draft: add roles for siguldry server and bridge

These roles deploy the Siguldry server and bridge.

There's a few TODOs, and one step that isn't covered at all is the
deployment of the TLS private keys. These need to be encrypted with
systemd-creds, which should be doable via ansible, but the pesign bridge
isn't doing it so I've left it out for now.

Signed-off-by: Jeremy Cline <jeremycline@microsoft.com>

.forgejo/workflows/ci.yaml

@@ -39,11 +39,15 @@ jobs:
     steps:
       - name: Install testing tools
         run: |
-          dnf install -y ansible-lint nodejs git ansible
+          dnf install -y python3-pip nodejs git
+          pip3 install ansible-core ansible-lint
 
       - name: Install ansible collections
         run: |
-          ansible-galaxy collection install community.zabbix
+          ansible-galaxy collection install \
+          community.zabbix \
+          community.general \
+          ansible.posix
 
       - name: Checkout code
         uses: https://code.forgejo.org/actions/checkout@v6

files/download/sync-up-downloads.sh.ib01

@@ -8,7 +8,7 @@
 RSYNC='/usr/bin/rsync'
 RS_OPT="-avSHP  --numeric-ids"
 RS_DEADLY="--delete --delete-excluded --delete-delay --delay-updates"
-ALT_EXCLUDES=""
+ALT_EXCLUDES="--exclude 44_Beta*" # 2026-04-16 - tmp. running out of space
 EPL_EXCLUDES=""
 FED_EXCLUDES=""
 

inventory/builders

@@ -289,6 +289,9 @@ buildhw-x86-01.rdu3.fedoraproject.org
 buildhw-x86-02.rdu3.fedoraproject.org
 buildhw-x86-03.rdu3.fedoraproject.org
 buildhw-x86-04.rdu3.fedoraproject.org
+buildhw-x86-05.rdu3.fedoraproject.org
+buildhw-x86-06.rdu3.fedoraproject.org
+buildhw-x86-07.rdu3.fedoraproject.org
 buildhw-x86-08.rdu3.fedoraproject.org
 buildhw-x86-09.rdu3.fedoraproject.org
 buildhw-x86-10.rdu3.fedoraproject.org
@@ -312,6 +315,9 @@ buildhw-x86-02.rdu3.fedoraproject.org
 buildhw-x86-03.rdu3.fedoraproject.org
 buildhw-x86-04.rdu3.fedoraproject.org
 # old iad2 hw
+buildhw-x86-05.rdu3.fedoraproject.org
+buildhw-x86-06.rdu3.fedoraproject.org
+buildhw-x86-07.rdu3.fedoraproject.org
 buildhw-x86-08.rdu3.fedoraproject.org
 buildhw-x86-09.rdu3.fedoraproject.org
 buildhw-x86-10.rdu3.fedoraproject.org

inventory/group_vars/all

@@ -100,6 +100,7 @@ communishift_projects:
     name: communishift-planet
   communishift-standupbot:
     name: communishift-standupbot
+    do_not_delete: true                           # Marked do not delete 2026-05-01 - dkirwan
   communishift-weekly-bootc:
     do_not_delete: true                           # Marked do not delete 2024-11-26. Needed until end of bootc initative. - dkirwan
     name: communishift-weekly-bootc

inventory/group_vars/buildvm_aarch64_stg

@@ -18,7 +18,7 @@ koji_topurl: "https://kojipkgs.stg.fedoraproject.org/"
 # Groups and individual hosts should ovveride them with specific info.
 
 koji_weburl: "https://koji.stg.fedoraproject.org/koji"
-ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/43/Server/aarch64/os/
+ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/aarch64/os/
 ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora
 lvm_size: 140000
 max_cpu: "{{ num_cpus }}"

inventory/group_vars/copr_aws

@@ -26,18 +26,13 @@ builders:
     aarch64: [50, 20, 33]
     x86_64: [70, 20, 52]
   aws_reserved_powerful:
-    x86_64: [1, 1, 1]
+    x86_64: [2, 2, 2]
   aws_powerful:
     aarch64: [10, 2, 0]
     x86_64: [10, 2, 1]
   aws_spot:
     aarch64: [30, 4, 1]
     x86_64: [70, 8, 16]
-  ppc64le_hypervisor_01:
-    ppc64le: [0, 4, 15]
-  # There's the ppc64le-test machine, so keep 2 builders less.
-  ppc64le_hypervisor_02:
-    ppc64le: [0, 4, 13]
   p09_hypervisor_01:
     ppc64le: [15, 5, 15]
   p09_hypervisor_02:
@@ -61,42 +56,42 @@ builders:
   x86_hypervisor_03:
     x86_64: [20, 4, 20]
   x86_hypervisor_04:
-    x86_64: [20, 4, 20]
+    x86_64: [0, 4, 20]
 
   ibm_cloud_us_east_hp:
     s390x: [2, 1, 0]
 
   ibm_cloud_br_sao_1:
-    s390x: [3, 1, 1]
+    s390x: [3, 3, 1]
   ibm_cloud_br_sao_2:
-    s390x: [3, 1, 1]
+    s390x: [3, 3, 1]
   ibm_cloud_br_sao_3:
-    s390x: [3, 1, 1]
+    s390x: [3, 3, 1]
 
   ibm_cloud_eu_es_1:
-    s390x: [3, 1, 1]
+    s390x: [3, 3, 1]
   ibm_cloud_eu_es_2:
-    s390x: [3, 1, 1]
+    s390x: [3, 3, 1]
   ibm_cloud_eu_es_3:
-    s390x: [3, 1, 1]
+    s390x: [3, 3, 1]
 
 cloud_instance_types:
   ibm_cloud:
-    s390x: mz2-2x16
+    s390x: bz2-2x8
     s390x_hp: bz2-16x64
 
 ibm_cloud_regions:
   eu_es:
     name: eu-es
     name_humans: Madrid, Spain
-    ssh_key: r050-cbd10ece-a28f-45c8-bc3a-15ecb9ff66d5
+    ssh_key: r050-4e396a17-294c-4197-9c56-e126185025a1
     vpc: r050-190b8bac-3bae-47cf-9be7-ac70fc54ccb9
     security_group: r050-cfc3db07-8cde-4807-9756-db91b242092a
     images: "{{ copr_builder_images.ibm_cloud.eu_es }}"
   br_sao:
     name: br-sao
     name_humans: Sao Paulo, Brazil
-    ssh_key: r042-4fb65a23-e7bd-440f-8d71-ff57b83a4152
+    ssh_key: r042-b30ff308-ef4f-43bf-bdd6-e16f1cc614cd
     vpc: r042-c902f12d-556f-4334-95cb-d181ebb3d8ba
     security_group: r042-22ef3881-fa20-4caa-9873-c8dc41c5dcb7
     images: "{{ copr_builder_images.ibm_cloud.br_sao }}"

inventory/group_vars/copr_dev_aws

@@ -33,10 +33,6 @@ builders:
   aws_spot:
     aarch64: [3, 3, 1]
     x86_64: [0, 0, 1]
-  ppc64le_hypervisor_01:
-    ppc64le: [0, 1, 1]
-  ppc64le_hypervisor_02:
-    ppc64le: [0, 1, 1]
   p09_hypervisor_01:
     ppc64le: [1, 1, 1]
   p09_hypervisor_02:
@@ -60,7 +56,7 @@ builders:
   x86_hypervisor_03:
     x86_64: [2, 1, 1]
   x86_hypervisor_04:
-    x86_64: [2, 1, 1]
+    x86_64: [0, 1, 1]
 
   ibm_cloud_us_east_hp:
     s390x: [1, 1, 0]
@@ -68,34 +64,34 @@ builders:
   ibm_cloud_br_sao_1:
     s390x: [1, 1, 0]
   ibm_cloud_br_sao_2:
-    s390x: [1, 1, 0]
+    s390x: [0, 0, 0]
   ibm_cloud_br_sao_3:
-    s390x: [1, 1, 0]
+    s390x: [0, 0, 0]
 
   ibm_cloud_eu_es_1:
-    s390x: [1, 1, 0]
+    s390x: [0, 0, 0]
   ibm_cloud_eu_es_2:
-    s390x: [1, 1, 0]
+    s390x: [0, 0, 0]
   ibm_cloud_eu_es_3:
-    s390x: [1, 1, 0]
+    s390x: [0, 0, 0]
 
 cloud_instance_types:
   ibm_cloud:
-    s390x: mz2-2x16
+    s390x: bz2-2x8
     s390x_hp: bz2-16x64
 
 ibm_cloud_regions:
   eu_es:
     name: eu-es
     name_humans: Madrid, Spain
-    ssh_key: r050-cbd10ece-a28f-45c8-bc3a-15ecb9ff66d5
+    ssh_key: r050-ea3b598c-39ca-4963-b8ef-c9d6ac146fad
     vpc: r050-190b8bac-3bae-47cf-9be7-ac70fc54ccb9
     security_group: r050-cfc3db07-8cde-4807-9756-db91b242092a
     images: "{{ copr_builder_images.ibm_cloud.eu_es }}"
   br_sao:
     name: br-sao
     name_humans: Sao Paulo, Brazil
-    ssh_key: r042-4fb65a23-e7bd-440f-8d71-ff57b83a4152
+    ssh_key: r042-3ec7f0e1-3eb3-4f55-a922-915c85da09c2
     vpc: r042-c902f12d-556f-4334-95cb-d181ebb3d8ba
     security_group: r042-22ef3881-fa20-4caa-9873-c8dc41c5dcb7
     images: "{{ copr_builder_images.ibm_cloud.br_sao }}"

inventory/group_vars/copr_hypervisor

@@ -19,6 +19,8 @@ primary_auth_source: ipa
 
 nbde: true
 nbde_device: /dev/md2
+nbde_device2: /dev/md3
+nbde_device3: /dev/md4
 nbde_client_bindings:
   - device: "{{ nbde_device }}"
     encryption_password: "{{ nbde_password }}"
@@ -27,6 +29,20 @@ nbde_client_bindings:
     servers:
       - http://tang01.rdu3.fedoraproject.org
       - http://tang02.rdu3.fedoraproject.org
+  - device: "{{ nbde_device2 }}"
+    encryption_password: "{{ nbde_password }}"
+    password_temporary: no
+    threshold: 1
+    servers:
+      - http://tang01.rdu3.fedoraproject.org
+      - http://tang02.rdu3.fedoraproject.org
+  - device: "{{ nbde_device3 }}"
+    encryption_password: "{{ nbde_password }}"
+    password_temporary: no
+    threshold: 1
+    servers:
+      - http://tang01.rdu3.fedoraproject.org
+      - http://tang02.rdu3.fedoraproject.org
 
 libvirt_host: "{{ inventory_hostname }}"
 

inventory/group_vars/download

@@ -107,6 +107,9 @@ dl_tier1:
   - sv.mirrors.kernel.org
   - dfw.mirrors.kernel.org
   - mirror.raiolanetworks.com # 91.132.103.246 / 2a12:d282:102:f6::1
+  - ftp-osl.osuosl.org # 140.211.166.134 / 2605:bc80:3010::134
+  - ftp-chi.osuosl.org # 64.50.236.52 / 2600:3402:200:227::2
+  - ftp-nyc.osuosl.org # 64.50.233.100
 ipa_host_group: download
 ipa_host_group_desc: Download servers
 nagios_Check_Services:

inventory/group_vars/koji_riscv

@@ -11,8 +11,8 @@ ipa_host_group_desc: riscv Koji Hub hosts
 koji_hub: "riscv-koji.fedoraproject.org/kojihub"
 koji_root: "riscv-koji.fedoraproject.org/koji"
 lvm_size: 100000
-mem_size: 32768
-max_mem_size: 65536
+mem_size: 45056
+max_mem_size: 90112
 nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=4"
 num_cpus: 8
 primary_auth_source: ipa

inventory/group_vars/wiki

@@ -14,7 +14,7 @@ lvm_size: 30000
 max_mem_size: 8192
 mem_size: 8192
 nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=3"
-num_cpus: 4
+num_cpus: 16
 primary_auth_source: ipa
 tcp_ports: [80]
 # mediawiki variables

inventory/host_vars/buildhw-x86-05.rdu3.fedoraproject.org

@@ -0,0 +1,70 @@
+---
+bmc:
+  ip_address: 10.16.160.16
+  ping: true
+  http: true
+  https: true
+br0_ipv4_ip: 10.16.169.35
+br0_ipv4_gw: 10.16.169.254
+br0_ipv4_nm: 24
+datacenter: rdu3
+dns1: 10.16.163.33
+dns2: 10.16.163.34
+dns_search1: "rdu3.fedoraproject.org"
+dns_search2: "fedoraproject.org"
+has_ipv4: yes
+mac0: c8:4b:d6:88:fb:c6
+mac1: c8:4b:d6:88:fb:c7
+mac2: 6c:fe:54:57:5f:48
+mac3: 6c:fe:54:57:5f:49
+network_connections:
+   # Bridge profile
+   - name: br0
+     state: up
+     type: bridge
+     mtu: 1500
+     autoconnect: yes
+     ip:
+      address:
+        - "{{ br0_ipv4_ip }}/{{ br0_ipv4_nm }}"
+      dhcp4: no
+      dns:
+        - "{{ dns1 }}"
+        - "{{ dns2 }}"
+      dns_search:
+        - "{{ dns_search1 }}"
+        - "{{ dns_search2 }}"
+      gateway4: "{{ br0_ipv4_gw }}"
+   # Bond profile
+   - name: bond0
+     type: bond
+     interface_name: bond0
+     mtu: 1500
+     controller: br0
+     bond:
+       mode: 802.3ad
+   # Port profile for the 1st Ethernet device
+   - name: bond0-port1
+     mac: "{{ mac2 }}"
+     type: ethernet
+     controller: bond0
+     state: up
+     mtu: 1500
+   # Port profile for the 2nd Ethernet device
+   - name: bond0-port2
+     mac: "{{ mac3 }}"
+     type: ethernet
+     controller: bond0
+     state: up
+     mtu: 1500
+# This is used to populate the inventory fields, only specific keys are allowed, see
+# https://www.zabbix.com/documentation/current/en/manual/api/reference/host/object#host-inventory
+zabbix_inventory:
+  date_hw_expiry: ""
+  date_hw_purchase: "2022-12-31"
+  hardware: PowerEdge R650
+  location: RDU3
+  oob_ip: "{{ bmc.ip_address }}"
+  serialno_a: 3ZGTRT3
+  type: Prod_Dedicated_HW
+  vendor: Dell

inventory/host_vars/buildhw-x86-06.rdu3.fedoraproject.org

@@ -0,0 +1,70 @@
+---
+bmc:
+  ip_address: 10.16.160.17
+  ping: true
+  http: true
+  https: true
+br0_ipv4_ip: 10.16.169.36
+br0_ipv4_gw: 10.16.169.254
+br0_ipv4_nm: 24
+datacenter: rdu3
+dns1: 10.16.163.33
+dns2: 10.16.163.34
+dns_search1: "rdu3.fedoraproject.org"
+dns_search2: "fedoraproject.org"
+has_ipv4: yes
+mac0: c8:4b:d6:89:f7:5c
+mac1: c8:4b:d6:89:f7:5d
+mac2: 6c:fe:54:57:80:2c
+mac3: 6c:fe:54:57:80:2d
+network_connections:
+   # Bridge profile
+   - name: br0
+     state: up
+     type: bridge
+     mtu: 1500
+     autoconnect: yes
+     ip:
+      address:
+        - "{{ br0_ipv4_ip }}/{{ br0_ipv4_nm }}"
+      dhcp4: no
+      dns:
+        - "{{ dns1 }}"
+        - "{{ dns2 }}"
+      dns_search:
+        - "{{ dns_search1 }}"
+        - "{{ dns_search2 }}"
+      gateway4: "{{ br0_ipv4_gw }}"
+   # Bond profile
+   - name: bond0
+     type: bond
+     interface_name: bond0
+     mtu: 1500
+     controller: br0
+     bond:
+       mode: 802.3ad
+   # Port profile for the 1st Ethernet device
+   - name: bond0-port1
+     mac: "{{ mac2 }}"
+     type: ethernet
+     controller: bond0
+     state: up
+     mtu: 1500
+   # Port profile for the 2nd Ethernet device
+   - name: bond0-port2
+     mac: "{{ mac3 }}"
+     type: ethernet
+     controller: bond0
+     state: up
+     mtu: 1500
+# This is used to populate the inventory fields, only specific keys are allowed, see
+# https://www.zabbix.com/documentation/current/en/manual/api/reference/host/object#host-inventory
+zabbix_inventory:
+  date_hw_expiry: ""
+  date_hw_purchase: "2022-12-31"
+  hardware: PowerEdge R650
+  location: RDU3
+  oob_ip: "{{ bmc.ip_address }}"
+  serialno_a: 2ZGTRT3
+  type: Prod_Dedicated_HW
+  vendor: Dell

inventory/host_vars/buildhw-x86-07.rdu3.fedoraproject.org

@@ -0,0 +1,68 @@
+---
+bmc:
+  ip_address: 10.16.160.18
+  ping: true
+  http: true
+  https: true
+br0_ipv4_ip: 10.16.169.37
+br0_ipv4_gw: 10.16.169.254
+br0_ipv4_nm: 24
+datacenter: rdu3
+dns1: 10.16.163.33
+dns2: 10.16.163.34
+dns_search1: "rdu3.fedoraproject.org"
+dns_search2: "fedoraproject.org"
+has_ipv4: yes
+mac0: 6c:fe:54:57:4d:80
+mac1: 6c:fe:54:57:4d:81
+network_connections:
+   # Bridge profile
+   - name: br0
+     state: up
+     type: bridge
+     mtu: 1500
+     autoconnect: yes
+     ip:
+      address:
+        - "{{ br0_ipv4_ip }}/{{ br0_ipv4_nm }}"
+      dhcp4: no
+      dns:
+        - "{{ dns1 }}"
+        - "{{ dns2 }}"
+      dns_search:
+        - "{{ dns_search1 }}"
+        - "{{ dns_search2 }}"
+      gateway4: "{{ br0_ipv4_gw }}"
+   # Bond profile
+   - name: bond0
+     type: bond
+     interface_name: bond0
+     mtu: 1500
+     controller: br0
+     bond:
+       mode: 802.3ad
+   # Port profile for the 1st Ethernet device
+   - name: bond0-port1
+     mac: "{{ mac0 }}"
+     type: ethernet
+     controller: bond0
+     state: up
+     mtu: 1500
+   # Port profile for the 2nd Ethernet device
+   - name: bond0-port2
+     mac: "{{ mac1 }}"
+     type: ethernet
+     controller: bond0
+     state: up
+     mtu: 1500
+# This is used to populate the inventory fields, only specific keys are allowed, see
+# https://www.zabbix.com/documentation/current/en/manual/api/reference/host/object#host-inventory
+zabbix_inventory:
+  date_hw_expiry: "2029-02-17"
+  date_hw_purchase: "2022-12-31"
+  hardware: PowerEdge R650
+  location: RDU3
+  oob_ip: "{{ bmc.ip_address }}"
+  serialno_a: 617DRT3
+  type: Prod_Dedicated_HW
+  vendor: Dell

inventory/host_vars/db-datanommer02.rdu3.fedoraproject.org

@@ -41,3 +41,5 @@ shared_buffers: "4GB"
 tcp_ports: [5432, 443]
 vmhost: vmhost-x86-04.rdu3.fedoraproject.org
 volgroup: /dev/vg_guests
+zabbix_macros:
+  'PG.LOCKS.MAX.WARN:"mirrormanager2"': 3000

inventory/host_vars/db01.rdu3.fedoraproject.org

@@ -82,5 +82,6 @@ vmhost: vmhost-x86-04.rdu3.fedoraproject.org
 volgroup: /dev/vg_guests
 zabbix_macros:
   'PG.LOCKS.MAX.WARN:"anitya"': 500
-  'PG.LOCKS.MAX.WARN:"bodhi2"': 200
+  'PG.LOCKS.MAX.WARN:"bodhi2"': 500
+  'PG.LOCKS.MAX.WARN:"datanommer2"': 1000
   'PG.LOCKS.MAX.WARN:"hyperkitty"': 500

inventory/host_vars/ipsilon03.rdu3.fedoraproject.org

@@ -1,16 +0,0 @@
----
-datacenter: rdu3
-eth0_ipv4_gw: 10.16.163.254
-eth0_ipv4_ip: 10.16.163.117
-ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/43/Server/x86_64/os/
-ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora
-vmhost: vmhost-x86-02.rdu3.fedoraproject.org
-volgroup: /dev/vg_guests
-# Network configuration for RDU3
-dns: 10.16.163.33
-dns1: 10.16.163.33
-dns2: 10.16.163.34
-dns_search1: "rdu3.fedoraproject.org"
-dns_search2: "vpn.fedoraproject.org"
-dns_search3: "fedoraproject.org"
-openid: yes

inventory/host_vars/openqa-a64-worker01.rdu3.fedoraproject.org

@@ -67,7 +67,7 @@ nrpe_procs_warn: 1400
 openqa_rngd: true
 openqa_tap_iface: bondbr0
 # this is a very powerful machine, can handle so many openQA workers
-openqa_workers: 60
+openqa_workers: 45
 # also means we need to bump the load average threshold
 openqa_critical_threshold: 120
 sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
@@ -76,7 +76,7 @@ sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
 # QEMUPORT is:
 # $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002;
 # so for worker 1 it's 20012, for worker 2 it's 20022, etc etc
-tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453', '20463', '20473', '20483', '20493', '20503', '20513', '20523', '20533', '20543', '20553', '20563', '20573', '20583', '20593', '20603']
+tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453']
 
