diff --git a/.forgejo/workflows/ci.yaml b/.forgejo/workflows/ci.yaml index 63673333da..9e409437b3 100644 --- a/.forgejo/workflows/ci.yaml +++ b/.forgejo/workflows/ci.yaml @@ -39,11 +39,15 @@ jobs: steps: - name: Install testing tools run: | - dnf install -y ansible-lint nodejs git ansible + dnf install -y python3-pip nodejs git + pip3 install ansible-core ansible-lint - name: Install ansible collections run: | - ansible-galaxy collection install community.zabbix + ansible-galaxy collection install \ + community.zabbix \ + community.general \ + ansible.posix - name: Checkout code uses: https://code.forgejo.org/actions/checkout@v6 diff --git a/files/download/sync-up-downloads.sh.ib01 b/files/download/sync-up-downloads.sh.ib01 index fa2c3e64cc..1bfb1e38e5 100755 --- a/files/download/sync-up-downloads.sh.ib01 +++ b/files/download/sync-up-downloads.sh.ib01 @@ -8,7 +8,7 @@ RSYNC='/usr/bin/rsync' RS_OPT="-avSHP --numeric-ids" RS_DEADLY="--delete --delete-excluded --delete-delay --delay-updates" -ALT_EXCLUDES="" +ALT_EXCLUDES="--exclude 44_Beta*" # 2026-04-16 - tmp. running out of space EPL_EXCLUDES="" FED_EXCLUDES="" diff --git a/inventory/builders b/inventory/builders index 1875224f87..13448e4fe8 100644 --- a/inventory/builders +++ b/inventory/builders @@ -289,6 +289,9 @@ buildhw-x86-01.rdu3.fedoraproject.org buildhw-x86-02.rdu3.fedoraproject.org buildhw-x86-03.rdu3.fedoraproject.org buildhw-x86-04.rdu3.fedoraproject.org +buildhw-x86-05.rdu3.fedoraproject.org +buildhw-x86-06.rdu3.fedoraproject.org +buildhw-x86-07.rdu3.fedoraproject.org buildhw-x86-08.rdu3.fedoraproject.org buildhw-x86-09.rdu3.fedoraproject.org buildhw-x86-10.rdu3.fedoraproject.org @@ -312,6 +315,9 @@ buildhw-x86-02.rdu3.fedoraproject.org buildhw-x86-03.rdu3.fedoraproject.org buildhw-x86-04.rdu3.fedoraproject.org # old iad2 hw +buildhw-x86-05.rdu3.fedoraproject.org +buildhw-x86-06.rdu3.fedoraproject.org +buildhw-x86-07.rdu3.fedoraproject.org buildhw-x86-08.rdu3.fedoraproject.org buildhw-x86-09.rdu3.fedoraproject.org buildhw-x86-10.rdu3.fedoraproject.org diff --git a/inventory/group_vars/all b/inventory/group_vars/all index cd8f8c2a22..2ae29716a2 100644 --- a/inventory/group_vars/all +++ b/inventory/group_vars/all @@ -100,6 +100,7 @@ communishift_projects: name: communishift-planet communishift-standupbot: name: communishift-standupbot + do_not_delete: true # Marked do not delete 2026-05-01 - dkirwan communishift-weekly-bootc: do_not_delete: true # Marked do not delete 2024-11-26. Needed until end of bootc initative. - dkirwan name: communishift-weekly-bootc diff --git a/inventory/group_vars/buildvm_aarch64_stg b/inventory/group_vars/buildvm_aarch64_stg index 08f009690a..38e4097b0d 100644 --- a/inventory/group_vars/buildvm_aarch64_stg +++ b/inventory/group_vars/buildvm_aarch64_stg @@ -18,7 +18,7 @@ koji_topurl: "https://kojipkgs.stg.fedoraproject.org/" # Groups and individual hosts should ovveride them with specific info. koji_weburl: "https://koji.stg.fedoraproject.org/koji" -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/43/Server/aarch64/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/aarch64/os/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora lvm_size: 140000 max_cpu: "{{ num_cpus }}" diff --git a/inventory/group_vars/copr_aws b/inventory/group_vars/copr_aws index ffcaca5ff6..db4fb0dcf3 100644 --- a/inventory/group_vars/copr_aws +++ b/inventory/group_vars/copr_aws @@ -26,18 +26,13 @@ builders: aarch64: [50, 20, 33] x86_64: [70, 20, 52] aws_reserved_powerful: - x86_64: [1, 1, 1] + x86_64: [2, 2, 2] aws_powerful: aarch64: [10, 2, 0] x86_64: [10, 2, 1] aws_spot: aarch64: [30, 4, 1] x86_64: [70, 8, 16] - ppc64le_hypervisor_01: - ppc64le: [0, 4, 15] - # There's the ppc64le-test machine, so keep 2 builders less. - ppc64le_hypervisor_02: - ppc64le: [0, 4, 13] p09_hypervisor_01: ppc64le: [15, 5, 15] p09_hypervisor_02: @@ -61,42 +56,42 @@ builders: x86_hypervisor_03: x86_64: [20, 4, 20] x86_hypervisor_04: - x86_64: [20, 4, 20] + x86_64: [0, 4, 20] ibm_cloud_us_east_hp: s390x: [2, 1, 0] ibm_cloud_br_sao_1: - s390x: [3, 1, 1] + s390x: [3, 3, 1] ibm_cloud_br_sao_2: - s390x: [3, 1, 1] + s390x: [3, 3, 1] ibm_cloud_br_sao_3: - s390x: [3, 1, 1] + s390x: [3, 3, 1] ibm_cloud_eu_es_1: - s390x: [3, 1, 1] + s390x: [3, 3, 1] ibm_cloud_eu_es_2: - s390x: [3, 1, 1] + s390x: [3, 3, 1] ibm_cloud_eu_es_3: - s390x: [3, 1, 1] + s390x: [3, 3, 1] cloud_instance_types: ibm_cloud: - s390x: mz2-2x16 + s390x: bz2-2x8 s390x_hp: bz2-16x64 ibm_cloud_regions: eu_es: name: eu-es name_humans: Madrid, Spain - ssh_key: r050-cbd10ece-a28f-45c8-bc3a-15ecb9ff66d5 + ssh_key: r050-4e396a17-294c-4197-9c56-e126185025a1 vpc: r050-190b8bac-3bae-47cf-9be7-ac70fc54ccb9 security_group: r050-cfc3db07-8cde-4807-9756-db91b242092a images: "{{ copr_builder_images.ibm_cloud.eu_es }}" br_sao: name: br-sao name_humans: Sao Paulo, Brazil - ssh_key: r042-4fb65a23-e7bd-440f-8d71-ff57b83a4152 + ssh_key: r042-b30ff308-ef4f-43bf-bdd6-e16f1cc614cd vpc: r042-c902f12d-556f-4334-95cb-d181ebb3d8ba security_group: r042-22ef3881-fa20-4caa-9873-c8dc41c5dcb7 images: "{{ copr_builder_images.ibm_cloud.br_sao }}" diff --git a/inventory/group_vars/copr_dev_aws b/inventory/group_vars/copr_dev_aws index 0ecc09b90a..ae0e6961e2 100644 --- a/inventory/group_vars/copr_dev_aws +++ b/inventory/group_vars/copr_dev_aws @@ -33,10 +33,6 @@ builders: aws_spot: aarch64: [3, 3, 1] x86_64: [0, 0, 1] - ppc64le_hypervisor_01: - ppc64le: [0, 1, 1] - ppc64le_hypervisor_02: - ppc64le: [0, 1, 1] p09_hypervisor_01: ppc64le: [1, 1, 1] p09_hypervisor_02: @@ -60,7 +56,7 @@ builders: x86_hypervisor_03: x86_64: [2, 1, 1] x86_hypervisor_04: - x86_64: [2, 1, 1] + x86_64: [0, 1, 1] ibm_cloud_us_east_hp: s390x: [1, 1, 0] @@ -68,34 +64,34 @@ builders: ibm_cloud_br_sao_1: s390x: [1, 1, 0] ibm_cloud_br_sao_2: - s390x: [1, 1, 0] + s390x: [0, 0, 0] ibm_cloud_br_sao_3: - s390x: [1, 1, 0] + s390x: [0, 0, 0] ibm_cloud_eu_es_1: - s390x: [1, 1, 0] + s390x: [0, 0, 0] ibm_cloud_eu_es_2: - s390x: [1, 1, 0] + s390x: [0, 0, 0] ibm_cloud_eu_es_3: - s390x: [1, 1, 0] + s390x: [0, 0, 0] cloud_instance_types: ibm_cloud: - s390x: mz2-2x16 + s390x: bz2-2x8 s390x_hp: bz2-16x64 ibm_cloud_regions: eu_es: name: eu-es name_humans: Madrid, Spain - ssh_key: r050-cbd10ece-a28f-45c8-bc3a-15ecb9ff66d5 + ssh_key: r050-ea3b598c-39ca-4963-b8ef-c9d6ac146fad vpc: r050-190b8bac-3bae-47cf-9be7-ac70fc54ccb9 security_group: r050-cfc3db07-8cde-4807-9756-db91b242092a images: "{{ copr_builder_images.ibm_cloud.eu_es }}" br_sao: name: br-sao name_humans: Sao Paulo, Brazil - ssh_key: r042-4fb65a23-e7bd-440f-8d71-ff57b83a4152 + ssh_key: r042-3ec7f0e1-3eb3-4f55-a922-915c85da09c2 vpc: r042-c902f12d-556f-4334-95cb-d181ebb3d8ba security_group: r042-22ef3881-fa20-4caa-9873-c8dc41c5dcb7 images: "{{ copr_builder_images.ibm_cloud.br_sao }}" diff --git a/inventory/group_vars/copr_hypervisor b/inventory/group_vars/copr_hypervisor index 7a2fe21d09..2dd7d4013e 100644 --- a/inventory/group_vars/copr_hypervisor +++ b/inventory/group_vars/copr_hypervisor @@ -19,6 +19,8 @@ primary_auth_source: ipa nbde: true nbde_device: /dev/md2 +nbde_device2: /dev/md3 +nbde_device3: /dev/md4 nbde_client_bindings: - device: "{{ nbde_device }}" encryption_password: "{{ nbde_password }}" @@ -27,6 +29,20 @@ nbde_client_bindings: servers: - http://tang01.rdu3.fedoraproject.org - http://tang02.rdu3.fedoraproject.org + - device: "{{ nbde_device2 }}" + encryption_password: "{{ nbde_password }}" + password_temporary: no + threshold: 1 + servers: + - http://tang01.rdu3.fedoraproject.org + - http://tang02.rdu3.fedoraproject.org + - device: "{{ nbde_device3 }}" + encryption_password: "{{ nbde_password }}" + password_temporary: no + threshold: 1 + servers: + - http://tang01.rdu3.fedoraproject.org + - http://tang02.rdu3.fedoraproject.org libvirt_host: "{{ inventory_hostname }}" diff --git a/inventory/group_vars/download b/inventory/group_vars/download index 3f896606ca..272948f7d0 100644 --- a/inventory/group_vars/download +++ b/inventory/group_vars/download @@ -107,6 +107,9 @@ dl_tier1: - sv.mirrors.kernel.org - dfw.mirrors.kernel.org - mirror.raiolanetworks.com # 91.132.103.246 / 2a12:d282:102:f6::1 + - ftp-osl.osuosl.org # 140.211.166.134 / 2605:bc80:3010::134 + - ftp-chi.osuosl.org # 64.50.236.52 / 2600:3402:200:227::2 + - ftp-nyc.osuosl.org # 64.50.233.100 ipa_host_group: download ipa_host_group_desc: Download servers nagios_Check_Services: diff --git a/inventory/group_vars/koji_riscv b/inventory/group_vars/koji_riscv index 0f147d0c6e..84fa7ea95d 100644 --- a/inventory/group_vars/koji_riscv +++ b/inventory/group_vars/koji_riscv @@ -11,8 +11,8 @@ ipa_host_group_desc: riscv Koji Hub hosts koji_hub: "riscv-koji.fedoraproject.org/kojihub" koji_root: "riscv-koji.fedoraproject.org/koji" lvm_size: 100000 -mem_size: 32768 -max_mem_size: 65536 +mem_size: 45056 +max_mem_size: 90112 nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=4" num_cpus: 8 primary_auth_source: ipa diff --git a/inventory/group_vars/wiki b/inventory/group_vars/wiki index 6e80764a73..f75a51f7b3 100644 --- a/inventory/group_vars/wiki +++ b/inventory/group_vars/wiki @@ -14,7 +14,7 @@ lvm_size: 30000 max_mem_size: 8192 mem_size: 8192 nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=3" -num_cpus: 4 +num_cpus: 16 primary_auth_source: ipa tcp_ports: [80] # mediawiki variables diff --git a/inventory/host_vars/buildhw-x86-05.rdu3.fedoraproject.org b/inventory/host_vars/buildhw-x86-05.rdu3.fedoraproject.org new file mode 100644 index 0000000000..a561490f04 --- /dev/null +++ b/inventory/host_vars/buildhw-x86-05.rdu3.fedoraproject.org @@ -0,0 +1,70 @@ +--- +bmc: + ip_address: 10.16.160.16 + ping: true + http: true + https: true +br0_ipv4_ip: 10.16.169.35 +br0_ipv4_gw: 10.16.169.254 +br0_ipv4_nm: 24 +datacenter: rdu3 +dns1: 10.16.163.33 +dns2: 10.16.163.34 +dns_search1: "rdu3.fedoraproject.org" +dns_search2: "fedoraproject.org" +has_ipv4: yes +mac0: c8:4b:d6:88:fb:c6 +mac1: c8:4b:d6:88:fb:c7 +mac2: 6c:fe:54:57:5f:48 +mac3: 6c:fe:54:57:5f:49 +network_connections: + # Bridge profile + - name: br0 + state: up + type: bridge + mtu: 1500 + autoconnect: yes + ip: + address: + - "{{ br0_ipv4_ip }}/{{ br0_ipv4_nm }}" + dhcp4: no + dns: + - "{{ dns1 }}" + - "{{ dns2 }}" + dns_search: + - "{{ dns_search1 }}" + - "{{ dns_search2 }}" + gateway4: "{{ br0_ipv4_gw }}" + # Bond profile + - name: bond0 + type: bond + interface_name: bond0 + mtu: 1500 + controller: br0 + bond: + mode: 802.3ad + # Port profile for the 1st Ethernet device + - name: bond0-port1 + mac: "{{ mac2 }}" + type: ethernet + controller: bond0 + state: up + mtu: 1500 + # Port profile for the 2nd Ethernet device + - name: bond0-port2 + mac: "{{ mac3 }}" + type: ethernet + controller: bond0 + state: up + mtu: 1500 +# This is used to populate the inventory fields, only specific keys are allowed, see +# https://www.zabbix.com/documentation/current/en/manual/api/reference/host/object#host-inventory +zabbix_inventory: + date_hw_expiry: "" + date_hw_purchase: "2022-12-31" + hardware: PowerEdge R650 + location: RDU3 + oob_ip: "{{ bmc.ip_address }}" + serialno_a: 3ZGTRT3 + type: Prod_Dedicated_HW + vendor: Dell diff --git a/inventory/host_vars/buildhw-x86-06.rdu3.fedoraproject.org b/inventory/host_vars/buildhw-x86-06.rdu3.fedoraproject.org new file mode 100644 index 0000000000..e925331e79 --- /dev/null +++ b/inventory/host_vars/buildhw-x86-06.rdu3.fedoraproject.org @@ -0,0 +1,70 @@ +--- +bmc: + ip_address: 10.16.160.17 + ping: true + http: true + https: true +br0_ipv4_ip: 10.16.169.36 +br0_ipv4_gw: 10.16.169.254 +br0_ipv4_nm: 24 +datacenter: rdu3 +dns1: 10.16.163.33 +dns2: 10.16.163.34 +dns_search1: "rdu3.fedoraproject.org" +dns_search2: "fedoraproject.org" +has_ipv4: yes +mac0: c8:4b:d6:89:f7:5c +mac1: c8:4b:d6:89:f7:5d +mac2: 6c:fe:54:57:80:2c +mac3: 6c:fe:54:57:80:2d +network_connections: + # Bridge profile + - name: br0 + state: up + type: bridge + mtu: 1500 + autoconnect: yes + ip: + address: + - "{{ br0_ipv4_ip }}/{{ br0_ipv4_nm }}" + dhcp4: no + dns: + - "{{ dns1 }}" + - "{{ dns2 }}" + dns_search: + - "{{ dns_search1 }}" + - "{{ dns_search2 }}" + gateway4: "{{ br0_ipv4_gw }}" + # Bond profile + - name: bond0 + type: bond + interface_name: bond0 + mtu: 1500 + controller: br0 + bond: + mode: 802.3ad + # Port profile for the 1st Ethernet device + - name: bond0-port1 + mac: "{{ mac2 }}" + type: ethernet + controller: bond0 + state: up + mtu: 1500 + # Port profile for the 2nd Ethernet device + - name: bond0-port2 + mac: "{{ mac3 }}" + type: ethernet + controller: bond0 + state: up + mtu: 1500 +# This is used to populate the inventory fields, only specific keys are allowed, see +# https://www.zabbix.com/documentation/current/en/manual/api/reference/host/object#host-inventory +zabbix_inventory: + date_hw_expiry: "" + date_hw_purchase: "2022-12-31" + hardware: PowerEdge R650 + location: RDU3 + oob_ip: "{{ bmc.ip_address }}" + serialno_a: 2ZGTRT3 + type: Prod_Dedicated_HW + vendor: Dell diff --git a/inventory/host_vars/buildhw-x86-07.rdu3.fedoraproject.org b/inventory/host_vars/buildhw-x86-07.rdu3.fedoraproject.org new file mode 100644 index 0000000000..9fa5f567c8 --- /dev/null +++ b/inventory/host_vars/buildhw-x86-07.rdu3.fedoraproject.org @@ -0,0 +1,68 @@ +--- +bmc: + ip_address: 10.16.160.18 + ping: true + http: true + https: true +br0_ipv4_ip: 10.16.169.37 +br0_ipv4_gw: 10.16.169.254 +br0_ipv4_nm: 24 +datacenter: rdu3 +dns1: 10.16.163.33 +dns2: 10.16.163.34 +dns_search1: "rdu3.fedoraproject.org" +dns_search2: "fedoraproject.org" +has_ipv4: yes +mac0: 6c:fe:54:57:4d:80 +mac1: 6c:fe:54:57:4d:81 +network_connections: + # Bridge profile + - name: br0 + state: up + type: bridge + mtu: 1500 + autoconnect: yes + ip: + address: + - "{{ br0_ipv4_ip }}/{{ br0_ipv4_nm }}" + dhcp4: no + dns: + - "{{ dns1 }}" + - "{{ dns2 }}" + dns_search: + - "{{ dns_search1 }}" + - "{{ dns_search2 }}" + gateway4: "{{ br0_ipv4_gw }}" + # Bond profile + - name: bond0 + type: bond + interface_name: bond0 + mtu: 1500 + controller: br0 + bond: + mode: 802.3ad + # Port profile for the 1st Ethernet device + - name: bond0-port1 + mac: "{{ mac0 }}" + type: ethernet + controller: bond0 + state: up + mtu: 1500 + # Port profile for the 2nd Ethernet device + - name: bond0-port2 + mac: "{{ mac1 }}" + type: ethernet + controller: bond0 + state: up + mtu: 1500 +# This is used to populate the inventory fields, only specific keys are allowed, see +# https://www.zabbix.com/documentation/current/en/manual/api/reference/host/object#host-inventory +zabbix_inventory: + date_hw_expiry: "2029-02-17" + date_hw_purchase: "2022-12-31" + hardware: PowerEdge R650 + location: RDU3 + oob_ip: "{{ bmc.ip_address }}" + serialno_a: 617DRT3 + type: Prod_Dedicated_HW + vendor: Dell diff --git a/inventory/host_vars/db-datanommer02.rdu3.fedoraproject.org b/inventory/host_vars/db-datanommer02.rdu3.fedoraproject.org index d236314e3d..eef1208477 100644 --- a/inventory/host_vars/db-datanommer02.rdu3.fedoraproject.org +++ b/inventory/host_vars/db-datanommer02.rdu3.fedoraproject.org @@ -41,3 +41,5 @@ shared_buffers: "4GB" tcp_ports: [5432, 443] vmhost: vmhost-x86-04.rdu3.fedoraproject.org volgroup: /dev/vg_guests +zabbix_macros: + 'PG.LOCKS.MAX.WARN:"mirrormanager2"': 3000 diff --git a/inventory/host_vars/db01.rdu3.fedoraproject.org b/inventory/host_vars/db01.rdu3.fedoraproject.org index 5fdf9208b1..a2e97104fe 100644 --- a/inventory/host_vars/db01.rdu3.fedoraproject.org +++ b/inventory/host_vars/db01.rdu3.fedoraproject.org @@ -82,5 +82,6 @@ vmhost: vmhost-x86-04.rdu3.fedoraproject.org volgroup: /dev/vg_guests zabbix_macros: 'PG.LOCKS.MAX.WARN:"anitya"': 500 - 'PG.LOCKS.MAX.WARN:"bodhi2"': 200 + 'PG.LOCKS.MAX.WARN:"bodhi2"': 500 + 'PG.LOCKS.MAX.WARN:"datanommer2"': 1000 'PG.LOCKS.MAX.WARN:"hyperkitty"': 500 diff --git a/inventory/host_vars/ipsilon03.rdu3.fedoraproject.org b/inventory/host_vars/ipsilon03.rdu3.fedoraproject.org deleted file mode 100644 index c487278ee1..0000000000 --- a/inventory/host_vars/ipsilon03.rdu3.fedoraproject.org +++ /dev/null @@ -1,16 +0,0 @@ ---- -datacenter: rdu3 -eth0_ipv4_gw: 10.16.163.254 -eth0_ipv4_ip: 10.16.163.117 -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/43/Server/x86_64/os/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora -vmhost: vmhost-x86-02.rdu3.fedoraproject.org -volgroup: /dev/vg_guests -# Network configuration for RDU3 -dns: 10.16.163.33 -dns1: 10.16.163.33 -dns2: 10.16.163.34 -dns_search1: "rdu3.fedoraproject.org" -dns_search2: "vpn.fedoraproject.org" -dns_search3: "fedoraproject.org" -openid: yes diff --git a/inventory/host_vars/openqa-a64-worker01.rdu3.fedoraproject.org b/inventory/host_vars/openqa-a64-worker01.rdu3.fedoraproject.org index 6a27a6a941..aa02e092b4 100644 --- a/inventory/host_vars/openqa-a64-worker01.rdu3.fedoraproject.org +++ b/inventory/host_vars/openqa-a64-worker01.rdu3.fedoraproject.org @@ -67,7 +67,7 @@ nrpe_procs_warn: 1400 openqa_rngd: true openqa_tap_iface: bondbr0 # this is a very powerful machine, can handle so many openQA workers -openqa_workers: 60 +openqa_workers: 45 # also means we need to bump the load average threshold openqa_critical_threshold: 120 sudoers: "{{ private }}/files/sudo/qavirt-sudoers" @@ -76,7 +76,7 @@ sudoers: "{{ private }}/files/sudo/qavirt-sudoers" # QEMUPORT is: # $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002; # so for worker 1 it's 20012, for worker 2 it's 20022, etc etc -tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453', '20463', '20473', '20483', '20493', '20503', '20513', '20523', '20533', '20543', '20553', '20563', '20573', '20583', '20593', '20603'] +tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453'] # This is used to populate the inventory fields, only specific keys are allowed, see # https://www.zabbix.com/documentation/current/en/manual/api/reference/host/object#host-inventory diff --git a/inventory/host_vars/openqa-a64-worker02.rdu3.fedoraproject.org b/inventory/host_vars/openqa-a64-worker02.rdu3.fedoraproject.org index a5fc810824..1db5ac8d64 100644 --- a/inventory/host_vars/openqa-a64-worker02.rdu3.fedoraproject.org +++ b/inventory/host_vars/openqa-a64-worker02.rdu3.fedoraproject.org @@ -67,7 +67,7 @@ nrpe_procs_warn: 1400 openqa_rngd: true openqa_tap_iface: bondbr0 # this is a very powerful machine, can handle so many openQA workers -openqa_workers: 60 +openqa_workers: 45 # also means we need to bump the load average threshold openqa_critical_threshold: 120 sudoers: "{{ private }}/files/sudo/qavirt-sudoers" @@ -76,7 +76,7 @@ sudoers: "{{ private }}/files/sudo/qavirt-sudoers" # QEMUPORT is: # $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002; # so for worker 1 it's 20012, for worker 2 it's 20022, etc etc -tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453', '20463', '20473', '20483', '20493', '20503', '20513', '20523', '20533', '20543', '20553', '20563', '20573', '20583', '20593', '20603'] +tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453'] # This is used to populate the inventory fields, only specific keys are allowed, see # https://www.zabbix.com/documentation/current/en/manual/api/reference/host/object#host-inventory diff --git a/inventory/host_vars/openqa-a64-worker03.rdu3.fedoraproject.org b/inventory/host_vars/openqa-a64-worker03.rdu3.fedoraproject.org index 19ed4637ff..fe74f2b33d 100644 --- a/inventory/host_vars/openqa-a64-worker03.rdu3.fedoraproject.org +++ b/inventory/host_vars/openqa-a64-worker03.rdu3.fedoraproject.org @@ -67,7 +67,7 @@ nrpe_procs_warn: 1400 openqa_rngd: true openqa_tap_iface: bondbr0 # this is a very powerful machine, can handle so many openQA workers -openqa_workers: 60 +openqa_workers: 45 # also means we need to bump the load average threshold openqa_critical_threshold: 120 sudoers: "{{ private }}/files/sudo/qavirt-sudoers" @@ -76,7 +76,7 @@ sudoers: "{{ private }}/files/sudo/qavirt-sudoers" # QEMUPORT is: # $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002; # so for worker 1 it's 20012, for worker 2 it's 20022, etc etc -tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453', '20463', '20473', '20483', '20493', '20503', '20513', '20523', '20533', '20543', '20553', '20563', '20573', '20583', '20593', '20603'] +tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453'] # This is used to populate the inventory fields, only specific keys are allowed, see # https://www.zabbix.com/documentation/current/en/manual/api/reference/host/object#host-inventory diff --git a/inventory/host_vars/openqa-a64-worker04.rdu3.fedoraproject.org b/inventory/host_vars/openqa-a64-worker04.rdu3.fedoraproject.org index 62c971c506..1924e9a617 100644 --- a/inventory/host_vars/openqa-a64-worker04.rdu3.fedoraproject.org +++ b/inventory/host_vars/openqa-a64-worker04.rdu3.fedoraproject.org @@ -67,7 +67,7 @@ nrpe_procs_warn: 1400 openqa_rngd: true openqa_tap_iface: bondbr0 # this is a very powerful machine, can handle so many openQA workers -openqa_workers: 60 +openqa_workers: 45 # also means we need to bump the load average threshold openqa_critical_threshold: 120 sudoers: "{{ private }}/files/sudo/qavirt-sudoers" @@ -76,7 +76,7 @@ sudoers: "{{ private }}/files/sudo/qavirt-sudoers" # QEMUPORT is: # $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002; # so for worker 1 it's 20012, for worker 2 it's 20022, etc etc -tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453', '20463', '20473', '20483', '20493', '20503', '20513', '20523', '20533', '20543', '20553', '20563', '20573', '20583', '20593', '20603'] +tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453'] # This is used to populate the inventory fields, only specific keys are allowed, see # https://www.zabbix.com/documentation/current/en/manual/api/reference/host/object#host-inventory diff --git a/inventory/host_vars/openqa-a64-worker05.rdu3.fedoraproject.org b/inventory/host_vars/openqa-a64-worker05.rdu3.fedoraproject.org index faf5ba1cb2..a9d9851937 100644 --- a/inventory/host_vars/openqa-a64-worker05.rdu3.fedoraproject.org +++ b/inventory/host_vars/openqa-a64-worker05.rdu3.fedoraproject.org @@ -67,7 +67,7 @@ nrpe_procs_warn: 1400 openqa_rngd: true openqa_tap_iface: bondbr0 # this is a very powerful machine, can handle so many openQA workers -openqa_workers: 60 +openqa_workers: 45 # also means we need to bump the load average threshold openqa_critical_threshold: 120 sudoers: "{{ private }}/files/sudo/qavirt-sudoers" @@ -76,7 +76,7 @@ sudoers: "{{ private }}/files/sudo/qavirt-sudoers" # QEMUPORT is: # $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002; # so for worker 1 it's 20012, for worker 2 it's 20022, etc etc -tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453', '20463', '20473', '20483', '20493', '20503', '20513', '20523', '20533', '20543', '20553', '20563', '20573', '20583', '20593', '20603'] +tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453'] # This is used to populate the inventory fields, only specific keys are allowed, see # https://www.zabbix.com/documentation/current/en/manual/api/reference/host/object#host-inventory diff --git a/inventory/host_vars/openqa-a64-worker06.rdu3.fedoraproject.org b/inventory/host_vars/openqa-a64-worker06.rdu3.fedoraproject.org index d9bed19285..a936f17992 100644 --- a/inventory/host_vars/openqa-a64-worker06.rdu3.fedoraproject.org +++ b/inventory/host_vars/openqa-a64-worker06.rdu3.fedoraproject.org @@ -67,7 +67,7 @@ nrpe_procs_warn: 1400 openqa_rngd: true openqa_tap_iface: bondbr0 # this is a very powerful machine, can handle so many openQA workers -openqa_workers: 60 +openqa_workers: 45 # also means we need to bump the load average threshold openqa_critical_threshold: 120 sudoers: "{{ private }}/files/sudo/qavirt-sudoers" @@ -76,7 +76,7 @@ sudoers: "{{ private }}/files/sudo/qavirt-sudoers" # QEMUPORT is: # $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002; # so for worker 1 it's 20012, for worker 2 it's 20022, etc etc -tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453', '20463', '20473', '20483', '20493', '20503', '20513', '20523', '20533', '20543', '20553', '20563', '20573', '20583', '20593', '20603'] +tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453'] # This is used to populate the inventory fields, only specific keys are allowed, see # https://www.zabbix.com/documentation/current/en/manual/api/reference/host/object#host-inventory diff --git a/inventory/inventory b/inventory/inventory index a7ffdc9623..25542fccc8 100644 --- a/inventory/inventory +++ b/inventory/inventory @@ -330,12 +330,10 @@ ipsilon01.stg.rdu3.fedoraproject.org [ipsilon] ipsilon01.rdu3.fedoraproject.org ipsilon02.rdu3.fedoraproject.org -ipsilon03.rdu3.fedoraproject.org [ipsilon_rdu3] ipsilon01.rdu3.fedoraproject.org ipsilon02.rdu3.fedoraproject.org -ipsilon03.rdu3.fedoraproject.org [nagios] noc02.fedoraproject.org diff --git a/playbooks/groups/copr-hypervisor.yml b/playbooks/groups/copr-hypervisor.yml index 512c145f59..7e73eb0036 100644 --- a/playbooks/groups/copr-hypervisor.yml +++ b/playbooks/groups/copr-hypervisor.yml @@ -20,7 +20,7 @@ dest: /usr/bin/nbde_client-network-flush owner: root group: root - mode: 755 + mode: 0755 - name: tell NetworkManager we don't want any auto connections ansible.builtin.copy: @@ -28,7 +28,7 @@ dest: /etc/NetworkManager/conf.d/noautodefault.conf owner: root group: root - mode: 644 + mode: 0644 tasks: - import_role: name=base @@ -41,6 +41,7 @@ - import_role: name: copr/hypervisor tags: copr_hypervisor + - {import_role: name=serial-console, when: datacenter == 'rdu3' and ansible_architecture != 'ppc64le'} - {import_role: name=linux-system-roles.nbde_client, tags: ['nbde_client'], when: (nbde|bool) } diff --git a/playbooks/groups/people.yml b/playbooks/groups/people.yml index 994138fb8d..c22376d88b 100644 --- a/playbooks/groups/people.yml +++ b/playbooks/groups/people.yml @@ -79,6 +79,10 @@ - role: apache + - role: anubis-el + tags: + - anubis + - role: httpd/certificate certname: wildcard-2025.fedorapeople.org SSLCertificateChainFile: wildcard-2025.fedorapeople.org.intermediate.cert diff --git a/playbooks/include/proxies-redirects.yml b/playbooks/include/proxies-redirects.yml index e3d7dfc65b..35d3277502 100644 --- a/playbooks/include/proxies-redirects.yml +++ b/playbooks/include/proxies-redirects.yml @@ -1018,3 +1018,10 @@ target: https://communityhealth.languages-in-floss.eu tags: - languages + + - role: httpd/redirectmatch + shortname: provisioning-server + website: provisioning.fedoraproject.org + target: https://fedoraproject.org/iot/ + tags: + - provisioning diff --git a/playbooks/include/proxies-websites.yml b/playbooks/include/proxies-websites.yml index 2801d18fa2..aa852ecb37 100644 --- a/playbooks/include/proxies-websites.yml +++ b/playbooks/include/proxies-websites.yml @@ -48,8 +48,8 @@ server_aliases: - stg.fedoraproject.org - localhost - - www.fedoraproject.org - hotspot-nocache.fedoraproject.org + tags: fedoraproject.org # This is for all the other domains we own # that redirect to https://fedoraproject.org @@ -1292,6 +1292,7 @@ cert_name: "{{wildcard_cert_name}}" tags: - riscv-koji + anubis: true - role: httpd/website site_name: riscv-kojipkgs.fedoraproject.org @@ -1299,6 +1300,17 @@ cert_name: "{{wildcard_cert_name}}" tags: - riscv-koji + anubis: true + when: "'proxies_internal' not in group_names" + + - role: httpd/website + site_name: riscv-kojipkgs.fedoraproject.org + sslonly: true + cert_name: "{{wildcard_cert_name}}" + tags: + - riscv-koji + anubis: false + when: "'proxies_internal' in group_names" - role: httpd/website site_name: "forge{{ env_suffix }}.fedoraproject.org" diff --git a/playbooks/manual/communishift_send_email_notifications.yml b/playbooks/manual/communishift_send_email_notifications.yml index 551bd9ff7c..b42ccf1012 100644 --- a/playbooks/manual/communishift_send_email_notifications.yml +++ b/playbooks/manual/communishift_send_email_notifications.yml @@ -5,6 +5,9 @@ # Run notifications only: # ansible-playbook .../communishift_send_email_notifications.yml --tags communishift_send_notifications # +# Dry run (FASJSON + per-project preview, no SMTP mail): +# ansible-playbook .../communishift_send_email_notifications.yml --tags communishift_send_notifications -e communishift_email_notifications_dry_run=true +# - hosts: localhost user: root gather_facts: false @@ -31,3 +34,10 @@ tags: - communishift_send_notifications loop: "{{ lookup('dict', communishift_projects) }}" + + - name: Summary of Communishift projects notified # noqa: run-once[task] + ansible.builtin.debug: + msg: "{%- set ns = namespace(names=[]) %}{%- for item in communishift_projects | dict2items | sort(attribute='value.name') %}{%- if not (item.value.do_not_delete | default(false)) %}{%- set _ = ns.names.append(item.value.name) %}{%- endif %}{%- endfor %} {% if communishift_email_notifications_dry_run | default(false) %}Communishift notification dry run complete (no email sent). Would notify {{ ns.names | length }} project(s): {{ ns.names | join(' ') }}{% else %}Communishift notification run complete. Emails were sent for {{ ns.names | length }} project(s): {{ ns.names | join(' ') }}{% endif %}" + run_once: true + tags: + - communishift_send_notifications diff --git a/playbooks/openshift-apps/badges.yml b/playbooks/openshift-apps/badges.yml index 2cc5c50774..58a05b7338 100644 --- a/playbooks/openshift-apps/badges.yml +++ b/playbooks/openshift-apps/badges.yml @@ -182,8 +182,8 @@ # Deployment config - role: openshift/object object_app: badges - object_template: deploymentconfig.yml.j2 - object_objectname: deploymentconfig.yml + object_template: deployment.yml.j2 + object_objectname: deployment.yml # Cron jobs - role: openshift/object diff --git a/playbooks/openshift-apps/blockerbugs.yml b/playbooks/openshift-apps/blockerbugs.yml index 5ab84eee75..b7652d6800 100644 --- a/playbooks/openshift-apps/blockerbugs.yml +++ b/playbooks/openshift-apps/blockerbugs.yml @@ -92,11 +92,6 @@ object_template: buildconfig.yml.j2 object_objectname: buildconfig.yml - - role: openshift/object - object_app: blockerbugs - object_template: deploymentconfig.yml.j2 - object_objectname: deploymentconfig.yml - - role: openshift/object object_app: blockerbugs object_template: deployment.yml.j2 diff --git a/playbooks/openshift-apps/bodhi.yml b/playbooks/openshift-apps/bodhi.yml index eb933f6456..b2f288fbf8 100644 --- a/playbooks/openshift-apps/bodhi.yml +++ b/playbooks/openshift-apps/bodhi.yml @@ -139,8 +139,8 @@ haproxy.router.openshift.io/timeout: 180s - role: openshift/object object_app: bodhi - object_template: deploymentconfig.yml.j2 - object_objectname: deploymentconfig.yml + object_template: deployment.yml.j2 + object_objectname: deployment.yml - role: openshift/object object_app: bodhi object_template: critpathcron.yml.j2 @@ -169,22 +169,22 @@ post_tasks: - name: Scale up pods - ansible.builtin.command: oc -n bodhi scale dc/bodhi-consumer --replicas={{ bodhi_openshift_pods }} + ansible.builtin.command: oc -n bodhi scale deployment bodhi-consumer --replicas={{ bodhi_openshift_pods }} when: env == "production" - name: Scale up pods - ansible.builtin.command: oc -n bodhi scale dc/bodhi-celery --replicas={{ bodhi_openshift_pods }} + ansible.builtin.command: oc -n bodhi scale deployment bodhi-celery --replicas={{ bodhi_openshift_pods }} when: env == "production" - name: Scale up pods - ansible.builtin.command: oc -n bodhi scale dc/bodhi-web --replicas=4 + ansible.builtin.command: oc -n bodhi scale deployment bodhi-web --replicas=4 when: env == "production" - name: Scale up pods - ansible.builtin.command: oc -n bodhi scale dc/bodhi-consumer --replicas={{ bodhi_openshift_pods_stg_consumers }} + ansible.builtin.command: oc -n bodhi scale deployment bodhi-consumer --replicas={{ bodhi_openshift_pods_stg_consumers }} when: env == "staging" - name: Scale up pods - ansible.builtin.command: oc -n bodhi scale dc/bodhi-celery --replicas={{ bodhi_openshift_pods }} + ansible.builtin.command: oc -n bodhi scale deployment bodhi-celery --replicas={{ bodhi_openshift_pods }} when: env == "staging" - name: Scale up pods - ansible.builtin.command: oc -n bodhi scale dc/bodhi-web --replicas={{ bodhi_openshift_pods }} + ansible.builtin.command: oc -n bodhi scale deployment bodhi-web --replicas={{ bodhi_openshift_pods }} when: env == "staging" - name: Set the timeout to the openshift route ansible.builtin.command: "oc -n bodhi annotate route bodhi-web --overwrite haproxy.router.openshift.io/timeout=180s" diff --git a/playbooks/openshift-apps/datanommer.yml b/playbooks/openshift-apps/datanommer.yml index 685458b35e..035b2d8611 100644 --- a/playbooks/openshift-apps/datanommer.yml +++ b/playbooks/openshift-apps/datanommer.yml @@ -80,8 +80,8 @@ - role: openshift/object object_app: datanommer - object_template: deploymentconfig.yml.j2 - object_objectname: deploymentconfig.yml + object_template: deployment.yml.j2 + object_objectname: deployment.yml - role: openshift/object object_app: datanommer diff --git a/playbooks/openshift-apps/easyfix.yml b/playbooks/openshift-apps/easyfix.yml deleted file mode 100644 index 7bfcbc31a8..0000000000 --- a/playbooks/openshift-apps/easyfix.yml +++ /dev/null @@ -1,71 +0,0 @@ -# -# Fedora Project easyfixes -# ---- -- name: Make the app be real - # hosts: os_control_stg:os_control - hosts: os_control_stg - user: root - gather_facts: false - - vars_files: - - /srv/web/infra/ansible/vars/global.yml - - /srv/private/ansible/vars.yml - - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml - - vars: - - roles: - - role: openshift/project - project_app: easyfix - project_description: "Easyfixes" - project_appowners: - - abompard - tags: - - apply-appowners - - - role: openshift/object - object_app: easyfix - object_file: imagestream.yml - object_objectname: imagestream.yml - - - role: openshift/object - object_app: easyfix - object_template: buildconfig.yml.j2 - object_objectname: buildconfig.yml - - - role: openshift/object - object_app: easyfix - object_file: storage.yml - object_objectname: storage.yml - - - role: openshift/object - object_app: easyfix - object_template: configmap.yml.j2 - object_objectname: configmap.yml - - - role: openshift/object - object_app: easyfix - object_file: service.yml - object_objectname: service.yml - - # Routes - - role: openshift/route - route_app: easyfix - route_name: web - route_host: "easyfix.apps.ocp{{ env_suffix }}.fedoraproject.org" - route_servicename: web - route_serviceport: web - route_annotations: - haproxy.router.openshift.io/timeout: 5m - - - role: openshift/object - object_app: easyfix - object_template: deploymentconfig.yml.j2 - object_objectname: deploymentconfig.yml - - # Cron jobs - - role: openshift/object - object_app: easyfix - object_template: cron.yml.j2 - object_objectname: cron.yml diff --git a/playbooks/openshift-apps/elections.yml b/playbooks/openshift-apps/elections.yml index b5a2d1fe0a..b6f14c7f95 100644 --- a/playbooks/openshift-apps/elections.yml +++ b/playbooks/openshift-apps/elections.yml @@ -119,5 +119,5 @@ - role: openshift/object object_app: elections - object_file: deploymentconfig.yml - object_objectname: deploymentconfig.yml + object_file: deployment.yml + object_objectname: deployment.yml diff --git a/playbooks/openshift-apps/flatpak-indexer.yml b/playbooks/openshift-apps/flatpak-indexer.yml index 7a61fd982e..6b1dd8e1cc 100644 --- a/playbooks/openshift-apps/flatpak-indexer.yml +++ b/playbooks/openshift-apps/flatpak-indexer.yml @@ -60,5 +60,5 @@ - role: openshift/object object_app: flatpak-indexer - object_template: deploymentconfig.yml.j2 - object_objectname: deploymentconfig.yml + object_template: deployment.yml.j2 + object_objectname: deployment.yml diff --git a/playbooks/openshift-apps/fmn.yml b/playbooks/openshift-apps/fmn.yml index 9c7169905d..b22930b1a7 100644 --- a/playbooks/openshift-apps/fmn.yml +++ b/playbooks/openshift-apps/fmn.yml @@ -217,8 +217,8 @@ # Deployment config - role: openshift/object object_app: fmn - object_template: deploymentconfig.yml.j2 - object_objectname: deploymentconfig.yml + object_template: deployment.yml.j2 + object_objectname: deployment.yml # FASJSON access - role: openshift/ipa-client diff --git a/playbooks/openshift-apps/mirrormanager.yml b/playbooks/openshift-apps/mirrormanager.yml index 00f1fb7161..6a965741b8 100644 --- a/playbooks/openshift-apps/mirrormanager.yml +++ b/playbooks/openshift-apps/mirrormanager.yml @@ -133,8 +133,8 @@ # Deployment config - role: openshift/object object_app: mirrormanager - object_template: deploymentconfig.yml.j2 - object_objectname: deploymentconfig.yml + object_template: deployment.yml.j2 + object_objectname: deployment.yml # Cron jobs - role: openshift/object diff --git a/playbooks/openshift-apps/noggin-centos.yml b/playbooks/openshift-apps/noggin-centos.yml index 4c1314007e..8f15a924dd 100644 --- a/playbooks/openshift-apps/noggin-centos.yml +++ b/playbooks/openshift-apps/noggin-centos.yml @@ -103,8 +103,8 @@ - role: openshift/object object_app: noggin object_os_app: noggin-centos - object_template: deploymentconfig.yml.j2 - object_objectname: deploymentconfig.yml + object_template: deployment.yml.j2 + object_objectname: deployment.yml - role: openshift/start-build start_build_app: noggin-centos diff --git a/playbooks/openshift-apps/noggin.yml b/playbooks/openshift-apps/noggin.yml index 54b84bb6dc..1bb8fac8db 100644 --- a/playbooks/openshift-apps/noggin.yml +++ b/playbooks/openshift-apps/noggin.yml @@ -98,8 +98,9 @@ - role: openshift/object object_app: noggin - object_template: deploymentconfig.yml.j2 - object_objectname: deploymentconfig.yml + object_os_app: noggin + object_template: deployment.yml.j2 + object_objectname: deployment.yml - role: openshift/start-build start_build_app: noggin diff --git a/playbooks/openshift-apps/poddlers.yml b/playbooks/openshift-apps/poddlers.yml index 932571b5fe..c6101cdd6b 100644 --- a/playbooks/openshift-apps/poddlers.yml +++ b/playbooks/openshift-apps/poddlers.yml @@ -104,8 +104,8 @@ - role: openshift/object object_app: poddlers - object_template: deploymentconfig.yml.j2 - object_objectname: deploymentconfig.yml + object_template: deployment.yml.j2 + object_objectname: deployment.yml - role: openshift/object object_app: poddlers diff --git a/playbooks/openshift-apps/release-monitoring.yml b/playbooks/openshift-apps/release-monitoring.yml index e9a1e7a377..a7d3e54376 100644 --- a/playbooks/openshift-apps/release-monitoring.yml +++ b/playbooks/openshift-apps/release-monitoring.yml @@ -63,8 +63,8 @@ object_objectname: route.yml - role: openshift/object object_app: release-monitoring - object_template: deploymentconfig.yml.j2 - object_objectname: deploymentconfig.yml + object_template: deployment.yml.j2 + object_objectname: deployment.yml - role: openshift/rollout rollout_app: release-monitoring rollout_dcname: release-monitoring-web diff --git a/playbooks/openshift-apps/transtats.yml b/playbooks/openshift-apps/transtats.yml deleted file mode 100644 index d6213dcaa3..0000000000 --- a/playbooks/openshift-apps/transtats.yml +++ /dev/null @@ -1,56 +0,0 @@ ---- -- name: Make the app be real - hosts: os_control[0]:os_control_stg[0] - user: root - gather_facts: false - - vars_files: - - /srv/web/infra/ansible/vars/global.yml - - "/srv/private/ansible/vars.yml" - - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml - - roles: - - role: openshift/project - project_app: transtats - project_description: transtats - project_appowners: - - suanand - - role: openshift/object - object_app: transtats - object_objectname: secret.yml - object_template: secret.yml.j2 - - role: openshift/imagestream - imagestream_app: transtats - imagestream_imagename: transtats - - role: openshift/object - object_app: transtats - object_template: buildconfig.yml.j2 - object_objectname: buildconfig.yml - - role: openshift/start-build - start_build_app: transtats - start_build_buildname: transtats-build - tags: - - never - - build - - role: openshift/object - object_app: transtats - object_file: service.yml - object_objectname: service.yml - - role: openshift/route - route_app: transtats - route_name: transtats-web - route_host: transtats{{ env_suffix }}.fedoraproject.org - route_serviceport: web - route_servicename: transtats-web - route_annotations: - haproxy.router.openshift.io/timeout: 8m - - role: openshift/object - object_app: transtats - object_file: deploymentconfig.yml - object_objectname: deploymentconfig.yml - - role: openshift/rollout - rollout_app: transtats - rollout_dcname: transtats-web - tags: - - never - - rollout diff --git a/playbooks/openshift-apps/webhook2fedmsg.yml b/playbooks/openshift-apps/webhook2fedmsg.yml index 2313af0539..448b9908bd 100644 --- a/playbooks/openshift-apps/webhook2fedmsg.yml +++ b/playbooks/openshift-apps/webhook2fedmsg.yml @@ -110,8 +110,8 @@ # Deployment config - role: openshift/object object_app: webhook2fedmsg - object_template: deploymentconfig.yml.j2 - object_objectname: deploymentconfig.yml + object_template: deployment.yml.j2 + object_objectname: deployment.yml # - role: openshift/start-build # start_build_app: webhook2fedmsg diff --git a/playbooks/openshift-apps/zezere.yml b/playbooks/openshift-apps/zezere.yml deleted file mode 100644 index 6b46c6131e..0000000000 --- a/playbooks/openshift-apps/zezere.yml +++ /dev/null @@ -1,56 +0,0 @@ ---- -- name: Make the app be real - hosts: os_control[0]:os_control_stg[0] - user: root - gather_facts: false - - vars_files: - - /srv/web/infra/ansible/vars/global.yml - - "/srv/private/ansible/vars.yml" - - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml - - roles: - - role: openshift/project - project_app: zezere - project_description: Zezere provisioning service - project_appowners: - - pbrobinson - - role: openshift/imagestream - imagestream_app: zezere - imagestream_imagename: zezere - - role: openshift/object - object_app: zezere - object_objectname: buildconfig.yml - object_file: buildconfig.yml - - role: openshift/start-build - start_build_app: zezere - start_build_buildname: zezere-build - tags: - - never - - build - - role: openshift/object - object_app: zezere - object_file: service.yml - object_objectname: service.yml - - role: openshift/route - route_app: zezere - route_name: zezere - route_host: "provision{{ env_suffix }}.fedoraproject.org" - route_servicename: zezere - route_serviceport: 8080 - route_annotations: - haproxy.router.openshift.io/set-forwarded-headers: append - - role: openshift/object - object_app: zezere - object_template: secret.yml.j2 - object_objectname: secret.yml - - role: openshift/object - object_app: zezere - object_template: deploymentconfig.yml.j2 - object_objectname: deploymentconfig.yml - - role: openshift/rollout - rollout_app: zezere - rollout_dcname: zezere - tags: - - never - - rollout diff --git a/roles/communishift/tasks/cleanup-administration-send-notifications.yml b/roles/communishift/tasks/cleanup-administration-send-notifications.yml index 2ac08341f3..e4ecb6a597 100644 --- a/roles/communishift/tasks/cleanup-administration-send-notifications.yml +++ b/roles/communishift/tasks/cleanup-administration-send-notifications.yml @@ -28,6 +28,22 @@ headers: - Reply-To=admin@fedoraproject.org charset: us-ascii - when: "not should_not_delete" + when: + - not should_not_delete + - not communishift_email_notifications_dry_run | default(false) + tags: + - communishift_send_notifications + +- name: Communishift notification email (dry-run preview, mail not sent) + ansible.builtin.debug: + msg: + dry_run: true + project: "{{ item.value.name }}" + to: infrastructure@lists.fedoraproject.org + bcc: "{{ communishift_project_emails[item.value.name]['email_list'] }}" + subject: "Fedora Communishift Notification for project: {{ item.value.name }}" + when: + - not should_not_delete + - communishift_email_notifications_dry_run | default(false) tags: - communishift_send_notifications diff --git a/roles/copr/backend/files/buildsys.production.pub b/roles/copr/backend/files/buildsys.production.pub new file mode 100644 index 0000000000..e7a33183f1 --- /dev/null +++ b/roles/copr/backend/files/buildsys.production.pub @@ -0,0 +1 @@ +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCao0nJaZ5JIE8rn5M/l5VXU1e1LSqGKVbDjNYIwbbT2n7T9SK91D2s7EpUq0/QdoFKuZVsGgl/P7V2Vk4PT5W3k+RG/ndBToa/9AJzFRRK3dbJncgdIKYuOHO6hqSOegbXihiLhML95R/XtN9ywwDw6H+ZvdA5A8HtDs/2VctRZ28zT2BYqUITZ78/Nhgq8ul315Oz+RDiZHp0NH6p0JPhsqtXuCQw/C7GipVgUAm4y4rbkpprPDweGFGN2Xpaps0NWafx9IuC752Kb3vg2IDYCTr2jn4Y5ISBzcJix4K57hR33KRhtdVLc25r7jfXoJzyoaUuHHTEqaYpXCLMO+aHAPruEFEPVIFK68POjebqY/O6ppglpf/qQNKipy0ujnMXTj5ZPMCSQeoTe1ym6ws1R1Nctvp9CBuHKDJg0PHHOLwktpdI6LxBg7gqj76tMiUsclH75JfbM7eSzeX0lMHRca9PoZgFRqduinHonB5mHjnen4mHlumCPVX0fATJ98IoI7VVveI+cZJ4NDklXTedl0K/KV3BhUWeSIM0UrqYiooHDRftenslLDTUFgPAzPst1bLUr/Oqa+66pv8qpbH6g7IHPnf3/xaKd4899SUgBcr9KhFFOTu6HvG9lrk/bZDh+pxp/8NwpJhqN74e0qkokwBjC5YonVNa34DDVF+Y9Q== copr-buildsys-prod diff --git a/roles/copr/backend/files/buildsys.staging.pub b/roles/copr/backend/files/buildsys.staging.pub new file mode 100644 index 0000000000..65cf3e206d --- /dev/null +++ b/roles/copr/backend/files/buildsys.staging.pub @@ -0,0 +1 @@ +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDOcf6r8Q7qCELUVCc3jNYx2YiQ3wCnxwxfxKa76plR7jmbhhUdiXNZEeKybEKNzYd+7sKSxkT8rl9fympTziB7uGOL18350MvstVGRxsgtuZLfoh0yGa78ZNVuOHBCgwD8wl3swdogwgJydqJNijEaJbrYLru7CuTbbGcXLtPpA8blszH9CNH2OyWJtGXSiQyB5PmLyJXsATZiqAZI4/M53K8z3Zp4qiwTwGsS+OVRjlY5S+7MIgb5SH5JOsiTdEf5VkPM5j8WG70cL6Y6mp+DQ0KdDeCEPX7mUvqhRU9KImWuD2QKCfYXGzG9NmR+ycmK7NrR1sLkMTtjmJTm9gRVOtlE1QWMFGmkq/4NvQAm7Qw4G3QDbnMbVntUftWqeC6dQM2q2FX1yqA9ogoCIwkz5nIq8YH5cjO0UqVYICfw5rqN3LLALSsusKvPyiNGXwckSiV647i9PZgUxsnBfX8zZJaiBiwYE+S9dEhPSc3ejVx6INVXB8lXRvFO6A2i4KrXWpkL8NvCcUuH3q0CwxGpOrxB1NIadMNLVk6CiWPBWW03L55SIu82rgUcJqtP44/MLTUUseIB8sh7+ReFbbdNrpaX1pAfn67k8/Q4alisN0NLoCSucxN3tck1KgboAoGsN9s8YfUjGvOzy2h5c5jqgGF22/0asA4y6OLKHDEa4Q== copr-buildsys-2026-04-16 diff --git a/roles/copr/backend/files/provision/files/buildsys.pub b/roles/copr/backend/files/provision/files/buildsys.pub deleted file mode 100644 index 10790ee925..0000000000 --- a/roles/copr/backend/files/provision/files/buildsys.pub +++ /dev/null @@ -1 +0,0 @@ -ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCeTO0ddXuhDZYM9HyM0a47aeV2yIVWhTpddrQ7/RAIs99XyrsicQLABzmdMBfiZnP0FnHBF/e+2xEkT8hHJpX6bX81jjvs2bb8KP18Nh8vaXI3QospWrRygpu1tjzqZT0Llh4ZVFscum8TrMw4VWXclzdDw6x7csCBjSttqq8F3iTJtQ9XM9/5tCAAOzGBKJrsGKV1CNIrfUo5CSzY+IUVIr8XJ93IB2ZQVASK34T/49egmrWlNB32fqAbDMC+XNmobgn6gO33Yq5Ly7Dk4kqTUx2TEaqDkZfhsVu0YcwV81bmqsltRvpj6bIXrEoMeav7nbuqKcPLTxWEY/2icePF diff --git a/roles/copr/backend/files/provision/files/mock/templates/fedora-eln.tpl b/roles/copr/backend/files/provision/files/mock/templates/fedora-eln.tpl new file mode 100644 index 0000000000..f809ebd4d8 --- /dev/null +++ b/roles/copr/backend/files/provision/files/mock/templates/fedora-eln.tpl @@ -0,0 +1,392 @@ +config_opts['releasever'] = 'eln' +config_opts['eln_rawhide_releasever'] = '45' + +config_opts['root'] = 'fedora-eln-{{ target_arch }}' + +config_opts['chroot_setup_cmd'] = 'install bash bzip2 coreutils cpio diffutils fedora-eln-release findutils gawk glibc-minimal-langpack grep gzip info patch redhat-rpm-config rpm-build sed tar unzip util-linux which xz' + +config_opts['dist'] = 'eln' # only useful for --resultdir variable subst +config_opts['extra_chroot_dirs'] = [ '/run/lock', ] + +# https://fedoraproject.org/wiki/Changes/BuildWithDNF5 +# https://pagure.io/releng/issue/11895 +config_opts['package_manager'] = 'dnf5' + +# Per https://github.com/fedora-eln/eln/issues/164 updated up to 4 times a day. +# Docs: https://docs.fedoraproject.org/en-US/eln/deliverables/#_container_image +config_opts['bootstrap_image'] = 'quay.io/fedora/eln:latest' + +# https://fedoraproject.org/wiki/Changes/ReplaceDnfWithDnf5 applied to ELN! +config_opts['bootstrap_image_ready'] = True + +config_opts['dnf.conf'] = """ +[main] +keepcache=1 +system_cachedir=/var/cache/dnf +debuglevel=2 +reposdir=/dev/null +logfile=/var/log/yum.log +retries=20 +obsoletes=1 +gpgcheck=0 +assumeyes=1 +syslog_ident=mock +syslog_device= +install_weak_deps=0 +metadata_expire=0 +best=1 +user_agent={{ user_agent }} + +# TODO +module_platform_id=platform:eln +protected_packages= + +{%- macro rawhide_gpg_keys() -%} +file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-rawhide-primary +{%- for version in [eln_rawhide_releasever|int, eln_rawhide_releasever|int - 1, eln_rawhide_releasever|int - 2] +%} file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-{{ version }}-primary +{%- endfor %} +{%- endmacro %} + +[eln-baseos] +name=Fedora - ELN BaseOS - Developmental packages for the next Enterprise Linux release +#baseurl=https://dl.fedoraproject.org/pub/eln/1/BaseOS/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-baseos-1&arch=$basearch +enabled=1 +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey={{ rawhide_gpg_keys() }} +skip_if_unavailable=False + +[eln-baseos-debuginfo] +name=Fedora - ELN BaseOS - Debug +#baseurl=https://dl.fedoraproject.org/pub/eln/1/BaseOS/$basearch/debug/tree +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-baseos-debug-1&arch=$basearch +enabled=0 +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey={{ rawhide_gpg_keys() }} +skip_if_unavailable=False + +[eln-baseos-source] +name=Fedora - ELN BaseOS - Source +#baseurl=https://dl.fedoraproject.org/pub/eln/1/BaseOS/source/tree/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-baseos-source-1&arch=source +enabled=0 +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey={{ rawhide_gpg_keys() }} +skip_if_unavailable=False + + +[eln-appstream] +name=Fedora - ELN AppStream - Developmental packages for the next Enterprise Linux release +#baseurl=https://dl.fedoraproject.org/pub/eln/1/AppStream/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-appstream-1&arch=$basearch +enabled=1 +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey={{ rawhide_gpg_keys() }} +skip_if_unavailable=False + +[eln-appstream-debuginfo] +name=Fedora - ELN AppStream - Debug +#baseurl=https://dl.fedoraproject.org/pub/eln/1/AppStream/$basearch/debug/tree +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-appstream-debug-1&arch=$basearch +enabled=0 +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey={{ rawhide_gpg_keys() }} +skip_if_unavailable=False + +[eln-appstream-source] +name=Fedora - ELN AppStream - Source +#baseurl=https://dl.fedoraproject.org/pub/eln/1/AppStream/source/tree/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-appstream-source-1&arch=source +enabled=0 +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey={{ rawhide_gpg_keys() }} +skip_if_unavailable=False + + +[eln-crb] +name=Fedora - ELN CodeReady Linux Builders - Build packages for the next Enterprise Linux release +#baseurl=https://dl.fedoraproject.org/pub/eln/1/CRB/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-crb-1&arch=$basearch +enabled=1 +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey={{ rawhide_gpg_keys() }} +skip_if_unavailable=False + +[eln-crb-debuginfo] +name=Fedora - ELN CodeReady Linux Builders - Debug +#baseurl=https://dl.fedoraproject.org/pub/eln/1/CRB/$basearch/debug/tree +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-crb-debug-1&arch=$basearch +enabled=0 +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey={{ rawhide_gpg_keys() }} +skip_if_unavailable=False + +[eln-crb-source] +name=Fedora - ELN CodeReady Linux Builders - Source +#baseurl=https://dl.fedoraproject.org/pub/eln/1/CRB/source/tree/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-crb-source-1&arch=source +enabled=0 +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey={{ rawhide_gpg_keys() }} +skip_if_unavailable=False + + + +[eln-extras] +name=Fedora - ELN Extras - Developmental packages for the next Enterprise Linux release +#baseurl=https://dl.fedoraproject.org/pub/eln/1/Extras/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-extras-1&arch=$basearch +enabled=1 +countme=1 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + +[eln-extras-debuginfo] +name=Fedora - ELN Extras - Debug +#baseurl=https://dl.fedoraproject.org/pub/eln/1/Extras/$basearch/debug/tree +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-extras-debug-1&arch=$basearch +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + +[eln-extras-source] +name=Fedora - ELN Extras - Source +#baseurl=https://dl.fedoraproject.org/pub/eln/1/Extras/source/tree/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-extras-source-1&arch=$basearch +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + + + +[eln-ha] +name=Fedora - ELN HighAvailability - Developmental packages for the next Enterprise Linux release +#baseurl=https://dl.fedoraproject.org/pub/eln/1/HighAvailability/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-highavailability-1&arch=$basearch +enabled=0 +countme=1 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + +[eln-ha-debuginfo] +name=Fedora - ELN HighAvailability - Debug +#baseurl=https://dl.fedoraproject.org/pub/eln/1/HighAvailability/$basearch/debug/tree +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-highavailability-debug-1&arch=$basearch +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + +[eln-ha-source] +name=Fedora - ELN HighAvailability - Source +#baseurl=https://dl.fedoraproject.org/pub/eln/1/HighAvailability/source/tree/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-highavailability-source-1&arch=source +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + + + +[eln-rt] +name=Fedora - ELN RT - Developmental packages for the next Enterprise Linux release +#baseurl=https://dl.fedoraproject.org/pub/eln/1/RT/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-rt-1&arch=$basearch +enabled=0 +countme=1 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + +[eln-rt-debuginfo] +name=Fedora - ELN RT - Debug +#baseurl=https://dl.fedoraproject.org/pub/eln/1/RT/$basearch/debug/tree +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-rt-debug-1&arch=$basearch +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + +[eln-rt-source] +name=Fedora - ELN RT - Source +#baseurl=https://dl.fedoraproject.org/pub/eln/1/RT/source/tree/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-rt-source-1&arch=source +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + + + +[eln-nfv] +name=Fedora - ELN NFV - Developmental packages for the next Enterprise Linux release +#baseurl=https://dl.fedoraproject.org/pub/eln/1/NFV/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-nfv-1&arch=$basearch +enabled=0 +countme=1 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + +[eln-nfv-debuginfo] +name=Fedora - ELN NFV - Debug +#baseurl=https://dl.fedoraproject.org/pub/eln/1/NFV/$basearch/debug/tree +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-nfv-debug-1&arch=$basearch +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + +[eln-nfv-source] +name=Fedora - ELN NFV - Source +#baseurl=https://dl.fedoraproject.org/pub/eln/1/NFV/source/tree/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-nfv-source-1&arch=source +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + + + +[eln-sap] +name=Fedora - ELN SAP - Developmental packages for the next Enterprise Linux release +#baseurl=https://dl.fedoraproject.org/pub/eln/1/SAP/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-sap-1&arch=$basearch +enabled=0 +countme=1 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + +[eln-sap-debuginfo] +name=Fedora - ELN SAP - Debug +#baseurl=https://dl.fedoraproject.org/pub/eln/1/SAP/$basearch/debug/tree +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-sap-debug-1&arch=$basearch +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + +[eln-sap-source] +name=Fedora - ELN SAP - Source +#baseurl=https://dl.fedoraproject.org/pub/eln/1/SAP/source/tree/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-sap-source-1&arch=$basearch +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + + + +[eln-saphana] +name=Fedora - ELN SAPHANA - Developmental packages for the next Enterprise Linux release +#baseurl=https://dl.fedoraproject.org/pub/eln/1/SAPHANA/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-saphana-1&arch=$basearch +enabled=0 +countme=1 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + +[eln-saphana-debuginfo] +name=Fedora - ELN SAPHANA - Debug +#baseurl=https://dl.fedoraproject.org/pub/eln/1/SAPHANA/$basearch/debug/tree +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-saphana-debug-1&arch=$basearch +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + +[eln-saphana-source] +name=Fedora - ELN SAPHANA - Source +#baseurl=https://dl.fedoraproject.org/pub/eln/1/SAPHANA/source/tree/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-saphana-source-1&arch=source +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + +[local] +name=local +baseurl=https://kojipkgs.fedoraproject.org/repos/eln-build/latest/$basearch/ +cost=2000 +enabled=0 +skip_if_unavailable=False +""" diff --git a/roles/copr/backend/files/provision/provision_builder_tasks.yml b/roles/copr/backend/files/provision/provision_builder_tasks.yml index 92fd5470f4..65ffff2cd0 100644 --- a/roles/copr/backend/files/provision/provision_builder_tasks.yml +++ b/roles/copr/backend/files/provision/provision_builder_tasks.yml @@ -274,10 +274,14 @@ - preparing_image - name: mockbuilder authorized_keys - authorized_key: user=mockbuilder key='{{ lookup('file', 'files/buildsys.pub') }}' + authorized_key: + user: mockbuilder + key: "{{ lookup('file', 'files/buildsys.pub') }}" - name: root authorized_keys - authorized_key: user=root key='{{ lookup('file', 'files/buildsys.pub') }}' + authorized_key: + user: root + key: "{{ lookup('file', 'files/buildsys.pub') }}" - name: setup 10x more fds in limits.conf ansible.builtin.copy: diff --git a/roles/copr/backend/tasks/main.yml b/roles/copr/backend/tasks/main.yml index cb50f54147..417ff01704 100644 --- a/roles/copr/backend/tasks/main.yml +++ b/roles/copr/backend/tasks/main.yml @@ -61,7 +61,12 @@ - .ssh - name: Setup privkey for copr user - ansible.builtin.copy: src="{{ private }}/files/copr/buildsys.priv" dest=/home/copr/.ssh/id_rsa owner=copr group=copr mode=600 + ansible.builtin.copy: + src: "{{ private }}/files/copr/buildsys.{{ env }}.priv" + dest: /home/copr/.ssh/id_rsa + owner: copr + group: copr + mode: "0600" - name: Setup copr user ssh config file ansible.builtin.template: @@ -88,11 +93,14 @@ - name: Replace bashrc for copr user ansible.builtin.copy: src="copr_bashrc" dest=/home/copr/.bashrc owner=copr group=copr mode=600 +# TODO(praiskup): this is weird, doesn't seem to be needed - name: Auth_key so we can login to localhost as the copr user from the copr user - authorized_key: user=copr key="{{ item }}" + authorized_key: + user: copr + key: "{{ item }}" no_log: true with_file: - - "provision/files/buildsys.pub" + - "buildsys.{{ env }}.pub" - name: Copy .boto file ansible.builtin.copy: src="boto" dest=/home/copr/.boto owner=copr group=copr diff --git a/roles/copr/backend/tasks/resalloc.yml b/roles/copr/backend/tasks/resalloc.yml index 506ff5232c..6aa132db1d 100644 --- a/roles/copr/backend/tasks/resalloc.yml +++ b/roles/copr/backend/tasks/resalloc.yml @@ -159,7 +159,7 @@ - name: Resalloc, copy backend ssh identity ansible.builtin.copy: - src: "{{ private }}/files/copr/buildsys.priv" + src: "{{ private }}/files/copr/buildsys.