From: Mattia Verga Date: Mon, 11 May 2026 14:29:28 +0200 Subject: [PATCH 063/269] bodhi-stg: add bind setting to valkey call Signed-off-by: Mattia Verga --- roles/openshift-apps/bodhi/templates/deployment.yml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 index 5445efcd1b..2deb5f8b9a 100644 --- a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 +++ b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 @@ -389,7 +389,7 @@ spec: - name: bodhi-valkey image: image-registry.openshift-image-registry.svc:5000/bodhi/bodhi-valkey:latest command: ["valkey-server"] - args: ["/etc/valkey/valkey.conf", "--logfile", "", "--pidfile", "", "--unixsocket", "", "--requirepass", "$(VALKEY_PASSWORD)"] + args: ["/etc/valkey/valkey.conf", "--logfile", "", "--pidfile", "", "--unixsocket", "--bind", "0.0.0.0", "", "--requirepass", "$(VALKEY_PASSWORD)"] env: - name: VALKEY_PASSWORD valueFrom: From c844df0cfbd400bafe7efc3bc743695c356f4180 Mon Sep 17 00:00:00 2001 From: Mattia Verga Date: Mon, 11 May 2026 14:35:56 +0200 Subject: [PATCH 064/269] bodhi-stg: use Recreate strategy for bodhi-valkey Signed-off-by: Mattia Verga --- roles/openshift-apps/bodhi/templates/deployment.yml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 index 2deb5f8b9a..cced441e1c 100644 --- a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 +++ b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 @@ -374,7 +374,7 @@ spec: matchLabels: app: bodhi-valkey strategy: - type: RollingUpdate + type: Recreate rollingUpdate: maxSurge: 25% maxUnavailable: 25% From 1371eae7b65a07d5739f21f0826940f9395dc68a Mon Sep 17 00:00:00 2001 From: Mattia Verga Date: Mon, 11 May 2026 14:38:10 +0200 Subject: [PATCH 065/269] fix bodhi-valkey deployment Signed-off-by: Mattia Verga --- roles/openshift-apps/bodhi/templates/deployment.yml.j2 | 3 --- 1 file changed, 3 deletions(-) diff --git a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 index cced441e1c..67f037ab0e 100644 --- a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 +++ b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 @@ -375,9 +375,6 @@ spec: app: bodhi-valkey strategy: type: Recreate - rollingUpdate: - maxSurge: 25% - maxUnavailable: 25% template: metadata: labels: From 06d732888f56406a7546d58adb1730b87cdbee10 Mon Sep 17 00:00:00 2001 From: Mattia Verga Date: Mon, 11 May 2026 14:40:06 +0200 Subject: [PATCH 066/269] fix bodhi-valkey deployment again Signed-off-by: Mattia Verga --- roles/openshift-apps/bodhi/templates/deployment.yml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 index 67f037ab0e..b6dce578ec 100644 --- a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 +++ b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 @@ -386,7 +386,7 @@ spec: - name: bodhi-valkey image: image-registry.openshift-image-registry.svc:5000/bodhi/bodhi-valkey:latest command: ["valkey-server"] - args: ["/etc/valkey/valkey.conf", "--logfile", "", "--pidfile", "", "--unixsocket", "--bind", "0.0.0.0", "", "--requirepass", "$(VALKEY_PASSWORD)"] + args: ["/etc/valkey/valkey.conf", "--logfile", "", "--pidfile", "", "--unixsocket", "", "--bind", "0.0.0.0", "--requirepass", "$(VALKEY_PASSWORD)"] env: - name: VALKEY_PASSWORD valueFrom: From 418cca4d57accf9bd5faaa21df2e7480a3fc8110 Mon Sep 17 00:00:00 2001 From: David Kirwan Date: Mon, 11 May 2026 13:52:02 +0100 Subject: [PATCH 067/269] communishift: clean up project group vars Signed-off-by: David Kirwan --- inventory/group_vars/all | 45 ---------------------------------------- 1 file changed, 45 deletions(-) diff --git a/inventory/group_vars/all b/inventory/group_vars/all index 2ae29716a2..211f632ace 100644 --- a/inventory/group_vars/all +++ b/inventory/group_vars/all @@ -44,38 +44,12 @@ communishift_projects: communishift-admins: name: communishift-admins do_not_delete: true # Marked do not delete 2024-11-25 - dkirwan - communishift-avant: - name: communishift-avant - cpu_limits: 2 - cpu_requests: 2 - memory_limits: 3Gi - memory_requests: 1.5Gi - pods: 6 - storage_requests: 10Gi - communishift-commops-analytics: - name: communishift-commops-analytics - communishift-commops-datanom: - name: communishift-commops-datanom - communishift-discoursepolls: - name: communishift-discoursepolls - communishift-eventbot: - name: communishift-eventbot communishift-fedora-coreos-ai-helpers: name: communishift-fedora-coreos-ai-helpers do_not_delete: true # Marked do not delete 2025-12-18 - dkirwan infra 12996 communishift-fedora-review-service: do_not_delete: true # Marked do not delete 2024-10-21 - dkirwan name: communishift-fedora-review-service - communishift-forgejo: - name: communishift-forgejo - communishift-fossology: - name: communishift-fossology - communishift-gitlabce: - name: communishift-gitlabce - communishift-jitsi: - name: communishift-jitsi - communishift-lightspeed-build: - name: communishift-lightspeed-build communishift-log-detective: name: communishift-log-detective do_not_delete: true # Marked do not delete 2024-10-21 - dkirwan @@ -83,31 +57,12 @@ communishift_projects: memory_requests: 4Gi storage_requests: 10Gi pods: 6 - communishift-mattdm: - name: communishift-mattdm - communishift-metrics: - name: communishift-metrics - communishift-ocm: - name: communishift-ocm - communishift-openscanhub: - name: communishift-openscanhub - cpu_limits: 2 - cpu_requests: 2 - memory_limits: 4Gi - memory_requests: 2Gi - pods: 16 - communishift-planet: - name: communishift-planet communishift-standupbot: name: communishift-standupbot do_not_delete: true # Marked do not delete 2026-05-01 - dkirwan communishift-weekly-bootc: do_not_delete: true # Marked do not delete 2024-11-26. Needed until end of bootc initative. - dkirwan name: communishift-weekly-bootc - communishift-draft-share: - name: communishift-draft-share - communishift-happinesspackets: - name: communishift-happinesspackets # true or false if we are or are not a copr build virthost. # Default to false copr_build_virthost: false From 9806794f83f117e4c5cce2e934c11d206d5ffa26 Mon Sep 17 00:00:00 2001 From: David Kirwan Date: Mon, 11 May 2026 15:54:05 +0100 Subject: [PATCH 068/269] zabbix-proxy: tls config for openshift based zabbix-agents Signed-off-by: David Kirwan --- roles/zabbix/zabbix_openshift_proxy/defaults/main.yml | 7 +++++++ ...-git-namespace.yaml.j2 => zabbix-namespace.yaml.j2} | 2 +- .../templates/zabbix-values.yaml.j2 | 10 ++++++++-- 3 files changed, 16 insertions(+), 3 deletions(-) create mode 100644 roles/zabbix/zabbix_openshift_proxy/defaults/main.yml rename roles/zabbix/zabbix_openshift_proxy/templates/{dist-git-namespace.yaml.j2 => zabbix-namespace.yaml.j2} (70%) diff --git a/roles/zabbix/zabbix_openshift_proxy/defaults/main.yml b/roles/zabbix/zabbix_openshift_proxy/defaults/main.yml new file mode 100644 index 0000000000..50a115001c --- /dev/null +++ b/roles/zabbix/zabbix_openshift_proxy/defaults/main.yml @@ -0,0 +1,7 @@ +--- +# Used by templates/zabbix-values.yaml.j2 for zabbixProxy TLS-PSK (incoming client connections). +# Inventory sets zabbix_tls_psk_identity and zabbix_tls_psk (private) in group_vars; staging +# layers map zabbix_tls_psk -> zabbix_tls_stg_psk. This fallback keeps the template valid when +# only zabbix_tls_stg_psk is provided (e.g. narrow play / extra-vars). +zabbix_tls_psk_identity: "Fedora" +zabbix_tls_stg_psk: "" diff --git a/roles/zabbix/zabbix_openshift_proxy/templates/dist-git-namespace.yaml.j2 b/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-namespace.yaml.j2 similarity index 70% rename from roles/zabbix/zabbix_openshift_proxy/templates/dist-git-namespace.yaml.j2 rename to roles/zabbix/zabbix_openshift_proxy/templates/zabbix-namespace.yaml.j2 index 1e14b419eb..d0a380fc38 100644 --- a/roles/zabbix/zabbix_openshift_proxy/templates/dist-git-namespace.yaml.j2 +++ b/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-namespace.yaml.j2 @@ -2,4 +2,4 @@ apiVersion: v1 kind: Namespace metadata: - name: "dist-git" + name: "zabbix" diff --git a/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 b/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 index c9abf5e88f..44cc183f23 100644 --- a/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 +++ b/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 @@ -71,13 +71,19 @@ zabbixProxy: ## Note that since version 6.0 the variable ZBX_SERVER_PORT is not supported anymore. Instead, add a colon (:) followed by the port number to the end of ZBX_SERVER_HOST value. - name: ZBX_SERVER_HOST value: "zabbix01.stg.rdu3.fedoraproject.org:10051" - ## Security settings + ## TLS-PSK for connections *to this proxy from Zabbix clients* (incoming listener). + ## Identity: zabbix_tls_psk_identity (see inventory group_vars/all). PSK value: prefer + ## zabbix_tls_psk (set per-environment, e.g. staging -> zabbix_tls_stg_psk), else zabbix_tls_stg_psk, + ## matching zabbix_agent role private vars. + ## ZBX_TLSPSK requires zabbix-docker images that support passing the raw key via env (7.x proxy-sqlite3). #- name: ZBX_TLSCONNECT # value: "psk" - name: ZBX_TLSACCEPT value: "unencrypted,psk" - name: ZBX_TLSPSKIDENTITY - value: "Fedora" + value: "{{ zabbix_tls_psk_identity }}" + - name: ZBX_TLSPSK + value: "{{ (env == 'production') | ternary(zabbix_tls_psk,, zabbix_tls_stg_psk,) }}" ## The variable is used to specify debug level. By default, value is 3 - name: ZBX_DEBUGLEVEL value: 3 From 0b9ff51e271cebb0a6559c1c203fa8d464c93fd0 Mon Sep 17 00:00:00 2001 From: David Kirwan Date: Mon, 11 May 2026 16:04:35 +0100 Subject: [PATCH 069/269] zabbix: playbook to deploy the zabbix proxy in openshift Signed-off-by: David Kirwan --- playbooks/openshift-apps/zabbix-proxy.yml | 18 ++++++++++++++++++ ....yaml.j2 => zabbix-proxy-namespace.yaml.j2} | 0 2 files changed, 18 insertions(+) create mode 100644 playbooks/openshift-apps/zabbix-proxy.yml rename roles/zabbix/zabbix_openshift_proxy/templates/{zabbix-namespace.yaml.j2 => zabbix-proxy-namespace.yaml.j2} (100%) diff --git a/playbooks/openshift-apps/zabbix-proxy.yml b/playbooks/openshift-apps/zabbix-proxy.yml new file mode 100644 index 0000000000..866da93894 --- /dev/null +++ b/playbooks/openshift-apps/zabbix-proxy.yml @@ -0,0 +1,18 @@ +--- +- name: Make the app be real + hosts: os_control_stg #:os_control + user: root + gather_facts: false + + vars: + placeholdervar: true # Incase any future vars need to be passed through to the helmchart + vars_files: + - /srv/web/infra/ansible/vars/global.yml + - "/srv/private/ansible/vars.yml" + - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml + + tasks: + - name: Zabbix Proxy Role + ansible.builtin.include_role: + name: zabbix/zabbix_openshift_proxy + tasks_from: main diff --git a/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-namespace.yaml.j2 b/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-proxy-namespace.yaml.j2 similarity index 100% rename from roles/zabbix/zabbix_openshift_proxy/templates/zabbix-namespace.yaml.j2 rename to roles/zabbix/zabbix_openshift_proxy/templates/zabbix-proxy-namespace.yaml.j2 From c098712064f83df92772b2e539b5e4335e6035de Mon Sep 17 00:00:00 2001 From: David Kirwan Date: Mon, 11 May 2026 16:16:24 +0100 Subject: [PATCH 070/269] zabbix: fix typo on helm values template. Signed-off-by: David Kirwan --- roles/zabbix/zabbix_openshift_proxy/tasks/call-helm.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/zabbix/zabbix_openshift_proxy/tasks/call-helm.yaml b/roles/zabbix/zabbix_openshift_proxy/tasks/call-helm.yaml index 00416c9ecd..9c5aa5b375 100644 --- a/roles/zabbix/zabbix_openshift_proxy/tasks/call-helm.yaml +++ b/roles/zabbix/zabbix_openshift_proxy/tasks/call-helm.yaml @@ -1,7 +1,7 @@ --- - name: Generate the zabbix-values.yaml from template ansible.builtin.template: - src: "values.yaml.j2" + src: "zabbix-values.yaml.j2" dest: "/root/ocp4/openshift-apps/zabbix-proxy/zabbix-values.yaml" mode: "0770" From c3b29e947c06f98d5ac8d8c1b4188b69a4ce80c7 Mon Sep 17 00:00:00 2001 From: David Kirwan Date: Mon, 11 May 2026 16:18:27 +0100 Subject: [PATCH 071/269] zabbix: fix typoes in template Signed-off-by: David Kirwan --- .../zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 b/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 index 44cc183f23..bcc2761d51 100644 --- a/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 +++ b/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 @@ -83,7 +83,7 @@ zabbixProxy: - name: ZBX_TLSPSKIDENTITY value: "{{ zabbix_tls_psk_identity }}" - name: ZBX_TLSPSK - value: "{{ (env == 'production') | ternary(zabbix_tls_psk,, zabbix_tls_stg_psk,) }}" + value: "{{ (env == 'production') | ternary(zabbix_tls_psk, zabbix_tls_stg_psk) }}" ## The variable is used to specify debug level. By default, value is 3 - name: ZBX_DEBUGLEVEL value: 3 From d1595d14200a42f736d094aac4b28a6d11b1d3b2 Mon Sep 17 00:00:00 2001 From: David Kirwan Date: Mon, 11 May 2026 16:24:20 +0100 Subject: [PATCH 072/269] zabbix: update the task to checkout correct helm chart Signed-off-by: David Kirwan --- roles/zabbix/zabbix_openshift_proxy/tasks/call-helm.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/roles/zabbix/zabbix_openshift_proxy/tasks/call-helm.yaml b/roles/zabbix/zabbix_openshift_proxy/tasks/call-helm.yaml index 9c5aa5b375..ede0a168eb 100644 --- a/roles/zabbix/zabbix_openshift_proxy/tasks/call-helm.yaml +++ b/roles/zabbix/zabbix_openshift_proxy/tasks/call-helm.yaml @@ -8,8 +8,9 @@ - name: Git clone the Zabbix Helm Chart ansible.builtin.git: - repo: "https://codeberg.org/fedora/forgejo-helm.git" + repo: "https://git.zabbix.com/scm/zt/kubernetes-helm.git" dest: /tmp/zabbix-kubernetes-helm + version: "release/7.0" - name: Build Helm chart dependencies ansible.builtin.command: From eef6c7bc89b59e56b3bc27790c9bd77c6d821ff6 Mon Sep 17 00:00:00 2001 From: David Kirwan Date: Mon, 11 May 2026 16:30:17 +0100 Subject: [PATCH 073/269] zabbix: enabling ZBX_TLSCONNECT on proxy Signed-off-by: David Kirwan --- .../zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 b/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 index bcc2761d51..37a50136db 100644 --- a/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 +++ b/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 @@ -75,9 +75,10 @@ zabbixProxy: ## Identity: zabbix_tls_psk_identity (see inventory group_vars/all). PSK value: prefer ## zabbix_tls_psk (set per-environment, e.g. staging -> zabbix_tls_stg_psk), else zabbix_tls_stg_psk, ## matching zabbix_agent role private vars. - ## ZBX_TLSPSK requires zabbix-docker images that support passing the raw key via env (7.x proxy-sqlite3). - #- name: ZBX_TLSCONNECT - # value: "psk" + ## zabbix-docker creates TLSPSKFile from ZBX_TLSPSK; Zabbix then requires TLSConnect for + ## proxy -> server (active) traffic. Use psk when the server expects the same PSK as agents. + - name: ZBX_TLSCONNECT + value: "psk" - name: ZBX_TLSACCEPT value: "unencrypted,psk" - name: ZBX_TLSPSKIDENTITY From 769ffc446f2298a0bac87f68e8c9024b37601bfb Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Mon, 11 May 2026 16:38:08 +0100 Subject: [PATCH 074/269] Add OpenVPN connectivity check & triggers to Zabbix Signed-off-by: Greg Sutcliffe --- .../client/files/zabbix/template-openvpn.yml | 38 +++++++++++++++++++ 1 file changed, 38 insertions(+) diff --git a/roles/openvpn/client/files/zabbix/template-openvpn.yml b/roles/openvpn/client/files/zabbix/template-openvpn.yml index a9cb1770b2..efe2dd3d8e 100644 --- a/roles/openvpn/client/files/zabbix/template-openvpn.yml +++ b/roles/openvpn/client/files/zabbix/template-openvpn.yml @@ -11,6 +11,40 @@ zabbix_export: groups: - name: Fedora items: + - uuid: eb73132afa214eb483990804bd4cb4bf + name: 'OpenVPN Client connectivity performance' + type: ZABBIX_ACTIVE + key: 'net.tcp.service.perf[http,192.168.1.41,80]' + value_type: FLOAT + units: ms + preprocessing: + - type: MULTIPLIER + parameters: + - '1000' + tags: + - tag: application + value: openvpn + - tag: component + value: network + triggers: + - uuid: d81b2b0d733f4cb09cb83d8fbf627b4f + expression: 'min(/OpenVPN Client/net.tcp.service.perf[http,192.168.1.41,80],5m)>{$OPENVPN.PING_TIME.MAX}' + name: 'OpenVPN: Ping time is too high (over {$OPENVPN.PING_TIME.MAX}ms for 5m)' + priority: WARNING + - uuid: cd9f75e2ee7540d3a5d00a48c5aa00f1 + name: 'OpenVPN Client connectivity' + type: ZABBIX_ACTIVE + key: 'net.tcp.service[http,192.168.1.41,80]' + tags: + - tag: application + value: openvpn + - tag: component + value: network + triggers: + - uuid: d82801a9fe9b405890b0a46705fe6599 + expression: 'max(/OpenVPN Client/net.tcp.service[http,192.168.1.41,80],#3)<1' + name: 'OpenVPN: Client cannot ping batcave01' + priority: AVERAGE - uuid: 93da423abd37459e9d5478e183048bd9 name: 'Time left on OpenVPN Cert' type: TRAP @@ -45,3 +79,7 @@ zabbix_export: tags: - tag: service value: openvpn + macros: + - macro: '{$OPENVPN.PING_TIME.MAX}' + value: '400' + description: 'ms warning time for openvpn performance' From 850e51c1db54aff429d7efd2e53653e5ddb0c638 Mon Sep 17 00:00:00 2001 From: David Kirwan Date: Mon, 11 May 2026 16:43:55 +0100 Subject: [PATCH 075/269] zabbix: debugging encryption config Signed-off-by: David Kirwan --- .../templates/zabbix-values.yaml.j2 | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 b/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 index 37a50136db..d7b6581049 100644 --- a/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 +++ b/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 @@ -71,16 +71,14 @@ zabbixProxy: ## Note that since version 6.0 the variable ZBX_SERVER_PORT is not supported anymore. Instead, add a colon (:) followed by the port number to the end of ZBX_SERVER_HOST value. - name: ZBX_SERVER_HOST value: "zabbix01.stg.rdu3.fedoraproject.org:10051" - ## TLS-PSK for connections *to this proxy from Zabbix clients* (incoming listener). - ## Identity: zabbix_tls_psk_identity (see inventory group_vars/all). PSK value: prefer - ## zabbix_tls_psk (set per-environment, e.g. staging -> zabbix_tls_stg_psk), else zabbix_tls_stg_psk, - ## matching zabbix_agent role private vars. - ## zabbix-docker creates TLSPSKFile from ZBX_TLSPSK; Zabbix then requires TLSConnect for - ## proxy -> server (active) traffic. Use psk when the server expects the same PSK as agents. + ## TLS split: proxy -> Zabbix server = plaintext; clients/agents -> proxy = TLS-PSK only. + ## (TLSConnect outbound vs TLSAccept inbound — see Zabbix proxy TLS docs.) + ## zabbix-docker builds TLSPSKFile from ZBX_TLSPSK for incoming PSK; TLSConnect must still be set + ## explicitly (unencrypted) so startup does not require server-side PSK. - name: ZBX_TLSCONNECT - value: "psk" + value: "unencrypted" - name: ZBX_TLSACCEPT - value: "unencrypted,psk" + value: "psk" - name: ZBX_TLSPSKIDENTITY value: "{{ zabbix_tls_psk_identity }}" - name: ZBX_TLSPSK From 035be95c3fcbab7c46d172cdcae8a0a1f20bc698 Mon Sep 17 00:00:00 2001 From: David Kirwan Date: Mon, 11 May 2026 17:10:12 +0100 Subject: [PATCH 076/269] zabbix: configure openshift based agents config Signed-off-by: David Kirwan --- .../zabbix_openshift_proxy/defaults/main.yml | 7 +++++++ .../templates/zabbix-values.yaml.j2 | 16 ++++++++++------ 2 files changed, 17 insertions(+), 6 deletions(-) diff --git a/roles/zabbix/zabbix_openshift_proxy/defaults/main.yml b/roles/zabbix/zabbix_openshift_proxy/defaults/main.yml index 50a115001c..ceb3a31aff 100644 --- a/roles/zabbix/zabbix_openshift_proxy/defaults/main.yml +++ b/roles/zabbix/zabbix_openshift_proxy/defaults/main.yml @@ -5,3 +5,10 @@ # only zabbix_tls_stg_psk is provided (e.g. narrow play / extra-vars). zabbix_tls_psk_identity: "Fedora" zabbix_tls_stg_psk: "" + +# Zabbix server DNS (no port) — reused for proxy Server=...:port and DaemonSet passive allowlist seed. +zabbix_openshift_agent_server_hostname: zabbix01.stg.rdu3.fedoraproject.org +# DaemonSet Agent 2 passive allowlist: comma-separated IPs/hostnames/CIDR that may poll :10050. +# Default is only the server; add proxy egress when passive checks flow through proxy (reject log shows IP). +# Example: "{{ zabbix_openshift_agent_server_hostname }},10.16.166.119" +zabbix_openshift_agent_passiveservers: "{{ zabbix_openshift_agent_server_hostname }}" diff --git a/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 b/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 index d7b6581049..ef35679aeb 100644 --- a/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 +++ b/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 @@ -70,7 +70,7 @@ zabbixProxy: ## Note that since version 6.0 the variable ZBX_SERVER_PORT is not supported anymore. Instead, add a colon (:) followed by the port number to the end of ZBX_SERVER_HOST value. - name: ZBX_SERVER_HOST - value: "zabbix01.stg.rdu3.fedoraproject.org:10051" + value: "{{ zabbix_openshift_agent_server_hostname }}:10051" ## TLS split: proxy -> Zabbix server = plaintext; clients/agents -> proxy = TLS-PSK only. ## (TLSConnect outbound vs TLSAccept inbound — see Zabbix proxy TLS docs.) ## zabbix-docker builds TLSPSKFile from ZBX_TLSPSK for incoming PSK; TLSConnect must still be set @@ -279,13 +279,17 @@ zabbixAgent: ## https://kubernetes.io/docs/concepts/containers/images/#using-a-private-registry pullSecrets: [] env: - ## Zabbix server host + ## Passive checks are initiated by Zabbix server/proxy connecting IN to agent :10050. + ## ZBX_PASSIVESERVERS is the comma-separated allowlist (hostnames, IPs, CIDR). It must include + ## every observed source IP of pollers — if logs show rejection from an IP such as the OpenShift + ## proxy Pod/Service egress, append it (inventory: zabbix_openshift_agent_passiveservers). - name: ZBX_SERVER_HOST - value: zabbix01.stg.rdu3.fedoraproject.org - ## Zabbix server port + value: "{{ zabbix_openshift_agent_server_hostname }}" - name: ZBX_SERVER_PORT - value: 10051 - ## This variable is boolean (true or false) and enables or disables feature of passive checks. By default, value is true + value: "10051" + - name: ZBX_PASSIVESERVERS + value: "{{ zabbix_openshift_agent_passiveservers }}" + ## This variable is boolean (true or false) and enables or disables feature of passive checks. By default, value is true - name: ZBX_PASSIVE_ALLOW value: true ## This variable is boolean (true or false) and enables or disables feature of active checks From 299e2e4005aec960cb7686b9efb124c368280365 Mon Sep 17 00:00:00 2001 From: David Kirwan Date: Mon, 11 May 2026 17:11:32 +0100 Subject: [PATCH 077/269] zabbix: configure git checkout step to force Signed-off-by: David Kirwan --- roles/zabbix/zabbix_openshift_proxy/tasks/call-helm.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/roles/zabbix/zabbix_openshift_proxy/tasks/call-helm.yaml b/roles/zabbix/zabbix_openshift_proxy/tasks/call-helm.yaml index ede0a168eb..e513f3989d 100644 --- a/roles/zabbix/zabbix_openshift_proxy/tasks/call-helm.yaml +++ b/roles/zabbix/zabbix_openshift_proxy/tasks/call-helm.yaml @@ -11,6 +11,7 @@ repo: "https://git.zabbix.com/scm/zt/kubernetes-helm.git" dest: /tmp/zabbix-kubernetes-helm version: "release/7.0" + force: true - name: Build Helm chart dependencies ansible.builtin.command: From 7dad780f04f1901ca8b7550fd9f4774e34c702b8 Mon Sep 17 00:00:00 2001 From: David Kirwan Date: Mon, 11 May 2026 17:29:54 +0100 Subject: [PATCH 078/269] zabbix: debugging agent/proxy config Signed-off-by: David Kirwan --- .../zabbix/zabbix_openshift_proxy/defaults/main.yml | 8 ++++---- .../templates/zabbix-values.yaml.j2 | 13 +++++++------ 2 files changed, 11 insertions(+), 10 deletions(-) diff --git a/roles/zabbix/zabbix_openshift_proxy/defaults/main.yml b/roles/zabbix/zabbix_openshift_proxy/defaults/main.yml index ceb3a31aff..1d8537dade 100644 --- a/roles/zabbix/zabbix_openshift_proxy/defaults/main.yml +++ b/roles/zabbix/zabbix_openshift_proxy/defaults/main.yml @@ -8,7 +8,7 @@ zabbix_tls_stg_psk: "" # Zabbix server DNS (no port) — reused for proxy Server=...:port and DaemonSet passive allowlist seed. zabbix_openshift_agent_server_hostname: zabbix01.stg.rdu3.fedoraproject.org -# DaemonSet Agent 2 passive allowlist: comma-separated IPs/hostnames/CIDR that may poll :10050. -# Default is only the server; add proxy egress when passive checks flow through proxy (reject log shows IP). -# Example: "{{ zabbix_openshift_agent_server_hostname }},10.16.166.119" -zabbix_openshift_agent_passiveservers: "{{ zabbix_openshift_agent_server_hostname }}" +# Extra DaemonSet passive allowlist only (comma-separated IPs/hostnames/CIDR). Do NOT repeat +# zabbix_openshift_agent_server_hostname — it is already in ZBX_SERVER_HOST; duplication breaks startup. +# Add proxy/pod egress IPs seen in "connection from ... rejected" logs, e.g. "10.16.166.119". +zabbix_openshift_agent_passiveservers_extra: "" diff --git a/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 b/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 index ef35679aeb..d113779129 100644 --- a/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 +++ b/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 @@ -279,16 +279,17 @@ zabbixAgent: ## https://kubernetes.io/docs/concepts/containers/images/#using-a-private-registry pullSecrets: [] env: - ## Passive checks are initiated by Zabbix server/proxy connecting IN to agent :10050. - ## ZBX_PASSIVESERVERS is the comma-separated allowlist (hostnames, IPs, CIDR). It must include - ## every observed source IP of pollers — if logs show rejection from an IP such as the OpenShift - ## proxy Pod/Service egress, append it (inventory: zabbix_openshift_agent_passiveservers). + ## Passive checks: pollers reach agent :10050. ZBX_SERVER_HOST becomes Server= (must list each address once). + ## zabbix-docker also merges ZBX_PASSIVESERVERS into Server; set passiveservers_extra to *additional* + ## sources only (e.g. OpenShift proxy egress IP), never repeat zabbix_openshift_agent_server_hostname. +{% if zabbix_openshift_agent_passiveservers_extra | default('') | trim | length > 0 %} + - name: ZBX_PASSIVESERVERS + value: "{{ zabbix_openshift_agent_passiveservers_extra | trim }}" +{% endif %} - name: ZBX_SERVER_HOST value: "{{ zabbix_openshift_agent_server_hostname }}" - name: ZBX_SERVER_PORT value: "10051" - - name: ZBX_PASSIVESERVERS - value: "{{ zabbix_openshift_agent_passiveservers }}" ## This variable is boolean (true or false) and enables or disables feature of passive checks. By default, value is true - name: ZBX_PASSIVE_ALLOW value: true From 269c4fd64d3b4221f7151b414c0537889ca62b97 Mon Sep 17 00:00:00 2001 From: David Kirwan Date: Mon, 11 May 2026 17:51:41 +0100 Subject: [PATCH 079/269] zabbix: configure agents to use internal dns for proxy Signed-off-by: David Kirwan --- roles/zabbix/zabbix_openshift_proxy/defaults/main.yml | 7 +++++-- .../zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 | 6 +++--- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/roles/zabbix/zabbix_openshift_proxy/defaults/main.yml b/roles/zabbix/zabbix_openshift_proxy/defaults/main.yml index 1d8537dade..1e2898630b 100644 --- a/roles/zabbix/zabbix_openshift_proxy/defaults/main.yml +++ b/roles/zabbix/zabbix_openshift_proxy/defaults/main.yml @@ -6,8 +6,11 @@ zabbix_tls_psk_identity: "Fedora" zabbix_tls_stg_psk: "" -# Zabbix server DNS (no port) — reused for proxy Server=...:port and DaemonSet passive allowlist seed. -zabbix_openshift_agent_server_hostname: zabbix01.stg.rdu3.fedoraproject.org +# Upstream Zabbix *server* the proxy connects to (host:port → proxy ZBX_SERVER_HOST). +zabbix_openshift_proxy_upstream_server_host: "zabbix01.stg.rdu3.fedoraproject.org:10051" +# DaemonSet agent passive Server= (kube DNS name of proxy Service, no port). Agent resolves this to +# the ClusterIP proxies use for passive polls. Confirm: oc get svc -n zabbix (often zabbix-zabbix-proxy). +zabbix_openshift_agent_server_hostname: zabbix-zabbix-proxy.zabbix.svc.cluster.local # Extra DaemonSet passive allowlist only (comma-separated IPs/hostnames/CIDR). Do NOT repeat # zabbix_openshift_agent_server_hostname — it is already in ZBX_SERVER_HOST; duplication breaks startup. # Add proxy/pod egress IPs seen in "connection from ... rejected" logs, e.g. "10.16.166.119". diff --git a/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 b/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 index d113779129..01d073985c 100644 --- a/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 +++ b/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 @@ -70,7 +70,7 @@ zabbixProxy: ## Note that since version 6.0 the variable ZBX_SERVER_PORT is not supported anymore. Instead, add a colon (:) followed by the port number to the end of ZBX_SERVER_HOST value. - name: ZBX_SERVER_HOST - value: "{{ zabbix_openshift_agent_server_hostname }}:10051" + value: "{{ zabbix_openshift_proxy_upstream_server_host }}" ## TLS split: proxy -> Zabbix server = plaintext; clients/agents -> proxy = TLS-PSK only. ## (TLSConnect outbound vs TLSAccept inbound — see Zabbix proxy TLS docs.) ## zabbix-docker builds TLSPSKFile from ZBX_TLSPSK for incoming PSK; TLSConnect must still be set @@ -280,8 +280,8 @@ zabbixAgent: pullSecrets: [] env: ## Passive checks: pollers reach agent :10050. ZBX_SERVER_HOST becomes Server= (must list each address once). - ## zabbix-docker also merges ZBX_PASSIVESERVERS into Server; set passiveservers_extra to *additional* - ## sources only (e.g. OpenShift proxy egress IP), never repeat zabbix_openshift_agent_server_hostname. + ## zabbix-docker also merges ZBX_PASSIVESERVERS into Server=; extras must never repeat addresses + ## already resolved from ZBX_SERVER_HOST (duplicate hostnames/IP sets break agent startup). {% if zabbix_openshift_agent_passiveservers_extra | default('') | trim | length > 0 %} - name: ZBX_PASSIVESERVERS value: "{{ zabbix_openshift_agent_passiveservers_extra | trim }}" From a0b48d31b88a07e131a179e91d18ba4271bded53 Mon Sep 17 00:00:00 2001 From: David Kirwan Date: Mon, 11 May 2026 17:57:29 +0100 Subject: [PATCH 080/269] zabbix: update internal dns name to match correct value Signed-off-by: David Kirwan --- roles/zabbix/zabbix_openshift_proxy/defaults/main.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/zabbix/zabbix_openshift_proxy/defaults/main.yml b/roles/zabbix/zabbix_openshift_proxy/defaults/main.yml index 1e2898630b..30d3d49a73 100644 --- a/roles/zabbix/zabbix_openshift_proxy/defaults/main.yml +++ b/roles/zabbix/zabbix_openshift_proxy/defaults/main.yml @@ -9,8 +9,8 @@ zabbix_tls_stg_psk: "" # Upstream Zabbix *server* the proxy connects to (host:port → proxy ZBX_SERVER_HOST). zabbix_openshift_proxy_upstream_server_host: "zabbix01.stg.rdu3.fedoraproject.org:10051" # DaemonSet agent passive Server= (kube DNS name of proxy Service, no port). Agent resolves this to -# the ClusterIP proxies use for passive polls. Confirm: oc get svc -n zabbix (often zabbix-zabbix-proxy). -zabbix_openshift_agent_server_hostname: zabbix-zabbix-proxy.zabbix.svc.cluster.local +# the ClusterIP proxies use for passive polls. Helm chart installs Service zabbix-zabbix-helm-chart-proxy in ns zabbix. +zabbix_openshift_agent_server_hostname: zabbix-zabbix-helm-chart-proxy.zabbix.svc.cluster.local # Extra DaemonSet passive allowlist only (comma-separated IPs/hostnames/CIDR). Do NOT repeat # zabbix_openshift_agent_server_hostname — it is already in ZBX_SERVER_HOST; duplication breaks startup. # Add proxy/pod egress IPs seen in "connection from ... rejected" logs, e.g. "10.16.166.119". From 7ce80fab53c014b86c6adb4ccc0a8031e6ad74db Mon Sep 17 00:00:00 2001 From: David Kirwan Date: Mon, 11 May 2026 18:00:34 +0100 Subject: [PATCH 081/269] zabbix: debugging connections to agents Signed-off-by: David Kirwan --- roles/zabbix/zabbix_openshift_proxy/defaults/main.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/zabbix/zabbix_openshift_proxy/defaults/main.yml b/roles/zabbix/zabbix_openshift_proxy/defaults/main.yml index 30d3d49a73..a9903c5f91 100644 --- a/roles/zabbix/zabbix_openshift_proxy/defaults/main.yml +++ b/roles/zabbix/zabbix_openshift_proxy/defaults/main.yml @@ -13,5 +13,5 @@ zabbix_openshift_proxy_upstream_server_host: "zabbix01.stg.rdu3.fedoraproject.or zabbix_openshift_agent_server_hostname: zabbix-zabbix-helm-chart-proxy.zabbix.svc.cluster.local # Extra DaemonSet passive allowlist only (comma-separated IPs/hostnames/CIDR). Do NOT repeat # zabbix_openshift_agent_server_hostname — it is already in ZBX_SERVER_HOST; duplication breaks startup. -# Add proxy/pod egress IPs seen in "connection from ... rejected" logs, e.g. "10.16.166.119". -zabbix_openshift_agent_passiveservers_extra: "" +# Proxy / cluster egress IPs if DNS→ClusterIP does not match SYN source addresses. +zabbix_openshift_agent_passiveservers_extra: "10.16.166.118,10.16.166.119,10.16.166.120" From 6ef4d3c1586a2e9413b3c06643713da7bd76a463 Mon Sep 17 00:00:00 2001 From: James Antill Date: Mon, 11 May 2026 12:47:51 -0400 Subject: [PATCH 082/269] wiki.stg: Update to F44. --- inventory/host_vars/wiki01.stg.rdu3.fedoraproject.org | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/inventory/host_vars/wiki01.stg.rdu3.fedoraproject.org b/inventory/host_vars/wiki01.stg.rdu3.fedoraproject.org index af1b366341..05f8939b27 100644 --- a/inventory/host_vars/wiki01.stg.rdu3.fedoraproject.org +++ b/inventory/host_vars/wiki01.stg.rdu3.fedoraproject.org @@ -2,7 +2,7 @@ datacenter: rdu3 eth0_ipv4_gw: 10.16.166.254 eth0_ipv4_ip: 10.16.166.24 -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/42/Server/x86_64/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/x86_64/os/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora vmhost: vmhost-x86-03.stg.rdu3.fedoraproject.org volgroup: /dev/vg_guests From 28c056c4f731b54c782656f28c1ddd2d772644b8 Mon Sep 17 00:00:00 2001 From: James Antill Date: Mon, 11 May 2026 13:42:48 -0400 Subject: [PATCH 083/269] people: Use ProxyPassReverse to rewrite redirects, and remove the port. Signed-off-by: James Antill --- roles/people/templates/people.conf | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/roles/people/templates/people.conf b/roles/people/templates/people.conf index 3e18e101fb..5d9b693e2f 100644 --- a/roles/people/templates/people.conf +++ b/roles/people/templates/people.conf @@ -59,6 +59,13 @@ NameVirtualHost *:80 ProxyPass / http://[::1]:8923/ ProxyPassReverse / http://[::1]:8923/ + # This tells the proxy to remove the ports on redirects ... I think + # we need to use mod_rewrite if we want it to work for *.fp.o + ProxyPassReverse / http://fedorapeople.org:8923/ + ProxyPassReverse / http://ols.fedorapeople.org:8923/ + ProxyPassReverse / http://people.fedorapeople.org:8923/ + ProxyPassReverse / http://people1.fedorapeople.org:8923/ + SetHandler server-status From d59d39d281f699f352d83fa7d8e7990998681cab Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Mon, 11 May 2026 11:09:55 -0700 Subject: [PATCH 084/269] proxies: more changes for the sporadic 502 issue ( 12913 ) I got claude to dig into the things we tried to fix this issue and look for things we missed. It found a few things: 1. In commit 35a1b3223b Victor Koycheff added some proxyopts for keepalive, etc. However, unfortunately, while the variable was set the template wasn't looking at that, so they were never actually set in the website. ;( So, we fix that by passing the variable in the right template here. 2. kojihub didn't have a keepalive set on the backend. (but this is likely cosmetic since the problem is at the proxy layer). We fix this by adding one anyhow. 3. The pass thru anubis didn't have keepalive set right, so we do that in the template. This may fix other 502 issues with other applications also. Calude used 57,508 tokens looking at all this. ;) Assisted-By: claude Signed-off-by: Kevin Fenzi --- .../templates/reversepassproxy.conf-nonopenshift-rdu3 | 2 +- roles/httpd/website/templates/website.conf | 9 +++++++-- roles/koji_hub/templates/kojihub.conf.j2 | 1 + 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/roles/httpd/reverseproxy/templates/reversepassproxy.conf-nonopenshift-rdu3 b/roles/httpd/reverseproxy/templates/reversepassproxy.conf-nonopenshift-rdu3 index f5af7ffd83..a8598c2440 100644 --- a/roles/httpd/reverseproxy/templates/reversepassproxy.conf-nonopenshift-rdu3 +++ b/roles/httpd/reverseproxy/templates/reversepassproxy.conf-nonopenshift-rdu3 @@ -56,7 +56,7 @@ RewriteRule .* "balancer://{{ balancer_name }}-websocket%{REQUEST_URI}" [P] {% endif %} {% endfor %} -ProxyPass {{ localpath }} "balancer://{{balancer_name}}{{remotepath}}" +ProxyPass {{ localpath }} "balancer://{{balancer_name}}{{remotepath}}" {{ proxyopts|default('') }} ProxyPassReverse {{ localpath }} "balancer://{{balancer_name}}{{remotepath}}" {% endif %} {% else %} diff --git a/roles/httpd/website/templates/website.conf b/roles/httpd/website/templates/website.conf index a94bd10b1a..b919bac5eb 100644 --- a/roles/httpd/website/templates/website.conf +++ b/roles/httpd/website/templates/website.conf @@ -142,13 +142,18 @@ ProxyRequests Off ProxyVia Off +{% if site_name == 'koji.fedoraproject.org' or site_name == 'riscv-koji.fedoraproject.org' %} + + # Long timeout for koji operations (completeBuild with texlive, watch-task, watch-logs) + ProxyTimeout 10800 +{% endif %} {% if site_name.startswith('openqa') %} # Openqa uses websockets, so allow them through anubis proxying. - ProxyPass / http://127.0.0.1:8987/ upgrade=websocket + ProxyPass / http://127.0.0.1:8987/ upgrade=websocket keepalive=on ttl=10 ProxyPassReverse / http://127.0.0.1:8987/ {% else %} - ProxyPass / http://127.0.0.1:8987/ + ProxyPass / http://127.0.0.1:8987/ keepalive=on ttl=10 ProxyPassReverse / http://127.0.0.1:8987/ {% endif %} {% else %} diff --git a/roles/koji_hub/templates/kojihub.conf.j2 b/roles/koji_hub/templates/kojihub.conf.j2 index 7a28811667..39702625a4 100644 --- a/roles/koji_hub/templates/kojihub.conf.j2 +++ b/roles/koji_hub/templates/kojihub.conf.j2 @@ -3,6 +3,7 @@ # KeepAlive On +KeepAliveTimeout 15 MaxKeepAliveRequests 0 Alias /kojihub /usr/share/koji-hub/kojiapp.py From 645cfe048206c5801c898fd0e4bb01422615091b Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Mon, 11 May 2026 11:57:42 -0700 Subject: [PATCH 085/269] proxies: when using a apache balancer, options go on the balancer members Clanker lead me astray here. We can't pass options on the proxypass here because we are using a balancer, so we need to pass them on the balancer members. Signed-off-by: Kevin Fenzi --- .../templates/reversepassproxy.conf-nonopenshift-rdu3 | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/roles/httpd/reverseproxy/templates/reversepassproxy.conf-nonopenshift-rdu3 b/roles/httpd/reverseproxy/templates/reversepassproxy.conf-nonopenshift-rdu3 index a8598c2440..25da0d1200 100644 --- a/roles/httpd/reverseproxy/templates/reversepassproxy.conf-nonopenshift-rdu3 +++ b/roles/httpd/reverseproxy/templates/reversepassproxy.conf-nonopenshift-rdu3 @@ -50,13 +50,13 @@ RewriteRule .* "balancer://{{ balancer_name }}-websocket%{REQUEST_URI}" [P] {% for member in balancer_members %} {% if http_not_https_yes_this_is_insecure_and_i_feel_bad %} - BalancerMember "http://{{ member }}" + BalancerMember "http://{{ member }}" {{ proxyopts|default('') }} {% else %} - BalancerMember "https://{{ member }}" + BalancerMember "https://{{ member }}" {{ proxyopts|default('') }} {% endif %} {% endfor %} -ProxyPass {{ localpath }} "balancer://{{balancer_name}}{{remotepath}}" {{ proxyopts|default('') }} +ProxyPass {{ localpath }} "balancer://{{balancer_name}}{{remotepath}}" ProxyPassReverse {{ localpath }} "balancer://{{balancer_name}}{{remotepath}}" {% endif %} {% else %} From 274e23e33649b7e6b1c3b0efa4d7be227dca67a5 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Mon, 11 May 2026 11:59:06 -0700 Subject: [PATCH 086/269] proxies: set ttl on the anubis layer to 15 also to match up with other things Signed-off-by: Kevin Fenzi --- roles/httpd/website/templates/website.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/httpd/website/templates/website.conf b/roles/httpd/website/templates/website.conf index b919bac5eb..eef8d21d86 100644 --- a/roles/httpd/website/templates/website.conf +++ b/roles/httpd/website/templates/website.conf @@ -150,10 +150,10 @@ {% if site_name.startswith('openqa') %} # Openqa uses websockets, so allow them through anubis proxying. - ProxyPass / http://127.0.0.1:8987/ upgrade=websocket keepalive=on ttl=10 + ProxyPass / http://127.0.0.1:8987/ upgrade=websocket keepalive=on ttl=15 ProxyPassReverse / http://127.0.0.1:8987/ {% else %} - ProxyPass / http://127.0.0.1:8987/ keepalive=on ttl=10 + ProxyPass / http://127.0.0.1:8987/ keepalive=on ttl=15 ProxyPassReverse / http://127.0.0.1:8987/ {% endif %} {% else %} From 0df0dc0ec9155647adc3edc13e76035b313da1f2 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Mon, 11 May 2026 14:30:03 -0700 Subject: [PATCH 087/269] proxies / koji: lower the keepalive on the proxy side Signed-off-by: Kevin Fenzi --- playbooks/include/proxies-reverseproxy.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/playbooks/include/proxies-reverseproxy.yml b/playbooks/include/proxies-reverseproxy.yml index 386600e22c..a08e2db6c0 100644 --- a/playbooks/include/proxies-reverseproxy.yml +++ b/playbooks/include/proxies-reverseproxy.yml @@ -662,7 +662,7 @@ website: koji.fedoraproject.org destname: koji keephost: true - proxyopts: "keepalive=on ttl=10" + proxyopts: "keepalive=on ttl=5" balancer_name: koji balancer_members: - "koji01.{{ datacenter }}.fedoraproject.org" @@ -676,7 +676,7 @@ website: koji.fedoraproject.org destname: koji keephost: true - proxyopts: "keepalive=on ttl=10" + proxyopts: "keepalive=on ttl=5" balancer_name: koji balancer_members: - "koji01.stg.{{ datacenter }}.fedoraproject.org" From 76e322e65af020ed421ec0024cd1da68abd19f07 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Mon, 11 May 2026 15:11:29 -0700 Subject: [PATCH 088/269] koji / hub: try increasing the keepalive timeout here Signed-off-by: Kevin Fenzi --- roles/koji_hub/templates/kojihub.conf.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/koji_hub/templates/kojihub.conf.j2 b/roles/koji_hub/templates/kojihub.conf.j2 index 39702625a4..0bb3e97f05 100644 --- a/roles/koji_hub/templates/kojihub.conf.j2 +++ b/roles/koji_hub/templates/kojihub.conf.j2 @@ -3,7 +3,7 @@ # KeepAlive On -KeepAliveTimeout 15 +KeepAliveTimeout 30 MaxKeepAliveRequests 0 Alias /kojihub /usr/share/koji-hub/kojiapp.py From b641125564188b3d1dddd28852ff6be21df61d11 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Mon, 11 May 2026 17:35:41 -0700 Subject: [PATCH 089/269] proxies / redirectmatch / provisioning-server: I am not sure how this worked before, but it needs a regex Signed-off-by: Kevin Fenzi --- playbooks/include/proxies-redirects.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/playbooks/include/proxies-redirects.yml b/playbooks/include/proxies-redirects.yml index 35d3277502..58ad791f65 100644 --- a/playbooks/include/proxies-redirects.yml +++ b/playbooks/include/proxies-redirects.yml @@ -1022,6 +1022,7 @@ - role: httpd/redirectmatch shortname: provisioning-server website: provisioning.fedoraproject.org + regex: ^.* target: https://fedoraproject.org/iot/ tags: - provisioning From d6d3a4db545b18ab178ab5a3018a9438673c14a5 Mon Sep 17 00:00:00 2001 From: Ryan Lerch Date: Tue, 12 May 2026 17:47:34 +1000 Subject: [PATCH 090/269] add group team mappings for staging atomic-desktops and bootc related: https://forge.fedoraproject.org/forge/forge/issues/546 Signed-off-by: Ryan Lerch --- roles/openshift-apps/forgejo/templates/values.yaml.j2 | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/roles/openshift-apps/forgejo/templates/values.yaml.j2 b/roles/openshift-apps/forgejo/templates/values.yaml.j2 index 869a9c8db0..b9e6cf1b1b 100644 --- a/roles/openshift-apps/forgejo/templates/values.yaml.j2 +++ b/roles/openshift-apps/forgejo/templates/values.yaml.j2 @@ -454,7 +454,9 @@ gitea: "forge-playground-owners":{"playground":["Owners"]}, "forge-playground-members":{"playground":["Members"]}, "forge-quality-members":{"quality":["Members"]}, - "forge-quality-owners":{"quality":["Owners"]} + "forge-quality-owners":{"quality":["Owners"]}, + "forge-atomic-desktops-owners":{"atomic-desktops":["Owners"]}, + "forge-bootc-owners":{"bootc":["Owners"]} }' {% else %} group-team-map: '{ @@ -472,7 +474,7 @@ gitea: "forge-council-members":{"council":["Members"]}, "forge-server-owners":{"server":["Owners"]}, "forge-server-members":{"server":["Members"]}, - "forge-docs-owners":{"docs":["Owners"]}, + "forge-docs-owners":{"docs":["Owners"], "docs-archive:["Owners"]}, "forge-docs-members":{"docs":["Members"]}, "forge-docs-quickdocs":{"docs":["Quickdocs"]}, "forge-forge-owners":{"forge":["Owners"]}, From 7923f145d97129712918e294a268feb3e9656eb4 Mon Sep 17 00:00:00 2001 From: Ryan Lerch Date: Tue, 12 May 2026 18:01:20 +1000 Subject: [PATCH 091/269] fix typo in docs-archive group team mapping Signed-off-by: Ryan Lerch --- roles/openshift-apps/forgejo/templates/values.yaml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/forgejo/templates/values.yaml.j2 b/roles/openshift-apps/forgejo/templates/values.yaml.j2 index b9e6cf1b1b..42f77cc0e9 100644 --- a/roles/openshift-apps/forgejo/templates/values.yaml.j2 +++ b/roles/openshift-apps/forgejo/templates/values.yaml.j2 @@ -474,7 +474,7 @@ gitea: "forge-council-members":{"council":["Members"]}, "forge-server-owners":{"server":["Owners"]}, "forge-server-members":{"server":["Members"]}, - "forge-docs-owners":{"docs":["Owners"], "docs-archive:["Owners"]}, + "forge-docs-owners":{"docs":["Owners"], "docs-archive":["Owners"]}, "forge-docs-members":{"docs":["Members"]}, "forge-docs-quickdocs":{"docs":["Quickdocs"]}, "forge-forge-owners":{"forge":["Owners"]}, From 4a68303c368d8165fa447f1f98e4080ff8e82f12 Mon Sep 17 00:00:00 2001 From: Pavel Raiskup Date: Mon, 11 May 2026 21:24:32 +0200 Subject: [PATCH 092/269] copr-fe: unix-socket-auth for postgresql --- roles/copr/frontend/files/pg/pg_hba.conf | 5 +---- roles/copr/frontend/tasks/psql_setup.yml | 21 ++++++++++----------- roles/copr/frontend/templates/copr.conf | 2 +- 3 files changed, 12 insertions(+), 16 deletions(-) diff --git a/roles/copr/frontend/files/pg/pg_hba.conf b/roles/copr/frontend/files/pg/pg_hba.conf index 3cf2f2cb65..133a94707a 100644 --- a/roles/copr/frontend/files/pg/pg_hba.conf +++ b/roles/copr/frontend/files/pg/pg_hba.conf @@ -1,7 +1,4 @@ -local coprdb copr-fe md5 -host coprdb copr-fe 127.0.0.1/8 md5 -host coprdb copr-fe ::1/128 md5 -local coprdb postgres ident +local coprdb copr-fe peer # TYPE DATABASE USER ADDRESS METHOD diff --git a/roles/copr/frontend/tasks/psql_setup.yml b/roles/copr/frontend/tasks/psql_setup.yml index c1933addc7..ffe838f534 100644 --- a/roles/copr/frontend/tasks/psql_setup.yml +++ b/roles/copr/frontend/tasks/psql_setup.yml @@ -15,7 +15,12 @@ when: not postgres_initialized.stat.exists - name: Copy pg_hba.conf - ansible.builtin.copy: src="pg/pg_hba.conf" dest=/var/lib/pgsql/data/pg_hba.conf owner=postgres group=postgres mode=0600 + ansible.builtin.copy: + src: "pg/pg_hba.conf" + dest: /var/lib/pgsql/data/pg_hba.conf + owner: postgres + group: postgres + mode: '0600' notify: - Restart postgresql tags: @@ -52,7 +57,10 @@ become_user: postgres - name: Create db user - postgresql_user: db="coprdb" name="copr-fe" password="{{ copr_database_password }}" role_attr_flags=SUPERUSER,NOCREATEDB,NOCREATEROLE + postgresql_user: + db: "coprdb" + name: "copr-fe" + role_attr_flags: "SUPERUSER,NOCREATEDB,NOCREATEROLE" become: yes become_user: postgres @@ -134,15 +142,6 @@ group: copr-fe mode: "0600" -- name: Install pgpass file - ansible.builtin.copy: - content: | - localhost:*:coprdb:copr-fe:{{ copr_database_password }} - dest: "{{ copr_fe_homedir }}/.pgpass" - owner: copr-fe - group: copr-fe - mode: "0400" - - stat: path="{{ copr_fe_homedir }}/.psql_history" register: history_file diff --git a/roles/copr/frontend/templates/copr.conf b/roles/copr/frontend/templates/copr.conf index b1e25a51f3..e4f3007a9f 100644 --- a/roles/copr/frontend/templates/copr.conf +++ b/roles/copr/frontend/templates/copr.conf @@ -33,7 +33,7 @@ RESALLOC_URL = "{{ backend_base_url }}/resalloc" #USE_ALLOWED_USERS = False #ALLOWED_USERS = ['bonnie', 'clyde'] -SQLALCHEMY_DATABASE_URI = 'postgresql+psycopg2://copr-fe:{{ copr_database_password }}@/coprdb' +SQLALCHEMY_DATABASE_URI = 'postgresql+psycopg2://copr-fe@/coprdb' # Token length, defaults to 30 (max 255) #API_TOKEN_LENGTH = 30 From 04e230408e31755060d6435468565eb3037f22b5 Mon Sep 17 00:00:00 2001 From: Pavel Raiskup Date: Tue, 12 May 2026 09:55:32 +0200 Subject: [PATCH 093/269] copr-fe: no need to grant copr-fe db admin rights --- roles/copr/frontend/tasks/psql_setup.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/copr/frontend/tasks/psql_setup.yml b/roles/copr/frontend/tasks/psql_setup.yml index ffe838f534..98ce1020e7 100644 --- a/roles/copr/frontend/tasks/psql_setup.yml +++ b/roles/copr/frontend/tasks/psql_setup.yml @@ -60,7 +60,7 @@ postgresql_user: db: "coprdb" name: "copr-fe" - role_attr_flags: "SUPERUSER,NOCREATEDB,NOCREATEROLE" + role_attr_flags: "NOSUPERUSER,NOCREATEDB,NOCREATEROLE" become: yes become_user: postgres From 83c42baccbb894f048d858d18af81ea10f44b361 Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Tue, 12 May 2026 10:04:48 +0100 Subject: [PATCH 094/269] Add hostvars for buildhw-x86-14 Signed-off-by: Greg Sutcliffe --- .../buildhw-x86-13.rdu3.fedoraproject.org | 2 +- .../buildhw-x86-14.rdu3.fedoraproject.org | 70 +++++++++++++++++++ 2 files changed, 71 insertions(+), 1 deletion(-) create mode 100644 inventory/host_vars/buildhw-x86-14.rdu3.fedoraproject.org diff --git a/inventory/host_vars/buildhw-x86-13.rdu3.fedoraproject.org b/inventory/host_vars/buildhw-x86-13.rdu3.fedoraproject.org index 291232794d..479e242431 100644 --- a/inventory/host_vars/buildhw-x86-13.rdu3.fedoraproject.org +++ b/inventory/host_vars/buildhw-x86-13.rdu3.fedoraproject.org @@ -1,6 +1,6 @@ --- bmc: - ip_address: 10.16.160.25 + ip_address: 10.16.160.87 ping: true http: true https: true diff --git a/inventory/host_vars/buildhw-x86-14.rdu3.fedoraproject.org b/inventory/host_vars/buildhw-x86-14.rdu3.fedoraproject.org new file mode 100644 index 0000000000..64df912d59 --- /dev/null +++ b/inventory/host_vars/buildhw-x86-14.rdu3.fedoraproject.org @@ -0,0 +1,70 @@ +--- +bmc: + ip_address: 10.16.160.88 + ping: true + http: true + https: true +br0_ipv4_ip: 10.16.169.44 +br0_ipv4_gw: 10.16.169.254 +br0_ipv4_nm: 24 +datacenter: rdu3 +dns1: 10.16.163.33 +dns2: 10.16.163.34 +dns_search1: "rdu3.fedoraproject.org" +dns_search2: "fedoraproject.org" +has_ipv4: yes +mac0: b4:45:06:fb:84:2e +mac1: b4:45:06:fb:84:2f +mac2: 5c:6f:69:7f:ba:30 +mac3: 5c:6f:69:7f:ba:31 +network_connections: + # Bridge profile + - name: br0 + state: up + type: bridge + mtu: 1500 + autoconnect: yes + ip: + address: + - "{{ br0_ipv4_ip }}/{{ br0_ipv4_nm }}" + dhcp4: no + dns: + - "{{ dns1 }}" + - "{{ dns2 }}" + dns_search: + - "{{ dns_search1 }}" + - "{{ dns_search2 }}" + gateway4: "{{ br0_ipv4_gw }}" + # Bond profile + - name: bond0 + type: bond + interface_name: bond0 + mtu: 1500 + controller: br0 + bond: + mode: 802.3ad + # Port profile for the 1st Ethernet device + - name: bond0-port1 + mac: "{{ mac2 }}" + type: ethernet + controller: bond0 + state: up + mtu: 1500 + # Port profile for the 2nd Ethernet device + - name: bond0-port2 + mac: "{{ mac3 }}" + type: ethernet + controller: bond0 + state: up + mtu: 1500 +# This is used to populate the inventory fields, only specific keys are allowed, see +# https://www.zabbix.com/documentation/current/en/manual/api/reference/host/object#host-inventory +zabbix_inventory: + date_hw_expiry: "" + date_hw_purchase: "" + hardware: PowerEdge R450 + location: RDU3 + oob_ip: "{{ bmc.ip_address }}" + serialno_a: F922FZ3 + type: Prod_Dedicated_HW + vendor: Dell From 665456d9d939caf150734c04d51edcd4950669fa Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Tue, 12 May 2026 10:07:03 +0100 Subject: [PATCH 095/269] Add buildhw-x86-14 to inventory groups Signed-off-by: Greg Sutcliffe --- inventory/builders | 2 ++ inventory/hardware | 1 + 2 files changed, 3 insertions(+) diff --git a/inventory/builders b/inventory/builders index 13448e4fe8..f8e25c5ae2 100644 --- a/inventory/builders +++ b/inventory/builders @@ -297,6 +297,7 @@ buildhw-x86-09.rdu3.fedoraproject.org buildhw-x86-10.rdu3.fedoraproject.org buildhw-x86-12.rdu3.fedoraproject.org buildhw-x86-13.rdu3.fedoraproject.org +buildhw-x86-14.rdu3.fedoraproject.org [buildhw_stg] buildhw-p10-01.stg.rdu3.fedoraproject.org @@ -323,6 +324,7 @@ buildhw-x86-09.rdu3.fedoraproject.org buildhw-x86-10.rdu3.fedoraproject.org buildhw-x86-12.rdu3.fedoraproject.org buildhw-x86-13.rdu3.fedoraproject.org +buildhw-x86-14.rdu3.fedoraproject.org [buildhw_stg_rdu3] buildhw-p10-01.stg.rdu3.fedoraproject.org diff --git a/inventory/hardware b/inventory/hardware index 500861d19b..c050cb8214 100644 --- a/inventory/hardware +++ b/inventory/hardware @@ -23,6 +23,7 @@ buildhw-x86-09.rdu3.fedoraproject.org buildhw-x86-10.rdu3.fedoraproject.org buildhw-x86-12.rdu3.fedoraproject.org buildhw-x86-13.rdu3.fedoraproject.org +buildhw-x86-14.rdu3.fedoraproject.org ## Build vm hosts bvmhost-x86-01.rdu3.fedoraproject.org bvmhost-x86-02.rdu3.fedoraproject.org From dfa0766cff30eb7ae23f55b35a90ddf4896878d4 Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Tue, 12 May 2026 11:11:46 +0100 Subject: [PATCH 096/269] Zabbix: Improve vpnclients connectivity check Signed-off-by: Greg Sutcliffe --- .../client/files/zabbix/template-openvpn.yml | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/roles/openvpn/client/files/zabbix/template-openvpn.yml b/roles/openvpn/client/files/zabbix/template-openvpn.yml index efe2dd3d8e..9930e9940b 100644 --- a/roles/openvpn/client/files/zabbix/template-openvpn.yml +++ b/roles/openvpn/client/files/zabbix/template-openvpn.yml @@ -14,7 +14,7 @@ zabbix_export: - uuid: eb73132afa214eb483990804bd4cb4bf name: 'OpenVPN Client connectivity performance' type: ZABBIX_ACTIVE - key: 'net.tcp.service.perf[http,192.168.1.41,80]' + key: 'net.tcp.service.perf[http,bastion.vpn.fedoraproject.org,25]' value_type: FLOAT units: ms preprocessing: @@ -26,23 +26,27 @@ zabbix_export: value: openvpn - tag: component value: network + - tag: scope + value: performance triggers: - uuid: d81b2b0d733f4cb09cb83d8fbf627b4f - expression: 'min(/OpenVPN Client/net.tcp.service.perf[http,192.168.1.41,80],5m)>{$OPENVPN.PING_TIME.MAX}' + expression: 'min(/OpenVPN Client/net.tcp.service.perf[http,bastion.vpn.fedoraproject.org,25],5m)>{$OPENVPN.PING_TIME.MAX}' name: 'OpenVPN: Ping time is too high (over {$OPENVPN.PING_TIME.MAX}ms for 5m)' priority: WARNING - uuid: cd9f75e2ee7540d3a5d00a48c5aa00f1 name: 'OpenVPN Client connectivity' type: ZABBIX_ACTIVE - key: 'net.tcp.service[http,192.168.1.41,80]' + key: 'net.tcp.service[http,bastion.vpn.fedoraproject.org,25]' tags: - tag: application value: openvpn - tag: component value: network + - tag: scope + value: connectivity triggers: - uuid: d82801a9fe9b405890b0a46705fe6599 - expression: 'max(/OpenVPN Client/net.tcp.service[http,192.168.1.41,80],#3)<1' + expression: 'max(/OpenVPN Client/net.tcp.service[http,bastion.vpn.fedoraproject.org,25],#3)=0' name: 'OpenVPN: Client cannot ping batcave01' priority: AVERAGE - uuid: 93da423abd37459e9d5478e183048bd9 @@ -81,5 +85,5 @@ zabbix_export: value: openvpn macros: - macro: '{$OPENVPN.PING_TIME.MAX}' - value: '400' + value: '1000' description: 'ms warning time for openvpn performance' From 55a7c1c9f907168b937b376b839258464fa366b0 Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Tue, 12 May 2026 11:13:44 +0100 Subject: [PATCH 097/269] Nagios: remove vpnclients check, migrated to Zabbix Signed-off-by: Greg Sutcliffe --- roles/nagios_server/files/nagios/services/vpnclients.cfg | 6 ------ roles/nagios_server/tasks/main.yml | 1 - 2 files changed, 7 deletions(-) delete mode 100644 roles/nagios_server/files/nagios/services/vpnclients.cfg diff --git a/roles/nagios_server/files/nagios/services/vpnclients.cfg b/roles/nagios_server/files/nagios/services/vpnclients.cfg deleted file mode 100644 index 13142f0f2c..0000000000 --- a/roles/nagios_server/files/nagios/services/vpnclients.cfg +++ /dev/null @@ -1,6 +0,0 @@ -define service { - hostgroup_name vpnclients - service_description vpnclients - check_command check_by_nrpe!check_openvpn_link - use defaulttemplate -} diff --git a/roles/nagios_server/tasks/main.yml b/roles/nagios_server/tasks/main.yml index 6200f8adf0..a22f3c13c7 100644 --- a/roles/nagios_server/tasks/main.yml +++ b/roles/nagios_server/tasks/main.yml @@ -234,7 +234,6 @@ - ssl.cfg - swap.cfg - templates.cfg - - vpnclients.cfg - vpn_server.cfg tags: - nagios_config From 05b94d70291ce42e7fc6b970d964c3b8ae4ea348 Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Tue, 12 May 2026 13:54:35 +0100 Subject: [PATCH 098/269] Zabbix: Improve Postfix queue trigger/recovery Signed-off-by: Greg Sutcliffe --- roles/base/files/postfix/zabbix-template.