 # This is used to populate the inventory fields, only specific keys are allowed, see
 # https://www.zabbix.com/documentation/current/en/manual/api/reference/host/object#host-inventory

inventory/host_vars/openqa-a64-worker02.rdu3.fedoraproject.org

@@ -67,7 +67,7 @@ nrpe_procs_warn: 1400
 openqa_rngd: true
 openqa_tap_iface: bondbr0
 # this is a very powerful machine, can handle so many openQA workers
-openqa_workers: 60
+openqa_workers: 45
 # also means we need to bump the load average threshold
 openqa_critical_threshold: 120
 sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
@@ -76,7 +76,7 @@ sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
 # QEMUPORT is:
 # $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002;
 # so for worker 1 it's 20012, for worker 2 it's 20022, etc etc
-tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453', '20463', '20473', '20483', '20493', '20503', '20513', '20523', '20533', '20543', '20553', '20563', '20573', '20583', '20593', '20603']
+tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453']
 
 # This is used to populate the inventory fields, only specific keys are allowed, see
 # https://www.zabbix.com/documentation/current/en/manual/api/reference/host/object#host-inventory

inventory/host_vars/openqa-a64-worker03.rdu3.fedoraproject.org

@@ -67,7 +67,7 @@ nrpe_procs_warn: 1400
 openqa_rngd: true
 openqa_tap_iface: bondbr0
 # this is a very powerful machine, can handle so many openQA workers
-openqa_workers: 60
+openqa_workers: 45
 # also means we need to bump the load average threshold
 openqa_critical_threshold: 120
 sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
@@ -76,7 +76,7 @@ sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
 # QEMUPORT is:
 # $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002;
 # so for worker 1 it's 20012, for worker 2 it's 20022, etc etc
-tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453', '20463', '20473', '20483', '20493', '20503', '20513', '20523', '20533', '20543', '20553', '20563', '20573', '20583', '20593', '20603']
+tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453']
 
 # This is used to populate the inventory fields, only specific keys are allowed, see
 # https://www.zabbix.com/documentation/current/en/manual/api/reference/host/object#host-inventory

inventory/host_vars/openqa-a64-worker04.rdu3.fedoraproject.org

@@ -67,7 +67,7 @@ nrpe_procs_warn: 1400
 openqa_rngd: true
 openqa_tap_iface: bondbr0
 # this is a very powerful machine, can handle so many openQA workers
-openqa_workers: 60
+openqa_workers: 45
 # also means we need to bump the load average threshold
 openqa_critical_threshold: 120
 sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
@@ -76,7 +76,7 @@ sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
 # QEMUPORT is:
 # $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002;
 # so for worker 1 it's 20012, for worker 2 it's 20022, etc etc
-tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453', '20463', '20473', '20483', '20493', '20503', '20513', '20523', '20533', '20543', '20553', '20563', '20573', '20583', '20593', '20603']
+tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453']
 
 # This is used to populate the inventory fields, only specific keys are allowed, see
 # https://www.zabbix.com/documentation/current/en/manual/api/reference/host/object#host-inventory

inventory/host_vars/openqa-a64-worker05.rdu3.fedoraproject.org

@@ -67,7 +67,7 @@ nrpe_procs_warn: 1400
 openqa_rngd: true
 openqa_tap_iface: bondbr0
 # this is a very powerful machine, can handle so many openQA workers
-openqa_workers: 60
+openqa_workers: 45
 # also means we need to bump the load average threshold
 openqa_critical_threshold: 120
 sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
@@ -76,7 +76,7 @@ sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
 # QEMUPORT is:
 # $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002;
 # so for worker 1 it's 20012, for worker 2 it's 20022, etc etc
-tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453', '20463', '20473', '20483', '20493', '20503', '20513', '20523', '20533', '20543', '20553', '20563', '20573', '20583', '20593', '20603']
+tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453']
 
 # This is used to populate the inventory fields, only specific keys are allowed, see
 # https://www.zabbix.com/documentation/current/en/manual/api/reference/host/object#host-inventory

inventory/host_vars/openqa-a64-worker06.rdu3.fedoraproject.org

@@ -67,7 +67,7 @@ nrpe_procs_warn: 1400
 openqa_rngd: true
 openqa_tap_iface: bondbr0
 # this is a very powerful machine, can handle so many openQA workers
-openqa_workers: 60
+openqa_workers: 45
 # also means we need to bump the load average threshold
 openqa_critical_threshold: 120
 sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
@@ -76,7 +76,7 @@ sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
 # QEMUPORT is:
 # $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002;
 # so for worker 1 it's 20012, for worker 2 it's 20022, etc etc
-tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453', '20463', '20473', '20483', '20493', '20503', '20513', '20523', '20533', '20543', '20553', '20563', '20573', '20583', '20593', '20603']
+tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453']
 
 # This is used to populate the inventory fields, only specific keys are allowed, see
 # https://www.zabbix.com/documentation/current/en/manual/api/reference/host/object#host-inventory

inventory/inventory

@@ -330,12 +330,10 @@ ipsilon01.stg.rdu3.fedoraproject.org
 [ipsilon]
 ipsilon01.rdu3.fedoraproject.org
 ipsilon02.rdu3.fedoraproject.org
-ipsilon03.rdu3.fedoraproject.org
 
 [ipsilon_rdu3]
 ipsilon01.rdu3.fedoraproject.org
 ipsilon02.rdu3.fedoraproject.org
-ipsilon03.rdu3.fedoraproject.org
 
 [nagios]
 noc02.fedoraproject.org

playbooks/groups/copr-hypervisor.yml

@@ -20,7 +20,7 @@
         dest: /usr/bin/nbde_client-network-flush
         owner: root
         group: root
-        mode: 755
+        mode: 0755
 
     - name: tell NetworkManager we don't want any auto connections
       ansible.builtin.copy:
@@ -28,7 +28,7 @@
         dest: /etc/NetworkManager/conf.d/noautodefault.conf
         owner: root
         group: root
-        mode: 644
+        mode: 0644
 
   tasks:
     - import_role: name=base
@@ -41,6 +41,7 @@
     - import_role:
         name: copr/hypervisor
       tags: copr_hypervisor
+    - {import_role: name=serial-console, when: datacenter == 'rdu3' and ansible_architecture != 'ppc64le'}
     - {import_role: name=linux-system-roles.nbde_client, tags: ['nbde_client'], when: (nbde|bool) }
 
 

playbooks/groups/people.yml

@@ -79,6 +79,10 @@
 
   - role: apache
 
+  - role: anubis-el
+    tags:
+    - anubis
+
   - role: httpd/certificate
     certname: wildcard-2025.fedorapeople.org
     SSLCertificateChainFile: wildcard-2025.fedorapeople.org.intermediate.cert

playbooks/include/proxies-redirects.yml

@@ -1018,3 +1018,10 @@
     target: https://communityhealth.languages-in-floss.eu
     tags:
       - languages
+
+  - role: httpd/redirectmatch
+    shortname: provisioning-server
+    website: provisioning.fedoraproject.org
+    target: https://fedoraproject.org/iot/
+    tags:
+      - provisioning

playbooks/include/proxies-websites.yml

@@ -48,8 +48,8 @@
     server_aliases:
     - stg.fedoraproject.org
     - localhost
-    - www.fedoraproject.org
     - hotspot-nocache.fedoraproject.org
+    tags: fedoraproject.org
 
   # This is for all the other domains we own
   # that redirect to https://fedoraproject.org
@@ -1292,6 +1292,7 @@
     cert_name: "{{wildcard_cert_name}}"
     tags:
     - riscv-koji
+    anubis: true
 
   - role: httpd/website
     site_name: riscv-kojipkgs.fedoraproject.org
@@ -1299,6 +1300,17 @@
     cert_name: "{{wildcard_cert_name}}"
     tags:
     - riscv-koji
+    anubis: true
+    when: "'proxies_internal' not in group_names"
+
+  - role: httpd/website
+    site_name: riscv-kojipkgs.fedoraproject.org
+    sslonly: true
+    cert_name: "{{wildcard_cert_name}}"
+    tags:
+    - riscv-koji
+    anubis: false
+    when: "'proxies_internal' in group_names"
 
   - role: httpd/website
     site_name: "forge{{ env_suffix }}.fedoraproject.org"

playbooks/manual/communishift_send_email_notifications.yml

@@ -5,6 +5,9 @@
 # Run notifications only:
 #   ansible-playbook .../communishift_send_email_notifications.yml --tags communishift_send_notifications
 #
+# Dry run (FASJSON + per-project preview, no SMTP mail):
+#   ansible-playbook .../communishift_send_email_notifications.yml --tags communishift_send_notifications -e communishift_email_notifications_dry_run=true
+#
 - hosts: localhost
   user: root
   gather_facts: false
@@ -31,3 +34,10 @@
           tags:
             - communishift_send_notifications
       loop: "{{ lookup('dict', communishift_projects) }}"
+
+    - name: Summary of Communishift projects notified  # noqa: run-once[task]
+      ansible.builtin.debug:
+        msg: "{%- set ns = namespace(names=[]) %}{%- for item in communishift_projects | dict2items | sort(attribute='value.name') %}{%- if not (item.value.do_not_delete | default(false)) %}{%- set _ = ns.names.append(item.value.name) %}{%- endif %}{%- endfor %} {% if communishift_email_notifications_dry_run | default(false) %}Communishift notification dry run complete (no email sent). Would notify {{ ns.names | length }} project(s): {{ ns.names | join(' ') }}{% else %}Communishift notification run complete. Emails were sent for {{ ns.names | length }} project(s): {{ ns.names | join(' ') }}{% endif %}"
+      run_once: true
+      tags:
+        - communishift_send_notifications

playbooks/openshift-apps/badges.yml

@@ -182,8 +182,8 @@
     # Deployment config
     - role: openshift/object
       object_app: badges
-      object_template: deploymentconfig.yml.j2
-      object_objectname: deploymentconfig.yml
+      object_template: deployment.yml.j2
+      object_objectname: deployment.yml
 
     # Cron jobs
     - role: openshift/object

playbooks/openshift-apps/blockerbugs.yml

@@ -92,11 +92,6 @@
     object_template: buildconfig.yml.j2
     object_objectname: buildconfig.yml
 
-  - role: openshift/object
-    object_app: blockerbugs
-    object_template: deploymentconfig.yml.j2
-    object_objectname: deploymentconfig.yml
-
   - role: openshift/object
     object_app: blockerbugs
     object_template: deployment.yml.j2

playbooks/openshift-apps/bodhi.yml

@@ -139,8 +139,8 @@
       haproxy.router.openshift.io/timeout: 180s
   - role: openshift/object
     object_app: bodhi
-    object_template: deploymentconfig.yml.j2
-    object_objectname: deploymentconfig.yml
+    object_template: deployment.yml.j2
+    object_objectname: deployment.yml
   - role: openshift/object
     object_app: bodhi
     object_template: critpathcron.yml.j2
@@ -169,22 +169,22 @@
 
   post_tasks:
   - name: Scale up pods
-    ansible.builtin.command: oc -n bodhi scale dc/bodhi-consumer --replicas={{ bodhi_openshift_pods }}
+    ansible.builtin.command: oc -n bodhi scale deployment bodhi-consumer --replicas={{ bodhi_openshift_pods }}
     when: env == "production"
   - name: Scale up pods
-    ansible.builtin.command: oc -n bodhi scale dc/bodhi-celery --replicas={{ bodhi_openshift_pods }}
+    ansible.builtin.command: oc -n bodhi scale deployment bodhi-celery --replicas={{ bodhi_openshift_pods }}
     when: env == "production"
   - name: Scale up pods
-    ansible.builtin.command: oc -n bodhi scale dc/bodhi-web --replicas=4
+    ansible.builtin.command: oc -n bodhi scale deployment bodhi-web --replicas=4
     when: env == "production"
   - name: Scale up pods
-    ansible.builtin.command: oc -n bodhi scale dc/bodhi-consumer --replicas={{ bodhi_openshift_pods_stg_consumers }}
+    ansible.builtin.command: oc -n bodhi scale deployment bodhi-consumer --replicas={{ bodhi_openshift_pods_stg_consumers }}
     when: env == "staging"
   - name: Scale up pods
-    ansible.builtin.command: oc -n bodhi scale dc/bodhi-celery --replicas={{ bodhi_openshift_pods }}
+    ansible.builtin.command: oc -n bodhi scale deployment bodhi-celery --replicas={{ bodhi_openshift_pods }}
     when: env == "staging"
   - name: Scale up pods
-    ansible.builtin.command: oc -n bodhi scale dc/bodhi-web --replicas={{ bodhi_openshift_pods }}
+    ansible.builtin.command: oc -n bodhi scale deployment bodhi-web --replicas={{ bodhi_openshift_pods }}
     when: env == "staging"
   - name: Set the timeout to the openshift route
     ansible.builtin.command: "oc -n bodhi annotate route bodhi-web --overwrite haproxy.router.openshift.io/timeout=180s"

playbooks/openshift-apps/datanommer.yml

@@ -80,8 +80,8 @@
 
   - role: openshift/object
     object_app: datanommer
-    object_template: deploymentconfig.yml.j2
-    object_objectname: deploymentconfig.yml
+    object_template: deployment.yml.j2
+    object_objectname: deployment.yml
 
   - role: openshift/object
     object_app: datanommer

playbooks/openshift-apps/easyfix.yml

@@ -1,71 +0,0 @@
-#
-# Fedora Project easyfixes
-#
----
-- name: Make the app be real
-  # hosts: os_control_stg:os_control
-  hosts: os_control_stg
-  user: root
-  gather_facts: false
-
-  vars_files:
-    - /srv/web/infra/ansible/vars/global.yml
-    - /srv/private/ansible/vars.yml
-    - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml
-
-  vars:
-
-  roles:
-    - role: openshift/project
-      project_app: easyfix
-      project_description: "Easyfixes"
-      project_appowners:
-        - abompard
-      tags:
-        - apply-appowners
-
-    - role: openshift/object
-      object_app: easyfix
-      object_file: imagestream.yml
-      object_objectname: imagestream.yml
-
-    - role: openshift/object
-      object_app: easyfix
-      object_template: buildconfig.yml.j2
-      object_objectname: buildconfig.yml
-
-    - role: openshift/object
-      object_app: easyfix
-      object_file: storage.yml
-      object_objectname: storage.yml
-
-    - role: openshift/object
-      object_app: easyfix
-      object_template: configmap.yml.j2
-      object_objectname: configmap.yml
-
-    - role: openshift/object
-      object_app: easyfix
-      object_file: service.yml
-      object_objectname: service.yml
-
-    # Routes
-    - role: openshift/route
-      route_app: easyfix
-      route_name: web
-      route_host: "easyfix.apps.ocp{{ env_suffix }}.fedoraproject.org"
-      route_servicename: web
-      route_serviceport: web
-      route_annotations:
-        haproxy.router.openshift.io/timeout: 5m
-
-    - role: openshift/object
-      object_app: easyfix
-      object_template: deploymentconfig.yml.j2
-      object_objectname: deploymentconfig.yml
-
-    # Cron jobs
-    - role: openshift/object
-      object_app: easyfix
-      object_template: cron.yml.j2
-      object_objectname: cron.yml

playbooks/openshift-apps/elections.yml

@@ -119,5 +119,5 @@
 
   - role: openshift/object
     object_app: elections
-    object_file: deploymentconfig.yml
-    object_objectname: deploymentconfig.yml
+    object_file: deployment.yml
+    object_objectname: deployment.yml

playbooks/openshift-apps/flatpak-indexer.yml

@@ -60,5 +60,5 @@
 
   - role: openshift/object
     object_app: flatpak-indexer
-    object_template: deploymentconfig.yml.j2
-    object_objectname: deploymentconfig.yml
+    object_template: deployment.yml.j2
+    object_objectname: deployment.yml

playbooks/openshift-apps/fmn.yml

@@ -217,8 +217,8 @@
     # Deployment config
     - role: openshift/object
       object_app: fmn
-      object_template: deploymentconfig.yml.j2
-      object_objectname: deploymentconfig.yml
+      object_template: deployment.yml.j2
+      object_objectname: deployment.yml
 
     # FASJSON access
     - role: openshift/ipa-client

playbooks/openshift-apps/mirrormanager.yml

@@ -133,8 +133,8 @@
     # Deployment config
     - role: openshift/object
       object_app: mirrormanager
-      object_template: deploymentconfig.yml.j2
-      object_objectname: deploymentconfig.yml
+      object_template: deployment.yml.j2
+      object_objectname: deployment.yml
 
     # Cron jobs
     - role: openshift/object

playbooks/openshift-apps/noggin-centos.yml

@@ -103,8 +103,8 @@
   - role: openshift/object
     object_app: noggin
     object_os_app: noggin-centos
-    object_template: deploymentconfig.yml.j2
-    object_objectname: deploymentconfig.yml
+    object_template: deployment.yml.j2
+    object_objectname: deployment.yml
 
   - role: openshift/start-build
     start_build_app: noggin-centos

playbooks/openshift-apps/noggin.yml

@@ -98,8 +98,9 @@
 
   - role: openshift/object
     object_app: noggin
-    object_template: deploymentconfig.yml.j2
-    object_objectname: deploymentconfig.yml
+    object_os_app: noggin
+    object_template: deployment.yml.j2
+    object_objectname: deployment.yml
 
   - role: openshift/start-build
     start_build_app: noggin

playbooks/openshift-apps/poddlers.yml

@@ -104,8 +104,8 @@
 
     - role: openshift/object
       object_app: poddlers
-      object_template: deploymentconfig.yml.j2
-      object_objectname: deploymentconfig.yml
+      object_template: deployment.yml.j2
+      object_objectname: deployment.yml
 