{{ env }}.priv" dest: /var/lib/resallocserver/.ssh/id_rsa owner: resalloc group: resalloc diff --git a/roles/copr/backend/tasks/setup_provisioning_environment.yml b/roles/copr/backend/tasks/setup_provisioning_environment.yml index 9612a3bda9..223832bf90 100644 --- a/roles/copr/backend/tasks/setup_provisioning_environment.yml +++ b/roles/copr/backend/tasks/setup_provisioning_environment.yml @@ -19,6 +19,13 @@ tags: - provision_config +- name: install the correct buildsys.pub + ansible.builtin.copy: + dest: "{{ provision_directory }}/files/buildsys.pub" + src: "buildsys.{{ env }}.pub" + tags: + - provision_config + - name: "Sync copr provisioning files [remove mock config leftovers]" ansible.posix.synchronize: src: "{{ roles_path }}/copr/backend/files/provision/files/mock/" diff --git a/roles/copr/backend/templates/copr-be.conf.j2 b/roles/copr/backend/templates/copr-be.conf.j2 index 2d7801a1c3..bd21332638 100644 --- a/roles/copr/backend/templates/copr-be.conf.j2 +++ b/roles/copr/backend/templates/copr-be.conf.j2 @@ -114,6 +114,11 @@ pulp_content_url={{ pulp_content_url }} # praiskup +{% if env == 'production' %} +sentry_dsn={{ copr_sentry_dsn }} +{% endif %} + + [builder] # default is 1800, this probably has no effect! timeout=108000 diff --git a/roles/copr/backend/templates/provision/copr-resalloc-aws-new.j2 b/roles/copr/backend/templates/provision/copr-resalloc-aws-new.j2 index 70410dac73..f21e9d2067 100644 --- a/roles/copr/backend/templates/provision/copr-resalloc-aws-new.j2 +++ b/roles/copr/backend/templates/provision/copr-resalloc-aws-new.j2 @@ -14,7 +14,7 @@ cmd=( /usr/bin/resalloc-aws-new --aws-profile default --ami {{ copr_builder_images.aws[item] }} - --ssh-key-name copr-builder + --ssh-key-name copr-builder-{{ env }} --security-group-id sg-0c3efdb681ced5d4f --debug {% for subnet in aws_arch_subnets[item] %} diff --git a/roles/copr/backend/templates/provision/copr-rpmbuild/main.ini.j2 b/roles/copr/backend/templates/provision/copr-rpmbuild/main.ini.j2 index edaf37a0ec..b739de8192 100644 --- a/roles/copr/backend/templates/provision/copr-rpmbuild/main.ini.j2 +++ b/roles/copr/backend/templates/provision/copr-rpmbuild/main.ini.j2 @@ -1,10 +1,12 @@ -# rpkg-util v3+ +# TODO: this file is used by both rpkg-util(?) and copr-rpmbuild. Move the +# copr-rpmbuild related stuff into copr-rpmbuild.yml. [main] frontend_url = {{ frontend_base_url }} distgit_lookaside_url = https://${% raw %}{{git_props:remote_netloc}}{% endraw %}/repo/pkgs/%(repo_path)s/%(filename)s/%(hashtype)s/%(hash)s/%(filename)s distgit_clone_url = {scheme}://{netloc}/%(repo_path)s rpm_vendor_copr_name = {{ rpm_vendor_copr_name }} +macro_override_db_url = https://copr-be.cloud.fedoraproject.org/config/distro-arch-specific.json [distgit0] distgit_hostname_pattern = src.fedoraproject.org diff --git a/roles/copr/backend/templates/provision/libvirt-new b/roles/copr/backend/templates/provision/libvirt-new index de99ba803e..036e5f7330 100755 --- a/roles/copr/backend/templates/provision/libvirt-new +++ b/roles/copr/backend/templates/provision/libvirt-new @@ -17,6 +17,7 @@ import shlex import time import argparse import ipaddress +from urllib.parse import urlparse from helpers import get_hv_identification_from_pool_id @@ -65,13 +66,13 @@ class LibvirtSpawner: self.log.debug("Logging to %s", self.connection) self.cleanup_actions = {} - def call(self, cmd, *args, **kwargs): + def call(self, cmd, *args, call=subprocess.call, **kwargs): """ Run CMD, and log info. """ self.log.debug("cmd: %s", ' '.join([shlex.quote(str(x)) for x in cmd])) start = time.time() - status = subprocess.call(cmd, *args, **kwargs) + status = call(cmd, *args, **kwargs) self.log.debug(" -> exit_status=%s, time=%ss", status, round(time.time() - start, 3)) return status @@ -82,6 +83,13 @@ class LibvirtSpawner: """ return self.call(['virsh', '-c', self.connection] + args, stdout=sys.stderr) + def virsh_check_output(self, args): + """ + Call virsh without polluting stdout. + """ + return self.call(['virsh', '-c', self.connection] + args, + call=subprocess.check_output).decode("utf-8") + def wait_for_ssh(self, host): """ Knowing the IP address of recently started VM, wait for the SSH server @@ -200,6 +208,21 @@ class LibvirtSpawner: """ todo_files = copy.copy(self.config_files) + + # Make sure the machine trusts our buildsys.pub key (via cloud-init). + with open("/var/lib/resallocserver/provision/files/buildsys.pub", "r", + encoding='utf-8') as file: + public_key = file.read() + + user_data = f"""\n +#cloud-config +ssh_authorized_keys: + - {public_key} +""" + todo_files.append(ConfigFile('user-data', user_data)) + meta_data = "instance-id: {self.vm_name}\n" + todo_files.append(ConfigFile('meta-data', meta_data)) + startup_script = self.get_startup_script() if startup_script: todo_files.append(startup_script) @@ -216,18 +239,33 @@ class LibvirtSpawner: image = os.path.join(self.workdir, 'config.iso') - # The 'eimg_config' label is not important, we search for /dev/sr0 - # anyway. - if self.call(['mkisofs', '-o', image, '-V', 'eimg_config', '-r', '-J', + # The 'cidata' label is important, otherwise cloud-init can't take the + # image as NoCloud drive. Other files shouldn't be a problem for cloud + # init. + if self.call(['mkisofs', '-o', image, '-V', 'cidata', '-r', '-J', '--quiet', config_dir]) != 0: raise Exception("mkisofs failed") return image - def create_volume_from_iso(self, name, prealloc_size, iso, pool=DEFAULT_POOL): - """ Create libvirt volume from ISO file """ - self.alloc_disk(name, prealloc_size, pool) - if self.virsh_silent(['vol-upload', name, iso, '--pool', pool]): - raise Exception("can not vol-upload the config disk") + def create_volume_from_iso(self, name, iso, pool=DEFAULT_POOL): + """ + Create libvirt volume from ISO file + """ + parsed_url = urlparse(self.connection) + remote_host = parsed_url.netloc + if not remote_host: + raise RuntimeError(f"Could not deduce remote host from connection: {self.connection}") + + # /libvirt-images -> /libvirt-images + pool_path = self.virsh_check_output(["-q", "pool-dumpxml", pool, "--xpath", '//target/path']) + pool_path = pool_path.strip()[6:-7] + target_path = os.path.join(pool_path, name) + + scp_cmd = ['scp', '-p', iso, f"{remote_host}:{target_path}"] + if self.call(scp_cmd): + raise RuntimeError(f"Failed to upload ISO via SCP to {target_path} on {remote_host}") + + self.virsh_silent(["pool-refresh", pool]) def create_volume_from_volume(self, name, volume, pool=DEFAULT_POOL, size=None): """ @@ -341,8 +379,7 @@ class LibvirtSpawner: if config_iso: self.log.info("using config image %s", config_iso) config_vol_name = self.vm_name + "_config" - self.create_volume_from_iso(config_vol_name, '1M', config_iso, - pool=pool) + self.create_volume_from_iso(config_vol_name, config_iso, pool=pool) root_image_volume = VOLUMES[self.arch] vol_root = self.vm_name + '_root' diff --git a/roles/copr/backend/templates/resalloc/osuosl-vm.j2 b/roles/copr/backend/templates/resalloc/osuosl-vm.j2 index 2c433bbf96..200e2e5e96 100755 --- a/roles/copr/backend/templates/resalloc/osuosl-vm.j2 +++ b/roles/copr/backend/templates/resalloc/osuosl-vm.j2 @@ -41,6 +41,6 @@ resalloc-openstack-new \ --flavor "$flavor" \ --name "$RESALLOC_NAME" \ --post-command "set -x ; resalloc-wait-for-ssh --timeout 250 --log debug \"\$RESALLOC_OS_IP\" >&2 && ansible-playbook $playbook -i \"\$RESALLOC_OS_IP,\" >&2 " \ - --key-pair-id copr-builder \ + --key-pair-id copr-builder-{{ env }} \ --nic net-id="$network" \ --print-ip diff --git a/roles/copr/backend/templates/resalloc/pools.yaml.j2 b/roles/copr/backend/templates/resalloc/pools.yaml.j2 index d3550dfd0c..15021320b6 100644 --- a/roles/copr/backend/templates/resalloc/pools.yaml.j2 +++ b/roles/copr/backend/templates/resalloc/pools.yaml.j2 @@ -3,9 +3,14 @@ # Notes for Resalloc configuration file: # {% if False %} -# - This is rather a complex Jinja template. Feel free to use the helper -# script to expand locally before you commit any change to this file: -# ./roles/copr/backend/templates/resalloc/pools.yaml.expand.sh +# +# =================================================================== +# =================================================================== +# This is rather a complex Jinja template. PLEASE use the helper +# script to expand locally before you commit any change to this file: +# ./roles/copr/backend/templates/resalloc/pools.yaml.expand.sh +# =================================================================== +# =================================================================== # {% endif %} # - You do NOT need to restart resalloc server after changing this file, it @@ -25,7 +30,7 @@ # d) remove the pool in PostgreSQL database. {% macro aws(arch, max, max_starting, max_prealloc, spot=False, on_demand=none, priority=0, reserved=False) %} -aws_{{ arch }}_{{ on_demand + '_' if on_demand is not none else '' }}{% if spot %}spot{% else %}normal{% endif %}{% if reserved %}reserved{% endif %}_{% if devel %}dev{% else %}prod{% endif %}: +aws_{{ arch }}_{{ on_demand + '_' if on_demand is not none else '' }}{% if spot %}spot{% elif reserved %}reserved{% else %}normal{% endif %}_{% if devel %}dev{% else %}prod{% endif %}: {% if on_demand and not reserved %} max: 10 max_starting: 4 @@ -56,8 +61,6 @@ aws_{{ arch }}_{{ on_demand + '_' if on_demand is not none else '' }}{% if spot - arch_armhfp_emulated - arch_riscv64 - arch_riscv64_emulated - - arch_s390x - - arch_s390x_emulated {% else %} - arch_aarch64 - arch_aarch64_native @@ -222,8 +225,6 @@ vmhost_x86_{{ hv }}_{% if devel %}dev{% else %}prod{% endif %}: - arch_armhfp_emulated - arch_riscv64 - arch_riscv64_emulated - - arch_s390x - - arch_s390x_emulated - hypervisor - hypervisor_x86_64 - hypervisor_x86_64_{{ hv }} @@ -247,41 +248,6 @@ vmhost_x86_{{ hv }}_{% if devel %}dev{% else %}prod{% endif %}: {% endif %} {% endfor %} -# Power8 hypervisors -{% for hv in ["01", "02", "03"] %} -{% if "ppc64le_hypervisor_" + hv in builders %} - -copr_hv_ppc64le_{{ hv }}_{% if devel %}dev{% else %}prod{% endif %}: - max: {{ builders["ppc64le_hypervisor_" + hv]["ppc64le"][0] }} - max_starting: {{ builders["ppc64le_hypervisor_" + hv]["ppc64le"][1] }} - max_prealloc: {{ builders["ppc64le_hypervisor_" + hv]["ppc64le"][2] }} - tags: - - copr_builder - - name: arch_noarch - priority: -8 - - arch_ppc64le - - arch_ppc64le_native - - hypervisor - - hypervisor_ppc64le - - hypervisor_ppc64le_{{ hv }} - - arch_power8 - cmd_new: "copr-resalloc-vm-ip-to-yaml /var/lib/resallocserver/provision/libvirt-new --swap-vol-size 168" - cmd_delete: "/var/lib/resallocserver/resalloc_provision/vm-delete" - cmd_livecheck: "resalloc-check-vm-ip" - cmd_release: "/var/lib/resallocserver/resalloc_provision/vm-release" - cmd_list: "/var/lib/resallocserver/provision/libvirt-list" - livecheck_period: 180 - reuse_opportunity_time: 90 - reuse_max_count: 8 - reuse_max_time: 1800 - description: > - A pool of ppc64le instances in the Fedora Community Cage. - These machines have POWER8 processors and are located in RDU (N Carolina). - Thank you Fedora Infrastructure team for maintaining the hypervisors. - -{% endif %} -{% endfor %} - # Power9 hypervisors {% for hv in ["01", "02", "03", "04"] %} {% if "p09_hypervisor_" + hv in builders %} @@ -414,7 +380,7 @@ copr_ic_s390x_hp_us_east_{% if devel %}dev{% else %}prod{% endif %}: description: > A pool of high-performance s390x instances in the IBM Cloud, Washington, D.C. (us-east). Thanks to IBM for sponsoring these builders. - +#} {% for zone in ['br_sao_1', 'br_sao_2', 'br_sao_3', 'eu_es_1', 'eu_es_2', 'eu_es_3'] %} copr_ic_s390x_{{ zone }}_{% if devel %}dev{% else %}prod{% endif %}: @@ -469,7 +435,6 @@ copr_ic_s390x_{{ zone }}_{% if devel %}dev{% else %}prod{% endif %}: Thanks to IBM for sponsoring these builders. {% endfor %} -#} # Power9 builders in OSU osuosl {{ osuosl_p09_p10() }} diff --git a/roles/copr/backend/templates/resalloc/vm-delete.j2 b/roles/copr/backend/templates/resalloc/vm-delete.j2 index 81cc7be442..673e02b94b 100755 --- a/roles/copr/backend/templates/resalloc/vm-delete.j2 +++ b/roles/copr/backend/templates/resalloc/vm-delete.j2 @@ -41,11 +41,6 @@ copr_osuosl_*) *s390x*) exit 0 ;; - -*copr_hv_x86_64_*) - ;; -*copr_hv_ppc64le_*) - ;; vmhost*) # hypervisors ;; diff --git a/roles/copr/dist_git/files/dist-git.conf b/roles/copr/dist_git/files/dist-git.conf index 3e1f871ebc..30c59e82ad 100644 --- a/roles/copr/dist_git/files/dist-git.conf +++ b/roles/copr/dist_git/files/dist-git.conf @@ -12,3 +12,6 @@ gitolite = False # name of the default branch (a.k.a. master or main) default_branch = master +{% if env == 'production' %} +sentry_dsn={{ copr_sentry_dsn }} +{% endif %} diff --git a/roles/copr/frontend/files/chroots.conf b/roles/copr/frontend/files/chroots.conf index 0d29d04919..a8364041d4 100644 --- a/roles/copr/frontend/files/chroots.conf +++ b/roles/copr/frontend/files/chroots.conf @@ -22,5 +22,5 @@ config["rules"] = [{ }, { "match_type": "arch", "match": ["s390x"], - "comment": "An emulated chroot. Builds are done on x86_64 using QEMU.", + "comment": "", }] diff --git a/roles/copr/frontend/templates/copr.conf b/roles/copr/frontend/templates/copr.conf index 840257a23a..bbe58b5e5a 100644 --- a/roles/copr/frontend/templates/copr.conf +++ b/roles/copr/frontend/templates/copr.conf @@ -288,6 +288,10 @@ EXTRA_BUILDCHROOT_TAGS = [{ # https://github.com/fedora-copr/copr/issues/4256 "pattern": "^@python/python3\.\d+/.*/root$", "tags": ["on_demand_powerful"], +},{ + # packages that always takes time to build + "pattern": ".*/.*/.*/(firefox|thunderbird)$", + "tags": ["on_demand_powerful"], }] {% endif %} @@ -321,3 +325,8 @@ OIDC_METADATA = "https://id.fedoraproject.org/openidc/.well-known/openid-configu OIDC_SECRET = "{{ copr_oidc_stg_client_secret }}" OIDC_METADATA = "https://id.stg.fedoraproject.org/openidc/.well-known/openid-configuration" {% endif %} + + +{% if env == 'production' %} +SENTRY_DSN="{{ copr_sentry_dsn }}" +{% endif %} diff --git a/roles/copr/hypervisor/files/buildsys.production.pub b/roles/copr/hypervisor/files/buildsys.production.pub new file mode 120000 index 0000000000..9aecd5a027 --- /dev/null +++ b/roles/copr/hypervisor/files/buildsys.production.pub @@ -0,0 +1 @@ +../../backend/files/buildsys.production.pub \ No newline at end of file diff --git a/roles/copr/hypervisor/files/buildsys.pub b/roles/copr/hypervisor/files/buildsys.pub deleted file mode 120000 index 3afbe620a2..0000000000 --- a/roles/copr/hypervisor/files/buildsys.pub +++ /dev/null @@ -1 +0,0 @@ -../../../copr/backend/files/provision/files/buildsys.pub \ No newline at end of file diff --git a/roles/copr/hypervisor/files/buildsys.staging.pub b/roles/copr/hypervisor/files/buildsys.staging.pub new file mode 120000 index 0000000000..420d50c2f9 --- /dev/null +++ b/roles/copr/hypervisor/files/buildsys.staging.pub @@ -0,0 +1 @@ +../../backend/files/buildsys.staging.pub \ No newline at end of file diff --git a/roles/copr/hypervisor/tasks/main.yml b/roles/copr/hypervisor/tasks/main.yml index 19dd6002e5..8939c00fab 100644 --- a/roles/copr/hypervisor/tasks/main.yml +++ b/roles/copr/hypervisor/tasks/main.yml @@ -139,10 +139,13 @@ - name: Create the copr user user: name=copr uid=11666 group=libvirt groups=qemu password_lock=true -- name: Assure that copr-be can ssh there as copr@... - authorized_key: user=copr key="{{ item }}" +- name: Assure that copr user on copr-backend can ssh as copr@... + authorized_key: + user: copr + key: "{{ item }}" with_file: - - buildsys.pub + - buildsys.production.pub + - buildsys.staging.pub - name: Add @copr keys for sysadmin-main and other allowed users authorized_key: user=copr key="{{ item }}" @@ -153,18 +156,6 @@ - config - sshkeys -# todo: generate it's own key -- name: Make sure hostA can ssh to hostB - ansible.builtin.copy: - src: "{{ private }}/files/copr/buildsys.priv" - dest: /home/copr/.ssh/id_rsa - owner: copr - mode: "0600" - -- name: Provide pub key, too, so we can install them to generated builder images - ansible.builtin.copy: src=buildsys.pub dest=/home/copr/.ssh/id_rsa.pub - owner=copr mode=0600 - - name: Enable praiskup-helpers repo ansible.builtin.shell: | dnf copr enable -y praiskup/helpers diff --git a/roles/dhcp_server/files/dhcpd.conf.noc01.rdu3.fedoraproject.org b/roles/dhcp_server/files/dhcpd.conf.noc01.rdu3.fedoraproject.org index c2f7fb6da7..b5aa60b191 100644 --- a/roles/dhcp_server/files/dhcpd.conf.noc01.rdu3.fedoraproject.org +++ b/roles/dhcp_server/files/dhcpd.conf.noc01.rdu3.fedoraproject.org @@ -1137,12 +1137,11 @@ host ocp03 { option routers 10.16.163.254; option subnet-mask 255.255.255.0; } -# These are for aarch64 boxes to initially provision on their 1g interfaces -host bvmhost-a64-01-provision { - hardware ethernet d8:5e:d3:e6:20:b0; - fixed-address 10.16.163.150; +host bvmhost-a64-01-stg { + hardware ethernet b8:ce:f6:51:56:c5; + fixed-address 10.16.167.16; next-server 10.16.163.10; - option routers 10.16.163.254; + option routers 10.16.167.254; option subnet-mask 255.255.255.0; } host bvmhost-a64-02-provision { @@ -1704,3 +1703,12 @@ host buildhw-p10-fcos01.rdu3.fedoraproject.org { option subnet-mask 255.255.255.0; option host-name "buildhw-p10-fcos01.rdu3.fedoraproject.org"; } + +host buildhw-p10-fcos02.rdu3.fedoraproject.org { + hardware ethernet be:86:ed:ba:1a:00; + fixed-address 10.16.171.36; + next-server 10.16.163.10; + option routers 10.16.171.254; + option subnet-mask 255.255.255.0; + option host-name "buildhw-p10-fcos02.rdu3.fedoraproject.org"; +} diff --git a/roles/fasjson/files/aliases.static b/roles/fasjson/files/aliases.static index 7a3cf24a25..9affb4595f 100644 --- a/roles/fasjson/files/aliases.static +++ b/roles/fasjson/files/aliases.static @@ -150,7 +150,7 @@ legal-cla-archive: /dev/null vendors: distribution-members # Fedora Council -legal: fpl, bsutula@redhat.com, rfontana@redhat.com +legal: fpl,bsutula@redhat.com,rfontana@redhat.com board: council-private@lists.fedoraproject.org chair: fpl chairman: fpl @@ -180,9 +180,9 @@ diversity-inclusion: dei # Code of Conduct (CoC) Committee ## https://docs.fedoraproject.org/en-US/project/coc-committee/ -codeofconduct: fpl, fca, jonatoni, dcantrell, ankursinha, chris +codeofconduct: fpl,fca,jonatoni,dcantrell,ankursinha,chris ## a special CoC sub-committee for on-site response at Flock to Fedora contributor conference -flock-coc: codeofconduct, dvolavko, npazmino@redhat.com, shaunm@redhat.com, spotz +flock-coc: codeofconduct,dvolavko,npazmino@redhat.com,shaunm@redhat.com,spotz # Fedora Matrix admin matrixadmin: fpl,fca,kevin,nb @@ -212,13 +212,13 @@ fudcon-latam: flock-staff # flock #flockpress: fca,fpl #flockinfo: fca,fpl -flock-staff: flock-team-members@fedoraproject.org, jwheel@redhat.com +flock-staff: flock-team-members@fedoraproject.org,jwheel@redhat.com #flock-admin: flock-staff #flock-access: flock-admin # # flock/sponsor alias # https://forge.fedoraproject.org/infra/tickets/issues/10591 -sponsors: flock-team-sponsors@fedoraproject.org, jwheel@redhat.com +sponsors: flock-team-sponsors@fedoraproject.org,jwheel@redhat.com # swag customer email alias https://forge.fedoraproject.org/infra/tickets/issues/10794 swag-info: fca,shaunm,designteam-sponsors@fedoraproject.org diff --git a/roles/haproxy/templates/haproxy.cfg b/roles/haproxy/templates/haproxy.cfg index 19881b670d..5e565f2e00 100644 --- a/roles/haproxy/templates/haproxy.cfg +++ b/roles/haproxy/templates/haproxy.cfg @@ -159,39 +159,11 @@ backend oci-registry-backend frontend ipsilon-frontend bind 0.0.0.0:10020 - - option http-buffer-request - # Define ipsilon OpenID only instance - acl path_openidc path_beg /openidc - acl path_openid path_beg /openid - acl is_openid_cookie req.cook(OPENID) true -{% if env == 'staging' %} - acl host_is_id_sub hdr(host) -m reg -i ^.+\.id\.stg\.fedoraproject\.org$ -{% else %} - acl host_is_id_sub hdr(host) -m reg -i ^.