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/roles/base/files/postfix/zabbix-template.yml b/roles/base/files/postfix/zabbix-template.yml index ab8d9a308b..8acfdb1196 100644 --- a/roles/base/files/postfix/zabbix-template.yml +++ b/roles/base/files/postfix/zabbix-template.yml @@ -1,7 +1,7 @@ zabbix_export: version: '7.0' template_groups: - - uuid: 372f19ba622745aaa43b4fa0b5168262 + - uuid: a333cbd6a3ad44baaa4eee4b0c0b1bec name: Fedora templates: - uuid: 76985efe0ea1479aa3d24a0a2c64e6d2 @@ -21,7 +21,9 @@ zabbix_export: value: queue triggers: - uuid: cc9ff19b502940af950215a931ee4079 - expression: 'monoinc(/Postfix Mail Queue/postfix.queue,15m,"weak")=0 and last(/Postfix Mail Queue/postfix.queue)>{$POSTFIX.QUEUE.WARN}' + expression: 'monoinc(/Postfix Mail Queue/postfix.queue,15m,"strict")=1 and last(/Postfix Mail Queue/postfix.queue)>{$POSTFIX.QUEUE.WARN}' + recovery_mode: RECOVERY_EXPRESSION + recovery_expression: 'monoinc(/Postfix Mail Queue/postfix.queue,15m,"strict")=0 and last(/Postfix Mail Queue/postfix.queue)<{$POSTFIX.QUEUE.WARN}' name: 'Postfix: increasing mails in mailq - {ITEM.LASTVALUE1} queued' opdata: '{ITEM.LASTVALUE1} mails queued' priority: HIGH From db4f19c2add32448dde2716185ecfb95a4e4a5be Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Tue, 12 May 2026 14:37:24 -0700 Subject: [PATCH 099/269] oci-registry01.stg: move to f44 Signed-off-by: Kevin Fenzi --- inventory/host_vars/oci-registry01.stg.rdu3.fedoraproject.org | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/inventory/host_vars/oci-registry01.stg.rdu3.fedoraproject.org b/inventory/host_vars/oci-registry01.stg.rdu3.fedoraproject.org index b655cd5622..52eb0ebdf1 100644 --- a/inventory/host_vars/oci-registry01.stg.rdu3.fedoraproject.org +++ b/inventory/host_vars/oci-registry01.stg.rdu3.fedoraproject.org @@ -2,7 +2,7 @@ datacenter: rdu3 eth0_ipv4_gw: 10.16.167.254 eth0_ipv4_ip: 10.16.167.35 -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/42/Server/x86_64/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/x86_64/os/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora lvm_size: 120g max_mem_size: 16384 From 22f47d356ad664c505f79fced6f39f4bc2e56854 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Tue, 12 May 2026 15:49:05 -0700 Subject: [PATCH 100/269] dl03: move to rhel10 Signed-off-by: Kevin Fenzi --- inventory/host_vars/dl03.rdu3.fedoraproject.org | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/inventory/host_vars/dl03.rdu3.fedoraproject.org b/inventory/host_vars/dl03.rdu3.fedoraproject.org index 1e118d8883..d387ce45c1 100644 --- a/inventory/host_vars/dl03.rdu3.fedoraproject.org +++ b/inventory/host_vars/dl03.rdu3.fedoraproject.org @@ -29,7 +29,7 @@ network_connections: type: ethernet state: up mtu: 1500 -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel lvm_size: 50000 max_mem_size: 20480 From c55e6f0893641ff25deafab4b2f9211b3991597c Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Tue, 12 May 2026 15:59:45 -0700 Subject: [PATCH 101/269] kickstarts: make a rhel10 kvm kickstart and have dl03 use it. Signed-off-by: Kevin Fenzi --- .../host_vars/dl03.rdu3.fedoraproject.org | 2 +- roles/kickstarts/templates/kvm-rhel-10.j2 | 78 +++++++++++++++++++ 2 files changed, 79 insertions(+), 1 deletion(-) create mode 100644 roles/kickstarts/templates/kvm-rhel-10.j2 diff --git a/inventory/host_vars/dl03.rdu3.fedoraproject.org b/inventory/host_vars/dl03.rdu3.fedoraproject.org index d387ce45c1..982c347e77 100644 --- a/inventory/host_vars/dl03.rdu3.fedoraproject.org +++ b/inventory/host_vars/dl03.rdu3.fedoraproject.org @@ -30,7 +30,7 @@ network_connections: state: up mtu: 1500 ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 lvm_size: 50000 max_mem_size: 20480 mem_size: 16384 diff --git a/roles/kickstarts/templates/kvm-rhel-10.j2 b/roles/kickstarts/templates/kvm-rhel-10.j2 new file mode 100644 index 0000000000..b648890f67 --- /dev/null +++ b/roles/kickstarts/templates/kvm-rhel-10.j2 @@ -0,0 +1,78 @@ +text +skipx +# License Agreement +eula --agreed +# Network information + +# Setup Repository info +url --url=https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +repo --name=epel --baseurl=https://infrastructure.fedoraproject.org/pub/epel/10/Everything/x86_64/ +repo --name="net-baseos" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/x86_64/baseos/ +repo --name="net-appstream" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/x86_64/appstream +repo --name="net-crb" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/x86_64/crb +# Run the Setup Agent on first boot +firstboot --disable +# Keyboard layouts +keyboard --vckeymap=us --xlayouts='us' +# System language +lang en_US.UTF-8 --addsupport=en_GB.UTF-8 +# Root password +rootpw --iscrypted "{{ kickstart_initial_password_encrypted }}" +# System timezone +timezone UTC --utc +# System bootloader configuration +zerombr +bootloader --append="net.ifnames=0 crashkernel=auto" --location=mbr --boot-drive=vda +# Partition clearing information +clearpart --initlabel --all +# Filesystem Data +reqpart --add-boot +part pv.100 --fstype="lvmpv" --size=1000 --grow +volgroup vg_vm --pesize=4096 pv.100 +logvol / --fstype="xfs" --size=10000 --name=LogVol00 --vgname=vg_vm --grow +logvol swap --fstype="swap" --size=8192 --name=LogVol01 --vgname=vg_vm +# What to do at the end +reboot + +%packages +@core +authselect-compat +bash-completion +bind-utils +cronie-noanacron +crontabs +dhclient +iptables-services +nfs-utils +nmap-ncat +openssh-clients +openssh-server +patch +postfix +python3 +python3-libselinux +rsync +rsyslog +strace +telnet +tmpwatch +tmux +traceroute +vim-enhanced +yum +yum-utils +zsh +-biosdevname +-cronie-anacron +-subscription-manager +-insights-client +-rhc +-iwl* +-yum-rhn-plugin +%end + +%post --nochroot --log=/mnt/sysimage/root/post.output --erroronfail +mkdir /mnt/sysimage/root/tmp +chroot /mnt/sysimage /usr/bin/curl https://infrastructure.fedoraproject.org/rhel/ks/post/rhel10-post.sh -o /root/tmp/rhel10-post.sh +chroot /mnt/sysimage /bin/bash /root/tmp/rhel10-post.sh +%end From 8f3def5c9117cfcf1bcd8658bb255ead4c349981 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Tue, 12 May 2026 16:01:51 -0700 Subject: [PATCH 102/269] batcave01: also install the new kickstart template Signed-off-by: Kevin Fenzi --- roles/kickstarts/tasks/main.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/roles/kickstarts/tasks/main.yml b/roles/kickstarts/tasks/main.yml index a3e40acefd..f31e889926 100644 --- a/roles/kickstarts/tasks/main.yml +++ b/roles/kickstarts/tasks/main.yml @@ -8,6 +8,7 @@ - kvm-fedora-s390x - kvm-rhel - kvm-rhel-8 + - kvm-rhel-10 - hardware-rhel-9-08disk - hardware-rhel-9-06disk - hardware-rhel-9-06disk-aarch64 From 8c54ea4badcddaec835460e21a671d0ec0cda08d Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Tue, 12 May 2026 16:18:25 -0700 Subject: [PATCH 103/269] kickstarts: kvm-rhel-10: fix repo paths Signed-off-by: Kevin Fenzi --- roles/kickstarts/templates/kvm-rhel-10.j2 | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/roles/kickstarts/templates/kvm-rhel-10.j2 b/roles/kickstarts/templates/kvm-rhel-10.j2 index b648890f67..e23a4568db 100644 --- a/roles/kickstarts/templates/kvm-rhel-10.j2 +++ b/roles/kickstarts/templates/kvm-rhel-10.j2 @@ -7,9 +7,9 @@ eula --agreed # Setup Repository info url --url=https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ repo --name=epel --baseurl=https://infrastructure.fedoraproject.org/pub/epel/10/Everything/x86_64/ -repo --name="net-baseos" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/x86_64/baseos/ -repo --name="net-appstream" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/x86_64/appstream -repo --name="net-crb" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/x86_64/crb +repo --name="net-baseos" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/baseos/ +repo --name="net-appstream" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/appstream/ +repo --name="net-crb" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/crb/ # Run the Setup Agent on first boot firstboot --disable # Keyboard layouts From c7349dadea9545b517b6fb64d8176bca439c9295 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Tue, 12 May 2026 16:23:32 -0700 Subject: [PATCH 104/269] kickstarts / kvm-rhel-10: drop packages that do not exist in rhel10 Signed-off-by: Kevin Fenzi --- roles/kickstarts/templates/kvm-rhel-10.j2 | 2 -- 1 file changed, 2 deletions(-) diff --git a/roles/kickstarts/templates/kvm-rhel-10.j2 b/roles/kickstarts/templates/kvm-rhel-10.j2 index e23a4568db..2051ca6f2d 100644 --- a/roles/kickstarts/templates/kvm-rhel-10.j2 +++ b/roles/kickstarts/templates/kvm-rhel-10.j2 @@ -36,12 +36,10 @@ reboot %packages @core -authselect-compat bash-completion bind-utils cronie-noanacron crontabs -dhclient iptables-services nfs-utils nmap-ncat From 550aad5c292b54338d8445bf084a1ebf8619a8cb Mon Sep 17 00:00:00 2001 From: Ryan Lerch Date: Wed, 13 May 2026 09:27:06 +1000 Subject: [PATCH 105/269] forge: add group team mappings for R sig related: https://forge.fedoraproject.org/forge/forge/issues/545 Signed-off-by: Ryan Lerch --- roles/openshift-apps/forgejo/templates/values.yaml.j2 | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/roles/openshift-apps/forgejo/templates/values.yaml.j2 b/roles/openshift-apps/forgejo/templates/values.yaml.j2 index 42f77cc0e9..5dce94744b 100644 --- a/roles/openshift-apps/forgejo/templates/values.yaml.j2 +++ b/roles/openshift-apps/forgejo/templates/values.yaml.j2 @@ -570,7 +570,8 @@ gitea: "forge-magazine-owners":{"magazine":["Owners"]}, "forge-magazine-members":{"magazine":["Members"]}, "forge-matrix-owners":{"matrix":["Owners"]}, - "forge-hummingbird-owners":{"hummingbird":["Owners"]} + "forge-hummingbird-owners":{"hummingbird":["Owners"]}, + "forge-r-owners":{"r":["Owners"]} }' {% endif %} # - name: 'OAuth 1' From eb0e697fabc088ba4db7964e756c9461e67c9ae4 Mon Sep 17 00:00:00 2001 From: Ryan Lerch Date: Wed, 13 May 2026 09:32:38 +1000 Subject: [PATCH 106/269] forge: add group team mappings for the fdwg org related: https://forge.fedoraproject.org/forge/forge/issues/559 Signed-off-by: Ryan Lerch --- roles/openshift-apps/forgejo/templates/values.yaml.j2 | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/roles/openshift-apps/forgejo/templates/values.yaml.j2 b/roles/openshift-apps/forgejo/templates/values.yaml.j2 index 5dce94744b..7b638b6a40 100644 --- a/roles/openshift-apps/forgejo/templates/values.yaml.j2 +++ b/roles/openshift-apps/forgejo/templates/values.yaml.j2 @@ -571,7 +571,9 @@ gitea: "forge-magazine-members":{"magazine":["Members"]}, "forge-matrix-owners":{"matrix":["Owners"]}, "forge-hummingbird-owners":{"hummingbird":["Owners"]}, - "forge-r-owners":{"r":["Owners"]} + "forge-r-owners":{"r":["Owners"]}, + "forge-fdwg-owners":{"fdwg":["Owners"]}, + "forge-fdwg-members":{"fdwg":["Members"]} }' {% endif %} # - name: 'OAuth 1' From 0986ae491b39aeb260754c19a789bda7aba36b39 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Tue, 12 May 2026 16:37:18 -0700 Subject: [PATCH 107/269] kickstarts / kvm-rhel-10: we need selinux-policy-epel to set things for epel packages Signed-off-by: Kevin Fenzi --- roles/kickstarts/templates/kvm-rhel-10.j2 | 1 + 1 file changed, 1 insertion(+) diff --git a/roles/kickstarts/templates/kvm-rhel-10.j2 b/roles/kickstarts/templates/kvm-rhel-10.j2 index 2051ca6f2d..c55766e9e8 100644 --- a/roles/kickstarts/templates/kvm-rhel-10.j2 +++ b/roles/kickstarts/templates/kvm-rhel-10.j2 @@ -51,6 +51,7 @@ python3 python3-libselinux rsync rsyslog +selinux-policy-epel strace telnet tmpwatch From bb9984ec61979062c27b700154c3cc4f3422975e Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Tue, 12 May 2026 16:40:06 -0700 Subject: [PATCH 108/269] kickstarts / kvm-rhel-10: use the new 10.1 name Signed-off-by: Kevin Fenzi --- roles/kickstarts/templates/kvm-rhel-10.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/kickstarts/templates/kvm-rhel-10.j2 b/roles/kickstarts/templates/kvm-rhel-10.j2 index c55766e9e8..0fefb1717b 100644 --- a/roles/kickstarts/templates/kvm-rhel-10.j2 +++ b/roles/kickstarts/templates/kvm-rhel-10.j2 @@ -51,7 +51,7 @@ python3 python3-libselinux rsync rsyslog -selinux-policy-epel +selinux-policy-targeted-extra strace telnet tmpwatch From 8e461e50f5d76232e8d240337064c98e1babc680 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Tue, 12 May 2026 16:55:25 -0700 Subject: [PATCH 109/269] dl04: move to rhel10 Signed-off-by: Kevin Fenzi --- inventory/host_vars/dl04.rdu3.fedoraproject.org | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/inventory/host_vars/dl04.rdu3.fedoraproject.org b/inventory/host_vars/dl04.rdu3.fedoraproject.org index 645e09e38d..d458a05a73 100644 --- a/inventory/host_vars/dl04.rdu3.fedoraproject.org +++ b/inventory/host_vars/dl04.rdu3.fedoraproject.org @@ -29,8 +29,8 @@ network_connections: type: ethernet state: up mtu: 1500 -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 lvm_size: 50000 max_mem_size: 20480 mem_size: 16384 From 6533d2ae712e9c02d1ac09413e75a0cc26a13645 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Tue, 12 May 2026 17:11:46 -0700 Subject: [PATCH 110/269] dl05: move to rhel10 Signed-off-by: Kevin Fenzi --- inventory/host_vars/dl05.rdu3.fedoraproject.org | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/inventory/host_vars/dl05.rdu3.fedoraproject.org b/inventory/host_vars/dl05.rdu3.fedoraproject.org index 65ce0111c5..a783e60d67 100644 --- a/inventory/host_vars/dl05.rdu3.fedoraproject.org +++ b/inventory/host_vars/dl05.rdu3.fedoraproject.org @@ -29,8 +29,8 @@ network_connections: type: ethernet state: up mtu: 1500 -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 lvm_size: 50000 max_mem_size: 20480 mem_size: 16384 From 4480adb270cf2b1fc1dbc5ade5d5820b0190dc10 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Tue, 12 May 2026 17:24:38 -0700 Subject: [PATCH 111/269] dl02: move to rhel10 Signed-off-by: Kevin Fenzi --- inventory/host_vars/dl02.rdu3.fedoraproject.org | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/inventory/host_vars/dl02.rdu3.fedoraproject.org b/inventory/host_vars/dl02.rdu3.fedoraproject.org index f700b455c6..63631199bf 100644 --- a/inventory/host_vars/dl02.rdu3.fedoraproject.org +++ b/inventory/host_vars/dl02.rdu3.fedoraproject.org @@ -29,8 +29,8 @@ network_connections: type: ethernet state: up mtu: 1500 -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 lvm_size: 50000 max_mem_size: 20480 mem_size: 16384 From dd2e76880a6fc3f93480709c356a6dd58146345e Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Tue, 12 May 2026 17:38:49 -0700 Subject: [PATCH 112/269] dl01: move to rhel10 Signed-off-by: Kevin Fenzi --- inventory/host_vars/dl01.rdu3.fedoraproject.org | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/inventory/host_vars/dl01.rdu3.fedoraproject.org b/inventory/host_vars/dl01.rdu3.fedoraproject.org index b9e8d57ca2..b5d366bc4a 100644 --- a/inventory/host_vars/dl01.rdu3.fedoraproject.org +++ b/inventory/host_vars/dl01.rdu3.fedoraproject.org @@ -29,8 +29,8 @@ network_connections: type: ethernet state: up mtu: 1500 -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 lvm_size: 50000 max_mem_size: 20480 mem_size: 16384 From 6f91abc606e0ec79045708a3bd9ccfbb27c320a6 Mon Sep 17 00:00:00 2001 From: Samyak Jain Date: Wed, 13 May 2026 16:29:58 +0530 Subject: [PATCH 113/269] Add releng org in forge staging Signed-off-by: Samyak Jain --- roles/openshift-apps/forgejo/templates/values.yaml.j2 | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/roles/openshift-apps/forgejo/templates/values.yaml.j2 b/roles/openshift-apps/forgejo/templates/values.yaml.j2 index 7b638b6a40..19553000ed 100644 --- a/roles/openshift-apps/forgejo/templates/values.yaml.j2 +++ b/roles/openshift-apps/forgejo/templates/values.yaml.j2 @@ -456,7 +456,9 @@ gitea: "forge-quality-members":{"quality":["Members"]}, "forge-quality-owners":{"quality":["Owners"]}, "forge-atomic-desktops-owners":{"atomic-desktops":["Owners"]}, - "forge-bootc-owners":{"bootc":["Owners"]} + "forge-bootc-owners":{"bootc":["Owners"]}, + "forge-releng-members":{"releng":["Members"]}, + "forge-releng-owners":{"releng":["Owners"]} }' {% else %} group-team-map: '{ From ebb316eedd52c7166bb98165ffdb43859626b7e6 Mon Sep 17 00:00:00 2001 From: David Kirwan Date: Wed, 13 May 2026 15:47:37 +0100 Subject: [PATCH 114/269] forgejo: Update runnerhost vm template with subdomain/hostname Signed-off-by: David Kirwan --- roles/openshift-apps/forgejo/defaults/main.yml | 3 +++ .../tasks/create-forgejo-runnerhost-vm.yaml | 11 +++++++++++ ...forgejo-runnerhost-headless-service.yaml.j2 | 18 ++++++++++++++++++ .../templates/forgejo-runnerhost-vm.yaml.j2 | 4 ++-- 4 files changed, 34 insertions(+), 2 deletions(-) create mode 100644 roles/openshift-apps/forgejo/templates/forgejo-runnerhost-headless-service.yaml.j2 diff --git a/roles/openshift-apps/forgejo/defaults/main.yml b/roles/openshift-apps/forgejo/defaults/main.yml index 8864206d04..497cdfdb3b 100644 --- a/roles/openshift-apps/forgejo/defaults/main.yml +++ b/roles/openshift-apps/forgejo/defaults/main.yml @@ -1,5 +1,8 @@ --- forgejo_namespace: "forgejo" +# KubeVirt headless Service name; must match spec.template.spec.subdomain and the +# network.kubevirt.io/headlessService label (cluster DNS: ...svc.cluster.local). +forgejo_runnerhost_headless_service_name: "forgejo-runnerhost" forgejo_project_description: "Forgejo Gitforge" forgejo_application_name: "{{ forgejo_namespace }}" diff --git a/roles/openshift-apps/forgejo/tasks/create-forgejo-runnerhost-vm.yaml b/roles/openshift-apps/forgejo/tasks/create-forgejo-runnerhost-vm.yaml index fe5ae1b45f..ad6141678f 100644 --- a/roles/openshift-apps/forgejo/tasks/create-forgejo-runnerhost-vm.yaml +++ b/roles/openshift-apps/forgejo/tasks/create-forgejo-runnerhost-vm.yaml @@ -1,4 +1,15 @@ --- +- name: Generate the forgejo-runnerhost-headless-service.yaml from template + ansible.builtin.template: + src: "forgejo-runnerhost-headless-service.yaml.j2" + dest: "/root/ocp4/openshift-apps/forgejo/forgejo-runnerhost-headless-service.yaml" + mode: "0770" + +- name: Deploy the forgejo-runnerhost headless Service + kubernetes.core.k8s: + state: present + src: "/root/ocp4/openshift-apps/forgejo/forgejo-runnerhost-headless-service.yaml" + - name: Generate the forgejo-runnerhost-vm.yaml from template ansible.builtin.template: src: "forgejo-runnerhost-vm.yaml.j2" diff --git a/roles/openshift-apps/forgejo/templates/forgejo-runnerhost-headless-service.yaml.j2 b/roles/openshift-apps/forgejo/templates/forgejo-runnerhost-headless-service.yaml.j2 new file mode 100644 index 0000000000..ae47479d3c --- /dev/null +++ b/roles/openshift-apps/forgejo/templates/forgejo-runnerhost-headless-service.yaml.j2 @@ -0,0 +1,18 @@ +--- +# Headless Service for KubeVirt VM pod DNS (subdomain + network.kubevirt.io/headlessService on the VM). +# VirtualMachine FQDN: .{{ forgejo_runnerhost_headless_service_name }}.{{ forgejo_namespace }}.svc.cluster.local +apiVersion: v1 +kind: Service +metadata: + name: "{{ forgejo_runnerhost_headless_service_name }}" + namespace: {{ forgejo_namespace }} +spec: + clusterIP: None + selector: + network.kubevirt.io/headlessService: "{{ forgejo_runnerhost_headless_service_name }}" + ports: + # Required by Service; not used for VM connectivity (masquerade handles traffic). + - name: placeholder + port: 15017 + targetPort: 15017 + protocol: TCP diff --git a/roles/openshift-apps/forgejo/templates/forgejo-runnerhost-vm.yaml.j2 b/roles/openshift-apps/forgejo/templates/forgejo-runnerhost-vm.yaml.j2 index e4f4ca1bef..97d3787479 100644 --- a/roles/openshift-apps/forgejo/templates/forgejo-runnerhost-vm.yaml.j2 +++ b/roles/openshift-apps/forgejo/templates/forgejo-runnerhost-vm.yaml.j2 @@ -29,7 +29,7 @@ spec: metadata: creationTimestamp: null labels: - network.kubevirt.io/headlessService: headless + network.kubevirt.io/headlessService: "{{ forgejo_runnerhost_headless_service_name }}" spec: serviceAccountName: forgejo-runner-vm architecture: amd64 @@ -50,7 +50,7 @@ spec: networks: - name: default pod: {} - subdomain: headless + subdomain: "{{ forgejo_runnerhost_headless_service_name }}" volumes: - dataVolume: name: forgejo-runnerhost-vm-volume From f838451f812fd50d6d492cd22d9c76d31d686039 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Wed, 13 May 2026 09:11:29 -0700 Subject: [PATCH 115/269] download-iso01: move to rhel10 Signed-off-by: Kevin Fenzi --- inventory/host_vars/download-iso01.rdu3.fedoraproject.org | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/inventory/host_vars/download-iso01.rdu3.fedoraproject.org b/inventory/host_vars/download-iso01.rdu3.fedoraproject.org index 35e715d89c..a0a9fb02d5 100644 --- a/inventory/host_vars/download-iso01.rdu3.fedoraproject.org +++ b/inventory/host_vars/download-iso01.rdu3.fedoraproject.org @@ -10,8 +10,8 @@ eth0_ipv6_ip: 2620:52:6:1161::35 eth0_ipv6_nm: 64 eth0_nm: 255.255.255.0 has_ipv6: yes -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 lvm_size: 50000 max_mem_size: 49152 mem_size: 32768 From acc8549a103bafe581db04b629870267ff311355 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Wed, 13 May 2026 09:34:23 -0700 Subject: [PATCH 116/269] download-ib01: move to rhel10 Signed-off-by: Kevin Fenzi --- inventory/host_vars/download-ib01.fedoraproject.org | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/inventory/host_vars/download-ib01.fedoraproject.org b/inventory/host_vars/download-ib01.fedoraproject.org index a363b91903..28796729e8 100644 --- a/inventory/host_vars/download-ib01.fedoraproject.org +++ b/inventory/host_vars/download-ib01.fedoraproject.org @@ -11,9 +11,9 @@ eth0_ipv6_ip: "2606:f640:6000:651::10" eth0_ipv6_gw: "2606:f640:6000:651::1" eth0_ipv6_nm: 64 has_ipv6: yes -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel -lvm_size: 150000 +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 +lvm_size: 100000 main_bridge: br0 max_mem_size: 49152 mem_size: 32768 From ce30489068777ac678b9fb3953f4d5c1927e2f03 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Wed, 13 May 2026 10:01:00 -0700 Subject: [PATCH 117/269] oci-candidate-registry01.stg: move to f44 Signed-off-by: Kevin Fenzi --- .../oci-candidate-registry01.stg.rdu3.fedoraproject.org | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/inventory/host_vars/oci-candidate-registry01.stg.rdu3.fedoraproject.org b/inventory/host_vars/oci-candidate-registry01.stg.rdu3.fedoraproject.org index 684163b49a..1236c567a5 100644 --- a/inventory/host_vars/oci-candidate-registry01.stg.rdu3.fedoraproject.org +++ b/inventory/host_vars/oci-candidate-registry01.stg.rdu3.fedoraproject.org @@ -2,7 +2,7 @@ datacenter: rdu3 eth0_ipv4_gw: 10.16.167.254 eth0_ipv4_ip: 10.16.167.34 -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/42/Server/x86_64/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/x86_64/os/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora lvm_size: 120g max_mem_size: 16384 From a38aeeab1b2434ed32a4fb4decdbe759c89f8d0e Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Wed, 13 May 2026 10:34:46 -0700 Subject: [PATCH 118/269] oci-registry02: move to f44 Signed-off-by: Kevin Fenzi --- inventory/host_vars/oci-registry02.rdu3.fedoraproject.org | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/inventory/host_vars/oci-registry02.rdu3.fedoraproject.org b/inventory/host_vars/oci-registry02.rdu3.fedoraproject.org index 3670ce979f..428c28d6ff 100644 --- a/inventory/host_vars/oci-registry02.rdu3.fedoraproject.org +++ b/inventory/host_vars/oci-registry02.rdu3.fedoraproject.org @@ -2,7 +2,7 @@ datacenter: rdu3 eth0_ipv4_gw: 10.16.169.254 eth0_ipv4_ip: 10.16.169.127 -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/42/Server/x86_64/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/x86_64/os/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora lvm_size: 120g max_mem_size: 16384 From c14a9c63af1e1893a4e6199c6db835f5ad586c1d Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Wed, 13 May 2026 10:55:15 -0700 Subject: [PATCH 119/269] oci-registry01: move to f44 Signed-off-by: Kevin Fenzi --- inventory/host_vars/oci-registry01.rdu3.fedoraproject.org | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/inventory/host_vars/oci-registry01.rdu3.fedoraproject.org b/inventory/host_vars/oci-registry01.rdu3.fedoraproject.org index 46a175682c..94838530f8 100644 --- a/inventory/host_vars/oci-registry01.rdu3.fedoraproject.org +++ b/inventory/host_vars/oci-registry01.rdu3.fedoraproject.org @@ -2,7 +2,7 @@ datacenter: rdu3 eth0_ipv4_gw: 10.16.169.254 eth0_ipv4_ip: 10.16.169.119 -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/42/Server/x86_64/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/x86_64/os/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora lvm_size: 120g max_mem_size: 16384 From 0d8779bc60e5c3c61c2a3c10cc07253523979b61 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Wed, 13 May 2026 11:11:18 -0700 Subject: [PATCH 120/269] debuginfod: are now both f44 Signed-off-by: Kevin Fenzi --- inventory/host_vars/debuginfod01.rdu3.fedoraproject.org | 2 +- inventory/host_vars/debuginfod01.stg.rdu3.fedoraproject.org | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/inventory/host_vars/debuginfod01.rdu3.fedoraproject.org b/inventory/host_vars/debuginfod01.rdu3.fedoraproject.org index 68c6beb90c..8fc6069445 100644 --- a/inventory/host_vars/debuginfod01.rdu3.fedoraproject.org +++ b/inventory/host_vars/debuginfod01.rdu3.fedoraproject.org @@ -2,7 +2,7 @@ datacenter: rdu3 eth0_ipv4_gw: 10.16.163.254 eth0_ipv4_ip: 10.16.163.109 -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/42/Server/x86_64/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/x86_64/os/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora sar_script_user: root virt_install_command: "{{ virt_install_command_one_nic }}" diff --git a/inventory/host_vars/debuginfod01.stg.rdu3.fedoraproject.org b/inventory/host_vars/debuginfod01.stg.rdu3.fedoraproject.org index 11ecfcd65c..3c49e68b91 100644 --- a/inventory/host_vars/debuginfod01.stg.rdu3.fedoraproject.org +++ b/inventory/host_vars/debuginfod01.stg.rdu3.fedoraproject.org @@ -2,7 +2,7 @@ datacenter: rdu3 eth0_ipv4_gw: 10.16.166.254 eth0_ipv4_ip: 10.16.166.62 -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/42/Server/x86_64/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/x86_64/os/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora vmhost: vmhost-x86-03.stg.rdu3.fedoraproject.org volgroup: /dev/vg_guests From cf60e5fab54fcdabbd53f7ef36e802bb30fd7d19 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Wed, 13 May 2026 16:27:57 -0700 Subject: [PATCH 121/269] kickstarts / rhel10: just point all the rhel10 kickstarts to the latest rhel10, not 10.0 Signed-off-by: Kevin Fenzi --- roles/kickstarts/templates/hardware-rhel-10-08disk.j2 | 6 +++--- roles/kickstarts/templates/hardware-rhel-10-10disk-copr.j2 | 6 +++--- roles/kickstarts/templates/hardware-rhel-10-10disk.j2 | 6 +++--- roles/kickstarts/templates/hardware-rhel-10-nodisk.j2 | 6 +++--- 4 files changed, 12 insertions(+), 12 deletions(-) diff --git a/roles/kickstarts/templates/hardware-rhel-10-08disk.j2 b/roles/kickstarts/templates/hardware-rhel-10-08disk.j2 index 0a751643bf..80beb7a9f6 100644 --- a/roles/kickstarts/templates/hardware-rhel-10-08disk.j2 +++ b/roles/kickstarts/templates/hardware-rhel-10-08disk.j2 @@ -7,9 +7,9 @@ vnc --password "{{ kickstart_vnc_password }}" # Use network install url --url=http://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ repo --name=epel --baseurl=http://infrastructure.fedoraproject.org/pub/epel/10/Everything/x86_64/ -repo --name="net-baseos" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10.0/repos/x86_64/baseos/ -repo --name="net-appstream" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10.0/repos/x86_64/appstream/ -repo --name="net-crb" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10.0/repos/x86_64/crb/ +repo --name="net-baseos" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/baseos/ +repo --name="net-appstream" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/appstream/ +repo --name="net-crb" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/crb/ # Firewall configuration firewall --disabled diff --git a/roles/kickstarts/templates/hardware-rhel-10-10disk-copr.j2 b/roles/kickstarts/templates/hardware-rhel-10-10disk-copr.j2 index b6018af9ba..44034d6939 100644 --- a/roles/kickstarts/templates/hardware-rhel-10-10disk-copr.j2 +++ b/roles/kickstarts/templates/hardware-rhel-10-10disk-copr.j2 @@ -7,9 +7,9 @@ vnc --password "{{ kickstart_vnc_password }}" # Use network install url --url=http://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ repo --name=epel --baseurl=http://infrastructure.fedoraproject.org/pub/epel/10/Everything/x86_64/ -repo --name="net-baseos" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10.0/repos/x86_64/baseos/ -repo --name="net-appstream" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10.0/repos/x86_64/appstream/ -repo --name="net-crb" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10.0/repos/x86_64/crb/ +repo --name="net-baseos" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/baseos/ +repo --name="net-appstream" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/appstream/ +repo --name="net-crb" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/crb/ # Firewall configuration firewall --disabled diff --git a/roles/kickstarts/templates/hardware-rhel-10-10disk.j2 b/roles/kickstarts/templates/hardware-rhel-10-10disk.j2 index ea06369b52..76530072fe 100644 --- a/roles/kickstarts/templates/hardware-rhel-10-10disk.j2 +++ b/roles/kickstarts/templates/hardware-rhel-10-10disk.j2 @@ -7,9 +7,9 @@ vnc --password "{{ kickstart_vnc_password }}" # Use network install url --url=http://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ repo --name=epel --baseurl=http://infrastructure.fedoraproject.org/pub/epel/10/Everything/x86_64/ -repo --name="net-baseos" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10.0/repos/x86_64/baseos/ -repo --name="net-appstream" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10.0/repos/x86_64/appstream/ -repo --name="net-crb" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10.0/repos/x86_64/crb/ +repo --name="net-baseos" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/baseos/ +repo --name="net-appstream" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/appstream/ +repo --name="net-crb" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/crb/ # Firewall configuration firewall --disabled diff --git a/roles/kickstarts/templates/hardware-rhel-10-nodisk.j2 b/roles/kickstarts/templates/hardware-rhel-10-nodisk.j2 index 979c4d8106..fa371688cc 100644 --- a/roles/kickstarts/templates/hardware-rhel-10-nodisk.j2 +++ b/roles/kickstarts/templates/hardware-rhel-10-nodisk.j2 @@ -7,9 +7,9 @@ vnc --password "{{ kickstart_vnc_password }}" # Use network install url --url=http://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ repo --name=epel --baseurl=http://infrastructure.fedoraproject.org/pub/epel/10/Everything/x86_64/ -repo --name="net-baseos" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10.0/repos/x86_64/baseos/ -repo --name="net-appstream" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10.0/repos/x86_64/appstream/ -repo --name="net-crb" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10.0/repos/x86_64/crb/ +repo --name="net-baseos" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/baseos/ +repo --name="net-appstream" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/appstream/ +repo --name="net-crb" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/crb/ # Firewall configuration firewall --disabled From 8b477bcc0a4b81b41cb5da7f59034e5cc8663fa7 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Wed, 13 May 2026 17:21:32 -0700 Subject: [PATCH 122/269] kickstarts / rhel10: install selinux-policy-extra in all cases, needed for epel packages Signed-off-by: Kevin Fenzi --- roles/kickstarts/templates/hardware-rhel-10-06disk-aarch64.j2 | 1 + roles/kickstarts/templates/hardware-rhel-10-08disk.j2 | 1 + roles/kickstarts/templates/hardware-rhel-10-10disk-copr.j2 | 1 + roles/kickstarts/templates/hardware-rhel-10-10disk.j2 | 1 + roles/kickstarts/templates/hardware-rhel-10-nodisk.j2 | 1 + 5 files changed, 5 insertions(+) diff --git a/roles/kickstarts/templates/hardware-rhel-10-06disk-aarch64.j2 b/roles/kickstarts/templates/hardware-rhel-10-06disk-aarch64.j2 index eee3d4c7c5..1dd1f811f7 100644 --- a/roles/kickstarts/templates/hardware-rhel-10-06disk-aarch64.j2 +++ b/roles/kickstarts/templates/hardware-rhel-10-06disk-aarch64.j2 @@ -84,6 +84,7 @@ patch postfix rsync screen +selinux-policy-extra strace s-nail tmpwatch diff --git a/roles/kickstarts/templates/hardware-rhel-10-08disk.j2 b/roles/kickstarts/templates/hardware-rhel-10-08disk.j2 index 80beb7a9f6..41a599c3c4 100644 --- a/roles/kickstarts/templates/hardware-rhel-10-08disk.j2 +++ b/roles/kickstarts/templates/hardware-rhel-10-08disk.j2 @@ -97,6 +97,7 @@ patch postfix rsync screen +selinux-policy-extra strace s-nail tmpwatch diff --git a/roles/kickstarts/templates/hardware-rhel-10-10disk-copr.j2 b/roles/kickstarts/templates/hardware-rhel-10-10disk-copr.j2 index 44034d6939..bee91eaf68 100644 --- a/roles/kickstarts/templates/hardware-rhel-10-10disk-copr.j2 +++ b/roles/kickstarts/templates/hardware-rhel-10-10disk-copr.j2 @@ -127,6 +127,7 @@ patch postfix rsync screen +selinux-policy-extra strace s-nail tmpwatch diff --git a/roles/kickstarts/templates/hardware-rhel-10-10disk.j2 b/roles/kickstarts/templates/hardware-rhel-10-10disk.j2 index 76530072fe..583318c724 100644 --- a/roles/kickstarts/templates/hardware-rhel-10-10disk.j2 +++ b/roles/kickstarts/templates/hardware-rhel-10-10disk.j2 @@ -103,6 +103,7 @@ patch postfix rsync screen +selinux-policy-extra strace s-nail tmpwatch diff --git a/roles/kickstarts/templates/hardware-rhel-10-nodisk.j2 b/roles/kickstarts/templates/hardware-rhel-10-nodisk.j2 index fa371688cc..e49fea23f8 100644 --- a/roles/kickstarts/templates/hardware-rhel-10-nodisk.j2 +++ b/roles/kickstarts/templates/hardware-rhel-10-nodisk.j2 @@ -56,6 +56,7 @@ patch postfix rsync screen +selinux-policy-extra strace s-nail tmpwatch From 4d2aa5527b7a21d8cc3da71122925a546c919174 Mon Sep 17 00:00:00 2001 From: Akashdeep Dhar Date: Thu, 14 May 2026 13:24:05 +0530 Subject: [PATCH 123/269] firmitas: support ticket creation on forgejo instead of pagure Signed-off-by: Akashdeep Dhar --- .../openshift-apps/firmitas/default/main.yml | 16 ++++++------- .../firmitas/tasks/create-buildconfig.yml | 2 +- ...t.yml => create-forgejo-apikey-secret.yml} | 8 +++---- roles/openshift-apps/firmitas/tasks/main.yml | 23 ++++++++++++------- .../firmitas/templates/myconfig.py.j2 | 15 +++++------- .../templates/secret-forgejo-apikey.yml.j2 | 11 +++++++++ .../templates/secret-pagure-apikey.yml.j2 | 11 --------- 7 files changed, 45 insertions(+), 41 deletions(-) rename roles/openshift-apps/firmitas/tasks/{create-pagure-apikey-secret.yml => create-forgejo-apikey-secret.yml} (53%) create mode 100644 roles/openshift-apps/firmitas/templates/secret-forgejo-apikey.yml.j2 delete mode 100644 roles/openshift-apps/firmitas/templates/secret-pagure-apikey.yml.j2 diff --git a/roles/openshift-apps/firmitas/default/main.yml b/roles/openshift-apps/firmitas/default/main.yml index a8702d95f6..4794ca0892 100644 --- a/roles/openshift-apps/firmitas/default/main.yml +++ b/roles/openshift-apps/firmitas/default/main.yml @@ -2,14 +2,14 @@ firmitas_namespace: "firmitas" firmitas_project_description: "Firmitas is a monitoring application which alerts about the expiration of RabbitMQ certs." firmitas_application_name: "{{ firmitas_namespace }}" -firmitas_pagure_secret_volume_name: "firmitas-pagure-volume" -firmitas_pagure_secret_name: "firmitas-pagure-secret" -firmitas_stg_pagure_apikey: "OVERRIDEME" # in the ansible-private repo -firmitas_stg_pagure_username: "OVERRIDEME" # in the ansible-private repo -firmitas_stg_pagure_host: "OVERRIDEME" # in the ansible-private repo -firmitas_pagure_apikey: "OVERRIDEME" # in the ansible-private repo -firmitas_pagure_username: "OVERRIDEME" # in the ansible-private repo -firmitas_pagure_host: "OVERRIDEME" # in the ansible-private repo +firmitas_forgejo_secret_volume_name: "firmitas-forgejo-volume" +firmitas_forgejo_secret_name: "firmitas-forgejo-secret" +firmitas_stg_forgejo_apikey: "OVERRIDEME" # in the ansible-private repo +firmitas_stg_forgejo_username: "firmitas-automata" +firmitas_stg_forgejo_reponame: "t0xic0der/firmitas-test" +firmitas_forgejo_apikey: "OVERRIDEME" # in the ansible-private repo +firmitas_forgejo_username: "firmitas-automata" +firmitas_forgejo_reponame: "infra/tickets" firmitas_certs_location: "https://infrastructure.fedoraproject.org/infra/rabbitmq-certs/" firmitas_requester: "t0xic0der" firmitas_image: "image-registry.openshift-image-registry.svc:5000/{{ firmitas_namespace }}/{{ firmitas_application_name }}:latest" diff --git a/roles/openshift-apps/firmitas/tasks/create-buildconfig.yml b/roles/openshift-apps/firmitas/tasks/create-buildconfig.yml index 9c587d4f43..a52e85b576 100644 --- a/roles/openshift-apps/firmitas/tasks/create-buildconfig.yml +++ b/roles/openshift-apps/firmitas/tasks/create-buildconfig.yml @@ -11,5 +11,5 @@ ansible.builtin.command: "oc apply -f /root/ocp4/openshift-apps/firmitas/buildconfig.yml" # Start a build -- name: "Run oc start-build {{ firmitas_application_name }}-build" +- name: "Run oc start-build" ansible.builtin.command: "oc start-build {{ firmitas_application_name }}-build -n {{ firmitas_namespace }}" diff --git a/roles/openshift-apps/firmitas/tasks/create-pagure-apikey-secret.yml b/roles/openshift-apps/firmitas/tasks/create-forgejo-apikey-secret.yml similarity index 53% rename from roles/openshift-apps/firmitas/tasks/create-pagure-apikey-secret.yml rename to roles/openshift-apps/firmitas/tasks/create-forgejo-apikey-secret.yml index 52f916b400..fb69827aa1 100644 --- a/roles/openshift-apps/firmitas/tasks/create-pagure-apikey-secret.yml +++ b/roles/openshift-apps/firmitas/tasks/create-forgejo-apikey-secret.yml @@ -1,11 +1,11 @@ --- # generate the templates for project to be created -- name: Create the pagure api secret template +- name: Create the Forgejo api secret template ansible.builtin.template: - src: "secret-pagure-apikey.yml.j2" - dest: "/root/ocp4/openshift-apps/firmitas/secret-pagure-apikey.yml" + src: "secret-forgejo-apikey.yml.j2" + dest: "/root/ocp4/openshift-apps/firmitas/secret-forgejo-apikey.yml" mode: "0770" # apply created openshift resources - name: Oc apply resources - ansible.builtin.command: "oc apply -f /root/ocp4/openshift-apps/firmitas/secret-pagure-apikey.yml" + ansible.builtin.command: "oc apply -f /root/ocp4/openshift-apps/firmitas/secret-forgejo-apikey.yml" diff --git a/roles/openshift-apps/firmitas/tasks/main.yml b/roles/openshift-apps/firmitas/tasks/main.yml index 601c12decf..a830bb0e55 100644 --- a/roles/openshift-apps/firmitas/tasks/main.yml +++ b/roles/openshift-apps/firmitas/tasks/main.yml @@ -3,12 +3,19 @@ ansible.builtin.file: path: "/root/ocp4/openshift-apps/firmitas/" state: directory + mode: "0770" -- include_tasks: create-namespace.yml -- include_tasks: create-pagure-apikey-secret.yml -- include_tasks: create-firmitas-configuration-secret.yml -- include_tasks: create-persistent-volume-claim.yml -- include_tasks: create-imagestream.yml -- include_tasks: create-buildconfig.yml -- include_tasks: create-cronjob.yml -# - include_tasks: create-deployment.yml +- name: Create namespace + ansible.builtin.include_tasks: create-namespace.yml +- name: Create Forgejo APIkey secret + ansible.builtin.include_tasks: create-forgejo-apikey-secret.yml +- name: Create Firmitas configuration secret + ansible.builtin.include_tasks: create-firmitas-configuration-secret.yml +- name: Create persistent volume claim + ansible.builtin.include_tasks: create-persistent-volume-claim.yml +- name: Create imagestream + ansible.builtin.include_tasks: create-imagestream.yml +- name: Create buildconfig + ansible.builtin.include_tasks: create-buildconfig.yml +- name: Create cronjob + ansible.builtin.include_tasks: create-cronjob.yml diff --git a/roles/openshift-apps/firmitas/templates/myconfig.py.j2 b/roles/openshift-apps/firmitas/templates/myconfig.py.j2 index e73839c90f..4dfccf2c0f 100644 --- a/roles/openshift-apps/firmitas/templates/myconfig.py.j2 +++ b/roles/openshift-apps/firmitas/templates/myconfig.py.j2 @@ -1,6 +1,6 @@ """ Firmitas -Copyright (C) 2023-2024 Akashdeep Dhar +Copyright (C) 2023-2026 Akashdeep Dhar This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software @@ -27,26 +27,23 @@ Variables related to notifications # The limit for how long a single request must be attempted for rqsttime = 30 -# The source code forge on which the issue tickets need to be created -gitforge = "pagure" - # The location of the ticketing repository -repoloca = "" +repoloca = "https://forge.{{ (env == 'staging')|ternary('stg.', '') }}fedoraproject.org" # The name of the ticketing repository with namespace -reponame = "{{ (env == 'staging')|ternary(firmitas_stg_pagure_host, firmitas_pagure_host) }}" +reponame = "{{ (env == 'staging')|ternary(firmitas_stg_forgejo_reponame, firmitas_forgejo_reponame) }}" # The username to masquerade as in order to create notification tickets -username = "{{ (env == 'staging')|ternary(firmitas_stg_pagure_user, firmitas_pagure_user) }}" +username = "{{ (env == 'staging')|ternary(firmitas_stg_forgejo_username, firmitas_forgejo_username) }}" # The API key for the source code forge pertaining to the user -password = "{{ (env == 'staging')|ternary(firmitas_stg_pagure_apikey, firmitas_pagure_apikey) }}" +password = "{{ (env == 'staging')|ternary(firmitas_stg_forgejo_apikey, firmitas_forgejo_apikey) }}" # Number of days from validity expiry to make the notification for daysqant = {{ (env == 'staging')|ternary(firmitas_stg_expiry_days, firmitas_expiry_days) }} # List of labels to tag the notification tickets with -tagslist = ["firmitas", "automate", "notifier"] +tagslist = [] # Maximum number of retries to opening the notification ticket maxretry = 5 diff --git a/roles/openshift-apps/firmitas/templates/secret-forgejo-apikey.yml.j2 b/roles/openshift-apps/firmitas/templates/secret-forgejo-apikey.yml.j2 new file mode 100644 index 0000000000..d703424d1e --- /dev/null +++ b/roles/openshift-apps/firmitas/templates/secret-forgejo-apikey.yml.j2 @@ -0,0 +1,11 @@ +--- +apiVersion: v1 +kind: Secret +metadata: + name: "{{ firmitas_namespace }}-forgejo-apikey-secret" + namespace: "{{ firmitas_namespace }}" +data: + firmitas-forgejo-apikey: + "{{ (env == 'production')|ternary(firmitas_forgejo_apikey, firmitas_stg_forgejo_apikey) | b64encode }}" + firmitas-forgejo-reponame: + "{{ (env == 'production')|ternary(firmitas_forgejo_reponame, firmitas_stg_forgejo_reponame) | b64encode }}" diff --git a/roles/openshift-apps/firmitas/templates/secret-pagure-apikey.yml.j2 b/roles/openshift-apps/firmitas/templates/secret-pagure-apikey.yml.j2 deleted file mode 100644 index cc6609e103..0000000000 --- a/roles/openshift-apps/firmitas/templates/secret-pagure-apikey.yml.j2 +++ /dev/null @@ -1,11 +0,0 @@ ---- -apiVersion: v1 -kind: Secret -metadata: - name: "{{ firmitas_namespace }}-pagure-apikey-secret" - namespace: "{{ firmitas_namespace }}" -data: - firmitas-pagure-apikey: - "{{ (env == 'production')|ternary(firmitas_pagure_apikey, firmitas_stg_pagure_apikey) | b64encode }}" - firmitas-pagure-host: - "{{ (env == 'production')|ternary( firmitas_pagure_host, firmitas_stg_pagure_host) | b64encode }}" From 6bdcf23ac75551dda7bab50d5cad16ff072b5e9e Mon Sep 17 00:00:00 2001 From: Akashdeep Dhar Date: Thu, 14 May 2026 14:57:11 +0530 Subject: [PATCH 124/269] firmitas: fix the missing variable ansible error Signed-off-by: Akashdeep Dhar --- roles/openshift-apps/firmitas/{default => defaults}/main.yml | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename roles/openshift-apps/firmitas/{default => defaults}/main.yml (100%) diff --git a/roles/openshift-apps/firmitas/default/main.yml b/roles/openshift-apps/firmitas/defaults/main.yml similarity index 100% rename from roles/openshift-apps/firmitas/default/main.yml rename to roles/openshift-apps/firmitas/defaults/main.yml From d47a99133396bd5e6a814373abaf23f6ab357504 Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Thu, 14 May 2026 13:28:11 +0100 Subject: [PATCH 125/269] Zabbix: Add proxy file-age checks for ostree & mirrorlist cache Signed-off-by: Greg Sutcliffe --- roles/httpd/proxy/files/zabbix-template.yml | 133 +++++++++++++++++--- 1 file changed, 115 insertions(+), 18 deletions(-) diff --git a/roles/httpd/proxy/files/zabbix-template.yml b/roles/httpd/proxy/files/zabbix-template.yml index b75a93a35f..226c993472 100644 --- a/roles/httpd/proxy/files/zabbix-template.yml +++ b/roles/httpd/proxy/files/zabbix-template.yml @@ -5,8 +5,8 @@ zabbix_export: name: Fedora templates: - uuid: 248dc8195923413eb6fb9dd8a8e09332 - template: 'Proxy HTTPd checks' - name: 'Proxy HTTPd checks' + template: 'Proxy checks' + name: 'Proxy checks' groups: - name: Fedora items: @@ -16,19 +16,116 @@ zabbix_export: key: 'vfs.file.time[/etc/httpd/ticketkey.tkey,modify]' history: 1d trends: '0' + units: unixtime description: 'Date of the ticketkey file, based on "modify" stat output' tags: - tag: application value: ticketkey triggers: - uuid: bfd41861a3f6448cbf0013675f8a6c74 - expression: 'now() - last(/Proxy HTTPd checks/vfs.file.time[/etc/httpd/ticketkey.tkey,modify]) > 3900' + expression: 'now() - last(/Proxy checks/vfs.file.time[/etc/httpd/ticketkey.tkey,modify]) > 3900' name: 'TicketKey age is more than one hour' priority: WARNING + dependencies: + - name: 'TicketKey age is more than two hours' + expression: 'now() - last(/Proxy checks/vfs.file.time[/etc/httpd/ticketkey.tkey,modify]) > 7200' + tags: + - tag: scope + value: file_age - uuid: 8b004b185340490ea9fa1fce4bc92386 - expression: 'now() - last(/Proxy HTTPd checks/vfs.file.time[/etc/httpd/ticketkey.tkey,modify]) > 7200' + expression: 'now() - last(/Proxy checks/vfs.file.time[/etc/httpd/ticketkey.tkey,modify]) > 7200' name: 'TicketKey age is more than two hours' priority: AVERAGE + tags: + - tag: scope + value: file_age + - uuid: a9a117ebdc514b08af24633b1ac40448 + name: 'Mirrorlist 1 cache timestamp' + type: ZABBIX_ACTIVE + key: 'vfs.file.time[/srv/mirrorlist/data/mirrorlist1/mirrorlist_cache.proto,modify]' + history: 1d + trends: '0' + units: unixtime + description: 'Date of the ticketkey file, based on "modify" stat output' + tags: + - tag: application + value: ticketkey + triggers: + - uuid: af2a279be64f4044b9c159a565072062 + expression: 'now() - last(/Proxy checks/vfs.file.time[/srv/mirrorlist/data/mirrorlist1/mirrorlist_cache.proto,modify]) > 14400' + name: 'Mirrorlist 1 cache age is more than 4 hours' + priority: WARNING + dependencies: + - name: 'Mirrorlist 1 cache age is more than 36 hours' + expression: 'now() - last(/Proxy checks/vfs.file.time[/srv/mirrorlist/data/mirrorlist1/mirrorlist_cache.proto,modify]) > 129600' + tags: + - tag: scope + value: file_age + - uuid: 16f086125dd04d4ca7896cefad47b3de + expression: 'now() - last(/Proxy checks/vfs.file.time[/srv/mirrorlist/data/mirrorlist1/mirrorlist_cache.proto,modify]) > 129600' + name: 'Mirrorlist 1 cache age is more than 36 hours' + priority: AVERAGE + tags: + - tag: scope + value: file_age + - uuid: dc236818b1e8480097dc7ffed3d179e9 + name: 'Mirrorlist 2 cache timestamp' + type: ZABBIX_ACTIVE + key: 'vfs.file.time[/srv/mirrorlist/data/mirrorlist2/mirrorlist_cache.proto,modify]' + history: 1d + trends: '0' + units: unixtime + description: 'Date of the ticketkey file, based on "modify" stat output' + tags: + - tag: application + value: ticketkey + triggers: + - uuid: 681164a1ffdb4c5ca7cd74f41c51d3d8 + expression: 'now() - last(/Proxy checks/vfs.file.time[/srv/mirrorlist/data/mirrorlist2/mirrorlist_cache.proto,modify]) > 14400' + name: 'Mirrorlist 2 cache age is more than 4 hours' + priority: WARNING + dependencies: + - name: 'Mirrorlist 2 cache age is more than 36 hours' + expression: 'now() - last(/Proxy checks/vfs.file.time[/srv/mirrorlist/data/mirrorlist2/mirrorlist_cache.proto,modify]) > 129600' + tags: + - tag: scope + value: file_age + - uuid: 40cf9c585fdf471d855ef3da6396cfc2 + expression: 'now() - last(/Proxy checks/vfs.file.time[/srv/mirrorlist/data/mirrorlist2/mirrorlist_cache.proto,modify]) > 129600' + name: 'Mirrorlist 2 cache age is more than 36 hours' + priority: AVERAGE + tags: + - tag: scope + value: file_age + - uuid: 07990ae5100f44208e7dab5da438c043 + name: 'OSTree Summary file timestamp' + type: ZABBIX_ACTIVE + key: 'vfs.file.time[/srv/web/ostree/summary,modify]' + history: 1d + trends: '0' + units: unixtime + description: 'Date of the ticketkey file, based on "modify" stat output' + tags: + - tag: application + value: ticketkey + triggers: + - uuid: bedc260eec06438097abdd7f0c7a6adb + expression: 'now() - last(/Proxy checks/vfs.file.time[/srv/web/ostree/summary,modify]) > 1800' + name: 'OSTree summary file age is more than 30 mins' + priority: WARNING + dependencies: + - name: 'OSTree summary file age is more than one hour' + expression: 'now() - last(/Proxy checks/vfs.file.time[/srv/web/ostree/summary,modify]) > 3600' + tags: + - tag: scope + value: file_age + - uuid: ea88d0ecaeff4896af3e836b4431c7ec + expression: 'now() - last(/Proxy checks/vfs.file.time[/srv/web/ostree/summary,modify]) > 3600' + name: 'OSTree summary file age is more than one hour' + priority: AVERAGE + tags: + - tag: scope + value: file_age - uuid: 9047878841c3403ebfd1352424ca96d7 name: http-accounts type: ZABBIX_ACTIVE @@ -42,7 +139,7 @@ zabbix_export: value: infra triggers: - uuid: 8830fee0972e42b0874bd1301c84bc58 - expression: 'last(/Proxy HTTPd checks/web.page.regexp[https://accounts.fedoraproject.org/healthz/ready,,,OK])<>"OK"' + expression: 'last(/Proxy checks/web.page.regexp[https://accounts.fedoraproject.org/healthz/ready,,,OK])<>"OK"' name: 'http-accounts connection failed' priority: AVERAGE tags: @@ -63,7 +160,7 @@ zabbix_export: value: infra triggers: - uuid: 777798b8704c4eb8a9a90d8b0054a900 - expression: 'last(/Proxy HTTPd checks/web.page.regexp[https://bodhi.fedoraproject.org/,,,Active Testers])<>"Active Testers"' + expression: 'last(/Proxy checks/web.page.regexp[https://bodhi.fedoraproject.org/,,,Active Testers])<>"Active Testers"' name: 'http-bodhi connection failed' priority: AVERAGE tags: @@ -84,7 +181,7 @@ zabbix_export: value: infra triggers: - uuid: d2111d480e404b349f14f400ff2a693a - expression: 'last(/Proxy HTTPd checks/web.page.regexp[https://docs.fedoraproject.org/en-US/docs/index.html,,,Antora])<>"Antora"' + expression: 'last(/Proxy checks/web.page.regexp[https://docs.fedoraproject.org/en-US/docs/index.html,,,Antora])<>"Antora"' name: 'http-docs.fedoraproject.org connection failed' priority: AVERAGE tags: @@ -105,7 +202,7 @@ zabbix_export: value: infra triggers: - uuid: 1d55c842156c4290ac0d6f7bdcb02f13 - expression: 'last(/Proxy HTTPd checks/web.page.regexp[https://fedoraproject.org/,,,https://fedoraproject.org])<>"https://fedoraproject.org"' + expression: 'last(/Proxy checks/web.page.regexp[https://fedoraproject.org/,,,https://fedoraproject.org])<>"https://fedoraproject.org"' name: 'http-fedoraproject.org connection failed' priority: AVERAGE tags: @@ -126,7 +223,7 @@ zabbix_export: value: infra triggers: - uuid: bfd8143fda7b4c60bebc80086024e48b - expression: 'last(/Proxy HTTPd checks/web.page.regexp[https://fedoraproject.org/static/hotspot.txt,,,OK])<>"OK"' + expression: 'last(/Proxy checks/web.page.regexp[https://fedoraproject.org/static/hotspot.txt,,,OK])<>"OK"' name: 'http-fedoraproject.org-hotspot.txt connection failed' priority: AVERAGE tags: @@ -147,7 +244,7 @@ zabbix_export: value: infra triggers: - uuid: 8efe34c0ade040d5b9d84ee06f31cc04 - expression: 'last(/Proxy HTTPd checks/web.page.regexp[https://fedoraproject.org/wiki/Fedora_Project_Wiki,,,Looking for help])<>"Looking for help"' + expression: 'last(/Proxy checks/web.page.regexp[https://fedoraproject.org/wiki/Fedora_Project_Wiki,,,Looking for help])<>"Looking for help"' name: 'http-fedoraproject.org-wiki connection failed' priority: AVERAGE tags: @@ -168,7 +265,7 @@ zabbix_export: value: infra triggers: - uuid: ca2817c97ef64ed08e35c08535b0bd41 - expression: 'last(/Proxy HTTPd checks/web.page.regexp[https://fedoraproject.org/wiki/Special:Version,,,MediaWiki is free software])<>"MediaWiki is free software"' + expression: 'last(/Proxy checks/web.page.regexp[https://fedoraproject.org/wiki/Special:Version,,,MediaWiki is free software])<>"MediaWiki is free software"' name: 'http-fedoraproject.org-wiki-non-cached connection failed' priority: AVERAGE tags: @@ -189,7 +286,7 @@ zabbix_export: value: infra triggers: - uuid: ea8cf6f662e74b04ad0b18731bf966ef - expression: 'last(/Proxy HTTPd checks/web.page.regexp[https://greenwave-web-greenwave.apps.ocp.fedoraproject.org/api/v1.0/policies,,,bodhi_update_push_stable])<>"bodhi_update_push_stable"' + expression: 'last(/Proxy checks/web.page.regexp[https://greenwave-web-greenwave.apps.ocp.fedoraproject.org/api/v1.0/policies,,,bodhi_update_push_stable])<>"bodhi_update_push_stable"' name: 'http-greenwave connection failed' priority: AVERAGE tags: @@ -210,7 +307,7 @@ zabbix_export: value: infra triggers: - uuid: 928062a012a54ce2b20a215c0d35e3af - expression: 'last(/Proxy HTTPd checks/web.page.regexp[https://id.fedoraproject.org/,,,your Fedora Account])<>"your Fedora Account"' + expression: 'last(/Proxy checks/web.page.regexp[https://id.fedoraproject.org/,,,your Fedora Account])<>"your Fedora Account"' name: 'http-ipsilon connection failed' priority: AVERAGE tags: @@ -231,7 +328,7 @@ zabbix_export: value: infra triggers: - uuid: ebe02ba799684a2aa1e9948d1b56bd68 - expression: 'last(/Proxy HTTPd checks/web.page.regexp[https://koschei.fedoraproject.org/,,,Package summary])<>"Package summary"' + expression: 'last(/Proxy checks/web.page.regexp[https://koschei.fedoraproject.org/,,,Package summary])<>"Package summary"' name: 'http-koschei connection failed' priority: AVERAGE tags: @@ -252,7 +349,7 @@ zabbix_export: value: infra triggers: - uuid: 0d99a7de0ca94563b556cfc08eb39702 - expression: 'last(/Proxy HTTPd checks/web.page.regexp[https://mirrors.fedoraproject.org/mirrorlist?repo=rawhide&arch=x86_64&country=global,,,development])<>"development"' + expression: 'last(/Proxy checks/web.page.regexp[https://mirrors.fedoraproject.org/mirrorlist?repo=rawhide&arch=x86_64&country=global,,,development])<>"development"' name: 'http-mirrorlist connection failed' priority: AVERAGE tags: @@ -273,7 +370,7 @@ zabbix_export: value: infra triggers: - uuid: 09fa67873d3745268a0a3f06c9c68a02 - expression: 'last(/Proxy HTTPd checks/web.page.regexp[https://registry.fedoraproject.org/v2/,,,{}])<>"{}"' + expression: 'last(/Proxy checks/web.page.regexp[https://registry.fedoraproject.org/v2/,,,{}])<>"{}"' name: 'http-moby-gresitry connection failed' priority: AVERAGE tags: @@ -294,7 +391,7 @@ zabbix_export: value: infra triggers: - uuid: 1861890b34894f27b1be9380f58c82b9 - expression: 'last(/Proxy HTTPd checks/web.page.regexp[https://release-monitoring.org/,,,Watch for releases of your favorite projects])<>"Watch for releases of your favorite projects"' + expression: 'last(/Proxy checks/web.page.regexp[https://release-monitoring.org/,,,Watch for releases of your favorite projects])<>"Watch for releases of your favorite projects"' name: 'http-release-monitoring.org connection failed' priority: AVERAGE tags: @@ -315,7 +412,7 @@ zabbix_export: value: infra triggers: - uuid: aaa3e2d4fb9d41cba1f5007c9521837d - expression: 'last(/Proxy HTTPd checks/web.page.regexp[https://waiverdb-web-waiverdb.apps.ocp.fedoraproject.org/api/v1.0/waivers/,,,first])<>"first"' + expression: 'last(/Proxy checks/web.page.regexp[https://waiverdb-web-waiverdb.apps.ocp.fedoraproject.org/api/v1.0/waivers/,,,first])<>"first"' name: 'http-waiverdb connection failed' priority: AVERAGE tags: From 4be7c97ff161f3f144bae614f6ed74d511f1d1a4 Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Thu, 14 May 2026 13:39:54 +0100 Subject: [PATCH 126/269] Nagios: Drop proxy mirrorlist & ostree file-age checks, migrated Signed-off-by: Greg Sutcliffe --- .../services/rdu3_internal/file_age.cfg | 27 ------------------- 1 file changed, 27 deletions(-) diff --git a/roles/nagios_server/files/nagios/services/rdu3_internal/file_age.cfg b/roles/nagios_server/files/nagios/services/rdu3_internal/file_age.cfg index 64ccda46fd..b4a994e40e 100644 --- a/roles/nagios_server/files/nagios/services/rdu3_internal/file_age.cfg +++ b/roles/nagios_server/files/nagios/services/rdu3_internal/file_age.cfg @@ -1,30 +1,3 @@ -define service { - hostgroup_name proxies - service_description Check MirrorList 1 Cache - check_command check_by_nrpe!check_mirrorlist1_cache - use defaulttemplate - check_interval 120 - notification_interval 130 -} - -define service { - hostgroup_name proxies - service_description Check MirrorList 2 Cache - check_command check_by_nrpe!check_mirrorlist2_cache - use defaulttemplate - check_interval 120 - notification_interval 130 -} - -define service { - hostgroup_name proxies - service_description Check ostree summary age - check_command check_by_nrpe!check_ostree_summary_file_age - use defaulttemplate - check_interval 120 - notification_interval 130 -} - define service { host_name log01.rdu3.fedoraproject.org service_description Check Merged Log From 4998b94fce103eaadc356bdce987f8ac7d53ea5e Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Thu, 14 May 2026 16:26:14 +0100 Subject: [PATCH 127/269] Zabbix: Migrate CountMe file-age checks from Nagios Signed-off-by: Greg Sutcliffe --- .../services/rdu3_internal/file_age.cfg | 92 ------ .../files/zabbix-template.yml | 293 ++++++++++++++++++ roles/web-data-analysis/tasks/main.yml | 27 ++ 3 files changed, 320 insertions(+), 92 deletions(-) create mode 100644 roles/web-data-analysis/files/zabbix-template.yml diff --git a/roles/nagios_server/files/nagios/services/rdu3_internal/file_age.cfg b/roles/nagios_server/files/nagios/services/rdu3_internal/file_age.cfg index b4a994e40e..41e910cdac 100644 --- a/roles/nagios_server/files/nagios/services/rdu3_internal/file_age.cfg +++ b/roles/nagios_server/files/nagios/services/rdu3_internal/file_age.cfg @@ -7,95 +7,3 @@ define service { notification_interval 130 event_handler restart_rsyslog } - -# Fedora Countme: -define service { - host_name log01.rdu3.fedoraproject.org - service_description Check Fedora countme raw DB age - check_command check_by_nrpe!check_countme_fedora_raw - use defaulttemplate - check_interval 120 - notification_interval 130 -} - -define service { - host_name log01.rdu3.fedoraproject.org - service_description Check Fedora countme totals DB age - check_command check_by_nrpe!check_countme_fedora_tot - use