     - role: openshift/object
       object_app: poddlers

playbooks/openshift-apps/release-monitoring.yml

@@ -63,8 +63,8 @@
     object_objectname: route.yml
   - role: openshift/object
     object_app: release-monitoring
-    object_template: deploymentconfig.yml.j2
-    object_objectname: deploymentconfig.yml
+    object_template: deployment.yml.j2
+    object_objectname: deployment.yml
   - role: openshift/rollout
     rollout_app: release-monitoring
     rollout_dcname: release-monitoring-web

playbooks/openshift-apps/transtats.yml

@@ -1,56 +0,0 @@
----
-- name: Make the app be real
-  hosts: os_control[0]:os_control_stg[0]
-  user: root
-  gather_facts: false
-
-  vars_files:
-    - /srv/web/infra/ansible/vars/global.yml
-    - "/srv/private/ansible/vars.yml"
-    - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml
-
-  roles:
-  - role: openshift/project
-    project_app: transtats
-    project_description: transtats
-    project_appowners:
-    - suanand
-  - role: openshift/object
-    object_app: transtats
-    object_objectname: secret.yml
-    object_template: secret.yml.j2
-  - role: openshift/imagestream
-    imagestream_app: transtats
-    imagestream_imagename: transtats
-  - role: openshift/object
-    object_app: transtats
-    object_template: buildconfig.yml.j2
-    object_objectname: buildconfig.yml
-  - role: openshift/start-build
-    start_build_app: transtats
-    start_build_buildname: transtats-build
-    tags:
-    - never
-    - build
-  - role: openshift/object
-    object_app: transtats
-    object_file: service.yml
-    object_objectname: service.yml
-  - role: openshift/route
-    route_app: transtats
-    route_name: transtats-web
-    route_host: transtats{{ env_suffix }}.fedoraproject.org
-    route_serviceport: web
-    route_servicename: transtats-web
-    route_annotations:
-      haproxy.router.openshift.io/timeout: 8m
-  - role: openshift/object
-    object_app: transtats
-    object_file: deploymentconfig.yml
-    object_objectname: deploymentconfig.yml
-  - role: openshift/rollout
-    rollout_app: transtats
-    rollout_dcname: transtats-web
-    tags:
-    - never
-    - rollout

playbooks/openshift-apps/webhook2fedmsg.yml

@@ -110,8 +110,8 @@
     # Deployment config
     - role: openshift/object
       object_app: webhook2fedmsg
-      object_template: deploymentconfig.yml.j2
-      object_objectname: deploymentconfig.yml
+      object_template: deployment.yml.j2
+      object_objectname: deployment.yml
 
   # - role: openshift/start-build
   #   start_build_app: webhook2fedmsg

playbooks/openshift-apps/zezere.yml

@@ -1,56 +0,0 @@
----
-- name: Make the app be real
-  hosts: os_control[0]:os_control_stg[0]
-  user: root
-  gather_facts: false
-
-  vars_files:
-    - /srv/web/infra/ansible/vars/global.yml
-    - "/srv/private/ansible/vars.yml"
-    - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml
-
-  roles:
-  - role: openshift/project
-    project_app: zezere
-    project_description: Zezere provisioning service
-    project_appowners:
-    - pbrobinson
-  - role: openshift/imagestream
-    imagestream_app: zezere
-    imagestream_imagename: zezere
-  - role: openshift/object
-    object_app: zezere
-    object_objectname: buildconfig.yml
-    object_file: buildconfig.yml
-  - role: openshift/start-build
-    start_build_app: zezere
-    start_build_buildname: zezere-build
-    tags:
-    - never
-    - build
-  - role: openshift/object
-    object_app: zezere
-    object_file: service.yml
-    object_objectname: service.yml
-  - role: openshift/route
-    route_app: zezere
-    route_name: zezere
-    route_host: "provision{{ env_suffix }}.fedoraproject.org"
-    route_servicename: zezere
-    route_serviceport: 8080
-    route_annotations:
-      haproxy.router.openshift.io/set-forwarded-headers: append
-  - role: openshift/object
-    object_app: zezere
-    object_template: secret.yml.j2
-    object_objectname: secret.yml
-  - role: openshift/object
-    object_app: zezere
-    object_template: deploymentconfig.yml.j2
-    object_objectname: deploymentconfig.yml
-  - role: openshift/rollout
-    rollout_app: zezere
-    rollout_dcname: zezere
-    tags:
-    - never
-    - rollout

roles/communishift/tasks/cleanup-administration-send-notifications.yml

@@ -28,6 +28,22 @@
     headers:
       - Reply-To=admin@fedoraproject.org
     charset: us-ascii
-  when: "not should_not_delete"
+  when:
+    - not should_not_delete
+    - not communishift_email_notifications_dry_run | default(false)
+  tags:
+    - communishift_send_notifications
+
+- name: Communishift notification email (dry-run preview, mail not sent)
+  ansible.builtin.debug:
+    msg:
+      dry_run: true
+      project: "{{ item.value.name }}"
+      to: infrastructure@lists.fedoraproject.org
+      bcc: "{{ communishift_project_emails[item.value.name]['email_list'] }}"
+      subject: "Fedora Communishift Notification for project: {{ item.value.name }}"
+  when:
+    - not should_not_delete
+    - communishift_email_notifications_dry_run | default(false)
   tags:
     - communishift_send_notifications

roles/copr/backend/files/buildsys.production.pub

@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCao0nJaZ5JIE8rn5M/l5VXU1e1LSqGKVbDjNYIwbbT2n7T9SK91D2s7EpUq0/QdoFKuZVsGgl/P7V2Vk4PT5W3k+RG/ndBToa/9AJzFRRK3dbJncgdIKYuOHO6hqSOegbXihiLhML95R/XtN9ywwDw6H+ZvdA5A8HtDs/2VctRZ28zT2BYqUITZ78/Nhgq8ul315Oz+RDiZHp0NH6p0JPhsqtXuCQw/C7GipVgUAm4y4rbkpprPDweGFGN2Xpaps0NWafx9IuC752Kb3vg2IDYCTr2jn4Y5ISBzcJix4K57hR33KRhtdVLc25r7jfXoJzyoaUuHHTEqaYpXCLMO+aHAPruEFEPVIFK68POjebqY/O6ppglpf/qQNKipy0ujnMXTj5ZPMCSQeoTe1ym6ws1R1Nctvp9CBuHKDJg0PHHOLwktpdI6LxBg7gqj76tMiUsclH75JfbM7eSzeX0lMHRca9PoZgFRqduinHonB5mHjnen4mHlumCPVX0fATJ98IoI7VVveI+cZJ4NDklXTedl0K/KV3BhUWeSIM0UrqYiooHDRftenslLDTUFgPAzPst1bLUr/Oqa+66pv8qpbH6g7IHPnf3/xaKd4899SUgBcr9KhFFOTu6HvG9lrk/bZDh+pxp/8NwpJhqN74e0qkokwBjC5YonVNa34DDVF+Y9Q== copr-buildsys-prod

roles/copr/backend/files/buildsys.staging.pub

@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDOcf6r8Q7qCELUVCc3jNYx2YiQ3wCnxwxfxKa76plR7jmbhhUdiXNZEeKybEKNzYd+7sKSxkT8rl9fympTziB7uGOL18350MvstVGRxsgtuZLfoh0yGa78ZNVuOHBCgwD8wl3swdogwgJydqJNijEaJbrYLru7CuTbbGcXLtPpA8blszH9CNH2OyWJtGXSiQyB5PmLyJXsATZiqAZI4/M53K8z3Zp4qiwTwGsS+OVRjlY5S+7MIgb5SH5JOsiTdEf5VkPM5j8WG70cL6Y6mp+DQ0KdDeCEPX7mUvqhRU9KImWuD2QKCfYXGzG9NmR+ycmK7NrR1sLkMTtjmJTm9gRVOtlE1QWMFGmkq/4NvQAm7Qw4G3QDbnMbVntUftWqeC6dQM2q2FX1yqA9ogoCIwkz5nIq8YH5cjO0UqVYICfw5rqN3LLALSsusKvPyiNGXwckSiV647i9PZgUxsnBfX8zZJaiBiwYE+S9dEhPSc3ejVx6INVXB8lXRvFO6A2i4KrXWpkL8NvCcUuH3q0CwxGpOrxB1NIadMNLVk6CiWPBWW03L55SIu82rgUcJqtP44/MLTUUseIB8sh7+ReFbbdNrpaX1pAfn67k8/Q4alisN0NLoCSucxN3tck1KgboAoGsN9s8YfUjGvOzy2h5c5jqgGF22/0asA4y6OLKHDEa4Q== copr-buildsys-2026-04-16

roles/copr/backend/files/provision/files/buildsys.pub

@@ -1 +0,0 @@
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCeTO0ddXuhDZYM9HyM0a47aeV2yIVWhTpddrQ7/RAIs99XyrsicQLABzmdMBfiZnP0FnHBF/e+2xEkT8hHJpX6bX81jjvs2bb8KP18Nh8vaXI3QospWrRygpu1tjzqZT0Llh4ZVFscum8TrMw4VWXclzdDw6x7csCBjSttqq8F3iTJtQ9XM9/5tCAAOzGBKJrsGKV1CNIrfUo5CSzY+IUVIr8XJ93IB2ZQVASK34T/49egmrWlNB32fqAbDMC+XNmobgn6gO33Yq5Ly7Dk4kqTUx2TEaqDkZfhsVu0YcwV81bmqsltRvpj6bIXrEoMeav7nbuqKcPLTxWEY/2icePF

roles/copr/backend/files/provision/files/mock/templates/fedora-eln.tpl

@@ -0,0 +1,392 @@
+config_opts['releasever'] = 'eln'
+config_opts['eln_rawhide_releasever'] = '45'
+
+config_opts['root'] = 'fedora-eln-{{ target_arch }}'
+
+config_opts['chroot_setup_cmd'] = 'install bash bzip2 coreutils cpio diffutils fedora-eln-release findutils gawk glibc-minimal-langpack grep gzip info patch redhat-rpm-config rpm-build sed tar unzip util-linux which xz'
+
+config_opts['dist'] = 'eln'  # only useful for --resultdir variable subst
+config_opts['extra_chroot_dirs'] = [ '/run/lock', ]
+
+# https://fedoraproject.org/wiki/Changes/BuildWithDNF5
+# https://pagure.io/releng/issue/11895
+config_opts['package_manager'] = 'dnf5'
+
+# Per https://github.com/fedora-eln/eln/issues/164 updated up to 4 times a day.
+# Docs: https://docs.fedoraproject.org/en-US/eln/deliverables/#_container_image
+config_opts['bootstrap_image'] = 'quay.io/fedora/eln:latest'
+
+# https://fedoraproject.org/wiki/Changes/ReplaceDnfWithDnf5 applied to ELN!
+config_opts['bootstrap_image_ready'] = True
+
+config_opts['dnf.conf'] = """
+[main]
+keepcache=1
+system_cachedir=/var/cache/dnf
+debuglevel=2
+reposdir=/dev/null
+logfile=/var/log/yum.log
+retries=20
+obsoletes=1
+gpgcheck=0
+assumeyes=1
+syslog_ident=mock
+syslog_device=
+install_weak_deps=0
+metadata_expire=0
+best=1
+user_agent={{ user_agent }}
+
+# TODO
+module_platform_id=platform:eln
+protected_packages=
+
+{%- macro rawhide_gpg_keys() -%}
+file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-rawhide-primary
+{%- for version in [eln_rawhide_releasever|int, eln_rawhide_releasever|int - 1, eln_rawhide_releasever|int - 2]
+%} file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-{{ version }}-primary
+{%- endfor %}
+{%- endmacro %}
+
+[eln-baseos]
+name=Fedora - ELN BaseOS - Developmental packages for the next Enterprise Linux release
+#baseurl=https://dl.fedoraproject.org/pub/eln/1/BaseOS/$basearch/os/
+metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-baseos-1&arch=$basearch
+enabled=1
+repo_gpgcheck=0
+type=rpm
+gpgcheck=1
+gpgkey={{ rawhide_gpg_keys() }}
+skip_if_unavailable=False
+
+[eln-baseos-debuginfo]
+name=Fedora - ELN BaseOS - Debug
+#baseurl=https://dl.fedoraproject.org/pub/eln/1/BaseOS/$basearch/debug/tree
+metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-baseos-debug-1&arch=$basearch
+enabled=0
+repo_gpgcheck=0
+type=rpm
+gpgcheck=1
+gpgkey={{ rawhide_gpg_keys() }}
+skip_if_unavailable=False
+
+[eln-baseos-source]
+name=Fedora - ELN BaseOS - Source
+#baseurl=https://dl.fedoraproject.org/pub/eln/1/BaseOS/source/tree/
+metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-baseos-source-1&arch=source
+enabled=0
+repo_gpgcheck=0
+type=rpm
+gpgcheck=1
+gpgkey={{ rawhide_gpg_keys() }}
+skip_if_unavailable=False
+
+
+[eln-appstream]
+name=Fedora - ELN AppStream - Developmental packages for the next Enterprise Linux release
+#baseurl=https://dl.fedoraproject.org/pub/eln/1/AppStream/$basearch/os/
+metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-appstream-1&arch=$basearch
+enabled=1
+repo_gpgcheck=0
+type=rpm
+gpgcheck=1
+gpgkey={{ rawhide_gpg_keys() }}
+skip_if_unavailable=False
+
+[eln-appstream-debuginfo]
+name=Fedora - ELN AppStream - Debug
+#baseurl=https://dl.fedoraproject.org/pub/eln/1/AppStream/$basearch/debug/tree
+metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-appstream-debug-1&arch=$basearch
+enabled=0
+repo_gpgcheck=0
+type=rpm
+gpgcheck=1
+gpgkey={{ rawhide_gpg_keys() }}
+skip_if_unavailable=False
+
+[eln-appstream-source]
+name=Fedora - ELN AppStream - Source
+#baseurl=https://dl.fedoraproject.org/pub/eln/1/AppStream/source/tree/
+metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-appstream-source-1&arch=source
+enabled=0
+repo_gpgcheck=0
+type=rpm
+gpgcheck=1
+gpgkey={{ rawhide_gpg_keys() }}
+skip_if_unavailable=False
+
+
+[eln-crb]
+name=Fedora - ELN CodeReady Linux Builders - Build packages for the next Enterprise Linux release
+#baseurl=https://dl.fedoraproject.org/pub/eln/1/CRB/$basearch/os/
+metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-crb-1&arch=$basearch
+enabled=1
+repo_gpgcheck=0
+type=rpm
+gpgcheck=1
+gpgkey={{ rawhide_gpg_keys() }}
+skip_if_unavailable=False
+
+[eln-crb-debuginfo]
+name=Fedora - ELN CodeReady Linux Builders - Debug
+#baseurl=https://dl.fedoraproject.org/pub/eln/1/CRB/$basearch/debug/tree
+metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-crb-debug-1&arch=$basearch
+enabled=0
+repo_gpgcheck=0
+type=rpm
+gpgcheck=1
+gpgkey={{ rawhide_gpg_keys() }}
+skip_if_unavailable=False
+
+[eln-crb-source]
+name=Fedora - ELN CodeReady Linux Builders - Source
+#baseurl=https://dl.fedoraproject.org/pub/eln/1/CRB/source/tree/
+metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-crb-source-1&arch=source
+enabled=0
+repo_gpgcheck=0
+type=rpm
+gpgcheck=1
+gpgkey={{ rawhide_gpg_keys() }}
+skip_if_unavailable=False
+
+
+
+[eln-extras]
+name=Fedora - ELN Extras - Developmental packages for the next Enterprise Linux release
+#baseurl=https://dl.fedoraproject.org/pub/eln/1/Extras/$basearch/os/
+metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-extras-1&arch=$basearch
+enabled=1
+countme=1
+metadata_expire=6h
+repo_gpgcheck=0
+type=rpm
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch
+skip_if_unavailable=False
+
+[eln-extras-debuginfo]
+name=Fedora - ELN Extras - Debug
+#baseurl=https://dl.fedoraproject.org/pub/eln/1/Extras/$basearch/debug/tree
+metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-extras-debug-1&arch=$basearch
+enabled=0
+metadata_expire=6h
+repo_gpgcheck=0
+type=rpm
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch
+skip_if_unavailable=False
+
+[eln-extras-source]
+name=Fedora - ELN Extras - Source
+#baseurl=https://dl.fedoraproject.org/pub/eln/1/Extras/source/tree/
+metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-extras-source-1&arch=$basearch
+enabled=0
+metadata_expire=6h
+repo_gpgcheck=0
+type=rpm
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch
+skip_if_unavailable=False
+
+
+
+[eln-ha]
+name=Fedora - ELN HighAvailability - Developmental packages for the next Enterprise Linux release
+#baseurl=https://dl.fedoraproject.org/pub/eln/1/HighAvailability/$basearch/os/
+metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-highavailability-1&arch=$basearch
+enabled=0
+countme=1
+metadata_expire=6h
+repo_gpgcheck=0
+type=rpm
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch
+skip_if_unavailable=False
+
+[eln-ha-debuginfo]
+name=Fedora - ELN HighAvailability - Debug
+#baseurl=https://dl.fedoraproject.org/pub/eln/1/HighAvailability/$basearch/debug/tree
+metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-highavailability-debug-1&arch=$basearch
+enabled=0
+metadata_expire=6h
+repo_gpgcheck=0
+type=rpm
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch
+skip_if_unavailable=False
+
+[eln-ha-source]
+name=Fedora - ELN HighAvailability - Source
+#baseurl=https://dl.fedoraproject.org/pub/eln/1/HighAvailability/source/tree/
+metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-highavailability-source-1&arch=source
+enabled=0
+metadata_expire=6h
+repo_gpgcheck=0
+type=rpm
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch
+skip_if_unavailable=False
+
+
+
+[eln-rt]
+name=Fedora - ELN RT - Developmental packages for the next Enterprise Linux release
+#baseurl=https://dl.fedoraproject.org/pub/eln/1/RT/$basearch/os/
+metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-rt-1&arch=$basearch
+enabled=0
+countme=1
+metadata_expire=6h
+repo_gpgcheck=0
+type=rpm
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch
+skip_if_unavailable=False
+
+[eln-rt-debuginfo]
+name=Fedora - ELN RT - Debug
+#baseurl=https://dl.fedoraproject.org/pub/eln/1/RT/$basearch/debug/tree
+metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-rt-debug-1&arch=$basearch
+enabled=0
+metadata_expire=6h
+repo_gpgcheck=0
+type=rpm
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch
+skip_if_unavailable=False
+
+[eln-rt-source]
+name=Fedora - ELN RT - Source
+#baseurl=https://dl.fedoraproject.org/pub/eln/1/RT/source/tree/
+metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-rt-source-1&arch=source
+enabled=0
+metadata_expire=6h
+repo_gpgcheck=0
+type=rpm
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch
+skip_if_unavailable=False
+
+
+
+[eln-nfv]
+name=Fedora - ELN NFV - Developmental packages for the next Enterprise Linux release
+#baseurl=https://dl.fedoraproject.org/pub/eln/1/NFV/$basearch/os/
+metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-nfv-1&arch=$basearch
+enabled=0
+countme=1
+metadata_expire=6h
+repo_gpgcheck=0
+type=rpm
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch
+skip_if_unavailable=False
+
+[eln-nfv-debuginfo]
+name=Fedora - ELN NFV - Debug
+#baseurl=https://dl.fedoraproject.org/pub/eln/1/NFV/$basearch/debug/tree
+metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-nfv-debug-1&arch=$basearch
+enabled=0
+metadata_expire=6h
+repo_gpgcheck=0
+type=rpm
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch
+skip_if_unavailable=False
+
+[eln-nfv-source]
+name=Fedora - ELN NFV - Source
+#baseurl=https://dl.fedoraproject.org/pub/eln/1/NFV/source/tree/
+metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-nfv-source-1&arch=source
+enabled=0
+metadata_expire=6h
+repo_gpgcheck=0
+type=rpm
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch
+skip_if_unavailable=False
+
+
+
+[eln-sap]
+name=Fedora - ELN SAP - Developmental packages for the next Enterprise Linux release
+#baseurl=https://dl.fedoraproject.org/pub/eln/1/SAP/$basearch/os/
+metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-sap-1&arch=$basearch
+enabled=0
+countme=1
+metadata_expire=6h
+repo_gpgcheck=0
+type=rpm
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch
+skip_if_unavailable=False
+
+[eln-sap-debuginfo]
+name=Fedora - ELN SAP - Debug
+#baseurl=https://dl.fedoraproject.org/pub/eln/1/SAP/$basearch/debug/tree
+metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-sap-debug-1&arch=$basearch
+enabled=0
+metadata_expire=6h
+repo_gpgcheck=0
+type=rpm
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch
+skip_if_unavailable=False
+
+[eln-sap-source]
+name=Fedora - ELN SAP - Source
+#baseurl=https://dl.fedoraproject.org/pub/eln/1/SAP/source/tree/
+metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-sap-source-1&arch=$basearch
+enabled=0
+metadata_expire=6h
+repo_gpgcheck=0
+type=rpm
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch
+skip_if_unavailable=False
+
+
+
+[eln-saphana]
+name=Fedora - ELN SAPHANA - Developmental packages for the next Enterprise Linux release
+#baseurl=https://dl.fedoraproject.org/pub/eln/1/SAPHANA/$basearch/os/
+metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-saphana-1&arch=$basearch
+enabled=0
+countme=1
+metadata_expire=6h
+repo_gpgcheck=0
+type=rpm
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch
+skip_if_unavailable=False
+
+[eln-saphana-debuginfo]
+name=Fedora - ELN SAPHANA - Debug
+#baseurl=https://dl.fedoraproject.org/pub/eln/1/SAPHANA/$basearch/debug/tree
+metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-saphana-debug-1&arch=$basearch
+enabled=0
+metadata_expire=6h
+repo_gpgcheck=0
+type=rpm
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch
+skip_if_unavailable=False
+
+[eln-saphana-source]
+name=Fedora - ELN SAPHANA - Source
+#baseurl=https://dl.fedoraproject.org/pub/eln/1/SAPHANA/source/tree/
+metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-saphana-source-1&arch=source
+enabled=0
+metadata_expire=6h
+repo_gpgcheck=0
+type=rpm
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch
+skip_if_unavailable=False
+
+[local]
+name=local
+baseurl=https://kojipkgs.fedoraproject.org/repos/eln-build/latest/$basearch/
+cost=2000
+enabled=0
+skip_if_unavailable=False
+"""

roles/copr/backend/files/provision/provision_builder_tasks.yml

@@ -274,10 +274,14 @@
     - preparing_image
 
 - name: mockbuilder authorized_keys
-  authorized_key: user=mockbuilder key='{{ lookup('file', 'files/buildsys.pub') }}'
+  authorized_key:
+    user: mockbuilder
+    key: "{{ lookup('file', 'files/buildsys.pub') }}"
 