+\.id\.fedoraproject\.org$ -{% endif %} - - use_backend ipsilon-backend if path_openidc - use_backend ipsilon-backend-openid if path_openid - use_backend ipsilon-backend-openid if is_openid_cookie - use_backend ipsilon-backend-openid if host_is_id_sub - default_backend ipsilon-backend -backend ipsilon-backend-openid - balance hdr(appserver) - cookie OPENID insert indirect nocache attr Max-Age=300 -{% if env == "staging" %} - server ipsilon01 ipsilon01:80 cookie true check inter 10s rise 1 fall 3 -{% else %} - server ipsilon03 ipsilon03:80 cookie true check inter 10s rise 1 fall 3 -{% endif %} - option httpchk GET / - backend ipsilon-backend balance hdr(appserver) server ipsilon01 ipsilon01:80 check inter 10s rise 1 fall 3 - http-response set-header x-xrds-location "https://id{{ env_suffix }}.fedoraproject.org/openid/XRDS" {% if env == "production" %} server ipsilon02 ipsilon02:80 check inter 10s rise 1 fall 3 {% endif %} diff --git a/roles/httpd/proxy/templates/httpd.conf.j2 b/roles/httpd/proxy/templates/httpd.conf.j2 index f0c2cdf7f8..188fdb286c 100644 --- a/roles/httpd/proxy/templates/httpd.conf.j2 +++ b/roles/httpd/proxy/templates/httpd.conf.j2 @@ -87,7 +87,7 @@ KeepAlive On # during a persistent connection. Set to 0 to allow an unlimited amount. # We recommend you leave this number high, for maximum performance. # -MaxKeepAliveRequests 500 +MaxKeepAliveRequests 0 # # KeepAliveTimeout: Number of seconds to wait for the next request from the diff --git a/roles/httpd/website/templates/robots/riscv-koji.fedoraproject.org-robots.txt b/roles/httpd/website/templates/robots/riscv-koji.fedoraproject.org-robots.txt new file mode 100644 index 0000000000..1f53798bb4 --- /dev/null +++ b/roles/httpd/website/templates/robots/riscv-koji.fedoraproject.org-robots.txt @@ -0,0 +1,2 @@ +User-agent: * +Disallow: / diff --git a/roles/ipa/server/tasks/main.yml b/roles/ipa/server/tasks/main.yml index cc44604d06..497199e185 100644 --- a/roles/ipa/server/tasks/main.yml +++ b/roles/ipa/server/tasks/main.yml @@ -24,6 +24,7 @@ - ipa-server - ipa-server-dns - ipa-fas + - ipa-healthcheck tags: - ipa/server - packages @@ -794,38 +795,9 @@ - ipa/server - config -# Zabbix monitoring of the internal IPA server -- name: Install Zabbix agent config drop-in - ansible.builtin.copy: - src: zabbix/agent-ipa-backup.conf - dest: /etc/zabbix/zabbix_agentd.d/ipa-backup.conf - mode: '0644' - notify: - - Restart zabbix agent +- name: Configure IPA monitoring in Zabbix + ansible.builtin.include_tasks: monitoring.yml tags: - ipa/server - zabbix_agent - -- name: Zabbix API Block - vars: - ansible_zabbix_auth_key: "{{ zabbix_auth_key }}" - ansible_network_os: "{{ zabbix_network_os }}" - ansible_connection: "{{ zabbix_connection }}" - ansible_httpapi_port: "{{ zabbix_httpapi_port }}" - ansible_httpapi_use_ssl: "{{ zabbix_httpapi_use_ssl }}" - ansible_httpapi_validate_certs: "{{ zabbix_httpapi_validate_certs }}" - ansible_host: "{{ zabbix_server }}" - ansible_zabbix_url_path: "{{ zabbix_url_path }}" - tags: - - ipa/server - zabbix_api - block: - - name: Import IPA template file - community.zabbix.zabbix_template: - template_yaml: "{{ lookup('file', 'zabbix/template-ipa.yml') }}" - state: present - - name: Add self to IPA template in Zabbix - community.zabbix.zabbix_host: - host_name: "{{ inventory_hostname }}" - link_templates: IPA Monitoring - force: false diff --git a/roles/ipa/server/tasks/monitoring.yml b/roles/ipa/server/tasks/monitoring.yml new file mode 100644 index 0000000000..38b81f4991 --- /dev/null +++ b/roles/ipa/server/tasks/monitoring.yml @@ -0,0 +1,59 @@ +# Zabbix monitoring of the internal IPA server + +# ipa-healthcheck can only be run by root, so cron the +# output to where Zabbix can find it +- name: Set cron for ipa-healthcheck + ansible.builtin.cron: + name: "Dump IPA healthcheck as root for Zabbix" + minute: "*/5" + user: root + job: "/usr/bin/ipa-healthcheck --output-type prometheus --all > /etc/zabbix/ipa-healthcheck.log 2> /dev/null" + tags: + - ipa/server + - zabbix_agent + +- name: Install Zabbix agent config drop-in + ansible.builtin.copy: + src: zabbix/agent-ipa-backup.conf + dest: /etc/zabbix/zabbix_agentd.d/ipa-backup.conf + mode: '0644' + notify: + - Restart zabbix agent + tags: + - ipa/server + - zabbix_agent + +- name: Zabbix API Block + vars: + ansible_zabbix_auth_key: "{{ zabbix_auth_key }}" + ansible_network_os: "{{ zabbix_network_os }}" + ansible_connection: "{{ zabbix_connection }}" + ansible_httpapi_port: "{{ zabbix_httpapi_port }}" + ansible_httpapi_use_ssl: "{{ zabbix_httpapi_use_ssl }}" + ansible_httpapi_validate_certs: "{{ zabbix_httpapi_validate_certs }}" + ansible_host: "{{ zabbix_server }}" + ansible_zabbix_url_path: "{{ zabbix_url_path }}" + tags: + - ipa/server + - zabbix_api + block: + - name: Import IPA template file + community.zabbix.zabbix_template: + template_yaml: "{{ lookup('file', 'zabbix/template-ipa.yml') }}" + state: present + run_once: true + + - name: Ensure IPA Zabbix hostgroup is present + community.zabbix.zabbix_group: + host_groups: + - IPA Servers + state: present + run_once: true + + - name: Add self to IPA template in Zabbix + community.zabbix.zabbix_host: + host_name: "{{ inventory_hostname }}" + host_groups: IPA Servers + link_templates: IPA Monitoring + force: false + diff --git a/roles/ipsilon/defaults/main.yml b/roles/ipsilon/defaults/main.yml index 6175e2bb9a..b29592e93e 100644 --- a/roles/ipsilon/defaults/main.yml +++ b/roles/ipsilon/defaults/main.yml @@ -1,3 +1,4 @@ --- ipsilon_patches: - 409 + - integrityerror diff --git a/roles/ipsilon/files/openid_banner.patch b/roles/ipsilon/files/openid_banner.patch deleted file mode 100644 index 0fe9df268b..0000000000 --- a/roles/ipsilon/files/openid_banner.patch +++ /dev/null @@ -1,15 +0,0 @@ ---- layout.html 2025-10-03 10:54:25.879128022 +0000 -+++ layout.html 2025-10-03 10:56:46.554758341 +0000 -@@ -21,6 +21,12 @@ - {%- endif %} - - -+
-+

-+ You are using OpenID to authenticate. This authentication method will go away on 1st May 2026. Please consider migrating to OpenID Connect. -+ For more info look at https://forge.fedoraproject.org/infra/tickets/issues/10241 -+

-+
-
-
- logo diff --git a/roles/ipsilon/tasks/main.yml b/roles/ipsilon/tasks/main.yml index ff21492adb..61b551a502 100644 --- a/roles/ipsilon/tasks/main.yml +++ b/roles/ipsilon/tasks/main.yml @@ -7,7 +7,6 @@ update_cache: yes name: - ipsilon - - ipsilon-openid - ipsilon-saml2 - ipsilon-openidc - ipsilon-authgssapi @@ -51,15 +50,6 @@ tags: - ipsilon -- name: Apply patch for OpenID banner - ansible.posix.patch: - src: openid_banner.patch - dest: /usr/share/ipsilon/themes/Fedora/templates/layout.html - when: openid is defined and openid - tags: - - ipsilon - - patch - - name: Apply patch for forge.fp.o links ansible.posix.patch: src: forge_fp_o.patch @@ -87,7 +77,6 @@ --admin-user=admin --ipa=yes --openidc=yes - --openid=yes --saml2=yes --info-sssd=yes --form=yes diff --git a/roles/ipsilon/tasks/patches.yml b/roles/ipsilon/tasks/patches.yml index 561b974aba..497c57d082 100644 --- a/roles/ipsilon/tasks/patches.yml +++ b/roles/ipsilon/tasks/patches.yml @@ -13,7 +13,7 @@ - name: Download patches ansible.builtin.copy: - src: /srv/web/infra/bigfiles/hotfixes/ipsilon/{{ item }} + src: /srv/web/infra/bigfiles/hotfixes/ipsilon/{{ item }}.patch dest: /opt/ipsilon-patches/{{ item }}.patch owner: root group: root diff --git a/roles/ipsilon/templates/configuration.conf b/roles/ipsilon/templates/configuration.conf index 97bb7bc3c9..90fba51a69 100644 --- a/roles/ipsilon/templates/configuration.conf +++ b/roles/ipsilon/templates/configuration.conf @@ -11,27 +11,6 @@ fas aws groups=[["aws-master", "arn:aws:iam::125523088429:role/aws-master"], ["a global enabled=allow [provider_config] -{% if openid is defined and openid %} -global enabled=openid - -openid endpoint url=https://id{{env_suffix}}.fedoraproject.org/openid/ -openid identity url template=http://%(username)s.id{{env_suffix}}.fedoraproject.org/ -{% if env == 'staging' %} -openid trusted roots= -{% else %} -openid trusted roots=https://ask.fedoraproject.org/,https://fedorahosted.org/,https://badges.fedoraproject.org,https://apps.fedoraproject.org/datagrepper/,https://apps.fedoraproject.org/calendar/,http://notifications.fedoraproject.org/,http://copr.fedoraproject.org/,https://copr.fedoraproject.org/,https://admin.fedoraproject.org/voting/,https://admin.fedoraproject.org,https://apps.fedoraproject.org/,https://release-monitoring.org/,http://pagure.io/,http://admin.fedoraproject.org/mirrormanager/,https://koschei.fedoraproject.org/,https://bodhi.fedoraproject.org,https://lists.fedoraproject.org/,https://openqa.fedoraproject.org/,https://src.fedoraproject.org/ -{% endif %} -{% if env == 'staging' %} -openid database url=postgresql://{{ ipsilon_db_user }}:{{ ipsilon_stg_db_pass }}@{{ ipsilon_db_host }}/{{ ipsilon_db_openid_name }} -{% else %} -openid database url=postgresql://{{ ipsilon_db_user }}:{{ ipsilon_db_pass }}@{{ ipsilon_db_host }}/{{ ipsilon_db_openid_name }} -{% endif %} -openid untrusted roots= -openid enabled extensions=Fedora Teams,Attribute Exchange,CLAs,Simple Registration,API -openid default attribute mapping=[["*", "*"], ["_groups", "groups"], [["_extras", "cla"], "cla"], ["fullname", "name"], ["_username", "nickname"], ["_username", "preferred_username"], ["fasIRCNick", "ircnick"], ["fasLocale", "locale"], ["fasTimeZone", "zoneinfo"], ["fasTimeZone", "timezone"], ["fasWebsiteURL", "website"], ["fasGPGKeyId", "gpg_keyid"], ["ipaSshPubKey", "ssh_key"], ["fasIsPrivate", "privacy"], ["fullname", "human_name"]] - -# End of OpenID configuration -{% else %} global enabled=saml2,openidc openidc enabled extensions=fedora-account,waiverdb,wiki,src,kerneltest @@ -80,5 +59,3 @@ saml2 session database url=postgresql://{{ ipsilon_db_user }}:{{ ipsilon_db_pass {% else %} {% include "saml2_data" %} {% endif %} - -{% endif %} diff --git a/roles/ipsilon/templates/httpd.conf.j2 b/roles/ipsilon/templates/httpd.conf.j2 index 557dd5b1f4..0764c10eec 100644 --- a/roles/ipsilon/templates/httpd.conf.j2 +++ b/roles/ipsilon/templates/httpd.conf.j2 @@ -6,19 +6,6 @@ Alias /.well-known /var/lib/ipsilon/root/public/well-known Alias /cache /var/cache/ipsilon Redirect /.well-known/webfinger /webfinger -# This is for mapping $username.id.fp.o -> id.fp.o/id/$username -RewriteEngine on -RewriteMap lowercase int:tolower -{% if env == "staging" %} -RewriteCond ${lowercase:%{SERVER_NAME}} ^[a-z0-9_\.-]+\.id\.stg\.fedoraproject\.org$ -RewriteRule ^(.+) /${lowercase:%{SERVER_NAME}}$1 [C] -{% else %} -RewriteCond ${lowercase:%{SERVER_NAME}} ^[a-z0-9_\.-]+\.id\.fedoraproject\.org$ -RewriteRule ^(.+) /${lowercase:%{SERVER_NAME}}$1 [C] -RewriteRule ^/([a-z0-9_\.-]+)\.id\.fedoraproject\.org/.* /openid/id/$1/ [PT] -{% endif %} - - WSGIScriptAlias / /usr/libexec/ipsilon/ipsilon WSGIDaemonProcess ipsilon user=ipsilon group=ipsilon home=/var/lib/ipsilon/root display-name=ipsilon processes=6 threads=2 maximum-requests=1000 WSGISocketPrefix run/wsgi diff --git a/roles/kickstarts/tasks/main.yml b/roles/kickstarts/tasks/main.yml index 1d799748ed..a3e40acefd 100644 --- a/roles/kickstarts/tasks/main.yml +++ b/roles/kickstarts/tasks/main.yml @@ -10,6 +10,8 @@ - kvm-rhel-8 - hardware-rhel-9-08disk - hardware-rhel-9-06disk + - hardware-rhel-9-06disk-aarch64 + - hardware-rhel-10-06disk-aarch64 - hardware-rhel-10-08disk - hardware-rhel-10-nodisk - hardware-fedora-01disk-nvme @@ -18,7 +20,6 @@ - hardware-fedora-06disk-nvme - hardware-fedora-ppc64le-02disk - hardware-fedora-ppc64le-08disk - - hardware-rhel-9-06disk-aarch64 - openqa-fedora-08disk tags: - config diff --git a/roles/kickstarts/templates/hardware-rhel-10-06disk-aarch64.j2 b/roles/kickstarts/templates/hardware-rhel-10-06disk-aarch64.j2 new file mode 100644 index 0000000000..eee3d4c7c5 --- /dev/null +++ b/roles/kickstarts/templates/hardware-rhel-10-06disk-aarch64.j2 @@ -0,0 +1,102 @@ +# Use network installation +vnc --password "{{ kickstart_vnc_password }}" +# Use network install +url --url=http://infrastructure.fedoraproject.org/repo/rhel/RHEL10-aarch64/ +repo --name=epel --baseurl=http://infrastructure.fedoraproject.org/pub/epel/10/Everything/aarch64/ +repo --name="net-baseos" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/aarch64/baseos/ +repo --name="net-appstream" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/aarch64/appstream/ +repo --name="net-crb" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/aarch64/crb/ + +# Firewall configuration +firewall --disabled +firstboot --disable +ignoredisk --only-use=nvme0n1,nvme1n1,nvme2n1,nvme3n1,nvme4n1,nvme5n1 +# Keyboard layouts +# old format: keyboard us +# new format: +keyboard --vckeymap=us --xlayouts='' +# System language +lang en_US.UTF-8 + +# Network information +# Reboot after installation +reboot +# Root password +rootpw --iscrypted "{{ kickstart_initial_password_encrypted }}" +# SELinux configuration +selinux --enforcing +# System services +services --disabled="firewalld,kdump" --enabled="postfix,rsyslog,chronyd" +# Do not configure the X Window System +skipx +# System timezone +timezone UTC --utc +# System bootloader configuration +bootloader --location=mbr --boot-drive=nvme0n1 --append="net.ifnames=0" --driveorder=nvme0n1,nvme1n1,nvme2n1,nvme3n1,nvme4n1,nvme5n1 +zerombr +clearpart --drives=nvme0n1,nvme1n1,nvme2n1,nvme3n1,nvme4n1,nvme5n1 --all --initlabel + +# Disk partitioning information +part raid.200 --fstype="mdmember" --ondisk=nvme0n1 --size=1000 +part raid.210 --fstype="mdmember" --ondisk=nvme1n1 --size=1000 +part raid.220 --fstype="mdmember" --ondisk=nvme2n1 --size=1000 +part raid.230 --fstype="mdmember" --ondisk=nvme3n1 --size=1000 +part raid.240 --fstype="mdmember" --ondisk=nvme4n1 --size=1000 +part raid.250 --fstype="mdmember" --ondisk=nvme5n1 --size=1000 +part raid.300 --fstype="mdmember" --ondisk=nvme0n1 --size=477 +part raid.310 --fstype="mdmember" --ondisk=nvme1n1 --size=477 +part raid.320 --fstype="mdmember" --ondisk=nvme2n1 --size=477 +part raid.330 --fstype="mdmember" --ondisk=nvme3n1 --size=477 +part raid.340 --fstype="mdmember" --ondisk=nvme4n1 --size=477 +part raid.350 --fstype="mdmember" --ondisk=nvme5n1 --size=477 +part raid.400 --fstype="mdmember" --ondisk=nvme0n1 --size=65536 --grow +part raid.410 --fstype="mdmember" --ondisk=nvme1n1 --size=65536 --grow +part raid.420 --fstype="mdmember" --ondisk=nvme2n1 --size=65536 --grow +part raid.430 --fstype="mdmember" --ondisk=nvme3n1 --size=65536 --grow +part raid.440 --fstype="mdmember" --ondisk=nvme4n1 --size=65536 --grow +part raid.450 --fstype="mdmember" --ondisk=nvme5n1 --size=65536 --grow + +raid /boot --device=0 --fstype="ext4" --level=RAID1 raid.200 raid.210 raid.220 raid.230 raid.240 raid.250 +raid /boot/efi --device=1 --fstype="efi" --level=RAID1 --fsoptions="umask=0077,shortname=winnt" raid.300 raid.310 raid.320 raid.330 raid.340 raid.350 +raid pv.610 --device=2 --fstype="lvmpv" --level=RAID6 --encrypted --passphrase="{{ luks_initial_password }}" --chunksize=512 raid.400 raid.410 raid.420 raid.430 raid.440 raid.450 + +volgroup vg_guests --pesize=4096 pv.610 + +logvol / --fstype="xfs" --size=32768 --name=LogVol00 --vgname=vg_guests +logvol swap --fstype="swap" --size=8192 --name=LogVol01 --vgname=vg_guests + +%packages +-geolite2-city +-iwl*firmware +-subscription-manager +bash-completion +bind-utils +clevis* +cronie-noanacron +crontabs +grubby +iptables-services +nfs-utils +nmap-ncat +openssh-clients +openssh-server +patch +postfix +rsync +screen +strace +s-nail +tmpwatch +tmux +traceroute +vim-enhanced +zsh +-insights-client +-rhc +%end + +%post --nochroot --log=/mnt/sysimage/root/post.output --erroronfail +mkdir /mnt/sysimage/root/tmp +chroot /mnt/sysimage /usr/bin/curl https://infrastructure.fedoraproject.org/rhel/ks/post/rhel10-post.sh -o /root/tmp/rhel10-post.sh +chroot /mnt/sysimage sh /root/tmp/rhel10-post.sh +%end diff --git a/roles/koji_hub/templates/hub.conf.j2 b/roles/koji_hub/templates/hub.conf.j2 index b33d831ad3..af8ea40c5a 100644 --- a/roles/koji_hub/templates/hub.conf.j2 +++ b/roles/koji_hub/templates/hub.conf.j2 @@ -163,6 +163,7 @@ channel = method flatpakBuild :: use flatpak user bpeck/jenkins-continuous-infra.apps.ci.centos.org :: use ci user zuul :: use ci + user packit && bool scratch :: use ci {% if koji_instance == "secondary" %} # Some special policy for riscv koji to send generic tasks to x86 builders. # method build :: use generic diff --git a/roles/koji_hub/templates/kojihub.conf.j2 b/roles/koji_hub/templates/kojihub.conf.j2 index a3a69b5455..7a28811667 100644 --- a/roles/koji_hub/templates/kojihub.conf.j2 +++ b/roles/koji_hub/templates/kojihub.conf.j2 @@ -3,6 +3,7 @@ # KeepAlive On +MaxKeepAliveRequests 0 Alias /kojihub /usr/share/koji-hub/kojiapp.py diff --git a/roles/koji_hub/templates/kojiweb.conf.j2 b/roles/koji_hub/templates/kojiweb.conf.j2 index 2c881ad5fe..1686fe0027 100644 --- a/roles/koji_hub/templates/kojiweb.conf.j2 +++ b/roles/koji_hub/templates/kojiweb.conf.j2 @@ -2,7 +2,7 @@ RewriteEngine On RewriteRule ^/$ /koji/ [R,L] KeepAlive On KeepAliveTimeout 16 -MaxKeepAliveRequests 500 +MaxKeepAliveRequests 0 ServerLimit 2000 MaxRequestWorkers 2000 diff --git a/roles/openshift-apps/badges/files/service.yml b/roles/openshift-apps/badges/files/service.yml index 617ceba8c4..b7bc3aec6a 100644 --- a/roles/openshift-apps/badges/files/service.yml +++ b/roles/openshift-apps/badges/files/service.yml @@ -13,7 +13,7 @@ spec: port: 8080 targetPort: 8080 selector: - deploymentconfig: frontend + deployment: frontend --- apiVersion: v1 kind: Service @@ -29,4 +29,4 @@ spec: targetPort: 6379 selector: app: badges - deploymentconfig: redis + deployment: redis diff --git a/roles/openshift-apps/badges/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/badges/templates/deployment.yml.j2 similarity index 78% rename from roles/openshift-apps/badges/templates/deploymentconfig.yml.j2 rename to roles/openshift-apps/badges/templates/deployment.yml.j2 index 10a2cf765b..ad22b68600 100644 --- a/roles/openshift-apps/badges/templates/deploymentconfig.yml.j2 +++ b/roles/openshift-apps/badges/templates/deployment.yml.j2 @@ -1,35 +1,34 @@ --- # Frontend component (Python/Pyramid served by gunicorn) -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: name: frontend labels: app: badges + deployment: frontend + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"tahrir:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"frontend\")].image"}]' spec: replicas: 1 selector: - app: badges - deploymentconfig: frontend + matchLabels: + app: badges + deployment: frontend strategy: - type: Rolling - activeDeadlineSeconds: 21600 - rollingParams: - intervalSeconds: 1 + type: RollingUpdate + rollingUpdate: maxSurge: 25% maxUnavailable: 25% - timeoutSeconds: 600 - updatePeriodSeconds: 1 template: metadata: - creationTimestamp: null labels: app: badges - deploymentconfig: frontend + deployment: frontend spec: containers: - name: frontend - image: tahrir:latest + image: image-registry.openshift-image-registry.svc:5000/badges/tahrir:latest imagePullPolicy: Always ports: - containerPort: 8080 @@ -58,7 +57,6 @@ spec: - name: tahrir-fedora-messaging-crt-volume mountPath: /etc/pki/fedora-messaging/crt readOnly: true - env: - name: FLASK_CONFIG value: "/etc/badges/tahrir.cfg" @@ -72,7 +70,6 @@ spec: value: /etc/keytabs/fedbadges.keytab - name: FEDORA_MESSAGING_CONF value: /etc/badges/fm-tahrir.toml - readinessProbe: timeoutSeconds: 10 initialDelaySeconds: 5 @@ -87,7 +84,6 @@ spec: httpGet: path: "/healthz/live" port: 8080 - volumes: - name: etc-badges configMap: @@ -113,49 +109,42 @@ spec: - name: tahrir-fedora-messaging-crt-volume secret: secretName: tahrir-fedora-messaging-crt - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - frontend - from: - kind: ImageStreamTag - name: tahrir:latest --- # Consumer component (Fedora Messaging consume command) -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: name: consumer labels: app: badges + deployment: consumer spec: - # There can be as many as necessary replicas: {{ (env == 