defaulttemplate - check_interval 120 - notification_interval 130 -} - -define service { - host_name log01.rdu3.fedoraproject.org - service_description Check Fedora countme web DB1 age - check_command check_by_nrpe!check_countme_fedora_web1 - use defaulttemplate - check_interval 120 - notification_interval 130 -} - -define service { - host_name log01.rdu3.fedoraproject.org - service_description Check Fedora countme web DB2 age - check_command check_by_nrpe!check_countme_fedora_web2 - use defaulttemplate - check_interval 120 - notification_interval 130 -} - -define service { - host_name log01.rdu3.fedoraproject.org - service_description Check Fedora countme web DB3 age - check_command check_by_nrpe!check_countme_fedora_web3 - use defaulttemplate - check_interval 120 - notification_interval 130 -} - -# CentOS countme -define service { - host_name log01.rdu3.fedoraproject.org - service_description Check CentOS countme raw DB age - check_command check_by_nrpe!check_countme_centos_raw - use defaulttemplate - check_interval 120 - notification_interval 130 -} - -define service { - host_name log01.rdu3.fedoraproject.org - service_description Check CentOS countme totals DB age - check_command check_by_nrpe!check_countme_centos_tot - use defaulttemplate - check_interval 120 - notification_interval 130 -} - -define service { - host_name log01.rdu3.fedoraproject.org - service_description Check CentOS countme web DB1 age - check_command check_by_nrpe!check_countme_centos_web1 - use defaulttemplate - check_interval 120 - notification_interval 130 -} - -define service { - host_name log01.rdu3.fedoraproject.org - service_description Check CentOS countme web DB2 age - check_command check_by_nrpe!check_countme_centos_web2 - use defaulttemplate - check_interval 120 - notification_interval 130 -} - -define service { - host_name log01.rdu3.fedoraproject.org - service_description Check CentOS countme web DB3 age - check_command check_by_nrpe!check_countme_centos_web3 - use defaulttemplate - check_interval 120 - notification_interval 130 -} diff --git a/roles/web-data-analysis/files/zabbix-template.yml b/roles/web-data-analysis/files/zabbix-template.yml new file mode 100644 index 0000000000..d888ad650a --- /dev/null +++ b/roles/web-data-analysis/files/zabbix-template.yml @@ -0,0 +1,293 @@ +zabbix_export: + version: '7.0' + template_groups: + - uuid: a333cbd6a3ad44baaa4eee4b0c0b1bec + name: Fedora + templates: + - uuid: 447d0b4d8918402a916f8412a7c96f34 + template: 'Web-Data checks' + name: 'Web-Data checks' + description: 'Checks on log01 for the CountMe datasets' + groups: + - name: Fedora + items: + - uuid: de95b200d3dd4f73a598d1dbbab53f4e + name: 'CentOS countme raw DB timestamp' + type: ZABBIX_ACTIVE + key: 'vfs.file.time[/var/lib/countme/raw-centos.db,modify]' + history: 1d + trends: '0' + units: unixtime + tags: + - tag: application + value: countme + triggers: + - uuid: ade949dbd0a94e24925a2d291b85e65a + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/lib/countme/raw-centos.db,modify]) > 86400' + name: 'CentOS countme raw DB timestamp is more than 24 hours old' + priority: WARNING + dependencies: + - name: 'CentOS countme raw DB timestamp is more than 48 hours old' + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/lib/countme/raw-centos.db,modify]) > 172800' + tags: + - tag: scope + value: file_age + - uuid: 0d7a51ceb35e4016b10ba66224134d1a + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/lib/countme/raw-centos.db,modify]) > 172800' + name: 'CentOS countme raw DB timestamp is more than 48 hours old' + priority: HIGH + tags: + - tag: scope + value: file_age + - uuid: 19fce9d2507a4e1b847687c8489d6a8e + name: 'Fedora countme raw DB timestamp' + type: ZABBIX_ACTIVE + key: 'vfs.file.time[/var/lib/countme/raw.db,modify]' + history: 1d + trends: '0' + units: unixtime + tags: + - tag: application + value: countme + triggers: + - uuid: c26d7114364f4024b2c578941ec33e25 + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/lib/countme/raw.db,modify]) > 86400' + name: 'Fedora countme raw DB timestamp is more than 24 hours old' + priority: WARNING + dependencies: + - name: 'Fedora countme raw DB timestamp is more than 48 hours old' + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/lib/countme/raw.db,modify]) > 172800' + tags: + - tag: scope + value: file_age + - uuid: 32ab177829ac4f3c9c7dedf2554e7cf3 + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/lib/countme/raw.db,modify]) > 172800' + name: 'Fedora countme raw DB timestamp is more than 48 hours old' + priority: HIGH + tags: + - tag: scope + value: file_age + - uuid: 9b5d2df694ec4b6b82bece288fdb6b09 + name: 'CentOS countme totals DB timestamp' + type: ZABBIX_ACTIVE + key: 'vfs.file.time[/var/lib/countme/totals-centos.db,modify]' + history: 1d + trends: '0' + units: unixtime + tags: + - tag: application + value: countme + triggers: + - uuid: c5dc12e66f1f49209bfd415d462faab2 + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/lib/countme/totals-centos.db,modify]) > 604800' + name: 'CentOS countme totals DB timestamp is more than 7 days old' + priority: WARNING + dependencies: + - name: 'CentOS countme totals DB timestamp is more than 8 days old' + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/lib/countme/totals-centos.db,modify]) > 691200' + tags: + - tag: scope + value: file_age + - uuid: ec0ed1a4fc2f4e9fa214426cbb81459e + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/lib/countme/totals-centos.db,modify]) > 691200' + name: 'CentOS countme totals DB timestamp is more than 8 days old' + priority: HIGH + tags: + - tag: scope + value: file_age + - uuid: 7f066857c5df40378be6e82bb9d5df0f + name: 'Fedora countme totals DB timestamp' + type: ZABBIX_ACTIVE + key: 'vfs.file.time[/var/lib/countme/totals.db,modify]' + history: 1d + trends: '0' + units: unixtime + tags: + - tag: application + value: countme + triggers: + - uuid: 7e500bd165284a3aa73bd683b341711a + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/lib/countme/totals.db,modify]) > 604800' + name: 'Fedora countme totals DB timestamp is more than 7 days old' + priority: WARNING + dependencies: + - name: 'Fedora countme totals DB timestamp is more than 8 days old' + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/lib/countme/totals.db,modify]) > 691200' + tags: + - tag: scope + value: file_age + - uuid: c396067105874fe69ab37663cc8b643e + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/lib/countme/totals.db,modify]) > 691200' + name: 'Fedora countme totals DB timestamp is more than 8 days old' + priority: HIGH + tags: + - tag: scope + value: file_age + - uuid: 900bf5585bdf45618e5759ee24dfad9e + name: 'CentOS countme web totals DB (gzip) timestamp' + type: ZABBIX_ACTIVE + key: 'vfs.file.time[/var/www/html/csv-reports/countme/totals-centos-countme.db.gz,modify]' + history: 1d + trends: '0' + units: unixtime + tags: + - tag: application + value: countme + triggers: + - uuid: e8e05a96d13e470cb6e9284cd44c192f + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals-centos-countme.db.gz,modify]) > 604800' + name: 'CentOS countme web totals DB (gzip) timestamp is more than 7 days old' + priority: WARNING + dependencies: + - name: 'CentOS countme web totals DB (gzip) timestamp is more than 8 days old' + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals-centos-countme.db.gz,modify]) > 691200' + tags: + - tag: scope + value: file_age + - uuid: afe95177e98e4c3fb022aa07cbfedb3d + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals-centos-countme.db.gz,modify]) > 691200' + name: 'CentOS countme web totals DB (gzip) timestamp is more than 8 days old' + priority: HIGH + tags: + - tag: scope + value: file_age + - uuid: d31e85b93bb14ba1907a24783919261e + name: 'CentOS countme web unique totals DB (gzip) timestamp' + type: ZABBIX_ACTIVE + key: 'vfs.file.time[/var/www/html/csv-reports/countme/totals-centos-unique.db.gz,modify]' + history: 1d + trends: '0' + units: unixtime + tags: + - tag: application + value: countme + triggers: + - uuid: 969db33400f24ef7a8739bc4cd481418 + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals-centos-unique.db.gz,modify]) > 604800' + name: 'CentOS countme web unique totals DB (gzip) timestamp is more than 7 days old' + priority: WARNING + dependencies: + - name: 'CentOS countme web unique totals DB (gzip) timestamp is more than 8 days old' + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals-centos-unique.db.gz,modify]) > 691200' + tags: + - tag: scope + value: file_age + - uuid: f2f699582e4f4d0c9b6ce48aa4113cb0 + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals-centos-unique.db.gz,modify]) > 691200' + name: 'CentOS countme web unique totals DB (gzip) timestamp is more than 8 days old' + priority: HIGH + tags: + - tag: scope + value: file_age + - uuid: 6830cb82c2bf47e99d8f7472c41c63ed + name: 'CentOS countme web totals DB timestamp' + type: ZABBIX_ACTIVE + key: 'vfs.file.time[/var/www/html/csv-reports/countme/totals-centos.db,modify]' + history: 1d + trends: '0' + units: unixtime + tags: + - tag: application + value: countme + triggers: + - uuid: 9fff0bccd1c9471a8eb201b9224a0462 + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals-centos.db,modify]) > 86400' + name: 'CentOS countme web totals DB timestamp is more than 24 hours old' + priority: WARNING + dependencies: + - name: 'CentOS countme web totals DB timestamp is more than 48 hours old' + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals-centos.db,modify]) > 172800' + tags: + - tag: scope + value: file_age + - uuid: 2dcfc8ceddd34aaabecd90ce8ac3aa51 + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals-centos.db,modify]) > 172800' + name: 'CentOS countme web totals DB timestamp is more than 48 hours old' + priority: HIGH + tags: + - tag: scope + value: file_age + - uuid: 489ac2f375ed4efcaba287f1f49647fa + name: 'Fedora countme web totals DB (gzip) timestamp' + type: ZABBIX_ACTIVE + key: 'vfs.file.time[/var/www/html/csv-reports/countme/totals-countme.db.gz,modify]' + history: 1d + trends: '0' + units: unixtime + tags: + - tag: application + value: countme + triggers: + - uuid: 91a373f54ac54a678c74eee83e2cd876 + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals-countme.db.gz,modify]) > 604800' + name: 'Fedora countme web totals DB (gzip) timestamp is more than 7 days old' + priority: WARNING + dependencies: + - name: 'Fedora countme web totals DB (gzip) timestamp is more than 8 days old' + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals-countme.db.gz,modify]) > 691200' + tags: + - tag: scope + value: file_age + - uuid: 24e361f74ad248e2a2acba7b6327a1b4 + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals-countme.db.gz,modify]) > 691200' + name: 'Fedora countme web totals DB (gzip) timestamp is more than 8 days old' + priority: HIGH + tags: + - tag: scope + value: file_age + - uuid: c1f87919fe4a4c22a7f9e28d9ab24ef9 + name: 'Fedora countme web unique totals DB (gzip) timestamp' + type: ZABBIX_ACTIVE + key: 'vfs.file.time[/var/www/html/csv-reports/countme/totals-unique.db.gz,modify]' + history: 1d + trends: '0' + units: unixtime + tags: + - tag: application + value: countme + triggers: + - uuid: f887f1c0bd884b75b8825c87526df479 + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals-unique.db.gz,modify]) > 604800' + name: 'Fedora countme web unique totals DB (gzip) timestamp is more than 7 days old' + priority: WARNING + dependencies: + - name: 'Fedora countme web unique totals DB (gzip) timestamp is more than 8 days old' + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals-unique.db.gz,modify]) > 691200' + tags: + - tag: scope + value: file_age + - uuid: 55df9f8ee62d4c9691bf4f9071df52cf + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals-unique.db.gz,modify]) > 691200' + name: 'Fedora countme web unique totals DB (gzip) timestamp is more than 8 days old' + priority: HIGH + tags: + - tag: scope + value: file_age + - uuid: 044a800e8fd6440a86810a44aa3f2b19 + name: 'Fedora countme web totals DB timestamp' + type: ZABBIX_ACTIVE + key: 'vfs.file.time[/var/www/html/csv-reports/countme/totals.db,modify]' + history: 1d + trends: '0' + units: unixtime + tags: + - tag: application + value: countme + triggers: + - uuid: 5c24063c245a40899aea54d62357864b + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals.db,modify]) > 86400' + name: 'Fedora countme web totals DB timestamp is more than 24 hours old' + priority: WARNING + dependencies: + - name: 'Fedora countme web totals DB timestamp is more than 48 hours old' + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals.db,modify]) > 172800' + tags: + - tag: scope + value: file_age + - uuid: e3970e1a01e1460b928eea98c4534ff3 + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals.db,modify]) > 172800' + name: 'Fedora countme web totals DB timestamp is more than 48 hours old' + priority: HIGH + tags: + - tag: scope + value: file_age diff --git a/roles/web-data-analysis/tasks/main.yml b/roles/web-data-analysis/tasks/main.yml index 3b7f338bf6..f7135eaf9a 100644 --- a/roles/web-data-analysis/tasks/main.yml +++ b/roles/web-data-analysis/tasks/main.yml @@ -252,3 +252,30 @@ tags: - config - web-data + +# Zabbix monitoring of the CountMe datasets +- name: Zabbix API Block + vars: + ansible_zabbix_auth_key: "{{ zabbix_auth_key }}" + ansible_network_os: "{{ zabbix_network_os }}" + ansible_connection: "{{ zabbix_connection }}" + ansible_httpapi_port: "{{ zabbix_httpapi_port }}" + ansible_httpapi_use_ssl: "{{ zabbix_httpapi_use_ssl }}" + ansible_httpapi_validate_certs: "{{ zabbix_httpapi_validate_certs }}" + ansible_host: "{{ zabbix_server }}" + ansible_zabbix_url_path: "{{ zabbix_url_path }}" + tags: + - web-data + - zabbix_api + block: + - name: Import web-data checks template + community.zabbix.zabbix_template: + template_yaml: "{{ lookup('file', 'zabbix-template.yml') }}" + state: present + run_once: true + + - name: Add self to web-data checks template in Zabbix + community.zabbix.zabbix_host: + host_name: "{{ inventory_hostname }}" + link_templates: Web-Data checks + force: false From 977a470510a4c073cadf4d351298eab2e8d7a2ab Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Thu, 14 May 2026 13:07:30 -0700 Subject: [PATCH 128/269] s390x-test01: add s390x maintainer test machine Signed-off-by: Kevin Fenzi --- inventory/host_vars/s390x-test01.fedorainfracloud.org | 4 ++++ inventory/inventory | 1 + .../server/files/ccd-rdu3/s390x-test01.fedorainfracloud.org | 2 ++ 3 files changed, 7 insertions(+) create mode 100644 inventory/host_vars/s390x-test01.fedorainfracloud.org create mode 100644 roles/openvpn/server/files/ccd-rdu3/s390x-test01.fedorainfracloud.org diff --git a/inventory/host_vars/s390x-test01.fedorainfracloud.org b/inventory/host_vars/s390x-test01.fedorainfracloud.org new file mode 100644 index 0000000000..191cc20db8 --- /dev/null +++ b/inventory/host_vars/s390x-test01.fedorainfracloud.org @@ -0,0 +1,4 @@ +--- +nagios_Can_Connect: false +nagios_Check_Services: + nrpe: false diff --git a/inventory/inventory b/inventory/inventory index 25542fccc8..dbc8188f06 100644 --- a/inventory/inventory +++ b/inventory/inventory @@ -783,6 +783,7 @@ ppc64le-test.fedorainfracloud.org ppc64le-test02.fedorainfracloud.org aarch64-test01.fedorainfracloud.org aarch64-test02.fedorainfracloud.org +s390x-test01.fedorainfracloud.org [aarch64_test] aarch64-test01.fedorainfracloud.org diff --git a/roles/openvpn/server/files/ccd-rdu3/s390x-test01.fedorainfracloud.org b/roles/openvpn/server/files/ccd-rdu3/s390x-test01.fedorainfracloud.org new file mode 100644 index 0000000000..fa71bde4ac --- /dev/null +++ b/roles/openvpn/server/files/ccd-rdu3/s390x-test01.fedorainfracloud.org @@ -0,0 +1,2 @@ +# ifconfig-push actualIP PtPIP +ifconfig-push 192.168.100.39 192.168.100.39 From 68315a2324299ece84ebdbd293dfd8821ca6d9f9 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Thu, 14 May 2026 13:11:41 -0700 Subject: [PATCH 129/269] s390x-test01: should be in cloud group Signed-off-by: Kevin Fenzi --- inventory/cloud | 1 + 1 file changed, 1 insertion(+) diff --git a/inventory/cloud b/inventory/cloud index 8032eb2bc6..245f731db0 100644 --- a/inventory/cloud +++ b/inventory/cloud @@ -46,6 +46,7 @@ aarch64-test02.fedorainfracloud.org # This is not in aws, but here is good enough for now ppc64le-test.fedorainfracloud.org ppc64le-test02.fedorainfracloud.org +s390x-test01.fedorainfracloud.org logdetective01.fedorainfracloud.org logdetective02.fedorainfracloud.org From 1bde47906f3ea9b59e4dae909f5e069c62c00907 Mon Sep 17 00:00:00 2001 From: Akashdeep Dhar Date: Fri, 15 May 2026 08:23:25 +0530 Subject: [PATCH 130/269] firmitas: move from `t0xic0der/firmitas-test` to `playground/firmitas-test` Signed-off-by: Akashdeep Dhar --- roles/openshift-apps/firmitas/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/firmitas/defaults/main.yml b/roles/openshift-apps/firmitas/defaults/main.yml index 4794ca0892..6579ddf7f9 100644 --- a/roles/openshift-apps/firmitas/defaults/main.yml +++ b/roles/openshift-apps/firmitas/defaults/main.yml @@ -6,7 +6,7 @@ firmitas_forgejo_secret_volume_name: "firmitas-forgejo-volume" firmitas_forgejo_secret_name: "firmitas-forgejo-secret" firmitas_stg_forgejo_apikey: "OVERRIDEME" # in the ansible-private repo firmitas_stg_forgejo_username: "firmitas-automata" -firmitas_stg_forgejo_reponame: "t0xic0der/firmitas-test" +firmitas_stg_forgejo_reponame: "playground/firmitas-test" firmitas_forgejo_apikey: "OVERRIDEME" # in the ansible-private repo firmitas_forgejo_username: "firmitas-automata" firmitas_forgejo_reponame: "infra/tickets" From 623214b0c9d6eb1d812eb847126b43d89d95c729 Mon Sep 17 00:00:00 2001 From: Ryan Lerch Date: Fri, 15 May 2026 20:09:16 +1000 Subject: [PATCH 131/269] maubot: apply hotfix to maubot to fix __provides__ issue related: https://forge.fedoraproject.org/infra/tickets/issues/13347 Signed-off-by: Ryan Lerch --- roles/openshift-apps/maubot/templates/buildconfig.yml.j2 | 2 ++ 1 file changed, 2 insertions(+) diff --git a/roles/openshift-apps/maubot/templates/buildconfig.yml.j2 b/roles/openshift-apps/maubot/templates/buildconfig.yml.j2 index b961f1ca14..d3105351c4 100644 --- a/roles/openshift-apps/maubot/templates/buildconfig.yml.j2 +++ b/roles/openshift-apps/maubot/templates/buildconfig.yml.j2 @@ -14,6 +14,8 @@ spec: FROM fedora:43 RUN dnf -y install python3-pip python3-gssapi git libpq-devel gcc gcc-c++ python-devel cmake && dnf -y clean all RUN pip install maubot[encryption] python-slugify httpx httpx_gssapi jinja2 fedora-messaging meetbot-messages pydantic maubot-fedora-messages backoff arrow python-gitlab pytz + # Python 3.14: register_handler_class must skip dir() names where getattr raises (__provides__) + RUN python3 -c 'import importlib.util, pathlib, sys; p=pathlib.Path(importlib.util.find_spec("maubot").origin).parent/"plugin_base.py"; old=" for key in dir(obj):\n val = getattr(obj, key)\n"; new=" for key in dir(obj):\n try:\n val = getattr(obj, key)\n except AttributeError:\n continue\n"; t=p.read_text(); (sys.exit(0) if "except AttributeError:\n continue" in t else sys.exit("maubot patch: pattern not found") if old not in t else p.write_text(t.replace(old, new, 1)))' RUN \ curl https://raw.githubusercontent.com/fedora-infra/matrix-bots/main/install-plugins-from-git.py -o /usr/local/bin/install-maubot-plugins && \ chmod +x /usr/local/bin/install-maubot-plugins && \ From 7688d6da70b9ff422b7b22972c5c5d8a226f631c Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Thu, 14 May 2026 16:30:45 -0700 Subject: [PATCH 132/269] proxies / website: on src/koji/riscv-koji have POSTs bypass anubis See https://forge.fedoraproject.org/infra/tickets/issues/12913 and https://github.com/TecharoHQ/anubis/issues/1624 We are seeing sporadic EOF errors when koji/src/riscv-koji send a 200 reply back through anubis. Since we just allow POST in anubis anyhow, bypass it entirely for them to avoid the EOF issue until we can sort it out more. Signed-off-by: Kevin Fenzi --- roles/httpd/website/templates/website.conf | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/roles/httpd/website/templates/website.conf b/roles/httpd/website/templates/website.conf index eef8d21d86..94daaa29e4 100644 --- a/roles/httpd/website/templates/website.conf +++ b/roles/httpd/website/templates/website.conf @@ -148,6 +148,17 @@ ProxyTimeout 10800 {% endif %} +{% if site_name == 'koji.fedoraproject.org' or site_name == 'riscv-koji.fedoraproject.org' or site_name == 'src.fedoraproject.org' %} + # We allow POST thru anubis, but we are seeing a sporadic EOF error with replies + # coming from the backend. See https://forge.fedoraproject.org/infra/tickets/issues/12913 + # + # So, just bypass anubis for POST's + # + RewriteEngine On + RewriteCond %{REQUEST_METHOD} POST + RewriteRule ^(.*)$ http://127.0.0.1:8345$1 [P,L] +{% endif %} + {% if site_name.startswith('openqa') %} # Openqa uses websockets, so allow them through anubis proxying. ProxyPass / http://127.0.0.1:8987/ upgrade=websocket keepalive=on ttl=15 From 6ccaaca78dc407faa4f9b64e6b82c37054ff84c1 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 15 May 2026 09:57:29 -0700 Subject: [PATCH 133/269] proxies: adjust zabbix template name Signed-off-by: Kevin Fenzi --- roles/httpd/proxy/tasks/main.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/httpd/proxy/tasks/main.yml b/roles/httpd/proxy/tasks/main.yml index a9e4e9b8b5..fffba4e26d 100644 --- a/roles/httpd/proxy/tasks/main.yml +++ b/roles/httpd/proxy/tasks/main.yml @@ -130,12 +130,12 @@ - httpd/proxy - zabbix_api block: - - name: Import Proxy HTTPd checks template + - name: Import Proxy checks template community.zabbix.zabbix_template: template_yaml: "{{ lookup('file', 'zabbix-template.yml') }}" state: present - name: Add self to Proxy checks template in Zabbix community.zabbix.zabbix_host: host_name: "{{ inventory_hostname }}" - link_templates: Proxy HTTPd checks + link_templates: Proxy checks force: false From 73dc88c487f2e8f90895c6bd5db56ceb0fb393bc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADt=20Smol=C3=ADk?= Date: Fri, 15 May 2026 19:23:41 +0200 Subject: [PATCH 134/269] fix: fix the annoying HTTP authentication popup on windows (stg only) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Vít Smolík --- roles/ipsilon/templates/httpd.conf.j2 | 3 +++ 1 file changed, 3 insertions(+) diff --git a/roles/ipsilon/templates/httpd.conf.j2 b/roles/ipsilon/templates/httpd.conf.j2 index 0764c10eec..9149dbfd92 100644 --- a/roles/ipsilon/templates/httpd.conf.j2 +++ b/roles/ipsilon/templates/httpd.conf.j2 @@ -47,6 +47,9 @@ WSGIApplicationGroup %{GLOBAL} AuthName "GSSAPI Single Sign On Login" GssapiCredStore keytab:/etc/krb5.HTTP_id{{ env_suffix }}.fedoraproject.org.keytab AuthType GSSAPI +{% if env == "staging" %} + BrowserMatch Windows gssapi-no-negotiate +{% endif %} # This is off because Apache (and thus mod_auth_gssapi) doesn't know this is proxied over TLS GssapiSSLonly Off GssapiLocalName on From af80a6a3a0704e60a3d28bfe338ee660b116daa3 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Thu, 14 May 2026 10:46:56 -0700 Subject: [PATCH 135/269] secure-boot: clean up old bkernel role and add 2 more builders We are no longer using the bkernel role (using the old card thats in buildhw-x86-01), so this removes that role and mentions of it. Also, because we are urgently building kernels all the time now, add one more buildhw-x86 and one more buildhw-a64 to secure-boot channel so we can build more/faster kernels. Signed-off-by: Kevin Fenzi --- inventory/builders | 7 +- inventory/inventory | 2 +- playbooks/groups/buildhw.yml | 12 ++-- playbooks/groups/buildvm.yml | 1 - roles/base/tasks/main.yml | 2 +- roles/bkernel/files/history_off.sh | 2 - roles/bkernel/files/pesign-users | 2 - roles/bkernel/tasks/main.yml | 70 ------------------- .../templates/bkernel-site-defaults.cfg | 23 ------ roles/koji_builder/tasks/main.yml | 2 +- 10 files changed, 10 insertions(+), 113 deletions(-) delete mode 100644 roles/bkernel/files/history_off.sh delete mode 100644 roles/bkernel/files/pesign-users delete mode 100644 roles/bkernel/tasks/main.yml delete mode 100644 roles/bkernel/templates/bkernel-site-defaults.cfg diff --git a/inventory/builders b/inventory/builders index f8e25c5ae2..6b480107de 100644 --- a/inventory/builders +++ b/inventory/builders @@ -401,10 +401,9 @@ buildvm-ppc64le-30.rdu3.fedoraproject.org buildvm-ppc64le-31.rdu3.fedoraproject.org buildvm-ppc64le-32.rdu3.fedoraproject.org -[bkernel] -buildhw-x86-01.rdu3.fedoraproject.org - [secureboot] +buildhw-x86-01.rdu3.fedoraproject.org +buildhw-a64-01.rdu3.fedoraproject.org buildhw-x86-02.rdu3.fedoraproject.org buildhw-a64-02.rdu3.fedoraproject.org @@ -467,7 +466,7 @@ buildvm buildvm_aarch64 buildvm_ppc64le buildvm_s390x -bkernel +secureboot [builders_stg:children] buildhw_ppc64le_stg diff --git a/inventory/inventory b/inventory/inventory index dbc8188f06..f3911d4b9f 100644 --- a/inventory/inventory +++ b/inventory/inventory @@ -817,7 +817,7 @@ colo_virt value staging builders -bkernel +secureboot buildvmhost [groupc] diff --git a/playbooks/groups/buildhw.yml b/playbooks/groups/buildhw.yml index 72f828c52e..674a00acb9 100644 --- a/playbooks/groups/buildhw.yml +++ b/playbooks/groups/buildhw.yml @@ -1,10 +1,10 @@ --- - import_playbook: "/srv/web/infra/ansible/playbooks/include/happy_birthday.yml" vars: - myhosts: "buildhw:bkernel:buildhw_stg" + myhosts: "buildhw:buildhw_stg" - name: make koji builder(s) on raw hw - hosts: buildhw:bkernel:buildhw_stg + hosts: buildhw:buildhw_stg remote_user: root gather_facts: true @@ -67,18 +67,14 @@ - koji_builder - - role: bkernel - when: "'bkernel' in group_names" - - role: siguldry/pesign_bridge when: inventory_hostname.startswith(('buildhw-x86-02','buildhw-a64-02')) - - { role: linux-system-roles.nbde_client, when: "inventory_hostname.startswith(('bkernel', 'buildhw'))" } - - { role: serial-console, when: "inventory_hostname.startswith(('bkernel', 'buildhw-x86'))" } + - { role: linux-system-roles.nbde_client, when: "inventory_hostname.startswith(('buildhw'))" } + - { role: serial-console, when: "inventory_hostname.startswith(('buildhw-x86'))" } - hosts - ipa/client - role: sudo - when: not inventory_hostname.startswith(('bkernel', 'buildhw-x86-01.rdu3')) - role: keytab/service kt_location: /etc/kojid/kojid.keytab diff --git a/playbooks/groups/buildvm.yml b/playbooks/groups/buildvm.yml index eaaf9be035..554d448d9d 100644 --- a/playbooks/groups/buildvm.yml +++ b/playbooks/groups/buildvm.yml @@ -33,7 +33,6 @@ } - ipa/client - role: sudo - when: not inventory_hostname.startswith('bkernel') and env == 'production' - koji_builder - role: nfs/client mnt_dir: '/mnt/koji/ostree' diff --git a/roles/base/tasks/main.yml b/roles/base/tasks/main.yml index 559ef516f4..71cf409754 100644 --- a/roles/base/tasks/main.yml +++ b/roles/base/tasks/main.yml @@ -46,7 +46,7 @@ - rootpw - base when: - - not inventory_hostname.startswith(('buildvm-','buildhw-','bkernel','compose')) + - not inventory_hostname.startswith(('buildvm-','buildhw-','compose')) - not inventory_hostname.startswith('copr') - name: Add ansible root key diff --git a/roles/bkernel/files/history_off.sh b/roles/bkernel/files/history_off.sh deleted file mode 100644 index be7ee75a3e..0000000000 --- a/roles/bkernel/files/history_off.sh +++ /dev/null @@ -1,2 +0,0 @@ -unset HISTFILE -set HISTSIZE=0 diff --git a/roles/bkernel/files/pesign-users b/roles/bkernel/files/pesign-users deleted file mode 100644 index 649d673d6c..0000000000 --- a/roles/bkernel/files/pesign-users +++ /dev/null @@ -1,2 +0,0 @@ -kojibuilder -pesign diff --git a/roles/bkernel/tasks/main.yml b/roles/bkernel/tasks/main.yml deleted file mode 100644 index 850962b108..0000000000 --- a/roles/bkernel/tasks/main.yml +++ /dev/null @@ -1,70 +0,0 @@ ---- -- name: Add pkgs for bkernel boxes - ansible.builtin.package: - state: present - name: - - pesign - - ccid - - pcsc-lite - - pcsc-lite-libs - - opensc - - nss-tools - tags: - - bkernel - -- name: Enable pcscd - service: name=pcscd state=started enabled=true - tags: - - bkernel - -- name: Setup opensc in pcscd - ansible.builtin.shell: modutil -dbdir /etc/pki/pesign -list | grep -q OpenSC || modutil -force -dbdir /etc/pki/pesign -add opensc -libfile /usr/lib64/pkcs11/opensc-pkcs11.so - check_mode: no - changed_when: "1 != 1" - tags: - - bkernel - -- name: Setup pesign users config - ansible.builtin.copy: src=pesign-users dest=/etc/pesign/users mode=0600 owner=root group=root - tags: - - bkernel - -- name: Enable pesign - service: name=pesign state=started enabled=true - tags: - - bkernel - -- name: /var/run/pesign directory perms (kojibuilder) - acl: path=/var/run/pesign entity=kojibuilder etype=user permissions=rwx recursive=true state=present - tags: - - bkernel - -- name: /var/run/pesign directory perms (pesign) - acl: path=/var/run/pesign default=true entity=pesign etype=group permissions=rwx recursive=true state=present - tags: - - bkernel - -- name: /var/run/pesign socket perms (kojibuilder) - acl: path=/var/run/pesign/socket entity=kojibuilder etype=user permissions=rwx recursive=true state=present - tags: - - bkernel - -- name: /var/run/pesign socket perms (pesign) - acl: path=/var/run/pesign/socket default=true entity=pesign etype=group permissions=rwx recursive=true state=present - tags: - - bkernel - -- name: When you awake you will remember nothing - ansible.builtin.copy: src=history_off.sh dest=/etc/profile.d/history_off.sh mode=0644 - tags: - - bkernel - -- name: Mock site-defaults.cfg - ansible.builtin.template: - src: bkernel-site-defaults.cfg - dest: /etc/mock/site-defaults.cfg - mode: "0644" - owner: root - group: mock - tags: - - bkernel diff --git a/roles/bkernel/templates/bkernel-site-defaults.cfg b/roles/bkernel/templates/bkernel-site-defaults.cfg deleted file mode 100644 index f48419dd96..0000000000 --- a/roles/bkernel/templates/bkernel-site-defaults.cfg +++ /dev/null @@ -1,23 +0,0 @@ -# mount the pesign socket into the chroot -config_opts['plugin_conf']['bind_mount_opts']['dirs'].append(('/var/run/pesign', '/var/run/pesign' )) -config_opts['nspawn_args'] += ['--bind=/var/run/pesign'] -config_opts['plugin_conf']['package_state_enable'] = False -config_opts['macros']['%bugurl'] = 'https://bugz.fedoraproject.org/%name' -#config_opts['nosync'] = True -#config_opts['nosync_force'] = True -config_opts['dnf_common_opts'] = ['--setopt=install_weak_deps=0'] -config_opts['environment']['LANG'] = 'C.UTF-8' -config_opts['use_bootstrap'] = False -config_opts['dnf_warning'] = False - -# dnf group install with '--allowerasing' is still to be released: -# https://github.com/rpm-software-management/dnf5/pull/1174 -config_opts["dnf5_avoid_opts"] = { - "group": ["--allowerasing"], -} - -config_opts['plugin_conf']['rpmautospec_enable'] = True -config_opts['plugin_conf']['rpmautospec_opts'] = { - 'requires': ['rpmautospec'], - 'cmd_base': ['/usr/bin/rpmautospec', 'process-distgit'], -} diff --git a/roles/koji_builder/tasks/main.yml b/roles/koji_builder/tasks/main.yml index a7ca34ae7e..b6344b32a0 100644 --- a/roles/koji_builder/tasks/main.yml +++ b/roles/koji_builder/tasks/main.yml @@ -226,7 +226,7 @@ - name: Mock site-defaults.cfg ansible.builtin.template: src=builders/site-defaults.cfg dest=/etc/mock/site-defaults.cfg mode=0644 owner=root group=mock - when: not inventory_hostname.startswith(('bkernel')) + when: "'secureboot' not in group_names" tags: - koji_builder - site-defaults From 442852923def759536e171a25d7edb01f1e08094 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADt=20Smol=C3=ADk?= Date: Fri, 15 May 2026 21:12:04 +0200 Subject: [PATCH 136/269] fix: fix the annoying HTTP authentication popup on windows (prod) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Vít Smolík --- roles/ipsilon/templates/httpd.conf.j2 | 2 -- 1 file changed, 2 deletions(-) diff --git a/roles/ipsilon/templates/httpd.conf.j2 b/roles/ipsilon/templates/httpd.conf.j2 index 9149dbfd92..b2b8256a5e 100644 --- a/roles/ipsilon/templates/httpd.conf.j2 +++ b/roles/ipsilon/templates/httpd.conf.j2 @@ -47,9 +47,7 @@ WSGIApplicationGroup %{GLOBAL} AuthName "GSSAPI Single Sign On Login" GssapiCredStore keytab:/etc/krb5.HTTP_id{{ env_suffix }}.fedoraproject.org.keytab AuthType GSSAPI -{% if env == "staging" %} BrowserMatch Windows gssapi-no-negotiate -{% endif %} # This is off because Apache (and thus mod_auth_gssapi) doesn't know this is proxied over TLS GssapiSSLonly Off GssapiLocalName on From 51081991befe830f7ad9a3bd3657a70470202d10 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 15 May 2026 12:30:12 -0700 Subject: [PATCH 137/269] buildhw: install pesign_bridge on all secureboot group members Signed-off-by: Kevin Fenzi --- playbooks/groups/buildhw.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/playbooks/groups/buildhw.yml b/playbooks/groups/buildhw.yml index 674a00acb9..e9633d0f88 100644 --- a/playbooks/groups/buildhw.yml +++ b/playbooks/groups/buildhw.yml @@ -68,7 +68,7 @@ - koji_builder - role: siguldry/pesign_bridge - when: inventory_hostname.startswith(('buildhw-x86-02','buildhw-a64-02')) + when: "'secureboot' in group_names" - { role: linux-system-roles.nbde_client, when: "inventory_hostname.startswith(('buildhw'))" } - { role: serial-console, when: "inventory_hostname.startswith(('buildhw-x86'))" } From 4e24b694b46b57848705b25d86fa5d09d58d11ed Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sun, 17 May 2026 12:18:58 -0700 Subject: [PATCH 138/269] kickstarts: rhel10: use https for all the urls Signed-off-by: Kevin Fenzi --- .../templates/hardware-rhel-10-06disk-aarch64.j2 | 10 +++++----- roles/kickstarts/templates/hardware-rhel-10-08disk.j2 | 10 +++++----- .../templates/hardware-rhel-10-10disk-copr.j2 | 10 +++++----- roles/kickstarts/templates/hardware-rhel-10-10disk.j2 | 10 +++++----- roles/kickstarts/templates/hardware-rhel-10-nodisk.j2 | 10 +++++----- roles/kickstarts/templates/hardware-rhel-9-08disk.j2 | 10 +++++----- roles/kickstarts/templates/kvm-rhel-10.j2 | 6 +++--- 7 files changed, 33 insertions(+), 33 deletions(-) diff --git a/roles/kickstarts/templates/hardware-rhel-10-06disk-aarch64.j2 b/roles/kickstarts/templates/hardware-rhel-10-06disk-aarch64.j2 index 1dd1f811f7..d8b49c1b4f 100644 --- a/roles/kickstarts/templates/hardware-rhel-10-06disk-aarch64.j2 +++ b/roles/kickstarts/templates/hardware-rhel-10-06disk-aarch64.j2 @@ -1,11 +1,11 @@ # Use network installation vnc --password "{{ kickstart_vnc_password }}" # Use network install -url --url=http://infrastructure.fedoraproject.org/repo/rhel/RHEL10-aarch64/ -repo --name=epel --baseurl=http://infrastructure.fedoraproject.org/pub/epel/10/Everything/aarch64/ -repo --name="net-baseos" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/aarch64/baseos/ -repo --name="net-appstream" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/aarch64/appstream/ -repo --name="net-crb" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/aarch64/crb/ +url --url=https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-aarch64/ +repo --name=epel --baseurl=https://infrastructure.fedoraproject.org/pub/epel/10/Everything/aarch64/ +repo --name="net-baseos" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/aarch64/baseos/ +repo --name="net-appstream" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/aarch64/appstream/ +repo --name="net-crb" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/aarch64/crb/ # Firewall configuration firewall --disabled diff --git a/roles/kickstarts/templates/hardware-rhel-10-08disk.j2 b/roles/kickstarts/templates/hardware-rhel-10-08disk.j2 index 41a599c3c4..ba392a0014 100644 --- a/roles/kickstarts/templates/hardware-rhel-10-08disk.j2 +++ b/roles/kickstarts/templates/hardware-rhel-10-08disk.j2 @@ -5,11 +5,11 @@ # Use network installation vnc --password "{{ kickstart_vnc_password }}" # Use network install -url --url=http://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ -repo --name=epel --baseurl=http://infrastructure.fedoraproject.org/pub/epel/10/Everything/x86_64/ -repo --name="net-baseos" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/baseos/ -repo --name="net-appstream" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/appstream/ -repo --name="net-crb" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/crb/ +url --url=https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +repo --name=epel --baseurl=https://infrastructure.fedoraproject.org/pub/epel/10/Everything/x86_64/ +repo --name="net-baseos" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/baseos/ +repo --name="net-appstream" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/appstream/ +repo --name="net-crb" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/crb/ # Firewall configuration firewall --disabled diff --git a/roles/kickstarts/templates/hardware-rhel-10-10disk-copr.j2 b/roles/kickstarts/templates/hardware-rhel-10-10disk-copr.j2 index bee91eaf68..9617db767a 100644 --- a/roles/kickstarts/templates/hardware-rhel-10-10disk-copr.j2 +++ b/roles/kickstarts/templates/hardware-rhel-10-10disk-copr.j2 @@ -5,11 +5,11 @@ # Use network installation vnc --password "{{ kickstart_vnc_password }}" # Use network install -url --url=http://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ -repo --name=epel --baseurl=http://infrastructure.fedoraproject.org/pub/epel/10/Everything/x86_64/ -repo --name="net-baseos" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/baseos/ -repo --name="net-appstream" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/appstream/ -repo --name="net-crb" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/crb/ +url --url=https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +repo --name=epel --baseurl=https://infrastructure.fedoraproject.org/pub/epel/10/Everything/x86_64/ +repo --name="net-baseos" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/baseos/ +repo --name="net-appstream" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/appstream/ +repo --name="net-crb" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/crb/ # Firewall configuration firewall --disabled diff --git a/roles/kickstarts/templates/hardware-rhel-10-10disk.j2 b/roles/kickstarts/templates/hardware-rhel-10-10disk.j2 index 583318c724..f3c925ae96 100644 --- a/roles/kickstarts/templates/hardware-rhel-10-10disk.j2 +++ b/roles/kickstarts/templates/hardware-rhel-10-10disk.j2 @@ -5,11 +5,11 @@ # Use network installation vnc --password "{{ kickstart_vnc_password }}" # Use network install -url --url=http://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ -repo --name=epel --baseurl=http://infrastructure.fedoraproject.org/pub/epel/10/Everything/x86_64/ -repo --name="net-baseos" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/baseos/ -repo --name="net-appstream" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/appstream/ -repo --name="net-crb" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/crb/ +url --url=https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +repo --name=epel --baseurl=https://infrastructure.fedoraproject.org/pub/epel/10/Everything/x86_64/ +repo --name="net-baseos" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/baseos/ +repo --name="net-appstream" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/appstream/ +repo --name="net-crb" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/crb/ # Firewall configuration firewall --disabled diff --git a/roles/kickstarts/templates/hardware-rhel-10-nodisk.j2 b/roles/kickstarts/templates/hardware-rhel-10-nodisk.j2 index e49fea23f8..12a06f5fdb 100644 --- a/roles/kickstarts/templates/hardware-rhel-10-nodisk.j2 +++ b/roles/kickstarts/templates/hardware-rhel-10-nodisk.j2 @@ -5,11 +5,11 @@ # Use network installation vnc --password "{{ kickstart_vnc_password }}" # Use network install -url --url=http://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ -repo --name=epel --baseurl=http://infrastructure.fedoraproject.org/pub/epel/10/Everything/x86_64/ -repo --name="net-baseos" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/baseos/ -repo --name="net-appstream" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/appstream/ -repo --name="net-crb" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/crb/ +url --url=https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +repo --name=epel --baseurl=https://infrastructure.fedoraproject.org/pub/epel/10/Everything/x86_64/ +repo --name="net-baseos" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/baseos/ +repo --name="net-appstream" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/appstream/ +repo --name="net-crb" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/crb/ # Firewall configuration firewall --disabled diff --git a/roles/kickstarts/templates/hardware-rhel-9-08disk.j2 b/roles/kickstarts/templates/hardware-rhel-9-08disk.j2 index 682a311e61..48d37f5235 100644 --- a/roles/kickstarts/templates/hardware-rhel-9-08disk.j2 +++ b/roles/kickstarts/templates/hardware-rhel-9-08disk.j2 @@ -7,11 +7,11 @@ auth --enableshadow --passalgo=sha512 # Use network installation vnc --password "{{ kickstart_vnc_password }}" # Use network install -url --url=http://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -repo --name=epel --baseurl=http://infrastructure.fedoraproject.org/pub/epel/9/Everything/x86_64/ -repo --name="net-baseos" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel9/x86_64/rhel-9-for-x86_64-baseos-rpms/ -repo --name="net-appstream" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel9/x86_64/rhel-9-for-x86_64-appstream-rpms/ -repo --name="net-crb" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel9/x86_64/codeready-builder-for-rhel-9-x86_64-rpms/ +url --url=https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ +repo --name=epel --baseurl=https://infrastructure.fedoraproject.org/pub/epel/9/Everything/x86_64/ +repo --name="net-baseos" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel9/x86_64/rhel-9-for-x86_64-baseos-rpms/ +repo --name="net-appstream" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel9/x86_64/rhel-9-for-x86_64-appstream-rpms/ +repo --name="net-crb" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel9/x86_64/codeready-builder-for-rhel-9-x86_64-rpms/ # Firewall configuration firewall --disabled diff --git a/roles/kickstarts/templates/kvm-rhel-10.j2 b/roles/kickstarts/templates/kvm-rhel-10.j2 index 0fefb1717b..6ceb468ce3 100644 --- a/roles/kickstarts/templates/kvm-rhel-10.j2 +++ b/roles/kickstarts/templates/kvm-rhel-10.j2 @@ -7,9 +7,9 @@ eula --agreed # Setup Repository info url --url=https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ repo --name=epel --baseurl=https://infrastructure.fedoraproject.org/pub/epel/10/Everything/x86_64/ -repo --name="net-baseos" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/baseos/ -repo --name="net-appstream" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/appstream/ -repo --name="net-crb" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/crb/ +repo --name="net-baseos" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/baseos/ +repo --name="net-appstream" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/appstream/ +repo --name="net-crb" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/crb/ # Run the Setup Agent on first boot firstboot --disable # Keyboard layouts From 4cf99e088abfa4ff489cb41613984c40d583ef8f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADt=20Smol=C3=ADk?= Date: Mon, 18 May 2026 09:14:27 +0200 Subject: [PATCH 139/269] fix(proxies): add www.fedoraproject.org back MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Vít Smolík --- playbooks/include/proxies-websites.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/playbooks/include/proxies-websites.yml b/playbooks/include/proxies-websites.yml index aa852ecb37..78fb9e3477 100644 --- a/playbooks/include/proxies-websites.yml +++ b/playbooks/include/proxies-websites.yml @@ -48,6 +48,7 @@ server_aliases: - stg.fedoraproject.org - localhost + - www.fedoraproject.org - hotspot-nocache.fedoraproject.org tags: fedoraproject.org From 917e6f4f5c503805a29de956f71bf89bc7129331 Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Fri, 15 May 2026 12:23:34 +0100 Subject: [PATCH 140/269] Zabbix: Migrate SSH connectivity checks from Nagios Signed-off-by: Greg Sutcliffe --- roles/batcave/files/zabbix-ssh-agent.conf | 1 + roles/batcave/files/zabbix-ssh-list.cron | 16 +++++ roles/batcave/files/zabbix-ssh-template.yml | 61 +++++++++++++++++++ roles/batcave/tasks/main.yml | 49 +++++++++++++++ .../files/nagios/services/ssh.cfg | 7 --- 5 files changed, 127 insertions(+), 7 deletions(-) create mode 100644 roles/batcave/files/zabbix-ssh-agent.conf create mode 100755 roles/batcave/files/zabbix-ssh-list.cron create mode 100644 roles/batcave/files/zabbix-ssh-template.yml diff --git a/roles/batcave/files/zabbix-ssh-agent.conf b/roles/batcave/files/zabbix-ssh-agent.conf new file mode 100644 index 0000000000..635f3ae8d9 --- /dev/null +++ b/roles/batcave/files/zabbix-ssh-agent.conf @@ -0,0 +1 @@ +UserParameter=ssh.discovery,awk 'BEGIN{printf "{\"data\":["}; {printf c"{\"{#SSH_HOST}\":\""$1"\"}";c=","}; END{print "]}"}' /etc/zabbix/ssh-targets.txt 2>/dev/null diff --git a/roles/batcave/files/zabbix-ssh-list.cron b/roles/batcave/files/zabbix-ssh-list.cron new file mode 100755 index 0000000000..ce9c1b7a92 --- /dev/null +++ b/roles/batcave/files/zabbix-ssh-list.cron @@ -0,0 +1,16 @@ +#!/bin/bash +# Generate the host list Zabbix should monitor for SSH access from the Ansible +# inventory data + +# Right now this just gets all the virtservers which matches Nagios, but we +# should probably expand it to all known-available hosts + +TMP_FILE=$(mktemp) +/usr/bin/ansible '*virtserver*' --list-hosts |grep -v "hosts.*:"|tr -d " " > "$TMP_FILE" + +if [ -s "$TMP_FILE" ]; then + mv "$TMP_FILE" /etc/zabbix/ssh-targets.txt + chmod 644 /etc/zabbix/ssh-targets.txt +else + rm -f "$TMP_FILE" +fi diff --git a/roles/batcave/files/zabbix-ssh-template.yml b/roles/batcave/files/zabbix-ssh-template.yml new file mode 100644 index 0000000000..c7100ec5c7 --- /dev/null +++ b/roles/batcave/files/zabbix-ssh-template.yml @@ -0,0 +1,61 @@ +zabbix_export: + version: '7.0' + template_groups: + - uuid: a333cbd6a3ad44baaa4eee4b0c0b1bec + name: Fedora + templates: + - uuid: f5dbfadc0ccd42c4b04172f09268481f + template: 'SSH access from Batcave' + name: 'SSH access from Batcave' + description: 'Only applies to Batcave and tests SSH access works. Uses discovery from a file populated from the Ansible inventory in /etc/zabbix/ssh-targets.txt via a cronjob.' + groups: + - name: Fedora + discovery_rules: + - uuid: ad85fd77593f4f2aa8073ced51d943a7 + name: 'SSH Target discovery' + type: ZABBIX_ACTIVE + key: ssh.discovery + delay: 1h + enabled_lifetime_type: DISABLE_NEVER + item_prototypes: + - uuid: 1f78c9bd8e894f799bea27e8f0429b8c + name: 'SSH host {#SSH_HOST} response time' + type: ZABBIX_ACTIVE + key: 'net.tcp.service.perf[ssh,{#SSH_HOST},22]' + delay: 5m + value_type: FLOAT + units: ms + valuemap: + name: 'Service status' + preprocessing: + - type: MULTIPLIER + parameters: + - '1000' + tags: + - tag: application + value: ssh + - uuid: 8fe6bedbdcc9480a8c00bfa1ead93400 + name: 'SSH host {#SSH_HOST} port access' + type: ZABBIX_ACTIVE + key: 'net.tcp.service[ssh,{#SSH_HOST},22]' + delay: 5m + valuemap: + name: 'Service status' + tags: + - tag: application + value: ssh + trigger_prototypes: + - uuid: 40b9cea515c6423fbcac99624676c1d0 + expression: 'last(/SSH access from Batcave/net.tcp.service[ssh,{#SSH_HOST},22]) = 0' + name: 'SSH host {#SSH_HOST} not reachable on 22' + tags: + - tag: scope + value: availability + valuemaps: + - uuid: a1b16e35c8e84f1c965fcfdde805297a + name: 'Service status' + mappings: + - value: '0' + newvalue: Down + - value: '1' + newvalue: Up diff --git a/roles/batcave/tasks/main.yml b/roles/batcave/tasks/main.yml index f9ec4f32e2..90ff923217 100644 --- a/roles/batcave/tasks/main.yml +++ b/roles/batcave/tasks/main.yml @@ -705,3 +705,52 @@ tags: - batcave - config + +# Monitoring setup for Batcave +- name: Setup cron for generating SSH monitoring hostlist + ansible.builtin.copy: + src: zabbix-ssh-list.cron + dest: /etc/cron.hourly/zabbix-ssh-list.cron + mode: '0755' + tags: + - batcave + - ssh + - zabbix_agent + +- name: Install Zabbix agent config drop-in + ansible.builtin.copy: + src: zabbix-ssh-agent.conf + dest: /etc/zabbix/zabbix_agentd.d/ssh-targets.conf + mode: '0644' + tags: + - batcave + - ssh + - zabbix_agent + notify: + - Restart zabbix agent + +- name: Zabbix API Block + vars: + ansible_zabbix_auth_key: "{{ zabbix_auth_key }}" + ansible_network_os: "{{ zabbix_network_os }}" + ansible_connection: "{{ zabbix_connection }}" + ansible_httpapi_port: "{{ zabbix_httpapi_port }}" + ansible_httpapi_use_ssl: "{{ zabbix_httpapi_use_ssl }}" + ansible_httpapi_validate_certs: "{{ zabbix_httpapi_validate_certs }}" + ansible_host: "{{ zabbix_server }}" + ansible_zabbix_url_path: "{{ zabbix_url_path }}" + tags: + - zabbix_api + - batcave + - ssh + block: + - name: Import Batcave SSH template file + community.zabbix.zabbix_template: + template_yaml: "{{ lookup('file', 'zabbix-ssh-template.yml') }}" + state: present + + - name: Add self to SSH template in Zabbix + community.zabbix.zabbix_host: + host_name: "{{ inventory_hostname }}" + link_templates: SSH access from Batcave + force: false diff --git a/roles/nagios_server/files/nagios/services/ssh.cfg b/roles/nagios_server/files/nagios/services/ssh.cfg index 9a86529df5..0bdf386632 100644 --- a/roles/nagios_server/files/nagios/services/ssh.cfg +++ b/roles/nagios_server/files/nagios/services/ssh.cfg @@ -1,10 +1,3 @@ -define service { - hostgroup_name virtservers - service_description SSH-virtservers - check_command check_ssh - use defaulttemplate -} - define service { hostgroup_name bastion service_description SSH-bastion From 1aac9b0c7b834aa8f71849ea70a81e6367a491cf Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Mon, 18 May 2026 12:07:43 -0700 Subject: [PATCH 141/269] kickstarts / rhel10-nohd: switch to rdp, vnc is no longer available in 10.1 Signed-off-by: Kevin Fenzi --- roles/kickstarts/templates/hardware-rhel-10-nodisk.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/kickstarts/templates/hardware-rhel-10-nodisk.j2 b/roles/kickstarts/templates/hardware-rhel-10-nodisk.j2 index 12a06f5fdb..71d60a72ec 100644 --- a/roles/kickstarts/templates/hardware-rhel-10-nodisk.j2 +++ b/roles/kickstarts/templates/hardware-rhel-10-nodisk.j2 @@ -3,7 +3,7 @@ ## # Use network installation -vnc --password "{{ kickstart_vnc_password }}" +rdp --username root --password "{{ kickstart_vnc_password }}" # Use network install url --url=https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ repo --name=epel --baseurl=https://infrastructure.fedoraproject.org/pub/epel/10/Everything/x86_64/ From d4c013129aec39997aa6e60b12288d3888051038 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Mon, 18 May 2026 12:42:54 -0700 Subject: [PATCH 142/269] kickstarts / rhel10-nohd: drop rdp as it is not implemented in rhel 10.1 kickstarts as far as I can tell Signed-off-by: Kevin Fenzi --- roles/kickstarts/templates/hardware-rhel-10-nodisk.j2 | 2 -- 1 file changed, 2 deletions(-) diff --git a/roles/kickstarts/templates/hardware-rhel-10-nodisk.j2 b/roles/kickstarts/templates/hardware-rhel-10-nodisk.j2 index 71d60a72ec..79e278d159 100644 --- a/roles/kickstarts/templates/hardware-rhel-10-nodisk.j2 +++ b/roles/kickstarts/templates/hardware-rhel-10-nodisk.j2 @@ -2,8 +2,6 @@ ## This kickstart is for Dell systems with 8 disks. It will build either a virthost or cloud. ## -# Use network installation -rdp --username root --password "{{ kickstart_vnc_password }}" # Use network install url --url=https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ repo --name=epel --baseurl=https://infrastructure.fedoraproject.org/pub/epel/10/Everything/x86_64/ From 0ae339219862ef689406ca33c2c67d2f9da2328b Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Mon, 18 May 2026 14:53:10 -0700 Subject: [PATCH 143/269] smtp-mm-ib01: move to rhel10 Signed-off-by: Kevin Fenzi --- inventory/host_vars/smtp-mm-ib01.fedoraproject.org | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/inventory/host_vars/smtp-mm-ib01.fedoraproject.org b/inventory/host_vars/smtp-mm-ib01.fedoraproject.org index f96b77a648..5216e72d7c 100644 --- a/inventory/host_vars/smtp-mm-ib01.fedoraproject.org +++ b/inventory/host_vars/smtp-mm-ib01.fedoraproject.org @@ -11,8 +11,8 @@ eth0_ipv6_ip: "2606:f640:6000:651::5" eth0_ipv6_gw: "2606:f640:6000:651::1" eth0_ipv6_nm: 64 has_ipv6: yes -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 main_bridge: br0 network_connections: - autoconnect: yes From a5d7291edc79bac545a7028566f2f99b6d2d302d Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Mon, 18 May 2026 15:24:12 -0700 Subject: [PATCH 144/269] base / nftables / kojibuilder: allow sign-bridge access for all builders in the secureboot group, not just x86-02/a64-02 Signed-off-by: Kevin Fenzi --- roles/base/templates/nftables/nftables.kojibuilder | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/base/templates/nftables/nftables.kojibuilder b/roles/base/templates/nftables/nftables.kojibuilder index 42dbfc4825..d667b257b2 100644 --- a/roles/base/templates/nftables/nftables.kojibuilder +++ b/roles/base/templates/nftables/nftables.kojibuilder @@ -87,7 +87,7 @@ add rule ip filter OUTPUT ip daddr 10.16.163.35/19 tcp sport 22 counter accept # Allow SSHFS binding to koji01 add rule ip filter OUTPUT ip daddr 10.16.169.104 tcp dport 22 counter accept {% endif %} -{% if inventory_hostname.startswith (('buildhw-x86-02', 'buildhw-a64-02')) %} +{% if inventory_hostname in groups['secureboot'] %} # Allow secure boot signing to contact the sign bridge add rule ip filter OUTPUT ip daddr 10.16.169.120 tcp dport 44334 counter accept {% endif %} From 944efaf34fd9d50c3cfcbc8b2943d82111b6e06e Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Mon, 18 May 2026 15:28:38 -0700 Subject: [PATCH 145/269] smtp-mm-osuosl01: move to rhel10 Signed-off-by: Kevin Fenzi --- inventory/host_vars/smtp-mm-osuosl01.fedoraproject.org | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/inventory/host_vars/smtp-mm-osuosl01.fedoraproject.org b/inventory/host_vars/smtp-mm-osuosl01.fedoraproject.org index 33d6e95995..947ca0ff87 100644 --- a/inventory/host_vars/smtp-mm-osuosl01.fedoraproject.org +++ b/inventory/host_vars/smtp-mm-osuosl01.fedoraproject.org @@ -10,8 +10,8 @@ eth0_ipv6_ip: "2605:bc80:3010:600:dead:beef:cafe:fedb" eth0_ipv6_gw: "2605:bc80:3010:600::1" eth0_ipv6_nm: 64 has_ipv6: yes -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 mem_size: 4096 network_connections: - autoconnect: yes From 2df5c98d16adfc6009b37fe5cabd3e2d407f7733 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Mon, 18 May 2026 15:38:57 -0700 Subject: [PATCH 146/269] smtp-mm-iso01: move to rhel10 Signed-off-by: Kevin Fenzi --- inventory/host_vars/smtp-mm-iso01.rdu3.fedoraproject.org | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/inventory/host_vars/smtp-mm-iso01.rdu3.fedoraproject.org b/inventory/host_vars/smtp-mm-iso01.rdu3.fedoraproject.org index f16713ed1c..af10b84859 100644 --- a/inventory/host_vars/smtp-mm-iso01.rdu3.fedoraproject.org +++ b/inventory/host_vars/smtp-mm-iso01.rdu3.fedoraproject.org @@ -10,8 +10,8 @@ eth0_ipv4_ip: 10.16.179.63 eth0_ipv6_gw: 2620:52:6:1161::1 eth0_ipv6_ip: 2620:52:6:1161::34 eth0_nm: 255.255.255.0 -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 vmhost: vmhost-x86-iso02.rdu3.fedoraproject.org volgroup: /dev/vg_guests vpn: true From ee21c8afc6ceeea08397e2dcf51010820bcce58a Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Mon, 18 May 2026 16:20:17 -0700 Subject: [PATCH 147/269] dedicatedsolutions02: add new host Signed-off-by: Kevin Fenzi --- .../dedicatedsolutions02.fedoraproject.org | 46 +++++++++++++++++++ inventory/inventory | 1 + 2 files changed, 47 insertions(+) create mode 100644 inventory/host_vars/dedicatedsolutions02.fedoraproject.org diff --git a/inventory/host_vars/dedicatedsolutions02.fedoraproject.org b/inventory/host_vars/dedicatedsolutions02.fedoraproject.org new file mode 100644 index 0000000000..ca42c543a4 --- /dev/null +++ b/inventory/host_vars/dedicatedsolutions02.fedoraproject.org @@ -0,0 +1,46 @@ +--- +br0_ipv4: 67.219.144.67 +br0_ipv4_gw: 67.219.144.65 +br0_ipv4_nm: 29 +br0_ipv6: "2604:1580:fe00:0:dead:beef:cafe:fe02" +br0_ipv6_gw: "2604:1580:fe00::1" +br0_ipv6_nm: 64 +br0_port0_mac: "{{ mac1 }}" +datacenter: dedicatedsolutions +dns1: 8.8.8.8 +dns2: 8.8.4.4 +dns_search1: "vpn.fedoraproject.org" +dns_search2: "fedoraproject.org" +has_ipv4: yes +has_ipv6: yes +mac1: 6c:c2:17:2b:73:40 +network_connections: + - autoconnect: yes + ip: + address: + - "{{ br0_ipv4 }}/{{ br0_ipv4_nm }}" + - "{{ br0_ipv6 }}/{{ br0_ipv6_nm }}" + dhcp4: no + dns: + - "{{ dns1 }}" + - "{{ dns2 }}" + dns_search: + - "{{ dns_search1 }}" + - "{{ dns_search2 }}" + gateway4: "{{ br0_ipv4_gw }}" + gateway6: "{{ br0_ipv6_gw }}" + name: br0 + state: up + type: bridge + - mac: "{{ br0_port0_mac }}" + master: br0 + name: br0-port0 + state: up + type: ethernet +nrpe_procs_crit: 1000 +nrpe_procs_warn: 900 +postfix_group: vpn +virthost: true +vpn: true +zabbix_macros: + 'VFS.DEV.WRITE.AWAIT.WARN': 100 diff --git a/inventory/inventory b/inventory/inventory index f3911d4b9f..d86040d304 100644 --- a/inventory/inventory +++ b/inventory/inventory @@ -110,6 +110,7 @@ bvmhost-x86-03.stg.rdu3.fedoraproject.org [colo_virt] dedicatedsolutions01.fedoraproject.org +dedicatedsolutions02.fedoraproject.org ibiblio02.fedoraproject.org ibiblio05.fedoraproject.org internetx02.fedoraproject.org From b0f0cbde394d830fea338d4b3b53314a5a7a72c7 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Mon, 18 May 2026 16:55:19 -0700 Subject: [PATCH 148/269] proxy11: move over to dedicatedsolutions02 Signed-off-by: Kevin Fenzi --- inventory/host_vars/proxy11.fedoraproject.org | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/inventory/host_vars/proxy11.fedoraproject.org b/inventory/host_vars/proxy11.fedoraproject.org index 64412d4565..a36a9f1945 100644 --- a/inventory/host_vars/proxy11.fedoraproject.org +++ b/inventory/host_vars/proxy11.fedoraproject.org @@ -43,7 +43,7 @@ postfix_group: vpn public_hostname: proxy11.fedoraproject.org # This is consumed by the roles/fedora-web/main role sponsor: dedicatedsolutions -vmhost: dedicatedsolutions01.fedoraproject.org +vmhost: dedicatedsolutions02.fedoraproject.org volgroup: /dev/vg_guests vpn: true zabbix_macros: From 9faab10da6c1cdf1d1aaa518e1552780f1264251 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Mon, 18 May 2026 16:57:15 -0700 Subject: [PATCH 149/269] proxy11: the vg here is named differently, but too much hassle to reinstall Signed-off-by: Kevin Fenzi --- inventory/host_vars/proxy11.fedoraproject.org | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/inventory/host_vars/proxy11.fedoraproject.org b/inventory/host_vars/proxy11.fedoraproject.org index a36a9f1945..05503e5715 100644 --- a/inventory/host_vars/proxy11.fedoraproject.org +++ b/inventory/host_vars/proxy11.fedoraproject.org @@ -44,7 +44,7 @@ public_hostname: proxy11.fedoraproject.org # This is consumed by the roles/fedora-web/main role sponsor: dedicatedsolutions vmhost: dedicatedsolutions02.fedoraproject.org -volgroup: /dev/vg_guests +volgroup: /dev/rhel_dedicatedsolutions02 vpn: true zabbix_macros: 'VFS.DEV.WRITE.AWAIT.WARN': 100 From 0723ffa45dffddcc7dd1f76d0de3e70bf1ecf549 Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Tue, 19 May 2026 15:31:40 +0100 Subject: [PATCH 150/269] Zabbix update SSH and Varnish templates Signed-off-by: Greg Sutcliffe --- roles/batcave/files/zabbix-ssh-template.yml | 1 + roles/varnish/files/zabbix/template.yml | 12 ++++++------ 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/roles/batcave/files/zabbix-ssh-template.yml b/roles/batcave/files/zabbix-ssh-template.yml index c7100ec5c7..b3749df259 100644 --- a/roles/batcave/files/zabbix-ssh-template.yml +++ b/roles/batcave/files/zabbix-ssh-template.yml @@ -48,6 +48,7 @@ zabbix_export: - uuid: 40b9cea515c6423fbcac99624676c1d0 expression: 'last(/SSH access from Batcave/net.tcp.service[ssh,{#SSH_HOST},22]) = 0' name: 'SSH host {#SSH_HOST} not reachable on 22' + priority: AVERAGE tags: - tag: scope value: availability diff --git a/roles/varnish/files/zabbix/template.yml b/roles/varnish/files/zabbix/template.yml index 9c489ce896..709fe67117 100644 --- a/roles/varnish/files/zabbix/template.yml +++ b/roles/varnish/files/zabbix/template.yml @@ -40,8 +40,8 @@ zabbix_export: dependencies: - name: 'Varnish: Process is not running' expression: 'last(/Varnish Cache Monitoring/proc.num["{$VARNISH.PROCESS_NAME}"])=0' - - name: 'Varnish: Service is down' - expression: 'last(/Varnish Cache Monitoring/net.tcp.service[http,"{$VARNISH.STATUS.HOST}","{$VARNISH.STATUS.PORT}"])=0' + - name: 'Varnish: Service is down (3 tries)' + expression: 'count(/Varnish Cache Monitoring/net.tcp.service[http,"{$VARNISH.STATUS.HOST}","{$VARNISH.STATUS.PORT}"],#3,,0)=3' - uuid: 80295421232547dfba8159e974c236d6 name: 'Varnish: Service ping' type: ZABBIX_ACTIVE @@ -52,8 +52,8 @@ zabbix_export: value: Varnish triggers: - uuid: 4c754b657d944992b309c0a92bb01499 - expression: 'last(/Varnish Cache Monitoring/net.tcp.service[http,"{$VARNISH.STATUS.HOST}","{$VARNISH.STATUS.PORT}"])=0' - name: 'Varnish: Service is down' + expression: 'count(/Varnish Cache Monitoring/net.tcp.service[http,"{$VARNISH.STATUS.HOST}","{$VARNISH.STATUS.PORT}"],#3,,0)=3' + name: 'Varnish: Service is down (3 tries)' priority: AVERAGE manual_close: 'YES' dependencies: @@ -363,8 +363,8 @@ zabbix_export: dependencies: - name: 'Varnish: Process is not running' expression: 'last(/Varnish Cache Monitoring/proc.num["{$VARNISH.PROCESS_NAME}"])=0' - - name: 'Varnish: Service is down' - expression: 'last(/Varnish Cache Monitoring/net.tcp.service[http,"{$VARNISH.STATUS.HOST}","{$VARNISH.STATUS.PORT}"])=0' + - name: 'Varnish: Service is down (3 tries)' + expression: 'count(/Varnish Cache Monitoring/net.tcp.service[http,"{$VARNISH.STATUS.HOST}","{$VARNISH.STATUS.PORT}"],#3,,0)=3' - uuid: 017f130075e44226ab676b4758445a6c name: 'Varnish: Total request bytes' type: DEPENDENT From 6e0f4fe7b0efcbee7aaccc73ffa068645d22aeb9 Mon Sep 17 00:00:00 2001 From: Diego Herrera Date: Thu, 7 May 2026 16:32:55 -0400 Subject: [PATCH 151/269] Retire EPEL 10.1 Signed-off-by: Diego Herrera --- roles/batcave/files/rhel10-sync | 2 +- roles/bodhi2/backend/files/new-updates-sync | 14 -------------- vars/all/EPEL.yaml | 4 ++-- 3 files changed, 3 insertions(+), 17 deletions(-) diff --git a/roles/batcave/files/rhel10-sync b/roles/batcave/files/rhel10-sync index 449f7c85fc..4d9c3429ea 100644 --- a/roles/batcave/files/rhel10-sync +++ b/roles/batcave/files/rhel10-sync @@ -1,6 +1,6 @@ #!