 - name: root authorized_keys
-  authorized_key: user=root key='{{ lookup('file', 'files/buildsys.pub') }}'
+  authorized_key:
+    user: root
+    key: "{{ lookup('file', 'files/buildsys.pub') }}"
 
 - name: setup 10x more fds in limits.conf
   ansible.builtin.copy:

roles/copr/backend/tasks/main.yml

@@ -61,7 +61,12 @@
   - .ssh
 
 - name: Setup privkey for copr user
-  ansible.builtin.copy: src="{{ private }}/files/copr/buildsys.priv" dest=/home/copr/.ssh/id_rsa owner=copr group=copr mode=600
+  ansible.builtin.copy:
+    src: "{{ private }}/files/copr/buildsys.{{ env }}.priv"
+    dest: /home/copr/.ssh/id_rsa
+    owner: copr
+    group: copr
+    mode: "0600"
 
 - name: Setup copr user ssh config file
   ansible.builtin.template:
@@ -88,11 +93,14 @@
 - name: Replace bashrc for copr user
   ansible.builtin.copy: src="copr_bashrc" dest=/home/copr/.bashrc owner=copr group=copr mode=600
 
+# TODO(praiskup): this is weird, doesn't seem to be needed
 - name: Auth_key so we can login to localhost as the copr user from the copr user
-  authorized_key: user=copr key="{{ item }}"
+  authorized_key:
+    user: copr
+    key: "{{ item }}"
   no_log: true
   with_file:
-  - "provision/files/buildsys.pub"
+  - "buildsys.{{ env }}.pub"
 
 - name: Copy .boto file
   ansible.builtin.copy: src="boto" dest=/home/copr/.boto owner=copr group=copr

roles/copr/backend/tasks/resalloc.yml

@@ -159,7 +159,7 @@
 
 - name: Resalloc, copy backend ssh identity
   ansible.builtin.copy:
-    src: "{{ private }}/files/copr/buildsys.priv"
+    src: "{{ private }}/files/copr/buildsys.{{ env }}.priv"
     dest: /var/lib/resallocserver/.ssh/id_rsa
     owner: resalloc
     group: resalloc

roles/copr/backend/tasks/setup_provisioning_environment.yml

@@ -19,6 +19,13 @@
   tags:
   - provision_config
 
+- name: install the correct buildsys.pub
+  ansible.builtin.copy:
+    dest: "{{ provision_directory }}/files/buildsys.pub"
+    src: "buildsys.{{ env }}.pub"
+  tags:
+  - provision_config
+
 - name: "Sync copr provisioning files [remove mock config leftovers]"
   ansible.posix.synchronize:
     src: "{{ roles_path }}/copr/backend/files/provision/files/mock/"

roles/copr/backend/templates/copr-be.conf.j2

@@ -114,6 +114,11 @@ pulp_content_url={{ pulp_content_url }}
 #     praiskup
 
 
+{% if env == 'production' %}
+sentry_dsn={{ copr_sentry_dsn }}
+{% endif %}
+
+
 [builder]
 # default is 1800, this probably has no effect!
 timeout=108000

roles/copr/backend/templates/provision/copr-resalloc-aws-new.j2

@@ -14,7 +14,7 @@ cmd=(
     /usr/bin/resalloc-aws-new
       --aws-profile default
       --ami {{ copr_builder_images.aws[item] }}
-      --ssh-key-name copr-builder
+      --ssh-key-name copr-builder-{{ env }}
       --security-group-id sg-0c3efdb681ced5d4f
       --debug
 {% for subnet in aws_arch_subnets[item] %}

roles/copr/backend/templates/provision/copr-rpmbuild/main.ini.j2

@@ -1,10 +1,12 @@
-# rpkg-util v3+
+# TODO: this file is used by both rpkg-util(?) and copr-rpmbuild.  Move the
+# copr-rpmbuild related stuff into copr-rpmbuild.yml.
 
 [main]
 frontend_url = {{ frontend_base_url }}
 distgit_lookaside_url = https://${% raw %}{{git_props:remote_netloc}}{% endraw %}/repo/pkgs/%(repo_path)s/%(filename)s/%(hashtype)s/%(hash)s/%(filename)s
 distgit_clone_url = {scheme}://{netloc}/%(repo_path)s
 rpm_vendor_copr_name = {{ rpm_vendor_copr_name }}
+macro_override_db_url = https://copr-be.cloud.fedoraproject.org/config/distro-arch-specific.json
 
 [distgit0]
 distgit_hostname_pattern = src.fedoraproject.org

roles/copr/backend/templates/provision/libvirt-new

@@ -17,6 +17,7 @@ import shlex
 import time
 import argparse
 import ipaddress
+from urllib.parse import urlparse
 
 from helpers import get_hv_identification_from_pool_id
 
@@ -65,13 +66,13 @@ class LibvirtSpawner:
         self.log.debug("Logging to %s", self.connection)
         self.cleanup_actions = {}
 
-    def call(self, cmd, *args, **kwargs):
+    def call(self, cmd, *args, call=subprocess.call, **kwargs):
         """
         Run CMD, and log info.
         """
         self.log.debug("cmd: %s", ' '.join([shlex.quote(str(x)) for x in cmd]))
         start = time.time()
-        status = subprocess.call(cmd, *args, **kwargs)
+        status = call(cmd, *args, **kwargs)
         self.log.debug(" -> exit_status=%s, time=%ss",
                        status, round(time.time() - start, 3))
         return status
@@ -82,6 +83,13 @@ class LibvirtSpawner:
         """
         return self.call(['virsh', '-c', self.connection] + args, stdout=sys.stderr)
 
+    def virsh_check_output(self, args):
+        """
+        Call virsh without polluting stdout.
+        """
+        return self.call(['virsh', '-c', self.connection] + args,
+                         call=subprocess.check_output).decode("utf-8")
+
     def wait_for_ssh(self, host):
         """
         Knowing the IP address of recently started VM, wait for the SSH server
@@ -200,6 +208,21 @@ class LibvirtSpawner:
         """
 
         todo_files = copy.copy(self.config_files)
+
+        # Make sure the machine trusts our buildsys.pub key (via cloud-init).
+        with open("/var/lib/resallocserver/provision/files/buildsys.pub", "r",
+                  encoding='utf-8') as file:
+            public_key = file.read()
+
+        user_data = f"""\n
+#cloud-config
+ssh_authorized_keys:
+  - {public_key}
+"""
+        todo_files.append(ConfigFile('user-data', user_data))
+        meta_data = "instance-id: {self.vm_name}\n"
+        todo_files.append(ConfigFile('meta-data', meta_data))
+
         startup_script = self.get_startup_script()
         if startup_script:
             todo_files.append(startup_script)
@@ -216,18 +239,33 @@ class LibvirtSpawner:
 
         image = os.path.join(self.workdir, 'config.iso')
 
-        # The 'eimg_config' label is not important, we search for /dev/sr0
-        # anyway.
-        if self.call(['mkisofs', '-o', image, '-V', 'eimg_config', '-r', '-J',
+        # The 'cidata' label is important, otherwise cloud-init can't take the
+        # image as NoCloud drive.  Other files shouldn't be a problem for cloud
+        # init.
+        if self.call(['mkisofs', '-o', image, '-V', 'cidata', '-r', '-J',
                       '--quiet', config_dir]) != 0:
             raise Exception("mkisofs failed")
         return image
 
-    def create_volume_from_iso(self, name, prealloc_size, iso, pool=DEFAULT_POOL):
-        """ Create libvirt volume from ISO file """
-        self.alloc_disk(name, prealloc_size, pool)
-        if self.virsh_silent(['vol-upload', name, iso, '--pool', pool]):
-            raise Exception("can not vol-upload the config disk")
+    def create_volume_from_iso(self, name, iso, pool=DEFAULT_POOL):
+        """
+        Create libvirt volume from ISO file
+        """
+        parsed_url = urlparse(self.connection)
+        remote_host = parsed_url.netloc
+        if not remote_host:
+            raise RuntimeError(f"Could not deduce remote host from connection: {self.connection}")
+
+        # <path>/libvirt-images</path> -> /libvirt-images
+        pool_path = self.virsh_check_output(["-q", "pool-dumpxml", pool, "--xpath", '//target/path'])
+        pool_path = pool_path.strip()[6:-7]
+        target_path = os.path.join(pool_path, name)
+
+        scp_cmd = ['scp', '-p', iso, f"{remote_host}:{target_path}"]
+        if self.call(scp_cmd):
+            raise RuntimeError(f"Failed to upload ISO via SCP to {target_path} on {remote_host}")
+
+        self.virsh_silent(["pool-refresh", pool])
 
     def create_volume_from_volume(self, name, volume, pool=DEFAULT_POOL, size=None):
         """
@@ -341,8 +379,7 @@ class LibvirtSpawner:
         if config_iso:
             self.log.info("using config image %s", config_iso)
             config_vol_name = self.vm_name + "_config"
-            self.create_volume_from_iso(config_vol_name, '1M', config_iso,
-                                        pool=pool)
+            self.create_volume_from_iso(config_vol_name, config_iso, pool=pool)
 
         root_image_volume = VOLUMES[self.arch]
         vol_root = self.vm_name + '_root'

roles/copr/backend/templates/resalloc/osuosl-vm.j2

@@ -41,6 +41,6 @@ resalloc-openstack-new \
     --flavor "$flavor" \
     --name "$RESALLOC_NAME" \
     --post-command "set -x ; resalloc-wait-for-ssh --timeout 250 --log debug \"\$RESALLOC_OS_IP\" >&2 && ansible-playbook $playbook -i \"\$RESALLOC_OS_IP,\" >&2 " \
-    --key-pair-id copr-builder \
+    --key-pair-id copr-builder-{{ env }} \
     --nic  net-id="$network" \
     --print-ip

roles/copr/backend/templates/resalloc/pools.yaml.j2

@@ -3,9 +3,14 @@
 # Notes for Resalloc configuration file:
 #
 {% if False %}
-# - This is rather a complex Jinja template.  Feel free to use the helper
-#   script to expand locally before you commit any change to this file:
-#   ./roles/copr/backend/templates/resalloc/pools.yaml.expand.sh
+#
+# ===================================================================
+# ===================================================================
+# This is rather a complex Jinja template.  PLEASE use the helper
+# script to expand locally before you commit any change to this file:
+# ./roles/copr/backend/templates/resalloc/pools.yaml.expand.sh
+# ===================================================================
+# ===================================================================
 #
 {% endif %}
 # - You do NOT need to restart resalloc server after changing this file, it
@@ -25,7 +30,7 @@
 #   d) remove the pool in PostgreSQL database.
 
 {% macro aws(arch, max, max_starting, max_prealloc, spot=False, on_demand=none, priority=0, reserved=False) %}
-aws_{{ arch }}_{{ on_demand + '_' if on_demand is not none else '' }}{% if spot %}spot{% else %}normal{% endif %}{% if reserved %}reserved{% endif %}_{% if devel %}dev{% else %}prod{% endif %}:
+aws_{{ arch }}_{{ on_demand + '_' if on_demand is not none else '' }}{% if spot %}spot{% elif reserved %}reserved{% else %}normal{% endif %}_{% if devel %}dev{% else %}prod{% endif %}:
 {% if on_demand and not reserved %}
     max: 10
     max_starting: 4
@@ -56,8 +61,6 @@ aws_{{ arch }}_{{ on_demand + '_' if on_demand is not none else '' }}{% if spot
     - arch_armhfp_emulated
     - arch_riscv64
     - arch_riscv64_emulated
-    - arch_s390x
-    - arch_s390x_emulated
 {% else %}
     - arch_aarch64
     - arch_aarch64_native
@@ -222,8 +225,6 @@ vmhost_x86_{{ hv }}_{% if devel %}dev{% else %}prod{% endif %}:
     - arch_armhfp_emulated
     - arch_riscv64
     - arch_riscv64_emulated
-    - arch_s390x
-    - arch_s390x_emulated
     - hypervisor
     - hypervisor_x86_64
     - hypervisor_x86_64_{{ hv }}
@@ -247,41 +248,6 @@ vmhost_x86_{{ hv }}_{% if devel %}dev{% else %}prod{% endif %}:
 {% endif %}
 {% endfor %}
 
-# Power8 hypervisors
-{% for hv in ["01", "02", "03"] %}
-{% if "ppc64le_hypervisor_" + hv in builders %}
-
-copr_hv_ppc64le_{{ hv }}_{% if devel %}dev{% else %}prod{% endif %}:
-    max: {{ builders["ppc64le_hypervisor_" + hv]["ppc64le"][0] }}
-    max_starting: {{ builders["ppc64le_hypervisor_" + hv]["ppc64le"][1] }}
-    max_prealloc: {{ builders["ppc64le_hypervisor_" + hv]["ppc64le"][2] }}
-    tags:
-    - copr_builder
-    - name: arch_noarch
-      priority: -8
-    - arch_ppc64le
-    - arch_ppc64le_native
-    - hypervisor
-    - hypervisor_ppc64le
-    - hypervisor_ppc64le_{{ hv }}
-    - arch_power8
-    cmd_new: "copr-resalloc-vm-ip-to-yaml /var/lib/resallocserver/provision/libvirt-new --swap-vol-size 168"
-    cmd_delete: "/var/lib/resallocserver/resalloc_provision/vm-delete"
-    cmd_livecheck: "resalloc-check-vm-ip"
-    cmd_release: "/var/lib/resallocserver/resalloc_provision/vm-release"
-    cmd_list: "/var/lib/resallocserver/provision/libvirt-list"
-    livecheck_period: 180
-    reuse_opportunity_time: 90
-    reuse_max_count: 8
-    reuse_max_time: 1800
-    description: >
-      A pool of ppc64le instances in the Fedora Community Cage.
-      These machines have POWER8 processors and are located in RDU (N Carolina).
-      Thank you Fedora Infrastructure team for maintaining the hypervisors.
-
-{% endif %}
-{% endfor %}
-
 # Power9 hypervisors
 {% for hv in ["01", "02", "03", "04"] %}
 {% if "p09_hypervisor_" + hv in builders %}
@@ -414,7 +380,7 @@ copr_ic_s390x_hp_us_east_{% if devel %}dev{% else %}prod{% endif %}:
   description: >
     A pool of high-performance s390x instances in the IBM Cloud, Washington, D.C. (us-east).
     Thanks to IBM for sponsoring these builders.
-
+#}
 
 {% for zone in ['br_sao_1', 'br_sao_2', 'br_sao_3', 'eu_es_1', 'eu_es_2', 'eu_es_3'] %}
 copr_ic_s390x_{{ zone }}_{% if devel %}dev{% else %}prod{% endif %}:
@@ -469,7 +435,6 @@ copr_ic_s390x_{{ zone }}_{% if devel %}dev{% else %}prod{% endif %}:
     Thanks to IBM for sponsoring these builders.
 