/usr/bin/bash -RELEASEVERS=('10.1') +RELEASEVERS=('10.2') ARCHES=('aarch64' 'ppc64le' 's390x' 'x86_64') REPOS=('baseos' 'appstream' 'crb') diff --git a/roles/bodhi2/backend/files/new-updates-sync b/roles/bodhi2/backend/files/new-updates-sync index 307914cf55..4c1c86ddc2 100755 --- a/roles/bodhi2/backend/files/new-updates-sync +++ b/roles/bodhi2/backend/files/new-updates-sync @@ -198,20 +198,6 @@ RELEASES = {'f44': {'topic': 'fedora', 'dest': os.path.join(EPELDEST, 'testing', '10.2', 'Everything')}, ]}} }, - 'epel10.1': {'topic': 'epel', - 'version': '10.1', - 'modules': ['epel'], - 'repos': {'epel': { - 'from': 'epel10.1', - 'to': [{'arches': ['x86_64', 'aarch64', 'ppc64le', 's390x', 'source'], - 'dest': os.path.join(EPELDEST, '10.1', 'Everything')}, - ]}, - 'epel-testing': { - 'from': 'epel10.1-testing', - 'to': [{'arches': ['x86_64', 'aarch64', 'ppc64le', 's390x', 'source'], - 'dest': os.path.join(EPELDEST, 'testing', '10.1', 'Everything')}, - ]}} - }, 'epel9': {'topic': 'epel', 'version': '9', 'modules': ['epel'], diff --git a/vars/all/EPEL.yaml b/vars/all/EPEL.yaml index 7cce42d521..1b974201f0 100644 --- a/vars/all/EPEL.yaml +++ b/vars/all/EPEL.yaml @@ -11,10 +11,10 @@ epel_minor: 3 # The EPEL minor version that has been branched, but doesn't have a matching # RHEL minor version released yet. Set to false if not available. -epel_branched_minor: 2 +epel_branched_minor: false # The EPEL minor version that matches RHEL. Set to false prior to the RHEL GA. -epel_z_minor: 1 +epel_z_minor: 2 # Assemble a list of EPEL tag names. When a minor version is set to false, # that list item will be an empty string, which is then removed with select in From 8fbab7e5b3ef96f1f0ba2a5f05860d8233703ee7 Mon Sep 17 00:00:00 2001 From: Jaroslav Groman Date: Fri, 15 May 2026 15:19:30 +0200 Subject: [PATCH 152/269] quality: update testdays app builder to python-311 --- roles/openshift-apps/testdays/templates/buildconfig.yml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/testdays/templates/buildconfig.yml.j2 b/roles/openshift-apps/testdays/templates/buildconfig.yml.j2 index d2a65d9968..d2747c4b21 100644 --- a/roles/openshift-apps/testdays/templates/buildconfig.yml.j2 +++ b/roles/openshift-apps/testdays/templates/buildconfig.yml.j2 @@ -24,7 +24,7 @@ spec: sourceStrategy: from: kind: DockerImage - name: registry.access.redhat.com/ubi9/python-39 + name: registry.access.redhat.com/ubi9/python-311 triggers: - type: ConfigChange - type: ImageChange From 0ea1c9f2923b78980ed3222a7008ee41feb01402 Mon Sep 17 00:00:00 2001 From: Jaroslav Groman Date: Mon, 18 May 2026 13:17:39 +0200 Subject: [PATCH 153/269] quality: update testdays app builder to python-312 --- roles/openshift-apps/testdays/templates/buildconfig.yml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/testdays/templates/buildconfig.yml.j2 b/roles/openshift-apps/testdays/templates/buildconfig.yml.j2 index d2747c4b21..3b4b115aeb 100644 --- a/roles/openshift-apps/testdays/templates/buildconfig.yml.j2 +++ b/roles/openshift-apps/testdays/templates/buildconfig.yml.j2 @@ -24,7 +24,7 @@ spec: sourceStrategy: from: kind: DockerImage - name: registry.access.redhat.com/ubi9/python-311 + name: registry.access.redhat.com/ubi9/python-312 triggers: - type: ConfigChange - type: ImageChange From c33602daf44e61b8899ed2d8ade61946d469402b Mon Sep 17 00:00:00 2001 From: Jakub Kadlcik Date: Wed, 20 May 2026 09:57:24 +0200 Subject: [PATCH 154/269] copr: high performance builder for karlinator/texlive-2023 Fix https://github.com/fedora-copr/copr/issues/4319 --- roles/copr/frontend/templates/copr.conf | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/roles/copr/frontend/templates/copr.conf b/roles/copr/frontend/templates/copr.conf index e4f3007a9f..49d981c60c 100644 --- a/roles/copr/frontend/templates/copr.conf +++ b/roles/copr/frontend/templates/copr.conf @@ -292,6 +292,10 @@ EXTRA_BUILDCHROOT_TAGS = [{ # packages that always takes time to build "pattern": ".*/.*/.*(x86_64|aarch64|ppc64le)/(firefox|thunderbird|pytorch|llvm|gcc|kernel)$", "tags": ["on_demand_powerful"], +},{ + # https://github.com/fedora-copr/copr/issues/4319 + "pattern": "^karlinator/texlive-2023/.*(x86_64|aarch64)/texlive*", + "tags": ["on_demand_powerful"], }] {% endif %} From 8f12b3c68159e02966b46bcbc803d04e9a2be5a2 Mon Sep 17 00:00:00 2001 From: Michal Konecny Date: Wed, 20 May 2026 15:07:17 +0200 Subject: [PATCH 155/269] [mailman3] Fix index not being rebuilt The index build was failing on xapian_haystack issue that happens when the mail is too long. This patch will skip those e-mails. See https://forge.fedoraproject.org/infra/tickets/issues/13355 for more info. Signed-off-by: Michal Konecny --- .../xapian_haystack_term_too_long.patch | 16 ++++++++++++++++ roles/mailman3/tasks/main.yml | 10 ++++++++++ 2 files changed, 26 insertions(+) create mode 100644 roles/mailman3/files/mailman_patch/xapian_haystack_term_too_long.patch diff --git a/roles/mailman3/files/mailman_patch/xapian_haystack_term_too_long.patch b/roles/mailman3/files/mailman_patch/xapian_haystack_term_too_long.patch new file mode 100644 index 0000000000..811e958737 --- /dev/null +++ b/roles/mailman3/files/mailman_patch/xapian_haystack_term_too_long.patch @@ -0,0 +1,16 @@ +diff --git i/xapian_backend.py w/xapian_backend.py +index 05e8fed..c2bdd95 100755 +--- i/xapian_backend.py ++++ w/xapian_backend.py +@@ -498,7 +498,10 @@ class XapianSearchBackend(BaseSearchBackend): + document.add_term(document_id) + + # finally, replace or add the document to the database +- database.replace_document(document_id, document) ++ try: ++ database.replace_document(document_id, document) ++ except xapian.InvalidArgumentError as ex: ++ sys.stderr.write(str(ex) + '\n') + + except UnicodeDecodeError: + sys.stderr.write('Chunk failed.\n') diff --git a/roles/mailman3/tasks/main.yml b/roles/mailman3/tasks/main.yml index 384a25e9e1..d0797f32aa 100644 --- a/roles/mailman3/tasks/main.yml +++ b/roles/mailman3/tasks/main.yml @@ -436,6 +436,16 @@ notify: - Restart mailman3 +# This is needed till https://github.com/notanumber/xapian-haystack/issues/77 +# is resolved +- name: Apply xapian_haystack patch + ansible.posix.patch: + src: mailman3_patch/xapian_haystack_term_too_long.patch + basedir: /usr/lib/python3.9/site-packages/ + tags: + - mailman + - patch + # Memcached - name: Set the memcached sysconfig file ansible.builtin.copy: From 13c1dd27d9db624e155bfaa3a5f118ba5ededbbb Mon Sep 17 00:00:00 2001 From: Michal Konecny Date: Wed, 20 May 2026 15:15:18 +0200 Subject: [PATCH 156/269] [mailman3] Use the correct path to file Signed-off-by: Michal Konecny --- roles/mailman3/tasks/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/mailman3/tasks/main.yml b/roles/mailman3/tasks/main.yml index d0797f32aa..339f732473 100644 --- a/roles/mailman3/tasks/main.yml +++ b/roles/mailman3/tasks/main.yml @@ -440,7 +440,7 @@ # is resolved - name: Apply xapian_haystack patch ansible.posix.patch: - src: mailman3_patch/xapian_haystack_term_too_long.patch + src: mailman_patch/xapian_haystack_term_too_long.patch basedir: /usr/lib/python3.9/site-packages/ tags: - mailman From 688720342ef56c67372fa45faede18e51162d171 Mon Sep 17 00:00:00 2001 From: Michal Konecny Date: Wed, 20 May 2026 15:18:41 +0200 Subject: [PATCH 157/269] [mailman3] Fix the patch file Posix patch doesn't really like the git fake directories. Signed-off-by: Michal Konecny --- .../files/mailman_patch/xapian_haystack_term_too_long.patch | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/roles/mailman3/files/mailman_patch/xapian_haystack_term_too_long.patch b/roles/mailman3/files/mailman_patch/xapian_haystack_term_too_long.patch index 811e958737..c19234f2a7 100644 --- a/roles/mailman3/files/mailman_patch/xapian_haystack_term_too_long.patch +++ b/roles/mailman3/files/mailman_patch/xapian_haystack_term_too_long.patch @@ -1,7 +1,7 @@ -diff --git i/xapian_backend.py w/xapian_backend.py +diff --git xapian_backend.py xapian_backend.py index 05e8fed..c2bdd95 100755 ---- i/xapian_backend.py -+++ w/xapian_backend.py +--- xapian_backend.py ++++ xapian_backend.py @@ -498,7 +498,10 @@ class XapianSearchBackend(BaseSearchBackend): document.add_term(document_id) From 44bc3548f0b35f32ebc303bc1303c8137bdfa840 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Wed, 20 May 2026 08:14:31 -0700 Subject: [PATCH 158/269] proxies: add ip that is generating a large number of 404s on mirrorlists Signed-off-by: Kevin Fenzi --- inventory/group_vars/proxies | 1 + 1 file changed, 1 insertion(+) diff --git a/inventory/group_vars/proxies b/inventory/group_vars/proxies index 48354ae605..ad47e2decf 100644 --- a/inventory/group_vars/proxies +++ b/inventory/group_vars/proxies @@ -85,6 +85,7 @@ nft_block_rules: - 'add rule ip filter INPUT ip saddr 101.47.185.0/24 counter reject' - 'add rule ip filter INPUT ip saddr 101.47.186.0/23 counter reject' - 'add rule ip filter INPUT ip saddr 34.159.191.146/32 counter reject' + - 'add rule ip filter INPUT ip saddr 208.78.212.5/32 counter reject' nft_custom_rules: # Need for rsync from log01 for logs. - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' From 9ffb23bb350c0918f307bc1b96b744056424d456 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Wed, 20 May 2026 08:55:52 -0700 Subject: [PATCH 159/269] release-monitoring: scale web pods to 3 by default Signed-off-by: Kevin Fenzi --- .../release-monitoring/templates/deployment.yml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/release-monitoring/templates/deployment.yml.j2 b/roles/openshift-apps/release-monitoring/templates/deployment.yml.j2 index 03e1db04ff..7658d6aba3 100644 --- a/roles/openshift-apps/release-monitoring/templates/deployment.yml.j2 +++ b/roles/openshift-apps/release-monitoring/templates/deployment.yml.j2 @@ -7,7 +7,7 @@ metadata: service: web name: release-monitoring-web spec: - replicas: 1 + replicas: 3 selector: matchLabels: app: release-monitoring-web From cf52816027bf8da2d7557e254446d661e5939e75 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Wed, 20 May 2026 13:33:41 -0700 Subject: [PATCH 160/269] proxy11: move to using normal volgroup name Signed-off-by: Kevin Fenzi --- inventory/host_vars/proxy11.fedoraproject.org | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/inventory/host_vars/proxy11.fedoraproject.org b/inventory/host_vars/proxy11.fedoraproject.org index 05503e5715..a36a9f1945 100644 --- a/inventory/host_vars/proxy11.fedoraproject.org +++ b/inventory/host_vars/proxy11.fedoraproject.org @@ -44,7 +44,7 @@ public_hostname: proxy11.fedoraproject.org # This is consumed by the roles/fedora-web/main role sponsor: dedicatedsolutions vmhost: dedicatedsolutions02.fedoraproject.org -volgroup: /dev/rhel_dedicatedsolutions02 +volgroup: /dev/vg_guests vpn: true zabbix_macros: 'VFS.DEV.WRITE.AWAIT.WARN': 100 From a5eb82884785879cdaa6df64fcdc310439231924 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Wed, 20 May 2026 13:34:25 -0700 Subject: [PATCH 161/269] release-monitoring: move back down to 1 web pod, seems to have caused duplicate comments on bugzilla bugs Signed-off-by: Kevin Fenzi --- .../release-monitoring/templates/deployment.yml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/release-monitoring/templates/deployment.yml.j2 b/roles/openshift-apps/release-monitoring/templates/deployment.yml.j2 index 7658d6aba3..03e1db04ff 100644 --- a/roles/openshift-apps/release-monitoring/templates/deployment.yml.j2 +++ b/roles/openshift-apps/release-monitoring/templates/deployment.yml.j2 @@ -7,7 +7,7 @@ metadata: service: web name: release-monitoring-web spec: - replicas: 3 + replicas: 1 selector: matchLabels: app: release-monitoring-web From 5e7b40087d13beed3ee733011928f73680cabc97 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Wed, 20 May 2026 13:35:56 -0700 Subject: [PATCH 162/269] proxy11: since we are doing a new install, try f44 Signed-off-by: Kevin Fenzi --- inventory/host_vars/proxy11.fedoraproject.org | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/inventory/host_vars/proxy11.fedoraproject.org b/inventory/host_vars/proxy11.fedoraproject.org index a36a9f1945..aea51013c5 100644 --- a/inventory/host_vars/proxy11.fedoraproject.org +++ b/inventory/host_vars/proxy11.fedoraproject.org @@ -13,7 +13,7 @@ eth0_ipv6_nm: 64 freezes: true has_ipv4: yes has_ipv6: yes -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/43/Server/x86_64/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/x86_64/os/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora max_mem_size: 32768 mem_size: 32768 From 60e48fd441b1a0db4b17098704fdc5df2249a48d Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Wed, 20 May 2026 14:27:17 -0700 Subject: [PATCH 163/269] ns02: reinstall with rhel10 Signed-off-by: Kevin Fenzi --- inventory/host_vars/ns02.fedoraproject.org | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/inventory/host_vars/ns02.fedoraproject.org b/inventory/host_vars/ns02.fedoraproject.org index d08931fa03..5f71d75e00 100644 --- a/inventory/host_vars/ns02.fedoraproject.org +++ b/inventory/host_vars/ns02.fedoraproject.org @@ -24,8 +24,8 @@ eth0_ipv6_ip: "2606:f640:6000:651::11" eth0_ipv6_gw: "2606:f640:6000:651::1" eth0_ipv6_nm: 64 has_ipv6: yes -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 main_bridge: br0 network_connections: - autoconnect: yes From 1963b068d3b219aa55feedefe55be8f1df055941 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Wed, 20 May 2026 14:31:53 -0700 Subject: [PATCH 164/269] Switch epel10.repo and rhel10.repo to use a link to latest There's no super right answer here, but if we point to a specific minor release here it means we have to move all machines to it when we change it, and we have to remember to do so. If we just use '10' and depend on the link that points to the latest minor: lrwxrwxrwx. 1 root root 4 May 19 17:12 /srv/web/repo/rhel/rhel10/10 -> 10.2/ then we don't have to keep changing this all the time, it will just update when that link changes. This doesn't leave us an easy way to keep some hosts back to the old minor, but in practice we pretty much never do this anyhow. Signed-off-by: Kevin Fenzi --- files/common/epel10.repo | 9 +++++---- files/common/rhel10.repo | 9 +++++---- 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/files/common/epel10.repo b/files/common/epel10.repo index 6c0fc38d62..9a0016fbdb 100644 --- a/files/common/epel10.repo +++ b/files/common/epel10.repo @@ -1,9 +1,10 @@ [epel] name=Extras Packages for Enterprise Linux $releasever - $basearch -# This is a bit too magic, esp. as we are using the infra. repo. and explicitly -# point to a 10.x variant ... might as well do the same here. +# We aren't using mirrormanager here, but pointing direct to our repos +# So, we want to just point to '10' here and depend on the link that exists +# to point us to the newest minor release. # baseurl=https://infrastructure.fedoraproject.org/pub/epel/$releasever${releasever_minor:+z}/Everything/$basearch/ -baseurl=https://infrastructure.fedoraproject.org/pub/epel/10.1/Everything/$basearch/ +baseurl=https://infrastructure.fedoraproject.org/pub/epel/10/Everything/$basearch/ enabled=1 gpgcheck=1 gpgkey=https://infrastructure.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-10 @@ -11,7 +12,7 @@ gpgkey=https://infrastructure.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-10 [epel-testing] name=Extras Packages for Enterprise Linux $releasever - $basearch # baseurl=https://infrastructure.fedoraproject.org/pub/epel/testing/$releasever${releasever_minor:+z}/Everything/$basearch/ -baseurl=https://infrastructure.fedoraproject.org/pub/epel/testing/10.1/Everything/$basearch/ +baseurl=https://infrastructure.fedoraproject.org/pub/epel/testing/10/Everything/$basearch/ enabled=0 gpgcheck=1 gpgkey=https://infrastructure.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-10 diff --git a/files/common/rhel10.repo b/files/common/rhel10.repo index 4079046d70..8e7a6917ce 100644 --- a/files/common/rhel10.repo +++ b/files/common/rhel10.repo @@ -12,24 +12,25 @@ gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta,file:///etc/pki/rpm-gpg enabled=1 gpgcheck=1 -# NOTE: When you change the 10.x here also change it in the epel10.repo file. +# These are not using mirrormanager, so point to '10' which will use the link +# to the latest minor release. [rhel10-BaseOS] name = rhel10 BaseOS $basearch -baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10.1/repos/$basearch/baseos +baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/$basearch/baseos gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta,file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release enabled=1 gpgcheck=1 [rhel10-AppStream] name = rhel10 AppStream $basearch -baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10.1/repos/$basearch/appstream +baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/$basearch/appstream gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta,file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release enabled=1 gpgcheck=1 [rhel10-CRB] name = rhel10 CodeReadyBuilder $basearch -baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10.1/repos/$basearch/crb +baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/$basearch/crb gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta,file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release enabled=1 gpgcheck=1 From 4262b3610ff95dec28da724bea30a674a76263aa Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Wed, 20 May 2026 14:44:21 -0700 Subject: [PATCH 165/269] dns: only set crypto-policy on rhel9 dns servers, 10 does not have that policy Signed-off-by: Kevin Fenzi --- roles/base/tasks/crypto-policies.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/base/tasks/crypto-policies.yml b/roles/base/tasks/crypto-policies.yml index ae61a2c2e5..bdf5738371 100644 --- a/roles/base/tasks/crypto-policies.yml +++ b/roles/base/tasks/crypto-policies.yml @@ -29,7 +29,7 @@ - name: Set crypto-policy on RHEL9 dns servers to DEFAULT:SHA1 ansible.builtin.command: "update-crypto-policies --set DEFAULT:SHA1" - when: "inventory_hostname.startswith('ns') and (currentcryptopolicy.stdout.find('DEFAULT:SHA1') == -1 or cryptopolicyapplied.rc != 0)" + when: "inventory_hostname.startswith('ns') and (currentcryptopolicy.stdout.find('DEFAULT:SHA1') == -1 and (ansible_distribution_major_version|int == 9) or cryptopolicyapplied.rc != 0)" check_mode: no tags: - crypto-policies From 2d24211424824ceb60fbe08833e09c814030f21e Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Wed, 20 May 2026 15:34:38 -0700 Subject: [PATCH 166/269] ns03: move to rhel10 Signed-off-by: Kevin Fenzi --- inventory/host_vars/ns03.rdu3.fedoraproject.org | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/inventory/host_vars/ns03.rdu3.fedoraproject.org b/inventory/host_vars/ns03.rdu3.fedoraproject.org index c4e599a6f2..584692856b 100644 --- a/inventory/host_vars/ns03.rdu3.fedoraproject.org +++ b/inventory/host_vars/ns03.rdu3.fedoraproject.org @@ -32,7 +32,7 @@ network_connections: # This host is externally reachable # external: true -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 vmhost: vmhost-x86-03.rdu3.fedoraproject.org volgroup: /dev/vg_guests From f2759cb8b280a2a5366802dc41ea07062fe870d0 Mon Sep 17 00:00:00 2001 From: Ryan Lerch Date: Thu, 21 May 2026 10:10:12 +1000 Subject: [PATCH 167/269] forge: add group team mappings for pungi org Signed-off-by: Ryan Lerch --- roles/openshift-apps/forgejo/templates/values.yaml.j2 | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/roles/openshift-apps/forgejo/templates/values.yaml.j2 b/roles/openshift-apps/forgejo/templates/values.yaml.j2 index 19553000ed..aab8079b79 100644 --- a/roles/openshift-apps/forgejo/templates/values.yaml.j2 +++ b/roles/openshift-apps/forgejo/templates/values.yaml.j2 @@ -575,7 +575,8 @@ gitea: "forge-hummingbird-owners":{"hummingbird":["Owners"]}, "forge-r-owners":{"r":["Owners"]}, "forge-fdwg-owners":{"fdwg":["Owners"]}, - "forge-fdwg-members":{"fdwg":["Members"]} + "forge-fdwg-members":{"fdwg":["Members"]}, + "forge-pungi-owners":{"pungi":["Owners"]} }' {% endif %} # - name: 'OAuth 1' From 1c6dded5bbd9c4e9a067346764c36aa03b17cea3 Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Thu, 21 May 2026 10:32:17 +0100 Subject: [PATCH 168/269] Nagios: remove more things we already have in Zabbix Signed-off-by: Greg Sutcliffe --- .../files/nagios/services/ssl.cfg | 46 ------------------- .../templates/nagios/services/ipa.cfg.j2 | 9 ---- .../templates/nagios/services/websites.cfg.j2 | 17 ------- 3 files changed, 72 deletions(-) diff --git a/roles/nagios_server/files/nagios/services/ssl.cfg b/roles/nagios_server/files/nagios/services/ssl.cfg index a4ede04233..b5ff39540c 100644 --- a/roles/nagios_server/files/nagios/services/ssl.cfg +++ b/roles/nagios_server/files/nagios/services/ssl.cfg @@ -12,13 +12,6 @@ define service { use defaulttemplate } -define service { - hostgroup_name oneproxy - service_description https-whatcanidoforfedora-cert - check_command check_ssl_cert!whatcanidoforfedora.org!25 - use defaulttemplate -} - define service { host_name pagure.io service_description https-pagure-cert @@ -33,45 +26,6 @@ define service { use defaulttemplate } -# fedora coreos endpoints - -define service { - hostgroup_name oneproxy - service_description https-updates-coreos-cert - check_command check_ssl_cert!updates.coreos.fedoraproject.org!25 - use defaulttemplate -} - -define service { - hostgroup_name oneproxy - service_description https-raw-updates-coreos-cert - check_command check_ssl_cert!raw-updates.coreos.fedoraproject.org!25 - use defaulttemplate -} - -define service { - hostgroup_name oneproxy - service_description https-status-updates-coreos-cert - check_command check_ssl_cert!status.updates.coreos.fedoraproject.org!25 - use defaulttemplate -} - -define service { - hostgroup_name oneproxy - service_description https-status-raw-updates-coreos-cert - check_command check_ssl_cert!status.raw-updates.coreos.fedoraproject.org!25 - use defaulttemplate -} - -# ocp4 cluster prod - -define service { - hostgroup_name oneproxy - service_description https-ocp4-prod-cert - check_command check_ssl_cert!console-openshift-console.apps.ocp.fedoraproject.org!25 - use defaulttemplate -} - # ocp4 cluster stg define service { diff --git a/roles/nagios_server/templates/nagios/services/ipa.cfg.j2 b/roles/nagios_server/templates/nagios/services/ipa.cfg.j2 index 8886bbf391..97d2a72f35 100644 --- a/roles/nagios_server/templates/nagios/services/ipa.cfg.j2 +++ b/roles/nagios_server/templates/nagios/services/ipa.cfg.j2 @@ -1,12 +1,3 @@ -define service { - host_name {% for host in groups['ipa'] %}{% if hostvars[host].nagios_Can_Connect == true %}{{host}},{% endif%}{% endfor %} - - service_description IPA Replication Status - check_command check_by_nrpe!check_ipa_replication - use lighttemplate - servicegroups ipa -} - define service { host_name {{ groups['ipa'][0] }} service_description IPA Free IDs diff --git a/roles/nagios_server/templates/nagios/services/websites.cfg.j2 b/roles/nagios_server/templates/nagios/services/websites.cfg.j2 index c9626b778a..80f0024c7e 100644 --- a/roles/nagios_server/templates/nagios/services/websites.cfg.j2 +++ b/roles/nagios_server/templates/nagios/services/websites.cfg.j2 @@ -48,23 +48,6 @@ define service { use internalwebsitetemplate } -define service { - hostgroup_name ipa - service_description http-ipa-internal - check_command check_website!localhost!/ipa/ui/!Identity Management - max_check_attempts 8 - use internalwebsitetemplate - event_handler restart_httpd -} - -define service { - hostgroup_name ocp_workers - service_description http-koschei-internal - check_command check_website_ssl!koschei.fedoraproject.org!/!Package summary - max_check_attempts 8 - use internalwebsitetemplate -} - define service { hostgroup_name proxies_ocp4 service_description http-fmn-web From 5d331ca6e3b00d5a7027163cca202bc3c367ffd0 Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Thu, 21 May 2026 11:07:10 +0100 Subject: [PATCH 169/269] Zabbix: port remaining SSL checks over from Nagios Signed-off-by: Greg Sutcliffe --- .../files/nagios/services/ssl.cfg | 36 ------------------- roles/zabbix/sslchecks/tasks/main.yml | 7 +++- 2 files changed, 6 insertions(+), 37 deletions(-) delete mode 100644 roles/nagios_server/files/nagios/services/ssl.cfg diff --git a/roles/nagios_server/files/nagios/services/ssl.cfg b/roles/nagios_server/files/nagios/services/ssl.cfg deleted file mode 100644 index b5ff39540c..0000000000 --- a/roles/nagios_server/files/nagios/services/ssl.cfg +++ /dev/null @@ -1,36 +0,0 @@ -define service { - hostgroup_name oneproxy - service_description https-admin.fedoraproject.org - check_command check_ssl_cert!admin.fedoraproject.org!60 - use defaulttemplate -} - -define service { - hostgroup_name oneproxy - service_description https-translate.fedoraproject.org-cert - check_command check_ssl_cert!translate.fedoraproject.org!60 - use defaulttemplate -} - -define service { - host_name pagure.io - service_description https-pagure-cert - check_command check_ssl_cert!pagure.io!25 - use defaulttemplate -} - -define service { - host_name stg.pagure.io - service_description https-pagure-stg-cert - check_command check_ssl_cert!stg.pagure.io!25 - use defaulttemplate -} - -# ocp4 cluster stg - -define service { - host_name retrace.fedoraproject.org - service_description http-cert-retrace.fedoraproject.org - check_command check_ssl_cert!retrace.fedoraproject.org!25 - use defaulttemplate -} diff --git a/roles/zabbix/sslchecks/tasks/main.yml b/roles/zabbix/sslchecks/tasks/main.yml index e1a845238e..ca23babc2d 100644 --- a/roles/zabbix/sslchecks/tasks/main.yml +++ b/roles/zabbix/sslchecks/tasks/main.yml @@ -2,13 +2,17 @@ - name: Create SSL checks for other hosts include_tasks: sslcheck.yml loop: + - { name: '*.apps.ocp.fedoraproject.org', cert: 'console-openshift-console.apps.ocp.fedoraproject.org', port: '443' } - { name: '*.fedorapeople.org', cert: 'fedorapeople.org', port: '443' } - { name: '*.fedoraproject.org', cert: 'fedoraproject.org', port: '443' } - - { name: '*.apps.ocp.fedoraproject.org', cert: 'console-openshift-console.apps.ocp.fedoraproject.org', port: '443' } + - { name: 'admin.fedoraproject.org', cert: 'admin.fedoraproject.org', port: '443' } - { name: 'api.ocp.fedoraproject.org', cert: 'api.ocp.fedoraproject.org', port: '6443' } + - { name: 'pagure.io', cert: 'pagure.io', port: '443' } - { name: 'raw-updates.coreos.fedoraproject.org', cert: 'raw-updates.coreos.fedoraproject.org', port: '443' } + - { name: 'retrace.fedoraproject.org', cert: 'retrace.fedoraproject.org', port: '443' } - { name: 'status.raw-updates.coreos.fedoraproject.org', cert: 'status.raw-updates.coreos.fedoraproject.org', port: '443' } - { name: 'status.updates.coreos.fedoraproject.org', cert: 'status.updates.coreos.fedoraproject.org', port: '443' } + - { name: 'translate.fedoraproject.org', cert: 'translate.fedoraproject.org', port: '443' } - { name: 'updates.coreos.fedoraproject.org', cert: 'updates.coreos.fedoraproject.org', port: '443' } - { name: 'whatcanidoforfedora.org', cert: 'whatcanidoforfedora.org', port: '443' } tags: @@ -20,6 +24,7 @@ loop: - { name: '*.apps.ocp.stg.fedoraproject.org', cert: 'console-openshift-console.apps.ocp.stg.fedoraproject.org', port: '443' } - { name: 'api.ocp.stg.fedoraproject.org', cert: 'api.ocp.stg.fedoraproject.org', port: '6443' } + - { name: 'stg.pagure.io', cert: 'stg.pagure.io', port: '443' } tags: - zabbix_api when: inventory_hostname == 'zabbix01.stg.rdu3.fedoraproject.org' From 331eae63d7e601f27846089bd7d32c45b3f97ef6 Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Thu, 21 May 2026 11:21:47 +0100 Subject: [PATCH 170/269] Nagios: remember to remove deleted ssl.cfg file from task loop Signed-off-by: Greg Sutcliffe --- roles/nagios_server/tasks/main.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/roles/nagios_server/tasks/main.yml b/roles/nagios_server/tasks/main.yml index a22f3c13c7..9c93aa456a 100644 --- a/roles/nagios_server/tasks/main.yml +++ b/roles/nagios_server/tasks/main.yml @@ -231,7 +231,6 @@ - raid.cfg - smtp-mm.cfg - ssh.cfg - - ssl.cfg - swap.cfg - templates.cfg - vpn_server.cfg From 26b81b373dae333359ff7d97070a4e43721e3a40 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Aur=C3=A9lien=20Bompard?= Date: Thu, 21 May 2026 17:16:38 +0200 Subject: [PATCH 171/269] Rebase Badges on python 3.13 (from 3.10) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Aurélien Bompard --- .../openshift-apps/badges/files/imagestream.yml | 10 +++++----- .../badges/templates/buildconfig.yml.j2 | 17 +++++++++++------ .../badges/templates/deployment.yml.j2 | 2 +- 3 files changed, 17 insertions(+), 12 deletions(-) diff --git a/roles/openshift-apps/badges/files/imagestream.yml b/roles/openshift-apps/badges/files/imagestream.yml index 1f724d219f..59bd546d7b 100644 --- a/roles/openshift-apps/badges/files/imagestream.yml +++ b/roles/openshift-apps/badges/files/imagestream.yml @@ -11,11 +11,11 @@ items: kind: ImageStream metadata: name: tahrir - # The Python 3.10 builder image + # The Python 3.13 builder image - apiVersion: image.openshift.io/v1 kind: ImageStream metadata: - name: python-310 + name: python-313 spec: lookupPolicy: local: false @@ -23,16 +23,16 @@ items: - name: latest from: kind: DockerImage - name: quay.io/fedora/python-310:latest + name: quay.io/fedora/python-313:latest importPolicy: scheduled: true referencePolicy: type: Source - # The Python 3.10 builder image plus custom packages + # The Python 3.13 builder image plus custom packages - apiVersion: image.openshift.io/v1 kind: ImageStream metadata: - name: python-310-custom-builder + name: python-313-custom-builder # Redis (for caching) - apiVersion: image.openshift.io/v1 kind: ImageStream diff --git a/roles/openshift-apps/badges/templates/buildconfig.yml.j2 b/roles/openshift-apps/badges/templates/buildconfig.yml.j2 index 98162aee4e..c1298a8b89 100644 --- a/roles/openshift-apps/badges/templates/buildconfig.yml.j2 +++ b/roles/openshift-apps/badges/templates/buildconfig.yml.j2 @@ -3,10 +3,10 @@ apiVersion: build.openshift.io/v1 kind: BuildConfig metadata: - name: python-310-custom-builder + name: python-313-custom-builder labels: app: badges - build: python-310-custom-builder + build: python-313-custom-builder spec: runPolicy: Serial source: @@ -18,11 +18,11 @@ spec: dockerStrategy: from: kind: ImageStreamTag - name: python-310:latest + name: python-313:latest output: to: kind: ImageStreamTag - name: python-310-custom-builder:latest + name: python-313-custom-builder:latest triggers: - type: ImageChange --- @@ -46,7 +46,7 @@ spec: sourceStrategy: from: kind: ImageStreamTag - name: python-310-custom-builder:latest + name: python-313-custom-builder:latest output: to: kind: ImageStreamTag @@ -81,7 +81,12 @@ spec: sourceStrategy: from: kind: ImageStreamTag - name: python-310-custom-builder:latest + name: python-313-custom-builder:latest + env: + # The .s2i/bin/assemble script uses this to build the frontend with the + # correct API and Ipsilon addresses. + - name: FEDORA_ENV + value: "{{ env }}" output: to: kind: ImageStreamTag diff --git a/roles/openshift-apps/badges/templates/deployment.yml.j2 b/roles/openshift-apps/badges/templates/deployment.yml.j2 index ad22b68600..3e96a775b6 100644 --- a/roles/openshift-apps/badges/templates/deployment.yml.j2 +++ b/roles/openshift-apps/badges/templates/deployment.yml.j2 @@ -1,5 +1,5 @@ --- -# Frontend component (Python/Pyramid served by gunicorn) +# Frontend component (Python/Flask served by gunicorn) apiVersion: apps/v1 kind: Deployment metadata: From fad66f712ef7b01de7418955542f7964b7b65e78 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Aur=C3=A9lien=20Bompard?= Date: Thu, 21 May 2026 17:17:31 +0200 Subject: [PATCH 172/269] Add a patch to pagure, based on PR 5553 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Aurélien Bompard --- roles/distgit/pagure/defaults/main.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/roles/distgit/pagure/defaults/main.yml b/roles/distgit/pagure/defaults/main.yml index df3114f21d..5ec6584715 100644 --- a/roles/distgit/pagure/defaults/main.yml +++ b/roles/distgit/pagure/defaults/main.yml @@ -4,4 +4,5 @@ pagure_patches: - 5529 - readme-include - 26bc9746 + - 5553 From 8cd135b4bd4a18bf510572f42666c1c17da2df3f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Aur=C3=A9lien=20Bompard?= Date: Thu, 21 May 2026 17:57:39 +0200 Subject: [PATCH 173/269] Fixup 26b81b3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Aurélien Bompard --- .../openshift-apps/badges/templates/buildconfig.yml.j2 | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/roles/openshift-apps/badges/templates/buildconfig.yml.j2 b/roles/openshift-apps/badges/templates/buildconfig.yml.j2 index c1298a8b89..778eb10224 100644 --- a/roles/openshift-apps/badges/templates/buildconfig.yml.j2 +++ b/roles/openshift-apps/badges/templates/buildconfig.yml.j2 @@ -82,11 +82,11 @@ spec: from: kind: ImageStreamTag name: python-313-custom-builder:latest - env: - # The .s2i/bin/assemble script uses this to build the frontend with the - # correct API and Ipsilon addresses. - - name: FEDORA_ENV - value: "{{ env }}" + env: + # The .s2i/bin/assemble script uses this to build the frontend with the + # correct API and Ipsilon addresses. + - name: FEDORA_ENV + value: "{{ env }}" output: to: kind: ImageStreamTag From 4908f3bea7b244a377350f248ac08fb392136f50 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Aur=C3=A9lien=20Bompard?= Date: Thu, 21 May 2026 17:59:00 +0200 Subject: [PATCH 174/269] Yet another forgotten thing for badges MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Aurélien Bompard --- .../openshift-apps/badges/templates/Dockerfile-builder-image | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/openshift-apps/badges/templates/Dockerfile-builder-image b/roles/openshift-apps/badges/templates/Dockerfile-builder-image index 1ff18aa2d4..32daa1a111 100644 --- a/roles/openshift-apps/badges/templates/Dockerfile-builder-image +++ b/roles/openshift-apps/badges/templates/Dockerfile-builder-image @@ -1,6 +1,6 @@ -FROM quay.io/fedora/python-310:latest +FROM quay.io/fedora/python-313:latest LABEL \ - name="python-310-badges-custom-builder" \ + name="python-313-badges-custom-builder" \ vendor="Fedora Infrastructure" \ license="MIT" USER root From 5887d43751578acecaa28920e6531f2944a04d1c Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Thu, 21 May 2026 10:39:45 -0700 Subject: [PATCH 175/269] mirrormanager / mirrorlist_proxy: add explicit Host: to header in checks In newer curl, not specifying Host: here means it emits a warning: Warning: The provided HTTP header 'mirrors.fedoraproject.org' does not look Warning: like a header? So, specify Host: for the header so it works on both old curl and new. Signed-off-by: Kevin Fenzi --- .../mirrorlist_proxy/files/restart-mirrorlist-processes | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/roles/mirrormanager/mirrorlist_proxy/files/restart-mirrorlist-processes b/roles/mirrormanager/mirrorlist_proxy/files/restart-mirrorlist-processes index 869fd96b6e..58bcd29e24 100644 --- a/roles/mirrormanager/mirrorlist_proxy/files/restart-mirrorlist-processes +++ b/roles/mirrormanager/mirrorlist_proxy/files/restart-mirrorlist-processes @@ -52,7 +52,7 @@ else fi # check mirrorlist2 (old protbuf cache and see that it's processing ok) -curl -q -H mirrors.fedoraproject.org ${mirrorlist2} -s -f --retry 50 --retry-delay 10 --retry-connrefused --retry-max-time 180 | grep "sha512" >/dev/null +curl -q -H 'Host: mirrors.fedoraproject.org' ${mirrorlist2} -s -f --retry 50 --retry-delay 10 --retry-connrefused --retry-max-time 180 | grep "sha512" >/dev/null if [ $? != 0 ]; then echo "ERROR: mirrorlist2 not processing correctly" exit 1 @@ -72,7 +72,7 @@ check_and_restart mirrorlist1 sleep ${TIME_RESTART} -curl -q -H mirrors.fedoraproject.org ${mirrorlist1} -s -f --retry 50 --retry-delay 10 --retry-connrefused --retry-max-time 180 | grep "sha512" >/dev/null +curl -q -H 'Host: mirrors.fedoraproject.org' ${mirrorlist1} -s -f --retry 50 --retry-delay 10 --retry-connrefused --retry-max-time 180 | grep "sha512" >/dev/null if [ $? != 0 ]; then echo "ERROR: mirrorlist1 did not restart correctly" exit 1 @@ -97,7 +97,7 @@ sleep 1 check_and_restart mirrorlist2 sleep ${TIME_RESTART} -curl -q -H mirrors.fedoraproject.org ${mirrorlist2} -o/dev/null -s -f --retry 50 --retry-delay 10 --retry-connrefused --retry-max-time 180 +curl -q -H 'Host: mirrors.fedoraproject.org' ${mirrorlist2} -o/dev/null -s -f --retry 50 --retry-delay 10 --retry-connrefused --retry-max-time 180 if [ $? != 0 ]; then echo "ERROR: mirrorlist2 did not restart correctly" exit 1 From 0595b45e39ff07134e43964a64904b25316bb688 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Thu, 21 May 2026 11:28:03 -0700 Subject: [PATCH 176/269] pagure-stg: fix dns search order to fix certgetter01 access Signed-off-by: Kevin Fenzi --- inventory/host_vars/pagure-stg02.fedoraproject.org | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/inventory/host_vars/pagure-stg02.fedoraproject.org b/inventory/host_vars/pagure-stg02.fedoraproject.org index 2aac4a638b..0237574972 100644 --- a/inventory/host_vars/pagure-stg02.fedoraproject.org +++ b/inventory/host_vars/pagure-stg02.fedoraproject.org @@ -2,9 +2,10 @@ datacenter: rdu3 dns1: 10.16.163.33 dns2: 10.16.163.34 -dns_search1: "stg.rdu3.fedoraproject.org" -dns_search2: "rdu3.fedoraproject.org" -dns_search3: "fedoraproject.org" +dns_search1: "vpn.fedoraproject.org" +dns_search2: "stg.rdu3.fedoraproject.org" +dns_search3: "rdu3.fedoraproject.org" +dns_search4: "fedoraproject.org" effective_cache_size: "6GB" eth0_ipv4_gw: 10.16.179.254 eth0_ipv4_ip: 10.16.179.61 @@ -29,6 +30,7 @@ network_connections: - "{{ dns_search1 }}" - "{{ dns_search2 }}" - "{{ dns_search3 }}" + - "{{ dns_search4 }}" gateway4: "{{ eth0_ipv4_gw }}" gateway6: "{{ eth0_ipv6_gw }}" mac: "{{ ansible_default_ipv4.macaddress }}" From 98c6cae22b9d2406a3e7cc0aefa09995a9147a74 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Thu, 21 May 2026 12:45:37 -0700 Subject: [PATCH 177/269] ns01: reinstall with rhel10 Signed-off-by: Kevin Fenzi --- inventory/host_vars/ns01.rdu3.fedoraproject.org | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/inventory/host_vars/ns01.rdu3.fedoraproject.org b/inventory/host_vars/ns01.rdu3.fedoraproject.org index 9948a16d38..5729a5c2a8 100644 --- a/inventory/host_vars/ns01.rdu3.fedoraproject.org +++ b/inventory/host_vars/ns01.rdu3.fedoraproject.org @@ -32,7 +32,7 @@ network_connections: # This host is externally reachable # external: true -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 vmhost: vmhost-x86-01.rdu3.fedoraproject.org volgroup: /dev/vg_guests From d60806aca01748a9523fef1de24e7d412425613e Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Thu, 21 May 2026 13:10:36 -0700 Subject: [PATCH 178/269] ns05: move to rhel10 Signed-off-by: Kevin Fenzi --- inventory/host_vars/ns05.fedoraproject.org | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/inventory/host_vars/ns05.fedoraproject.org b/inventory/host_vars/ns05.fedoraproject.org index edb8d29c7e..8f22d3c906 100644 --- a/inventory/host_vars/ns05.fedoraproject.org +++ b/inventory/host_vars/ns05.fedoraproject.org @@ -25,8 +25,8 @@ eth0_ipv6_ip: "2001:4178:2:1269:dead:beef:cafe:fed5" eth0_ipv6_nm: 64 eth0_nm: 255.255.255.240 has_ipv6: yes -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 network_connections: - autoconnect: yes ip: From f05fbe3876d78f486e4a2bc6c87dbb2ede85f864 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Thu, 21 May 2026 13:30:15 -0700 Subject: [PATCH 179/269] dedicatedsolutions01: drop from inventory in favor of 02 Signed-off-by: Kevin Fenzi --- inventory/inventory | 1 - 1 file changed, 1 deletion(-) diff --git a/inventory/inventory b/inventory/inventory index d86040d304..910ab11d36 100644 --- a/inventory/inventory +++ b/inventory/inventory @@ -109,7 +109,6 @@ bvmhost-x86-02.stg.rdu3.fedoraproject.org bvmhost-x86-03.stg.rdu3.fedoraproject.org [colo_virt] -dedicatedsolutions01.fedoraproject.org dedicatedsolutions02.fedoraproject.org ibiblio02.fedoraproject.org ibiblio05.fedoraproject.org From 4140b2cdfd2a871b2bcf9e7776226adc5f8913a2 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Thu, 21 May 2026 15:51:34 -0700 Subject: [PATCH 180/269] resultsdb-ci-listener: update for upstream Forge migration The upstream app migrated from Pagure to Forge. Update references here. Signed-off-by: Adam Williamson --- .../resultsdb-ci-listener/templates/buildconfig.yml.j2 | 2 +- .../resultsdb-ci-listener/templates/configmaps.yml.j2 | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/openshift-apps/resultsdb-ci-listener/templates/buildconfig.yml.j2 b/roles/openshift-apps/resultsdb-ci-listener/templates/buildconfig.yml.j2 index 459a275a5c..a25777812e 100644 --- a/roles/openshift-apps/resultsdb-ci-listener/templates/buildconfig.yml.j2 +++ b/roles/openshift-apps/resultsdb-ci-listener/templates/buildconfig.yml.j2 @@ -14,7 +14,7 @@ spec: source: type: Git git: - uri: https://pagure.io/ci-resultsdb-listener.git + uri: https://forge.fedoraproject.org/apps/ci-resultsdb-listener.git ref: "{{ env }}" strategy: type: Source diff --git a/roles/openshift-apps/resultsdb-ci-listener/templates/configmaps.yml.j2 b/roles/openshift-apps/resultsdb-ci-listener/templates/configmaps.yml.j2 index 9bae0933be..4a5d92de31 100644 --- a/roles/openshift-apps/resultsdb-ci-listener/templates/configmaps.yml.j2 +++ b/roles/openshift-apps/resultsdb-ci-listener/templates/configmaps.yml.j2 @@ -69,7 +69,7 @@ data: app = "resultsdb_listener" # Some suggested extra fields: # URL of the project that provides this consumer - app_url = "https://pagure.io/ci-resultsdb-listener/" + app_url = "https://forge.fedoraproject.org/apps/ci-resultsdb-listener" # Contact emails for the maintainer(s) of the consumer - in case the # broker admin needs to contact them, for e.g. app_contacts_email = [ From 05eb12595eaae42074a36784d9a95474e9e2926c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Aur=C3=A9lien=20Bompard?= Date: Fri, 22 May 2026 16:44:18 +0200 Subject: [PATCH 181/269] Apply hotfix patches to pagure.io too (staging for now) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Aurélien Bompard --- inventory/group_vars/pagure | 2 ++ inventory/group_vars/pagure_stg | 7 +++++++ roles/pagure/tasks/main.yml | 6 ++++++ roles/pagure/tasks/patches.yml | 35 +++++++++++++++++++++++++++++++++ 4 files changed, 50 insertions(+) create mode 100644 roles/pagure/tasks/patches.yml diff --git a/inventory/group_vars/pagure b/inventory/group_vars/pagure index eb711ff83c..5145af1cdf 100644 --- a/inventory/group_vars/pagure +++ b/inventory/group_vars/pagure @@ -72,6 +72,8 @@ vpn: true zabbix_host: zabbix01.vpn.fedoraproject.org zabbix_macros: 'VFS.DEV.WRITE.AWAIT.WARN': 60 # frequently saturated writes overnight +# Hotfixes +pagure_patches: [] notes: | Run the pagure instances for fedora diff --git a/inventory/group_vars/pagure_stg b/inventory/group_vars/pagure_stg index a63e991bc9..b1a01ec7b3 100644 --- a/inventory/group_vars/pagure_stg +++ b/inventory/group_vars/pagure_stg @@ -41,6 +41,13 @@ zabbix_host: zabbix01.vpn.fedoraproject.org zabbix_server: "{{ zabbix_hostname }}" zabbix_auth_key: "{{ zabbix_apikey }}" # ansible-private repo zabbix_tls_psk: "{{ zabbix_tls_prod_psk }}" # in ansible-private repo, pagure-stg is weird... +# Hotfixes +pagure_patches: + - b50d32b7c92f131ebcc3b633de6c6e91e28297ec + - 5529 + - readme-include + - 26bc9746 + - 5553 notes: | Run the pagure instances for fedora diff --git a/roles/pagure/tasks/main.yml b/roles/pagure/tasks/main.yml index 3d7b874e26..96cdb5f381 100644 --- a/roles/pagure/tasks/main.yml +++ b/roles/pagure/tasks/main.yml @@ -429,6 +429,12 @@ - fedora-messaging +- name: Apply patches + ansible.builtin.import_tasks: patches.yml + tags: + - pagure + - patches + # Set-up Pagure - name: Create the folders used for releases and archives diff --git a/roles/pagure/tasks/patches.yml b/roles/pagure/tasks/patches.yml new file mode 100644 index 0000000000..1c3b4495b6 --- /dev/null +++ b/roles/pagure/tasks/patches.yml @@ -0,0 +1,35 @@ +--- +- name: Install patch and filterdiff + ansible.builtin.dnf: + name: + - patch + - patchutils + +- name: Prepare the patches directory + ansible.builtin.file: + path: /opt/patches + state: directory + mode: "0755" + +- name: Download patches + ansible.builtin.copy: + src: /srv/web/infra/bigfiles/hotfixes/pagure/{{ item }}.patch + dest: /opt/patches/{{ item }}.patch + owner: root + group: root + mode: "0644" + loop: "{{ pagure_patches }}" + +- name: Apply patches + ansible.builtin.shell: + chdir: "{{ ansible_facts['python3']['sitelib'] }}" + cmd: filterdiff --include '?/pagure/*' /opt/patches/{{ item }}.patch | patch -p1 --forward --fuzz=0 --reject-file=- --batch + loop: "{{ pagure_patches }}" + register: result + ignore_errors: true + changed_when: + - "'Reversed (or previously applied) patch detected!' not in result.stdout" + - result.rc == 0 + failed_when: "'FAILED' in result.stdout" + notify: + - Restart apache From 16642a1d024f676796c8413ac09e0ae1ec0381f9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Aur=C3=A9lien=20Bompard?= Date: Fri, 22 May 2026 17:03:44 +0200 Subject: [PATCH 182/269] OK, it works, apply them to prod pagure.io too MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Aurélien Bompard --- inventory/group_vars/pagure | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/inventory/group_vars/pagure b/inventory/group_vars/pagure index 5145af1cdf..486557be40 100644 --- a/inventory/group_vars/pagure +++ b/inventory/group_vars/pagure @@ -73,7 +73,12 @@ zabbix_host: zabbix01.vpn.fedoraproject.org zabbix_macros: 'VFS.DEV.WRITE.AWAIT.WARN': 60 # frequently saturated writes overnight # Hotfixes -pagure_patches: [] +pagure_patches: + - b50d32b7c92f131ebcc3b633de6c6e91e28297ec + - 5529 + - readme-include + - 26bc9746 + - 5553 notes: | Run the pagure instances for fedora From 481443b92fe3974773ab21fe55e7a598a7829105 Mon Sep 17 00:00:00 2001 From: Mattia Verga Date: Sat, 23 May 2026 10:13:03 +0200 Subject: [PATCH 183/269] bodhi-stg: use valkey cache Signed-off-by: Mattia Verga --- playbooks/openshift-apps/bodhi.yml | 7 +++++- roles/bodhi2/base/templates/production.ini.j2 | 22 +++++++++++++++++++ .../bodhi/templates/deployment.yml.j2 | 8 ++++++- .../bodhi/templates/dockerfile-base | 4 ++-- .../bodhi/templates/dockerfile-critpathcron | 4 ++-- .../bodhi/templates/valkey-configmap.yml.j2 | 15 +++++++++++++ vars/apps/bodhi.yml | 1 + 7 files changed, 55 insertions(+), 6 deletions(-) create mode 100644 roles/openshift-apps/bodhi/templates/valkey-configmap.yml.j2 diff --git a/playbooks/openshift-apps/bodhi.yml b/playbooks/openshift-apps/bodhi.yml index 6cae605bf7..7bde20dddc 100644 --- a/playbooks/openshift-apps/bodhi.yml +++ b/playbooks/openshift-apps/bodhi.yml @@ -83,6 +83,11 @@ object_template: secret.yml.j2 object_objectname: secret.yml when: env == "staging" + - role: openshift/object + object_app: bodhi + object_template: valkey-configmap.yml.j2 + object_objectname: valkey-configmap.yml + when: env == "staging" - role: openshift/keytab keytab_app: bodhi keytab_key: koji-keytab @@ -194,7 +199,7 @@ ansible.builtin.command: oc -n bodhi scale deployment bodhi-celery --replicas={{ bodhi_openshift_pods }} when: env == "staging" - name: Scale up pods - ansible.builtin.command: oc -n bodhi scale deployment bodhi-web --replicas={{ bodhi_openshift_pods }} + ansible.builtin.command: oc -n bodhi scale deployment bodhi-web --replicas={{ bodhi_openshift_pods_stg_web }} when: env == "staging" - name: Set the timeout to the openshift route ansible.builtin.command: "oc -n bodhi annotate route bodhi-web --overwrite haproxy.router.openshift.io/timeout=180s" diff --git a/roles/bodhi2/base/templates/production.ini.j2 b/roles/bodhi2/base/templates/production.ini.j2 index c3b7d15d79..bccafe60bd 100644 --- a/roles/bodhi2/base/templates/production.ini.j2 +++ b/roles/bodhi2/base/templates/production.ini.j2 @@ -366,12 +366,34 @@ top_testers_timeframe = 900 # stacks_enabled = False # Cache settings +{% if env == 'staging' %} +dogpile.cache.backend = dogpile.cache.redis +# Set expiration_time to one week +dogpile.cache.expiration_time = 604800 +dogpile.cache.dogpile_expire_time = 10 +dogpile.cache.arguments.url = redis://default:{{bodhi_valkey_secret}}@bodhi-valkey:6379/0 +# dogpile.cache.arguments.host = +# dogpile.cache.arguments.port = 6379 +# dogpile.cache.arguments.db = 0 +# dogpile.cache.arguments.username = default +# dogpile.cache.arguments.password = This_Is_JustAT3st +dogpile.cache.arguments.distributed_lock = True +dogpile.cache.arguments.thread_local_lock = False +dogpile.cache.arguments.lock_timeout = 5 +dogpile.cache.arguments.lock_sleep = 0.1 +dogpile.cache.arguments.lock_prefix = bodhi:dogpile_lock: +# Set redis expiration_time to one week + 1 hour +dogpile.cache.arguments.redis_expiration_time = 608400 +dogpile.cache.arguments.connection_pool_kwargs.max_connections = 20 +dogpile.cache.arguments.connection_pool_kwargs.socket_keepalive = True +{% else %} # dogpile.cache.backend = dogpile.cache.dbm # dogpile.cache.expiration_time = 100 # dogpile.cache.arguments.filename = /var/cache/bodhi-dogpile-cache.dbm dogpile.cache.backend = dogpile.cache.memory_pickle # Cache expires every 6 hours. dogpile.cache.expiration_time = 21600 +{% endif %} # Exclude sending emails to these users # exclude_mail = bodhi diff --git a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 index b6dce578ec..905635f26b 100644 --- a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 +++ b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 @@ -386,7 +386,7 @@ spec: - name: bodhi-valkey image: image-registry.openshift-image-registry.svc:5000/bodhi/bodhi-valkey:latest command: ["valkey-server"] - args: ["/etc/valkey/valkey.conf", "--logfile", "", "--pidfile", "", "--unixsocket", "", "--bind", "0.0.0.0", "--requirepass", "$(VALKEY_PASSWORD)"] + args: ["/etc/valkey/valkey.conf", "--include", "/etc/valkey/valkey-overrides.conf", "--requirepass", "$(VALKEY_PASSWORD)"] env: - name: VALKEY_PASSWORD valueFrom: @@ -397,6 +397,9 @@ spec: volumeMounts: - name: bodhi-valkey-data-volume mountPath: /data + - name: bodhi-valkey-config-volume + mountPath: /etc/valkey/valkey-overrides.conf + subPath: valkey-overrides.conf ports: - containerPort: 6379 protocol: TCP @@ -417,6 +420,9 @@ spec: - name: bodhi-valkey-data-volume persistentVolumeClaim: claimName: "bodhi-valkey-storage{{ '-stg' if env == 'staging' else '' }}" + - name: bodhi-valkey-config-volume + configMap: + name: bodhi-valkey-config --- # bodhi-valkey Service apiVersion: v1 diff --git a/roles/openshift-apps/bodhi/templates/dockerfile-base b/roles/openshift-apps/bodhi/templates/dockerfile-base index bb877d7dcb..a298e5035b 100644 --- a/roles/openshift-apps/bodhi/templates/dockerfile-base +++ b/roles/openshift-apps/bodhi/templates/dockerfile-base @@ -1,7 +1,7 @@ {% if env == "staging" %} -FROM fedora:44 +FROM quay.io/fedora/fedora:44 {% else %} -FROM fedora:43 +FROM quay.io/fedora/fedora:43 {% endif %} LABEL \ name="bodhi-base" \ diff --git a/roles/openshift-apps/bodhi/templates/dockerfile-critpathcron b/roles/openshift-apps/bodhi/templates/dockerfile-critpathcron index d4b2173c3a..bfdfc82e52 100644 --- a/roles/openshift-apps/bodhi/templates/dockerfile-critpathcron +++ b/roles/openshift-apps/bodhi/templates/dockerfile-critpathcron @@ -1,7 +1,7 @@ {% if env == "staging" %} -FROM fedora:43 +FROM quay.io/fedora/fedora:43 {% else %} -FROM fedora:43 +FROM quay.io/fedora/fedora:43 {% endif %} LABEL \ name="bodhi-critpathcron" \ diff --git a/roles/openshift-apps/bodhi/templates/valkey-configmap.yml.j2 b/roles/openshift-apps/bodhi/templates/valkey-configmap.yml.j2 new file mode 100644 index 0000000000..674219e4ee --- /dev/null +++ b/roles/openshift-apps/bodhi/templates/valkey-configmap.yml.j2 @@ -0,0 +1,15 @@ +{% if env == "staging" %} +apiVersion: v1 +kind: ConfigMap +metadata: + name: bodhi-valkey-config + labels: + app: bodhi-valkey +data: + valkey-overrides.conf: | + bind 0.0.0.0 + logfile "" + loglevel {{ 'verbose' if env == 'staging' else 'notice' }} + pidfile "" + dir /data +{% endif %} diff --git a/vars/apps/bodhi.yml b/vars/apps/bodhi.yml index 06236bc261..e356b61775 100644 --- a/vars/apps/bodhi.yml +++ b/vars/apps/bodhi.yml @@ -3,4 +3,5 @@ bodhi_version: "{{ (env == 'production')|ternary('26.4.0', '26.4.0') }}" bodhi_openshift_pods: 1 bodhi_openshift_pods_stg_consumers: 15 +bodhi_openshift_pods_stg_web: 2 bodhi_sent_topics: ^org\.fedoraproject\.{{ env_short }}\.(bodhi|pungi)\..