 {% endfor %}
-#}
 
 # Power9 builders in OSU osuosl
 {{ osuosl_p09_p10() }}

roles/copr/backend/templates/resalloc/vm-delete.j2

@@ -41,11 +41,6 @@ copr_osuosl_*)
 *s390x*)
     exit 0
     ;;
-
-*copr_hv_x86_64_*)
-    ;;
-*copr_hv_ppc64le_*)
-    ;;
 vmhost*)
     # hypervisors
     ;;

roles/copr/dist_git/files/dist-git.conf

@@ -12,3 +12,6 @@ gitolite    = False
 # name of the default branch (a.k.a. master or main)
 default_branch = master
 
+{% if env == 'production' %}
+sentry_dsn={{ copr_sentry_dsn }}
+{% endif %}

roles/copr/frontend/files/chroots.conf

@@ -22,5 +22,5 @@ config["rules"] = [{
 }, {
         "match_type": "arch",
         "match": ["s390x"],
-        "comment": "An emulated chroot. Builds are done on x86_64 using QEMU.",
+        "comment": "",
 }]

roles/copr/frontend/templates/copr.conf

@@ -288,6 +288,10 @@ EXTRA_BUILDCHROOT_TAGS = [{
     # https://github.com/fedora-copr/copr/issues/4256
     "pattern": "^@python/python3\.\d+/.*/root$",
     "tags": ["on_demand_powerful"],
+},{
+    # packages that always takes time to build
+    "pattern": ".*/.*/.*/(firefox|thunderbird)$",
+    "tags": ["on_demand_powerful"],
 }]
 {% endif %}
 
@@ -321,3 +325,8 @@ OIDC_METADATA = "https://id.fedoraproject.org/openidc/.well-known/openid-configu
 OIDC_SECRET = "{{ copr_oidc_stg_client_secret }}"
 OIDC_METADATA = "https://id.stg.fedoraproject.org/openidc/.well-known/openid-configuration"
 {% endif %}
+
+
+{% if env == 'production' %}
+SENTRY_DSN="{{ copr_sentry_dsn }}"
+{% endif %}

roles/copr/hypervisor/files/buildsys.production.pub

@@ -0,0 +1 @@
+../../backend/files/buildsys.production.pub

roles/copr/hypervisor/files/buildsys.pub

@@ -1 +0,0 @@
-../../../copr/backend/files/provision/files/buildsys.pub

roles/copr/hypervisor/files/buildsys.staging.pub

@@ -0,0 +1 @@
+../../backend/files/buildsys.staging.pub

roles/copr/hypervisor/tasks/main.yml

@@ -139,10 +139,13 @@
 - name: Create the copr user
   user: name=copr uid=11666 group=libvirt groups=qemu password_lock=true
 
-- name: Assure that copr-be can ssh there as copr@...
-  authorized_key: user=copr key="{{ item }}"
+- name: Assure that copr user on copr-backend can ssh as copr@...
+  authorized_key:
+    user: copr
+    key: "{{ item }}"
   with_file:
-  - buildsys.pub
+    - buildsys.production.pub
+    - buildsys.staging.pub
 
 - name: Add @copr keys for sysadmin-main and other allowed users
   authorized_key: user=copr key="{{ item }}"
@@ -153,18 +156,6 @@
   - config
   - sshkeys
 
-# todo: generate it's own key
-- name: Make sure hostA can ssh to hostB
-  ansible.builtin.copy:
-    src: "{{ private }}/files/copr/buildsys.priv"
-    dest: /home/copr/.ssh/id_rsa
-    owner: copr
-    mode: "0600"
-
-- name: Provide pub key, too, so we can install them to generated builder images
-  ansible.builtin.copy: src=buildsys.pub dest=/home/copr/.ssh/id_rsa.pub
-        owner=copr mode=0600
-
 - name: Enable praiskup-helpers repo
   ansible.builtin.shell: |
     dnf copr enable -y praiskup/helpers

roles/dhcp_server/files/dhcpd.conf.noc01.rdu3.fedoraproject.org

@@ -1137,12 +1137,11 @@ host ocp03 {
      option routers 10.16.163.254;
      option subnet-mask 255.255.255.0;
 }
-# These are for aarch64 boxes to initially provision on their 1g interfaces
-host bvmhost-a64-01-provision {
-     hardware ethernet d8:5e:d3:e6:20:b0;
-     fixed-address 10.16.163.150;
+host bvmhost-a64-01-stg {
+     hardware ethernet b8:ce:f6:51:56:c5;
+     fixed-address 10.16.167.16;
      next-server 10.16.163.10;
-     option routers 10.16.163.254;
+     option routers 10.16.167.254;
      option subnet-mask 255.255.255.0;
 }
 host bvmhost-a64-02-provision {
@@ -1704,3 +1703,12 @@ host buildhw-p10-fcos01.rdu3.fedoraproject.org {
      option subnet-mask 255.255.255.0;
      option host-name "buildhw-p10-fcos01.rdu3.fedoraproject.org";
 }
+
+host buildhw-p10-fcos02.rdu3.fedoraproject.org {
+     hardware ethernet be:86:ed:ba:1a:00;
+     fixed-address 10.16.171.36;
+     next-server 10.16.163.10;
+     option routers 10.16.171.254;
+     option subnet-mask 255.255.255.0;
+     option host-name "buildhw-p10-fcos02.rdu3.fedoraproject.org";
+}

roles/fasjson/files/aliases.static

@@ -150,7 +150,7 @@ legal-cla-archive: /dev/null
 vendors: distribution-members
 
 # Fedora Council
-legal: fpl, bsutula@redhat.com, rfontana@redhat.com
+legal: fpl,bsutula@redhat.com,rfontana@redhat.com
 board: council-private@lists.fedoraproject.org
 chair: fpl
 chairman: fpl
@@ -180,9 +180,9 @@ diversity-inclusion: dei
 
 # Code of Conduct (CoC) Committee
 ## https://docs.fedoraproject.org/en-US/project/coc-committee/
-codeofconduct: fpl, fca, jonatoni, dcantrell, ankursinha, chris
+codeofconduct: fpl,fca,jonatoni,dcantrell,ankursinha,chris
 ## a special CoC sub-committee for on-site response at Flock to Fedora contributor conference
-flock-coc: codeofconduct, dvolavko, npazmino@redhat.com, shaunm@redhat.com, spotz
+flock-coc: codeofconduct,dvolavko,npazmino@redhat.com,shaunm@redhat.com,spotz
 
 # Fedora Matrix admin
 matrixadmin: fpl,fca,kevin,nb
@@ -212,13 +212,13 @@ fudcon-latam: flock-staff
 # flock
 #flockpress: fca,fpl
 #flockinfo: fca,fpl
-flock-staff: flock-team-members@fedoraproject.org, jwheel@redhat.com
+flock-staff: flock-team-members@fedoraproject.org,jwheel@redhat.com
 #flock-admin: flock-staff
 #flock-access: flock-admin
 #
 # flock/sponsor alias
 # https://forge.fedoraproject.org/infra/tickets/issues/10591
-sponsors: flock-team-sponsors@fedoraproject.org, jwheel@redhat.com
+sponsors: flock-team-sponsors@fedoraproject.org,jwheel@redhat.com
 
 # swag customer email alias https://forge.fedoraproject.org/infra/tickets/issues/10794
 swag-info: fca,shaunm,designteam-sponsors@fedoraproject.org

roles/haproxy/templates/haproxy.cfg

@@ -159,39 +159,11 @@ backend oci-registry-backend
 
 frontend ipsilon-frontend
     bind 0.0.0.0:10020
-
-    option http-buffer-request
-    # Define ipsilon OpenID only instance
-    acl path_openidc path_beg /openidc
-    acl path_openid path_beg /openid
-    acl is_openid_cookie req.cook(OPENID) true
-{% if env == 'staging' %}
-    acl host_is_id_sub hdr(host) -m reg -i ^.+\.id\.stg\.fedoraproject\.org$
-{% else %}
-    acl host_is_id_sub hdr(host) -m reg -i ^.+\.id\.fedoraproject\.org$
-{% endif %}
-
-    use_backend ipsilon-backend if path_openidc
-    use_backend ipsilon-backend-openid if path_openid
-    use_backend ipsilon-backend-openid if is_openid_cookie
-    use_backend ipsilon-backend-openid if host_is_id_sub
-
     default_backend ipsilon-backend
 
-backend ipsilon-backend-openid
-    balance hdr(appserver)
-    cookie OPENID insert indirect nocache attr Max-Age=300
-{% if env == "staging" %}
-    server  ipsilon01 ipsilon01:80 cookie true check inter 10s rise 1 fall 3
-{% else %}
-    server  ipsilon03 ipsilon03:80 cookie true check inter 10s rise 1 fall 3
-{% endif %}
-    option httpchk GET /
-
 backend ipsilon-backend
     balance hdr(appserver)
     server  ipsilon01 ipsilon01:80 check inter 10s rise 1 fall 3
-    http-response set-header x-xrds-location "https://id{{ env_suffix }}.fedoraproject.org/openid/XRDS"
 {% if env == "production" %}
     server  ipsilon02 ipsilon02:80 check inter 10s rise 1 fall 3
 {% endif %}

roles/httpd/proxy/templates/httpd.conf.j2

@@ -87,7 +87,7 @@ KeepAlive On
 # during a persistent connection. Set to 0 to allow an unlimited amount.
 # We recommend you leave this number high, for maximum performance.
 #
-MaxKeepAliveRequests 500
+MaxKeepAliveRequests 0
 
 #
 # KeepAliveTimeout: Number of seconds to wait for the next request from the

roles/httpd/website/templates/robots/riscv-koji.fedoraproject.org-robots.txt

@@ -0,0 +1,2 @@
+User-agent: *
+Disallow: /

roles/ipa/server/tasks/main.yml

@@ -24,6 +24,7 @@
   - ipa-server
   - ipa-server-dns
   - ipa-fas
+  - ipa-healthcheck
   tags:
   - ipa/server
   - packages
@@ -794,38 +795,9 @@
     - ipa/server
     - config
 
-# Zabbix monitoring of the internal IPA server
-- name: Install Zabbix agent config drop-in
-  ansible.builtin.copy:
-    src: zabbix/agent-ipa-backup.conf
-    dest: /etc/zabbix/zabbix_agentd.d/ipa-backup.conf
-    mode: '0644'
-  notify:
-    - Restart zabbix agent
+- name: Configure IPA monitoring in Zabbix
+  ansible.builtin.include_tasks: monitoring.yml
   tags:
     - ipa/server
     - zabbix_agent
-
-- name: Zabbix API Block
-  vars:
-    ansible_zabbix_auth_key: "{{ zabbix_auth_key }}"
-    ansible_network_os: "{{ zabbix_network_os }}"
-    ansible_connection: "{{ zabbix_connection }}"
-    ansible_httpapi_port: "{{ zabbix_httpapi_port }}"
-    ansible_httpapi_use_ssl: "{{ zabbix_httpapi_use_ssl }}"
-    ansible_httpapi_validate_certs: "{{ zabbix_httpapi_validate_certs }}"
-    ansible_host: "{{ zabbix_server }}"
-    ansible_zabbix_url_path: "{{ zabbix_url_path }}"
-  tags:
-    - ipa/server
     - zabbix_api
-  block:
-    - name: Import IPA template file
-      community.zabbix.zabbix_template:
-        template_yaml: "{{ lookup('file', 'zabbix/template-ipa.yml') }}"
-        state: present
-    - name: Add self to IPA template in Zabbix
-      community.zabbix.zabbix_host:
-        host_name: "{{ inventory_hostname }}"
-        link_templates: IPA Monitoring
-        force: false

roles/ipa/server/tasks/monitoring.yml

@@ -0,0 +1,59 @@
+# Zabbix monitoring of the internal IPA server
+
+# ipa-healthcheck can only be run by root, so cron the
+# output to where Zabbix can find it
+- name: Set cron for ipa-healthcheck
+  ansible.builtin.cron:
+    name: "Dump IPA healthcheck as root for Zabbix"
+    minute: "*/5"
+    user: root
+    job: "/usr/bin/ipa-healthcheck --output-type prometheus --all > /etc/zabbix/ipa-healthcheck.log 2> /dev/null"
+  tags:
+    - ipa/server
+    - zabbix_agent
+
+- name: Install Zabbix agent config drop-in
+  ansible.builtin.copy:
+    src: zabbix/agent-ipa-backup.conf
+    dest: /etc/zabbix/zabbix_agentd.d/ipa-backup.conf
+    mode: '0644'
+  notify:
+    - Restart zabbix agent
+  tags:
+    - ipa/server
+    - zabbix_agent
+
+- name: Zabbix API Block
+  vars:
+    ansible_zabbix_auth_key: "{{ zabbix_auth_key }}"
+    ansible_network_os: "{{ zabbix_network_os }}"
+    ansible_connection: "{{ zabbix_connection }}"
+    ansible_httpapi_port: "{{ zabbix_httpapi_port }}"
+    ansible_httpapi_use_ssl: "{{ zabbix_httpapi_use_ssl }}"
+    ansible_httpapi_validate_certs: "{{ zabbix_httpapi_validate_certs }}"
+    ansible_host: "{{ zabbix_server }}"
+    ansible_zabbix_url_path: "{{ zabbix_url_path }}"
+  tags:
+    - ipa/server
+    - zabbix_api
+  block:
+    - name: Import IPA template file
+      community.zabbix.zabbix_template:
+        template_yaml: "{{ lookup('file', 'zabbix/template-ipa.yml') }}"
+        state: present
+      run_once: true
+
+    - name: Ensure IPA Zabbix hostgroup is present
+      community.zabbix.zabbix_group:
+        host_groups:
+          - IPA Servers
+        state: present
+      run_once: true
+
+    - name: Add self to IPA template in Zabbix
+      community.zabbix.zabbix_host:
+        host_name: "{{ inventory_hostname }}"
+        host_groups: IPA Servers
+        link_templates: IPA Monitoring
+        force: false
+

roles/ipsilon/defaults/main.yml

@@ -1,3 +1,4 @@
 ---
 ipsilon_patches:
   - 409
+  - integrityerror

roles/ipsilon/files/openid_banner.patch

@@ -1,15 +0,0 @@
---- layout.html 2025-10-03 10:54:25.879128022 +0000
-+++ layout.html 2025-10-03 10:56:46.554758341 +0000
-@@ -21,6 +21,12 @@
-         {%- endif %}
-     </head>
-     <body>
-+       <div class="alert-danger">
-+           <h1 align="center">
-+                   You are using OpenID to authenticate. This authentication method will go away on 1st May 2026. Please consider migrating to OpenID Connect.
-+                   For more info look at https://forge.fedoraproject.org/infra/tickets/issues/10241
-+           </h1>
-+       </div>
-         <div class="navbar navbar-light masthead">
-             <div class="container justify-content-between">
-                 <img alt="logo" src="{{ basepath }}/ui/res/FedoraAccounts.png" height=40px />

roles/ipsilon/tasks/main.yml

@@ -7,7 +7,6 @@
     update_cache: yes
     name:
     - ipsilon
-    - ipsilon-openid
     - ipsilon-saml2
     - ipsilon-openidc
     - ipsilon-authgssapi
@@ -51,15 +50,6 @@
   tags:
   - ipsilon
 
-- name: Apply patch for OpenID banner
-  ansible.posix.patch:
-    src: openid_banner.patch
-    dest: /usr/share/ipsilon/themes/Fedora/templates/layout.html
-  when: openid is defined and openid
-  tags:
-  - ipsilon
-  - patch
-
 - name: Apply patch for forge.fp.o links
   ansible.posix.patch:
     src: forge_fp_o.patch
@@ -87,7 +77,6 @@
          --admin-user=admin
          --ipa=yes
          --openidc=yes
-         --openid=yes
          --saml2=yes
          --info-sssd=yes
          --form=yes

roles/ipsilon/tasks/patches.yml

@@ -13,7 +13,7 @@
 
 - name: Download patches
   ansible.builtin.copy:
-    src: /srv/web/infra/bigfiles/hotfixes/ipsilon/{{ item }}
+    src: /srv/web/infra/bigfiles/hotfixes/ipsilon/{{ item }}.patch
     dest: /opt/ipsilon-patches/{{ item }}.patch
     owner: root
     group: root

roles/ipsilon/templates/configuration.conf

@@ -11,27 +11,6 @@ fas aws groups=[["aws-master", "arn:aws:iam::125523088429:role/aws-master"], ["a
 global enabled=allow
 
 [provider_config]
-{% if openid is defined and openid %}
-global enabled=openid
-
-openid endpoint url=https://id{{env_suffix}}.fedoraproject.org/openid/
-openid identity url template=http://%(username)s.id{{env_suffix}}.fedoraproject.org/
-{% if env == 'staging' %}
-openid trusted roots=
-{% else %}
-openid trusted roots=https://ask.fedoraproject.org/,https://fedorahosted.org/,https://badges.fedoraproject.org,https://apps.fedoraproject.org/datagrepper/,https://apps.fedoraproject.org/calendar/,http://notifications.fedoraproject.org/,http://copr.fedoraproject.org/,https://copr.fedoraproject.org/,https://admin.fedoraproject.org/voting/,https://admin.fedoraproject.org,https://apps.fedoraproject.org/,https://release-monitoring.org/,http://pagure.io/,http://admin.fedoraproject.org/mirrormanager/,https://koschei.fedoraproject.org/,https://bodhi.fedoraproject.org,https://lists.fedoraproject.org/,https://openqa.fedoraproject.org/,https://src.fedoraproject.org/
-{% endif %}
-{% if env == 'staging' %}
-openid database url=postgresql://{{ ipsilon_db_user }}:{{ ipsilon_stg_db_pass }}@{{ ipsilon_db_host }}/{{ ipsilon_db_openid_name }}
-{% else %}
-openid database url=postgresql://{{ ipsilon_db_user }}:{{ ipsilon_db_pass }}@{{ ipsilon_db_host }}/{{ ipsilon_db_openid_name }}
-{% endif %}
-openid untrusted roots=
-openid enabled extensions=Fedora Teams,Attribute Exchange,CLAs,Simple Registration,API
-openid default attribute mapping=[["*", "*"], ["_groups", "groups"], [["_extras", "cla"], "cla"], ["fullname", "name"], ["_username", "nickname"], ["_username", "preferred_username"], ["fasIRCNick", "ircnick"], ["fasLocale", "locale"], ["fasTimeZone", "zoneinfo"], ["fasTimeZone", "timezone"], ["fasWebsiteURL", "website"], ["fasGPGKeyId", "gpg_keyid"], ["ipaSshPubKey", "ssh_key"], ["fasIsPrivate", "privacy"], ["fullname", "human_name"]]
-
-# End of OpenID configuration
-{% else %}
 global enabled=saml2,openidc
 
 openidc enabled extensions=fedora-account,waiverdb,wiki,src,kerneltest
@@ -80,5 +59,3 @@ saml2 session database url=postgresql://{{ ipsilon_db_user }}:{{ ipsilon_db_pass
 {% else %}
 {% include "saml2_data" %}
 {% endif %}
-
-{% endif %}

roles/ipsilon/templates/httpd.conf.j2

@@ -6,19 +6,6 @@ Alias /.well-known /var/lib/ipsilon/root/public/well-known
 Alias /cache /var/cache/ipsilon
 Redirect /.well-known/webfinger /webfinger
 
-# This is for mapping $username.id.fp.o -> id.fp.o/id/$username
-RewriteEngine on
-RewriteMap lowercase int:tolower
-{% if env == "staging" %}
-RewriteCond ${lowercase:%{SERVER_NAME}} ^[a-z0-9_\.-]+\.id\.stg\.fedoraproject\.org$
-RewriteRule ^(.+) /${lowercase:%{SERVER_NAME}}$1 [C]
-{% else %}
-RewriteCond ${lowercase:%{SERVER_NAME}} ^[a-z0-9_\.-]+\.id\.fedoraproject\.org$
-RewriteRule ^(.+) /${lowercase:%{SERVER_NAME}}$1 [C]
-RewriteRule ^/([a-z0-9_\.-]+)\.id\.fedoraproject\.org/.* /openid/id/$1/ [PT]
-{% endif %}
-
-
 WSGIScriptAlias / /usr/libexec/ipsilon/ipsilon
 WSGIDaemonProcess ipsilon user=ipsilon group=ipsilon home=/var/lib/ipsilon/root display-name=ipsilon processes=6 threads=2 maximum-requests=1000
 WSGISocketPrefix run/wsgi

roles/kickstarts/tasks/main.yml

@@ -10,6 +10,8 @@
     - kvm-rhel-8
     - hardware-rhel-9-08disk
     - hardware-rhel-9-06disk
+    - hardware-rhel-9-06disk-aarch64
+    - hardware-rhel-10-06disk-aarch64
     - hardware-rhel-10-08disk
     - hardware-rhel-10-nodisk
     - hardware-fedora-01disk-nvme
@@ -18,7 +20,6 @@
     - hardware-fedora-06disk-nvme
     - hardware-fedora-ppc64le-02disk
     - hardware-fedora-ppc64le-08disk
-    - hardware-rhel-9-06disk-aarch64
     - openqa-fedora-08disk
   tags:
   - config

roles/kickstarts/templates/hardware-rhel-10-06disk-aarch64.j2

@@ -0,0 +1,102 @@
+# Use network installation
+vnc --password "{{ kickstart_vnc_password }}"
+# Use network install
+url --url=http://infrastructure.fedoraproject.org/repo/rhel/RHEL10-aarch64/
+repo --name=epel --baseurl=http://infrastructure.fedoraproject.org/pub/epel/10/Everything/aarch64/
+repo --name="net-baseos"     --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/aarch64/baseos/
+repo --name="net-appstream"     --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/aarch64/appstream/
+repo --name="net-crb"     --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/aarch64/crb/
+
+# Firewall configuration
+firewall --disabled
+firstboot --disable
+ignoredisk --only-use=nvme0n1,nvme1n1,nvme2n1,nvme3n1,nvme4n1,nvme5n1
+# Keyboard layouts
+# old format: keyboard us
+# new format:
+keyboard --vckeymap=us --xlayouts=''
+# System language
+lang en_US.UTF-8
+
+# Network information
+# Reboot after installation
+reboot
+# Root password
+rootpw --iscrypted "{{ kickstart_initial_password_encrypted }}"
+# SELinux configuration
+selinux --enforcing
+# System services
+services --disabled="firewalld,kdump" --enabled="postfix,rsyslog,chronyd"
+# Do not configure the X Window System
+skipx
+# System timezone
+timezone UTC --utc
+# System bootloader configuration
+bootloader --location=mbr --boot-drive=nvme0n1 --append="net.ifnames=0" --driveorder=nvme0n1,nvme1n1,nvme2n1,nvme3n1,nvme4n1,nvme5n1
+zerombr
+clearpart --drives=nvme0n1,nvme1n1,nvme2n1,nvme3n1,nvme4n1,nvme5n1 --all --initlabel
+
+# Disk partitioning information
+part raid.200 --fstype="mdmember" --ondisk=nvme0n1 --size=1000
+part raid.210 --fstype="mdmember" --ondisk=nvme1n1 --size=1000
+part raid.220 --fstype="mdmember" --ondisk=nvme2n1 --size=1000
+part raid.230 --fstype="mdmember" --ondisk=nvme3n1 --size=1000
+part raid.240 --fstype="mdmember" --ondisk=nvme4n1 --size=1000
+part raid.250 --fstype="mdmember" --ondisk=nvme5n1 --size=1000
+part raid.300 --fstype="mdmember" --ondisk=nvme0n1 --size=477
+part raid.310 --fstype="mdmember" --ondisk=nvme1n1 --size=477
+part raid.320 --fstype="mdmember" --ondisk=nvme2n1 --size=477
+part raid.330 --fstype="mdmember" --ondisk=nvme3n1 --size=477
+part raid.340 --fstype="mdmember" --ondisk=nvme4n1 --size=477
+part raid.350 --fstype="mdmember" --ondisk=nvme5n1 --size=477
+part raid.400 --fstype="mdmember" --ondisk=nvme0n1 --size=65536 --grow
+part raid.410 --fstype="mdmember" --ondisk=nvme1n1 --size=65536 --grow
+part raid.420 --fstype="mdmember" --ondisk=nvme2n1 --size=65536 --grow
+part raid.430 --fstype="mdmember" --ondisk=nvme3n1 --size=65536 --grow
+part raid.440 --fstype="mdmember" --ondisk=nvme4n1 --size=65536 --grow
+part raid.450 --fstype="mdmember" --ondisk=nvme5n1 --size=65536 --grow
+
+raid /boot     --device=0 --fstype="ext4"    --level=RAID1  raid.200 raid.210 raid.220 raid.230 raid.240 raid.250
+raid /boot/efi --device=1 --fstype="efi" --level=RAID1 --fsoptions="umask=0077,shortname=winnt" raid.300 raid.310 raid.320 raid.330 raid.340 raid.350
+raid pv.610 --device=2 --fstype="lvmpv" --level=RAID6 --encrypted --passphrase="{{ luks_initial_password }}" --chunksize=512 raid.400 raid.410 raid.420 raid.430 raid.440 raid.450
+
+volgroup vg_guests --pesize=4096 pv.610
+
+logvol /     --fstype="xfs"  --size=32768 --name=LogVol00 --vgname=vg_guests
+logvol swap  --fstype="swap" --size=8192  --name=LogVol01 --vgname=vg_guests
+
+%packages
+-geolite2-city
+-iwl*firmware
+-subscription-manager
+bash-completion
+bind-utils
+clevis*
+cronie-noanacron
+crontabs
+grubby
+iptables-services
+nfs-utils
+nmap-ncat
+openssh-clients
+openssh-server
+patch
+postfix
+rsync
+screen
+strace
+s-nail
+tmpwatch
+tmux
+traceroute
+vim-enhanced
+zsh
+-insights-client
+-rhc
+%end
+
+%post --nochroot --log=/mnt/sysimage/root/post.output --erroronfail
+mkdir /mnt/sysimage/root/tmp
+chroot /mnt/sysimage /usr/bin/curl https://infrastructure.fedoraproject.org/rhel/ks/post/rhel10-post.sh -o /root/tmp/rhel10-post.sh
+chroot /mnt/sysimage sh /root/tmp/rhel10-post.sh
+%end

roles/koji_hub/templates/hub.conf.j2

@@ -163,6 +163,7 @@ channel =
     method flatpakBuild :: use flatpak
     user bpeck/jenkins-continuous-infra.apps.ci.centos.org :: use ci
     user zuul :: use ci
+    user packit && bool scratch :: use ci
 {% if koji_instance == "secondary" %}
 # Some special policy for riscv koji to send generic tasks to x86 builders.
 #    method build :: use generic

roles/koji_hub/templates/kojihub.conf.j2

@@ -3,6 +3,7 @@
 #
 
 KeepAlive On
+MaxKeepAliveRequests 0
 
 Alias /kojihub /usr/share/koji-hub/kojiapp.py
 

roles/koji_hub/templates/kojiweb.conf.j2

@@ -2,7 +2,7 @@ RewriteEngine On
 RewriteRule ^/$ /koji/  [R,L]
 KeepAlive On
 KeepAliveTimeout 16
-MaxKeepAliveRequests 500
+MaxKeepAliveRequests 0
 
 ServerLimit 2000
 MaxRequestWorkers 2000

roles/openshift-apps/badges/files/service.yml

@@ -13,7 +13,7 @@ spec:
       port: 8080
       targetPort: 8080
   selector:
-    deploymentconfig: frontend
+    deployment: frontend
 ---
 apiVersion: v1
 kind: Service
@@ -29,4 +29,4 @@ spec:
       targetPort: 6379
   selector:
     app: badges
-    deploymentconfig: redis
+    deployment: redis

roles/openshift-apps/badges/templates/deployment.yml.j2

@@ -1,35 +1,34 @@
 ---
 # Frontend component (Python/Pyramid served by gunicorn)
-apiVersion: apps.openshift.io/v1
-kind: DeploymentConfig
+apiVersion: apps/v1
+kind: Deployment
 metadata:
   name: frontend
   labels:
     app: badges
+    deployment: frontend
+  annotations:
+    image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"tahrir:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"frontend\")].image"}]'
 spec:
   replicas: 1
   selector:
-    app: badges
-    deploymentconfig: frontend
+    matchLabels:
+      app: badges
+      deployment: frontend
   strategy:
-    type: Rolling
-    activeDeadlineSeconds: 21600
-    rollingParams:
-      intervalSeconds: 1
+    type: RollingUpdate
+    rollingUpdate:
       maxSurge: 25%
       maxUnavailable: 25%
-      timeoutSeconds: 600
-      updatePeriodSeconds: 1
   template:
     metadata:
-      creationTimestamp: null
       labels:
         app: badges
-        deploymentconfig: frontend
+        deployment: frontend
     spec:
       containers:
         - name: frontend
-          image: tahrir:latest
+          image: image-registry.openshift-image-registry.svc:5000/badges/tahrir:latest
           imagePullPolicy: Always
           ports:
             - containerPort: 8080
@@ -58,7 +57,6 @@ spec:
             - name: tahrir-fedora-messaging-crt-volume
               mountPath: /etc/pki/fedora-messaging/crt
               readOnly: true
-
           env:
             - name: FLASK_CONFIG
               value: "/etc/badges/tahrir.cfg"
@@ -72,7 +70,6 @@ spec:
               value: /etc/keytabs/fedbadges.keytab
             - name: FEDORA_MESSAGING_CONF
               value: /etc/badges/fm-tahrir.toml
-
           readinessProbe:
             timeoutSeconds: 10
             initialDelaySeconds: 5
@@ -87,7 +84,6 @@ spec:
             httpGet:
               path: "/healthz/live"
               port: 8080
-
       volumes:
         - name: etc-badges
           configMap:
@@ -113,49 +109,42 @@ spec:
         - name: tahrir-fedora-messaging-crt-volume
           secret:
             secretName: tahrir-fedora-messaging-crt
-  triggers:
-    - type: ConfigChange
-    - type: ImageChange
-      imageChangeParams:
-        automatic: true
-        containerNames:
-          - frontend
-        from:
-          kind: ImageStreamTag
-          name: tahrir:latest
 ---
 # Consumer component (Fedora Messaging consume command)
-apiVersion: apps.openshift.io/v1
-kind: DeploymentConfig
+apiVersion: apps/v1
+kind: Deployment
 metadata:
   name: consumer
   labels:
     app: badges
+    deployment: consumer
 spec:
-  # There can be as many as necessary
   replicas: {{ (env == 'production')|ternary(2, 1) }}
   selector:
-    app: badges
-    deploymentconfig: consumer
+    matchLabels:
+      app: badges
+      deployment: consumer
   strategy:
     type: Recreate
-    recreateParams:
-      mid:
-        execNewPod:
-          command: [/opt/app-root/bin/tahrir-sync-db, /etc/badges/tahrir.cfg]
-          containerName: consumer
-          volumes:
-            - etc-badges
-        failurePolicy: Abort
   template:
     metadata:
-      creationTimestamp: null
       labels:
         app: badges
-        deploymentconfig: consumer
+        deployment: consumer
+      annotations:
+        image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fedbadges:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"consumer\")].image"}]'
     spec:
+      initContainers:
+        - name: db-sync
+          image: image-registry.openshift-image-registry.svc:5000/badges/fedbadges:latest
+          command: ["/opt/app-root/bin/tahrir-sync-db", "/etc/badges/tahrir.cfg"]
+          volumeMounts:
+            - name: etc-badges
+              mountPath: "/etc/badges"
+              readOnly: true
       containers:
         - name: consumer
+          image: image-registry.openshift-image-registry.svc:5000/badges/fedbadges:latest
           imagePullPolicy: Always
           volumeMounts:
             - name: etc-badges
@@ -206,39 +195,35 @@ spec:
         - name: fedora-messaging-crt-volume
           secret:
             secretName: fedora-messaging-crt
-  triggers:
-    - type: ConfigChange
-    - type: ImageChange
-      imageChangeParams:
-        automatic: true
-        containerNames:
-          - consumer
-        from:
-          kind: ImageStreamTag
-          name: fedbadges:latest
 ---
 # Redis, for caching
-apiVersion: apps.openshift.io/v1
-kind: DeploymentConfig
+apiVersion: apps/v1
+kind: Deployment
 metadata:
   name: redis
   labels:
     app: badges
     service: redis
+    deployment: redis
 spec:
   replicas: 1
   selector:
-    app: badges
-    deploymentconfig: redis
+    matchLabels:
+      app: badges
+      deployment: redis
+  strategy: {}
   template:
     metadata:
       labels:
         app: badges
-        deploymentconfig: redis
+        service: redis
+        deployment: redis
+      annotations:
+        image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"redis:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"redis\")].image"}]'
     spec:
       containers:
         - name: redis
-          image: redis:latest
+          image: image-registry.openshift-image-registry.svc:5000/badges/redis:latest
           volumeMounts:
             - name: data
               mountPath: "/bitnami/redis/data"
@@ -267,13 +252,3 @@ spec:
         - name: data
           persistentVolumeClaim:
             claimName: redis
-  triggers:
-    - type: ConfigChange
-    - type: ImageChange
-      imageChangeParams:
-        automatic: true
-        containerNames:
-          - redis
-        from:
-          kind: ImageStreamTag
-          name: redis:latest

roles/openshift-apps/blockerbugs/templates/deploymentconfig.yml.j2

@@ -1,140 +0,0 @@
----
-apiVersion: apps.openshift.io/v1
-kind: DeploymentConfig
-metadata:
-  labels:
-    app: blockerbugs
-    service: blockerbugs
-  name: blockerbugs
-spec:
-  replicas: 0
-  selector:
-    app: blockerbugs
-    deploymentconfig: blockerbugs
-  strategy:
-    type: Recreate
-    recreateParams:
-      mid:
-        failurePolicy: Abort
-        execNewPod:
-          containerName: blockerbugs
-          # BBA would automatically proceed with upgrade_db if necessary
-          # init_db isn't dropping anything, so it's safe to call every time the pod starts
-          command: ["python", "/opt/app-root/src/blockerbugs/cli.py", "init_db"]
-          # and then just the gunicorn for the frontend part
-          volumes:
-          - blockerbugs-secret-volume
-  template:
-    metadata:
-      labels:
-        app: blockerbugs
-        deploymentconfig: blockerbugs
-    spec:
-      containers:
-      - name: blockerbugs
-        image: blockerbugs:latest
-        ports:
-        - containerPort: 8080
-        resources: {}
-        env:
-{% if env == 'staging' %}
-        - name: POSTGRESQL_USER
-          value: "{{ stg_blockerbugs_db_user }}"
-{% else %}
-        - name: POSTGRESQL_USER
-          value: "{{ prod_blockerbugs_db_user }}"
-{% endif %}
-        - name: POSTGRESQL_DATABASE
-          value: "blockerbugs"
-        - name: POSTGRESQL_SERVICE_HOST
-          value: "db01{{ env_suffix }}.{{datacenter}}.fedoraproject.org"
-        - name: POSTGRESQL_SERVICE_PORT
-          value: "5432"
-{% if env == 'staging' %}
-        - name: POSTGRESQL_PASSWORD
-          value: "{{ stg_blockerbugs_db_password }}"
-        - name: SECRET_KEY
-          value: "{{ stg_blockerbugs_secret_key }}"
-        - name: PAGURE_REPO_TOKEN
-          value: "{{ stg_blockerbugs_pagure_repo_token_secret }}"
-        - name: PAGURE_REPO_WEBHOOK_KEY
-          value: "{{ stg_blockerbugs_pagure_repo_webhook_key_secret }}"
-        - name: BUGZILLA_API_KEY
-          value: "{{ stg_blockerbugs_bz_api_key }}"
-        - name: PAGURE_URL
-          value: "https://stg.pagure.io/"
-        - name: PAGURE_API
-          value: "https://stg.pagure.io/api/0/"
-        - name: BUGZILLA_URL
-          value: "https://bugzilla.stage.redhat.com"
-{% else %}
-        - name: POSTGRESQL_PASSWORD
-          value: "{{ prod_blockerbugs_db_password }}"
-        - name: SECRET_KEY
-          value: "{{ prod_blockerbugs_secret_key }}"
-        - name: PAGURE_REPO_TOKEN
-          value: "{{ prod_blockerbugs_pagure_repo_token_secret }}"
-        - name: PAGURE_REPO_WEBHOOK_KEY
-          value: "{{ prod_blockerbugs_pagure_repo_webhook_key_secret }}"
-        - name: BUGZILLA_API_KEY
-          value: "{{ prod_blockerbugs_bz_api_key }}"
-        - name: PAGURE_URL
-          value: "https://pagure.io/"
-        - name: PAGURE_API
-          value: "https://pagure.io/api/0/"
-        - name: BUGZILLA_URL
-          value: "https://bugzilla.redhat.com"
-{% endif %}
-        - name: BLOCKERBUGS_URL
-          value: "https://qa{{ env_suffix }}.fedoraproject.org/blockerbugs/"
-        - name: BLOCKERBUGS_API
-          value: "https://qa{{ env_suffix }}.fedoraproject.org/blockerbugs/api/v0/"
-        - name: FAS_BASE_URL
-          value: "https://admin{{ env_suffix }}.fedoraproject.org/accounts/"
-        - name: FAS_ADMIN_GROUP
-          value: "qa-admin"
-        - name: PAGURE_BOT_USERNAME
-          value: "blockerbot"
-        - name: PAGURE_BOT_ENABLED
-          value: "True"
-        - name: PAGURE_REPO
-          value: "fedora-qa/blocker-review"
-        - name: BODHI_URL
-          value: "https://bodhi{{ env_suffix }}.fedoraproject.org/"
-        - name: OPENSHIFT_PROD
-{% if env == 'staging' %}
-          value: "0"
-{% else %}
-          value: "1"
-{% endif %}
-        volumeMounts:
-        - name: blockerbugs-secret-volume
-          mountPath: /opt/app-root/secret/
-          readOnly: true
-        readinessProbe:
-          timeoutSeconds: 5
-          initialDelaySeconds: 5
-          httpGet:
-            path: /blockerbugs/
-            port: 8080
-        livenessProbe:
-          timeoutSeconds: 15
-          initialDelaySeconds: 30
-          httpGet:
-            path: /blockerbugs/
-            port: 8080
-      volumes:
-      - name: blockerbugs-secret-volume
-        secret:
-          secretName: blockerbugs-secret
-
-  triggers:
-  - type: ConfigChange
-  - type: ImageChange
-    imageChangeParams:
-      automatic: true
-      containerNames:
-      - blockerbugs
-      from:
-        kind: ImageStreamTag
-        name: blockerbugs:latest

roles/openshift-apps/bodhi/files/service.yml

@@ -4,8 +4,7 @@ kind: Service
 metadata:
   name: bodhi-web
   labels:
-    app: bodhi
-    service: web
+    app: bodhi-web
   namespace: bodhi
 spec:
   ports:
@@ -13,4 +12,4 @@ spec:
       port: 8080
       targetPort: 8080
   selector:
-    deploymentconfig: bodhi-web
+    app: bodhi-web