* From b5eddd80ea81971bb032122308e16faa2d3ac71c Mon Sep 17 00:00:00 2001 From: Mattia Verga Date: Sat, 23 May 2026 11:01:41 +0200 Subject: [PATCH 184/269] bodhi-stg: cannot use --include to override valkey conf Signed-off-by: Mattia Verga --- playbooks/openshift-apps/bodhi.yml | 5 ----- .../bodhi/templates/deployment.yml.j2 | 8 +------- .../bodhi/templates/valkey-configmap.yml.j2 | 15 --------------- 3 files changed, 1 insertion(+), 27 deletions(-) delete mode 100644 roles/openshift-apps/bodhi/templates/valkey-configmap.yml.j2 diff --git a/playbooks/openshift-apps/bodhi.yml b/playbooks/openshift-apps/bodhi.yml index 7bde20dddc..d1cb7834b1 100644 --- a/playbooks/openshift-apps/bodhi.yml +++ b/playbooks/openshift-apps/bodhi.yml @@ -83,11 +83,6 @@ object_template: secret.yml.j2 object_objectname: secret.yml when: env == "staging" - - role: openshift/object - object_app: bodhi - object_template: valkey-configmap.yml.j2 - object_objectname: valkey-configmap.yml - when: env == "staging" - role: openshift/keytab keytab_app: bodhi keytab_key: koji-keytab diff --git a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 index 905635f26b..cc3c6247ec 100644 --- a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 +++ b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 @@ -386,7 +386,7 @@ spec: - name: bodhi-valkey image: image-registry.openshift-image-registry.svc:5000/bodhi/bodhi-valkey:latest command: ["valkey-server"] - args: ["/etc/valkey/valkey.conf", "--include", "/etc/valkey/valkey-overrides.conf", "--requirepass", "$(VALKEY_PASSWORD)"] + args: ["/etc/valkey/valkey.conf", "--bind", "0.0.0.0", "--pidfile", "", "--dir", "/data", "--loglevel", "{{ 'verbose' if env == 'staging' else 'warning' }}", "--requirepass", "$(VALKEY_PASSWORD)"] env: - name: VALKEY_PASSWORD valueFrom: @@ -397,9 +397,6 @@ spec: volumeMounts: - name: bodhi-valkey-data-volume mountPath: /data - - name: bodhi-valkey-config-volume - mountPath: /etc/valkey/valkey-overrides.conf - subPath: valkey-overrides.conf ports: - containerPort: 6379 protocol: TCP @@ -420,9 +417,6 @@ spec: - name: bodhi-valkey-data-volume persistentVolumeClaim: claimName: "bodhi-valkey-storage{{ '-stg' if env == 'staging' else '' }}" - - name: bodhi-valkey-config-volume - configMap: - name: bodhi-valkey-config --- # bodhi-valkey Service apiVersion: v1 diff --git a/roles/openshift-apps/bodhi/templates/valkey-configmap.yml.j2 b/roles/openshift-apps/bodhi/templates/valkey-configmap.yml.j2 deleted file mode 100644 index 674219e4ee..0000000000 --- a/roles/openshift-apps/bodhi/templates/valkey-configmap.yml.j2 +++ /dev/null @@ -1,15 +0,0 @@ -{% if env == "staging" %} -apiVersion: v1 -kind: ConfigMap -metadata: - name: bodhi-valkey-config - labels: - app: bodhi-valkey -data: - valkey-overrides.conf: | - bind 0.0.0.0 - logfile "" - loglevel {{ 'verbose' if env == 'staging' else 'notice' }} - pidfile "" - dir /data -{% endif %} From c46879dc54dfd4a05cfce727dd2e8ae412604354 Mon Sep 17 00:00:00 2001 From: Mattia Verga Date: Sat, 23 May 2026 11:07:47 +0200 Subject: [PATCH 185/269] bodhi-stg: fix valkey logfile Signed-off-by: Mattia Verga --- roles/openshift-apps/bodhi/templates/deployment.yml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 index cc3c6247ec..c6e1ee455a 100644 --- a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 +++ b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 @@ -386,7 +386,7 @@ spec: - name: bodhi-valkey image: image-registry.openshift-image-registry.svc:5000/bodhi/bodhi-valkey:latest command: ["valkey-server"] - args: ["/etc/valkey/valkey.conf", "--bind", "0.0.0.0", "--pidfile", "", "--dir", "/data", "--loglevel", "{{ 'verbose' if env == 'staging' else 'warning' }}", "--requirepass", "$(VALKEY_PASSWORD)"] + args: ["/etc/valkey/valkey.conf", "--bind", "0.0.0.0", "--pidfile", "", "--dir", "/data", "--logfile", "", "--loglevel", "{{ 'verbose' if env == 'staging' else 'warning' }}", "--requirepass", "$(VALKEY_PASSWORD)"] env: - name: VALKEY_PASSWORD valueFrom: From 885651a7a77ef36146ebbb5a5ae8a083be79c540 Mon Sep 17 00:00:00 2001 From: Mattia Verga Date: Sat, 23 May 2026 11:11:26 +0200 Subject: [PATCH 186/269] bodhi-stg: fix valkey unixsocket Signed-off-by: Mattia Verga --- roles/openshift-apps/bodhi/templates/deployment.yml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 index c6e1ee455a..fd2083b386 100644 --- a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 +++ b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 @@ -386,7 +386,7 @@ spec: - name: bodhi-valkey image: image-registry.openshift-image-registry.svc:5000/bodhi/bodhi-valkey:latest command: ["valkey-server"] - args: ["/etc/valkey/valkey.conf", "--bind", "0.0.0.0", "--pidfile", "", "--dir", "/data", "--logfile", "", "--loglevel", "{{ 'verbose' if env == 'staging' else 'warning' }}", "--requirepass", "$(VALKEY_PASSWORD)"] + args: ["/etc/valkey/valkey.conf", "--bind", "0.0.0.0", "--pidfile", "", "--unixsocket", "", "--dir", "/data", "--logfile", "", "--loglevel", "{{ 'verbose' if env == 'staging' else 'warning' }}", "--requirepass", "$(VALKEY_PASSWORD)"] env: - name: VALKEY_PASSWORD valueFrom: From 7b21d2756ff2af098978f737948ccf6ca432159c Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sat, 23 May 2026 09:49:35 -0700 Subject: [PATCH 187/269] communishift: add some projects This will add release-schedule-planner ( 13336 ) and draft-share ( 13358 ) Signed-off-by: Kevin Fenzi --- inventory/group_vars/all | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/inventory/group_vars/all b/inventory/group_vars/all index 211f632ace..a2d67b9d26 100644 --- a/inventory/group_vars/all +++ b/inventory/group_vars/all @@ -63,6 +63,10 @@ communishift_projects: communishift-weekly-bootc: do_not_delete: true # Marked do not delete 2024-11-26. Needed until end of bootc initative. - dkirwan name: communishift-weekly-bootc + communishift-release-schedule-planner + name: communishift-release-schedule-planner + communishift-draft-share + name: communishift-draft-share # true or false if we are or are not a copr build virthost. # Default to false copr_build_virthost: false From 40fe2bfc693487a9536d87a357065859085fe496 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sat, 23 May 2026 09:51:54 -0700 Subject: [PATCH 188/269] fix syntax error Signed-off-by: Kevin Fenzi --- inventory/group_vars/all | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/inventory/group_vars/all b/inventory/group_vars/all index a2d67b9d26..fc64cac7bb 100644 --- a/inventory/group_vars/all +++ b/inventory/group_vars/all @@ -63,9 +63,9 @@ communishift_projects: communishift-weekly-bootc: do_not_delete: true # Marked do not delete 2024-11-26. Needed until end of bootc initative. - dkirwan name: communishift-weekly-bootc - communishift-release-schedule-planner + communishift-release-schedule-planner: name: communishift-release-schedule-planner - communishift-draft-share + communishift-draft-share: name: communishift-draft-share # true or false if we are or are not a copr build virthost. # Default to false From 7ed0a93f2a33bc85251eda4781ab63ac0b9c3d54 Mon Sep 17 00:00:00 2001 From: Ryan Lerch Date: Mon, 25 May 2026 12:52:18 +1000 Subject: [PATCH 189/269] forge: add group team mapping for DEI mentor summit team related: https://forge.fedoraproject.org/forge/forge/issues/589 Signed-off-by: Ryan Lerch --- roles/openshift-apps/forgejo/templates/values.yaml.j2 | 1 + 1 file changed, 1 insertion(+) diff --git a/roles/openshift-apps/forgejo/templates/values.yaml.j2 b/roles/openshift-apps/forgejo/templates/values.yaml.j2 index aab8079b79..8edd1b5f31 100644 --- a/roles/openshift-apps/forgejo/templates/values.yaml.j2 +++ b/roles/openshift-apps/forgejo/templates/values.yaml.j2 @@ -495,6 +495,7 @@ gitea: "forge-dei-owners":{"dei":["Owners"]}, "forge-dei-members":{"dei":["Members"]}, "forge-dei-pride":{"dei":["Pride"]}, + "forge-dei-mentorsummitorg":{"dei":["mentor-summit-org"]}, "forge-rust-owners":{"rust":["Owners"]}, "forge-rust-members":{"rust":["Members"]}, "forge-mobility-owners":{"mobility":["Owners"]}, From 2e63ef6b7210af1291e180dc5291b57c4aa7711e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Aur=C3=A9lien=20Bompard?= Date: Mon, 25 May 2026 09:31:12 +0200 Subject: [PATCH 190/269] Badges: adjust the oidc callback URL in staging MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Aurélien Bompard --- roles/ipsilon/templates/openidc.staging.static.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/ipsilon/templates/openidc.staging.static.j2 b/roles/ipsilon/templates/openidc.staging.static.j2 index 938d65655f..048cb0c25c 100644 --- a/roles/ipsilon/templates/openidc.staging.static.j2 +++ b/roles/ipsilon/templates/openidc.staging.static.j2 @@ -919,7 +919,7 @@ mirrormanager ipsilon_internal={"type":"static","client_id":"mirrormanager","tru tahrir client_name="Badges Staging" tahrir client_secret="{{ tahrir_oidc_client_secret_staging }}" -tahrir redirect_uris=["https://badges.stg.fedoraproject.org/oidc/authorize", "https://badges.apps.ocp.stg.fedoraproject.org/oidc/authorize"] +tahrir redirect_uris=["https://badges.stg.fedoraproject.org/oidc/authorize", "https://badges.apps.ocp.stg.fedoraproject.org/oidc/authorize", "https://badges.stg.fedoraproject.org/callback"] tahrir client_uri="https://badges.stg.fedoraproject.org/" tahrir ipsilon_internal={"type":"static","client_id":"tahrir","trusted":true} tahrir contacts=["admin@fedoraproject.org"] From 004fb438fe0c77ba1dc266a0b508f2c1ddb3d705 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Aur=C3=A9lien=20Bompard?= Date: Mon, 25 May 2026 10:07:57 +0200 Subject: [PATCH 191/269] Badges: the frontend needs its own OIDC client MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Aurélien Bompard --- .../templates/openidc.staging.static.j2 | 29 ++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) diff --git a/roles/ipsilon/templates/openidc.staging.static.j2 b/roles/ipsilon/templates/openidc.staging.static.j2 index 048cb0c25c..f4eaca3934 100644 --- a/roles/ipsilon/templates/openidc.staging.static.j2 +++ b/roles/ipsilon/templates/openidc.staging.static.j2 @@ -919,7 +919,7 @@ mirrormanager ipsilon_internal={"type":"static","client_id":"mirrormanager","tru tahrir client_name="Badges Staging" tahrir client_secret="{{ tahrir_oidc_client_secret_staging }}" -tahrir redirect_uris=["https://badges.stg.fedoraproject.org/oidc/authorize", "https://badges.apps.ocp.stg.fedoraproject.org/oidc/authorize", "https://badges.stg.fedoraproject.org/callback"] +tahrir redirect_uris=["https://badges.stg.fedoraproject.org/oidc/authorize", "https://badges.apps.ocp.stg.fedoraproject.org/oidc/authorize"] tahrir client_uri="https://badges.stg.fedoraproject.org/" tahrir ipsilon_internal={"type":"static","client_id":"tahrir","trusted":true} tahrir contacts=["admin@fedoraproject.org"] @@ -944,6 +944,33 @@ tahrir default_max_age=null tahrir default_acr_values=null tahrir client_secret_expires_at=0 +tahrir-frontend client_name="Badges Staging" +tahrir-frontend client_secret="" +tahrir-frontend redirect_uris=["https://badges.stg.fedoraproject.org/callback"] +tahrir-frontend client_uri="https://badges.stg.fedoraproject.org/" +tahrir-frontend ipsilon_internal={"type":"static","client_id":"tahrir-frontend","trusted":true} +tahrir-frontend contacts=["admin@fedoraproject.org"] +tahrir-frontend client_id=null +tahrir-frontend policy_uri="https://fedoraproject.org/wiki/Legal:PrivacyPolicy" +tahrir-frontend grant_types="authorization_code" +tahrir-frontend response_types="code" +tahrir-frontend application_type="native" +tahrir-frontend subject_type="public" +tahrir-frontend logo_uri=null +tahrir-frontend tos_uri=null +tahrir-frontend jwks_uri=null +tahrir-frontend jwks=null +tahrir-frontend sector_identifier_uri=null +tahrir-frontend request_uris=[] +tahrir-frontend require_auth_time=null +tahrir-frontend token_endpoint_auth_method="none" +tahrir-frontend id_token_signed_response_alg="RS256" +tahrir-frontend request_object_signing_alg="none" +tahrir-frontend initiate_login_uri=null +tahrir-frontend default_max_age=null +tahrir-frontend default_acr_values=null +tahrir-frontend client_secret_expires_at=0 + mailman3 client_name="Mailman Staging" mailman3 client_secret="{{ mailman_stg_oidc_pass }}" mailman3 redirect_uris=["https://lists.stg.fedoraproject.org/accounts/fedora/login/callback/", "https://lists.stg.fedorahosted.org/accounts/fedora/login/callback/", "https://lists.stg.pagure.io/accounts/fedora/login/callback/"] From f4ca07caf78641e67394d3f140b05af7fafa156f Mon Sep 17 00:00:00 2001 From: Ryan Lerch Date: Tue, 26 May 2026 12:36:17 +1000 Subject: [PATCH 192/269] forge: add group team mapping for actions org related: https://forge.fedoraproject.org/forge/forge/issues/557 Signed-off-by: Ryan Lerch --- roles/openshift-apps/forgejo/templates/values.yaml.j2 | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/roles/openshift-apps/forgejo/templates/values.yaml.j2 b/roles/openshift-apps/forgejo/templates/values.yaml.j2 index 8edd1b5f31..fb39bc322e 100644 --- a/roles/openshift-apps/forgejo/templates/values.yaml.j2 +++ b/roles/openshift-apps/forgejo/templates/values.yaml.j2 @@ -577,7 +577,8 @@ gitea: "forge-r-owners":{"r":["Owners"]}, "forge-fdwg-owners":{"fdwg":["Owners"]}, "forge-fdwg-members":{"fdwg":["Members"]}, - "forge-pungi-owners":{"pungi":["Owners"]} + "forge-pungi-owners":{"pungi":["Owners"]}, + "forge-action-owners":{"action":["Owners"]} }' {% endif %} # - name: 'OAuth 1' From 749c16501f47240e90333e421caf74d32aae833e Mon Sep 17 00:00:00 2001 From: Ryan Lerch Date: Tue, 26 May 2026 13:02:46 +1000 Subject: [PATCH 193/269] forge: add forgejo.org to migrations whitelist Signed-off-by: Ryan Lerch --- roles/openshift-apps/forgejo/templates/values.yaml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/forgejo/templates/values.yaml.j2 b/roles/openshift-apps/forgejo/templates/values.yaml.j2 index fb39bc322e..e660dee225 100644 --- a/roles/openshift-apps/forgejo/templates/values.yaml.j2 +++ b/roles/openshift-apps/forgejo/templates/values.yaml.j2 @@ -798,7 +798,7 @@ gitea: ## @param gitea.config.migrations Settings for Git repository migrations migrations: - ALLOWED_DOMAINS: "*.fedoraproject.org,pagure.io,stg.pagure.io,gitlab.com,codeberg.org,github.com,*.github.com,*.githubusercontent.com" + ALLOWED_DOMAINS: "*.fedoraproject.org,pagure.io,stg.pagure.io,gitlab.com,codeberg.org,github.com,*.github.com,*.githubusercontent.com,*.forgejo.org" ## @param gitea.config.federation Federation configuration federation: {} From 90cc0bee981bf92de70b8f8ae7cdb3cd9320ff08 Mon Sep 17 00:00:00 2001 From: Ryan Lerch Date: Tue, 26 May 2026 17:16:47 +1000 Subject: [PATCH 194/269] forge: set DEFAULT_ACTIONS_URL to forge.fp.o resolves: https://forge.fedoraproject.org/forge/forge/issues/557 Signed-off-by: Ryan Lerch --- roles/openshift-apps/forgejo/templates/values.yaml.j2 | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/roles/openshift-apps/forgejo/templates/values.yaml.j2 b/roles/openshift-apps/forgejo/templates/values.yaml.j2 index e660dee225..48f4c0dba8 100644 --- a/roles/openshift-apps/forgejo/templates/values.yaml.j2 +++ b/roles/openshift-apps/forgejo/templates/values.yaml.j2 @@ -825,7 +825,8 @@ gitea: proxy: {} ## @param gitea.config.actions Configuration for [Forgejo Actions](https://forgejo.org/docs/latest/user/actions/) - actions: {} + actions: + DEFAULT_ACTIONS_URL: https://forge.fedoraproject.org/actions ## @param gitea.config.other Uncategorized configuration options other: {} From f68ab813be0a77236f9237630cb9102857ede453 Mon Sep 17 00:00:00 2001 From: Ryan Lerch Date: Tue, 26 May 2026 17:26:37 +1000 Subject: [PATCH 195/269] forge: fix typo in DEFAULT_ACTIONS_URL Signed-off-by: Ryan Lerch --- roles/openshift-apps/forgejo/templates/values.yaml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/forgejo/templates/values.yaml.j2 b/roles/openshift-apps/forgejo/templates/values.yaml.j2 index 48f4c0dba8..2d57b9ad16 100644 --- a/roles/openshift-apps/forgejo/templates/values.yaml.j2 +++ b/roles/openshift-apps/forgejo/templates/values.yaml.j2 @@ -826,7 +826,7 @@ gitea: ## @param gitea.config.actions Configuration for [Forgejo Actions](https://forgejo.org/docs/latest/user/actions/) actions: - DEFAULT_ACTIONS_URL: https://forge.fedoraproject.org/actions + DEFAULT_ACTIONS_URL: https://forge.fedoraproject.org/ ## @param gitea.config.other Uncategorized configuration options other: {} From 137626c6374a42d21eb1521435e7aba75d3c692d Mon Sep 17 00:00:00 2001 From: Ryan Lerch Date: Tue, 26 May 2026 17:54:39 +1000 Subject: [PATCH 196/269] forge: fix yet asnother typo in DEFAULT_ACTIONS_URL config Signed-off-by: Ryan Lerch --- roles/openshift-apps/forgejo/templates/values.yaml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/forgejo/templates/values.yaml.j2 b/roles/openshift-apps/forgejo/templates/values.yaml.j2 index 2d57b9ad16..46c40fd1fa 100644 --- a/roles/openshift-apps/forgejo/templates/values.yaml.j2 +++ b/roles/openshift-apps/forgejo/templates/values.yaml.j2 @@ -826,7 +826,7 @@ gitea: ## @param gitea.config.actions Configuration for [Forgejo Actions](https://forgejo.org/docs/latest/user/actions/) actions: - DEFAULT_ACTIONS_URL: https://forge.fedoraproject.org/ + DEFAULT_ACTIONS_URL: https://forge.fedoraproject.org ## @param gitea.config.other Uncategorized configuration options other: {} From 6cfda2b8f5092e976f2d614558fcaced9169247d Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Tue, 26 May 2026 13:44:59 +0100 Subject: [PATCH 197/269] Zabbix: move http-koji checks from Nagios Signed-off-by: Greg Sutcliffe --- inventory/group_vars/staging | 2 + roles/koji_hub/files/zabbix-template.yml | 59 +++++++++++++++++++ roles/koji_hub/tasks/main.yml | 25 ++++++++ .../templates/nagios/services/websites.cfg.j2 | 19 ------ 4 files changed, 86 insertions(+), 19 deletions(-) create mode 100644 roles/koji_hub/files/zabbix-template.yml diff --git a/inventory/group_vars/staging b/inventory/group_vars/staging index 5c9d7004bb..ca7fb08b02 100644 --- a/inventory/group_vars/staging +++ b/inventory/group_vars/staging @@ -69,3 +69,5 @@ zabbix_tls_psk: "{{ zabbix_tls_stg_psk }}" # in ansible-private repo zabbix_inventory: # Env is not a valid key, so use this field for environment deployment_status: staging +zabbix_macros: + 'KOJI.HOST': koji.stg.fedoraproject.org diff --git a/roles/koji_hub/files/zabbix-template.yml b/roles/koji_hub/files/zabbix-template.yml new file mode 100644 index 0000000000..793974e751 --- /dev/null +++ b/roles/koji_hub/files/zabbix-template.yml @@ -0,0 +1,59 @@ +zabbix_export: + version: '7.0' + template_groups: + - uuid: a333cbd6a3ad44baaa4eee4b0c0b1bec + name: Fedora + templates: + - uuid: cd834c9a477042fdadba6fb6c1cdcc56 + template: 'Koji checks' + name: 'Koji checks' + description: 'Checks on Koji wellness' + groups: + - name: Fedora + items: + - uuid: dda31efd4386498a9b3176ad80e50eb2 + name: 'http-koji localhost' + type: ZABBIX_ACTIVE + key: 'web.page.regexp[http://localhost/koji/,,,Recent]' + value_type: CHAR + trends: '0' + tags: + - tag: application + value: koji + - tag: component + value: infra + triggers: + - uuid: f95efffe36024e8a94b5f8fa582cc86b + expression: 'last(/Koji checks/web.page.regexp[http://localhost/koji/,,,Recent])<>"Recent"' + name: 'http-koji localhost connection failed' + priority: AVERAGE + tags: + - tag: scope + value: availability + - tag: scope + value: connectivity + - uuid: 6dcf20635db1441892d51884bff34037 + name: http-koji + type: ZABBIX_ACTIVE + key: 'web.page.regexp[https://{$KOJI_HOST}/koji/hosts,,,fedoraproject.org]' + value_type: CHAR + trends: '0' + tags: + - tag: application + value: koji + - tag: component + value: infra + triggers: + - uuid: f85aa3969eb241ed857e21e07964ca5c + expression: 'last(/Koji checks/web.page.regexp[https://{$KOJI_HOST}/koji/hosts,,,fedoraproject.org])<>"fedoraproject.org"' + name: 'http-koji connection failed' + priority: AVERAGE + tags: + - tag: scope + value: availability + - tag: scope + value: connectivity + macros: + - macro: '{$KOJI.HOST}' + value: koji.fedoraproject.org + description: 'Target for koji checks (override for stg)' diff --git a/roles/koji_hub/tasks/main.yml b/roles/koji_hub/tasks/main.yml index 06ae93fb6a..800d5c0dc1 100644 --- a/roles/koji_hub/tasks/main.yml +++ b/roles/koji_hub/tasks/main.yml @@ -484,3 +484,28 @@ tags: - koji_hub - koji_hub/oomd + +# Zabbix monitoring of the koji sites +- name: Zabbix API Block + vars: + ansible_zabbix_auth_key: "{{ zabbix_auth_key }}" + ansible_network_os: "{{ zabbix_network_os }}" + ansible_connection: "{{ zabbix_connection }}" + ansible_httpapi_port: "{{ zabbix_httpapi_port }}" + ansible_httpapi_use_ssl: "{{ zabbix_httpapi_use_ssl }}" + ansible_httpapi_validate_certs: "{{ zabbix_httpapi_validate_certs }}" + ansible_host: "{{ zabbix_server }}" + ansible_zabbix_url_path: "{{ zabbix_url_path }}" + tags: + - koji_hub + - zabbix_api + block: + - name: Import Proxy checks template + community.zabbix.zabbix_template: + template_yaml: "{{ lookup('file', 'zabbix-template.yml') }}" + state: present + - name: Add self to Koji checks template in Zabbix + community.zabbix.zabbix_host: + host_name: "{{ inventory_hostname }}" + link_templates: Koji checks + force: false diff --git a/roles/nagios_server/templates/nagios/services/websites.cfg.j2 b/roles/nagios_server/templates/nagios/services/websites.cfg.j2 index 80f0024c7e..fc6ee72756 100644 --- a/roles/nagios_server/templates/nagios/services/websites.cfg.j2 +++ b/roles/nagios_server/templates/nagios/services/websites.cfg.j2 @@ -97,25 +97,6 @@ define service { servicegroups freemedia } - -## Internal services - -define service { - hostgroup_name koji - service_description http-koji - check_command check_website!koji.fedoraproject.org!/koji/hosts!fedoraproject.org - use websitetemplate -} - -define service { - hostgroup_name koji - service_description http-koji-frontend - check_command check_website_ppc!localhost!/koji/!Recent - use ppc-secondarytemplate -} - -## Auxillary to websites but necessary to make them happen - {% endif %} {% if vars['nagios_location'] == 'rdu3_internal' %} From 7e5a64efdc69349479f5ed99736c08b0de39baef Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Tue, 26 May 2026 13:50:58 +0100 Subject: [PATCH 198/269] Zabbix: fix typo in template macro Signed-off-by: Greg Sutcliffe --- roles/koji_hub/files/zabbix-template.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/koji_hub/files/zabbix-template.yml b/roles/koji_hub/files/zabbix-template.yml index 793974e751..f06c2e96a0 100644 --- a/roles/koji_hub/files/zabbix-template.yml +++ b/roles/koji_hub/files/zabbix-template.yml @@ -35,7 +35,7 @@ zabbix_export: - uuid: 6dcf20635db1441892d51884bff34037 name: http-koji type: ZABBIX_ACTIVE - key: 'web.page.regexp[https://{$KOJI_HOST}/koji/hosts,,,fedoraproject.org]' + key: 'web.page.regexp[https://{$KOJI.HOST}/koji/hosts,,,fedoraproject.org]' value_type: CHAR trends: '0' tags: @@ -45,7 +45,7 @@ zabbix_export: value: infra triggers: - uuid: f85aa3969eb241ed857e21e07964ca5c - expression: 'last(/Koji checks/web.page.regexp[https://{$KOJI_HOST}/koji/hosts,,,fedoraproject.org])<>"fedoraproject.org"' + expression: 'last(/Koji checks/web.page.regexp[https://{$KOJI.HOST}/koji/hosts,,,fedoraproject.org])<>"fedoraproject.org"' name: 'http-koji connection failed' priority: AVERAGE tags: From 8d40668907498532567cb6454245a91a455206b3 Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Tue, 26 May 2026 14:13:50 +0100 Subject: [PATCH 199/269] Zabbix: Add some basic non-host HTTP checking to zabbix01 Signed-off-by: Greg Sutcliffe --- roles/zabbix/sslchecks/tasks/httpcheck.yml | 26 ++++++++++++++++++++++ roles/zabbix/sslchecks/tasks/main.yml | 9 ++++++++ 2 files changed, 35 insertions(+) create mode 100644 roles/zabbix/sslchecks/tasks/httpcheck.yml diff --git a/roles/zabbix/sslchecks/tasks/httpcheck.yml b/roles/zabbix/sslchecks/tasks/httpcheck.yml new file mode 100644 index 0000000000..a522b12888 --- /dev/null +++ b/roles/zabbix/sslchecks/tasks/httpcheck.yml @@ -0,0 +1,26 @@ +--- +- name: Zabbix API Block + vars: + ansible_zabbix_auth_key: "{{ zabbix_auth_key }}" + ansible_network_os: "{{ zabbix_network_os }}" + ansible_connection: "{{ zabbix_connection }}" + ansible_httpapi_port: "{{ zabbix_httpapi_port }}" + ansible_httpapi_use_ssl: "{{ zabbix_httpapi_use_ssl }}" + ansible_httpapi_validate_certs: "{{ zabbix_httpapi_validate_certs }}" + ansible_host: "{{ zabbix_server }}" + ansible_zabbix_url_path: "{{ zabbix_url_path }}" + tags: + - zabbix_agent + - zabbix_api + block: + - name: Create {{ item.name }} http connection item + community.zabbix.zabbix_item: + name: "{{ item.name }} + host_name: "{{ inventory_hostname }}" + params: + type: zabbix_agent_active + key: "net.tcp.service[tcp,{{ item.name }},{{ item.port }}]" + value_type: numeric_unsigned + tags: + - tag: component + value: tcp diff --git a/roles/zabbix/sslchecks/tasks/main.yml b/roles/zabbix/sslchecks/tasks/main.yml index ca23babc2d..b3743084fa 100644 --- a/roles/zabbix/sslchecks/tasks/main.yml +++ b/roles/zabbix/sslchecks/tasks/main.yml @@ -28,3 +28,12 @@ tags: - zabbix_api when: inventory_hostname == 'zabbix01.stg.rdu3.fedoraproject.org' + +# HTTP service checks on DNS names +- name: Create HTTP checks for other hosts + include_tasks: httpcheck.yml + loop: + - { name: 'certgetter01.rdu3.fedoraproject.org', port: '80' } + tags: + - zabbix_api + when: inventory_hostname == 'zabbix01.rdu3.fedoraproject.org' From 6ed762bb2925623c56146342ab39d54bc7c51df9 Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Tue, 26 May 2026 14:22:13 +0100 Subject: [PATCH 200/269] Zabbix: use regex instead, more flexible Signed-off-by: Greg Sutcliffe --- roles/zabbix/sslchecks/tasks/httpcheck.yml | 8 ++++---- roles/zabbix/sslchecks/tasks/main.yml | 3 ++- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/roles/zabbix/sslchecks/tasks/httpcheck.yml b/roles/zabbix/sslchecks/tasks/httpcheck.yml index a522b12888..f8da053434 100644 --- a/roles/zabbix/sslchecks/tasks/httpcheck.yml +++ b/roles/zabbix/sslchecks/tasks/httpcheck.yml @@ -15,12 +15,12 @@ block: - name: Create {{ item.name }} http connection item community.zabbix.zabbix_item: - name: "{{ item.name }} + name: "{{ item.name }}" host_name: "{{ inventory_hostname }}" params: type: zabbix_agent_active - key: "net.tcp.service[tcp,{{ item.name }},{{ item.port }}]" - value_type: numeric_unsigned + key: "web.page.regexp[{{ item.name }},,,{{ item.string }}]" + value_type: character tags: - tag: component - value: tcp + value: http diff --git a/roles/zabbix/sslchecks/tasks/main.yml b/roles/zabbix/sslchecks/tasks/main.yml index b3743084fa..136ca3c072 100644 --- a/roles/zabbix/sslchecks/tasks/main.yml +++ b/roles/zabbix/sslchecks/tasks/main.yml @@ -33,7 +33,8 @@ - name: Create HTTP checks for other hosts include_tasks: httpcheck.yml loop: - - { name: 'certgetter01.rdu3.fedoraproject.org', port: '80' } + - { name: 'http://certgetter01.rdu3.fedoraproject.org', string: 'Index' } + - { name: 'https://lists.fedoraproject.org/archives', string: 'Fedora Mailing-Lists' } tags: - zabbix_api when: inventory_hostname == 'zabbix01.rdu3.fedoraproject.org' From 0d3e1263170de06594f90554586b2cdfd7a8e82f Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Tue, 26 May 2026 14:39:21 +0100 Subject: [PATCH 201/269] Zabbix: Fix item typo and add another check Signed-off-by: Greg Sutcliffe --- roles/zabbix/sslchecks/tasks/httpcheck.yml | 2 ++ roles/zabbix/sslchecks/tasks/main.yml | 1 + 2 files changed, 3 insertions(+) diff --git a/roles/zabbix/sslchecks/tasks/httpcheck.yml b/roles/zabbix/sslchecks/tasks/httpcheck.yml index f8da053434..ee428ff1e2 100644 --- a/roles/zabbix/sslchecks/tasks/httpcheck.yml +++ b/roles/zabbix/sslchecks/tasks/httpcheck.yml @@ -10,6 +10,7 @@ ansible_host: "{{ zabbix_server }}" ansible_zabbix_url_path: "{{ zabbix_url_path }}" tags: + - httpitems - zabbix_agent - zabbix_api block: @@ -21,6 +22,7 @@ type: zabbix_agent_active key: "web.page.regexp[{{ item.name }},,,{{ item.string }}]" value_type: character + interval: 1m tags: - tag: component value: http diff --git a/roles/zabbix/sslchecks/tasks/main.yml b/roles/zabbix/sslchecks/tasks/main.yml index 136ca3c072..e3a8a9ce0b 100644 --- a/roles/zabbix/sslchecks/tasks/main.yml +++ b/roles/zabbix/sslchecks/tasks/main.yml @@ -35,6 +35,7 @@ loop: - { name: 'http://certgetter01.rdu3.fedoraproject.org', string: 'Index' } - { name: 'https://lists.fedoraproject.org/archives', string: 'Fedora Mailing-Lists' } + - { name: 'https://mailman01.rdu3.fedoraproject.org/archives', string: 'Fedora Mailing-Lists' } tags: - zabbix_api when: inventory_hostname == 'zabbix01.rdu3.fedoraproject.org' From 1680d35e631f71fb55ef2689e2c1dd7d5bf49637 Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Tue, 26 May 2026 17:10:43 +0100 Subject: [PATCH 202/269] Move more http checks to Zabbix Signed-off-by: Greg Sutcliffe --- .../services/rdu3_internal/certgetter.cfg | 6 -- roles/nagios_server/tasks/main.yml | 2 - .../templates/nagios/services/websites.cfg.j2 | 63 ------------------- roles/zabbix/sslchecks/tasks/main.yml | 3 + 4 files changed, 3 insertions(+), 71 deletions(-) delete mode 100644 roles/nagios_server/files/nagios/services/rdu3_internal/certgetter.cfg diff --git a/roles/nagios_server/files/nagios/services/rdu3_internal/certgetter.cfg b/roles/nagios_server/files/nagios/services/rdu3_internal/certgetter.cfg deleted file mode 100644 index 13bdc2e38e..0000000000 --- a/roles/nagios_server/files/nagios/services/rdu3_internal/certgetter.cfg +++ /dev/null @@ -1,6 +0,0 @@ -define service { - host_name certgetter01.rdu3.fedoraproject.org - service_description certgetter-http - check_command check_http!certgetter01.rdu3.fedoraproject.org - use defaulttemplate -} diff --git a/roles/nagios_server/tasks/main.yml b/roles/nagios_server/tasks/main.yml index 9c93aa456a..60b6bcaa69 100644 --- a/roles/nagios_server/tasks/main.yml +++ b/roles/nagios_server/tasks/main.yml @@ -182,7 +182,6 @@ - name: Copy /etc/nagios/services (RDU3 specific files) ansible.builtin.copy: src=nagios/services/rdu3_internal/{{ item }} dest=/etc/nagios/services/{{ item }} with_items: - - certgetter.cfg - db_backups.cfg - disk.cfg - fedora_messaging.cfg @@ -202,7 +201,6 @@ - name: Copy /etc/nagios/services (RDU3 specific files) ansible.builtin.copy: src=nagios/services/rdu3_internal/{{ item }} dest=/etc/nagios/services/{{ item }} with_items: - - certgetter.cfg - db_backups.cfg - disk.cfg - fedora_messaging.cfg diff --git a/roles/nagios_server/templates/nagios/services/websites.cfg.j2 b/roles/nagios_server/templates/nagios/services/websites.cfg.j2 index fc6ee72756..7a941d3c04 100644 --- a/roles/nagios_server/templates/nagios/services/websites.cfg.j2 +++ b/roles/nagios_server/templates/nagios/services/websites.cfg.j2 @@ -1,11 +1,3 @@ -define service { - host_name registry-cdn - service_description http-moby-registry-cdn - check_command check_website_ssl!cdn.registry.fedoraproject.org!/v2/!{} - max_check_attempts 8 - use websitetemplate -} - define service { host_name proxy01.fedoraproject.org, proxy10.fedoraproject.org service_description http-oci-registry-api @@ -20,22 +12,6 @@ define service { use websitetemplate } -## Individual hosts - -define service { - host_name status - service_description http-status.fedoraproject.org - check_command check_website_ssl!www.fedorastatus.org!/index.html!Fedora Infrastructure Status - use websitetemplate -} - -define service { - host_name lists.fedoraproject.org - service_description http-lists.fedoraproject.org - check_command check_website_ssl!lists.fedoraproject.org!/archives/!Fedora Mailing-Lists - use websitetemplate -} - {% if vars['nagios_location'] == 'rdu3_internal' %} ## ## Other Frontend Websites @@ -62,26 +38,6 @@ define service { use websitetemplate } -#define service { -# hostgroup_name packages -# service_description http-packages-internal -# check_command check_website!localhost!/packages/!Packages -# max_check_attempts 8 -# use internalwebsitetemplate -# event_handler restart_httpd -#} -# -#define service { -# hostgroup_name packages -# service_description http-packages-internal-bugstab -# check_command check_website!localhost!/packages/fcomm_connector/bugzilla/query/query_bugs/%7B%22filters%22:%7B%22package%22:%22nethack%22,%22version%22:%22%22%7D,%22rows_per_page%22:10,%22start_row%22:0%7D!total_rows -# max_check_attempts 8 -# use internalwebsitetemplate -# # When this thing dies, you usually just need to nuke /var/cache/fedoracommunity/bugzillacookies -# #event_handler nuke_bugzillacookies_handler -#} - - define service { hostgroup_name pkgs service_description http-pkgs-pagure @@ -99,17 +55,6 @@ define service { {% endif %} -{% if vars['nagios_location'] == 'rdu3_internal' %} - -define service { - host_name mailman01.rdu3.fedoraproject.org - service_description http-mailman-internal - check_command check_website!mailman01.rdu3.fedoraproject.org!/archives/!Fedora Mailing-Lists - use websitetemplate -} - -{% endif %} - define service { host_name copr-be service_description http-download.copr.fedorainfracloud.org @@ -117,11 +62,3 @@ define service { max_check_attempts 8 use websitetemplate } - -define service { - host_name pagure.io - service_description https://forge.fedoraproject.org/infra/tickets - check_command check_website_follow!pagure.io!https://pagure.io/fedora-infrastructure/issues!Issues - max_check_attempts 8 - use websitetemplate -} diff --git a/roles/zabbix/sslchecks/tasks/main.yml b/roles/zabbix/sslchecks/tasks/main.yml index e3a8a9ce0b..79e8add755 100644 --- a/roles/zabbix/sslchecks/tasks/main.yml +++ b/roles/zabbix/sslchecks/tasks/main.yml @@ -36,6 +36,9 @@ - { name: 'http://certgetter01.rdu3.fedoraproject.org', string: 'Index' } - { name: 'https://lists.fedoraproject.org/archives', string: 'Fedora Mailing-Lists' } - { name: 'https://mailman01.rdu3.fedoraproject.org/archives', string: 'Fedora Mailing-Lists' } + - { name: 'https://cdn.registry.fedoraproject.org/v2/', string: '{}' } + - { name: 'https://www.fedorastatus.org/index.html', string: 'Fedora Infrastructure Status' } + - { name: 'https://pagure.io/fedora-infrastructure/issues', string: 'Issues' } tags: - zabbix_api when: inventory_hostname == 'zabbix01.rdu3.fedoraproject.org' From 03dec33fd85ff18084865f5137f999c6caedf7b0 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Tue, 26 May 2026 13:53:03 -0700 Subject: [PATCH 203/269] tang01: reinstall with rhel10 Signed-off-by: Kevin Fenzi --- inventory/host_vars/tang01.rdu3.fedoraproject.org | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/inventory/host_vars/tang01.rdu3.fedoraproject.org b/inventory/host_vars/tang01.rdu3.fedoraproject.org index 72013fc401..48ca82f356 100644 --- a/inventory/host_vars/tang01.rdu3.fedoraproject.org +++ b/inventory/host_vars/tang01.rdu3.fedoraproject.org @@ -6,8 +6,8 @@ dns_search1: "rdu3.fedoraproject.org" dns_search2: "fedoraproject.org" eth0_ipv4_gw: 10.16.163.254 eth0_ipv4_ip: 10.16.163.37 -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 # Define resources for this group of hosts here. lvm_size: 20000 mem_size: 4096 From 31c695a70f64fdbfc06d9c2566e2f57c6226d058 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Tue, 26 May 2026 13:58:04 -0700 Subject: [PATCH 204/269] tang01: increase disk size a bit Signed-off-by: Kevin Fenzi --- inventory/host_vars/tang01.rdu3.fedoraproject.org | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/inventory/host_vars/tang01.rdu3.fedoraproject.org b/inventory/host_vars/tang01.rdu3.fedoraproject.org index 48ca82f356..2ce099c0a9 100644 --- a/inventory/host_vars/tang01.rdu3.fedoraproject.org +++ b/inventory/host_vars/tang01.rdu3.fedoraproject.org @@ -9,7 +9,7 @@ eth0_ipv4_ip: 10.16.163.37 ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 # Define resources for this group of hosts here. -lvm_size: 20000 +lvm_size: 25000 mem_size: 4096 num_cpus: 2 vmhost: vmhost-x86-01.rdu3.fedoraproject.org From 3ac21c8018284631da4d055255e350e020b430ce Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Tue, 26 May 2026 16:00:47 -0700 Subject: [PATCH 205/269] tang02: move to rhel10 Signed-off-by: Kevin Fenzi --- inventory/host_vars/tang02.rdu3.fedoraproject.org | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/inventory/host_vars/tang02.rdu3.fedoraproject.org b/inventory/host_vars/tang02.rdu3.fedoraproject.org index 4e5253cdda..6ba0dfee23 100644 --- a/inventory/host_vars/tang02.rdu3.fedoraproject.org +++ b/inventory/host_vars/tang02.rdu3.fedoraproject.org @@ -6,10 +6,10 @@ dns_search1: "rdu3.fedoraproject.org" dns_search2: "fedoraproject.org" eth0_ipv4_gw: 10.16.163.254 eth0_ipv4_ip: 10.16.163.38 -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 # Define resources for this group of hosts here. -lvm_size: 20000 +lvm_size: 25000 mem_size: 4096 num_cpus: 2 vmhost: vmhost-x86-05.rdu3.fedoraproject.org From f8fbb98edab1ad051bcecf4d046b4f40a9150103 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Tue, 26 May 2026 16:38:28 -0700 Subject: [PATCH 206/269] memcached01.stg: add a new rhel10 staging memcached Once this is up and working, we can switch applications over to using it, and retire the rhel9 one. Signed-off-by: Kevin Fenzi --- .../host_vars/memcached01.stg.rdu3.fedoraproject.org | 8 ++++++++ inventory/inventory | 2 ++ 2 files changed, 10 insertions(+) create mode 100644 inventory/host_vars/memcached01.stg.rdu3.fedoraproject.org diff --git a/inventory/host_vars/memcached01.stg.rdu3.fedoraproject.org b/inventory/host_vars/memcached01.stg.rdu3.fedoraproject.org new file mode 100644 index 0000000000..447ddd2bc1 --- /dev/null +++ b/inventory/host_vars/memcached01.stg.rdu3.fedoraproject.org @@ -0,0 +1,8 @@ +--- +datacenter: rdu3 +eth0_ipv4_gw: 10.16.166.254 +eth0_ipv4_ip: 10.16.166.41 +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 +vmhost: vmhost-x86-05.stg.rdu3.fedoraproject.org +volgroup: /dev/vg_guests diff --git a/inventory/inventory b/inventory/inventory index 910ab11d36..2a787d2e64 100644 --- a/inventory/inventory +++ b/inventory/inventory @@ -349,9 +349,11 @@ memcached02.rdu3.fedoraproject.org memcached02.rdu3.fedoraproject.org [memcached_stg] +memcached01.stg.rdu3.fedoraproject.org memcached02.stg.rdu3.fedoraproject.org [memcached_stg_rdu3] +memcached01.stg.rdu3.fedoraproject.org memcached02.stg.rdu3.fedoraproject.org [mirrorlist_proxies] From 7e226ba150db332663cd2a3562f2d37f9e27536d Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Tue, 26 May 2026 16:48:00 -0700 Subject: [PATCH 207/269] memcached_stg: increase disk size Signed-off-by: Kevin Fenzi --- inventory/group_vars/memcached_stg | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/inventory/group_vars/memcached_stg b/inventory/group_vars/memcached_stg index d23f6b5516..41d19cd247 100644 --- a/inventory/group_vars/memcached_stg +++ b/inventory/group_vars/memcached_stg @@ -9,7 +9,7 @@ ipa_client_sudo_groups: - sysadmin-web ipa_host_group: memcached ipa_host_group_desc: Distributed Memory Caching service -lvm_size: 20000 +lvm_size: 25000 mem_size: 4096 num_cpus: 1 # for systems that do not match the above - specify the same parameter in From 7268404db730a77467c76eedb011212af14a7f74 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Tue, 26 May 2026 17:06:58 -0700 Subject: [PATCH 208/269] memcached01.stg: add properly to stg group Signed-off-by: Kevin Fenzi --- inventory/inventory | 1 + 1 file changed, 1 insertion(+) diff --git a/inventory/inventory b/inventory/inventory index 2a787d2e64..615081ec21 100644 --- a/inventory/inventory +++ b/inventory/inventory @@ -644,6 +644,7 @@ ipatuura01.stg.rdu3.fedoraproject.org ipsilon01.stg.rdu3.fedoraproject.org koji01.stg.rdu3.fedoraproject.org mailman01.stg.rdu3.fedoraproject.org +memcached01.stg.rdu3.fedoraproject.org memcached02.stg.rdu3.fedoraproject.org os-control01.stg.rdu3.fedoraproject.org pkgs01.stg.rdu3.fedoraproject.org From ccb89c99a49cf57b7b526b1da6931c5a0096e78d Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Tue, 26 May 2026 17:26:22 -0700 Subject: [PATCH 209/269] memcached01: add a new prod memcached01 Once this is all setup we can switch to it and retire the rhel9 02. Signed-off-by: Kevin Fenzi --- inventory/group_vars/memcached | 2 +- inventory/host_vars/memcached01.rdu3.fedoraproject.org | 8 ++++++++ inventory/inventory | 2 ++ 3 files changed, 11 insertions(+), 1 deletion(-) create mode 100644 inventory/host_vars/memcached01.rdu3.fedoraproject.org diff --git a/inventory/group_vars/memcached b/inventory/group_vars/memcached index 36de6ce023..d53ea3eaef 100644 --- a/inventory/group_vars/memcached +++ b/inventory/group_vars/memcached @@ -9,7 +9,7 @@ ipa_client_sudo_groups: - sysadmin-web ipa_host_group: memcached ipa_host_group_desc: Distributed Memory Caching service -lvm_size: 20000 +lvm_size: 25000 mem_size: 8192 num_cpus: 2 primary_auth_source: ipa diff --git a/inventory/host_vars/memcached01.rdu3.fedoraproject.org b/inventory/host_vars/memcached01.rdu3.fedoraproject.org new file mode 100644 index 0000000000..a3e4cf7260 --- /dev/null +++ b/inventory/host_vars/memcached01.rdu3.fedoraproject.org @@ -0,0 +1,8 @@ +--- +datacenter: rdu3 +eth0_ipv4_gw: 10.16.163.254 +eth0_ipv4_ip: 10.16.163.130 +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 +vmhost: vmhost-x86-03.rdu3.fedoraproject.org +volgroup: /dev/vg_guests diff --git a/inventory/inventory b/inventory/inventory index 615081ec21..8f364d72f3 100644 --- a/inventory/inventory +++ b/inventory/inventory @@ -343,9 +343,11 @@ noc01.rdu3.fedoraproject.org noc01.rdu3.fedoraproject.org [memcached] +memcached01.rdu3.fedoraproject.org memcached02.rdu3.fedoraproject.org [memcached_rdu3] +memcached01.rdu3.fedoraproject.org memcached02.rdu3.fedoraproject.org [memcached_stg] From 70cfd1412eb0c3c2cee8a333627396c8320eeba4 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Tue, 26 May 2026 17:38:05 -0700 Subject: [PATCH 210/269] memcached01: use correct ip Signed-off-by: Kevin Fenzi --- inventory/host_vars/memcached01.rdu3.fedoraproject.org | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/inventory/host_vars/memcached01.rdu3.fedoraproject.org b/inventory/host_vars/memcached01.rdu3.fedoraproject.org index a3e4cf7260..cef266f37a 100644 --- a/inventory/host_vars/memcached01.rdu3.fedoraproject.org +++ b/inventory/host_vars/memcached01.rdu3.fedoraproject.org @@ -1,7 +1,7 @@ --- datacenter: rdu3 eth0_ipv4_gw: 10.16.163.254 -eth0_ipv4_ip: 10.16.163.130 +eth0_ipv4_ip: 10.16.163.59 ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 vmhost: vmhost-x86-03.rdu3.fedoraproject.org From 814582dc4dfd406c53eac0f3ea2717492c2414c1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Aur=C3=A9lien=20Bompard?= Date: Wed, 27 May 2026 10:41:07 +0200 Subject: [PATCH 211/269] Rebase webhook2fedmsg to python 3.13 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Aurélien Bompard --- .../webhook2fedmsg/files/imagestream.yml | 36 ++++++++++++++----- .../templates/buildconfig.yml.j2 | 3 +- 2 files changed, 29 insertions(+), 10 deletions(-) diff --git a/roles/openshift-apps/webhook2fedmsg/files/imagestream.yml b/roles/openshift-apps/webhook2fedmsg/files/imagestream.yml index f755f14b32..040f2a07c2 100644 --- a/roles/openshift-apps/webhook2fedmsg/files/imagestream.yml +++ b/roles/openshift-apps/webhook2fedmsg/files/imagestream.yml @@ -1,10 +1,30 @@ --- apiVersion: image.openshift.io/v1 -kind: ImageStream -metadata: - name: webhook2fedmsg -spec: - lookupPolicy: - local: false -status: - dockerImageRepository: "" +kind: List +items: + - apiVersion: image.openshift.io/v1 + kind: ImageStream + metadata: + name: webhook2fedmsg + spec: + lookupPolicy: + local: false + status: + dockerImageRepository: "" + # The Python 3.13 builder image + - apiVersion: image.openshift.io/v1 + kind: ImageStream + metadata: + name: python-313 + spec: + lookupPolicy: + local: false + tags: + - name: latest + from: + kind: DockerImage + name: quay.io/fedora/python-313:latest + importPolicy: + scheduled: true + referencePolicy: + type: Source diff --git a/roles/openshift-apps/webhook2fedmsg/templates/buildconfig.yml.j2 b/roles/openshift-apps/webhook2fedmsg/templates/buildconfig.yml.j2 index 366420288c..6753351a4a 100644 --- a/roles/openshift-apps/webhook2fedmsg/templates/buildconfig.yml.j2 +++ b/roles/openshift-apps/webhook2fedmsg/templates/buildconfig.yml.j2 @@ -21,8 +21,7 @@ spec: sourceStrategy: from: kind: ImageStreamTag - namespace: openshift - name: python:3.11-ubi9 + name: python-313:latest env: # The .s2i/bin/assemble script uses this to build the frontend with the # correct API and Ipsilon addresses. From f2c2aa037bea8648806db1b69cf5bcf5972cbf0c Mon Sep 17 00:00:00 2001 From: Ryan Lerch Date: Wed, 27 May 2026 19:44:39 +1000 Subject: [PATCH 212/269] forge: add group team mapping for atomic Signed-off-by: Ryan Lerch --- roles/openshift-apps/forgejo/templates/values.yaml.j2 | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/roles/openshift-apps/forgejo/templates/values.yaml.j2 b/roles/openshift-apps/forgejo/templates/values.yaml.j2 index 46c40fd1fa..af3e59e13d 100644 --- a/roles/openshift-apps/forgejo/templates/values.yaml.j2 +++ b/roles/openshift-apps/forgejo/templates/values.yaml.j2 @@ -578,7 +578,8 @@ gitea: "forge-fdwg-owners":{"fdwg":["Owners"]}, "forge-fdwg-members":{"fdwg":["Members"]}, "forge-pungi-owners":{"pungi":["Owners"]}, - "forge-action-owners":{"action":["Owners"]} + "forge-action-owners":{"action":["Owners"]}, + "forge-atomic-owners":{"atomic":["Owners"]} }' {% endif %} # - name: 'OAuth 1' From 068605d67dd90a5357744c891cb61bd531e84e0f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Aur=C3=A9lien=20Bompard?= Date: Wed, 27 May 2026 11:52:51 +0200 Subject: [PATCH 213/269] Fixup 814582dc: actually use the imagestream.yml file MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Aurélien Bompard --- playbooks/openshift-apps/webhook2fedmsg.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/playbooks/openshift-apps/webhook2fedmsg.yml b/playbooks/openshift-apps/webhook2fedmsg.yml index ce70ec5e6a..9c489085a6 100644 --- a/playbooks/openshift-apps/webhook2fedmsg.yml +++ b/playbooks/openshift-apps/webhook2fedmsg.yml @@ -65,9 +65,10 @@ secret_file_key: webhook2fedmsg-key.pem secret_file_privatefile: "rabbitmq/{{env}}/pki/private/webhook2fedmsg{{env_suffix}}.key" - - role: openshift/imagestream - imagestream_app: webhook2fedmsg - imagestream_imagename: webhook2fedmsg + - role: openshift/object + object_app: webhook2fedmsg + object_file: imagestream.yml + object_objectname: imagestream.yml - role: openshift/object object_app: webhook2fedmsg From 1ffd0cd8a5fd84dd2025da4fea073133aa5686ad Mon Sep 17 00:00:00 2001 From: David Kirwan Date: Wed, 27 May 2026 11:47:55 +0100 Subject: [PATCH 214/269] forgejo: Redesign runnerconfig Signed-off-by: David Kirwan --- roles/openshift-apps/forgejo/README.md | 95 +++++++++++++++++++ .../openshift-apps/forgejo/runners/README.md | 38 ++++++++ .../forgejo/runners/production/ai-ml-1.yml | 6 ++ .../forgejo/runners/production/apps-1.yml | 6 ++ .../runners/production/atomic-desktops-1.yml | 7 ++ .../forgejo/runners/production/ci-1.yml | 7 ++ .../forgejo/runners/production/commops-1.yml | 6 ++ .../forgejo/runners/production/council-1.yml | 6 ++ .../forgejo/runners/production/dei-1.yml | 6 ++ .../forgejo/runners/production/design-1.yml | 6 ++ .../forgejo/runners/production/docs-1.yml | 6 ++ .../forgejo/runners/production/forge-1.yml | 6 ++ .../forgejo/runners/production/infra-1.yml | 6 ++ .../runners/production/marketing-1.yml | 6 ++ .../production/mentored-projects-1.yml | 6 ++ .../runners/production/mindshare-1.yml | 6 ++ .../runners/production/operations-1.yml | 6 ++ .../forgejo/runners/production/podcast-1.yml | 6 ++ .../forgejo/runners/production/quality-1.yml | 6 ++ .../forgejo/runners/production/releng-1.yml | 6 ++ .../forgejo/runners/production/releng-2.yml | 6 ++ .../forgejo/runners/production/security-1.yml | 6 ++ .../forgejo/runners/staging/cle-1.yml | 6 ++ .../forgejo/runners/staging/docs-1.yml | 6 ++ .../forgejo/runners/staging/fedora-1.yml | 6 ++ .../forgejo/runners/staging/fedora-2.yml | 6 ++ .../forgejo/runners/staging/fedora-3.yml | 6 ++ .../forgejo/runners/staging/fedora-4.yml | 6 ++ .../forgejo/runners/staging/fedora-5.yml | 6 ++ .../forgejo/runners/staging/fedora-6.yml | 6 ++ .../forgejo/runners/staging/test.yml | 8 ++ .../forgejo/tasks/load-forgejo-runners.yaml | 40 ++++++++ roles/openshift-apps/forgejo/tasks/main.yaml | 1 + .../forgejo/tasks/register-runners.yaml | 2 +- .../forgejo/templates/forgejo-runners.yaml.j2 | 15 +-- 35 files changed, 357 insertions(+), 12 deletions(-) create mode 100644 roles/openshift-apps/forgejo/README.md create mode 100644 roles/openshift-apps/forgejo/runners/README.md create mode 100644 roles/openshift-apps/forgejo/runners/production/ai-ml-1.yml create mode 100644 roles/openshift-apps/forgejo/runners/production/apps-1.yml create mode 100644 roles/openshift-apps/forgejo/runners/production/atomic-desktops-1.yml create mode 100644 roles/openshift-apps/forgejo/runners/production/ci-1.yml create mode 100644 roles/openshift-apps/forgejo/runners/production/commops-1.yml create mode 100644 roles/openshift-apps/forgejo/runners/production/council-1.yml create mode 100644 roles/openshift-apps/forgejo/runners/production/dei-1.yml create mode 100644 roles/openshift-apps/forgejo/runners/production/design-1.yml create mode 100644 roles/openshift-apps/forgejo/runners/production/docs-1.yml create mode 100644 roles/openshift-apps/forgejo/runners/production/forge-1.yml create mode 100644 roles/openshift-apps/forgejo/runners/production/infra-1.yml create mode 100644 roles/openshift-apps/forgejo/runners/production/marketing-1.yml create mode 100644 roles/openshift-apps/forgejo/runners/production/mentored-projects-1.yml create mode 100644 roles/openshift-apps/forgejo/runners/production/mindshare-1.yml create mode 100644 roles/openshift-apps/forgejo/runners/production/operations-1.yml create mode 100644 roles/openshift-apps/forgejo/runners/production/podcast-1.yml create mode 100644 roles/openshift-apps/forgejo/runners/production/quality-1.yml create mode 100644 roles/openshift-apps/forgejo/runners/production/releng-1.yml create mode 100644 roles/openshift-apps/forgejo/runners/production/releng-2.yml create mode 100644 roles/openshift-apps/forgejo/runners/production/security-1.yml create mode 100644 roles/openshift-apps/forgejo/runners/staging/cle-1.yml create mode 100644 roles/openshift-apps/forgejo/runners/staging/docs-1.yml create mode 100644 roles/openshift-apps/forgejo/runners/staging/fedora-1.yml create mode 100644 roles/openshift-apps/forgejo/runners/staging/fedora-2.yml create mode 100644 roles/openshift-apps/forgejo/runners/staging/fedora-3.yml create mode 100644 roles/openshift-apps/forgejo/runners/staging/fedora-4.yml create mode 100644 roles/openshift-apps/forgejo/runners/staging/fedora-5.yml create mode 100644 roles/openshift-apps/forgejo/runners/staging/fedora-6.yml create mode 100644 roles/openshift-apps/forgejo/runners/staging/test.yml create mode 100644 roles/openshift-apps/forgejo/tasks/load-forgejo-runners.yaml diff --git a/roles/openshift-apps/forgejo/README.md b/roles/openshift-apps/forgejo/README.md new file mode 100644 index 0000000000..008818832c --- /dev/null +++ b/roles/openshift-apps/forgejo/README.md @@ -0,0 +1,95 @@ +# Forgejo OpenShift App Role + +Deploys Fedora Forgejo (git forge) on OpenShift: namespace, storage, PostgreSQL, Valkey, Helm release, CI runners, and control-host backups. + +**Playbook:** [`playbooks/openshift-apps/forgejo.yml`](../../../playbooks/openshift-apps/forgejo.yml) + +## Entry point and execution model + +- **Hosts:** `os_control_stg:os_control` (OpenShift control nodes), `gather_facts: false` +- **Where work runs:** On the control host under `/root/ocp4/openshift-apps/forgejo/` — templates are rendered there, then applied with `kubernetes.core.k8s`, `oc apply`, or `kubernetes.core.helm` +- **Pattern:** Hybrid OpenShift app — raw manifests plus the upstream [forgejo-helm](https://codeberg.org/fedora/forgejo-helm) chart (not the composable `openshift/*` roles) +- **Secrets/config:** Production vs staging uses `env` (`production` / `staging`) and ternaries in `templates/values.yaml.j2`. Sensitive vars (passwords, OIDC keys, runner secrets) come from private vars (`/srv/private/ansible/vars.yml`), not this repo + +## Task flow (`tasks/main.yaml`) + +### 1. Control-host backup infrastructure + +Before cluster resources: + +- Creates `/root/ocp4/openshift-apps/forgejo/backups/{script,dump,log}/` +- Copies backup scripts from `files/` +- Cron on the control host: + - **02:00** — `run_forgejo_backup.sh` (rsync scripts into Forgejo pod, DB dump, pull dump back) + - **03:00** — `run_forgejo_pruning.sh` (prune old dumps) + +Backup dumps are NFS-mounted on `os-control01` (see `inventory/host_vars/os-control01.rdu3.fedoraproject.org`). + +### 2. Kubernetes foundation + +| Step | Task file | Deploys | +|------|-----------|---------| +| Namespace | `create-forgejo-namespace.yaml` | `forgejo` namespace | +| Storage | `create-forgejo-pvc.yaml` | PV + PVC `gitea-shared-storage` (NetApp NFS `forgejo-volume`, RWX 100Gi) | +| Database | `create-postgres-operator-config.yaml` | Crunchy `PostgresCluster` `forgejo-ha` (PG 17, 2 replicas, pgBackRest); 30s wait | +| Cache | `deploy-valkey.yaml` | 6-replica Valkey StatefulSet + Service + ConfigMap + Secret (`valkey` tag, `oc apply`) | +| App | `call-helm.yaml` | Forgejo Helm release | + +Custom theme ConfigMap task is **commented out** in `main.yaml` (`create-custom-theme-configmap.yaml`). Theme CSS is in `files/themes/` and referenced in Helm values (`fedora-auto`, etc.). + +### 3. Forgejo application (Helm) + +`call-helm.yaml`: + +1. Renders `templates/values.yaml.j2` → `helm-values.yaml` +2. Clones https://codeberg.org/fedora/forgejo-helm.git to `/tmp/forgejo-helm_repo` +3. Runs `helm dependency update` +4. Deploys release `forgejo` in namespace `forgejo` via `kubernetes.core.helm` + +Notable Helm settings: + +- **Image:** Quay (`forgejo_prod_quay_image` / `forgejo_stg_quay_image`), rootless +- **Route:** OpenShift Route (not Ingress); `forgejo_hostname` / `forgejo_stg_hostname` +- **Persistence:** Pre-created PVC `gitea-shared-storage` (`persistence.create: false`) +- **DB:** External Crunchy Postgres, not chart PostgreSQL +- **Cache:** External Valkey via `redis+cluster://` in `gitea.config.cache` (chart `redis-cluster` subchart enabled; live cache is the separate Valkey StatefulSet) +- **Auth:** OpenID Connect to Fedora Accounts with `group-team-map` for org/team RBAC +- **Admin:** Private vars; `passwordMode: keepUpdated` + +### 4. CI runners (Forgejo Actions) + +| Step | Task file | Purpose | +|------|-----------|---------| +| Load runners | `load-forgejo-runners.yaml` | Merges `runners//*.yml` with private registration secrets | +| Runner vars | `copy-forgejo-runner-vars.yaml` | Renders runner vars from `forgejo-runners.yaml.j2` | +| Runner secret | `create-forgejo-runner-config-secret.yaml` | K8s Secret for runner VM | +| VM RBAC | `create-forgejo-runnerhost-sa-rbac.yaml` | ServiceAccount, Role, RoleBinding, token Secret | +| Runner VM | `create-forgejo-runnerhost-vm.yaml` | KubeVirt VM + headless Service | +| Registration | `register-runners.yaml` | `forgejo-cli actions register` in Forgejo pod | + +Runner host: + +- KubeVirt VM `forgejo-runnerhost-vm` (Fedora `u1.xlarge`, 30Gi) +- Packages in `defaults/main.yml` (`ansible`, `podman`, `python3-kubernetes`, etc.) +- SA token via serial disk `SATOKEN000001` +- Cloud-init runs **ansible-pull** from [ansible-role-forgejo-runner](https://codeberg.org/fedora/ansible-role-forgejo-runner) (in-repo clone is commented out) +- `load-forgejo-runners.yaml` merges `runners//*.yml` with secret dicts from private vars, then `register-runners.yaml` registers them (idempotent; tolerates duplicate key) + +## Variables + +- `defaults/main.yml` — namespace, headless service name, runnerhost packages +- `vars/main.yml` — `openshift_user_id` for PV ownership + +Most operational variables live in private/group vars (hostnames, DB, OIDC, runner secrets, Valkey password, etc.). + +## Related code + +- **`roles/openshift-apps/dist-git`** — reuses `/root/ocp4/openshift-apps/forgejo/` for theme ConfigMaps +- **`.forgejo/workflows/`** — CI for this ansible repo runs on this Forgejo instance + +## Design notes + +1. Mixed deploy paths: `kubernetes.core.k8s`, `oc apply` (Valkey), and Helm +2. Runner registration is in Ansible; runner daemons are configured via ansible-pull on the VM +3. Backups are control-host cron jobs using `oc rsync` / `oc exec`, not in-cluster CronJobs +4. Same playbook runs prod and staging; `env` selects all branching diff --git a/roles/openshift-apps/forgejo/runners/README.md b/roles/openshift-apps/forgejo/runners/README.md new file mode 100644 index 0000000000..f3e7e976f2 --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/README.md @@ -0,0 +1,38 @@ +# Forgejo runner definitions + +Each runner has one YAML file under `production/` or `staging/`. These files are public (this repo) and contain everything **except** the registration secret. + +## File format + +```yaml +--- +name: releng-1 +scope: releng +labels: + - releng-1 +image: code.forgejo.org/forgejo/runner:11 +``` + +- **name** — Unique runner name (must match the filename stem). +- **scope** — Forgejo org scope for `forgejo-cli actions register --scope` (omit or use `global` for instance-wide runners). +- **labels** — Workflow `runs-on` labels. Quote values that contain colons. +- **image** — Runner container image on the runner host. +- **capacity** — Optional concurrent job limit (passed through to runner host config). + +## Secrets (private ansible repo) + +Registration secrets stay in `/srv/private/ansible/vars.yml` as a dict keyed by runner name: + +```yaml +forgejo_runner_secrets: + releng-1: "01c729e8f65dea42ddaf335dbfcf3841c71e58c8" + infra-1: "c4ebefbdc76b023bd7c7ef06a483fae045bb2f3d" + # ... + +forgejo_stg_runner_secrets: + # staging runners, same shape +``` + +Generate a new secret with: `openssl rand -hex 20` + +`tasks/load-forgejo-runners.yaml` merges each definition file with its secret before