roles/openshift-apps/bodhi/templates/deployment.yml.j2

@@ -0,0 +1,350 @@
+---
+# bodhi-web
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: bodhi-web
+  name: bodhi-web
+spec:
+  replicas: {{ bodhi_openshift_pods }}
+  selector:
+    matchLabels:
+      app: bodhi-web
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: bodhi-web
+{% if env == "staging" %}
+        monitoring-key: cpe
+{% endif %}
+      annotations:
+        image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-base:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-web\")].image"}]'
+    spec:
+      initContainers:
+      - name: alembic-upgrade
+        image: image-registry.openshift-image-registry.svc:5000/bodhi/bodhi-base:latest
+        command: ["/bin/sh", "-c"]
+        args:
+          - |
+            (/usr/bin/alembic-3 -c /etc/bodhi/alembic.ini current | grep -q "(head)") || ( cd /etc/bodhi && /usr/bin/alembic-3 -c /etc/bodhi/alembic.ini upgrade head)
+        volumeMounts:
+        - name: config-volume
+          mountPath: /etc/bodhi
+          readOnly: true
+      containers:
+      - name: bodhi-web
+        image: image-registry.openshift-image-registry.svc:5000/bodhi/bodhi-base:latest
+        command: ["gunicorn"]
+        args: ["--paste", "/etc/bodhi/production.ini", "-b", "0.0.0.0:8080", "-w", "4", "--log-level", "DEBUG", "-k", "gthread", "--threads", "2", "--log-file=-"]
+        ports:
+        - containerPort: 8080
+          name: web
+        resources: {}
+        volumeMounts:
+        - name: config-volume
+          mountPath: /etc/bodhi
+          readOnly: true
+        - name: bodhi-critpath-storage
+          mountPath: /etc/bodhi/critpath
+          readOnly: true
+        - name: keytab-volume
+          mountPath: /etc/keytabs
+          readOnly: true
+        - name: httpdir-volume
+          mountPath: /httpdir
+        - name: fedora-messaging-config-volume
+          mountPath: /etc/fedora-messaging
+          readOnly: true
+        - name: fedora-messaging-ca-volume
+          mountPath: /etc/pki/fedora-messaging/cacert.pem
+          subPath: cacert.pem
+          readOnly: true
+        - name: fedora-messaging-crt-volume
+          mountPath: /etc/pki/fedora-messaging/bodhi-cert.pem
+          subPath: bodhi-cert.pem
+          readOnly: true
+        - name: fedora-messaging-key-volume
+          mountPath: /etc/pki/fedora-messaging/bodhi-key.pem
+          subPath: bodhi-key.pem
+          readOnly: true
+        readinessProbe:
+          timeoutSeconds: 10
+          initialDelaySeconds: 5
+          periodSeconds: 60
+          httpGet:
+            path: /healthz/ready
+            port: 8080
+        livenessProbe:
+          timeoutSeconds: 60
+          initialDelaySeconds: 30
+          periodSeconds: 120
+          failureThreshold: 5
+          httpGet:
+            path: /healthz/live
+            port: 8080
+      volumes:
+      - name: config-volume
+        configMap:
+          name: bodhi-configmap
+      - name: bodhi-critpath-storage
+        persistentVolumeClaim:
+          claimName: "bodhi-critpath-storage"
+      - name: keytab-volume
+        secret:
+          secretName: bodhi-keytab
+      - name: httpdir-volume
+        emptyDir: {}
+      - name: fedora-messaging-config-volume
+        configMap:
+          name: fedora-messaging-configmap
+      - name: fedora-messaging-ca-volume
+        secret:
+          secretName: bodhi-fedora-messaging-ca
+      - name: fedora-messaging-crt-volume
+        secret:
+          secretName: bodhi-fedora-messaging-crt
+      - name: fedora-messaging-key-volume
+        secret:
+          secretName: bodhi-fedora-messaging-key
+---
+# bodhi-consumer
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: bodhi-consumer
+  name: bodhi-consumer
+spec:
+{% if env == 'staging' %}
+  replicas: {{ bodhi_openshift_pods_stg_consumers }}
+{% else %}
+  replicas: {{ bodhi_openshift_pods }}
+{% endif %}
+  selector:
+    matchLabels:
+      app: bodhi-consumer
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+  template:
+    metadata:
+      labels:
+        app: bodhi-consumer
+      annotations:
+        image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-base:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-consumer\")].image"}]'
+    spec:
+      containers:
+      - name: bodhi-consumer
+        image: image-registry.openshift-image-registry.svc:5000/bodhi/bodhi-base:latest
+        command: ["/usr/bin/fedora-messaging"]
+        args: ["consume"]
+        resources: {}
+        volumeMounts:
+        - name: config-volume
+          mountPath: /etc/bodhi
+          readOnly: true
+        - name: bodhi-critpath-storage
+          mountPath: /etc/bodhi/critpath
+          readOnly: true
+        - name: keytab-volume
+          mountPath: /etc/keytabs
+          readOnly: true
+        - name: fedora-messaging-config-volume
+          mountPath: /etc/fedora-messaging
+          readOnly: true
+        - name: fedora-messaging-ca-volume
+          mountPath: /etc/pki/fedora-messaging/cacert.pem
+          subPath: cacert.pem
+          readOnly: true
+        - name: fedora-messaging-crt-volume
+          mountPath: /etc/pki/fedora-messaging/bodhi-cert.pem
+          subPath: bodhi-cert.pem
+          readOnly: true
+        - name: fedora-messaging-key-volume
+          mountPath: /etc/pki/fedora-messaging/bodhi-key.pem
+          subPath: bodhi-key.pem
+          readOnly: true
+      volumes:
+      - name: config-volume
+        configMap:
+          name: bodhi-configmap
+      - name: bodhi-critpath-storage
+        persistentVolumeClaim:
+          claimName: "bodhi-critpath-storage"
+      - name: keytab-volume
+        secret:
+          secretName: bodhi-keytab
+      - name: fedora-messaging-config-volume
+        configMap:
+          name: fedora-messaging-configmap
+      - name: fedora-messaging-ca-volume
+        secret:
+          secretName: bodhi-fedora-messaging-ca
+      - name: fedora-messaging-crt-volume
+        secret:
+          secretName: bodhi-fedora-messaging-crt
+      - name: fedora-messaging-key-volume
+        secret:
+          secretName: bodhi-fedora-messaging-key
+---
+# bodhi-celery
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: bodhi-celery
+  name: bodhi-celery
+spec:
+  replicas: {{ bodhi_openshift_pods }}
+  selector:
+    matchLabels:
+      app: bodhi-celery
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+  template:
+    metadata:
+      labels:
+        app: bodhi-celery
+      annotations:
+        image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-base:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-celery\")].image"}]'
+    spec:
+      containers:
+      - name: bodhi-celery
+        image: image-registry.openshift-image-registry.svc:5000/bodhi/bodhi-base:latest
+        command: ["/usr/bin/celery"]
+        args: ["-A", "bodhi.server.tasks.app", "worker", "-l", "info", "-Q", "celery"]
+        resources: {}
+        volumeMounts:
+        - name: config-volume
+          mountPath: /etc/bodhi
+          readOnly: true
+        - name: bodhi-critpath-storage
+          mountPath: /etc/bodhi/critpath
+          readOnly: true
+        - name: keytab-volume
+          mountPath: /etc/keytabs
+          readOnly: true
+        - name: fedora-messaging-config-volume
+          mountPath: /etc/fedora-messaging
+          readOnly: true
+        - name: fedora-messaging-ca-volume
+          mountPath: /etc/pki/fedora-messaging/cacert.pem
+          subPath: cacert.pem
+          readOnly: true
+        - name: fedora-messaging-crt-volume
+          mountPath: /etc/pki/fedora-messaging/bodhi-cert.pem
+          subPath: bodhi-cert.pem
+          readOnly: true
+        - name: fedora-messaging-key-volume
+          mountPath: /etc/pki/fedora-messaging/bodhi-key.pem
+          subPath: bodhi-key.pem
+          readOnly: true
+      volumes:
+      - name: config-volume
+        configMap:
+          name: bodhi-configmap
+      - name: bodhi-critpath-storage
+        persistentVolumeClaim:
+          claimName: "bodhi-critpath-storage"
+      - name: keytab-volume
+        secret:
+          secretName: bodhi-keytab
+      - name: fedora-messaging-config-volume
+        configMap:
+          name: fedora-messaging-configmap
+      - name: fedora-messaging-ca-volume
+        secret:
+          secretName: bodhi-fedora-messaging-ca
+      - name: fedora-messaging-crt-volume
+        secret:
+          secretName: bodhi-fedora-messaging-crt
+      - name: fedora-messaging-key-volume
+        secret:
+          secretName: bodhi-fedora-messaging-key
+---
+# bodhi-celery-beat
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: bodhi-celery-beat
+  name: bodhi-celery-beat
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: bodhi-celery-beat
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+  template:
+    metadata:
+      labels:
+        app: bodhi-celery-beat
+      annotations:
+        image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-base:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-celery-beat\")].image"}]'
+    spec:
+      containers:
+      - name: bodhi-celery-beat
+        image: image-registry.openshift-image-registry.svc:5000/bodhi/bodhi-base:latest
+        workingDir: "/tmp"
+        command: ["/usr/bin/celery"]
+        args: ["-A", "bodhi.server.tasks.app", "beat", "-l", "info"]
+        resources: {}
+        volumeMounts:
+        - name: config-volume
+          mountPath: /etc/bodhi
+          readOnly: true
+        - name: bodhi-critpath-storage
+          mountPath: /etc/bodhi/critpath
+          readOnly: true
+        - name: keytab-volume
+          mountPath: /etc/keytabs
+          readOnly: true
+        - name: fedora-messaging-config-volume
+          mountPath: /etc/fedora-messaging
+          readOnly: true
+        - name: fedora-messaging-ca-volume
+          mountPath: /etc/pki/fedora-messaging/cacert.pem
+          subPath: cacert.pem
+          readOnly: true
+        - name: fedora-messaging-crt-volume
+          mountPath: /etc/pki/fedora-messaging/bodhi-cert.pem
+          subPath: bodhi-cert.pem
+          readOnly: true
+        - name: fedora-messaging-key-volume
+          mountPath: /etc/pki/fedora-messaging/bodhi-key.pem
+          subPath: bodhi-key.pem
+          readOnly: true
+      volumes:
+      - name: config-volume
+        configMap:
+          name: bodhi-configmap
+      - name: bodhi-critpath-storage
+        persistentVolumeClaim:
+          claimName: "bodhi-critpath-storage"
+      - name: keytab-volume
+        secret:
+          secretName: bodhi-keytab
+      - name: fedora-messaging-config-volume
+        configMap:
+          name: fedora-messaging-configmap
+      - name: fedora-messaging-ca-volume
+        secret:
+          secretName: bodhi-fedora-messaging-ca
+      - name: fedora-messaging-crt-volume
+        secret:
+          secretName: bodhi-fedora-messaging-crt
+      - name: fedora-messaging-key-volume
+        secret:
+          secretName: bodhi-fedora-messaging-key

roles/openshift-apps/bodhi/templates/deploymentconfig.yml.j2

@@ -1,436 +0,0 @@
----
-apiVersion: apps.openshift.io/v1
-items:
-- apiVersion: apps.openshift.io/v1
-  kind: DeploymentConfig
-  metadata:
-    labels:
-      app: bodhi
-      service: web
-    name: bodhi-web
-  spec:
-    replicas: {{ bodhi_openshift_pods }}
-    selector:
-      deploymentconfig: bodhi-web
-    strategy:
-      activeDeadlineSeconds: 21600
-      recreateParams:
-        mid:
-          execNewPod:
-            command:
-              - /bin/sh
-              - '-c'
-              - >-
-                (/usr/bin/alembic-3 -c /etc/bodhi/alembic.ini current | grep -q
-                "(head)") || ( cd /etc/bodhi && /usr/bin/alembic-3 -c
-                /etc/bodhi/alembic.ini upgrade head)
-            containerName: bodhi-web
-            volumes:
-              - config-volume
-          failurePolicy: Abort
-        timeoutSeconds: 600
-      resources: {}
-      type: Recreate
-    template:
-      metadata:
-        creationTimestamp: null
-        labels:
-          app: bodhi-web
-          deploymentconfig: bodhi-web
-{% if env == "staging" %}
-          monitoring-key: cpe
-{% endif %}
-      spec:
-        containers:
-        - name: bodhi-web
-          image: bodhi-base:latest
-          command: ["gunicorn"]
-          # Don't use --preload, it causes threading errors with Fedora Messaging on Python 3.13
-          # https://github.com/fedora-infra/fedora-messaging/issues/431
-          args: ["--paste", "/etc/bodhi/production.ini", "-b", "0.0.0.0:8080", "-w", "4", "--log-level", "DEBUG", "-k", "gthread", "--threads", "2", "--log-file=-"]
-          ports:
-          - containerPort: 8080
-            name: web
-          resources: {}
-          volumeMounts:
-          - name: config-volume
-            mountPath: /etc/bodhi
-            readOnly: true
-          - name: bodhi-critpath-storage
-            mountPath: /etc/bodhi/critpath
-            readOnly: true
-          - name: keytab-volume
-            mountPath: /etc/keytabs
-            readOnly: true
-          - name: httpdir-volume
-            mountPath: /httpdir
-          - name: fedora-messaging-config-volume
-            mountPath: /etc/fedora-messaging
-            readOnly: true
-          - name: fedora-messaging-ca-volume
-            mountPath: /etc/pki/fedora-messaging/cacert.pem
-            subPath: cacert.pem
-            readOnly: true
-          - name: fedora-messaging-crt-volume
-            mountPath: /etc/pki/fedora-messaging/bodhi-cert.pem
-            subPath: bodhi-cert.pem
-            readOnly: true
-          - name: fedora-messaging-key-volume
-            mountPath: /etc/pki/fedora-messaging/bodhi-key.pem
-            subPath: bodhi-key.pem
-            readOnly: true
-          readinessProbe:
-            timeoutSeconds: 10
-            initialDelaySeconds: 5
-            periodSeconds: 60
-            httpGet:
-              path: /healthz/ready
-              port: 8080
-          livenessProbe:
-            timeoutSeconds: 60
-            initialDelaySeconds: 30
-            periodSeconds: 120
-            failureThreshold: 5
-            httpGet:
-              path: /healthz/live
-              port: 8080
-        volumes:
-        - name: config-volume
-          configMap:
-            name: bodhi-configmap
-        - name: bodhi-critpath-storage
-          persistentVolumeClaim:
-            claimName: "bodhi-critpath-storage"
-        - name: keytab-volume
-          secret:
-            secretName: bodhi-keytab
-        - name: httpdir-volume
-          emptyDir: {}
-        - name: fedora-messaging-config-volume
-          configMap:
-            name: fedora-messaging-configmap
-        - name: fedora-messaging-ca-volume
-          secret:
-            secretName: bodhi-fedora-messaging-ca
-        - name: fedora-messaging-crt-volume
-          secret:
-            secretName: bodhi-fedora-messaging-crt
-        - name: fedora-messaging-key-volume
-          secret:
-            secretName: bodhi-fedora-messaging-key
-    triggers:
-    - imageChangeParams:
-        automatic: true
-        containerNames:
-        - bodhi-web
-        from:
-          kind: ImageStreamTag
-          name: bodhi-base:latest
-          namespace: bodhi
-      type: ImageChange
-    - type: ConfigChange
-kind: List
-metadata: {}
----
-apiVersion: apps.openshift.io/v1
-items:
-- apiVersion: apps.openshift.io/v1
-  kind: DeploymentConfig
-  metadata:
-    labels:
-      app: bodhi
-      service: consumer
-    name: bodhi-consumer
-  spec:
-{% if env == 'staging' %}
-    replicas: {{ bodhi_openshift_pods_stg_consumers }}
-{% else %}
-    replicas: {{ bodhi_openshift_pods }}
-{% endif %}
-    selector:
-      deploymentconfig: bodhi-consumer
-    strategy:
-      activeDeadlineSeconds: 21600
-      recreateParams:
-        timeoutSeconds: 600
-      resources: {}
-      rollingParams:
-        intervalSeconds: 1
-        maxSurge: 25%
-        maxUnavailable: 25%
-        timeoutSeconds: 600
-        updatePeriodSeconds: 1
-      type: Rolling
-    template:
-      metadata:
-        creationTimestamp: null
-        labels:
-          app: bodhi-consumer
-          deploymentconfig: bodhi-consumer
-      spec:
-        containers:
-        - name: bodhi-consumer
-          image: bodhi-base:latest
-          command: ["/usr/bin/fedora-messaging"]
-          args: ["consume"]
-          resources: {}
-          volumeMounts:
-          - name: config-volume
-            mountPath: /etc/bodhi
-            readOnly: true
-          - name: bodhi-critpath-storage
-            mountPath: /etc/bodhi/critpath
-            readOnly: true
-          - name: keytab-volume
-            mountPath: /etc/keytabs
-            readOnly: true
-          - name: fedora-messaging-config-volume
-            mountPath: /etc/fedora-messaging
-            readOnly: true
-          - name: fedora-messaging-ca-volume
-            mountPath: /etc/pki/fedora-messaging/cacert.pem
-            subPath: cacert.pem
-            readOnly: true
-          - name: fedora-messaging-crt-volume
-            mountPath: /etc/pki/fedora-messaging/bodhi-cert.pem
-            subPath: bodhi-cert.pem
-            readOnly: true
-          - name: fedora-messaging-key-volume
-            mountPath: /etc/pki/fedora-messaging/bodhi-key.pem
-            subPath: bodhi-key.pem
-            readOnly: true
-        volumes:
-        - name: config-volume
-          configMap:
-            name: bodhi-configmap
-        - name: bodhi-critpath-storage
-          persistentVolumeClaim:
-            claimName: "bodhi-critpath-storage"
-        - name: keytab-volume
-          secret:
-            secretName: bodhi-keytab
-        - name: fedora-messaging-config-volume
-          configMap:
-            name: fedora-messaging-configmap
-        - name: fedora-messaging-ca-volume
-          secret:
-            secretName: bodhi-fedora-messaging-ca
-        - name: fedora-messaging-crt-volume
-          secret:
-            secretName: bodhi-fedora-messaging-crt
-        - name: fedora-messaging-key-volume
-          secret:
-            secretName: bodhi-fedora-messaging-key
-    triggers:
-    - imageChangeParams:
-        automatic: true
-        containerNames:
-        - bodhi-consumer
-        from:
-          kind: ImageStreamTag
-          name: bodhi-base:latest
-          namespace: bodhi
-      type: ImageChange
-    - type: ConfigChange
-kind: List
-metadata: {}
----
-apiVersion: apps.openshift.io/v1
-items:
-- apiVersion: apps.openshift.io/v1
-  kind: DeploymentConfig
-  metadata:
-    labels:
-      app: bodhi
-      service: celery
-    name: bodhi-celery
-  spec:
-    replicas: {{ bodhi_openshift_pods }}
-    selector:
-      deploymentconfig: bodhi-celery
-    strategy:
-      activeDeadlineSeconds: 21600
-      recreateParams:
-        timeoutSeconds: 600
-      resources: {}
-      rollingParams:
-        intervalSeconds: 1
-        maxSurge: 25%
-        maxUnavailable: 25%
-        timeoutSeconds: 600
-        updatePeriodSeconds: 1
-      type: Rolling
-    template:
-      metadata:
-        creationTimestamp: null
-        labels:
-          app: bodhi-celery
-          deploymentconfig: bodhi-celery
-      spec:
-        containers:
-        - name: bodhi-celery
-          image: bodhi-base:latest
-          command: ["/usr/bin/celery"]
-          args: ["-A", "bodhi.server.tasks.app", "worker", "-l", "info", "-Q", "celery"]
-          resources: {}
-          volumeMounts:
-          - name: config-volume
-            mountPath: /etc/bodhi
-            readOnly: true
-          - name: bodhi-critpath-storage
-            mountPath: /etc/bodhi/critpath
-            readOnly: true
-          - name: keytab-volume
-            mountPath: /etc/keytabs
-            readOnly: true
-          - name: fedora-messaging-config-volume
-            mountPath: /etc/fedora-messaging
-            readOnly: true
-          - name: fedora-messaging-ca-volume
-            mountPath: /etc/pki/fedora-messaging/cacert.pem
-            subPath: cacert.pem
-            readOnly: true
-          - name: fedora-messaging-crt-volume
-            mountPath: /etc/pki/fedora-messaging/bodhi-cert.pem
-            subPath: bodhi-cert.pem
-            readOnly: true
-          - name: fedora-messaging-key-volume
-            mountPath: /etc/pki/fedora-messaging/bodhi-key.pem
-            subPath: bodhi-key.pem
-            readOnly: true
-        volumes:
-        - name: config-volume
-          configMap:
-            name: bodhi-configmap
-        - name: bodhi-critpath-storage
-          persistentVolumeClaim:
-            claimName: "bodhi-critpath-storage"
-        - name: keytab-volume
-          secret:
-            secretName: bodhi-keytab
-        - name: fedora-messaging-config-volume
-          configMap:
-            name: fedora-messaging-configmap
-        - name: fedora-messaging-ca-volume
-          secret:
-            secretName: bodhi-fedora-messaging-ca
-        - name: fedora-messaging-crt-volume
-          secret:
-            secretName: bodhi-fedora-messaging-crt
-        - name: fedora-messaging-key-volume
-          secret:
-            secretName: bodhi-fedora-messaging-key
-    triggers:
-    - imageChangeParams:
-        automatic: true
-        containerNames:
-        - bodhi-celery
-        from:
-          kind: ImageStreamTag
-          name: bodhi-base:latest
-          namespace: bodhi
-      type: ImageChange
-    - type: ConfigChange
-kind: List
-metadata: {}
----
-apiVersion: apps.openshift.io/v1
-items:
-- apiVersion: apps.openshift.io/v1
-  kind: DeploymentConfig
-  metadata:
-    labels:
-      app: bodhi
-      service: celery-beat
-    name: bodhi-celery-beat
-  spec:
-    # There must be only one celery-beat worker
-    replicas: 1
-    selector:
-      deploymentconfig: bodhi-celery-beat
-    strategy:
-      activeDeadlineSeconds: 21600
-      recreateParams:
-        timeoutSeconds: 600
-      resources: {}
-      rollingParams:
-        intervalSeconds: 1
-        maxSurge: 25%
-        maxUnavailable: 25%
-        timeoutSeconds: 600
-        updatePeriodSeconds: 1
-      type: Rolling
-    template:
-      metadata:
-        creationTimestamp: null
-        labels:
-          app: bodhi-celery-beat
-          deploymentconfig: bodhi-celery-beat
-      spec:
-        containers:
-        - name: bodhi-celery-beat
-          image: bodhi-base:latest
-          workingDir: "/tmp"
-          command: ["/usr/bin/celery"]
-          args: ["-A", "bodhi.server.tasks.app", "beat", "-l", "info"]
-          resources: {}
-          volumeMounts:
-          - name: config-volume
-            mountPath: /etc/bodhi
-            readOnly: true
-          - name: bodhi-critpath-storage
-            mountPath: /etc/bodhi/critpath
-            readOnly: true
-          - name: keytab-volume
-            mountPath: /etc/keytabs
-            readOnly: true
-          - name: fedora-messaging-config-volume
-            mountPath: /etc/fedora-messaging
-            readOnly: true
-          - name: fedora-messaging-ca-volume
-            mountPath: /etc/pki/fedora-messaging/cacert.pem
-            subPath: cacert.pem
-            readOnly: true
-          - name: fedora-messaging-crt-volume
-            mountPath: /etc/pki/fedora-messaging/bodhi-cert.pem
-            subPath: bodhi-cert.pem
-            readOnly: true
-          - name: fedora-messaging-key-volume
-            mountPath: /etc/pki/fedora-messaging/bodhi-key.pem
-            subPath: bodhi-key.pem
-            readOnly: true
-        volumes:
-        - name: config-volume
-          configMap:
-            name: bodhi-configmap
-        - name: bodhi-critpath-storage
-          persistentVolumeClaim:
-            claimName: "bodhi-critpath-storage"
-        - name: keytab-volume
-          secret:
-            secretName: bodhi-keytab
-        - name: fedora-messaging-config-volume
-          configMap:
-            name: fedora-messaging-configmap
-        - name: fedora-messaging-ca-volume
-          secret:
-            secretName: bodhi-fedora-messaging-ca
-        - name: fedora-messaging-crt-volume
-          secret:
-            secretName: bodhi-fedora-messaging-crt
-        - name: fedora-messaging-key-volume
-          secret:
-            secretName: bodhi-fedora-messaging-key
-    triggers:
-    - imageChangeParams:
-        automatic: true
-        containerNames:
-        - bodhi-celery-beat
-        from:
-          kind: ImageStreamTag
-          name: bodhi-base:latest
-          namespace: bodhi
-      type: ImageChange
-    - type: ConfigChange
-kind: List
-metadata: {}