templating and CLI registration. diff --git a/roles/openshift-apps/forgejo/runners/production/ai-ml-1.yml b/roles/openshift-apps/forgejo/runners/production/ai-ml-1.yml new file mode 100644 index 0000000000..fdda2f2d4d --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/ai-ml-1.yml @@ -0,0 +1,6 @@ +--- +name: ai-ml-1 +scope: ai-ml +labels: + - podman +image: code.forgejo.org/forgejo/runner:12 diff --git a/roles/openshift-apps/forgejo/runners/production/apps-1.yml b/roles/openshift-apps/forgejo/runners/production/apps-1.yml new file mode 100644 index 0000000000..0588e4dc38 --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/apps-1.yml @@ -0,0 +1,6 @@ +--- +name: apps-1 +scope: apps +labels: + - podman +image: code.forgejo.org/forgejo/runner:11 diff --git a/roles/openshift-apps/forgejo/runners/production/atomic-desktops-1.yml b/roles/openshift-apps/forgejo/runners/production/atomic-desktops-1.yml new file mode 100644 index 0000000000..951400d19d --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/atomic-desktops-1.yml @@ -0,0 +1,7 @@ +--- +name: atomic-desktops-1 +scope: atomic-desktops +labels: + - "docker:docker://node:22-bookworm" + - "docker-slim:docker://node:22-alpine" +image: code.forgejo.org/forgejo/runner:11 diff --git a/roles/openshift-apps/forgejo/runners/production/ci-1.yml b/roles/openshift-apps/forgejo/runners/production/ci-1.yml new file mode 100644 index 0000000000..327be38fa3 --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/ci-1.yml @@ -0,0 +1,7 @@ +--- +name: ci-1 +scope: ci +labels: + - "docker:docker://node:22-bookworm" + - "docker-slim:docker://node:22-alpine" +image: code.forgejo.org/forgejo/runner:11 diff --git a/roles/openshift-apps/forgejo/runners/production/commops-1.yml b/roles/openshift-apps/forgejo/runners/production/commops-1.yml new file mode 100644 index 0000000000..db51e3cdcd --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/commops-1.yml @@ -0,0 +1,6 @@ +--- +name: commops-1 +scope: commops +labels: + - podman +image: code.forgejo.org/forgejo/runner:11 diff --git a/roles/openshift-apps/forgejo/runners/production/council-1.yml b/roles/openshift-apps/forgejo/runners/production/council-1.yml new file mode 100644 index 0000000000..917d349389 --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/council-1.yml @@ -0,0 +1,6 @@ +--- +name: council-1 +scope: council +labels: + - podman +image: code.forgejo.org/forgejo/runner:12 diff --git a/roles/openshift-apps/forgejo/runners/production/dei-1.yml b/roles/openshift-apps/forgejo/runners/production/dei-1.yml new file mode 100644 index 0000000000..bc98d65d47 --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/dei-1.yml @@ -0,0 +1,6 @@ +--- +name: dei-1 +scope: dei +labels: + - podman +image: code.forgejo.org/forgejo/runner:12 diff --git a/roles/openshift-apps/forgejo/runners/production/design-1.yml b/roles/openshift-apps/forgejo/runners/production/design-1.yml new file mode 100644 index 0000000000..1260852c3b --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/design-1.yml @@ -0,0 +1,6 @@ +--- +name: design-1 +scope: design +labels: + - podman +image: code.forgejo.org/forgejo/runner:12 diff --git a/roles/openshift-apps/forgejo/runners/production/docs-1.yml b/roles/openshift-apps/forgejo/runners/production/docs-1.yml new file mode 100644 index 0000000000..965c7733bd --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/docs-1.yml @@ -0,0 +1,6 @@ +--- +name: docs-1 +scope: docs +labels: + - podman +image: code.forgejo.org/forgejo/runner:12 diff --git a/roles/openshift-apps/forgejo/runners/production/forge-1.yml b/roles/openshift-apps/forgejo/runners/production/forge-1.yml new file mode 100644 index 0000000000..fe915e239f --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/forge-1.yml @@ -0,0 +1,6 @@ +--- +name: forge-1 +scope: forge +labels: + - podman +image: code.forgejo.org/forgejo/runner:11 diff --git a/roles/openshift-apps/forgejo/runners/production/infra-1.yml b/roles/openshift-apps/forgejo/runners/production/infra-1.yml new file mode 100644 index 0000000000..20aff67cba --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/infra-1.yml @@ -0,0 +1,6 @@ +--- +name: infra-1 +scope: infra +labels: + - infra-1 +image: code.forgejo.org/forgejo/runner:11 diff --git a/roles/openshift-apps/forgejo/runners/production/marketing-1.yml b/roles/openshift-apps/forgejo/runners/production/marketing-1.yml new file mode 100644 index 0000000000..4a441f4e10 --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/marketing-1.yml @@ -0,0 +1,6 @@ +--- +name: marketing-1 +scope: marketing +labels: + - podman +image: code.forgejo.org/forgejo/runner:12 diff --git a/roles/openshift-apps/forgejo/runners/production/mentored-projects-1.yml b/roles/openshift-apps/forgejo/runners/production/mentored-projects-1.yml new file mode 100644 index 0000000000..80f4be9974 --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/mentored-projects-1.yml @@ -0,0 +1,6 @@ +--- +name: mentored-projects-1 +scope: mentored-projects +labels: + - podman +image: code.forgejo.org/forgejo/runner:12 diff --git a/roles/openshift-apps/forgejo/runners/production/mindshare-1.yml b/roles/openshift-apps/forgejo/runners/production/mindshare-1.yml new file mode 100644 index 0000000000..9d8acdb1e6 --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/mindshare-1.yml @@ -0,0 +1,6 @@ +--- +name: mindshare-1 +scope: mindshare +labels: + - podman +image: code.forgejo.org/forgejo/runner:11 diff --git a/roles/openshift-apps/forgejo/runners/production/operations-1.yml b/roles/openshift-apps/forgejo/runners/production/operations-1.yml new file mode 100644 index 0000000000..b7d8116b38 --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/operations-1.yml @@ -0,0 +1,6 @@ +--- +name: operations-1 +scope: operations +labels: + - podman +image: code.forgejo.org/forgejo/runner:12 diff --git a/roles/openshift-apps/forgejo/runners/production/podcast-1.yml b/roles/openshift-apps/forgejo/runners/production/podcast-1.yml new file mode 100644 index 0000000000..90d533718d --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/podcast-1.yml @@ -0,0 +1,6 @@ +--- +name: podcast-1 +scope: podcast +labels: + - podman +image: code.forgejo.org/forgejo/runner:12 diff --git a/roles/openshift-apps/forgejo/runners/production/quality-1.yml b/roles/openshift-apps/forgejo/runners/production/quality-1.yml new file mode 100644 index 0000000000..3467d2a6ec --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/quality-1.yml @@ -0,0 +1,6 @@ +--- +name: quality-1 +scope: quality +labels: + - fedora +image: code.forgejo.org/forgejo/runner:11 diff --git a/roles/openshift-apps/forgejo/runners/production/releng-1.yml b/roles/openshift-apps/forgejo/runners/production/releng-1.yml new file mode 100644 index 0000000000..515a5e4b5e --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/releng-1.yml @@ -0,0 +1,6 @@ +--- +name: releng-1 +scope: releng +labels: + - releng-1 +image: code.forgejo.org/forgejo/runner:11 diff --git a/roles/openshift-apps/forgejo/runners/production/releng-2.yml b/roles/openshift-apps/forgejo/runners/production/releng-2.yml new file mode 100644 index 0000000000..3519c4e7eb --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/releng-2.yml @@ -0,0 +1,6 @@ +--- +name: releng-2 +scope: releng +labels: + - docker +image: code.forgejo.org/forgejo/runner:11 diff --git a/roles/openshift-apps/forgejo/runners/production/security-1.yml b/roles/openshift-apps/forgejo/runners/production/security-1.yml new file mode 100644 index 0000000000..eb2a573578 --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/security-1.yml @@ -0,0 +1,6 @@ +--- +name: security-1 +scope: security +labels: + - podman +image: code.forgejo.org/forgejo/runner:12 diff --git a/roles/openshift-apps/forgejo/runners/staging/cle-1.yml b/roles/openshift-apps/forgejo/runners/staging/cle-1.yml new file mode 100644 index 0000000000..4f52b97e40 --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/staging/cle-1.yml @@ -0,0 +1,6 @@ +--- +name: cle-1 +scope: cle +labels: + - cle-1 +image: code.forgejo.org/forgejo/runner:11 diff --git a/roles/openshift-apps/forgejo/runners/staging/docs-1.yml b/roles/openshift-apps/forgejo/runners/staging/docs-1.yml new file mode 100644 index 0000000000..83ee715436 --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/staging/docs-1.yml @@ -0,0 +1,6 @@ +--- +name: docs-1 +scope: docs +labels: + - docs-1 +image: code.forgejo.org/forgejo/runner:11 diff --git a/roles/openshift-apps/forgejo/runners/staging/fedora-1.yml b/roles/openshift-apps/forgejo/runners/staging/fedora-1.yml new file mode 100644 index 0000000000..5fbb4fcab4 --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/staging/fedora-1.yml @@ -0,0 +1,6 @@ +--- +name: fedora-1 +scope: global +labels: + - fedora-1 +image: code.forgejo.org/forgejo/runner:11 diff --git a/roles/openshift-apps/forgejo/runners/staging/fedora-2.yml b/roles/openshift-apps/forgejo/runners/staging/fedora-2.yml new file mode 100644 index 0000000000..da6b891b04 --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/staging/fedora-2.yml @@ -0,0 +1,6 @@ +--- +name: fedora-2 +scope: global +labels: + - fedora-2 +image: code.forgejo.org/forgejo/runner:11 diff --git a/roles/openshift-apps/forgejo/runners/staging/fedora-3.yml b/roles/openshift-apps/forgejo/runners/staging/fedora-3.yml new file mode 100644 index 0000000000..58a5123e43 --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/staging/fedora-3.yml @@ -0,0 +1,6 @@ +--- +name: fedora-3 +scope: global +labels: + - fedora-3 +image: code.forgejo.org/forgejo/runner:11 diff --git a/roles/openshift-apps/forgejo/runners/staging/fedora-4.yml b/roles/openshift-apps/forgejo/runners/staging/fedora-4.yml new file mode 100644 index 0000000000..93ffcb104d --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/staging/fedora-4.yml @@ -0,0 +1,6 @@ +--- +name: fedora-4 +scope: global +labels: + - fedora-4 +image: code.forgejo.org/forgejo/runner:11 diff --git a/roles/openshift-apps/forgejo/runners/staging/fedora-5.yml b/roles/openshift-apps/forgejo/runners/staging/fedora-5.yml new file mode 100644 index 0000000000..2e213c41cc --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/staging/fedora-5.yml @@ -0,0 +1,6 @@ +--- +name: fedora-5 +scope: global +labels: + - fedora-5 +image: code.forgejo.org/forgejo/runner:11 diff --git a/roles/openshift-apps/forgejo/runners/staging/fedora-6.yml b/roles/openshift-apps/forgejo/runners/staging/fedora-6.yml new file mode 100644 index 0000000000..63efb98cde --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/staging/fedora-6.yml @@ -0,0 +1,6 @@ +--- +name: fedora-6 +scope: global +labels: + - fedora-6 +image: code.forgejo.org/forgejo/runner:11 diff --git a/roles/openshift-apps/forgejo/runners/staging/test.yml b/roles/openshift-apps/forgejo/runners/staging/test.yml new file mode 100644 index 0000000000..44d9e8c9dd --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/staging/test.yml @@ -0,0 +1,8 @@ +--- +name: test +scope: playground +labels: + - "docker:docker://node:22-bookworm" + - "docker-slim:docker://node:22-alpine" +image: code.forgejo.org/forgejo/runner:11 +capacity: 4 diff --git a/roles/openshift-apps/forgejo/tasks/load-forgejo-runners.yaml b/roles/openshift-apps/forgejo/tasks/load-forgejo-runners.yaml new file mode 100644 index 0000000000..1d82f8af47 --- /dev/null +++ b/roles/openshift-apps/forgejo/tasks/load-forgejo-runners.yaml @@ -0,0 +1,40 @@ +--- +# Build forgejo_runners from per-runner YAML files in runners// plus secrets in private vars. +# Private vars (forgejo_runner_secrets / forgejo_stg_runner_secrets) must be a dict keyed by runner name: +# forgejo_runner_secrets: +# releng-1: "0123...hex40" + +- name: Find forgejo runner definition files + ansible.builtin.find: + paths: "{{ role_path }}/runners/{{ env }}" + patterns: "*.yml" + register: _forgejo_runner_def_files + +- name: Build forgejo_runners from definitions and private secrets + ansible.builtin.set_fact: + forgejo_runners: "{{ forgejo_runners | default([]) + [_runner] }}" + loop: "{{ _forgejo_runner_def_files.files | sort(attribute='path') }}" + vars: + _def: "{{ lookup('ansible.builtin.file', item.path) | from_yaml }}" + _secrets: "{{ (env == 'production') | ternary(forgejo_runner_secrets, forgejo_stg_runner_secrets) }}" + _runner: "{{ _def | combine({'secret': _secrets[_def.name]}) }}" + when: _forgejo_runner_def_files.matched > 0 + +- name: Set empty forgejo_runners when no definition files exist + ansible.builtin.set_fact: + forgejo_runners: [] + when: _forgejo_runner_def_files.matched == 0 + +- name: Validate each runner has a secret in private vars + ansible.builtin.assert: + that: + - _secrets[item.name] is defined + - _secrets[item.name] | length > 0 + fail_msg: >- + Missing secret for runner '{{ item.name }}'. + Add it to {{ (env == 'production') | ternary('forgejo_runner_secrets', 'forgejo_stg_runner_secrets') }} + in the ansible private repo. + loop: "{{ forgejo_runners }}" + vars: + _secrets: "{{ (env == 'production') | ternary(forgejo_runner_secrets, forgejo_stg_runner_secrets) }}" + when: forgejo_runners | length > 0 diff --git a/roles/openshift-apps/forgejo/tasks/main.yaml b/roles/openshift-apps/forgejo/tasks/main.yaml index 47a16540ad..e6bb6da416 100644 --- a/roles/openshift-apps/forgejo/tasks/main.yaml +++ b/roles/openshift-apps/forgejo/tasks/main.yaml @@ -57,6 +57,7 @@ # - include_tasks: create-custom-theme-configmap.yaml - include_tasks: deploy-valkey.yaml - include_tasks: call-helm.yaml +- include_tasks: load-forgejo-runners.yaml - include_tasks: copy-forgejo-runner-vars.yaml - include_tasks: create-forgejo-runner-config-secret.yaml - include_tasks: create-forgejo-runnerhost-sa-rbac.yaml diff --git a/roles/openshift-apps/forgejo/tasks/register-runners.yaml b/roles/openshift-apps/forgejo/tasks/register-runners.yaml index d5ce4e1bd1..53b29c2680 100644 --- a/roles/openshift-apps/forgejo/tasks/register-runners.yaml +++ b/roles/openshift-apps/forgejo/tasks/register-runners.yaml @@ -15,7 +15,7 @@ namespace: forgejo pod: "{{ forgejo_pods.resources[0].metadata.name }}" command: "forgejo forgejo-cli actions register --name {{ item['name'] }} --labels {{ item['labels'] | join(',') }} --secret {{ item['secret'] }}{{ ' --scope ' + item['scope'] if item['scope'] is defined and item['scope'] != 'global' else '' }}" - loop: "{{ (env == 'production') | ternary(forgejo_runner_secrets, forgejo_stg_runner_secrets) }}" + loop: "{{ forgejo_runners }}" register: forgejo_cli_outputs failed_when: >- (forgejo_cli_outputs.rc is defined diff --git a/roles/openshift-apps/forgejo/templates/forgejo-runners.yaml.j2 b/roles/openshift-apps/forgejo/templates/forgejo-runners.yaml.j2 index cc8bf93dc0..9fd9e6daad 100644 --- a/roles/openshift-apps/forgejo/templates/forgejo-runners.yaml.j2 +++ b/roles/openshift-apps/forgejo/templates/forgejo-runners.yaml.j2 @@ -4,18 +4,11 @@ # Internal URL (accessible from VM): http://forgejo-http.forgejo.svc.cluster.local:3000 forgejo_instance_url: "{{ (env == 'production') | ternary(forgejo_runner_instance_url, forgejo_stg_runner_instance_url) }}" -# Forgejo runners to register and configure -# Note: Generate secrets with: openssl rand -hex 20 +# Forgejo runners to register and configure (built by load-forgejo-runners.yaml). +# Non-secret fields live in roles/openshift-apps/forgejo/runners//*.yml; +# registration secrets live in private vars (forgejo_runner_secrets / forgejo_stg_runner_secrets). # -# Runner configuration: -# - name: Unique runner name -# - labels: List of label names (the runner container will automatically add schema:arg based on its environment) -# These are the label names that workflows will use in "runs-on" -# - image: Container image to use for the runner -# The image determines what execution environment and tools are available -# - secret: 40-character hex string for idempotent registration -# -forgejo_runners: {{ (env == 'production') | ternary(forgejo_runner_secrets, forgejo_stg_runner_secrets) }} +forgejo_runners: {{ forgejo_runners }} # Configuration for the zabbix agent running on the runnerhost forgejo_runnerhost_zabbix_agent_identity: {{ zabbix_tls_psk_identity }} From 2b6ddca8f456cb4ec1ba3237276a82dd9b00045c Mon Sep 17 00:00:00 2001 From: David Kirwan Date: Wed, 27 May 2026 12:26:41 +0100 Subject: [PATCH 215/269] forgejo: update README for runner config Signed-off-by: David Kirwan --- roles/openshift-apps/forgejo/runners/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/forgejo/runners/README.md b/roles/openshift-apps/forgejo/runners/README.md index f3e7e976f2..0be5536dc8 100644 --- a/roles/openshift-apps/forgejo/runners/README.md +++ b/roles/openshift-apps/forgejo/runners/README.md @@ -21,7 +21,7 @@ image: code.forgejo.org/forgejo/runner:11 ## Secrets (private ansible repo) -Registration secrets stay in `/srv/private/ansible/vars.yml` as a dict keyed by runner name: +Registration secrets stay in `ansible-private/vars.yml` as a dict keyed by runner name: ```yaml forgejo_runner_secrets: From 0baaabd735673f1ad7a814cd223184464eb7ad4e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Aur=C3=A9lien=20Bompard?= Date: Wed, 27 May 2026 16:56:09 +0200 Subject: [PATCH 216/269] Prepare W2FM in staging for Pretix MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Aurélien Bompard --- playbooks/openshift-apps/webhook2fedmsg.yml | 2 +- roles/openshift-apps/webhook2fedmsg/templates/w2fm.cfg.j2 | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/playbooks/openshift-apps/webhook2fedmsg.yml b/playbooks/openshift-apps/webhook2fedmsg.yml index 9c489085a6..1abdd0509c 100644 --- a/playbooks/openshift-apps/webhook2fedmsg.yml +++ b/playbooks/openshift-apps/webhook2fedmsg.yml @@ -36,7 +36,7 @@ roles: - role: rabbit/user user_name: "webhook2fedmsg{{ env_suffix }}" - user_sent_topics: ^org\.fedoraproject\.{{ env_short }}\.(github|gitlab|discourse|forgejo)\..* + user_sent_topics: ^org\.fedoraproject\.{{ env_short }}\.(github|gitlab|discourse|forgejo|pretix)\..* - role: openshift/project project_app: webhook2fedmsg diff --git a/roles/openshift-apps/webhook2fedmsg/templates/w2fm.cfg.j2 b/roles/openshift-apps/webhook2fedmsg/templates/w2fm.cfg.j2 index f4c4f12a2f..40822df4b5 100644 --- a/roles/openshift-apps/webhook2fedmsg/templates/w2fm.cfg.j2 +++ b/roles/openshift-apps/webhook2fedmsg/templates/w2fm.cfg.j2 @@ -4,3 +4,4 @@ FASJSON_URL="https://fasjson{{ env_suffix }}.fedoraproject.org" OIDC__PROVIDER_URL="https://id{{ env_suffix }}.fedoraproject.org/openidc" OIDC__CLIENT_ID="webhook2fedmsg" DATAGREPPER_URL="https://apps{{ env_suffix }}.fedoraproject.org/datagrepper" +PRETIX__TOKEN="{{ (env == 'staging')|ternary(webhook2fedmsg_stg_pretix_token, webhook2fedmsg_prod_pretix_token) }}" From 50559f83d7d770c13b49ab16985518a170dcbde7 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Wed, 27 May 2026 12:37:23 -0700 Subject: [PATCH 217/269] memcached: move to new rhel10 instances This moves all the applications that are using memcached to point to the 01 (rhel10) versions intead of the 02 (rhel9) ones. After pushing this, I will roll the changes out in staging and confirm everything works, then do production. In the event of problems will roll this back. Signed-off-by: Kevin Fenzi --- roles/mailman3/templates/settings.py.j2 | 2 +- roles/mediawiki/templates/LocalSettings.php.fp.j2 | 2 +- roles/openshift-apps/badges/templates/tahrir.cfg.py | 2 +- roles/openshift-apps/elections/templates/fedora-elections.cfg | 2 +- roles/openshift-apps/koschei/templates/config-backend.cfg.j2 | 2 +- roles/openshift-apps/koschei/templates/config-frontend.cfg.j2 | 2 +- roles/openshift-apps/poddlers/templates/fedora-messaging.toml | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/roles/mailman3/templates/settings.py.j2 b/roles/mailman3/templates/settings.py.j2 index 6124c75978..cdba26f6f0 100644 --- a/roles/mailman3/templates/settings.py.j2 +++ b/roles/mailman3/templates/settings.py.j2 @@ -370,7 +370,7 @@ LOGGING = { CACHES = { 'default': { 'BACKEND': 'django.core.cache.backends.memcached.PyLibMCCache', - 'LOCATION': 'memcached02:11211', + 'LOCATION': 'memcached01:11211', } } diff --git a/roles/mediawiki/templates/LocalSettings.php.fp.j2 b/roles/mediawiki/templates/LocalSettings.php.fp.j2 index ed749e2367..2abf8b1cdf 100644 --- a/roles/mediawiki/templates/LocalSettings.php.fp.j2 +++ b/roles/mediawiki/templates/LocalSettings.php.fp.j2 @@ -158,7 +158,7 @@ $wgParserCacheType = CACHE_MEMCACHED; $wgMessageCacheType = CACHE_MEMCACHED; $wgSessionsInMemcached = true; $wgMemCachedServers = array ( - 0 => 'memcached02:11211', + 0 => 'memcached01:11211', ); ## To enable image uploads, make sure the 'images' directory diff --git a/roles/openshift-apps/badges/templates/tahrir.cfg.py b/roles/openshift-apps/badges/templates/tahrir.cfg.py index dd11d0c112..223b958bb4 100644 --- a/roles/openshift-apps/badges/templates/tahrir.cfg.py +++ b/roles/openshift-apps/badges/templates/tahrir.cfg.py @@ -51,7 +51,7 @@ CACHE = { "backend": "dogpile.cache.null", "expiration_time": 100, "arguments": { - "url": "memcached02{{env_suffix}}:11211", + "url": "memcached01{{env_suffix}}:11211", "distributed_lock": True, "lock_timeout": 5, }, diff --git a/roles/openshift-apps/elections/templates/fedora-elections.cfg b/roles/openshift-apps/elections/templates/fedora-elections.cfg index e680a00bd1..09a129b5d1 100644 --- a/roles/openshift-apps/elections/templates/fedora-elections.cfg +++ b/roles/openshift-apps/elections/templates/fedora-elections.cfg @@ -51,7 +51,7 @@ SESSION_COOKIE_NAME = 'elections' DOGPILE_CACHE = { 'backend': 'dogpile.cache.memcached', 'arguments': { - 'url': ["memcached02:11211"], + 'url': ["memcached01:11211"], 'distributed_lock': True, }, } diff --git a/roles/openshift-apps/koschei/templates/config-backend.cfg.j2 b/roles/openshift-apps/koschei/templates/config-backend.cfg.j2 index c265682be9..28513d1322 100644 --- a/roles/openshift-apps/koschei/templates/config-backend.cfg.j2 +++ b/roles/openshift-apps/koschei/templates/config-backend.cfg.j2 @@ -159,7 +159,7 @@ config = { "backend": "dogpile.cache.memcached", "expiration_time": None, "arguments": { - "url": "memcached02", + "url": "memcached01", }, }, }, diff --git a/roles/openshift-apps/koschei/templates/config-frontend.cfg.j2 b/roles/openshift-apps/koschei/templates/config-frontend.cfg.j2 index 2d66ef00ad..3b112a8b7a 100644 --- a/roles/openshift-apps/koschei/templates/config-frontend.cfg.j2 +++ b/roles/openshift-apps/koschei/templates/config-frontend.cfg.j2 @@ -54,7 +54,7 @@ config = { "backend": "dogpile.cache.memcached", "expiration_time": 3600, # 1 hour "arguments": { - "url": "memcached02:11211", + "url": "memcached01:11211", }, }, }, diff --git a/roles/openshift-apps/poddlers/templates/fedora-messaging.toml b/roles/openshift-apps/poddlers/templates/fedora-messaging.toml index 8d7ab9d3bb..fa78720345 100644 --- a/roles/openshift-apps/poddlers/templates/fedora-messaging.toml +++ b/roles/openshift-apps/poddlers/templates/fedora-messaging.toml @@ -56,7 +56,7 @@ blocked_toddlers = [ backend = "dogpile.cache.pylibmc" expiration_time = 3600 [consumer_config.cache.arguments] -url = ["memcached02{{ env_suffix }}.rdu3.fedoraproject.org"] +url = ["memcached01{{ env_suffix }}.rdu3.fedoraproject.org"] binary = true behaviors = {"tcp_nodelay" = true, "ketama" = true} From bbf92585784410c8741a6b8bf7e960aecac1dd79 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Wed, 27 May 2026 13:48:59 -0700 Subject: [PATCH 218/269] memcached02 (rhel9) retirement We switched over to the rhel10 versions of these, so these are going away. Thanks for your service! Signed-off-by: Kevin Fenzi --- inventory/host_vars/memcached02.rdu3.fedoraproject.org | 8 -------- .../host_vars/memcached02.stg.rdu3.fedoraproject.org | 8 -------- inventory/inventory | 5 ----- 3 files changed, 21 deletions(-) delete mode 100644 inventory/host_vars/memcached02.rdu3.fedoraproject.org delete mode 100644 inventory/host_vars/memcached02.stg.rdu3.fedoraproject.org diff --git a/inventory/host_vars/memcached02.rdu3.fedoraproject.org b/inventory/host_vars/memcached02.rdu3.fedoraproject.org deleted file mode 100644 index 4be2a60813..0000000000 --- a/inventory/host_vars/memcached02.rdu3.fedoraproject.org +++ /dev/null @@ -1,8 +0,0 @@ ---- -datacenter: rdu3 -eth0_ipv4_gw: 10.16.163.254 -eth0_ipv4_ip: 10.16.163.130 -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel -vmhost: vmhost-x86-03.rdu3.fedoraproject.org -volgroup: /dev/vg_guests diff --git a/inventory/host_vars/memcached02.stg.rdu3.fedoraproject.org b/inventory/host_vars/memcached02.stg.rdu3.fedoraproject.org deleted file mode 100644 index ff01e13822..0000000000 --- a/inventory/host_vars/memcached02.stg.rdu3.fedoraproject.org +++ /dev/null @@ -1,8 +0,0 @@ ---- -datacenter: rdu3 -eth0_ipv4_gw: 10.16.166.254 -eth0_ipv4_ip: 10.16.166.77 -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel -vmhost: vmhost-x86-05.stg.rdu3.fedoraproject.org -volgroup: /dev/vg_guests diff --git a/inventory/inventory b/inventory/inventory index 8f364d72f3..bb608f103a 100644 --- a/inventory/inventory +++ b/inventory/inventory @@ -344,19 +344,15 @@ noc01.rdu3.fedoraproject.org [memcached] memcached01.rdu3.fedoraproject.org -memcached02.rdu3.fedoraproject.org [memcached_rdu3] memcached01.rdu3.fedoraproject.org -memcached02.rdu3.fedoraproject.org [memcached_stg] memcached01.stg.rdu3.fedoraproject.org -memcached02.stg.rdu3.fedoraproject.org [memcached_stg_rdu3] memcached01.stg.rdu3.fedoraproject.org -memcached02.stg.rdu3.fedoraproject.org [mirrorlist_proxies] proxy02.fedoraproject.org @@ -647,7 +643,6 @@ ipsilon01.stg.rdu3.fedoraproject.org koji01.stg.rdu3.fedoraproject.org mailman01.stg.rdu3.fedoraproject.org memcached01.stg.rdu3.fedoraproject.org -memcached02.stg.rdu3.fedoraproject.org os-control01.stg.rdu3.fedoraproject.org pkgs01.stg.rdu3.fedoraproject.org proxy01.stg.rdu3.fedoraproject.org From 26402546de1ce6df38624218b2893336712b197c Mon Sep 17 00:00:00 2001 From: Ryan Lerch Date: Thu, 28 May 2026 08:59:27 +1000 Subject: [PATCH 219/269] update location of cloud-image-uploader to new home on forge related: https://forge.fedoraproject.org/infra/tickets/issues/13369 Signed-off-by: Ryan Lerch --- .../cloud-image-uploader/templates/buildconfig.yml.j2 | 4 ++-- .../openshift-apps/cloud-image-uploader/templates/config.toml | 2 +- .../cloud-image-uploader/templates/image-tester-fm-conf.toml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/roles/openshift-apps/cloud-image-uploader/templates/buildconfig.yml.j2 b/roles/openshift-apps/cloud-image-uploader/templates/buildconfig.yml.j2 index ddf3934fca..6cb1b9424d 100644 --- a/roles/openshift-apps/cloud-image-uploader/templates/buildconfig.yml.j2 +++ b/roles/openshift-apps/cloud-image-uploader/templates/buildconfig.yml.j2 @@ -12,7 +12,7 @@ items: source: type: git git: - uri: https://pagure.io/cloud-image-uploader.git + uri: https://forge.fedoraproject.org/apps/cloud-image-uploader.git {% if env == 'staging' %} ref: main {% else %} @@ -39,7 +39,7 @@ items: source: type: git git: - uri: https://pagure.io/cloud-image-uploader.git + uri: https://forge.fedoraproject.org/apps/cloud-image-uploader.git {% if env == 'staging' %} ref: main {% else %} diff --git a/roles/openshift-apps/cloud-image-uploader/templates/config.toml b/roles/openshift-apps/cloud-image-uploader/templates/config.toml index df87b78705..1953f595bd 100644 --- a/roles/openshift-apps/cloud-image-uploader/templates/config.toml +++ b/roles/openshift-apps/cloud-image-uploader/templates/config.toml @@ -19,7 +19,7 @@ certfile = "/etc/pki/rabbitmq/cert/cloud-image-uploader.crt" [client_properties] app = "Fedora Cloud Image Uploader ({{ queue_suffix }})" -app_url = "https://pagure.io/cloud-image-uploader" +app_url = "https://forge.fedoraproject.org/apps/cloud-image-uploader" app_contacts_email = "cloud@lists.fedoraproject.org" [[bindings]] diff --git a/roles/openshift-apps/cloud-image-uploader/templates/image-tester-fm-conf.toml b/roles/openshift-apps/cloud-image-uploader/templates/image-tester-fm-conf.toml index 63a8bf0cca..8b0e9c8220 100644 --- a/roles/openshift-apps/cloud-image-uploader/templates/image-tester-fm-conf.toml +++ b/roles/openshift-apps/cloud-image-uploader/templates/image-tester-fm-conf.toml @@ -19,7 +19,7 @@ certfile = "/etc/pki/rabbitmq/cert/cloud-image-uploader.crt" [client_properties] app = "Fedora Cloud Image Uploader ({{ queue_suffix }})" -app_url = "https://pagure.io/cloud-image-uploader" +app_url = "https://forge.fedoraproject.org/apps/cloud-image-uploader" app_contacts_email = "cloud@lists.fedoraproject.org" [[bindings]] From eb0de86f9a47970e43f7ffe466d095bbb3791478 Mon Sep 17 00:00:00 2001 From: Ryan Lerch Date: Thu, 28 May 2026 09:36:24 +1000 Subject: [PATCH 220/269] update location of elections to new home on forge related: https://forge.fedoraproject.org/infra/tickets/issues/13369 Signed-off-by: Ryan Lerch --- files/httpd/fedorahosted-redirects.conf | 6 +++--- roles/openshift-apps/elections/templates/buildconfig.yml.j2 | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/files/httpd/fedorahosted-redirects.conf b/files/httpd/fedorahosted-redirects.conf index bbdb3bed6a..264b4b4582 100644 --- a/files/httpd/fedorahosted-redirects.conf +++ b/files/httpd/fedorahosted-redirects.conf @@ -90,9 +90,9 @@ RewriteRule ^/gfs2-utils/report https://pagure.io/gfs2-utils/issues [R=301] RewriteRule ^/gfs2-utils/ticket/(.*) https://pagure.io/gfs2-utils/issue/$1 [R=301] RewriteRule ^/gfs2-utils https://pagure.io/gfs2-utils [R=301] -RewriteRule ^/elections/report https://pagure.io/elections/issues [R=301] -RewriteRule ^/elections/ticket/(.*) https://pagure.io/elections/issue/$1 [R=301] -RewriteRule ^/elections https://pagure.io/elections [R=301] +RewriteRule ^/elections/report https://forge.fedoraproject.org/apps/elections/issues [R=301] +RewriteRule ^/elections/ticket/(.*) https://forge.fedoraproject.org/apps/elections/issues/$1 [R=301] +RewriteRule ^/elections https://forge.fedoraproject.org/apps/elections [R=301] RewriteRule ^/fedocal/report https://pagure.io/fedocal/issues [R=301] RewriteRule ^/fedocal/ticket/(.*) https://pagure.io/fedocal/issue/$1 [R=301] diff --git a/roles/openshift-apps/elections/templates/buildconfig.yml.j2 b/roles/openshift-apps/elections/templates/buildconfig.yml.j2 index 62c89fb909..e3bfeb6370 100644 --- a/roles/openshift-apps/elections/templates/buildconfig.yml.j2 +++ b/roles/openshift-apps/elections/templates/buildconfig.yml.j2 @@ -13,7 +13,7 @@ spec: source: type: Git git: - uri: https://pagure.io/elections.git + uri: https://forge.fedoraproject.org/apps/elections.git {% if env == 'staging' %} ref: "staging" {% else %} From c796a888d238811e2dedcd4d3317e71d26707296 Mon Sep 17 00:00:00 2001 From: Ryan Lerch Date: Thu, 28 May 2026 11:32:32 +1000 Subject: [PATCH 221/269] update location of fedora-packages-static to new home on forge related: https://forge.fedoraproject.org/infra/tickets/issues/13369 Signed-off-by: Ryan Lerch --- roles/apps-fp-o/files/apps.yaml | 4 ++-- .../fedora-packages-static/templates/buildconfig.yml.j2 | 2 +- .../fedora-packages-static/templates/packages/schema.xml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/roles/apps-fp-o/files/apps.yaml b/roles/apps-fp-o/files/apps.yaml index af6762e528..d01cacb5b0 100644 --- a/roles/apps-fp-o/files/apps.yaml +++ b/roles/apps-fp-o/files/apps.yaml @@ -321,8 +321,8 @@ children: data: url: https://packages.fedoraproject.org/ package_url: https://apps.fedoraproject.org/packages/{package} - source_url: https://pagure.io/fedora-packages-static - bugs_url: https://pagure.io/fedora-packages-static/issues + source_url: https://forge.fedoraproject.org/apps/fedora-packages-static + bugs_url: https://forge.fedoraproject.org/apps/fedora-packages-static/issues docs_url: http://threebean.org/blog/history-of-fedora-packages/ sops: - https://infrastructure.fedoraproject.org/infra/docs/fedorapackages.rst diff --git a/roles/openshift-apps/fedora-packages-static/templates/buildconfig.yml.j2 b/roles/openshift-apps/fedora-packages-static/templates/buildconfig.yml.j2 index 1c9c7c1ea6..b67215ef81 100644 --- a/roles/openshift-apps/fedora-packages-static/templates/buildconfig.yml.j2 +++ b/roles/openshift-apps/fedora-packages-static/templates/buildconfig.yml.j2 @@ -13,7 +13,7 @@ spec: source: type: Git git: - uri: https://pagure.io/fedora-packages-static.git + uri: https://forge.fedoraproject.org/apps/fedora-packages-static.git {% if env == 'staging' %} ref: "staging" {% else %} diff --git a/roles/openshift-apps/fedora-packages-static/templates/packages/schema.xml b/roles/openshift-apps/fedora-packages-static/templates/packages/schema.xml index 4b91a53d58..7f7e6f895d 100644 --- a/roles/openshift-apps/fedora-packages-static/templates/packages/schema.xml +++ b/roles/openshift-apps/fedora-packages-static/templates/packages/schema.xml @@ -19,7 +19,7 @@ - + From 7b4f3b4182f54c030e08d74a1dac866a6970b2c6 Mon Sep 17 00:00:00 2001 From: Ryan Lerch Date: Thu, 28 May 2026 12:04:48 +1000 Subject: [PATCH 222/269] update location of fedocal to new home on forge related: https://forge.fedoraproject.org/infra/tickets/issues/13369 Signed-off-by: Ryan Lerch --- files/httpd/fedorahosted-redirects.conf | 6 +++--- roles/openshift-apps/fedocal/templates/buildconfig.yml.j2 | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/files/httpd/fedorahosted-redirects.conf b/files/httpd/fedorahosted-redirects.conf index 264b4b4582..3b6eeee3ea 100644 --- a/files/httpd/fedorahosted-redirects.conf +++ b/files/httpd/fedorahosted-redirects.conf @@ -94,9 +94,9 @@ RewriteRule ^/elections/report https://forge.fedoraproject.org/apps/elections/is RewriteRule ^/elections/ticket/(.*) https://forge.fedoraproject.org/apps/elections/issues/$1 [R=301] RewriteRule ^/elections https://forge.fedoraproject.org/apps/elections [R=301] -RewriteRule ^/fedocal/report https://pagure.io/fedocal/issues [R=301] -RewriteRule ^/fedocal/ticket/(.*) https://pagure.io/fedocal/issue/$1 [R=301] -RewriteRule ^/fedocal https://pagure.io/fedocal [R=301] +RewriteRule ^/fedocal/report https://forge.fedoraproject.org/apps/fedocal/issues [R=301] +RewriteRule ^/fedocal/ticket/(.*) https://forge.fedoraproject.org/apps/fedocal/issue/$1 [R=301] +RewriteRule ^/fedocal https://forge.fedoraproject.org/apps/fedocal [R=301] RewriteRule ^/FedoraReview/report https://pagure.io/FedoraReview/issues [R=301] RewriteRule ^/FedoraReview/ticket/(.*) https://pagure.io/FedoraReview/issue/$1 [R=301] diff --git a/roles/openshift-apps/fedocal/templates/buildconfig.yml.j2 b/roles/openshift-apps/fedocal/templates/buildconfig.yml.j2 index 48024dc458..69cc9fdfd9 100644 --- a/roles/openshift-apps/fedocal/templates/buildconfig.yml.j2 +++ b/roles/openshift-apps/fedocal/templates/buildconfig.yml.j2 @@ -13,7 +13,7 @@ spec: source: type: Git git: - uri: https://pagure.io/fedocal.git + uri: https://forge.fedoraproject.org/apps/fedocal.git {% if env == 'staging' %} ref: "staging" {% else %} From b8773db5ba42ddd5322d806175bf6832f47dbb53 Mon Sep 17 00:00:00 2001 From: Akashdeep Dhar Date: Wed, 13 May 2026 11:29:32 +0530 Subject: [PATCH 223/269] Move the Fedora Badges static assets from Pagure to Forgejo Signed-off-by: Akashdeep Dhar --- roles/openshift-apps/badges/templates/checkout-rules-repo.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/badges/templates/checkout-rules-repo.sh b/roles/openshift-apps/badges/templates/checkout-rules-repo.sh index 2bf2e1d2ac..bc7822215a 100644 --- a/roles/openshift-apps/badges/templates/checkout-rules-repo.sh +++ b/roles/openshift-apps/badges/templates/checkout-rules-repo.sh @@ -6,7 +6,7 @@ set -x DIR=/var/lib/badges if [ ! -d "$DIR/.git" ]; then - git clone https://pagure.io/fedora-badges.git $DIR + git clone https://forge.fedoraproject.org/apps/badges-assets.git $DIR fi git config --global --add safe.directory $DIR From 993e600700824d9d1c06e141eac898bd2e3f12fa Mon Sep 17 00:00:00 2001 From: Akashdeep Dhar Date: Thu, 28 May 2026 11:38:53 +0530 Subject: [PATCH 224/269] badges: fix image trigger annote order on deploy metadata Similar to https://forge.fedoraproject.org/infra/ansible/pulls/3338 Signed-off-by: Akashdeep Dhar --- roles/openshift-apps/badges/templates/deployment.yml.j2 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/openshift-apps/badges/templates/deployment.yml.j2 b/roles/openshift-apps/badges/templates/deployment.yml.j2 index 3e96a775b6..d9f22f67d4 100644 --- a/roles/openshift-apps/badges/templates/deployment.yml.j2 +++ b/roles/openshift-apps/badges/templates/deployment.yml.j2 @@ -118,6 +118,8 @@ metadata: labels: app: badges deployment: consumer + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fedbadges:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"consumer\")].image"}]' spec: replicas: {{ (env == 'production')|ternary(2, 1) }} selector: @@ -131,8 +133,6 @@ spec: labels: app: badges deployment: consumer - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fedbadges:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"consumer\")].image"}]' spec: initContainers: - name: db-sync From 2e2abbedac79742e447277a2e8528413c1b4beda Mon Sep 17 00:00:00 2001 From: Jan Matufka Date: Tue, 26 May 2026 10:31:59 +0200 Subject: [PATCH 225/269] nvidia-cdi: create a role Signed-off-by: Jan Matufka --- .../files/nvidia-cdi-generate.service | 11 +++++ roles/nvidia-cdi/handlers/main.yml | 4 ++ roles/nvidia-cdi/tasks/main.yml | 41 +++++++++++++++++++ 3 files changed, 56 insertions(+) create mode 100644 roles/nvidia-cdi/files/nvidia-cdi-generate.service create mode 100644 roles/nvidia-cdi/handlers/main.yml create mode 100644 roles/nvidia-cdi/tasks/main.yml diff --git a/roles/nvidia-cdi/files/nvidia-cdi-generate.service b/roles/nvidia-cdi/files/nvidia-cdi-generate.service new file mode 100644 index 0000000000..e159d4e24c --- /dev/null +++ b/roles/nvidia-cdi/files/nvidia-cdi-generate.service @@ -0,0 +1,11 @@ +[Unit] +Description=Generate Nvidia CDI configuration +Before=logdetective.service + +[Service] +Type=oneshot +ExecStart=/usr/bin/nvidia-ctk cdi generate --output=/etc/cdi/nvidia.yaml +RemainAfterExit=yes + +[Install] +WantedBy=multi-user.target diff --git a/roles/nvidia-cdi/handlers/main.yml b/roles/nvidia-cdi/handlers/main.yml new file mode 100644 index 0000000000..c28484f735 --- /dev/null +++ b/roles/nvidia-cdi/handlers/main.yml @@ -0,0 +1,4 @@ +--- +- name: Reload systemd + ansible.builtin.systemd: + daemon_reload: true diff --git a/roles/nvidia-cdi/tasks/main.yml b/roles/nvidia-cdi/tasks/main.yml new file mode 100644 index 0000000000..eeaa849c57 --- /dev/null +++ b/roles/nvidia-cdi/tasks/main.yml @@ -0,0 +1,41 @@ +--- +- name: Add nvidia-container-toolkit repo + ansible.builtin.get_url: + url: https://nvidia.github.io/libnvidia-container/stable/rpm/nvidia-container-toolkit.repo + dest: /etc/yum.repos.d/nvidia-container-toolkit.repo + mode: "0644" + tags: + - packages + +- name: Install nvidia-container-toolkit + ansible.builtin.package: + name: nvidia-container-toolkit + tags: + - packages + +- name: Ensure /etc/cdi directory exists + ansible.builtin.file: + path: /etc/cdi + state: directory + owner: root + group: root + mode: "0755" + +- name: Install nvidia-cdi-generate systemd service + ansible.builtin.copy: + src: nvidia-cdi-generate.service + dest: /etc/systemd/system/nvidia-cdi-generate.service + owner: root + group: root + mode: "0644" + notify: + - Reload systemd + tags: + - config + +- name: Enable and start nvidia-cdi-generate service + ansible.builtin.systemd: + name: nvidia-cdi-generate.service + enabled: true + state: started + daemon_reload: true From d77168ff0c6c835770af6e6d473193aac051bff5 Mon Sep 17 00:00:00 2001 From: Jan Matufka Date: Tue, 26 May 2026 10:32:47 +0200 Subject: [PATCH 226/269] logdetective: service, dependency on nvidia-cdi - for persistent deployment Signed-off-by: Jan Matufka --- main.yml | 1 + playbooks/groups/logdetective.yml | 1 + roles/logdetective/files/logdetective.service | 15 +++++++++++++++ roles/logdetective/handlers/main.yml | 4 ++++ roles/logdetective/tasks/main.yml | 19 +++++++++++++++++++ 5 files changed, 40 insertions(+) create mode 100644 roles/logdetective/files/logdetective.service create mode 100644 roles/logdetective/handlers/main.yml diff --git a/main.yml b/main.yml index be7ae57fa4..655a114100 100644 --- a/main.yml +++ b/main.yml @@ -33,6 +33,7 @@ - import_playbook: /srv/web/infra/ansible/playbooks/groups/koji-hub.yml - import_playbook: /srv/web/infra/ansible/playbooks/groups/kojipkgs.yml - import_playbook: /srv/web/infra/ansible/playbooks/groups/logserver.yml +- import_playbook: /srv/web/infra/ansible/playbooks/groups/logdetective.yml - import_playbook: /srv/web/infra/ansible/playbooks/groups/mailman.yml - import_playbook: /srv/web/infra/ansible/playbooks/groups/maintainer-test.yml - import_playbook: /srv/web/infra/ansible/playbooks/groups/mariadb-server.yml diff --git a/playbooks/groups/logdetective.yml b/playbooks/groups/logdetective.yml index 30245f8d0c..2e05acd22d 100644 --- a/playbooks/groups/logdetective.yml +++ b/playbooks/groups/logdetective.yml @@ -38,5 +38,6 @@ # Roles are run first, before tasks, regardless of where you place them here. roles: - base + - nvidia-cdi - logdetective - nagios_client diff --git a/roles/logdetective/files/logdetective.service b/roles/logdetective/files/logdetective.service new file mode 100644 index 0000000000..2950d33a27 --- /dev/null +++ b/roles/logdetective/files/logdetective.service @@ -0,0 +1,15 @@ +[Unit] +Description=LogDetective compose stack +After=network-online.target nvidia-cdi-generate.service +Wants=network-online.target nvidia-cdi-generate.service + +[Service] +Type=simple +WorkingDirectory=/root/logdetective +ExecStart=/usr/bin/podman-compose -f /root/logdetective/docker-compose-prod.yaml up --abort-on-container-failure +ExecStopPost=/usr/bin/podman-compose -f /root/logdetective/docker-compose-prod.yaml down +Restart=on-failure +RestartSec=20 + +[Install] +WantedBy=multi-user.target diff --git a/roles/logdetective/handlers/main.yml b/roles/logdetective/handlers/main.yml new file mode 100644 index 0000000000..c28484f735 --- /dev/null +++ b/roles/logdetective/handlers/main.yml @@ -0,0 +1,4 @@ +--- +- name: Reload systemd + ansible.builtin.systemd: + daemon_reload: true diff --git a/roles/logdetective/tasks/main.yml b/roles/logdetective/tasks/main.yml index b3f6a414d5..973d648c1d 100644 --- a/roles/logdetective/tasks/main.yml +++ b/roles/logdetective/tasks/main.yml @@ -144,3 +144,22 @@ with_items: - http - https + +- name: Install logdetective systemd service + ansible.builtin.copy: + src: logdetective.service + dest: /etc/systemd/system/logdetective.service + owner: root + group: root + mode: "0644" + notify: + - Reload systemd + tags: + - config + +- name: Enable and start logdetective service + ansible.builtin.systemd: + name: logdetective.service + enabled: true + state: started + daemon_reload: true From c0d5169f58d276de2aa5f6d7e0ea4f776b0c8a88 Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Thu, 28 May 2026 09:37:45 +0100 Subject: [PATCH 227/269] Zabbix: remove some unused checks Signed-off-by: Greg Sutcliffe --- .../templates/nagios/services/websites.cfg.j2 | 8 -------- roles/zabbix/sslchecks/tasks/main.yml | 1 - 2 files changed, 9 deletions(-) diff --git a/roles/nagios_server/templates/nagios/services/websites.cfg.j2 b/roles/nagios_server/templates/nagios/services/websites.cfg.j2 index 7a941d3c04..78340c7ceb 100644 --- a/roles/nagios_server/templates/nagios/services/websites.cfg.j2 +++ b/roles/nagios_server/templates/nagios/services/websites.cfg.j2 @@ -45,14 +45,6 @@ define service { use websitetemplate } -define service { - hostgroup_name sundries - service_description http-freemedia-internal - check_command check_website!localhost!/freemedia/FreeMedia-form.html!Media - use internalwebsitetemplate - servicegroups freemedia -} - {% endif %} define service { diff --git a/roles/zabbix/sslchecks/tasks/main.yml b/roles/zabbix/sslchecks/tasks/main.yml index 79e8add755..c4b734242b 100644 --- a/roles/zabbix/sslchecks/tasks/main.yml +++ b/roles/zabbix/sslchecks/tasks/main.yml @@ -35,7 +35,6 @@ loop: - { name: 'http://certgetter01.rdu3.fedoraproject.org', string: 'Index' } - { name: 'https://lists.fedoraproject.org/archives', string: 'Fedora Mailing-Lists' } - - { name: 'https://mailman01.rdu3.fedoraproject.org/archives', string: 'Fedora Mailing-Lists' } - { name: 'https://cdn.registry.fedoraproject.org/v2/', string: '{}' } - { name: 'https://www.fedorastatus.org/index.html', string: 'Fedora Infrastructure Status' } - { name: 'https://pagure.io/fedora-infrastructure/issues', string: 'Issues' } From bc2f608f4c6e60e6867c806a099622b37ecc273e Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Thu, 28 May 2026 09:44:55 +0100 Subject: [PATCH 228/269] Zabbix: add trigger for one-off httpcheck items Signed-off-by: Greg Sutcliffe --- roles/zabbix/sslchecks/tasks/httpcheck.yml | 14 +++++++++++++- roles/zabbix/sslchecks/tasks/main.yml | 2 +- 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/roles/zabbix/sslchecks/tasks/httpcheck.yml b/roles/zabbix/sslchecks/tasks/httpcheck.yml index ee428ff1e2..7834834cd1 100644 --- a/roles/zabbix/sslchecks/tasks/httpcheck.yml +++ b/roles/zabbix/sslchecks/tasks/httpcheck.yml @@ -10,7 +10,6 @@ ansible_host: "{{ zabbix_server }}" ansible_zabbix_url_path: "{{ zabbix_url_path }}" tags: - - httpitems - zabbix_agent - zabbix_api block: @@ -26,3 +25,16 @@ tags: - tag: component value: http + + - name: Create {{ item.name }} http connection trigger + community.zabbix.zabbix_trigger: + name: "{{ item.name }} - text not found" + host_name: "{{ inventory_hostname }}" + params: + severity: average + expression: "last(/{{ inventory_hostname }}/web.page.regexp[{{ item.name }},,,{{ item.string }}])<>'{{ item.string }}'" + enabled: true + manual_close: true + tags: + - tag: scope + value: availability diff --git a/roles/zabbix/sslchecks/tasks/main.yml b/roles/zabbix/sslchecks/tasks/main.yml index c4b734242b..fe3b149416 100644 --- a/roles/zabbix/sslchecks/tasks/main.yml +++ b/roles/zabbix/sslchecks/tasks/main.yml @@ -34,7 +34,7 @@ include_tasks: httpcheck.yml loop: - { name: 'http://certgetter01.rdu3.fedoraproject.org', string: 'Index' } - - { name: 'https://lists.fedoraproject.org/archives', string: 'Fedora Mailing-Lists' } + - { name: 'https://lists.fedoraproject.org/archives/', string: 'Fedora Mailing-Lists' } - { name: 'https://cdn.registry.fedoraproject.org/v2/', string: '{}' } - { name: 'https://www.fedorastatus.org/index.html', string: 'Fedora Infrastructure Status' } - { name: 'https://pagure.io/fedora-infrastructure/issues', string: 'Issues' } From e3d9be210ec1e2e5909289905f15c19a5d7573cb Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Thu, 28 May 2026 11:08:35 +0100 Subject: [PATCH 229/269] Zabbix: Move internal proxy checks from Nagios Signed-off-by: Greg Sutcliffe --- roles/httpd/proxy/files/zabbix-selinux.te | 11 ++ .../proxy/files/zabbix-template-internal.yml | 109 ++++++++++++++++++ roles/httpd/proxy/tasks/monitoring.yml | 76 ++++++++++++ 3 files changed, 196 insertions(+) create mode 100644 roles/httpd/proxy/files/zabbix-selinux.te create mode 100644 roles/httpd/proxy/files/zabbix-template-internal.yml create mode 100644 roles/httpd/proxy/tasks/monitoring.yml diff --git a/roles/httpd/proxy/files/zabbix-selinux.te b/roles/httpd/proxy/files/zabbix-selinux.te new file mode 100644 index 0000000000..602f519e5b --- /dev/null +++ b/roles/httpd/proxy/files/zabbix-selinux.te @@ -0,0 +1,11 @@ +module zabbix_proxy 1.1; + +require { + type unreserved_port_t; + type zabbix_agent_t; + class tcp_socket name_connect; +} + +#============= zabbix_agent_t ============== + +allow zabbix_agent_t unreserved_port_t:tcp_socket name_connect; diff --git a/roles/httpd/proxy/files/zabbix-template-internal.yml b/roles/httpd/proxy/files/zabbix-template-internal.yml new file mode 100644 index 0000000000..f691cc8e5b --- /dev/null +++ b/roles/httpd/proxy/files/zabbix-template-internal.yml @@ -0,0 +1,109 @@ +zabbix_export: + version: '7.0' + template_groups: + - uuid: a333cbd6a3ad44baaa4eee4b0c0b1bec + name: Fedora + templates: + - uuid: 847dc5c32ea342e5b20659747516f19d + template: 'Proxy checks - internal' + name: 'Proxy checks - internal' + description: 'Checks that only internal proxies can run' + groups: + - name: Fedora + items: + - uuid: e7604e57aa8a4b3caa474d95f49bec7e + name: 'Mirrorlist Docker Container TCP check' + type: ZABBIX_ACTIVE + key: 'net.tcp.service[tcp,,18081]' + tags: + - tag: component + value: mirrorlist + triggers: + - uuid: 08fcae0ec58145609e85c2fc128e1861 + expression: 'last(/Proxy checks - internal/net.tcp.service[tcp,,18081])=0' + name: 'Mirrorlist Docker Container TCP check failed' + priority: AVERAGE + - uuid: 1f917349a49440c78e24daae9ac25b1f + name: http-fmn-api + type: ZABBIX_ACTIVE + key: 'web.page.regexp[https://fmn-api.apps.ocp.fedoraproject.org/api/v1/healthz/ready,,,OK]' + delay: 5m + value_type: CHAR + trends: '0' + timeout: 6s + tags: + - tag: component + value: http + triggers: + - uuid: 0e93bf5f3449458fa24795fa03d1e0af + expression: 'last(/Proxy checks - internal/web.page.regexp[https://fmn-api.apps.ocp.fedoraproject.org/api/v1/healthz/ready,,,OK])<>"OK"' + name: 'http-fmn-api connection failed' + priority: AVERAGE + tags: + - tag: scope + value: availability + - tag: scope + value: connectivity + - uuid: 1f0eba5fb89b47b1bc380a9f699c8564 + name: http-fmn-web + type: ZABBIX_ACTIVE + key: 'web.page.regexp[https://notifications.fedoraproject.org/,,,FMN]' + delay: 5m + value_type: CHAR + trends: '0' + timeout: 6s + tags: + - tag: component + value: http + triggers: + - uuid: 96a1590776a74dc68736083d3b51319c + expression: 'last(/Proxy checks - internal/web.page.regexp[https://notifications.fedoraproject.org/,,,FMN])<>"FMN"' + name: 'http-fmn-web connection failed' + priority: AVERAGE + tags: + - tag: scope + value: availability + - tag: scope + value: connectivity + - uuid: de4cb57caa0a4776846c0327c4a1e2ac + name: http-oci-registry-webui + type: ZABBIX_ACTIVE + key: 'web.page.regexp[https://registry.fedoraproject.org/v2/fedora/tags/list,,,rawhide]' + delay: 5m + value_type: CHAR + trends: '0' + timeout: 6s + tags: + - tag: component + value: http + triggers: + - uuid: 515fd69090b349e391be581c6e4dc82c + expression: 'last(/Proxy checks - internal/web.page.regexp[https://registry.fedoraproject.org/v2/fedora/tags/list,,,rawhide])<>"rawhide"' + name: 'http-oci-registry-webui connection failed' + priority: AVERAGE + tags: + - tag: scope + value: availability + - tag: scope + value: connectivity + - uuid: 44286da1dca046b89d205f8db0a0cb56 + name: http-oci-registry-api + type: ZABBIX_ACTIVE + key: 'web.page.regexp[https://registry.fedoraproject.org/v2/_catalog?last=fedora,,,fedora]' + delay: 5m + value_type: CHAR + trends: '0' + timeout: 30s + tags: + - tag: component + value: http + triggers: + - uuid: afe0d6921c074089869e11ec59e6fe35 + expression: 'last(/Proxy checks - internal/web.page.regexp[https://registry.fedoraproject.org/v2/_catalog?last=fedora,,,fedora])<>"fedora"' + name: 'http-oci-registry-api connection failed' + priority: AVERAGE + tags: + - tag: scope + value: availability + - tag: scope + value: connectivity diff --git a/roles/httpd/proxy/tasks/monitoring.yml b/roles/httpd/proxy/tasks/monitoring.yml new file mode 100644 index 0000000000..9732ed7080 --- /dev/null +++ b/roles/httpd/proxy/tasks/monitoring.yml @@ -0,0 +1,76 @@ +# Custom SELinux requirements for Zabbix to run TCP port checks +- name: Ensure a directory exists for Proxy+Zabbix selinux module + ansible.builtin.file: + path: /usr/local/share/zabbix + state: directory + mode: '0755' + tags: + - selinux + - httpd/proxy + - zabbix_agent + +- name: Copy Proxy Zabbix SELinux module + ansible.builtin.copy: + src: zabbix-selinux.te + dest: /usr/local/share/zabbix/zabbix_proxy.te + owner: root + group: root + mode: '0644' + register: selinux_zabbix_file + tags: + - selinux + - httpd/proxy + - zabbix_agent + +- name: Compile and install SELinux module + ansible.builtin.include_tasks: "{{ tasks_path }}/compile-selinux.yml" + vars: + selinux_module_dir: /usr/local/share/zabbix + selinux_module_name: zabbix_proxy + when: selinux_zabbix_file.changed # noqa: no-handler + tags: + - selinux + - httpd/proxy + - zabbix_agent + +# Zabbix monitoring of the proxy sites & ticketkeys +- name: Zabbix API Block + vars: + ansible_zabbix_auth_key: "{{ zabbix_auth_key }}" + ansible_network_os: "{{ zabbix_network_os }}" + ansible_connection: "{{ zabbix_connection }}" + ansible_httpapi_port: "{{ zabbix_httpapi_port }}" + ansible_httpapi_use_ssl: "{{ zabbix_httpapi_use_ssl }}" + ansible_httpapi_validate_certs: "{{ zabbix_httpapi_validate_certs }}" + ansible_host: "{{ zabbix_server }}" + ansible_zabbix_url_path: "{{ zabbix_url_path }}" + tags: + - httpd/proxy + - zabbix_api + block: + - name: Import Proxy checks template + community.zabbix.zabbix_template: + template_yaml: "{{ lookup('file', 'zabbix-template.yml') }}" + state: present + run_once: true + + - name: Import Proxy internal checks template + community.zabbix.zabbix_template: + template_yaml: "{{ lookup('file', 'zabbix-template-internal.yml') }}" + state: present + run_once: true + + - name: Add self to Proxy checks template in Zabbix + community.zabbix.zabbix_host: + host_name: "{{ inventory_hostname }}" + link_templates: Proxy checks + force: false + run_once: true + + - name: Add self to Proxy internal checks template in Zabbix + community.zabbix.zabbix_host: + host_name: "{{ inventory_hostname }}" + link_templates: Proxy checks - internal + force: false + run_once: true + when: "'proxies_rdu3' in group_names" From 69612dffe5cbd8b1ae57cd970ecf5e1fd31c25d0 Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Thu, 28 May 2026 11:30:27 +0100 Subject: [PATCH 230/269] Zabbix: Add the rest of the previous commit that got missed Signed-off-by: Greg Sutcliffe --- roles/httpd/proxy/tasks/main.yml | 24 ++-------------- roles/nagios_server/tasks/main.yml | 1 - .../nagios/services/mirrorlist-proxies.cfg.j2 | 8 ------ .../templates/nagios/services/websites.cfg.j2 | 28 ------------------- 4 files changed, 3 insertions(+), 58 deletions(-) delete mode 100644 roles/nagios_server/templates/nagios/services/mirrorlist-proxies.cfg.j2 diff --git a/roles/httpd/proxy/tasks/main.yml b/roles/httpd/proxy/tasks/main.yml index fffba4e26d..04bb0a41e5 100644 --- a/roles/httpd/proxy/tasks/main.yml +++ b/roles/httpd/proxy/tasks/main.yml @@ -115,27 +115,9 @@ notify: - Reload systemd -# Zabbix monitoring of the proxy sites & ticketkeys -- name: Zabbix API Block - vars: - ansible_zabbix_auth_key: "{{ zabbix_auth_key }}" - ansible_network_os: "{{ zabbix_network_os }}" - ansible_connection: "{{ zabbix_connection }}" - ansible_httpapi_port: "{{ zabbix_httpapi_port }}" - ansible_httpapi_use_ssl: "{{ zabbix_httpapi_use_ssl }}" - ansible_httpapi_validate_certs: "{{ zabbix_httpapi_validate_certs }}" - ansible_host: "{{ zabbix_server }}" - ansible_zabbix_url_path: "{{ zabbix_url_path }}" +- name: Configure proxy http/misc monitoring in Zabbix + ansible.builtin.include_tasks: monitoring.yml tags: - httpd/proxy + - zabbix_agent - zabbix_api - block: - - name: Import Proxy checks template - community.zabbix.zabbix_template: - template_yaml: "{{ lookup('file', 'zabbix-template.yml') }}" - state: present - - name: Add self to Proxy checks template in Zabbix - community.zabbix.zabbix_host: - host_name: "{{ inventory_hostname }}" - link_templates: Proxy checks - force: false diff --git a/roles/nagios_server/tasks/main.yml b/roles/nagios_server/tasks/main.yml index 60b6bcaa69..7132c2a20e 100644 --- a/roles/nagios_server/tasks/main.yml +++ b/roles/nagios_server/tasks/main.yml @@ -379,7 +379,6 @@ ansible.builtin.template: src=nagios/services/{{item}}.j2 dest=/etc/nagios/services/{{item}} mode=0644 owner=root group=root with_items: - ipa.cfg - - mirrorlist-proxies.cfg when: env == "production" and nagios_location == 'rdu3_internal' tags: - nagios_server diff --git a/roles/nagios_server/templates/nagios/services/mirrorlist-proxies.cfg.j2 b/roles/nagios_server/templates/nagios/services/mirrorlist-proxies.cfg.j2 deleted file mode 100644 index 9776422083..0000000000 --- a/roles/nagios_server/templates/nagios/services/mirrorlist-proxies.cfg.j2 +++ /dev/null @@ -1,8 +0,0 @@ -{% for host in groups['mirrorlist_proxies'] if hostvars[host].datacenter == datacenter %} -define service { - host_name {{ host }} - service_description {{ host }} mirrorlist docker container - check_command check_by_nrpe!check_mirrorlist_docker_proxy - use defaulttemplate -} -{% endfor %} diff --git a/roles/nagios_server/templates/nagios/services/websites.cfg.j2 b/roles/nagios_server/templates/nagios/services/websites.cfg.j2 index 78340c7ceb..3400960f36 100644 --- a/roles/nagios_server/templates/nagios/services/websites.cfg.j2 +++ b/roles/nagios_server/templates/nagios/services/websites.cfg.j2 @@ -1,17 +1,3 @@ -define service { - host_name proxy01.fedoraproject.org, proxy10.fedoraproject.org - service_description http-oci-registry-api - check_command check_website_ssl!registry.fedoraproject.org!/v2/_catalog?last=fedora!fedora - use websitetemplate -} - -define service { - host_name proxy01.fedoraproject.org, proxy10.fedoraproject.org - service_description http-oci-registry-webui - check_command check_website_ssl!registry.fedoraproject.org!/v2/fedora/tags/list!rawhide - use websitetemplate -} - {% if vars['nagios_location'] == 'rdu3_internal' %} ## ## Other Frontend Websites @@ -24,20 +10,6 @@ define service { use internalwebsitetemplate } -define service { - hostgroup_name proxies_ocp4 - service_description http-fmn-web - check_command check_website_ssl!notifications.fedoraproject.org!/!FMN - use websitetemplate -} - -define service { - hostgroup_name proxies_ocp4 - service_description http-fmn-api - check_command check_website_ssl!fmn-api.apps.ocp.fedoraproject.org!