roles/openshift-apps/compose-tracker/templates/deploymentconfig.yml.j2

@@ -1,54 +0,0 @@
----
-apiVersion: apps.openshift.io/v1
-kind: DeploymentConfig
-metadata:
-  labels:
-    app: compose-tracker
-  name: compose-tracker
-spec:
-  replicas: 1
-  selector:
-    app: compose-tracker
-  strategy:
-    resources: {}
-  template:
-    metadata:
-      labels:
-        app: compose-tracker
-      name: compose-tracker
-    spec:
-      containers:
-      - envFrom:
-        - secretRef:
-            name: compose-tracker-forgejo-token
-        env:
-        - name: FORGEJO_NAMESPACE
-          value: "releng"
-        - name: FORGEJO_REPO
-          value: "compose-tracker-issues"
-        - name: FORGEJO_DOMAIN
-{% if env == "staging" %}
-          value: "https://forge.stg.fedoraproject.org/"
-{% else %}
-          value: "https://forge.fedoraproject.org/"
-{% endif %}
-        # sleep infinity is useful for debugging environment issues
-        # comment out when not debugging
-#       args: ['infinity']
-#       command: ['/usr/bin/sleep']
-        image: ""
-        imagePullPolicy: IfNotPresent
-        name: compose-tracker
-        resources: {}
-      restartPolicy: Always
-  test: false
-  triggers:
-  - type: ConfigChange
-  - type: ImageChange
-    imageChangeParams:
-      automatic: true
-      containerNames:
-      - compose-tracker
-      from:
-        kind: ImageStreamTag
-        name: compose-tracker-img:latest

roles/openshift-apps/datanommer/templates/deployment.yml.j2

@@ -1,6 +1,6 @@
 ---
-apiVersion: apps.openshift.io/v1
-kind: DeploymentConfig
+apiVersion: apps/v1
+kind: Deployment
 metadata:
   name: datanommer
   labels:
@@ -8,27 +8,28 @@ metadata:
 spec:
   replicas: 1
   selector:
-    app: Datanommer
-    deploymentconfig: datanommer
+    matchLabels:
+      app: Datanommer
   strategy:
     type: Recreate
-    recreateParams:
-      mid:
-        execNewPod:
-          command: [/opt/app-root/bin/alembic, -c, /etc/fedora-messaging/alembic.ini, upgrade, head]
-          containerName: datanommer
-          volumes:
-            - fedora-messaging-config-volume
-        failurePolicy: Abort
   template:
     metadata:
-      creationTimestamp: null
       labels:
         app: Datanommer
-        deploymentconfig: datanommer
+      annotations:
+        image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"datanommer:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"datanommer\")].image"}]'
     spec:
+      initContainers:
+      - name: alembic-upgrade
+        image: image-registry.openshift-image-registry.svc:5000/datanommer/datanommer:latest
+        command: ["/opt/app-root/bin/alembic", "-c", "/etc/fedora-messaging/alembic.ini", "upgrade", "head"]
+        volumeMounts:
+        - name: fedora-messaging-config-volume
+          mountPath: "/etc/fedora-messaging"
+          readOnly: true
       containers:
       - name: datanommer
+        image: image-registry.openshift-image-registry.svc:5000/datanommer/datanommer:latest
         imagePullPolicy: Always
         ports:
         - containerPort: 8080
@@ -64,13 +65,3 @@ spec:
       - name: fedora-messaging-key-volume
         secret:
           secretName: fedora-messaging-key
-  triggers:
-  - imageChangeParams:
-      automatic: true
-      containerNames:
-      - datanommer
-      from:
-        kind: ImageStreamTag
-        name: datanommer:latest
-    type: ImageChange
-  - type: ConfigChange

roles/openshift-apps/easyfix/templates/deploymentconfig.yml.j2

@@ -1,75 +0,0 @@
----
-apiVersion: apps.openshift.io/v1
-kind: DeploymentConfig
-metadata:
-  name: web
-  labels:
-    app: easyfix
-spec:
-  replicas: 1
-  selector:
-    app: easyfix
-    deploymentconfig: web
-  strategy:
-    type: Rolling
-    activeDeadlineSeconds: 21600
-    rollingParams:
-      intervalSeconds: 1
-      maxSurge: 25%
-      maxUnavailable: 25%
-      timeoutSeconds: 600
-      updatePeriodSeconds: 1
-  template:
-    metadata:
-      creationTimestamp: null
-      labels:
-        app: easyfix
-        deploymentconfig: web
-    spec:
-      containers:
-        - name: easyfix
-          imagePullPolicy: Always
-          ports:
-            - containerPort: 8080
-          volumeMounts:
-            - name: httpdir-volume
-              mountPath: /httpdir
-            - name: data
-              mountPath: /srv
-            - name: config
-              mountPath: "/etc/easyfix"
-              readOnly: true
-          env:
-            - name: APP_SCRIPT
-              value: ".s2i/run-httpd.sh"
-          readinessProbe:
-            timeoutSeconds: 1
-            initialDelaySeconds: 5
-            httpGet:
-              path: /
-              port: 8080
-          livenessProbe:
-            timeoutSeconds: 1
-            initialDelaySeconds: 20
-            httpGet:
-              path: /
-              port: 8080
-      volumes:
-        - name: httpdir-volume
-          emptyDir: {}
-        - name: config
-          configMap:
-            name: config
-        - name: data
-          persistentVolumeClaim:
-            claimName: data
-  triggers:
-    - type: ConfigChange
-    - type: ImageChange
-      imageChangeParams:
-        automatic: true
-        containerNames:
-          - easyfix
-        from:
-          kind: ImageStreamTag
-          name: easyfix:latest

roles/openshift-apps/elections/files/deployment.yml

@@ -1,6 +1,6 @@
 ---
-apiVersion: apps.openshift.io/v1
-kind: DeploymentConfig
+apiVersion: apps/v1
+kind: Deployment
 metadata:
   labels:
     app: elections
@@ -9,35 +9,42 @@ metadata:
 spec:
   replicas: 1
   selector:
-    app: elections
-    deploymentconfig: elections
+    matchLabels:
+      app: elections
   strategy:
     type: Recreate
-    recreateParams:
-      mid:
-        failurePolicy: Abort
-        execNewPod:
-          containerName: elections
-          command: ["/opt/app-root/src/alembic_upgrade.sh"]
-          env:
-          - name: PYTHONPATH
-            value: /opt/app-root/src
-          - name: KRB5_CONFIG
-            value: /etc/ipa/krb5.conf
-          volumes:
-            - config-volume
-            - elections-secret-volume
-            - ipa-config-volume
-            - keytab-volume
   template:
     metadata:
       labels:
         app: elections
-        deploymentconfig: elections
+      annotations:
+        image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"elections:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"elections\")].image"}]'
     spec:
+      initContainers:
+      - name: alembic-upgrade
+        image: image-registry.openshift-image-registry.svc:5000/elections/elections:latest
+        command: ["/opt/app-root/src/alembic_upgrade.sh"]
+        env:
+        - name: PYTHONPATH
+          value: /opt/app-root/src
+        - name: KRB5_CONFIG
+          value: /etc/ipa/krb5.conf
+        volumeMounts:
+        - name: config-volume
+          mountPath: /opt/app-root/config/
+          readOnly: true
+        - name: elections-secret-volume
+          mountPath: /opt/app-root/secret/
+          readOnly: true
+        - name: ipa-config-volume
+          mountPath: /etc/ipa
+          readOnly: true
+        - name: keytab-volume
+          mountPath: /etc/keytabs
+          readOnly: true
       containers:
       - name: elections
-        image: elections:latest
+        image: image-registry.openshift-image-registry.svc:5000/elections/elections:latest
         ports:
         - containerPort: 8000
         resources: {}
@@ -102,14 +109,3 @@ spec:
       - name: keytab-volume
         secret:
           secretName: elections-keytab
-
-  triggers:
-  - type: ConfigChange
-  - type: ImageChange
-    imageChangeParams:
-      automatic: true
-      containerNames:
-      - elections
-      from:
-        kind: ImageStreamTag
-        name: elections:latest

roles/openshift-apps/elections/files/service.yml

@@ -13,4 +13,3 @@ spec:
     targetPort: 8000
   selector:
     app: elections
-    deploymentconfig: elections

roles/openshift-apps/flatpak-indexer/files/service.yml

@@ -13,4 +13,3 @@ spec:
     targetPort: 6379
   selector:
     app: redis
-    deploymentconfig: redis

roles/openshift-apps/flatpak-indexer/templates/deployment.yml.j2

@@ -1,6 +1,6 @@
 ---
-kind: DeploymentConfig
-apiVersion: apps.openshift.io/v1
+apiVersion: apps/v1
+kind: Deployment
 metadata:
   labels:
     app: flatpak-indexer
@@ -8,26 +8,24 @@ metadata:
 spec:
   replicas: 1
   selector:
-    app: flatpak-indexer
-    deploymentconfig: flatpak-indexer
+    matchLabels:
+      app: flatpak-indexer
   strategy:
-    activeDeadlineSeconds: 21600
-    resources: {}
-    rollingParams:
-      intervalSeconds: 1
+    type: RollingUpdate
+    rollingUpdate:
       maxSurge: 25%
       maxUnavailable: 25%
-      timeoutSeconds: 600
-      updatePeriodSeconds: 1
-    type: Rolling
   template:
     metadata:
       labels:
         app: flatpak-indexer
-        deploymentconfig: flatpak-indexer
+      annotations:
+        image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"flatpak-indexer:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"flatpak-indexer\")].image"}]'
     spec:
       containers:
-      - env:
+      - name: flatpak-indexer
+        image: image-registry.openshift-image-registry.svc:5000/flatpak-indexer/flatpak-indexer:latest
+        env:
         - name: OUTPUT_DIR
           value: /var/www/flatpaks
         - name: REDIS_PASSWORD
@@ -37,12 +35,9 @@ spec:
               key: password
         - name: REDIS_URL
           value: redis://redis.flatpak-indexer.svc.cluster.local:6379
-        image: flatpak-indexer:latest
-        name: flatpak-indexer
         ports:
         - containerPort: 8080
           protocol: TCP
-        resources: {}
         volumeMounts:
         - mountPath: /etc/flatpak-indexer
           name: indexer-config-volume
@@ -52,34 +47,19 @@ spec:
           readOnly: true
         - mountPath: /var/www/flatpaks
           name: index-output-volume
-      dnsPolicy: ClusterFirst
-      restartPolicy: Always
       volumes:
-      - configMap:
-          defaultMode: 420
+      - name: indexer-config-volume
+        configMap:
           name: indexer-config
-        name: indexer-config-volume
-      - configMap:
-          defaultMode: 420
+      - name: koji-conf-volume
+        configMap:
           name: koji-conf
-        name: koji-conf-volume
       - name: index-output-volume
         persistentVolumeClaim:
           claimName: flatpak-indexer-storage{{ '-stg' if env == 'staging' else '' }}
-  test: false
-  triggers:
-  - type: ConfigChange
-  - type: ImageChange
-    imageChangeParams:
-      automatic: true
-      containerNames:
-      - flatpak-indexer
-      from:
-        kind: ImageStreamTag
-        name: flatpak-indexer:latest
 ---
-kind: DeploymentConfig
-apiVersion: apps.openshift.io/v1
+apiVersion: apps/v1
+kind: Deployment
 metadata:
   labels:
     app: flatpak-indexer-differ
@@ -88,26 +68,24 @@ spec:
   replicas: 1
   revisionHistoryLimit: 10
   selector:
-    app: flatpak-indexer-differ
-    deploymentconfig: flatpak-indexer-differ
+    matchLabels:
+      app: flatpak-indexer-differ
   strategy:
-    activeDeadlineSeconds: 21600
-    resources: {}
-    rollingParams:
-      intervalSeconds: 1
+    type: RollingUpdate
+    rollingUpdate:
       maxSurge: 25%
       maxUnavailable: 25%
-      timeoutSeconds: 600
-      updatePeriodSeconds: 1
-    type: Rolling
   template:
     metadata:
       labels:
         app: flatpak-indexer-differ
-        deploymentconfig: flatpak-indexer-differ
+      annotations:
+        image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"flatpak-indexer:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"flatpak-indexer-differ\")].image"}]'
     spec:
       containers:
-      - env:
+      - name: flatpak-indexer-differ
+        image: image-registry.openshift-image-registry.svc:5000/flatpak-indexer/flatpak-indexer:latest
+        env:
         - name: OUTPUT_DIR
           value: /var/www/flatpaks
         - name: FLATPAK_INDEXER_COMMAND
@@ -119,8 +97,6 @@ spec:
               key: password
         - name: REDIS_URL
           value: redis://redis.flatpak-indexer.svc.cluster.local:6379
-        image: flatpak-indexer:latest
-        name: flatpak-indexer-differ
         ports:
         - containerPort: 8080
           protocol: TCP
@@ -137,30 +113,16 @@ spec:
           readOnly: true
         - mountPath: /var/www/flatpaks
           name: index-output-volume
-      dnsPolicy: ClusterFirst
-      restartPolicy: Always
       volumes:
-      - configMap:
-          defaultMode: 420
+      - name: indexer-config-volume
+        configMap:
           name: indexer-config
-        name: indexer-config-volume
       - name: index-output-volume
         persistentVolumeClaim:
           claimName: flatpak-indexer-storage{{ '-stg' if env == 'staging' else '' }}
-  test: false
-  triggers:
-  - type: ConfigChange
-  - type: ImageChange
-    imageChangeParams:
-      automatic: true
-      containerNames:
-      - flatpak-indexer-differ
-      from:
-        kind: ImageStreamTag
-        name: flatpak-indexer:latest
 ---
-apiVersion: apps.openshift.io/v1
-kind: DeploymentConfig
+apiVersion: apps/v1
+kind: Deployment
 metadata:
   labels:
     app: redis
@@ -169,27 +131,29 @@ spec:
   replicas: 1
   revisionHistoryLimit: 10
   selector:
-    app: redis
-    deploymentconfig: redis
+    matchLabels:
+      app: redis
   strategy:
-    activeDeadlineSeconds: 21600
-    # Recreate so that the old pod is stopped before the new pod is created.
-    # Could also use a StatefulSet
     type: Recreate
   template:
     metadata:
       labels:
         app: redis
-        deploymentconfig: redis
+      annotations:
+        image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"redis:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"redis\")].image"}]'
     spec:
       containers:
-      - env:
-          - name: REDIS_PASSWORD
-            valueFrom:
-              secretKeyRef:
-                name: redis-password
-                key: password
-        image: redis:latest
+      - name: redis
+        image: image-registry.openshift-image-registry.svc:5000/flatpak-indexer/redis:latest
+        env:
+        - name: REDIS_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: redis-password
+              key: password
+        ports:
+        - containerPort: 6379
+          protocol: TCP
         livenessProbe:
           exec:
             command: ['valkey-cli', '-a', '$REDIS_PASSWORD', 'ping']
@@ -198,10 +162,6 @@ spec:
           periodSeconds: 10
           successThreshold: 1
           timeoutSeconds: 5
-        name: redis
-        ports:
-        - containerPort: 6379
-          protocol: TCP
         readinessProbe:
           exec:
             command: ['valkey-cli', '-a', '$REDIS_PASSWORD', 'ping']
@@ -209,24 +169,10 @@ spec:
           periodSeconds: 60
           successThreshold: 1
           timeoutSeconds: 1
-        resources: {}
         volumeMounts:
         - mountPath: /data
           name: redis-data-volume
-      dnsPolicy: ClusterFirst
-      restartPolicy: Always
       volumes:
       - name: redis-data-volume
         persistentVolumeClaim:
           claimName: flatpak-indexer-redis-storage{{ '-stg' if env == 'staging' else '' }}
-  test: false
-  triggers:
-  - type: ConfigChange
-  - type: ImageChange
-    imageChangeParams:
-      automatic: true
-      containerNames:
-      - redis
-      from:
-        kind: ImageStreamTag
-        name: redis:latest

roles/openshift-apps/fmn/files/service.yml

@@ -5,6 +5,7 @@ metadata:
   name: frontend
   labels:
     app: fmn
+    component: frontend
 spec:
   ports:
     - name: web
@@ -12,7 +13,7 @@ spec:
       targetPort: 8080
   selector:
     app: fmn
-    deploymentconfig: frontend
+    component: frontend
 ---
 apiVersion: v1
 kind: Service
@@ -20,6 +21,7 @@ metadata:
   name: api
   labels:
     app: fmn
+    component: api
 spec:
   ports:
     - name: web
@@ -27,7 +29,7 @@ spec:
       targetPort: 8080
   selector:
     app: fmn
-    deploymentconfig: api
+    component: api
 ---
 apiVersion: v1
 kind: Service
@@ -35,6 +37,7 @@ metadata:
   name: sendria
   labels:
     app: fmn
+    component: sendria
 spec:
   ports:
     - name: web
@@ -45,7 +48,7 @@ spec:
       targetPort: 1025
   selector:
     app: fmn
-    deploymentconfig: sendria
+    component: sendria
 ---
 apiVersion: v1
 kind: Service
@@ -53,6 +56,7 @@ metadata:
   name: redis
   labels:
     app: fmn
+    component: redis
 spec:
   ports:
     - name: redis
@@ -61,4 +65,4 @@ spec:
       targetPort: 6379
   selector:
     app: fmn
-    deploymentconfig: redis
+    component: redis