/api/v1/healthz/ready!OK - use websitetemplate -} - define service { hostgroup_name pkgs service_description http-pkgs-pagure From 44951845e42cd7ca5544b09e7ab3ed57df601008 Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Thu, 28 May 2026 11:33:34 +0100 Subject: [PATCH 231/269] Zabbix: remove incorrect run_once directives from proxy monitoring Signed-off-by: Greg Sutcliffe --- roles/httpd/proxy/tasks/monitoring.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/roles/httpd/proxy/tasks/monitoring.yml b/roles/httpd/proxy/tasks/monitoring.yml index 9732ed7080..8c9c32254b 100644 --- a/roles/httpd/proxy/tasks/monitoring.yml +++ b/roles/httpd/proxy/tasks/monitoring.yml @@ -65,12 +65,10 @@ host_name: "{{ inventory_hostname }}" link_templates: Proxy checks force: false - run_once: true - name: Add self to Proxy internal checks template in Zabbix community.zabbix.zabbix_host: host_name: "{{ inventory_hostname }}" link_templates: Proxy checks - internal force: false - run_once: true when: "'proxies_rdu3' in group_names" From e537215abc4768bda2d03064b29cd4c0cd188d5d Mon Sep 17 00:00:00 2001 From: Jakub Kadlcik Date: Thu, 28 May 2026 12:39:39 +0200 Subject: [PATCH 232/269] copr-dist-git: move sentry configuration to the correct config --- roles/copr/dist_git/files/dist-git.conf | 4 ---- roles/copr/dist_git/templates/copr-dist-git.conf.j2 | 4 ++++ 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/roles/copr/dist_git/files/dist-git.conf b/roles/copr/dist_git/files/dist-git.conf index 30c59e82ad..25d35b5fe4 100644 --- a/roles/copr/dist_git/files/dist-git.conf +++ b/roles/copr/dist_git/files/dist-git.conf @@ -11,7 +11,3 @@ gitolite = False # name of the default branch (a.k.a. master or main) default_branch = master - -{% if env == 'production' %} -sentry_dsn={{ copr_sentry_dsn }} -{% endif %} diff --git a/roles/copr/dist_git/templates/copr-dist-git.conf.j2 b/roles/copr/dist_git/templates/copr-dist-git.conf.j2 index a8e5c60ab6..f6dff3de9a 100644 --- a/roles/copr/dist_git/templates/copr-dist-git.conf.j2 +++ b/roles/copr/dist_git/templates/copr-dist-git.conf.j2 @@ -18,3 +18,7 @@ per_task_log_dir=/var/lib/copr-dist-git/per-task-logs/ # which chroot to use for mock-scm builds mock_scm_chroot=fedora-24-x86_64 + +{% if env == 'production' %} +sentry_dsn={{ copr_sentry_dsn }} +{% endif %} From 9e3cd9d4ffa7d7729baf151ed1bb45fcb2e115a8 Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Thu, 28 May 2026 13:11:45 +0100 Subject: [PATCH 233/269] Zabbix: Move DNS checks from Nagios Signed-off-by: Greg Sutcliffe --- roles/dns/files/zabbix/template.yml | 55 +++++++++++++++++++ roles/dns/tasks/main.yml | 27 +++++++++ .../files/nagios/services/dns.cfg | 6 -- roles/nagios_server/tasks/main.yml | 2 - 4 files changed, 82 insertions(+), 8 deletions(-) create mode 100644 roles/dns/files/zabbix/template.yml delete mode 100644 roles/nagios_server/files/nagios/services/dns.cfg diff --git a/roles/dns/files/zabbix/template.yml b/roles/dns/files/zabbix/template.yml new file mode 100644 index 0000000000..720b0e5656 --- /dev/null +++ b/roles/dns/files/zabbix/template.yml @@ -0,0 +1,55 @@ +zabbix_export: + version: '7.0' + template_groups: + - uuid: a333cbd6a3ad44baaa4eee4b0c0b1bec + name: Fedora + templates: + - uuid: 469d49d18d9f4da28aaf775b50084b08 + template: 'DNS checks' + name: 'DNS checks' + groups: + - name: Fedora + items: + - uuid: 681147b6755a453ab5e26e2ad8ad2402 + name: 'DNS performance for fedoraproject.org' + type: ZABBIX_ACTIVE + key: 'net.dns.perf[,fedoraproject.org,A]' + value_type: FLOAT + trends: '0' + units: ms + preprocessing: + - type: MULTIPLIER + parameters: + - '1000' + tags: + - tag: component + value: dns + triggers: + - uuid: c5721fb738374074a26810e8e75b260d + expression: 'avg(/DNS checks/net.dns.perf[,fedoraproject.org,A],#3)>1000' + name: 'DNS performance for fedoraproject.org is more than 1s' + priority: AVERAGE + tags: + - tag: scope + value: performance + - uuid: e189ee7aee2c451586573a1d03207a98 + name: 'DNS query for fedoraproject.org' + type: ZABBIX_ACTIVE + key: 'net.dns.record[,fedoraproject.org,A]' + value_type: CHAR + trends: '0' + tags: + - tag: component + value: dns + triggers: + - uuid: 225808c08f0a480a948d68ef43fe2d10 + expression: 'find(/DNS checks/net.dns.record[,fedoraproject.org,A],,"like","fedoraproject.org A")=0' + name: 'DNS query for fedoraproject.org is incorrect' + priority: HIGH + description: | + https://www.zabbix.com/documentation/7.0/en/manual/appendix/functions/history#find + + returns 0 if string not found, so we test for 0. look for fedoraproject.org because some are internal (10.x) records and some are external (38.x) records + tags: + - tag: scope + value: availability diff --git a/roles/dns/tasks/main.yml b/roles/dns/tasks/main.yml index d8c4863890..0f99452743 100644 --- a/roles/dns/tasks/main.yml +++ b/roles/dns/tasks/main.yml @@ -122,3 +122,30 @@ service: name=named state=started enabled=yes tags: - dns + +- name: Zabbix API Block + vars: + ansible_zabbix_auth_key: "{{ zabbix_auth_key }}" + ansible_network_os: "{{ zabbix_network_os }}" + ansible_connection: "{{ zabbix_connection }}" + ansible_httpapi_port: "{{ zabbix_httpapi_port }}" + ansible_httpapi_use_ssl: "{{ zabbix_httpapi_use_ssl }}" + ansible_httpapi_validate_certs: "{{ zabbix_httpapi_validate_certs }}" + ansible_host: "{{ zabbix_server }}" + ansible_zabbix_url_path: "{{ zabbix_url_path }}" + tags: + - zabbix_api + - zabbix_agent + - dns + block: + - name: Import DNS Zabbix template file + community.zabbix.zabbix_template: + template_yaml: "{{ lookup('file', 'zabbix/template.yml') }}" + state: present + run_once: true + + - name: Add self to DNS template in Zabbix + community.zabbix.zabbix_host: + host_name: "{{ inventory_hostname }}" + link_templates: DNS checks + force: false diff --git a/roles/nagios_server/files/nagios/services/dns.cfg b/roles/nagios_server/files/nagios/services/dns.cfg deleted file mode 100644 index dbf24b4007..0000000000 --- a/roles/nagios_server/files/nagios/services/dns.cfg +++ /dev/null @@ -1,6 +0,0 @@ -define service { - hostgroup_name dns - service_description DNS: fp.o - check_command check_dns_fpo - use criticaltemplate -} diff --git a/roles/nagios_server/tasks/main.yml b/roles/nagios_server/tasks/main.yml index 7132c2a20e..974b262435 100644 --- a/roles/nagios_server/tasks/main.yml +++ b/roles/nagios_server/tasks/main.yml @@ -221,7 +221,6 @@ ansible.builtin.copy: src=nagios/services/{{ item }} dest=/etc/nagios/services/{{ item }} with_items: - copr.cfg - - dns.cfg - memcached.cfg - nagios.cfg - pagure_redis.cfg @@ -243,7 +242,6 @@ - name: Copy /etc/nagios/services (External) ansible.builtin.copy: src=nagios/services/{{ item }} dest=/etc/nagios/services/{{ item }} with_items: - - dns.cfg - smtp-mm.cfg - templates.cfg - ping-ipv6.cfg From e104755e4e0cacfcaf6ff8c2d8a37adefbce11d3 Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Thu, 28 May 2026 13:20:09 +0100 Subject: [PATCH 234/269] Zabbix: fix DNS perf units, and regexp record trigger Signed-off-by: Greg Sutcliffe --- roles/dns/files/zabbix/template.yml | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/roles/dns/files/zabbix/template.yml b/roles/dns/files/zabbix/template.yml index 720b0e5656..e1f0f53f2b 100644 --- a/roles/dns/files/zabbix/template.yml +++ b/roles/dns/files/zabbix/template.yml @@ -16,17 +16,13 @@ zabbix_export: key: 'net.dns.perf[,fedoraproject.org,A]' value_type: FLOAT trends: '0' - units: ms - preprocessing: - - type: MULTIPLIER - parameters: - - '1000' + units: s tags: - tag: component value: dns triggers: - uuid: c5721fb738374074a26810e8e75b260d - expression: 'avg(/DNS checks/net.dns.perf[,fedoraproject.org,A],#3)>1000' + expression: 'avg(/DNS checks/net.dns.perf[,fedoraproject.org,A],#3)>1' name: 'DNS performance for fedoraproject.org is more than 1s' priority: AVERAGE tags: @@ -43,7 +39,7 @@ zabbix_export: value: dns triggers: - uuid: 225808c08f0a480a948d68ef43fe2d10 - expression: 'find(/DNS checks/net.dns.record[,fedoraproject.org,A],,"like","fedoraproject.org A")=0' + expression: 'find(/DNS checks/net.dns.record[,fedoraproject.org,A],,"regexp","fedoraproject.org.*A")=0' name: 'DNS query for fedoraproject.org is incorrect' priority: HIGH description: | From de6e36a4e5a6c6a15e08fc07f6fa15a9c3f97a3e Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Thu, 28 May 2026 13:28:04 +0100 Subject: [PATCH 235/269] Nagios: Remove PostgreSQL checks that we already have in Zabbix Signed-off-by: Greg Sutcliffe --- .../files/nagios/services/rdu3_internal/pgsql.cfg | 14 -------------- roles/nagios_server/tasks/main.yml | 2 -- 2 files changed, 16 deletions(-) delete mode 100644 roles/nagios_server/files/nagios/services/rdu3_internal/pgsql.cfg diff --git a/roles/nagios_server/files/nagios/services/rdu3_internal/pgsql.cfg b/roles/nagios_server/files/nagios/services/rdu3_internal/pgsql.cfg deleted file mode 100644 index 0ea186d0e8..0000000000 --- a/roles/nagios_server/files/nagios/services/rdu3_internal/pgsql.cfg +++ /dev/null @@ -1,14 +0,0 @@ -define service { - host_name db-koji01.rdu3.fedoraproject.org - service_description Check Koji DB - check_command check_pgsql!koji - use criticaltemplate -} - -define service { - host_name db-fas01.rdu3.fedoraproject.org - service_description Check FAS DB - check_command check_pgsql!fas2 - use criticaltemplate - servicegroups fas -} diff --git a/roles/nagios_server/tasks/main.yml b/roles/nagios_server/tasks/main.yml index 974b262435..613d793e6d 100644 --- a/roles/nagios_server/tasks/main.yml +++ b/roles/nagios_server/tasks/main.yml @@ -190,7 +190,6 @@ - locking.cfg - mailman.cfg - nrpe.cfg - - pgsql.cfg tags: - nagios_config - nagios_server @@ -209,7 +208,6 @@ - locking.cfg - mailman.cfg - nrpe.cfg - - pgsql.cfg tags: - nagios_config - nagios_server From 641887c8cf719e4632cfc5bcc8ff0bebb880f299 Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Thu, 28 May 2026 13:36:04 +0100 Subject: [PATCH 236/269] Zabbix: also test SSH access to the bastions from Batcave Signed-off-by: Greg Sutcliffe --- roles/batcave/files/zabbix-ssh-list.cron | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/batcave/files/zabbix-ssh-list.cron b/roles/batcave/files/zabbix-ssh-list.cron index ce9c1b7a92..7abf5d6ee8 100755 --- a/roles/batcave/files/zabbix-ssh-list.cron +++ b/roles/batcave/files/zabbix-ssh-list.cron @@ -6,7 +6,7 @@ # should probably expand it to all known-available hosts TMP_FILE=$(mktemp) -/usr/bin/ansible '*virtserver*' --list-hosts |grep -v "hosts.*:"|tr -d " " > "$TMP_FILE" +/usr/bin/ansible 'bastion:virtservers' --list-hosts |grep -v "hosts.*:"|tr -d " " > "$TMP_FILE" if [ -s "$TMP_FILE" ]; then mv "$TMP_FILE" /etc/zabbix/ssh-targets.txt From f29d91d7afe5b1b8f1107537faa87fe0d6d747bc Mon Sep 17 00:00:00 2001 From: David Kirwan Date: Thu, 28 May 2026 13:38:48 +0100 Subject: [PATCH 237/269] forgejo: runner config not being passed to the openshift secret Signed-off-by: David Kirwan --- .../forgejo/tasks/load-forgejo-runners.yaml | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/roles/openshift-apps/forgejo/tasks/load-forgejo-runners.yaml b/roles/openshift-apps/forgejo/tasks/load-forgejo-runners.yaml index 1d82f8af47..cb9e15cf0a 100644 --- a/roles/openshift-apps/forgejo/tasks/load-forgejo-runners.yaml +++ b/roles/openshift-apps/forgejo/tasks/load-forgejo-runners.yaml @@ -5,25 +5,23 @@ # releng-1: "0123...hex40" - name: Find forgejo runner definition files - ansible.builtin.find: - paths: "{{ role_path }}/runners/{{ env }}" - patterns: "*.yml" - register: _forgejo_runner_def_files + ansible.builtin.set_fact: + _forgejo_runner_def_paths: "{{ query('ansible.builtin.fileglob', role_path ~ '/runners/' ~ env ~ '/*.yml') | sort }}" - name: Build forgejo_runners from definitions and private secrets ansible.builtin.set_fact: forgejo_runners: "{{ forgejo_runners | default([]) + [_runner] }}" - loop: "{{ _forgejo_runner_def_files.files | sort(attribute='path') }}" + loop: "{{ _forgejo_runner_def_paths }}" vars: - _def: "{{ lookup('ansible.builtin.file', item.path) | from_yaml }}" + _def: "{{ lookup('ansible.builtin.file', item) | from_yaml }}" _secrets: "{{ (env == 'production') | ternary(forgejo_runner_secrets, forgejo_stg_runner_secrets) }}" _runner: "{{ _def | combine({'secret': _secrets[_def.name]}) }}" - when: _forgejo_runner_def_files.matched > 0 + when: _forgejo_runner_def_paths | length > 0 - name: Set empty forgejo_runners when no definition files exist ansible.builtin.set_fact: forgejo_runners: [] - when: _forgejo_runner_def_files.matched == 0 + when: _forgejo_runner_def_paths | length == 0 - name: Validate each runner has a secret in private vars ansible.builtin.assert: From f3a05e1b726cab6628829f6e6005c772ddec7a18 Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Thu, 28 May 2026 17:17:40 +0100 Subject: [PATCH 238/269] Zabbix: Fix cronjob that generates the SSH target list --- roles/batcave/files/zabbix-ssh-list.cron | 2 ++ 1 file changed, 2 insertions(+) diff --git a/roles/batcave/files/zabbix-ssh-list.cron b/roles/batcave/files/zabbix-ssh-list.cron index 7abf5d6ee8..d565e80f96 100755 --- a/roles/batcave/files/zabbix-ssh-list.cron +++ b/roles/batcave/files/zabbix-ssh-list.cron @@ -11,6 +11,8 @@ TMP_FILE=$(mktemp) if [ -s "$TMP_FILE" ]; then mv "$TMP_FILE" /etc/zabbix/ssh-targets.txt chmod 644 /etc/zabbix/ssh-targets.txt + # creating and moving a file breaks selinux, so set it to match a file the agent can already read + chcon --reference=/etc/zabbix/fedora.psk /etc/zabbix/ssh-targets.txt else rm -f "$TMP_FILE" fi From e73d603bd2b705a079cb0f2575c8f8bde06fe39d Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Thu, 28 May 2026 17:18:45 +0100 Subject: [PATCH 239/269] Nagios: remove SSH monitoring, Zabbix does it Signed-off-by: Greg Sutcliffe --- .../files/nagios/services/ssh.cfg | 30 ------------------- roles/nagios_server/tasks/main.yml | 1 - 2 files changed, 31 deletions(-) delete mode 100644 roles/nagios_server/files/nagios/services/ssh.cfg diff --git a/roles/nagios_server/files/nagios/services/ssh.cfg b/roles/nagios_server/files/nagios/services/ssh.cfg deleted file mode 100644 index 0bdf386632..0000000000 --- a/roles/nagios_server/files/nagios/services/ssh.cfg +++ /dev/null @@ -1,30 +0,0 @@ -define service { - hostgroup_name bastion - service_description SSH-bastion - check_command check_ssh - use defaulttemplate -} - -#define service { -# hostgroup_name buildservers -# service_description SSH -# check_command check_ssh -# use defaulttemplate -# retry_interval 5 -# max_check_attempts 12 -#} - -#define service { -# hostgroup_name autoqa -# service_description SSH -# check_command check_ssh -# use autoqatemplate -#} - -# TODO: uncomment once retrace exists again -#define service { -# hostgroup_name retrace -# service_description SSH-retrace -# check_command check_ssh -# use retracetemplate -#} diff --git a/roles/nagios_server/tasks/main.yml b/roles/nagios_server/tasks/main.yml index 613d793e6d..1c07b3664a 100644 --- a/roles/nagios_server/tasks/main.yml +++ b/roles/nagios_server/tasks/main.yml @@ -225,7 +225,6 @@ - procs.cfg - raid.cfg - smtp-mm.cfg - - ssh.cfg - swap.cfg - templates.cfg - vpn_server.cfg From a1c7d0828abe535966d4ab1ed87f4285d3216ae1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Patrik=20Polakovi=C4=8D?= Date: Thu, 28 May 2026 20:29:20 +0200 Subject: [PATCH 240/269] Fedora 42 is now End Of Life MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Patrik Polakovič --- roles/bodhi2/backend/files/new-updates-sync | 48 ---- roles/bodhi2/backend/tasks/main.yml | 2 +- .../backend/templates/koji_sync_listener.toml | 3 - roles/koji_hub/templates/hub.conf.j2 | 1 - .../pkgdb-gnome-software-collections.json | 4 +- .../templates/robosignatory.toml.j2 | 213 ------------------ vars/all/FedoraPreviousPrevious.yaml | 2 +- 7 files changed, 4 insertions(+), 269 deletions(-) diff --git a/roles/bodhi2/backend/files/new-updates-sync b/roles/bodhi2/backend/files/new-updates-sync index 4c1c86ddc2..625a08093a 100755 --- a/roles/bodhi2/backend/files/new-updates-sync +++ b/roles/bodhi2/backend/files/new-updates-sync @@ -121,54 +121,6 @@ RELEASES = {'f44': {'topic': 'fedora', {'arches': ['ppc64le', 's390x'], 'dest': os.path.join(FEDORAALTDEST, 'testing', '43', 'Everything')} ]}} - }, - 'f42': {'topic': 'fedora', - 'version': '42', - 'modules': ['fedora', 'fedora-secondary'], - 'repos': {'updates': { - 'from': 'f42-updates', - 'ostrees': [{'ref': 'fedora/42/%(arch)s/updates/silverblue', - 'dest': OSTREEDEST, - 'arches': ['x86_64', 'aarch64']}, - {'ref': 'fedora/42/%(arch)s/updates/kinoite', - 'dest': OSTREEDEST, - 'arches': ['x86_64', 'aarch64']}, - {'ref': 'fedora/42/%(arch)s/updates/sericea', - 'dest': OSTREEDEST, - 'arches': ['x86_64', 'aarch64']}, - {'ref': 'fedora/42/%(arch)s/updates/onyx', - 'dest': OSTREEDEST, - 'arches': ['x86_64', 'aarch64']}, - {'ref': 'fedora/42/%(arch)s/updates/cosmic-atomic', - 'dest': OSTREEDEST, - 'arches': ['x86_64', 'aarch64']}], - 'to': [{'arches': ['x86_64', 'aarch64', 'source'], - 'dest': os.path.join(FEDORADEST, '42', 'Everything')}, - {'arches': ['ppc64le', 's390x'], - 'dest': os.path.join(FEDORAALTDEST, '42', 'Everything')} - ]}, - 'updates-testing': { - 'from': 'f42-updates-testing', - 'ostrees': [{'ref': 'fedora/42/%(arch)s/testing/silverblue', - 'dest': OSTREEDEST, - 'arches': ['x86_64', 'aarch64']}, - {'ref': 'fedora/42/%(arch)s/testing/kinoite', - 'dest': OSTREEDEST, - 'arches': ['x86_64', 'aarch64']}, - {'ref': 'fedora/42/%(arch)s/testing/sericea', - 'dest': OSTREEDEST, - 'arches': ['x86_64', 'aarch64']}, - {'ref': 'fedora/42/%(arch)s/testing/onyx', - 'dest': OSTREEDEST, - 'arches': ['x86_64', 'aarch64']}, - {'ref': 'fedora/42/%(arch)s/testing/cosmic-atomic', - 'dest': OSTREEDEST, - 'arches': ['x86_64', 'aarch64']}], - 'to': [{'arches': ['x86_64', 'aarch64', 'source'], - 'dest': os.path.join(FEDORADEST, 'testing', '42', 'Everything')}, - {'arches': ['ppc64le', 's390x'], - 'dest': os.path.join(FEDORAALTDEST, 'testing', '42', 'Everything')} - ]}} }, 'epel10.3': {'topic': 'epel', 'version': '10.3', diff --git a/roles/bodhi2/backend/tasks/main.yml b/roles/bodhi2/backend/tasks/main.yml index de03b5c1e9..04a464a378 100644 --- a/roles/bodhi2/backend/tasks/main.yml +++ b/roles/bodhi2/backend/tasks/main.yml @@ -116,7 +116,7 @@ # bodhi2/backend/files/koji_sync_listener.py # This cronjob runs only once a day. The listener script runs reactively. cron: name="owner-sync" minute="15" hour="4" user="root" - job="/usr/local/bin/lock-wrapper owner-sync '/usr/local/bin/owner-sync-pagure f45 f44 f43 f42 {{ epel_tags | join(' ') }} epel9 epel9-next epel8'" + job="/usr/local/bin/lock-wrapper owner-sync '/usr/local/bin/owner-sync-pagure f45 f44 f43 {{ epel_tags | join(' ') }} epel9 epel9-next epel8'" cron_file=update-koji-owner user=apache when: env == "production" diff --git a/roles/bodhi2/backend/templates/koji_sync_listener.toml b/roles/bodhi2/backend/templates/koji_sync_listener.toml index 7e124c9cd2..877a31208a 100644 --- a/roles/bodhi2/backend/templates/koji_sync_listener.toml +++ b/roles/bodhi2/backend/templates/koji_sync_listener.toml @@ -43,9 +43,6 @@ taglist = [ "f43", "f43-container", "f43-flatpak", - "f42", - "f42-container", - "f42-flatpak", {% for tag in epel_tags %} "{{ tag }}", {% endfor %} diff --git a/roles/koji_hub/templates/hub.conf.j2 b/roles/koji_hub/templates/hub.conf.j2 index af8ea40c5a..05f34eadfe 100644 --- a/roles/koji_hub/templates/hub.conf.j2 +++ b/roles/koji_hub/templates/hub.conf.j2 @@ -249,7 +249,6 @@ sidetag = tag f45-build :: allow tag f44-build :: allow tag f43-build :: allow - tag f42-build :: allow tag eln-build :: allow {% for tag in epel_tags %} tag {{ tag }}-build :: allow diff --git a/roles/pkgdb-proxy/files/pkgdb-gnome-software-collections.json b/roles/pkgdb-proxy/files/pkgdb-gnome-software-collections.json index 5bed8416ac..b9776c0dad 100644 --- a/roles/pkgdb-proxy/files/pkgdb-gnome-software-collections.json +++ b/roles/pkgdb-proxy/files/pkgdb-gnome-software-collections.json @@ -37,11 +37,11 @@ "allow_retire": true, "branchname": "f42", "date_created": "2024-05-14 12:36:15", - "date_updated": "2025-02-04 14:07:23", + "date_updated": "2026-05-28 14:07:23", "dist_tag": ".fc42", "koji_name": "f42", "name": "Fedora Linux", - "status": "Active", + "status": "EOL", "version": "42" }, { diff --git a/roles/robosignatory/templates/robosignatory.toml.j2 b/roles/robosignatory/templates/robosignatory.toml.j2 index e83ce598b0..f0c3d56888 100644 --- a/roles/robosignatory/templates/robosignatory.toml.j2 +++ b/roles/robosignatory/templates/robosignatory.toml.j2 @@ -112,13 +112,6 @@ handlers = ["console"] key = "{{ (env == 'production')|ternary('fedora-infra', 'testkey') }}" keyid = "{{ (env == 'production')|ternary('47dd8ef9', 'd300e724') }}" - [[consumer_config.koji_instances.primary.tags]] - from = "f42-infra-candidate" - to = "f42-infra-stg" - key = "{{ (env == 'production')|ternary('fedora-infra', 'testkey') }}" - keyid = "{{ (env == 'production')|ternary('47dd8ef9', 'd300e724') }}" - file_signing_key = "fedora-42-ima" - [[consumer_config.koji_instances.primary.tags]] from = "f43-infra-candidate" to = "f43-infra-stg" @@ -142,13 +135,6 @@ handlers = ["console"] # Gated coreos-pool tag - [[consumer_config.koji_instances.primary.tags]] - from = "f42-coreos-signing-pending" - to = "coreos-pool" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - keyid = "{{ (env == 'production')|ternary('105ef944', 'd300e724') }}" - file_signing_key = "fedora-42-ima" - [[consumer_config.koji_instances.primary.tags]] from = "f43-coreos-signing-pending" to = "coreos-pool" @@ -232,20 +218,6 @@ handlers = ["console"] trusted_taggers = ['bodhi'] file_signing_key = "fedora-43-ima" - [[consumer_config.koji_instances.primary.tags]] - from = "f42-signing-pending" - to = "f42-updates-testing-pending" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - keyid = "{{ (env == 'production')|ternary('105ef944', 'd300e724') }}" - file_signing_key = "fedora-42-ima" - - [consumer_config.koji_instances.primary.tags.sidetags] - pattern = 'f42-build-side-' - from = '-signing-pending' - to = '-testing-pending' - trusted_taggers = ['bodhi'] - file_signing_key = "fedora-42-ima" - # Gated bodhi updates {% for tag in epel_tags %} @@ -363,13 +335,6 @@ handlers = ["console"] keyid = "{{ (env == 'production')|ternary('31645531', 'd300e724') }}" file_signing_key = "fedora-43-ima" - [[consumer_config.koji_instances.primary.tags]] - from = "f42-openh264" - to = "f42-openh264" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - keyid = "{{ (env == 'production')|ternary('105ef944', 'd300e724') }}" - file_signing_key = "fedora-42-ima" - [[consumer_config.koji_instances.primary.tags]] from = "epel9-openh264" to = "epel9-openh264" @@ -418,44 +383,6 @@ handlers = ["console"] directory = "/mnt/fedora_koji/koji/compose/iot/repo/" key = "{{ (env == 'production')|ternary('fedora-44', 'testkey') }}" - # f42 silveblue ostree refs - - [consumer_config.ostree_refs."fedora/42/x86_64/silverblue"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/aarch64/silverblue"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/ppc64le/silverblue"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/x86_64/updates/silverblue"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/x86_64/testing/silverblue"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/aarch64/updates/silverblue"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/aarch64/testing/silverblue"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/ppc64le/updates/silverblue"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/ppc64le/testing/silverblue"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - # f43 silveblue ostree refs [consumer_config.ostree_refs."fedora/43/x86_64/silverblue"] @@ -546,44 +473,6 @@ handlers = ["console"] directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" key = "{{ (env == 'production')|ternary('fedora-45', 'testkey') }}" - # f42 kinoite ostree refs - - [consumer_config.ostree_refs."fedora/42/x86_64/kinoite"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/aarch64/kinoite"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/ppc64le/kinoite"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/x86_64/updates/kinoite"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/x86_64/testing/kinoite"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/aarch64/updates/kinoite"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/aarch64/testing/kinoite"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/ppc64le/updates/kinoite"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/ppc64le/testing/kinoite"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - # f43 kinoite ostree refs [consumer_config.ostree_refs."fedora/43/x86_64/kinoite"] @@ -674,44 +563,6 @@ handlers = ["console"] directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" key = "{{ (env == 'production')|ternary('fedora-45', 'testkey') }}" - # f42 sericea ostree refs - - [consumer_config.ostree_refs."fedora/42/x86_64/sericea"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/aarch64/sericea"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/ppc64le/sericea"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/x86_64/updates/sericea"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/x86_64/testing/sericea"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/aarch64/updates/sericea"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/aarch64/testing/sericea"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/ppc64le/updates/sericea"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/ppc64le/testing/sericea"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - # f43 sericea ostree refs [consumer_config.ostree_refs."fedora/43/x86_64/sericea"] @@ -802,44 +653,6 @@ handlers = ["console"] directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" key = "{{ (env == 'production')|ternary('fedora-45', 'testkey') }}" - # f42 onyx ostree refs - - [consumer_config.ostree_refs."fedora/42/x86_64/onyx"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/aarch64/onyx"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/ppc64le/onyx"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/x86_64/updates/onyx"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/x86_64/testing/onyx"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/aarch64/updates/onyx"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/aarch64/testing/onyx"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/ppc64le/updates/onyx"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/ppc64le/testing/onyx"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - # f43 onyx ostree refs [consumer_config.ostree_refs."fedora/43/x86_64/onyx"] @@ -930,32 +743,6 @@ handlers = ["console"] directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" key = "{{ (env == 'production')|ternary('fedora-45', 'testkey') }}" - # f42 cosmic-atomic ostree refs - - [consumer_config.ostree_refs."fedora/42/x86_64/cosmic-atomic"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/aarch64/cosmic-atomic"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/x86_64/updates/cosmic-atomic"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/x86_64/testing/cosmic-atomic"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/aarch64/updates/cosmic-atomic"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/aarch64/testing/cosmic-atomic"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - # f43 cosmic-atomic ostree refs [consumer_config.ostree_refs."fedora/43/x86_64/cosmic-atomic"] diff --git a/vars/all/FedoraPreviousPrevious.yaml b/vars/all/FedoraPreviousPrevious.yaml index af1e22a3b2..519608fa95 100644 --- a/vars/all/FedoraPreviousPrevious.yaml +++ b/vars/all/FedoraPreviousPrevious.yaml @@ -1,2 +1,2 @@ --- -FedoraPreviousPrevious: True +FedoraPreviousPrevious: False From 177bb004420f9b4e52548f8f86da33795fca4916 Mon Sep 17 00:00:00 2001 From: Lenka Segura Date: Thu, 28 May 2026 16:53:52 +0200 Subject: [PATCH 241/269] forgejo: strip the labels after ':' during registration Signed-off-by: Lenka Segura --- roles/openshift-apps/forgejo/tasks/register-runners.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/forgejo/tasks/register-runners.yaml b/roles/openshift-apps/forgejo/tasks/register-runners.yaml index 53b29c2680..1dc9446cd8 100644 --- a/roles/openshift-apps/forgejo/tasks/register-runners.yaml +++ b/roles/openshift-apps/forgejo/tasks/register-runners.yaml @@ -14,7 +14,7 @@ kubernetes.core.k8s_exec: namespace: forgejo pod: "{{ forgejo_pods.resources[0].metadata.name }}" - command: "forgejo forgejo-cli actions register --name {{ item['name'] }} --labels {{ item['labels'] | join(',') }} --secret {{ item['secret'] }}{{ ' --scope ' + item['scope'] if item['scope'] is defined and item['scope'] != 'global' else '' }}" + command: "forgejo forgejo-cli actions register --name {{ item['name'] }} --labels {{ item['labels'] | map('regex_replace', ':.*', '') | join(',') }} --secret {{ item['secret'] }}{{ ' --scope ' + item['scope'] if item['scope'] is defined and item['scope'] != 'global' else '' }}" loop: "{{ forgejo_runners }}" register: forgejo_cli_outputs failed_when: >- From 9d572f18390cb5f1860945cadbdbe7988c8409b7 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Thu, 28 May 2026 16:20:15 -0700 Subject: [PATCH 242/269] add coreos-agent, rag-magazine-guidelines, and public-inboc-poc communishift projects Signed-off-by: Kevin Fenzi --- inventory/group_vars/all | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/inventory/group_vars/all b/inventory/group_vars/all index fc64cac7bb..8d18b74cb0 100644 --- a/inventory/group_vars/all +++ b/inventory/group_vars/all @@ -67,6 +67,13 @@ communishift_projects: name: communishift-release-schedule-planner communishift-draft-share: name: communishift-draft-share + communishift-coreos-agent: + name: communishift-coreos-agent + communishift-rag-magazine-guidelines: + name: communishift-rag-magazine-guidelines + storage_requests: 15Gi + communishift-public-inbox-poc + name: communishift-public-inbox-poc # true or false if we are or are not a copr build virthost. # Default to false copr_build_virthost: false From 6a767b3706f0b79f07b65c1486425619245815a2 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Thu, 28 May 2026 16:21:54 -0700 Subject: [PATCH 243/269] always a missing : Signed-off-by: Kevin Fenzi --- inventory/group_vars/all | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/inventory/group_vars/all b/inventory/group_vars/all index 8d18b74cb0..8302bf27ee 100644 --- a/inventory/group_vars/all +++ b/inventory/group_vars/all @@ -72,7 +72,7 @@ communishift_projects: communishift-rag-magazine-guidelines: name: communishift-rag-magazine-guidelines storage_requests: 15Gi - communishift-public-inbox-poc + communishift-public-inbox-poc: name: communishift-public-inbox-poc # true or false if we are or are not a copr build virthost. # Default to false From 9a5bca7aadf3f242968b5956749b06a1133f0586 Mon Sep 17 00:00:00 2001 From: Pavel Raiskup Date: Fri, 29 May 2026 13:49:59 +0200 Subject: [PATCH 244/269] copr-dist-git: hotfix https://github.com/fedora-copr/copr/issues/4318 --- .../0001-import-file-with-slash-in-name.patch | 37 +++++++++++++++++++ roles/copr/dist_git/tasks/main.yml | 6 +++ 2 files changed, 43 insertions(+) create mode 100644 roles/copr/dist_git/files/patches/0001-import-file-with-slash-in-name.patch diff --git a/roles/copr/dist_git/files/patches/0001-import-file-with-slash-in-name.patch b/roles/copr/dist_git/files/patches/0001-import-file-with-slash-in-name.patch new file mode 100644 index 0000000000..37e123db5c --- /dev/null +++ b/roles/copr/dist_git/files/patches/0001-import-file-with-slash-in-name.patch @@ -0,0 +1,37 @@ +Hot-fix for https://github.com/fedora-copr/copr/issues/4318 + +Can be dropped once upstream deploys: https://pagure.io/rpkg/pull-request/777 + +diff --git a/pyrpkg/__init__.py b/pyrpkg/__init__.py +index 46ca599..7e923d1 100644 +--- a/pyrpkg/__init__.py ++++ b/pyrpkg/__init__.py +@@ -2069,17 +2069,14 @@ class Commands(object): + '.fmf/*', '*.fmf', 'changelog'] + + # Get a list of files we're currently tracking +- ourfiles = self.repo.git.ls_files().split('\n') +- if ourfiles == ['']: +- # Repository doesn't contain any files +- ourfiles = [] +- else: +- # Trim out sources and .gitignore +- for file in ('.gitignore', 'sources'): +- try: +- ourfiles.remove(file) +- except ValueError: +- pass ++ ourfiles = self.repo.git.ls_files('-z').rstrip('\0') ++ ourfiles = ourfiles.split('\0') if ourfiles else [] ++ # Trim out sources and .gitignore ++ for file in ('.gitignore', 'sources'): ++ try: ++ ourfiles.remove(file) ++ except ValueError: ++ pass + + # Things work better if we're in our repository directory + oldpath = os.getcwd() +-- +2.54.0 + diff --git a/roles/copr/dist_git/tasks/main.yml b/roles/copr/dist_git/tasks/main.yml index 84b7bac803..54dd87025a 100644 --- a/roles/copr/dist_git/tasks/main.yml +++ b/roles/copr/dist_git/tasks/main.yml @@ -32,6 +32,12 @@ - dist-git-selinux - copr-dist-git +- name: Patch https://github.com/fedora-copr/copr/issues/4318 + patch: + src: patches/0001-import-file-with-slash-in-name.patch + dest: /usr/lib/python3.14/site-packages/pyrpkg/__init__.py + tags: patches + - name: Switch selinux to enforcing selinux: policy=targeted state=enforcing From 63315f460241bc255ee9b5c25370b66740fd694e Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 29 May 2026 10:10:44 -0700 Subject: [PATCH 245/269] proxy12: reinstall with f44 We need to do this anyhow, but this will test to see if the weird alerts we have been getting persist on f44 with the latest libvirt machine setup. Signed-off-by: Kevin Fenzi --- inventory/host_vars/proxy12.fedoraproject.org | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/inventory/host_vars/proxy12.fedoraproject.org b/inventory/host_vars/proxy12.fedoraproject.org index af895c509f..7f0cc3bf81 100644 --- a/inventory/host_vars/proxy12.fedoraproject.org +++ b/inventory/host_vars/proxy12.fedoraproject.org @@ -13,7 +13,7 @@ eth0_ipv6_nm: 64 freezes: true has_ipv4: yes has_ipv6: yes -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/43/Server/x86_64/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/x86_64/os/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora mac0: "52:54:00:84:5d:9f" main_bridge: br0 @@ -40,7 +40,7 @@ network_connections: type: ethernet nrpe_procs_crit: 1400 nrpe_procs_warn: 1200 -num_cpus: 8 +num_cpus: 16 postfix_group: vpn public_hostname: proxy12.fedoraproject.org # This is consumed by the roles/fedora-web/main role From 141940d1ad6552c05d29141191a1a6a2e4df4aea Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 29 May 2026 10:41:46 -0700 Subject: [PATCH 246/269] basessh: allow tcp forwarding on noc as well as bastion. We sometimes use forwarding here to access mgmt devices. Signed-off-by: Kevin Fenzi --- roles/basessh/templates/sshd_config.j2 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/basessh/templates/sshd_config.j2 b/roles/basessh/templates/sshd_config.j2 index 3bb3d5f71e..fdb4eca656 100644 --- a/roles/basessh/templates/sshd_config.j2 +++ b/roles/basessh/templates/sshd_config.j2 @@ -40,8 +40,8 @@ UsePAM yes AllowAgentForwarding no X11Forwarding no PermitTunnel no -{% if ansible_hostname.startswith(('bastion')) %} -# This is a bastion host, we need tcp forwarding here. +{% if ansible_hostname.startswith(('bastion')) or ansible_hostname.startswith(('noc')) %} +# This is a bastion or noc host, we need tcp forwarding there. AllowTcpForwarding yes {% else %} AllowTcpForwarding no From 1be1c69f0feddef89e0f7d7714d0127aec740637 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 29 May 2026 10:52:26 -0700 Subject: [PATCH 247/269] proxy12: fix mac address This had the hard coded mac address of the previous vm. We moved to using ansible to just fill in the current mac, so fix that here too. Signed-off-by: Kevin Fenzi --- inventory/host_vars/proxy12.fedoraproject.org | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/inventory/host_vars/proxy12.fedoraproject.org b/inventory/host_vars/proxy12.fedoraproject.org index 7f0cc3bf81..874a7fa91b 100644 --- a/inventory/host_vars/proxy12.fedoraproject.org +++ b/inventory/host_vars/proxy12.fedoraproject.org @@ -15,7 +15,6 @@ has_ipv4: yes has_ipv6: yes ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/x86_64/os/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora -mac0: "52:54:00:84:5d:9f" main_bridge: br0 max_mem_size: 20000 mem_size: 16384 @@ -35,7 +34,7 @@ network_connections: - "{{ dns_search2 }}" gateway4: "{{ eth0_ipv4_gw }}" gateway6: "{{ eth0_ipv6_gw }}" - mac: "{{ mac0 }}" + mac: "{{ ansible_default_ipv4.macaddress }}" name: eth0 type: ethernet nrpe_procs_crit: 1400 From 06c765b10dc29641ce3bc5964a417ac40801baab Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 29 May 2026 11:24:25 -0700 Subject: [PATCH 248/269] buildvm-x86: reinstall with fedora 44 Signed-off-by: Kevin Fenzi --- inventory/group_vars/buildvm_stg | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/inventory/group_vars/buildvm_stg b/inventory/group_vars/buildvm_stg index 4bc1c93cd1..57a7b41248 100644 --- a/inventory/group_vars/buildvm_stg +++ b/inventory/group_vars/buildvm_stg @@ -18,7 +18,7 @@ koji_topurl: "https://kojipkgs.stg.fedoraproject.org/" # Groups and individual hosts should ovveride them with specific info. koji_weburl: "https://koji.stg.fedoraproject.org/koji" -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/43/Server/x86_64/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/x86_64/os/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora lvm_size: 150000 max_mem_size: "{{ mem_size }}" From 0248c0d535f68dba848de1d0f9f95252046b85c6 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 29 May 2026 11:26:08 -0700 Subject: [PATCH 249/269] virthost: rkhunter is available in epel10/10.2 Signed-off-by: Kevin Fenzi --- playbooks/groups/virthost.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/playbooks/groups/virthost.yml b/playbooks/groups/virthost.yml index 58170976ca..ab1e317421 100644 --- a/playbooks/groups/virthost.yml +++ b/playbooks/groups/virthost.yml @@ -39,7 +39,7 @@ roles: - base - - {role: rkhunter, when: ansible_distribution_major_version|int < 10} + - role: rkhunter - role: nagios_client - zabbix/zabbix_agent - hosts From 71aec6a544dfd67f6b64d00bb05b0ab4d6152829 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 29 May 2026 12:23:51 -0700 Subject: [PATCH 250/269] Move s390x staging builders and koji.stg hub to f44. Signed-off-by: Kevin Fenzi --- inventory/group_vars/buildvm_ppc64le_stg | 2 +- inventory/group_vars/buildvm_s390x_stg | 2 +- inventory/host_vars/koji01.stg.rdu3.fedoraproject.org | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/inventory/group_vars/buildvm_ppc64le_stg b/inventory/group_vars/buildvm_ppc64le_stg index b808743da2..bb1c08a0e9 100644 --- a/inventory/group_vars/buildvm_ppc64le_stg +++ b/inventory/group_vars/buildvm_ppc64le_stg @@ -18,7 +18,7 @@ koji_topurl: "https://kojipkgs.stg.fedoraproject.org/" # Groups and individual hosts should ovveride them with specific info. koji_weburl: "https://koji.stg.fedoraproject.org/koji" -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora-secondary/releases/43/Server/ppc64le/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora-secondary/releases/44/Server/ppc64le/os/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora lvm_size: 150000 main_bridge: br0 diff --git a/inventory/group_vars/buildvm_s390x_stg b/inventory/group_vars/buildvm_s390x_stg index ca78ce5723..fcfe3076a6 100644 --- a/inventory/group_vars/buildvm_s390x_stg +++ b/inventory/group_vars/buildvm_s390x_stg @@ -13,7 +13,7 @@ koji_server_url: "https://koji.stg.fedoraproject.org/kojihub" koji_instance: "primary" koji_topurl: "https://kojipkgs.stg.fedoraproject.org/" koji_weburl: "https://koji.stg.fedoraproject.org/koji" -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora-secondary/releases/43/Server/s390x/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora-secondary/releases/44/Server/s390x/os/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora-s390x virt_install_command: "{{ virt_install_command_s390x_one_nic_unsafe }}" lvm_size: 100000 diff --git a/inventory/host_vars/koji01.stg.rdu3.fedoraproject.org b/inventory/host_vars/koji01.stg.rdu3.fedoraproject.org index c05a1aebb2..744acaae55 100644 --- a/inventory/host_vars/koji01.stg.rdu3.fedoraproject.org +++ b/inventory/host_vars/koji01.stg.rdu3.fedoraproject.org @@ -6,7 +6,7 @@ koji_instance: primary koji_server_url: "https://koji.stg.fedoraproject.org/kojihub" koji_topurl: "https://kojipkgs.stg.fedoraproject.org/" koji_weburl: "https://koji.stg.fedoraproject.org/koji" -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/43/Server/x86_64/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/x86_64/os/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora lvm_size: 1.5t nrpe_procs_crit: 1000 From 8bbcceafdd2609d36b40699ae982e3589a9d0bf7 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sat, 30 May 2026 08:36:39 -0700 Subject: [PATCH 251/269] proxies: bump max connections fromm 3200 to 4000 It seems like the alerts we have been getting have been when proxies are near the limit rejecting things via anubis, but unable to keep up. So, lets try and jump this up a bit and see if it solves those alerts/slowdowns. Signed-off-by: Kevin Fenzi --- inventory/group_vars/proxies | 4 +++- inventory/group_vars/proxies_stg | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/inventory/group_vars/proxies b/inventory/group_vars/proxies index ad47e2decf..3984cea0e4 100644 --- a/inventory/group_vars/proxies +++ b/inventory/group_vars/proxies @@ -132,7 +132,9 @@ ipa_host_group_desc: Proxies between internal hosts and the Internet lvm_size: 100000 # This is used in the httpd.conf to determine the value for serverlimit and # maxrequestworkers. On proxies with 8 cpus it should be 300 * 8 = 3200 -maxrequestworkers: 3200 +# However, due to lots of very transitory connections, bumping up to 4000 +# to give some head room. +maxrequestworkers: 4000 mem_size: 8192 nagios_Check_Services: swap: false diff --git a/inventory/group_vars/proxies_stg b/inventory/group_vars/proxies_stg index f3bbd7020f..3e020a7b6f 100644 --- a/inventory/group_vars/proxies_stg +++ b/inventory/group_vars/proxies_stg @@ -63,7 +63,9 @@ ipa_host_group_desc: Proxies between internal hosts and the Internet lvm_size: 100000 # This is used in the httpd.conf to determine the value for serverlimit and # maxrequestworkers. On proxies with 8 cpus it should be 300 * 8 = 3200 -maxrequestworkers: 3200 +# However, due to lots of very transitory connections, bumping up to 4000 +# to give some head room. +maxrequestworkers: 4000 mem_size: 49152 num_cpus: 8 ocp_masters_stg: From 615af75669e0a5bb6179404751980680399a334f Mon Sep 17 00:00:00 2001 From: Pavel Raiskup Date: Mon, 1 Jun 2026 09:26:54 +0200 Subject: [PATCH 252/269] copr-be: more quota per sandbox --- roles/copr/backend/templates/copr-be.conf.j2 | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/roles/copr/backend/templates/copr-be.conf.j2 b/roles/copr/backend/templates/copr-be.conf.j2 index bd21332638..562b8b2caa 100644 --- a/roles/copr/backend/templates/copr-be.conf.j2 +++ b/roles/copr/backend/templates/copr-be.conf.j2 @@ -70,7 +70,11 @@ builds_max_workers_owner=0 # Maximum number of concurrently running tasks per build sandbox. {% if env == 'production' %} -builds_max_workers_sandbox=35 +# Do not increase this number without cross-team discussion. Further increases +# will have consequences (individuals stealing majority of machines). +# Long-term, we should implement a dynamic quota system (e.g., something that +# analyzes the structure of the queue). +builds_max_workers_sandbox=50 {% else %} builds_max_workers_sandbox=4 {% endif %} From d830f9ae6e96353cf4d981469f179ca42d299adc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20Such=C3=BD?= Date: Mon, 1 Jun 2026 09:54:15 +0200 Subject: [PATCH 253/269] copr: bump up number of reserved instances --- inventory/group_vars/copr_aws | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/inventory/group_vars/copr_aws b/inventory/group_vars/copr_aws index db4fb0dcf3..a516f30973 100644 --- a/inventory/group_vars/copr_aws +++ b/inventory/group_vars/copr_aws @@ -19,12 +19,12 @@ backend_base_url: "https://download.copr.fedorainfracloud.org" builders: # max|spawn_concurrently|prealloc aws: - aarch64: [8, 2, 1] - x86_64: [50, 10, 20] + aarch64: [50, 10, 1] + x86_64: [50, 10, 1] # put here the number -1 of the actuall reserved instances aws_reserved: - aarch64: [50, 20, 33] - x86_64: [70, 20, 52] + aarch64: [55, 20, 55] + x86_64: [70, 20, 70] aws_reserved_powerful: x86_64: [2, 2, 2] aws_powerful: From c6f7e6e601bdefe6a9e3fae7cc01a483788dd5d1 Mon Sep 17 00:00:00 2001 From: Samyak Jain Date: Mon, 1 Jun 2026 14:12:09 +0530 Subject: [PATCH 254/269] Update Bodhi Pungi comps git URL from pagure.io to forge.fedoraproject.org/releng/fedora-comps after the fedora-comps migration Signed-off-by: Samyak Jain --- roles/bodhi2/backend/templates/pungi.rpm.conf.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/bodhi2/backend/templates/pungi.rpm.conf.j2 b/roles/bodhi2/backend/templates/pungi.rpm.conf.j2 index 4d762624f9..f345811ce8 100644 --- a/roles/bodhi2/backend/templates/pungi.rpm.conf.j2 +++ b/roles/bodhi2/backend/templates/pungi.rpm.conf.j2 @@ -24,7 +24,7 @@ release_short = '[[ release.id_prefix.title() ]]' # GENERAL SETTINGS comps_file = { 'scm': 'git', - 'repo': 'https://pagure.io/fedora-comps.git', + 'repo': 'https://forge.fedoraproject.org/releng/fedora-comps.git', 'branch': 'main', # defaults to cvs/HEAD or git/main [% if release.id_prefix == 'FEDORA-EPEL' %] 'file': 'comps-epel[[ release.version | int ]].xml', From c8a55f0113fccc5b350beb1b22c5da451d68e1fe Mon Sep 17 00:00:00 2001 From: Lenka Segura Date: Fri, 29 May 2026 12:42:37 +0200 Subject: [PATCH 255/269] forgejo: Increase the capacity of 'ci' and 'atomic-desktops' runners Signed-off-by: Lenka Segura --- .../forgejo/runners/production/atomic-desktops-1.yml | 1 + roles/openshift-apps/forgejo/runners/production/ci-1.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/roles/openshift-apps/forgejo/runners/production/atomic-desktops-1.yml b/roles/openshift-apps/forgejo/runners/production/atomic-desktops-1.yml index 951400d19d..5605f9270a 100644 --- a/roles/openshift-apps/forgejo/runners/production/atomic-desktops-1.yml +++ b/roles/openshift-apps/forgejo/runners/production/atomic-desktops-1.yml @@ -5,3 +5,4 @@ labels: - "docker:docker://node:22-bookworm" - "docker-slim:docker://node:22-alpine" image: code.forgejo.org/forgejo/runner:11 +capacity: 20 diff --git a/roles/openshift-apps/forgejo/runners/production/ci-1.yml b/roles/openshift-apps/forgejo/runners/production/ci-1.yml index 327be38fa3..0755f453a5 100644 --- a/roles/openshift-apps/forgejo/runners/production/ci-1.yml +++ b/roles/openshift-apps/forgejo/runners/production/ci-1.yml @@ -5,3 +5,4 @@ labels: - "docker:docker://node:22-bookworm" - "docker-slim:docker://node:22-alpine" image: code.forgejo.org/forgejo/runner:11 +capacity: 20 From 259ec5b2e87a26526f40b1a463ea2354489013f3 Mon Sep 17 00:00:00 2001 From: Jiri Kyjovsky Date: Mon, 1 Jun 2026 17:21:57 +0200 Subject: [PATCH 256/269] copr-be: enable rpmeta build time prediction (observability-only) Deploy rpmeta config to copr-be.conf and hardware pools YAML with real builder specs. Initially logging-only, does not affect VM allocation. --- inventory/group_vars/copr_back_aws | 3 ++ inventory/group_vars/copr_back_dev_aws | 3 ++ roles/copr/backend/tasks/main.yml | 13 ++++++ roles/copr/backend/templates/copr-be.conf.j2 | 7 ++++ .../backend/templates/rpmeta-hw-pools.yaml.j2 | 40 +++++++++++++++++++ 5 files changed, 66 insertions(+) create mode 100644 roles/copr/backend/templates/rpmeta-hw-pools.yaml.j2 diff --git a/inventory/group_vars/copr_back_aws b/inventory/group_vars/copr_back_aws index ade4ed605f..20c93fb26d 100644 --- a/inventory/group_vars/copr_back_aws +++ b/inventory/group_vars/copr_back_aws @@ -53,6 +53,9 @@ copr_backend_data_2_raid1_volumes: - nvme-Amazon_Elastic_Block_Store_vol0f226a7163d28d8fd-part1 - nvme-Amazon_Elastic_Block_Store_vol07293869d85a750b8-part1 +rpmeta_enabled: true +rpmeta_hostname: rpmeta.fedoraproject.org + notes: | Provide the backend for copr (3rd party packages) * Backend: Management of copr cloud infrastructure (OpenStack). diff --git a/inventory/group_vars/copr_back_dev_aws b/inventory/group_vars/copr_back_dev_aws index e6b8d38f34..77d4e14994 100644 --- a/inventory/group_vars/copr_back_dev_aws +++ b/inventory/group_vars/copr_back_dev_aws @@ -49,6 +49,9 @@ copr_backend_data_2_raid1_volumes: - nvme-Amazon_Elastic_Block_Store_vol0ce8220e998e2e32a-part1 - nvme-Amazon_Elastic_Block_Store_vol0038e042c49987b82-part1 +rpmeta_enabled: true +rpmeta_hostname: rpmeta.stg.fedoraproject.org + notes: | Provide the testing environment of copr's backend This host is the testing environment for the cloud infrastructure of copr's backend diff --git a/roles/copr/backend/tasks/main.yml b/roles/copr/backend/tasks/main.yml index 417ff01704..7aa2aade4b 100644 --- a/roles/copr/backend/tasks/main.yml +++ b/roles/copr/backend/tasks/main.yml @@ -273,6 +273,19 @@ - copr_infrastructure_password - provision_config +- name: Deploy rpmeta HW pools config + ansible.builtin.template: + src: rpmeta-hw-pools.yaml.j2 + dest: /etc/copr/rpmeta-hw-pools.yaml + owner: root + group: copr + mode: "0640" + when: rpmeta_enabled | default(false) | bool and rpmeta_hostname is defined + notify: + - Restart copr-backend + tags: + - config + - name: Create messaging config directory ansible.builtin.file: dest=/etc/copr/msgbuses state=directory owner=copr group=copr mode=0700 when: copr_messaging diff --git a/roles/copr/backend/templates/copr-be.conf.j2 b/roles/copr/backend/templates/copr-be.conf.j2 index 562b8b2caa..88f4d3431c 100644 --- a/roles/copr/backend/templates/copr-be.conf.j2 +++ b/roles/copr/backend/templates/copr-be.conf.j2 @@ -122,6 +122,13 @@ pulp_content_url={{ pulp_content_url }} sentry_dsn={{ copr_sentry_dsn }} {% endif %} +{% if rpmeta_enabled | default(false) | bool and rpmeta_hostname is defined %} +rpmeta_enabled=true +rpmeta_url=https://{{ rpmeta_hostname }} +rpmeta_timeout={{ rpmeta_timeout | default(5) }} +rpmeta_hw_pools_config=/etc/copr/rpmeta-hw-pools.yaml +{% endif %} + [builder] # default is 1800, this probably has no effect! diff --git a/roles/copr/backend/templates/rpmeta-hw-pools.yaml.j2 b/roles/copr/backend/templates/rpmeta-hw-pools.yaml.j2 new file mode 100644 index 0000000000..af98f40203 --- /dev/null +++ b/roles/copr/backend/templates/rpmeta-hw-pools.yaml.j2 @@ -0,0 +1,40 @@ +# Hardware specs of base builder machines per architecture. +# Used by copr-backend to call rpmeta with the correct HW info. +# Update when builder instance types change. +# +# x86_64: AWS c7i.xlarge (4 vCPU / 7.6 GiB / 143 GiB swap) +# aarch64: AWS c7g.xlarge (4 vCPU / 7.6 GiB / 143 GiB swap) +# ppc64le: POWER9 hypervisors in Fedora Community Cage (5 cores / 15 GiB / 140 GiB swap) +# s390x: IBM Cloud z15 (2 vCPU / 7.8 GiB / 143 GiB swap) + +x86_64: + cpu_model_name: "Intel(R) Xeon(R) Platinum 8488C" + cpu_arch: "x86_64" + cpu_model: "143" + cpu_cores: 4 + ram: 7.6 + swap: 143.0 + +aarch64: + cpu_model_name: "Neoverse-V1" + cpu_arch: "aarch64" + cpu_model: "1" + cpu_cores: 4 + ram: 7.6 + swap: 143.0 + +ppc64le: + cpu_model_name: "POWER9 (architected), altivec supported" + cpu_arch: "ppc64le" + cpu_model: "2.2 (pvr 004e 1202)" + cpu_cores: 5 + ram: 15.0 + swap: 140.0 + +s390x: + cpu_model_name: "IBM z15" + cpu_arch: "s390x" + cpu_model: "8562" + cpu_cores: 2 + ram: 7.8 + swap: 143.0 From ce1edea8ee5dc5a45037086e80fa6c3bf062b8e0 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Mon, 1 Jun 2026 09:56:58 -0700 Subject: [PATCH 257/269] distgit: fix the ca cert the git hooks use for fedora-messaging We were copying in the req instead of the ca, so this messaging hook has been broken for a long while. This is the hook that notifys on uploads. Signed-off-by: Kevin Fenzi --- roles/distgit/tasks/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/distgit/tasks/main.yml b/roles/distgit/tasks/main.yml index 1c1f78375b..31d08a329a 100644 --- a/roles/distgit/tasks/main.yml +++ b/roles/distgit/tasks/main.yml @@ -202,7 +202,7 @@ owner: root group: root mode: "440" - - src: "{{ private }}/files/rabbitmq/production/pki/reqs/git-hooks.req" + - src: "{{ private }}/files/rabbitmq/production/pki/ca.crt" dest: git-hooks.ca owner: root group: root From a0156fc54dd7ed102b74bbde0c6c3bb4037b6116 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Mon, 1 Jun 2026 10:27:44 -0700 Subject: [PATCH 258/269] pkgs: allow apache to read fedora-messaging key Signed-off-by: Kevin Fenzi --- roles/distgit/tasks/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/distgit/tasks/main.yml b/roles/distgit/tasks/main.yml index 31d08a329a..c1eac81a27 100644 --- a/roles/distgit/tasks/main.yml +++ b/roles/distgit/tasks/main.yml @@ -200,7 +200,7 @@ - src: "{{ private }}/files/rabbitmq/production/pki/private/git-hooks.key" dest: git-hooks.key owner: root - group: root + group: apache mode: "440" - src: "{{ private }}/files/rabbitmq/production/pki/ca.crt" dest: git-hooks.ca From a9adce6136db248d7bbd9830934d79d3945c0a59 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Mon, 25 May 2026 23:55:24 +0200 Subject: [PATCH 259/269] robosignatory: enable signing on f45-python --- roles/robosignatory/templates/robosignatory.toml.j2 | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/roles/robosignatory/templates/robosignatory.toml.j2 b/roles/robosignatory/templates/robosignatory.toml.j2 index f0c3d56888..5929d53301 100644 --- a/roles/robosignatory/templates/robosignatory.toml.j2 +++ b/roles/robosignatory/templates/robosignatory.toml.j2 @@ -350,13 +350,13 @@ handlers = ["console"] keyid = "{{ (env == 'production')|ternary('31645531', 'd300e724') }}" file_signing_key = "fedora-43-ima" - # F43 Python Side tag (f43-python) + # F45 Python Side tag (f45-python) [[consumer_config.koji_instances.primary.tags]] - from = "f43-python" - to = "f43-python" - key = "{{ (env == 'production')|ternary('fedora-43', 'testkey') }}" - keyid = "{{ (env == 'production')|ternary('31645531', 'd300e724') }}" - file_signing_key = "fedora-43-ima" + from = "f45-python" + to = "f45-python" + key = "{{ (env == 'production')|ternary('fedora-45', 'testkey') }}" + keyid = "{{ (env == 'production')|ternary('f577861e', 'd300e724') }}" + file_signing_key = "fedora-45-ima" [consumer_config.ostree_refs] From 40b32258901e3e45efb5031759d5929ea8f25f56 Mon Sep 17 00:00:00 2001 From: James Antill Date: Wed, 27 May 2026 14:20:49 -0400 Subject: [PATCH 260/269] pagure: hotfix for commit hash Signed-off-by: James Antill --- .../hotfix/004-commit-hash-traceback.patch | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 roles/pagure/files/hotfix/004-commit-hash-traceback.patch diff --git a/roles/pagure/files/hotfix/004-commit-hash-traceback.patch b/roles/pagure/files/hotfix/004-commit-hash-traceback.patch new file mode 100644 index 0000000000..0b6fb6441f --- /dev/null +++ b/roles/pagure/files/hotfix/004-commit-hash-traceback.patch @@ -0,0 +1,18 @@ +diff --git a/pagure/ui/filters.py b/pagure/ui/filters.py +index 17a97160..e5a1ef1d 100644 +--- a/pagure/ui/filters.py 2024-05-24 10:43:47.000000000 -0400 ++++ b/pagure/ui/filters.py 2026-05-19 17:56:07.900604131 -0400 +@@ -144,8 +144,11 @@ + output = ['
', ''] + + commit_hash = commit +- if hasattr(commit_hash, "hex"): ++ # This can traceback, so try/except ++ try: + commit_hash = commit_hash.hex ++ except: ++ commit_hash = commit + + comments = {} + if prequest and not isinstance(prequest, flask.wrappers.Request): +Only in pagure-5.14.1-build-new/pagure-5.14.1/pagure/ui: filters.py~ From 4a6fc0fdf53bfe80f79c21cbd28fecc116647f5a Mon Sep 17 00:00:00 2001 From: James Antill Date: Mon, 1 Jun 2026 17:42:12 -0400 Subject: [PATCH 261/269] nftables: Fix table name scoping issue. Signed-off-by: James Antill --- roles/base/templates/nftables/_nft_accept_beg | 6 ------ roles/base/templates/nftables/_nft_drop_beg | 6 ------ roles/base/templates/nftables/nftables | 9 +++++++++ roles/base/templates/nftables/nftables.bastion | 7 +++++++ roles/base/templates/nftables/nftables.kojibuilder | 7 +++++++ roles/base/templates/nftables/nftables.osuosl | 7 +++++++ roles/base/templates/nftables/nftables.sign | 7 +++++++ roles/base/templates/nftables/nftables.staging | 7 +++++++ .../nftables/nftables.storinator01.fedorainfracloud.org | 7 +++++++ .../nftables/nftables.torrent02.fedoraproject.org | 7 +++++++ 10 files changed, 58 insertions(+), 12 deletions(-) diff --git a/roles/base/templates/nftables/_nft_accept_beg b/roles/base/templates/nftables/_nft_accept_beg index aa5c8f2236..7c90f50719 100644 --- a/roles/base/templates/nftables/_nft_accept_beg +++ b/roles/base/templates/nftables/_nft_accept_beg @@ -2,12 +2,6 @@ # _nft_accept_beg # Setup an ip filter table with default accept policy, and the std. allow rules. -# Set small Table Names. -# We need the big global ones so we can use them in *_rules but, that would be -# a lot in these files. -{% set _tn = nft_table_filter %} -{% set _tnat = nft_table_nat %} - add table {{_tn}} add chain {{_tn}} INPUT { type filter hook input priority 0; policy accept; } add chain {{_tn}} FORWARD { type filter hook forward priority 0; policy accept; } diff --git a/roles/base/templates/nftables/_nft_drop_beg b/roles/base/templates/nftables/_nft_drop_beg index 3663d11ed4..5546f1ea88 100644 --- a/roles/base/templates/nftables/_nft_drop_beg +++ b/roles/base/templates/nftables/_nft_drop_beg @@ -5,12 +5,6 @@ # Note that there's no _nft_drop_end because _nft_accept_end drops everything # and we don't need that. -# Set small Table Names. -# We need the big global ones so we can use them in *_rules but, that would be -# a lot in these files. -{% set _tn = nft_table_filter %} -{% set _tnat = nft_table_nat %} - add table {{_tn}} add chain {{_tn}} INPUT { type filter hook input priority 0; policy drop; } add chain {{_tn}} FORWARD { type filter hook forward priority 0; policy drop; } diff --git a/roles/base/templates/nftables/nftables b/roles/base/templates/nftables/nftables index 8d96da9f4c..7a19fbc06b 100644 --- a/roles/base/templates/nftables/nftables +++ b/roles/base/templates/nftables/nftables @@ -1,6 +1,15 @@ # {{ ansible_managed }} # {{ template_path }} +# NOTE: This needs to be done at the top level because include inherits +# variables, but set variables don't escape. +# Set small Table Names. +# We need the big global ones so we can use them in *_rules but, that would be +# a lot in these files. +{% set _tn = nft_table_filter %} +{% set _tnat = nft_table_nat %} + + {% include '_nft_accept_beg' %} {% include '_nft_accept_std' %} diff --git a/roles/base/templates/nftables/nftables.bastion b/roles/base/templates/nftables/nftables.bastion index f3a3cde524..2c7d25d42f 100644 --- a/roles/base/templates/nftables/nftables.bastion +++ b/roles/base/templates/nftables/nftables.bastion @@ -1,6 +1,13 @@ # {{ ansible_managed }} # {{ template_path }} +# Set small Table Names. +# We need the big global ones so we can use them in *_rules but, that would be +# a lot in these files. +{% set _tn = nft_table_filter %} +{% set _tnat = nft_table_nat %} + + {% include '_nft_accept_beg' %} {% include '_nft_accept_std' %} diff --git a/roles/base/templates/nftables/nftables.kojibuilder b/roles/base/templates/nftables/nftables.kojibuilder index e70543f2fc..d663f410bf 100644 --- a/roles/base/templates/nftables/nftables.kojibuilder +++ b/roles/base/templates/nftables/nftables.kojibuilder @@ -1,6 +1,13 @@ # {{ ansible_managed }} # {{ template_path }} +# Set small Table Names. +# We need the big global ones so we can use them in *_rules but, that would be +# a lot in these files. +{% set _tn = nft_table_filter %} +{% set _tnat = nft_table_nat %} + + {% include '_nft_drop_beg' %} {% include '_nft_drop_std' %} diff --git a/roles/base/templates/nftables/nftables.osuosl b/roles/base/templates/nftables/nftables.osuosl index 5596703e65..851f44c149 100644 --- a/roles/base/templates/nftables/nftables.osuosl +++ b/roles/base/templates/nftables/nftables.osuosl @@ -1,6 +1,13 @@ # {{ ansible_managed }} # {{ template_path }} +# Set small Table Names. +# We need the big global ones so we can use them in *_rules but, that would be +# a lot in these files. +{% set _tn = nft_table_filter %} +{% set _tnat = nft_table_nat %} + + {% include '_nft_accept_beg' %} {% include '_nft_accept_std' %} diff --git a/roles/base/templates/nftables/nftables.sign b/roles/base/templates/nftables/nftables.sign index e551e2f20f..f908205a70 100644 --- a/roles/base/templates/nftables/nftables.sign +++ b/roles/base/templates/nftables/nftables.sign @@ -1,6 +1,13 @@ # {{ ansible_managed }} # {{ template_path }} +# Set small Table Names. +# We need the big global ones so we can use them in *_rules but, that would be +# a lot in these files. +{% set _tn = nft_table_filter %} +{% set _tnat = nft_table_nat %} + + {% include '_nft_accept_beg' %} {% include '_nft_accept_std' %} diff --git a/roles/base/templates/nftables/nftables.staging b/roles/base/templates/nftables/nftables.staging index 3086c7097f..f10ff19819 100644 --- a/roles/base/templates/nftables/nftables.staging +++ b/roles/base/templates/nftables/nftables.staging @@ -1,6 +1,13 @@ # {{ ansible_managed }} # {{ template_path }} +# Set small Table Names. +# We need the big global ones so we can use them in *_rules but, that would be +# a lot in these files. +{% set _tn = nft_table_filter %} +{% set _tnat = nft_table_nat %} + + {% include '_nft_accept_beg' %} {% include '_nft_accept_std' %} diff --git a/roles/base/templates/nftables/nftables.storinator01.fedorainfracloud.org b/roles/base/templates/nftables/nftables.storinator01.fedorainfracloud.org index 7c0df8cf75..c88087cc92 100644 --- a/roles/base/templates/nftables/nftables.storinator01.fedorainfracloud.org +++ b/roles/base/templates/nftables/nftables.storinator01.fedorainfracloud.org @@ -1,6 +1,13 @@ # {{ ansible_managed }} # {{ template_path }} +# Set small Table Names. +# We need the big global ones so we can use them in *_rules but, that would be +# a lot in these files. +{% set _tn = nft_table_filter %} +{% set _tnat = nft_table_nat %} + + {% include '_nft_accept_beg' %} {% include '_nft_accept_std' %} diff --git a/roles/base/templates/nftables/nftables.torrent02.fedoraproject.org b/roles/base/templates/nftables/nftables.torrent02.fedoraproject.org index 17ab8a187b..3122c50af1 100644 --- a/roles/base/templates/nftables/nftables.torrent02.fedoraproject.org +++ b/roles/base/templates/nftables/nftables.torrent02.fedoraproject.org @@ -1,6 +1,13 @@ # {{ ansible_managed }} # {{ template_path }} +# Set small Table Names. +# We need the big global ones so we can use them in *_rules but, that would be +# a lot in these files. +{% set _tn = nft_table_filter %} +{% set _tnat = nft_table_nat %} + + {% include '_nft_accept_beg' %} {% include '_nft_accept_std' %} From e11b39314ddc7728c4ab416761fa1c27b6c5b106 Mon Sep 17 00:00:00 2001 From: James Antill Date: Mon, 1 Jun 2026 18:38:22 -0400 Subject: [PATCH 262/269] nftables: Fix/merge monitoring changes between prod/staging. Signed-off-by: James Antill --- .../base/templates/nftables/_nft_accept_monitoring | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/roles/base/templates/nftables/_nft_accept_monitoring b/roles/base/templates/nftables/_nft_accept_monitoring index b24676659b..0a64adaa07 100644 --- a/roles/base/templates/nftables/_nft_accept_monitoring +++ b/roles/base/templates/nftables/_nft_accept_monitoring @@ -2,14 +2,23 @@ # Default accept policy, let things be monitored # for nrpe - allow it from nocs +# NOTE: These were still here in staging, before the cleanup. #add rule {{_tn}} INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept #add rule {{_tn}} INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept +#add rule {{_tn}} INPUT ip saddr 192.168.1.66 tcp dport 5666 counter accept # FIXME - this is the global nat-ip and we need the noc01-specific ip add rule {{_tn}} INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept add rule {{_tn}} INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept add rule {{_tn}} INPUT ip saddr 10.16.163.10 tcp dport 5666 counter accept -add rule {{_tn}} INPUT ip saddr 10.16.166.10 tcp dport 5666 counter accept +# NOTE: This was in staging only, before the cleanup. But seems dead. +#add rule {{_tn}} INPUT ip saddr 10.16.166.10 tcp dport 5666 counter accept + +{% if env != 'staging' %} # zabbix01 add rule {{_tn}} INPUT tcp dport 10051 counter accept add rule {{_tn}} INPUT ip saddr 10.3.163.198 tcp dport 10050 counter accept - +{% else %} +# zabbix01.stg +add rule ip filter INPUT tcp dport 10051 counter accept +add rule ip filter INPUT ip saddr 10.16.166.61 tcp dport 10050 counter accept +{% endif %} From 3fdaf170d5381de1942cba982f071167046490fd Mon Sep 17 00:00:00 2001 From: James Antill Date: Mon, 1 Jun 2026 18:43:59 -0400 Subject: [PATCH 263/269] nftables: Use the config. table names in staging. Signed-off-by: James Antill --- roles/base/templates/nftables/_nft_accept_monitoring | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/base/templates/nftables/_nft_accept_monitoring b/roles/base/templates/nftables/_nft_accept_monitoring index 0a64adaa07..7d28698920 100644 --- a/roles/base/templates/nftables/_nft_accept_monitoring +++ b/roles/base/templates/nftables/_nft_accept_monitoring @@ -19,6 +19,6 @@ add rule {{_tn}} INPUT tcp dport 10051 counter accept add rule {{_tn}} INPUT ip saddr 10.3.163.198 tcp dport 10050 counter accept {% else %} # zabbix01.stg -add rule ip filter INPUT tcp dport 10051 counter accept -add rule ip filter INPUT ip saddr 10.16.166.61 tcp dport 10050 counter accept +add rule {{_tn}} INPUT tcp dport 10051 counter accept +add rule {{_tn}} INPUT ip saddr 10.16.166.61 tcp dport 10050 counter accept {% endif %} From 3731a63a13980f57fe0d43d802914fb5c11c2986 Mon Sep 17 00:00:00 2001 From: Mattia Verga Date: Tue, 2 Jun 2026 09:07:28 +0200 Subject: [PATCH 264/269] bodhi-stg: add python-redis to base image Signed-off-by: Mattia Verga --- roles/openshift-apps/bodhi/templates/dockerfile-base | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/bodhi/templates/dockerfile-base b/roles/openshift-apps/bodhi/templates/dockerfile-base index a298e5035b..df3f376b27 100644 --- a/roles/openshift-apps/bodhi/templates/dockerfile-base +++ b/roles/openshift-apps/bodhi/templates/dockerfile-base @@ -14,7 +14,7 @@ RUN curl -o /etc/yum.repos.d/infra-tags-stg.repo https://infrastructure.fedorapr RUN curl -o /etc/yum.repos.d/infra-tags.repo https://infrastructure.fedoraproject.org/infra/ansible/files/common/fedora-infra-tags.repo {% endif %} {% if env == "staging" %} -RUN dnf install -y bodhi-server python3-koji-fedoramessaging-messages python3-gunicorn sed valkey --refresh +RUN dnf install -y bodhi-server python3-koji-fedoramessaging-messages python3-gunicorn python3-redis sed valkey --refresh {% else %} RUN dnf install -y bodhi-server-{{bodhi_version}} python3-koji-fedoramessaging-messages python3-gunicorn sed {% endif %} From ea82ea2c9abf7da9f87ccde10fb87517d0793adc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Aur=C3=A9lien=20Bompard?= Date: Tue, 2 Jun 2026 09:53:18 +0200 Subject: [PATCH 265/269] Fix the openshift user id in badges MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Aurélien Bompard --- vars/apps/badges.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/vars/apps/badges.yml b/vars/apps/badges.yml index 52e704afbc..32c1f652df 100644 --- a/vars/apps/badges.yml +++ b/vars/apps/badges.yml @@ -12,5 +12,5 @@ badges_award_cronjobs: schedule: "40 2 * * 3" - name: badges-dev schedule: "40 2 * * 4" -# oc describe project/fedora-packages-static | grep supplemental-groups -openshift_user_id: 1000840000 +# oc describe project/badges | grep supplemental-groups +openshift_user_id: "{{ (env == 'production')|ternary(1001000000, 1000980000) }}" From d98ce9b9f862fc84bff96b45c6885dc549bbce6c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Aur=C3=A9lien=20Bompard?= Date: Tue, 2 Jun 2026 09:53:35 +0200 Subject: [PATCH 266/269] Fix the triggers for the deployment in webhook2fedmsg MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Aurélien Bompard --- .../webhook2fedmsg/templates/deployment.yml.j2 | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/roles/openshift-apps/webhook2fedmsg/templates/deployment.yml.j2 b/roles/openshift-apps/webhook2fedmsg/templates/deployment.yml.j2 index ec7341211a..1d1137cbc0 100644 --- a/roles/openshift-apps/webhook2fedmsg/templates/deployment.yml.j2 +++ b/roles/openshift-apps/webhook2fedmsg/templates/deployment.yml.j2 @@ -2,10 +2,12 @@ apiVersion: apps/v1 kind: Deployment metadata: + name: app labels: app: webhook2fedmsg service: webhook2fedmsg - name: app + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"webhook2fedmsg:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"app\")].image"}]' spec: replicas: 1 selector: @@ -19,8 +21,6 @@ spec: labels: app: webhook2fedmsg service: webhook2fedmsg - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"webhook2fedmsg:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"app\")].image"}]' spec: initContainers: - name: setup From 728b6c57a3d4535a72f2771f8aa0c7050c76bb6f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Aur=C3=A9lien=20Bompard?= Date: Tue, 2 Jun 2026 10:14:01 +0200 Subject: [PATCH 267/269] Fix deployment triggers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The annotations must be on the deployment's metadata, not on the pod template's metadata. Signed-off-by: Aurélien Bompard --- .../badges/templates/deployment.yml.j2 | 4 +- .../bodhi/templates/deployment.yml.j2 | 28 +++++++------- .../templates/deployment.yml.j2 | 4 +- .../datagrepper/templates/deployment.yml.j2 | 4 +- .../datanommer/templates/deployment.yml.j2 | 4 +- .../templates/deployment.yml.j2 | 6 +-- .../fasjson/templates/deployment.yml.j2 | 4 +- .../templates/deployment.yml.j2 | 4 +- .../templates/deployment.yml.j2 | 6 +-- .../fmn/templates/deployment.yml.j2 | 38 +++++++++---------- .../greenwave/templates/deployment.yml.j2 | 8 ++-- .../mirrormanager/templates/deployment.yml.j2 | 4 +- .../noggin/templates/deployment.yml.j2 | 4 +- .../poddlers/templates/deployment.yml.j2 | 4 +- .../templates/deployment.yml.j2 | 12 +++--- .../templates/deployment.yml.j2 | 8 ++-- .../waiverdb/templates/deployment.yml.j2 | 4 +- 17 files changed, 73 insertions(+), 73 deletions(-) diff --git a/roles/openshift-apps/badges/templates/deployment.yml.j2 b/roles/openshift-apps/badges/templates/deployment.yml.j2 index d9f22f67d4..098837a8e4 100644 --- a/roles/openshift-apps/badges/templates/deployment.yml.j2 +++ b/roles/openshift-apps/badges/templates/deployment.yml.j2 @@ -205,6 +205,8 @@ metadata: app: badges service: redis deployment: redis + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"redis:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"redis\")].image"}]' spec: replicas: 1 selector: @@ -218,8 +220,6 @@ spec: app: badges service: redis deployment: redis - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"redis:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"redis\")].image"}]' spec: containers: - name: redis diff --git a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 index fd2083b386..fd6043b7e0 100644 --- a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 +++ b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 @@ -3,9 +3,11 @@ apiVersion: apps/v1 kind: Deployment metadata: + name: bodhi-web labels: app: bodhi-web - name: bodhi-web + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-base:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-web\")].image"}]' spec: replicas: {{ bodhi_openshift_pods }} selector: @@ -20,8 +22,6 @@ spec: {% if env == "staging" %} monitoring-key: cpe {% endif %} - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-base:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-web\")].image"}]' spec: initContainers: - name: alembic-upgrade @@ -125,9 +125,11 @@ spec: apiVersion: apps/v1 kind: Deployment metadata: + name: bodhi-consumer labels: app: bodhi-consumer - name: bodhi-consumer + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-base:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-consumer\")].image"}]' spec: {% if env == 'staging' %} replicas: {{ bodhi_openshift_pods_stg_consumers }} @@ -146,8 +148,6 @@ spec: metadata: labels: app: bodhi-consumer - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-base:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-consumer\")].image"}]' spec: containers: - name: bodhi-consumer @@ -207,14 +207,16 @@ spec: apiVersion: apps/v1 kind: Deployment metadata: + name: bodhi-celery labels: app: bodhi-celery - name: bodhi-celery spec: replicas: {{ bodhi_openshift_pods }} selector: matchLabels: app: bodhi-celery + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-base:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-celery\")].image"}]' strategy: type: RollingUpdate rollingUpdate: @@ -224,8 +226,6 @@ spec: metadata: labels: app: bodhi-celery - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-base:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-celery\")].image"}]' spec: containers: - name: bodhi-celery @@ -288,6 +288,8 @@ metadata: labels: app: bodhi-celery-beat name: bodhi-celery-beat + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-base:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-celery-beat\")].image"}]' spec: replicas: 1 selector: @@ -302,8 +304,6 @@ spec: metadata: labels: app: bodhi-celery-beat - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-base:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-celery-beat\")].image"}]' spec: containers: - name: bodhi-celery-beat @@ -365,9 +365,11 @@ spec: apiVersion: apps/v1 kind: Deployment metadata: + name: bodhi-valkey labels: app: bodhi-valkey - name: bodhi-valkey + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-valkey:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-valkey\")].image"}]' spec: replicas: 1 selector: @@ -379,8 +381,6 @@ spec: metadata: labels: app: bodhi-valkey - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-valkey:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-valkey\")].image"}]' spec: containers: - name: bodhi-valkey diff --git a/roles/openshift-apps/bugzilla2fedmsg/templates/deployment.yml.j2 b/roles/openshift-apps/bugzilla2fedmsg/templates/deployment.yml.j2 index ce502eb8ac..f222650513 100644 --- a/roles/openshift-apps/bugzilla2fedmsg/templates/deployment.yml.j2 +++ b/roles/openshift-apps/bugzilla2fedmsg/templates/deployment.yml.j2 @@ -6,6 +6,8 @@ metadata: labels: app: bugzilla2fedmsg service: bugzilla2fedmsg + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bugzilla2fedmsg:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bugzilla2fedmsg\")].image"}]' spec: replicas: 1 selector: @@ -16,8 +18,6 @@ spec: metadata: labels: app: bugzilla2fedmsg - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bugzilla2fedmsg:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bugzilla2fedmsg\")].image"}]' spec: containers: - name: bugzilla2fedmsg diff --git a/roles/openshift-apps/datagrepper/templates/deployment.yml.j2 b/roles/openshift-apps/datagrepper/templates/deployment.yml.j2 index e79bd7766e..4c70372c17 100644 --- a/roles/openshift-apps/datagrepper/templates/deployment.yml.j2 +++ b/roles/openshift-apps/datagrepper/templates/deployment.yml.j2 @@ -5,6 +5,8 @@ metadata: name: datagrepper labels: app: Datagrepper + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"datagrepper:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"datagrepper\")].image"}]' spec: replicas: 1 selector: @@ -19,8 +21,6 @@ spec: metadata: labels: app: Datagrepper - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"datagrepper:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"datagrepper\")].image"}]' spec: containers: - name: datagrepper diff --git a/roles/openshift-apps/datanommer/templates/deployment.yml.j2 b/roles/openshift-apps/datanommer/templates/deployment.yml.j2 index 1fa0dd2523..ad0430f4e0 100644 --- a/roles/openshift-apps/datanommer/templates/deployment.yml.j2 +++ b/roles/openshift-apps/datanommer/templates/deployment.yml.j2 @@ -5,6 +5,8 @@ metadata: name: datanommer labels: app: Datanommer + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"datanommer:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"datanommer\")].image"}]' spec: replicas: 1 selector: @@ -16,8 +18,6 @@ spec: metadata: labels: app: Datanommer - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"datanommer:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"datanommer\")].image"}]' spec: initContainers: - name: alembic-upgrade diff --git a/roles/openshift-apps/discourse2fedmsg/templates/deployment.yml.j2 b/roles/openshift-apps/discourse2fedmsg/templates/deployment.yml.j2 index 120e647ab6..763806e228 100644 --- a/roles/openshift-apps/discourse2fedmsg/templates/deployment.yml.j2 +++ b/roles/openshift-apps/discourse2fedmsg/templates/deployment.yml.j2 @@ -2,10 +2,12 @@ apiVersion: apps/v1 kind: Deployment metadata: + name: discourse2fedmsg labels: app: discourse2fedmsg service: discourse2fedmsg - name: discourse2fedmsg + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"discourse2fedmsg:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"discourse2fedmsg\")].image"}]' spec: replicas: 1 selector: @@ -16,8 +18,6 @@ spec: metadata: labels: app: discourse2fedmsg - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"discourse2fedmsg:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"discourse2fedmsg\")].image"}]' spec: containers: - name: discourse2fedmsg diff --git a/roles/openshift-apps/fasjson/templates/deployment.yml.j2 b/roles/openshift-apps/fasjson/templates/deployment.yml.j2 index b901afd27f..05e6a2bc03 100644 --- a/roles/openshift-apps/fasjson/templates/deployment.yml.j2 +++ b/roles/openshift-apps/fasjson/templates/deployment.yml.j2 @@ -5,6 +5,8 @@ metadata: name: fasjson labels: app: fasjson + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fasjson:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"fasjson\")].image"}]' spec: replicas: 1 selector: @@ -19,8 +21,6 @@ spec: metadata: labels: app: fasjson - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fasjson:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"fasjson\")].image"}]' spec: containers: - name: fasjson diff --git a/roles/openshift-apps/fedora-packages-static/templates/deployment.yml.j2 b/roles/openshift-apps/fedora-packages-static/templates/deployment.yml.j2 index 82230087be..c38cd517db 100644 --- a/roles/openshift-apps/fedora-packages-static/templates/deployment.yml.j2 +++ b/roles/openshift-apps/fedora-packages-static/templates/deployment.yml.j2 @@ -3,6 +3,8 @@ apiVersion: apps/v1 kind: Deployment metadata: name: fedora-packages-static + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fedora-packages-static:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"fedora-packages-static\")].image"}]' spec: replicas: 1 selector: @@ -14,8 +16,6 @@ spec: metadata: labels: app: fedora-packages-static - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fedora-packages-static:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"fedora-packages-static\")].image"}]' spec: initContainers: - name: init-solr diff --git a/roles/openshift-apps/flatpak-indexer/templates/deployment.yml.j2 b/roles/openshift-apps/flatpak-indexer/templates/deployment.yml.j2 index 4bbbc78f37..1f1595fea4 100644 --- a/roles/openshift-apps/flatpak-indexer/templates/deployment.yml.j2 +++ b/roles/openshift-apps/flatpak-indexer/templates/deployment.yml.j2 @@ -2,9 +2,11 @@ apiVersion: apps/v1 kind: Deployment metadata: + name: flatpak-indexer labels: app: flatpak-indexer - name: flatpak-indexer + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"flatpak-indexer:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"flatpak-indexer\")].image"}]' spec: replicas: 1 selector: @@ -19,8 +21,6 @@ spec: metadata: labels: app: flatpak-indexer - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"flatpak-indexer:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"flatpak-indexer\")].image"}]' spec: containers: - name: flatpak-indexer diff --git a/roles/openshift-apps/fmn/templates/deployment.yml.j2 b/roles/openshift-apps/fmn/templates/deployment.yml.j2 index 593f076b78..bd19d090ed 100644 --- a/roles/openshift-apps/fmn/templates/deployment.yml.j2 +++ b/roles/openshift-apps/fmn/templates/deployment.yml.j2 @@ -7,6 +7,8 @@ metadata: labels: app: fmn component: frontend + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"frontend\")].image"}]' spec: replicas: 1 selector: @@ -23,8 +25,6 @@ spec: labels: app: fmn component: frontend - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"frontend\")].image"}]' spec: containers: - name: frontend @@ -62,6 +62,8 @@ metadata: labels: app: fmn component: api + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"api\")].image"}]' spec: replicas: 1 selector: @@ -78,8 +80,6 @@ spec: labels: app: fmn component: api - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"api\")].image"}]' spec: containers: - name: api @@ -170,6 +170,8 @@ metadata: labels: app: fmn component: consumer + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"consumer\")].image"}]' spec: replicas: 1 selector: @@ -183,8 +185,6 @@ spec: labels: app: fmn component: consumer - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"consumer\")].image"}]' spec: initContainers: - name: database-sync @@ -262,6 +262,8 @@ metadata: labels: app: fmn component: sender-email + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"sender-email\")].image"}]' spec: replicas: 1 selector: @@ -275,8 +277,6 @@ spec: labels: app: fmn component: sender-email - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"sender-email\")].image"}]' spec: containers: - name: sender-email @@ -320,6 +320,8 @@ metadata: labels: app: fmn component: sender-irc + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"sender-irc\")].image"}]' spec: replicas: {{ (env == 'production')|ternary('1', '0') }} selector: @@ -333,8 +335,6 @@ spec: labels: app: fmn component: sender-irc - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"sender-irc\")].image"}]' spec: containers: - name: sender-irc @@ -378,6 +378,8 @@ metadata: labels: app: fmn component: sender-matrix + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"sender-matrix\")].image"}]' spec: replicas: 1 selector: @@ -391,8 +393,6 @@ spec: labels: app: fmn component: sender-matrix - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"sender-matrix\")].image"}]' spec: containers: - name: sender-matrix @@ -436,6 +436,8 @@ metadata: labels: app: fmn component: redis + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"redis:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"redis\")].image"}]' spec: replicas: 1 selector: @@ -448,8 +450,6 @@ spec: labels: app: fmn component: redis - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"redis:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"redis\")].image"}]' spec: containers: - name: redis @@ -479,6 +479,8 @@ metadata: labels: app: fmn component: collectd + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"collectd\")].image"}]' spec: replicas: 1 selector: @@ -492,8 +494,6 @@ spec: labels: app: fmn component: collectd - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"collectd\")].image"}]' spec: containers: - name: collectd @@ -526,10 +526,12 @@ spec: apiVersion: apps/v1 kind: Deployment metadata: + name: sendria labels: app: fmn component: sendria - name: sendria + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"sendria:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"sendria\")].image"}]' spec: replicas: 1 selector: @@ -543,8 +545,6 @@ spec: labels: app: fmn component: sendria - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"sendria:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"sendria\")].image"}]' spec: containers: - name: sendria diff --git a/roles/openshift-apps/greenwave/templates/deployment.yml.j2 b/roles/openshift-apps/greenwave/templates/deployment.yml.j2 index 5fcfce3ab3..bc47ed97b7 100644 --- a/roles/openshift-apps/greenwave/templates/deployment.yml.j2 +++ b/roles/openshift-apps/greenwave/templates/deployment.yml.j2 @@ -6,6 +6,8 @@ metadata: labels: app: greenwave service: web + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"greenwave:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"web\")].image"}]' spec: replicas: 2 selector: @@ -18,8 +20,6 @@ spec: labels: app: greenwave service: web - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"greenwave:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"web\")].image"}]' spec: containers: - name: web @@ -57,6 +57,8 @@ metadata: labels: app: greenwave service: fedmsg-consumers + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"greenwave:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"fedmsg-consumers\")].image"}]' spec: replicas: 0 selector: @@ -68,8 +70,6 @@ spec: labels: app: greenwave service: fedmsg-consumers - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"greenwave:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"fedmsg-consumers\")].image"}]' spec: containers: - name: fedmsg-consumers diff --git a/roles/openshift-apps/mirrormanager/templates/deployment.yml.j2 b/roles/openshift-apps/mirrormanager/templates/deployment.yml.j2 index 44347637c9..5ed8be3740 100644 --- a/roles/openshift-apps/mirrormanager/templates/deployment.yml.j2 +++ b/roles/openshift-apps/mirrormanager/templates/deployment.yml.j2 @@ -6,6 +6,8 @@ metadata: name: frontend labels: app: mirrormanager + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"mirrormanager2:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"mirrormanager\")].image"}]' spec: replicas: 1 selector: @@ -20,8 +22,6 @@ spec: metadata: labels: app: mirrormanager - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"mirrormanager2:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"mirrormanager\")].image"}]' spec: containers: - name: mirrormanager diff --git a/roles/openshift-apps/noggin/templates/deployment.yml.j2 b/roles/openshift-apps/noggin/templates/deployment.yml.j2 index 2b998bd2dd..596c7a5543 100644 --- a/roles/openshift-apps/noggin/templates/deployment.yml.j2 +++ b/roles/openshift-apps/noggin/templates/deployment.yml.j2 @@ -5,6 +5,8 @@ metadata: name: noggin labels: app: {{ object_app }} + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"noggin:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"noggin\")].image"}]' spec: replicas: 1 selector: @@ -19,8 +21,6 @@ spec: metadata: labels: app: {{ object_app }} - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"noggin:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"noggin\")].image"}]' spec: containers: - name: noggin diff --git a/roles/openshift-apps/poddlers/templates/deployment.yml.j2 b/roles/openshift-apps/poddlers/templates/deployment.yml.j2 index b399a3f539..ff0eef24e0 100644 --- a/roles/openshift-apps/poddlers/templates/deployment.yml.j2 +++ b/roles/openshift-apps/poddlers/templates/deployment.yml.j2 @@ -7,6 +7,8 @@ metadata: name: {{ toddler.name }} labels: app: poddlers + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"toddlers:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"toddlers\")].image"}]' spec: replicas: {{ toddler.replicas|default(1) }} selector: @@ -20,8 +22,6 @@ spec: labels: app: poddlers deployment: {{ toddler.name }} - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"toddlers:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"toddlers\")].image"}]' spec: containers: - name: toddlers diff --git a/roles/openshift-apps/release-monitoring/templates/deployment.yml.j2 b/roles/openshift-apps/release-monitoring/templates/deployment.yml.j2 index 03e1db04ff..a5ce963f05 100644 --- a/roles/openshift-apps/release-monitoring/templates/deployment.yml.j2 +++ b/roles/openshift-apps/release-monitoring/templates/deployment.yml.j2 @@ -2,10 +2,12 @@ apiVersion: apps/v1 kind: Deployment metadata: + name: release-monitoring-web labels: app: release-monitoring-web service: web - name: release-monitoring-web + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"release-monitoring-web:latest","namespace":"release-monitoring"},"fieldPath":"spec.template.spec.containers[?(@.name==\"release-monitoring-web\")].image"}]' spec: replicas: 1 selector: @@ -18,8 +20,6 @@ spec: labels: app: release-monitoring-web service: web - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"release-monitoring-web:latest","namespace":"release-monitoring"},"fieldPath":"spec.template.spec.containers[?(@.name==\"release-monitoring-web\")].image"}]' spec: initContainers: - name: alembic-upgrade @@ -88,10 +88,12 @@ spec: apiVersion: apps/v1 kind: Deployment metadata: + name: release-monitoring-check-service labels: app: release-monitoring-check-service service: web - name: release-monitoring-check-service + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"release-monitoring-web:latest","namespace":"release-monitoring"},"fieldPath":"spec.template.spec.containers[?(@.name==\"release-monitoring-web\")].image"}]' spec: {% if env == 'staging' %} replicas: 0 @@ -108,8 +110,6 @@ spec: labels: app: release-monitoring-check-service service: web - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"release-monitoring-web:latest","namespace":"release-monitoring"},"fieldPath":"spec.template.spec.containers[?(@.name==\"release-monitoring-web\")].image"}]' spec: initContainers: - name: alembic-check diff --git a/roles/openshift-apps/the-new-hotness/templates/deployment.yml.j2 b/roles/openshift-apps/the-new-hotness/templates/deployment.yml.j2 index 5617b8c8e4..3e8dc64c83 100644 --- a/roles/openshift-apps/the-new-hotness/templates/deployment.yml.j2 +++ b/roles/openshift-apps/the-new-hotness/templates/deployment.yml.j2 @@ -3,6 +3,8 @@ apiVersion: apps/v1 kind: Deployment metadata: name: the-new-hotness + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"the-new-hotness:latest","namespace":"the-new-hotness"},"fieldPath":"spec.template.spec.containers[?(@.name==\"the-new-hotness\")].image"}]' spec: replicas: 1 selector: @@ -14,8 +16,6 @@ spec: metadata: labels: app: the-new-hotness - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"the-new-hotness:latest","namespace":"the-new-hotness"},"fieldPath":"spec.template.spec.containers[?(@.name==\"the-new-hotness\")].image"}]' spec: containers: - name: the-new-hotness @@ -71,6 +71,8 @@ apiVersion: apps/v1 kind: Deployment metadata: name: the-new-hotness-redis + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"the-new-hotness-redis:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"the-new-hotness-redis\")].image"}]' spec: replicas: 1 selector: @@ -81,8 +83,6 @@ spec: metadata: labels: app: the-new-hotness-redis - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"the-new-hotness-redis:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"the-new-hotness-redis\")].image"}]' spec: containers: - name: the-new-hotness-redis diff --git a/roles/openshift-apps/waiverdb/templates/deployment.yml.j2 b/roles/openshift-apps/waiverdb/templates/deployment.yml.j2 index 37a47616ac..a482255524 100644 --- a/roles/openshift-apps/waiverdb/templates/deployment.yml.j2 +++ b/roles/openshift-apps/waiverdb/templates/deployment.yml.j2 @@ -6,6 +6,8 @@ metadata: labels: app: waiverdb service: web + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"waiverdb:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"web\")].image"}]' spec: replicas: 2 selector: @@ -20,8 +22,6 @@ spec: labels: app: waiverdb service: web - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"waiverdb:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"web\")].image"}]' spec: initContainers: - name: db-upgrade From 3457eea89bd38643735f1fdf0a2f01e551188129 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Aur=C3=A9lien=20Bompard?= Date: Tue, 2 Jun 2026 11:54:21 +0200 Subject: [PATCH 268/269] Add the RabbitMQ user for the lookaside cache MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes: https://forge.fedoraproject.org/infra/tickets/issues/13380 Signed-off-by: Aurélien Bompard --- roles/rabbitmq_cluster/tasks/apps.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/roles/rabbitmq_cluster/tasks/apps.yml b/roles/rabbitmq_cluster/tasks/apps.yml index c03fa1e9bd..31761fbb14 100644 --- a/roles/rabbitmq_cluster/tasks/apps.yml +++ b/roles/rabbitmq_cluster/tasks/apps.yml @@ -185,3 +185,11 @@ vars: user_name: logdetective-packit{{ env_suffix }} user_sent_topics: ^org\.fedoraproject\.{{ env_short }}\.logdetective\..* + +- name: Lookaside cache + run_once: true + include_role: + name: rabbit/user + vars: + user_name: git-hooks{{ env_suffix }} + user_sent_topics: ^org\.fedoraproject\.{{ env_short }}\.git\.lookaside\..* From ebaf8210f3b2ead6242e463679957892396f49c1 Mon Sep 17 00:00:00 2001 From: Jeremy Cline Date: Tue, 31 Mar 2026 11:29:19 -0400 Subject: [PATCH 269/269] draft: add roles for siguldry server and bridge These roles deploy the Siguldry server and bridge. There's a few TODOs, and one step that isn't covered at all is the deployment of the TLS private keys. These need to be encrypted with systemd-creds, which should be doable via ansible, but the pesign bridge isn't doing it so I've left it out for now. Signed-off-by: Jeremy Cline --- roles/siguldry/bridge/handlers/main.yml | 8 + roles/siguldry/bridge/tasks/main.yml | 116 ++++++++++ .../siguldry/bridge/templates/bridge.toml.j2 | 21 ++ .../bridge/templates/override.conf.j2 | 12 ++ roles/siguldry/server/defaults/main.yml | 7 + roles/siguldry/server/handlers/main.yml | 8 + roles/siguldry/server/tasks/kryoptic.yml | 151 +++++++++++++ roles/siguldry/server/tasks/main.yml | 202 ++++++++++++++++++ .../server/templates/kryoptic.toml.j2 | 4 + .../server/templates/server-override.conf.j2 | 12 ++ .../siguldry/server/templates/server.toml.j2 | 101 +++++++++ .../server/templates/signer-override.conf.j2 | 16 ++ 12 files changed, 658 insertions(+) create mode 100644 roles/siguldry/bridge/handlers/main.yml create mode 100644 roles/siguldry/bridge/tasks/main.yml create mode 100644 roles/siguldry/bridge/templates/bridge.toml.j2 create mode 100644 roles/siguldry/bridge/templates/override.conf.j2 create mode 100644 roles/siguldry/server/defaults/main.yml create mode 100644 roles/siguldry/server/handlers/main.yml create mode 100644 roles/siguldry/server/tasks/kryoptic.yml create mode 100644 roles/siguldry/server/tasks/main.yml create mode 100644 roles/siguldry/server/templates/kryoptic.toml.j2 create mode 100644 roles/siguldry/server/templates/server-override.conf.j2 create mode 100644 roles/siguldry/server/templates/server.toml.j2 create mode 100644 roles/siguldry/server/templates/signer-override.conf.j2 diff --git a/roles/siguldry/bridge/handlers/main.yml b/roles/siguldry/bridge/handlers/main.yml new file mode 100644 index 0000000000..4dc212b8ec --- /dev/null +++ b/roles/siguldry/bridge/handlers/main.yml @@ -0,0 +1,8 @@ +--- +- name: Restart siguldry-bridge + ansible.builtin.systemd: + name: siguldry-bridge.service + state: restarted + tags: + - siguldry + - siguldry/bridge diff --git a/roles/siguldry/bridge/tasks/main.yml b/roles/siguldry/bridge/tasks/main.yml new file mode 100644 index 0000000000..790ca8fe1f --- /dev/null +++ b/roles/siguldry/bridge/tasks/main.yml @@ -0,0 +1,116 @@ +--- +- name: Install siguldry package + ansible.builtin.package: + state: present + name: siguldry + tags: + - packages + - siguldry + - siguldry/bridge + +# We only need to grant the service explicit access to the TPM on systemd < 258 +- name: Get systemd version + ansible.builtin.command: systemctl --version + register: systemd_version_output + changed_when: systemd_version_output.rc != 0 + +- name: Set whether explicit AllowDevice override is needed + ansible.builtin.set_fact: + explicit_allow_tpm: "{{ (systemd_version_output.stdout_lines[0] | regex_search('\\d+') | int) < 258 }}" + +- name: Create siguldry config directory + ansible.builtin.file: + path: /etc/siguldry + state: directory + owner: root + group: root + mode: '0755' + tags: + - config + - siguldry + - siguldry/bridge + +- name: Create credstore.encrypted directory + ansible.builtin.file: + path: /etc/credstore.encrypted + state: directory + owner: root + group: root + mode: '0700' + tags: + - config + - siguldry + - siguldry/bridge + +- name: Create siguldry-bridge systemd override directory + ansible.builtin.file: + path: /etc/systemd/system/siguldry-bridge.service.d + state: directory + owner: root + group: root + mode: '0755' + tags: + - config + - siguldry + - siguldry/bridge + +- name: Setup siguldry-bridge systemd override file + ansible.builtin.template: + src: override.conf.j2 + dest: /etc/systemd/system/siguldry-bridge.service.d/override.conf + owner: root + group: root + mode: '0644' + notify: Restart siguldry-bridge + tags: + - config + - siguldry + - siguldry/bridge + +- name: Setup siguldry-bridge config file + ansible.builtin.template: + src: bridge.toml.j2 + dest: /etc/siguldry/bridge.toml + owner: root + group: root + mode: '0644' + notify: Restart siguldry-bridge + tags: + - config + - siguldry + - siguldry/bridge + +- name: Setup bridge certificate + ansible.builtin.copy: + src: "{{ private }}/files/siguldryca/{{ env }}/pki/issued/siguldry-bridge.crt" + dest: /etc/siguldry/bridge.crt + owner: root + group: root + mode: '0644' + tags: + - config + - siguldry + - siguldry/bridge + +- name: Setup CA certificate + ansible.builtin.copy: + src: "{{ private }}/files/siguldryca/{{ env }}/pki/ca.crt" + dest: /etc/siguldry/ca.crt + owner: root + group: root + mode: '0644' + tags: + - config + - siguldry + - siguldry/bridge + +- name: Enable and start siguldry-bridge service + ansible.builtin.systemd: + name: siguldry-bridge.service + enabled: yes + state: started + daemon_reload: yes + tags: + - services + - siguldry + - siguldry/bridge diff --git a/roles/siguldry/bridge/templates/bridge.toml.j2 b/roles/siguldry/bridge/templates/bridge.toml.j2 new file mode 100644 index 0000000000..4b2a168565 --- /dev/null +++ b/roles/siguldry/bridge/templates/bridge.toml.j2 @@ -0,0 +1,21 @@ +# The socket address to listen on for incoming connections from Siguldry servers. +# +# The default is to listen on all interfaces on port 44333. +server_listening_address = "[::]:44333" + +# The socket address to listen on for incoming connections from Siguldry clients. +# +# The default is to listen on all interfaces on port 44334. +client_listening_address = "[::]:44334" + +# The TLS credentials for the server and client listeners. +# +# Both clients and servers connect to the above addresses and perform mutual TLS. +# Note that the certificate must have `serverAuth` in its extended key usage extension. +# +# Paths that aren't absolute are loaded relative to systemd's credentials directory, +# which are encrypted, see https://systemd.io/CREDENTIALS/ +[credentials] +private_key = "siguldry.bridge.private_key.pem" +certificate = "/etc/siguldry/bridge.crt" +ca_certificate = "/etc/siguldry/ca.crt" diff --git a/roles/siguldry/bridge/templates/override.conf.j2 b/roles/siguldry/bridge/templates/override.conf.j2 new file mode 100644 index 0000000000..a33171f49c --- /dev/null +++ b/roles/siguldry/bridge/templates/override.conf.j2 @@ -0,0 +1,12 @@ +[Service] +# Tweak for lower/higher log verbosity. +# Refer to https://docs.rs/tracing-subscriber/0.3.19/tracing_subscriber/filter/struct.EnvFilter.html#directives +Environment=SIGULDRY_BRIDGE_LOG="WARN,siguldry=INFO" + +{% if explicit_allow_tpm %} +# Credentials require the TPM to decrypt. +# +# For systemd 257 and older you'll need to explicitly allow access to the TPM +# Refer to https://github.com/systemd/systemd/issues/35959. +DeviceAllow=/dev/tpmrm0 +{% endif %} diff --git a/roles/siguldry/server/defaults/main.yml b/roles/siguldry/server/defaults/main.yml new file mode 100644 index 0000000000..45d5f3c18c --- /dev/null +++ b/roles/siguldry/server/defaults/main.yml @@ -0,0 +1,7 @@ +--- + +siguldry_kryoptic_conf: "/etc/siguldry/kryoptic.toml" +siguldry_kryoptic_db: "/var/lib/siguldry/kryoptic.sqlite" + +siguldry_kryoptic_so_pin: "12345678" +siguldry_kryoptic_user_pin: "123456" diff --git a/roles/siguldry/server/handlers/main.yml b/roles/siguldry/server/handlers/main.yml new file mode 100644 index 0000000000..a956d31dca --- /dev/null +++ b/roles/siguldry/server/handlers/main.yml @@ -0,0 +1,8 @@ +--- +- name: Restart siguldry-server + ansible.builtin.systemd: + name: siguldry-server.service + state: restarted + tags: + - siguldry + - siguldry/server diff --git a/roles/siguldry/server/tasks/kryoptic.yml b/roles/siguldry/server/tasks/kryoptic.yml new file mode 100644 index 0000000000..bb474bd97c --- /dev/null +++ b/roles/siguldry/server/tasks/kryoptic.yml @@ -0,0 +1,151 @@ +--- +# For staging, use Kryoptic as a software HSM for binding +- name: Install kryoptic and PKCS#11 tools (staging only) + ansible.builtin.package: + state: present + name: + - kryoptic + - opensc + - openssl + - pkcs11-provider + tags: + - packages + - siguldry + - siguldry/server + +- name: Setup kryoptic configuration + ansible.builtin.template: + src: kryoptic.toml.j2 + dest: "{{ siguldry_kryoptic_conf }}" + owner: root + group: root + mode: '0644' + tags: + - config + - siguldry + - siguldry/server + +- name: Check if kryoptic token is initialized + ansible.builtin.stat: + path: "{{ siguldry_kryoptic_db }}" + register: kryoptic_db + tags: + - config + - siguldry + - siguldry/server + +- name: Initialize kryoptic PKCS#11 token + ansible.builtin.command: + cmd: >- + pkcs11-tool + --module /usr/lib64/pkcs11/libkryoptic_pkcs11.so + --init-token + --label siguldry-stg-token + --so-pin env:KRYOPTIC_SO_PIN + environment: + KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}" + KRYOPTIC_SO_PIN: "{{ siguldry_kryoptic_so_pin }}" + when: not kryoptic_db.stat.exists + tags: + - config + - siguldry + - siguldry/server + +- name: Initialize kryoptic user PIN + ansible.builtin.command: + cmd: >- + pkcs11-tool + --module /usr/lib64/pkcs11/libkryoptic_pkcs11.so + --login + --so-pin env:KRYOPTIC_SO_PIN + --init-pin + --new-pin env:KRYOPTIC_USER_PIN + environment: + KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}" + KRYOPTIC_SO_PIN: "{{ siguldry_kryoptic_so_pin }}" + KRYOPTIC_USER_PIN: "{{ siguldry_kryoptic_user_pin }}" + when: not kryoptic_db.stat.exists + tags: + - config + - siguldry + - siguldry/server + +- name: Check for existing binding key + ansible.builtin.command: + cmd: >- + pkcs11-tool + --module /usr/lib64/pkcs11/libkryoptic_pkcs11.so + --login + --pin env:KRYOPTIC_USER_PIN + --list-objects + --type privkey + environment: + KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}" + KRYOPTIC_USER_PIN: "{{ siguldry_kryoptic_user_pin }}" + register: kryoptic_objects + changed_when: false + tags: + - config + - siguldry + - siguldry/server + +- name: Generate RSA binding key pair + ansible.builtin.command: + cmd: >- + pkcs11-tool + --module /usr/lib64/pkcs11/libkryoptic_pkcs11.so + --login + --pin env:KRYOPTIC_USER_PIN + --keypairgen + --key-type rsa:4096 + --usage-sign + --usage-decrypt + --id 1 + --label siguldry-binding-key + environment: + KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}" + KRYOPTIC_USER_PIN: "{{ siguldry_kryoptic_user_pin }}" + when: "'siguldry-binding-key' not in kryoptic_objects.stdout" + tags: + - config + - siguldry + - siguldry/server + +- name: Create self-signed x509 binding certificate + ansible.builtin.command: + cmd: >- + openssl req -x509 + -provider pkcs11 + -subj /CN=siguldry-binding-key + -passin pass:{{ siguldry_kryoptic_user_pin }} + -key pkcs11:token=siguldry-stg-token;type=private + -out /etc/siguldry/kryoptic-binding.crt + creates: /etc/siguldry/kryoptic-binding.crt + environment: + KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}" + tags: + - config + - siguldry + - siguldry/server + +- name: Import x509 certificate to token + ansible.builtin.command: + cmd: >- + pkcs11-tool + --module /usr/lib64/pkcs11/libkryoptic_pkcs11.so + --login + --pin env:KRYOPTIC_USER_PIN + --keypairgen + --key-type rsa:4096 + --usage-sign + --usage-decrypt + --id 1 + --label siguldry-binding-key + environment: + KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}" + KRYOPTIC_USER_PIN: "{{ siguldry_kryoptic_user_pin }}" + when: "'siguldry-binding-key' not in kryoptic_objects.stdout" + tags: + - config + - siguldry + - siguldry/server diff --git a/roles/siguldry/server/tasks/main.yml b/roles/siguldry/server/tasks/main.yml new file mode 100644 index 0000000000..c205deb2bc --- /dev/null +++ b/roles/siguldry/server/tasks/main.yml @@ -0,0 +1,202 @@ +--- +- name: Install siguldry package + ansible.builtin.package: + state: present + name: siguldry + tags: + - packages + - siguldry + - siguldry/server + +# We only need to grant the service explicit access to the TPM on systemd < 258 +- name: Get systemd version + ansible.builtin.command: systemctl --version + register: systemd_version_output + changed_when: systemd_version_output.rc != 0 + +- name: Set whether explicit AllowDevice override is needed + ansible.builtin.set_fact: + explicit_allow_tpm: "{{ (systemd_version_output.stdout_lines[0] | regex_search('\\d+') | int) < 258 }}" + +- name: Create siguldry config directory + ansible.builtin.file: + path: /etc/siguldry + state: directory + owner: root + group: root + mode: '0755' + tags: + - config + - siguldry + - siguldry/server + +- name: Create credstore.encrypted directory + ansible.builtin.file: + path: /etc/credstore.encrypted + state: directory + owner: root + group: root + mode: '0700' + tags: + - config + - siguldry + - siguldry/server + +- name: Ensure the siguldry state directory exists + ansible.builtin.file: + path: /var/lib/siguldry + state: directory + owner: siguldry + group: siguldry + mode: '0750' + tags: + - siguldry + - siguldry/server + +- name: Create siguldry-signer systemd override directory + ansible.builtin.file: + path: /etc/systemd/system/siguldry-signer@.service.d + state: directory + owner: root + group: root + mode: '0755' + tags: + - config + - siguldry + - siguldry/server + +- name: Setup siguldry-signer systemd override file + ansible.builtin.template: + src: signer-override.conf.j2 + dest: /etc/systemd/system/siguldry-signer@.service.d/override.conf + owner: root + group: root + mode: '0644' + notify: Restart siguldry-server + tags: + - config + - siguldry + - siguldry/server + +- name: Create siguldry-server systemd override directory + ansible.builtin.file: + path: /etc/systemd/system/siguldry-server.service.d + state: directory + owner: root + group: root + mode: '0755' + tags: + - config + - siguldry + - siguldry/server + +- name: Setup siguldry-server systemd override file + ansible.builtin.template: + src: server-override.conf.j2 + dest: /etc/systemd/system/siguldry-server.service.d/override.conf + owner: root + group: root + mode: '0644' + notify: Restart siguldry-server + tags: + - config + - siguldry + - siguldry/server + +- name: Setup siguldry-server config file + ansible.builtin.template: + src: server.toml.j2 + dest: /etc/siguldry/server.toml + owner: root + group: root + mode: '0644' + notify: Restart siguldry-server + tags: + - config + - siguldry + - siguldry/server + +- name: Setup server certificate + ansible.builtin.copy: + src: "{{ private }}/files/siguldryca/{{ env }}/pki/issued/siguldry-server.crt" + dest: /etc/siguldry/server.crt + owner: root + group: root + mode: '0644' + tags: + - config + - siguldry + - siguldry/server + +- name: Setup CA certificate + ansible.builtin.copy: + src: "{{ private }}/files/siguldryca/{{ env }}/pki/ca.crt" + dest: /etc/siguldry/ca.crt + owner: root + group: root + mode: '0644' + tags: + - config + - siguldry + - siguldry/server + +- name: Setup binding certificates + ansible.builtin.copy: + src: "{{ private }}/files/sigul/{{ item }}" + dest: "/etc/siguldry/{{ item }}" + owner: root + group: root + mode: '0644' + with_items: + - yubikey_sv03.pem + - yubikey_sv04.pem + - yubikey_sv05.pem + - yubikey_sv06.pem + when: env == "production" + tags: + - config + - siguldry + - siguldry/server + +- name: Setup software HSM for binding certificate in staging + ansible.builtin.include_tasks: kryoptic.yml + when: env != "production" + tags: + - siguldry + - siguldry/server + +- name: Check if siguldry database is initialized + ansible.builtin.stat: + path: /var/lib/siguldry/siguldry.sqlite + register: siguldry_db + tags: + - config + - siguldry + - siguldry/server + +- name: Initialize Siguldry database + ansible.builtin.command: + cmd: >- + systemd-run --pty --wait --collect + --working-directory=/var/lib/siguldry + --setenv=SIGULDRY_SERVER_CONFIG=/etc/siguldry/server.toml + --property=UMask=017 + --uid=siguldry + --gid=siguldry + siguldry-server manage migrate + when: not siguldry_db.stat.exists + tags: + - config + - siguldry + - siguldry/server + +- name: Enable and start siguldry-server service + ansible.builtin.systemd: + name: siguldry-server.service + enabled: yes + state: started + daemon_reload: yes + tags: + - services + - siguldry + - siguldry/server diff --git a/roles/siguldry/server/templates/kryoptic.toml.j2 b/roles/siguldry/server/templates/kryoptic.toml.j2 new file mode 100644 index 0000000000..4880b0a7cf --- /dev/null +++ b/roles/siguldry/server/templates/kryoptic.toml.j2 @@ -0,0 +1,4 @@ +[[slots]] +slot = 1 +dbtype = "sqlite" +dbargs = "{{ siguldry_kryoptic_db }}" diff --git a/roles/siguldry/server/templates/server-override.conf.j2 b/roles/siguldry/server/templates/server-override.conf.j2 new file mode 100644 index 0000000000..60aa35e97c --- /dev/null +++ b/roles/siguldry/server/templates/server-override.conf.j2 @@ -0,0 +1,12 @@ +[Service] +# Tweak for lower/higher log verbosity. +# Refer to https://docs.rs/tracing-subscriber/0.3.19/tracing_subscriber/filter/struct.EnvFilter.html#directives +Environment=SIGULDRY_SERVER_LOG="WARN,siguldry=INFO" + +{% if explicit_allow_tpm %} +# Credentials require the TPM to decrypt. +# +# For systemd 257 and older you'll need to explicitly allow access to the TPM +# Refer to https://github.com/systemd/systemd/issues/35959. +DeviceAllow=/dev/tpmrm0 +{% endif %} diff --git a/roles/siguldry/server/templates/server.toml.j2 b/roles/siguldry/server/templates/server.toml.j2 new file mode 100644 index 0000000000..759673e6c6 --- /dev/null +++ b/roles/siguldry/server/templates/server.toml.j2 @@ -0,0 +1,101 @@ +# The location where the server should store its state. +# +# To back up the service, back up this directory. +state_directory = "/var/lib/siguldry/" + +# The hostname of the Siguldry bridge. +{% if env == "production" %} +bridge_hostname = "sign-bridge.{{datacenter}}.fedoraproject.org" +{% else %} +bridge_hostname = "sign-bridge.stg.{{datacenter}}.fedoraproject.org" +{% endif %} + +# The port to use when connecting to the Siguldry bridge. +bridge_port = 44333 + +# The number of ready connections to maintain with the bridge. This decreases the latency of +# responses when multiple client connections are established, at the expense of some idle +# connections. Be aware that the bridge has its own limits on the allowable number of idle +# server connections. If you use multiple servers with a single bridge, be sure that the +# bridge allows enough idle connections to cover each server's pool size. The default is 32. +connection_pool_size = 32 + +# The minimum length for user's access password, in *bytes*. For example, the multi-byte +# UTF-8 character "🪿" counts as 4 bytes. +user_password_length = 64 + +# The user ID to use when creating OpenPGP keys. +# +# This is typically an email like "Signing Key ". +openpgp_user_id = "Fedora " + +# The set of certificates to encrypt passwords with. +# +# At least one entry should include a PKCS#11 URI for a private key. Signing keys are encrypted +# using each certificate, so providing more than one binding means *any* of the private keys +# associated with the certificates will allow you to access the signing key, assuming you have +# the user-set password for the key as well. +# +# When binding is used, the admin needs to unlock the token by entering the PIN using +# "siguldry-server enter-pin". +# +# If no bindings are configured, the keys are protected using only the user-provided +# password. +# +# An example binding entry: +# +# [[pkcs11_bindings]] +# certificate = "/path/to/cert.pem" +# private_key = "pkcs11:token=some-token;type=private" +# +# [[pkcs11_bindings]] +# certificate = "/path/to/a/second/cert.pem" +{% if env == "production" %} +[[pkcs11_bindings]] +certificate = "/etc/sigul/yubikey_sv03.pem" +{% if inventory_hostname.startswith('sign-vault03') %} +private_key = "pkcs11:serial=8f2a341e00d7a665;id=%03;type=private" +{% endif %} + +[[pkcs11_bindings]] +certificate = "/etc/sigul/yubikey_sv04.pem" +{% if inventory_hostname.startswith('sign-vault04') %} +private_key = "pkcs11:serial=b38ee13e56b3b987;id=%03;type=private" +{% endif %} + +[[pkcs11_bindings]] +certificate = "/etc/siguldry/yubikey_sv05.pem" +{% if inventory_hostname.startswith('sign-vault05') %} +private_key = "pkcs11:serial=e8dae68ae187ff13;id=%03;type=private" +{% endif %} + +[[pkcs11_bindings]] +certificate = "/etc/siguldry/yubikey_sv06.pem" +{% if inventory_hostname.startswith('sign-vault06') or inventory_hostname == "sign-vault01.rdu3.fedoraproject.org" %} +private_key = "pkcs11:serial=e3c4804a6631dd5f;id=%03;type=private" +{% endif %} + +{% else %} +# In staging, use Kryoptic as a software HSM for binding +[[pkcs11_bindings]] +certificate = "/etc/siguldry/kryoptic-binding.crt" +private_key = "pkcs11:token=siguldry-stg-token;type=private" +{% endif %} + +# The credentials to use when connecting to the bridge and when accepting client connections +# tunneled through the bridge. Note that the certificate must have both `clientAuth` and +# `serverAuth` in its extended key usage extension. +[credentials] +private_key = "siguldry.server.private_key.pem" +certificate = "/etc/siguldry/server.crt" +ca_certificate = "/etc/siguldry/ca.crt" + +# Certificates created by Siguldry allow the user to specify the subject's common name. +# +# The rest of the certificate's subject is specified here. +[certificate_subject] +country = "US" +state_or_province = "North Carolina" +locality = "Raleigh" +organization = "Red Hat, Inc." +organizational_unit = "The Fedora Project" diff --git a/roles/siguldry/server/templates/signer-override.conf.j2 b/roles/siguldry/server/templates/signer-override.conf.j2 new file mode 100644 index 0000000000..38c8eb1397 --- /dev/null +++ b/roles/siguldry/server/templates/signer-override.conf.j2 @@ -0,0 +1,16 @@ +[Service] +# Tweak for lower/higher log verbosity. +# Refer to https://docs.rs/tracing-subscriber/0.3.19/tracing_subscriber/filter/struct.EnvFilter.html#directives +Environment=SIGULDRY_SERVER_LOG="WARN,siguldry=INFO" + +{% if env != "production" %} +# Kryoptic software HSM configuration for staging +Environment=KRYOPTIC_CONF="{{ siguldry_kryoptic_conf }}" +{% endif %} + +# Unbinding keys requires access to a Yubikey +# I'm not sure there's a good way to allow _only_ the Yubikey device. +# +# TODO: also need to add access to whatever device has the Secure Boot keys. +# Also TODO: is this even the right way to expose USB devices? +DeviceAllow=/dev/bus/usb