'production')|ternary(2, 1) }} selector: - app: badges - deploymentconfig: consumer + matchLabels: + app: badges + deployment: consumer strategy: type: Recreate - recreateParams: - mid: - execNewPod: - command: [/opt/app-root/bin/tahrir-sync-db, /etc/badges/tahrir.cfg] - containerName: consumer - volumes: - - etc-badges - failurePolicy: Abort template: metadata: - creationTimestamp: null labels: app: badges - deploymentconfig: consumer + deployment: consumer + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fedbadges:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"consumer\")].image"}]' spec: + initContainers: + - name: db-sync + image: image-registry.openshift-image-registry.svc:5000/badges/fedbadges:latest + command: ["/opt/app-root/bin/tahrir-sync-db", "/etc/badges/tahrir.cfg"] + volumeMounts: + - name: etc-badges + mountPath: "/etc/badges" + readOnly: true containers: - name: consumer + image: image-registry.openshift-image-registry.svc:5000/badges/fedbadges:latest imagePullPolicy: Always volumeMounts: - name: etc-badges @@ -206,39 +195,35 @@ spec: - name: fedora-messaging-crt-volume secret: secretName: fedora-messaging-crt - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - consumer - from: - kind: ImageStreamTag - name: fedbadges:latest --- # Redis, for caching -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: name: redis labels: app: badges service: redis + deployment: redis spec: replicas: 1 selector: - app: badges - deploymentconfig: redis + matchLabels: + app: badges + deployment: redis + strategy: {} template: metadata: labels: app: badges - deploymentconfig: redis + service: redis + deployment: redis + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"redis:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"redis\")].image"}]' spec: containers: - name: redis - image: redis:latest + image: image-registry.openshift-image-registry.svc:5000/badges/redis:latest volumeMounts: - name: data mountPath: "/bitnami/redis/data" @@ -267,13 +252,3 @@ spec: - name: data persistentVolumeClaim: claimName: redis - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - redis - from: - kind: ImageStreamTag - name: redis:latest diff --git a/roles/openshift-apps/blockerbugs/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/blockerbugs/templates/deploymentconfig.yml.j2 deleted file mode 100644 index 05e9c733f4..0000000000 --- a/roles/openshift-apps/blockerbugs/templates/deploymentconfig.yml.j2 +++ /dev/null @@ -1,140 +0,0 @@ ---- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig -metadata: - labels: - app: blockerbugs - service: blockerbugs - name: blockerbugs -spec: - replicas: 0 - selector: - app: blockerbugs - deploymentconfig: blockerbugs - strategy: - type: Recreate - recreateParams: - mid: - failurePolicy: Abort - execNewPod: - containerName: blockerbugs - # BBA would automatically proceed with upgrade_db if necessary - # init_db isn't dropping anything, so it's safe to call every time the pod starts - command: ["python", "/opt/app-root/src/blockerbugs/cli.py", "init_db"] - # and then just the gunicorn for the frontend part - volumes: - - blockerbugs-secret-volume - template: - metadata: - labels: - app: blockerbugs - deploymentconfig: blockerbugs - spec: - containers: - - name: blockerbugs - image: blockerbugs:latest - ports: - - containerPort: 8080 - resources: {} - env: -{% if env == 'staging' %} - - name: POSTGRESQL_USER - value: "{{ stg_blockerbugs_db_user }}" -{% else %} - - name: POSTGRESQL_USER - value: "{{ prod_blockerbugs_db_user }}" -{% endif %} - - name: POSTGRESQL_DATABASE - value: "blockerbugs" - - name: POSTGRESQL_SERVICE_HOST - value: "db01{{ env_suffix }}.{{datacenter}}.fedoraproject.org" - - name: POSTGRESQL_SERVICE_PORT - value: "5432" -{% if env == 'staging' %} - - name: POSTGRESQL_PASSWORD - value: "{{ stg_blockerbugs_db_password }}" - - name: SECRET_KEY - value: "{{ stg_blockerbugs_secret_key }}" - - name: PAGURE_REPO_TOKEN - value: "{{ stg_blockerbugs_pagure_repo_token_secret }}" - - name: PAGURE_REPO_WEBHOOK_KEY - value: "{{ stg_blockerbugs_pagure_repo_webhook_key_secret }}" - - name: BUGZILLA_API_KEY - value: "{{ stg_blockerbugs_bz_api_key }}" - - name: PAGURE_URL - value: "https://stg.pagure.io/" - - name: PAGURE_API - value: "https://stg.pagure.io/api/0/" - - name: BUGZILLA_URL - value: "https://bugzilla.stage.redhat.com" -{% else %} - - name: POSTGRESQL_PASSWORD - value: "{{ prod_blockerbugs_db_password }}" - - name: SECRET_KEY - value: "{{ prod_blockerbugs_secret_key }}" - - name: PAGURE_REPO_TOKEN - value: "{{ prod_blockerbugs_pagure_repo_token_secret }}" - - name: PAGURE_REPO_WEBHOOK_KEY - value: "{{ prod_blockerbugs_pagure_repo_webhook_key_secret }}" - - name: BUGZILLA_API_KEY - value: "{{ prod_blockerbugs_bz_api_key }}" - - name: PAGURE_URL - value: "https://pagure.io/" - - name: PAGURE_API - value: "https://pagure.io/api/0/" - - name: BUGZILLA_URL - value: "https://bugzilla.redhat.com" -{% endif %} - - name: BLOCKERBUGS_URL - value: "https://qa{{ env_suffix }}.fedoraproject.org/blockerbugs/" - - name: BLOCKERBUGS_API - value: "https://qa{{ env_suffix }}.fedoraproject.org/blockerbugs/api/v0/" - - name: FAS_BASE_URL - value: "https://admin{{ env_suffix }}.fedoraproject.org/accounts/" - - name: FAS_ADMIN_GROUP - value: "qa-admin" - - name: PAGURE_BOT_USERNAME - value: "blockerbot" - - name: PAGURE_BOT_ENABLED - value: "True" - - name: PAGURE_REPO - value: "fedora-qa/blocker-review" - - name: BODHI_URL - value: "https://bodhi{{ env_suffix }}.fedoraproject.org/" - - name: OPENSHIFT_PROD -{% if env == 'staging' %} - value: "0" -{% else %} - value: "1" -{% endif %} - volumeMounts: - - name: blockerbugs-secret-volume - mountPath: /opt/app-root/secret/ - readOnly: true - readinessProbe: - timeoutSeconds: 5 - initialDelaySeconds: 5 - httpGet: - path: /blockerbugs/ - port: 8080 - livenessProbe: - timeoutSeconds: 15 - initialDelaySeconds: 30 - httpGet: - path: /blockerbugs/ - port: 8080 - volumes: - - name: blockerbugs-secret-volume - secret: - secretName: blockerbugs-secret - - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - blockerbugs - from: - kind: ImageStreamTag - name: blockerbugs:latest diff --git a/roles/openshift-apps/bodhi/files/service.yml b/roles/openshift-apps/bodhi/files/service.yml index 3f5fecedc3..e44d011aca 100644 --- a/roles/openshift-apps/bodhi/files/service.yml +++ b/roles/openshift-apps/bodhi/files/service.yml @@ -4,8 +4,7 @@ kind: Service metadata: name: bodhi-web labels: - app: bodhi - service: web + app: bodhi-web namespace: bodhi spec: ports: @@ -13,4 +12,4 @@ spec: port: 8080 targetPort: 8080 selector: - deploymentconfig: bodhi-web + app: bodhi-web diff --git a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 new file mode 100644 index 0000000000..9487ebeafd --- /dev/null +++ b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 @@ -0,0 +1,350 @@ +--- +# bodhi-web +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: bodhi-web + name: bodhi-web +spec: + replicas: {{ bodhi_openshift_pods }} + selector: + matchLabels: + app: bodhi-web + strategy: + type: Recreate + template: + metadata: + labels: + app: bodhi-web +{% if env == "staging" %} + monitoring-key: cpe +{% endif %} + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-base:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-web\")].image"}]' + spec: + initContainers: + - name: alembic-upgrade + image: image-registry.openshift-image-registry.svc:5000/bodhi/bodhi-base:latest + command: ["/bin/sh", "-c"] + args: + - | + (/usr/bin/alembic-3 -c /etc/bodhi/alembic.ini current | grep -q "(head)") || ( cd /etc/bodhi && /usr/bin/alembic-3 -c /etc/bodhi/alembic.ini upgrade head) + volumeMounts: + - name: config-volume + mountPath: /etc/bodhi + readOnly: true + containers: + - name: bodhi-web + image: image-registry.openshift-image-registry.svc:5000/bodhi/bodhi-base:latest + command: ["gunicorn"] + args: ["--paste", "/etc/bodhi/production.ini", "-b", "0.0.0.0:8080", "-w", "4", "--log-level", "DEBUG", "-k", "gthread", "--threads", "2", "--log-file=-"] + ports: + - containerPort: 8080 + name: web + resources: {} + volumeMounts: + - name: config-volume + mountPath: /etc/bodhi + readOnly: true + - name: bodhi-critpath-storage + mountPath: /etc/bodhi/critpath + readOnly: true + - name: keytab-volume + mountPath: /etc/keytabs + readOnly: true + - name: httpdir-volume + mountPath: /httpdir + - name: fedora-messaging-config-volume + mountPath: /etc/fedora-messaging + readOnly: true + - name: fedora-messaging-ca-volume + mountPath: /etc/pki/fedora-messaging/cacert.pem + subPath: cacert.pem + readOnly: true + - name: fedora-messaging-crt-volume + mountPath: /etc/pki/fedora-messaging/bodhi-cert.pem + subPath: bodhi-cert.pem + readOnly: true + - name: fedora-messaging-key-volume + mountPath: /etc/pki/fedora-messaging/bodhi-key.pem + subPath: bodhi-key.pem + readOnly: true + readinessProbe: + timeoutSeconds: 10 + initialDelaySeconds: 5 + periodSeconds: 60 + httpGet: + path: /healthz/ready + port: 8080 + livenessProbe: + timeoutSeconds: 60 + initialDelaySeconds: 30 + periodSeconds: 120 + failureThreshold: 5 + httpGet: + path: /healthz/live + port: 8080 + volumes: + - name: config-volume + configMap: + name: bodhi-configmap + - name: bodhi-critpath-storage + persistentVolumeClaim: + claimName: "bodhi-critpath-storage" + - name: keytab-volume + secret: + secretName: bodhi-keytab + - name: httpdir-volume + emptyDir: {} + - name: fedora-messaging-config-volume + configMap: + name: fedora-messaging-configmap + - name: fedora-messaging-ca-volume + secret: + secretName: bodhi-fedora-messaging-ca + - name: fedora-messaging-crt-volume + secret: + secretName: bodhi-fedora-messaging-crt + - name: fedora-messaging-key-volume + secret: + secretName: bodhi-fedora-messaging-key +--- +# bodhi-consumer +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: bodhi-consumer + name: bodhi-consumer +spec: +{% if env == 'staging' %} + replicas: {{ bodhi_openshift_pods_stg_consumers }} +{% else %} + replicas: {{ bodhi_openshift_pods }} +{% endif %} + selector: + matchLabels: + app: bodhi-consumer + strategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 25% + maxUnavailable: 25% + template: + metadata: + labels: + app: bodhi-consumer + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-base:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-consumer\")].image"}]' + spec: + containers: + - name: bodhi-consumer + image: image-registry.openshift-image-registry.svc:5000/bodhi/bodhi-base:latest + command: ["/usr/bin/fedora-messaging"] + args: ["consume"] + resources: {} + volumeMounts: + - name: config-volume + mountPath: /etc/bodhi + readOnly: true + - name: bodhi-critpath-storage + mountPath: /etc/bodhi/critpath + readOnly: true + - name: keytab-volume + mountPath: /etc/keytabs + readOnly: true + - name: fedora-messaging-config-volume + mountPath: /etc/fedora-messaging + readOnly: true + - name: fedora-messaging-ca-volume + mountPath: /etc/pki/fedora-messaging/cacert.pem + subPath: cacert.pem + readOnly: true + - name: fedora-messaging-crt-volume + mountPath: /etc/pki/fedora-messaging/bodhi-cert.pem + subPath: bodhi-cert.pem + readOnly: true + - name: fedora-messaging-key-volume + mountPath: /etc/pki/fedora-messaging/bodhi-key.pem + subPath: bodhi-key.pem + readOnly: true + volumes: + - name: config-volume + configMap: + name: bodhi-configmap + - name: bodhi-critpath-storage + persistentVolumeClaim: + claimName: "bodhi-critpath-storage" + - name: keytab-volume + secret: + secretName: bodhi-keytab + - name: fedora-messaging-config-volume + configMap: + name: fedora-messaging-configmap + - name: fedora-messaging-ca-volume + secret: + secretName: bodhi-fedora-messaging-ca + - name: fedora-messaging-crt-volume + secret: + secretName: bodhi-fedora-messaging-crt + - name: fedora-messaging-key-volume + secret: + secretName: bodhi-fedora-messaging-key +--- +# bodhi-celery +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: bodhi-celery + name: bodhi-celery +spec: + replicas: {{ bodhi_openshift_pods }} + selector: + matchLabels: + app: bodhi-celery + strategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 25% + maxUnavailable: 25% + template: + metadata: + labels: + app: bodhi-celery + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-base:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-celery\")].image"}]' + spec: + containers: + - name: bodhi-celery + image: image-registry.openshift-image-registry.svc:5000/bodhi/bodhi-base:latest + command: ["/usr/bin/celery"] + args: ["-A", "bodhi.server.tasks.app", "worker", "-l", "info", "-Q", "celery"] + resources: {} + volumeMounts: + - name: config-volume + mountPath: /etc/bodhi + readOnly: true + - name: bodhi-critpath-storage + mountPath: /etc/bodhi/critpath + readOnly: true + - name: keytab-volume + mountPath: /etc/keytabs + readOnly: true + - name: fedora-messaging-config-volume + mountPath: /etc/fedora-messaging + readOnly: true + - name: fedora-messaging-ca-volume + mountPath: /etc/pki/fedora-messaging/cacert.pem + subPath: cacert.pem + readOnly: true + - name: fedora-messaging-crt-volume + mountPath: /etc/pki/fedora-messaging/bodhi-cert.pem + subPath: bodhi-cert.pem + readOnly: true + - name: fedora-messaging-key-volume + mountPath: /etc/pki/fedora-messaging/bodhi-key.pem + subPath: bodhi-key.pem + readOnly: true + volumes: + - name: config-volume + configMap: + name: bodhi-configmap + - name: bodhi-critpath-storage + persistentVolumeClaim: + claimName: "bodhi-critpath-storage" + - name: keytab-volume + secret: + secretName: bodhi-keytab + - name: fedora-messaging-config-volume + configMap: + name: fedora-messaging-configmap + - name: fedora-messaging-ca-volume + secret: + secretName: bodhi-fedora-messaging-ca + - name: fedora-messaging-crt-volume + secret: + secretName: bodhi-fedora-messaging-crt + - name: fedora-messaging-key-volume + secret: + secretName: bodhi-fedora-messaging-key +--- +# bodhi-celery-beat +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: bodhi-celery-beat + name: bodhi-celery-beat +spec: + replicas: 1 + selector: + matchLabels: + app: bodhi-celery-beat + strategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 25% + maxUnavailable: 25% + template: + metadata: + labels: + app: bodhi-celery-beat + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-base:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-celery-beat\")].image"}]' + spec: + containers: + - name: bodhi-celery-beat + image: image-registry.openshift-image-registry.svc:5000/bodhi/bodhi-base:latest + workingDir: "/tmp" + command: ["/usr/bin/celery"] + args: ["-A", "bodhi.server.tasks.app", "beat", "-l", "info"] + resources: {} + volumeMounts: + - name: config-volume + mountPath: /etc/bodhi + readOnly: true + - name: bodhi-critpath-storage + mountPath: /etc/bodhi/critpath + readOnly: true + - name: keytab-volume + mountPath: /etc/keytabs + readOnly: true + - name: fedora-messaging-config-volume + mountPath: /etc/fedora-messaging + readOnly: true + - name: fedora-messaging-ca-volume + mountPath: /etc/pki/fedora-messaging/cacert.pem + subPath: cacert.pem + readOnly: true + - name: fedora-messaging-crt-volume + mountPath: /etc/pki/fedora-messaging/bodhi-cert.pem + subPath: bodhi-cert.pem + readOnly: true + - name: fedora-messaging-key-volume + mountPath: /etc/pki/fedora-messaging/bodhi-key.pem + subPath: bodhi-key.pem + readOnly: true + volumes: + - name: config-volume + configMap: + name: bodhi-configmap + - name: bodhi-critpath-storage + persistentVolumeClaim: + claimName: "bodhi-critpath-storage" + - name: keytab-volume + secret: + secretName: bodhi-keytab + - name: fedora-messaging-config-volume + configMap: + name: fedora-messaging-configmap + - name: fedora-messaging-ca-volume + secret: + secretName: bodhi-fedora-messaging-ca + - name: fedora-messaging-crt-volume + secret: + secretName: bodhi-fedora-messaging-crt + - name: fedora-messaging-key-volume + secret: + secretName: bodhi-fedora-messaging-key diff --git a/roles/openshift-apps/bodhi/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/bodhi/templates/deploymentconfig.yml.j2 deleted file mode 100644 index 16689e8000..0000000000 --- a/roles/openshift-apps/bodhi/templates/deploymentconfig.yml.j2 +++ /dev/null @@ -1,436 +0,0 @@ ---- -apiVersion: apps.openshift.io/v1 -items: -- apiVersion: apps.openshift.io/v1 - kind: DeploymentConfig - metadata: - labels: - app: bodhi - service: web - name: bodhi-web - spec: - replicas: {{ bodhi_openshift_pods }} - selector: - deploymentconfig: bodhi-web - strategy: - activeDeadlineSeconds: 21600 - recreateParams: - mid: - execNewPod: - command: - - /bin/sh - - '-c' - - >- - (/usr/bin/alembic-3 -c /etc/bodhi/alembic.ini current | grep -q - "(head)") || ( cd /etc/bodhi && /usr/bin/alembic-3 -c - /etc/bodhi/alembic.ini upgrade head) - containerName: bodhi-web - volumes: - - config-volume - failurePolicy: Abort - timeoutSeconds: 600 - resources: {} - type: Recreate - template: - metadata: - creationTimestamp: null - labels: - app: bodhi-web - deploymentconfig: bodhi-web -{% if env == "staging" %} - monitoring-key: cpe -{% endif %} - spec: - containers: - - name: bodhi-web - image: bodhi-base:latest - command: ["gunicorn"] - # Don't use --preload, it causes threading errors with Fedora Messaging on Python 3.13 - # https://github.com/fedora-infra/fedora-messaging/issues/431 - args: ["--paste", "/etc/bodhi/production.ini", "-b", "0.0.0.0:8080", "-w", "4", "--log-level", "DEBUG", "-k", "gthread", "--threads", "2", "--log-file=-"] - ports: - - containerPort: 8080 - name: web - resources: {} - volumeMounts: - - name: config-volume - mountPath: /etc/bodhi - readOnly: true - - name: bodhi-critpath-storage - mountPath: /etc/bodhi/critpath - readOnly: true - - name: keytab-volume - mountPath: /etc/keytabs - readOnly: true - - name: httpdir-volume - mountPath: /httpdir - - name: fedora-messaging-config-volume - mountPath: /etc/fedora-messaging - readOnly: true - - name: fedora-messaging-ca-volume - mountPath: /etc/pki/fedora-messaging/cacert.pem - subPath: cacert.pem - readOnly: true - - name: fedora-messaging-crt-volume - mountPath: /etc/pki/fedora-messaging/bodhi-cert.pem - subPath: bodhi-cert.pem - readOnly: true - - name: fedora-messaging-key-volume - mountPath: /etc/pki/fedora-messaging/bodhi-key.pem - subPath: bodhi-key.pem - readOnly: true - readinessProbe: - timeoutSeconds: 10 - initialDelaySeconds: 5 - periodSeconds: 60 - httpGet: - path: /healthz/ready - port: 8080 - livenessProbe: - timeoutSeconds: 60 - initialDelaySeconds: 30 - periodSeconds: 120 - failureThreshold: 5 - httpGet: - path: /healthz/live - port: 8080 - volumes: - - name: config-volume - configMap: - name: bodhi-configmap - - name: bodhi-critpath-storage - persistentVolumeClaim: - claimName: "bodhi-critpath-storage" - - name: keytab-volume - secret: - secretName: bodhi-keytab - - name: httpdir-volume - emptyDir: {} - - name: fedora-messaging-config-volume - configMap: - name: fedora-messaging-configmap - - name: fedora-messaging-ca-volume - secret: - secretName: bodhi-fedora-messaging-ca - - name: fedora-messaging-crt-volume - secret: - secretName: bodhi-fedora-messaging-crt - - name: fedora-messaging-key-volume - secret: - secretName: bodhi-fedora-messaging-key - triggers: - - imageChangeParams: - automatic: true - containerNames: - - bodhi-web - from: - kind: ImageStreamTag - name: bodhi-base:latest - namespace: bodhi - type: ImageChange - - type: ConfigChange -kind: List -metadata: {} ---- -apiVersion: apps.openshift.io/v1 -items: -- apiVersion: apps.openshift.io/v1 - kind: DeploymentConfig - metadata: - labels: - app: bodhi - service: consumer - name: bodhi-consumer - spec: -{% if env == 'staging' %} - replicas: {{ bodhi_openshift_pods_stg_consumers }} -{% else %} - replicas: {{ bodhi_openshift_pods }} -{% endif %} - selector: - deploymentconfig: bodhi-consumer - strategy: - activeDeadlineSeconds: 21600 - recreateParams: - timeoutSeconds: 600 - resources: {} - rollingParams: - intervalSeconds: 1 - maxSurge: 25% - maxUnavailable: 25% - timeoutSeconds: 600 - updatePeriodSeconds: 1 - type: Rolling - template: - metadata: - creationTimestamp: null - labels: - app: bodhi-consumer - deploymentconfig: bodhi-consumer - spec: - containers: - - name: bodhi-consumer - image: bodhi-base:latest - command: ["/usr/bin/fedora-messaging"] - args: ["consume"] - resources: {} - volumeMounts: - - name: config-volume - mountPath: /etc/bodhi - readOnly: true - - name: bodhi-critpath-storage - mountPath: /etc/bodhi/critpath - readOnly: true - - name: keytab-volume - mountPath: /etc/keytabs - readOnly: true - - name: fedora-messaging-config-volume - mountPath: /etc/fedora-messaging - readOnly: true - - name: fedora-messaging-ca-volume - mountPath: /etc/pki/fedora-messaging/cacert.pem - subPath: cacert.pem - readOnly: true - - name: fedora-messaging-crt-volume - mountPath: /etc/pki/fedora-messaging/bodhi-cert.pem - subPath: bodhi-cert.pem - readOnly: true - - name: fedora-messaging-key-volume - mountPath: /etc/pki/fedora-messaging/bodhi-key.pem - subPath: bodhi-key.pem - readOnly: true - volumes: - - name: config-volume - configMap: - name: bodhi-configmap - - name: bodhi-critpath-storage - persistentVolumeClaim: - claimName: "bodhi-critpath-storage" - - name: keytab-volume - secret: - secretName: bodhi-keytab - - name: fedora-messaging-config-volume - configMap: - name: fedora-messaging-configmap - - name: fedora-messaging-ca-volume - secret: - secretName: bodhi-fedora-messaging-ca - - name: fedora-messaging-crt-volume - secret: - secretName: bodhi-fedora-messaging-crt - - name: fedora-messaging-key-volume - secret: - secretName: bodhi-fedora-messaging-key - triggers: - - imageChangeParams: - automatic: true - containerNames: - - bodhi-consumer - from: - kind: ImageStreamTag - name: bodhi-base:latest - namespace: bodhi - type: ImageChange - - type: ConfigChange -kind: List -metadata: {} ---- -apiVersion: apps.openshift.io/v1 -items: -- apiVersion: apps.openshift.io/v1 - kind: DeploymentConfig - metadata: - labels: - app: bodhi - service: celery - name: bodhi-celery - spec: - replicas: {{ bodhi_openshift_pods }} - selector: - deploymentconfig: bodhi-celery - strategy: - activeDeadlineSeconds: 21600 - recreateParams: - timeoutSeconds: 600 - resources: {} - rollingParams: - intervalSeconds: 1 - maxSurge: 25% - maxUnavailable: 25% - timeoutSeconds: 600 - updatePeriodSeconds: 1 - type: Rolling - template: - metadata: - creationTimestamp: null - labels: - app: bodhi-celery - deploymentconfig: bodhi-celery - spec: - containers: - - name: bodhi-celery - image: bodhi-base:latest - command: ["/usr/bin/celery"] - args: ["-A", "bodhi.server.tasks.app", "worker", "-l", "info", "-Q", "celery"] - resources: {} - volumeMounts: - - name: config-volume - mountPath: /etc/bodhi - readOnly: true - - name: bodhi-critpath-storage - mountPath: /etc/bodhi/critpath - readOnly: true - - name: keytab-volume - mountPath: /etc/keytabs - readOnly: true - - name: fedora-messaging-config-volume - mountPath: /etc/fedora-messaging - readOnly: true - - name: fedora-messaging-ca-volume - mountPath: /etc/pki/fedora-messaging/cacert.pem - subPath: cacert.pem - readOnly: true - - name: fedora-messaging-crt-volume - mountPath: /etc/pki/fedora-messaging/bodhi-cert.pem - subPath: bodhi-cert.pem - readOnly: true - - name: fedora-messaging-key-volume - mountPath: /etc/pki/fedora-messaging/bodhi-key.pem - subPath: bodhi-key.pem - readOnly: true - volumes: - - name: config-volume - configMap: - name: bodhi-configmap - - name: bodhi-critpath-storage - persistentVolumeClaim: - claimName: "bodhi-critpath-storage" - - name: keytab-volume - secret: - secretName: bodhi-keytab - - name: fedora-messaging-config-volume - configMap: - name: fedora-messaging-configmap - - name: fedora-messaging-ca-volume - secret: - secretName: bodhi-fedora-messaging-ca - - name: fedora-messaging-crt-volume - secret: - secretName: bodhi-fedora-messaging-crt - - name: fedora-messaging-key-volume - secret: - secretName: bodhi-fedora-messaging-key - triggers: - - imageChangeParams: - automatic: true - containerNames: - - bodhi-celery - from: - kind: ImageStreamTag - name: bodhi-base:latest - namespace: bodhi - type: ImageChange - - type: ConfigChange -kind: List -metadata: {} ---- -apiVersion: apps.openshift.io/v1 -items: -- apiVersion: apps.openshift.io/v1 - kind: DeploymentConfig - metadata: - labels: - app: bodhi - service: celery-beat - name: bodhi-celery-beat - spec: - # There must be only one celery-beat worker - replicas: 1 - selector: - deploymentconfig: bodhi-celery-beat - strategy: - activeDeadlineSeconds: 21600 - recreateParams: - timeoutSeconds: 600 - resources: {} - rollingParams: - intervalSeconds: 1 - maxSurge: 25% - maxUnavailable: 25% - timeoutSeconds: 600 - updatePeriodSeconds: 1 - type: Rolling - template: - metadata: - creationTimestamp: null - labels: - app: bodhi-celery-beat - deploymentconfig: bodhi-celery-beat - spec: - containers: - - name: bodhi-celery-beat - image: bodhi-base:latest - workingDir: "/tmp" - command: ["/usr/bin/celery"] - args: ["-A", "bodhi.server.tasks.app", "beat", "-l", "info"] - resources: {} - volumeMounts: - - name: config-volume - mountPath: /etc/bodhi - readOnly: true - - name: bodhi-critpath-storage - mountPath: /etc/bodhi/critpath - readOnly: true - - name: keytab-volume - mountPath: /etc/keytabs - readOnly: true - - name: fedora-messaging-config-volume - mountPath: /etc/fedora-messaging - readOnly: true - - name: fedora-messaging-ca-volume - mountPath: /etc/pki/fedora-messaging/cacert.pem - subPath: cacert.pem - readOnly: true - - name: fedora-messaging-crt-volume - mountPath: /etc/pki/fedora-messaging/bodhi-cert.pem - subPath: bodhi-cert.pem - readOnly: true - - name: fedora-messaging-key-volume - mountPath: /etc/pki/fedora-messaging/bodhi-key.pem - subPath: bodhi-key.pem - readOnly: true - volumes: - - name: config-volume - configMap: - name: bodhi-configmap - - name: bodhi-critpath-storage - persistentVolumeClaim: - claimName: "bodhi-critpath-storage" - - name: keytab-volume - secret: - secretName: bodhi-keytab - - name: fedora-messaging-config-volume - configMap: - name: fedora-messaging-configmap - - name: fedora-messaging-ca-volume - secret: - secretName: bodhi-fedora-messaging-ca - - name: fedora-messaging-crt-volume - secret: - secretName: bodhi-fedora-messaging-crt - - name: fedora-messaging-key-volume - secret: - secretName: bodhi-fedora-messaging-key - triggers: - - imageChangeParams: - automatic: true - containerNames: - - bodhi-celery-beat - from: - kind: ImageStreamTag - name: bodhi-base:latest - namespace: bodhi - type: ImageChange - - type: ConfigChange -kind: List -metadata: {} diff --git a/roles/openshift-apps/compose-tracker/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/compose-tracker/templates/deploymentconfig.yml.j2 deleted file mode 100644 index 5229929411..0000000000 --- a/roles/openshift-apps/compose-tracker/templates/deploymentconfig.yml.j2 +++ /dev/null @@ -1,54 +0,0 @@ ---- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig -metadata: - labels: - app: compose-tracker - name: compose-tracker -spec: - replicas: 1 - selector: - app: compose-tracker - strategy: - resources: {} - template: - metadata: - labels: - app: compose-tracker - name: compose-tracker - spec: - containers: - - envFrom: - - secretRef: - name: compose-tracker-forgejo-token - env: - - name: FORGEJO_NAMESPACE - value: "releng" - - name: FORGEJO_REPO - value: "compose-tracker-issues" - - name: FORGEJO_DOMAIN -{% if env == "staging" %} - value: "https://forge.stg.fedoraproject.org/" -{% else %} - value: "https://forge.fedoraproject.org/" -{% endif %} - # sleep infinity is useful for debugging environment issues - # comment out when not debugging -# args: ['infinity'] -# command: ['/usr/bin/sleep'] - image: "" - imagePullPolicy: IfNotPresent - name: compose-tracker - resources: {} - restartPolicy: Always - test: false - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - compose-tracker - from: - kind: ImageStreamTag - name: compose-tracker-img:latest diff --git a/roles/openshift-apps/datanommer/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/datanommer/templates/deployment.yml.j2 similarity index 65% rename from roles/openshift-apps/datanommer/templates/deploymentconfig.yml.j2 rename to roles/openshift-apps/datanommer/templates/deployment.yml.j2 index 3dd37976e3..1fa0dd2523 100644 --- a/roles/openshift-apps/datanommer/templates/deploymentconfig.yml.j2 +++ b/roles/openshift-apps/datanommer/templates/deployment.yml.j2 @@ -1,6 +1,6 @@ --- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: name: datanommer labels: @@ -8,27 +8,28 @@ metadata: spec: replicas: 1 selector: - app: Datanommer - deploymentconfig: datanommer + matchLabels: + app: Datanommer strategy: type: Recreate - recreateParams: - mid: - execNewPod: - command: [/opt/app-root/bin/alembic, -c, /etc/fedora-messaging/alembic.ini, upgrade, head] - containerName: datanommer - volumes: - - fedora-messaging-config-volume - failurePolicy: Abort template: metadata: - creationTimestamp: null labels: app: Datanommer - deploymentconfig: datanommer + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"datanommer:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"datanommer\")].image"}]' spec: + initContainers: + - name: alembic-upgrade + image: image-registry.openshift-image-registry.svc:5000/datanommer/datanommer:latest + command: ["/opt/app-root/bin/alembic", "-c", "/etc/fedora-messaging/alembic.ini", "upgrade", "head"] + volumeMounts: + - name: fedora-messaging-config-volume + mountPath: "/etc/fedora-messaging" + readOnly: true containers: - name: datanommer + image: image-registry.openshift-image-registry.svc:5000/datanommer/datanommer:latest imagePullPolicy: Always ports: - containerPort: 8080 @@ -64,13 +65,3 @@ spec: - name: fedora-messaging-key-volume secret: secretName: fedora-messaging-key - triggers: - - imageChangeParams: - automatic: true - containerNames: - - datanommer - from: - kind: ImageStreamTag - name: datanommer:latest - type: ImageChange - - type: ConfigChange diff --git a/roles/openshift-apps/easyfix/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/easyfix/templates/deploymentconfig.yml.j2 deleted file mode 100644 index ab06ac87fa..0000000000 --- a/roles/openshift-apps/easyfix/templates/deploymentconfig.yml.j2 +++ /dev/null @@ -1,75 +0,0 @@ ---- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig -metadata: - name: web - labels: - app: easyfix -spec: - replicas: 1 - selector: - app: easyfix - deploymentconfig: web - strategy: - type: Rolling - activeDeadlineSeconds: 21600 - rollingParams: - intervalSeconds: 1 - maxSurge: 25% - maxUnavailable: 25% - timeoutSeconds: 600 - updatePeriodSeconds: 1 - template: - metadata: - creationTimestamp: null - labels: - app: easyfix - deploymentconfig: web - spec: - containers: - - name: easyfix - imagePullPolicy: Always - ports: - - containerPort: 8080 - volumeMounts: - - name: httpdir-volume - mountPath: /httpdir - - name: data - mountPath: /srv - - name: config - mountPath: "/etc/easyfix" - readOnly: true - env: - - name: APP_SCRIPT - value: ".s2i/run-httpd.sh" - readinessProbe: - timeoutSeconds: 1 - initialDelaySeconds: 5 - httpGet: - path: / - port: 8080 - livenessProbe: - timeoutSeconds: 1 - initialDelaySeconds: 20 - httpGet: - path: / - port: 8080 - volumes: - - name: httpdir-volume - emptyDir: {} - - name: config - configMap: - name: config - - name: data - persistentVolumeClaim: - claimName: data - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - easyfix - from: - kind: ImageStreamTag - name: easyfix:latest diff --git a/roles/openshift-apps/elections/files/deploymentconfig.yml b/roles/openshift-apps/elections/files/deployment.yml similarity index 66% rename from roles/openshift-apps/elections/files/deploymentconfig.yml rename to roles/openshift-apps/elections/files/deployment.yml index 49c1baf666..024eab3a95 100644 --- a/roles/openshift-apps/elections/files/deploymentconfig.yml +++ b/roles/openshift-apps/elections/files/deployment.yml @@ -1,6 +1,6 @@ --- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: labels: app: elections @@ -9,35 +9,42 @@ metadata: spec: replicas: 1 selector: - app: elections - deploymentconfig: elections + matchLabels: + app: elections strategy: type: Recreate - recreateParams: - mid: - failurePolicy: Abort - execNewPod: - containerName: elections - command: ["/opt/app-root/src/alembic_upgrade.sh"] - env: - - name: PYTHONPATH - value: /opt/app-root/src - - name: KRB5_CONFIG - value: /etc/ipa/krb5.conf - volumes: - - config-volume - - elections-secret-volume - - ipa-config-volume - - keytab-volume template: metadata: labels: app: elections - deploymentconfig: elections + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"elections:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"elections\")].image"}]' spec: + initContainers: + - name: alembic-upgrade + image: image-registry.openshift-image-registry.svc:5000/elections/elections:latest + command: ["/opt/app-root/src/alembic_upgrade.sh"] + env: + - name: PYTHONPATH + value: /opt/app-root/src + - name: KRB5_CONFIG + value: /etc/ipa/krb5.conf + volumeMounts: + - name: config-volume + mountPath: /opt/app-root/config/ + readOnly: true + - name: elections-secret-volume + mountPath: /opt/app-root/secret/ + readOnly: true + - name: ipa-config-volume + mountPath: /etc/ipa + readOnly: true + - name: keytab-volume + mountPath: /etc/keytabs + readOnly: true containers: - name: elections - image: elections:latest + image: image-registry.openshift-image-registry.svc:5000/elections/elections:latest ports: - containerPort: 8000 resources: {} @@ -102,14 +109,3 @@ spec: - name: keytab-volume secret: secretName: elections-keytab - - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - elections - from: - kind: ImageStreamTag - name: elections:latest diff --git a/roles/openshift-apps/elections/files/service.yml b/roles/openshift-apps/elections/files/service.yml index 6f85983e4c..a6df54ad59 100644 --- a/roles/openshift-apps/elections/files/service.yml +++ b/roles/openshift-apps/elections/files/service.yml @@ -13,4 +13,3 @@ spec: targetPort: 8000 selector: app: elections - deploymentconfig: elections diff --git a/roles/openshift-apps/flatpak-indexer/files/service.yml b/roles/openshift-apps/flatpak-indexer/files/service.yml index 8408b6dd10..2cc70f9259 100644 --- a/roles/openshift-apps/flatpak-indexer/files/service.yml +++ b/roles/openshift-apps/flatpak-indexer/files/service.yml @@ -13,4 +13,3 @@ spec: targetPort: 6379 selector: app: redis - deploymentconfig: redis diff --git a/roles/openshift-apps/flatpak-indexer/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/flatpak-indexer/templates/deployment.yml.j2 similarity index 58% rename from roles/openshift-apps/flatpak-indexer/templates/deploymentconfig.yml.j2 rename to roles/openshift-apps/flatpak-indexer/templates/deployment.yml.j2 index 4372bd3e11..4bbbc78f37 100644 --- a/roles/openshift-apps/flatpak-indexer/templates/deploymentconfig.yml.j2 +++ b/roles/openshift-apps/flatpak-indexer/templates/deployment.yml.j2 @@ -1,6 +1,6 @@ --- -kind: DeploymentConfig -apiVersion: apps.openshift.io/v1 +apiVersion: apps/v1 +kind: Deployment metadata: labels: app: flatpak-indexer @@ -8,26 +8,24 @@ metadata: spec: replicas: 1 selector: - app: flatpak-indexer - deploymentconfig: flatpak-indexer + matchLabels: + app: flatpak-indexer strategy: - activeDeadlineSeconds: 21600 - resources: {} - rollingParams: - intervalSeconds: 1 + type: RollingUpdate + rollingUpdate: maxSurge: 25% maxUnavailable: 25% - timeoutSeconds: 600 - updatePeriodSeconds: 1 - type: Rolling template: metadata: labels: app: flatpak-indexer - deploymentconfig: flatpak-indexer + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"flatpak-indexer:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"flatpak-indexer\")].image"}]' spec: containers: - - env: + - name: flatpak-indexer + image: image-registry.openshift-image-registry.svc:5000/flatpak-indexer/flatpak-indexer:latest + env: - name: OUTPUT_DIR value: /var/www/flatpaks - name: REDIS_PASSWORD @@ -37,12 +35,9 @@ spec: key: password - name: REDIS_URL value: redis://redis.flatpak-indexer.svc.cluster.local:6379 - image: flatpak-indexer:latest - name: flatpak-indexer ports: - containerPort: 8080 protocol: TCP - resources: {} volumeMounts: - mountPath: /etc/flatpak-indexer name: indexer-config-volume @@ -52,34 +47,19 @@ spec: readOnly: true - mountPath: /var/www/flatpaks name: index-output-volume - dnsPolicy: ClusterFirst - restartPolicy: Always volumes: - - configMap: - defaultMode: 420 + - name: indexer-config-volume + configMap: name: indexer-config - name: indexer-config-volume - - configMap: - defaultMode: 420 + - name: koji-conf-volume + configMap: name: koji-conf - name: koji-conf-volume - name: index-output-volume persistentVolumeClaim: claimName: flatpak-indexer-storage{{ '-stg' if env == 'staging' else '' }} - test: false - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - flatpak-indexer - from: - kind: ImageStreamTag - name: flatpak-indexer:latest --- -kind: DeploymentConfig -apiVersion: apps.openshift.io/v1 +apiVersion: apps/v1 +kind: Deployment metadata: labels: app: flatpak-indexer-differ @@ -88,26 +68,24 @@ spec: replicas: 1 revisionHistoryLimit: 10 selector: - app: flatpak-indexer-differ - deploymentconfig: flatpak-indexer-differ + matchLabels: + app: flatpak-indexer-differ strategy: - activeDeadlineSeconds: 21600 - resources: {} - rollingParams: - intervalSeconds: 1 + type: RollingUpdate + rollingUpdate: maxSurge: 25% maxUnavailable: 25% - timeoutSeconds: 600 - updatePeriodSeconds: 1 - type: Rolling template: metadata: labels: app: flatpak-indexer-differ - deploymentconfig: flatpak-indexer-differ + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"flatpak-indexer:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"flatpak-indexer-differ\")].image"}]' spec: containers: - - env: + - name: flatpak-indexer-differ + image: image-registry.openshift-image-registry.svc:5000/flatpak-indexer/flatpak-indexer:latest + env: - name: OUTPUT_DIR value: /var/www/flatpaks - name: FLATPAK_INDEXER_COMMAND @@ -119,8 +97,6 @@ spec: key: password - name: REDIS_URL value: redis://redis.flatpak-indexer.svc.cluster.local:6379 - image: flatpak-indexer:latest - name: flatpak-indexer-differ ports: - containerPort: 8080 protocol: TCP @@ -137,30 +113,16 @@ spec: readOnly: true - mountPath: /var/www/flatpaks name: index-output-volume - dnsPolicy: ClusterFirst - restartPolicy: Always volumes: - - configMap: - defaultMode: 420 + - name: indexer-config-volume + configMap: name: indexer-config - name: indexer-config-volume - name: index-output-volume persistentVolumeClaim: claimName: flatpak-indexer-storage{{ '-stg' if env == 'staging' else '' }} - test: false - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - flatpak-indexer-differ - from: - kind: ImageStreamTag - name: flatpak-indexer:latest --- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: labels: app: redis @@ -169,27 +131,29 @@ spec: replicas: 1 revisionHistoryLimit: 10 selector: - app: redis - deploymentconfig: redis + matchLabels: + app: redis strategy: - activeDeadlineSeconds: 21600 - # Recreate so that the old pod is stopped before the new pod is created. - # Could also use a StatefulSet type: Recreate template: metadata: labels: app: redis - deploymentconfig: redis + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"redis:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"redis\")].image"}]' spec: containers: - - env: - - name: REDIS_PASSWORD - valueFrom: - secretKeyRef: - name: redis-password - key: password - image: redis:latest + - name: redis + image: image-registry.openshift-image-registry.svc:5000/flatpak-indexer/redis:latest + env: + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: redis-password + key: password + ports: + - containerPort: 6379 + protocol: TCP livenessProbe: exec: command: ['valkey-cli', '-a', '$REDIS_PASSWORD', 'ping'] @@ -198,10 +162,6 @@ spec: periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 - name: redis - ports: - - containerPort: 6379 - protocol: TCP readinessProbe: exec: command: ['valkey-cli', '-a', '$REDIS_PASSWORD', 'ping'] @@ -209,24 +169,10 @@ spec: periodSeconds: 60 successThreshold: 1 timeoutSeconds: 1 - resources: {} volumeMounts: - mountPath: /data name: redis-data-volume - dnsPolicy: ClusterFirst - restartPolicy: Always volumes: - name: redis-data-volume persistentVolumeClaim: claimName: flatpak-indexer-redis-storage{{ '-stg' if env == 'staging' else '' }} - test: false - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - redis - from: - kind: ImageStreamTag - name: redis:latest diff --git a/roles/openshift-apps/fmn/files/service.yml b/roles/openshift-apps/fmn/files/service.yml index cfa76c83ea..ee15e36ddc 100644 --- a/roles/openshift-apps/fmn/files/service.yml +++ b/roles/openshift-apps/fmn/files/service.yml @@ -5,6 +5,7 @@ metadata: name: frontend labels: app: fmn + component: frontend spec: ports: - name: web @@ -12,7 +13,7 @@ spec: targetPort: 8080 selector: app: fmn - deploymentconfig: frontend + component: frontend --- apiVersion: v1 kind: Service @@ -20,6 +21,7 @@ metadata: name: api labels: app: fmn + component: api spec: ports: - name: web @@ -27,7 +29,7 @@ spec: targetPort: 8080 selector: app: fmn - deploymentconfig: api + component: api --- apiVersion: v1 kind: Service @@ -35,6 +37,7 @@ metadata: name: sendria labels: app: fmn + component: sendria spec: ports: - name: web @@ -45,7 +48,7 @@ spec: targetPort: 1025 selector: app: fmn - deploymentconfig: sendria + component: sendria --- apiVersion: v1 kind: Service @@ -53,6 +56,7 @@ metadata: name: redis labels: app: fmn + component: redis spec: ports: - name: redis @@ -61,4 +65,4 @@ spec: targetPort: 6379 selector: app: fmn - deploymentconfig: redis + component: redis diff --git a/roles/openshift-apps/fmn/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/fmn/templates/deployment.yml.j2 similarity index 73% rename from roles/openshift-apps/fmn/templates/deploymentconfig.yml.j2 rename to roles/openshift-apps/fmn/templates/deployment.yml.j2 index eb2f17e40c..593f076b78 100644 --- a/roles/openshift-apps/fmn/templates/deploymentconfig.yml.j2 +++ b/roles/openshift-apps/fmn/templates/deployment.yml.j2 @@ -1,34 +1,34 @@ --- # Frontend component (Javascript served by Apache httpd) -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: name: frontend labels: app: fmn + component: frontend spec: replicas: 1 selector: - app: fmn - deploymentconfig: frontend + matchLabels: + app: fmn + component: frontend strategy: - type: Rolling - activeDeadlineSeconds: 21600 - rollingParams: - intervalSeconds: 1 + type: RollingUpdate + rollingUpdate: maxSurge: 25% maxUnavailable: 25% - timeoutSeconds: 600 - updatePeriodSeconds: 1 template: metadata: - creationTimestamp: null labels: app: fmn - deploymentconfig: frontend + component: frontend + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"frontend\")].image"}]' spec: containers: - name: frontend + image: image-registry.openshift-image-registry.svc:5000/fmn/fmn:latest imagePullPolicy: Always ports: - containerPort: 8080 @@ -53,47 +53,37 @@ spec: volumes: - name: httpdir-volume emptyDir: {} - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - frontend - from: - kind: ImageStreamTag - name: fmn:latest --- # API component (Python/FastAPI served by Uvicorn) -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: name: api labels: app: fmn + component: api spec: replicas: 1 selector: - app: fmn - deploymentconfig: api + matchLabels: + app: fmn + component: api strategy: - type: Rolling - activeDeadlineSeconds: 21600 - rollingParams: - intervalSeconds: 1 + type: RollingUpdate + rollingUpdate: maxSurge: 25% maxUnavailable: 25% - timeoutSeconds: 600 - updatePeriodSeconds: 1 template: metadata: - creationTimestamp: null labels: app: fmn - deploymentconfig: api + component: api + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"api\")].image"}]' spec: containers: - name: api + image: image-registry.openshift-image-registry.svc:5000/fmn/fmn:latest imagePullPolicy: Always ports: - containerPort: 8080 @@ -116,7 +106,6 @@ spec: - name: fedora-messaging-crt-volume mountPath: /etc/pki/fedora-messaging/crt readOnly: true - env: - name: APP_SCRIPT value: ".s2i/run-api.sh" @@ -141,7 +130,6 @@ spec: key: cache-hash-key - name: FEDORA_MESSAGING_CONF value: /etc/fmn/api.toml - readinessProbe: timeoutSeconds: 1 initialDelaySeconds: 5 @@ -154,7 +142,6 @@ spec: httpGet: path: /api/v1/healthz/live port: 8080 - volumes: - name: etc-fmn configMap: @@ -174,49 +161,42 @@ spec: - name: fedora-messaging-crt-volume secret: secretName: fedora-messaging-crt - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - api - from: - kind: ImageStreamTag - name: fmn:latest --- # Consumer component (Fedora Messaging consume command) -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: - name: consumer + name: fmn labels: app: fmn + component: consumer spec: - # There can be as many as necessary replicas: 1 selector: - app: fmn - deploymentconfig: consumer + matchLabels: + app: fmn + component: consumer strategy: type: Recreate - recreateParams: - mid: - execNewPod: - command: [/opt/app-root/bin/fmn, database, sync] - containerName: consumer - volumes: - - etc-fmn - failurePolicy: Abort template: metadata: - creationTimestamp: null labels: app: fmn - deploymentconfig: consumer + component: consumer + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"consumer\")].image"}]' spec: + initContainers: + - name: database-sync + image: image-registry.openshift-image-registry.svc:5000/fmn/fmn:latest + command: ["/opt/app-root/bin/fmn", "database", "sync"] + volumeMounts: + - name: etc-fmn + mountPath: "/etc/fmn" + readOnly: true containers: - name: consumer + image: image-registry.openshift-image-registry.svc:5000/fmn/fmn:latest imagePullPolicy: Always volumeMounts: - name: etc-fmn @@ -273,41 +253,34 @@ spec: - name: fedora-messaging-crt-volume secret: secretName: fedora-messaging-crt - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - consumer - from: - kind: ImageStreamTag - name: fmn:latest --- # Email sending component (custom python runner) -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: name: sender-email labels: app: fmn + component: sender-email spec: - # There can be many pods for email. replicas: 1 selector: - app: fmn - deploymentconfig: sender-email + matchLabels: + app: fmn + component: sender-email strategy: type: Recreate template: metadata: - creationTimestamp: null labels: app: fmn - deploymentconfig: sender-email + component: sender-email + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"sender-email\")].image"}]' spec: containers: - name: sender-email + image: image-registry.openshift-image-registry.svc:5000/fmn/fmn:latest imagePullPolicy: Always volumeMounts: - name: etc-fmn @@ -338,42 +311,34 @@ spec: - name: fedora-messaging-crt-volume secret: secretName: fedora-messaging-crt - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - sender-email - from: - kind: ImageStreamTag - name: fmn:latest --- # IRC sending component (custom python runner) -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: name: sender-irc labels: app: fmn + component: sender-irc spec: - # There can be only one pod for IRC - # Staging is currently unable to connect to IRC outside because of firewall rules. replicas: {{ (env == 'production')|ternary('1', '0') }} selector: - app: fmn - deploymentconfig: sender-irc + matchLabels: + app: fmn + component: sender-irc strategy: type: Recreate template: metadata: - creationTimestamp: null labels: app: fmn - deploymentconfig: sender-irc + component: sender-irc + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"sender-irc\")].image"}]' spec: containers: - name: sender-irc + image: image-registry.openshift-image-registry.svc:5000/fmn/fmn:latest imagePullPolicy: Always volumeMounts: - name: etc-fmn @@ -404,42 +369,34 @@ spec: - name: fedora-messaging-crt-volume secret: secretName: fedora-messaging-crt - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - sender-irc - from: - kind: ImageStreamTag - name: fmn:latest --- # Matrix sending component (custom python runner) -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: name: sender-matrix labels: app: fmn + component: sender-matrix spec: - # Not sure how many concurrent connections are supported by Matrix with the - # same token. Let's just have one for now. replicas: 1 selector: - app: fmn - deploymentconfig: sender-matrix + matchLabels: + app: fmn + component: sender-matrix strategy: type: Recreate template: metadata: - creationTimestamp: null labels: app: fmn - deploymentconfig: sender-matrix + component: sender-matrix + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"sender-matrix\")].image"}]' spec: containers: - name: sender-matrix + image: image-registry.openshift-image-registry.svc:5000/fmn/fmn:latest imagePullPolicy: Always volumeMounts: - name: etc-fmn @@ -470,79 +427,77 @@ spec: - name: fedora-messaging-crt-volume secret: secretName: fedora-messaging-crt - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - sender-matrix - from: - kind: ImageStreamTag - name: fmn:latest --- # Redis, for caching -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: name: redis labels: app: fmn - service: redis + component: redis spec: replicas: 1 selector: - app: fmn - deploymentconfig: redis + matchLabels: + app: fmn + component: redis + strategy: {} template: metadata: labels: app: fmn - deploymentconfig: redis + component: redis + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"redis:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"redis\")].image"}]' spec: containers: - name: redis image: redis:latest + command: + - redis-server + - --requirepass + - $(REDIS_PASSWORD) env: - name: REDIS_PASSWORD valueFrom: secretKeyRef: name: fmn key: redis-password - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - redis - from: - kind: ImageStreamTag - name: redis:latest + volumeMounts: + - name: redis-data + mountPath: /data + volumes: + - name: redis-data + emptyDir: {} --- # Collectd stats collector -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: name: collectd labels: app: fmn + component: collectd spec: replicas: 1 selector: - app: fmn - deploymentconfig: collectd + matchLabels: + app: fmn + component: collectd strategy: type: Recreate template: metadata: - creationTimestamp: null labels: app: fmn - deploymentconfig: collectd + component: collectd + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"collectd\")].image"}]' spec: containers: - name: collectd + image: image-registry.openshift-image-registry.svc:5000/fmn/fmn:latest imagePullPolicy: Always volumeMounts: - name: etc-fmn @@ -561,47 +516,39 @@ spec: secretKeyRef: name: fmn key: cache-hash-key - volumes: - name: etc-fmn configMap: name: fmn - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - collectd - from: - kind: ImageStreamTag - name: fmn:latest --- # Sendria, to display email notifications in staging {% if env == 'staging' %} -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: labels: app: fmn - service: sendria + component: sendria name: sendria spec: replicas: 1 selector: - app: fmn - deploymentconfig: sendria + matchLabels: + app: fmn + component: sendria strategy: type: Recreate template: metadata: labels: app: fmn - deploymentconfig: sendria + component: sendria + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"sendria:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"sendria\")].image"}]' spec: containers: - name: sendria - image: sendria:latest + image: image-registry.openshift-image-registry.svc:5000/fmn/sendria:latest ports: - containerPort: 1025 - containerPort: 1080 @@ -623,14 +570,4 @@ spec: volumes: - name: data emptyDir: {} - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - sendria - from: - kind: ImageStreamTag - name: sendria:latest {% endif %} diff --git a/roles/openshift-apps/forgejo/tasks/register-runners.yaml b/roles/openshift-apps/forgejo/tasks/register-runners.yaml index 424bee10c5..d5ce4e1bd1 100644 --- a/roles/openshift-apps/forgejo/tasks/register-runners.yaml +++ b/roles/openshift-apps/forgejo/tasks/register-runners.yaml @@ -14,7 +14,7 @@ kubernetes.core.k8s_exec: namespace: forgejo pod: "{{ forgejo_pods.resources[0].metadata.name }}" - command: "forgejo forgejo-cli actions register --name {{ item.name }} --labels {{ item.labels | join(',') }} --secret {{ item.secret }}{{ ' --scope ' + item.scope if item.scope is defined and item.scope != 'global' else '' }}" + command: "forgejo forgejo-cli actions register --name {{ item['name'] }} --labels {{ item['labels'] | join(',') }} --secret {{ item['secret'] }}{{ ' --scope ' + item['scope'] if item['scope'] is defined and item['scope'] != 'global' else '' }}" loop: "{{ (env == 'production') | ternary(forgejo_runner_secrets, forgejo_stg_runner_secrets) }}" register: forgejo_cli_outputs failed_when: >- @@ -28,8 +28,8 @@ - name: Display CLI registration results ansible.builtin.debug: msg: | - Runner: {{ item.item.name }} - Labels: {{ item.item.labels | join(', ') }} - Status: {% if item.rc is defined and item.rc == 0 %}Registered{% elif 'duplicate key' in (item.stderr | default('')) + (item.msg | default('')) %}Already exists{% else %}Failed: {{ item.msg | default('unknown error') }}{% endif %} + Runner: {{ item['item']['name'] }} + Labels: {{ item['item']['labels'] | join(', ') }} + Status: {% if item['rc'] is defined and item['rc'] == 0 %}Registered{% elif 'duplicate key' in (item['stderr'] | default('')) + (item['msg'] | default('')) %}Already exists{% else %}Failed: {{ item['msg'] | default('unknown error') }}{% endif %} loop: "{{ forgejo_cli_outputs.results }}" when: forgejo_cli_outputs is defined diff --git a/roles/openshift-apps/forgejo/templates/forgejo-runnerhost-sa-vm.yaml.j2 b/roles/openshift-apps/forgejo/templates/forgejo-runnerhost-sa-vm.yaml.j2 deleted file mode 100644 index d4b206d96f..0000000000 --- a/roles/openshift-apps/forgejo/templates/forgejo-runnerhost-sa-vm.yaml.j2 +++ /dev/null @@ -1,104 +0,0 @@ ---- -apiVersion: template.openshift.io/v1 -kind: Template -metadata: - name: forgejo-runner-vm - annotations: - description: KubeVirt VM for running Forgejo Action runners with a mounted SA token disk. -parameters: - - name: VM_NAME - description: Name of the VirtualMachine - required: true - - name: NAMESPACE - description: Target namespace - value: forgejo - - name: INSTANCE_TYPE - description: VirtualMachineClusterInstanceType name - value: u1.xlarge - - name: DISK_SIZE - description: Root disk size - value: 30Gi - - name: VM_USER - description: Default VM user - value: fedora - - name: VM_PASSWORD - description: Default VM password (change after first login) - generate: expression - from: "[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}" - - name: SERVICE_ACCOUNT - description: ServiceAccount name for Kubernetes API access - value: forgejo-runner-vm - - name: SA_TOKEN_SECRET - description: Name of the Secret containing the SA token - value: forgejo-runner-vm-token -objects: - - apiVersion: kubevirt.io/v1 - kind: VirtualMachine - metadata: - name: ${VM_NAME} - namespace: ${NAMESPACE} - labels: - app: forgejo-runner - spec: - dataVolumeTemplates: - - metadata: - name: ${VM_NAME}-volume - spec: - sourceRef: - kind: DataSource - name: fedora - namespace: openshift-virtualization-os-images - storage: - resources: - requests: - storage: ${DISK_SIZE} - instancetype: - kind: virtualmachineclusterinstancetype - name: ${INSTANCE_TYPE} - preference: - kind: virtualmachineclusterpreference - name: fedora - runStrategy: Always - template: - metadata: - labels: - network.kubevirt.io/headlessService: headless - spec: - serviceAccountName: ${SERVICE_ACCOUNT} - architecture: amd64 - domain: - devices: - autoattachPodInterface: false - disks: - - name: sa-token-disk - disk: {} - serial: SATOKEN000001 - interfaces: - - masquerade: {} - name: default - machine: - type: pc-q35-rhel9.6.0 - resources: {} - networks: - - name: default - pod: {} - subdomain: headless - volumes: - - dataVolume: - name: ${VM_NAME}-volume - name: rootdisk - - cloudInitNoCloud: - userData: | - #cloud-config - chpasswd: - expire: false - password: "${VM_PASSWORD}" - user: "${VM_USER}" - bootcmd: - - "mkdir -p /mnt/sa-token" - - "mount /dev/$(lsblk --nodeps -no name,serial | grep SATOKEN000001 | cut -f1 -d' ') /mnt/sa-token" - name: cloudinitdisk - - name: sa-token-disk - secret: - secretName: ${SA_TOKEN_SECRET} - diff --git a/roles/openshift-apps/forgejo/templates/forgejo-runners.yaml.j2 b/roles/openshift-apps/forgejo/templates/forgejo-runners.yaml.j2 index 556a43886d..cc8bf93dc0 100644 --- a/roles/openshift-apps/forgejo/templates/forgejo-runners.yaml.j2 +++ b/roles/openshift-apps/forgejo/templates/forgejo-runners.yaml.j2 @@ -16,3 +16,7 @@ forgejo_instance_url: "{{ (env == 'production') | ternary(forgejo_runner_instanc # - secret: 40-character hex string for idempotent registration # forgejo_runners: {{ (env == 'production') | ternary(forgejo_runner_secrets, forgejo_stg_runner_secrets) }} + +# Configuration for the zabbix agent running on the runnerhost +forgejo_runnerhost_zabbix_agent_identity: {{ zabbix_tls_psk_identity }} +forgejo_runnerhost_zabbix_agent_psk: {{ (env == 'production') | ternary(zabbix_tls_prod_psk, zabbix_tls_stg_psk) }} diff --git a/roles/openshift-apps/forgejo/templates/values.yaml.j2 b/roles/openshift-apps/forgejo/templates/values.yaml.j2 index f013b5ee28..66d1abc5fd 100644 --- a/roles/openshift-apps/forgejo/templates/values.yaml.j2 +++ b/roles/openshift-apps/forgejo/templates/values.yaml.j2 @@ -551,6 +551,7 @@ gitea: "forge-legal-owners":{"legal":["Owners"]}, "forge-podcast-owners":{"podcast":["Owners"]}, "forge-discussion-owners":{"discussion":["Owners"]}, + "forge-discussion-members":{"discussion":["Members"]}, "forge-science-owners":{"science":["Owners"]}, "forge-science-members":{"science":["Members"]}, "forge-eln-owners":{"eln":["Owners"]}, @@ -558,7 +559,12 @@ gitea: "forge-koji-owners":{"koji":["Owners"]}, "forge-koji-members":{"koji":["Members"]}, "forge-i18n-owners":{"i18n":["Owners"]}, - "forge-i18n-members":{"i18n":["Members"]} + "forge-i18n-members":{"i18n":["Members"]}, + "forge-packaging-owners":{"packaging":["Owners"]}, + "forge-packaging-committee":{"packaging":["Committee"]}, + "forge-packaging-packager":{"packaging":["Packager"]}, + "forge-packaging-provenpackager":{"packaging":["ProvenPackager"]}, + "forge-dotnet-owners":{"dotnet":["Owners"]} }' {% endif %} # - name: 'OAuth 1' @@ -697,6 +703,7 @@ gitea: ENABLE_NOTIFY_MAIL: true DEFAULT_ORG_MEMBER_VISIBLE: true REGISTER_EMAIL_CONFIRM: true + AUTO_WATCH_NEW_REPOS: false ## @param gitea.config.ssh.minimum_key_sizes SSH minimum key sizes ssh.minimum_key_sizes: {} diff --git a/roles/openshift-apps/mdapi/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/mdapi/templates/deploymentconfig.yml.j2 deleted file mode 100644 index 58c37eea99..0000000000 --- a/roles/openshift-apps/mdapi/templates/deploymentconfig.yml.j2 +++ /dev/null @@ -1,57 +0,0 @@ ---- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig -metadata: - name: mdapi - labels: - app: mdapi - service: mdapi -spec: - replicas: 1 - selector: - app: mdapi - service: mdapi - template: - metadata: - labels: - app: mdapi - service: mdapi - spec: - containers: - - name: mdapi - image: registry/mdapi:latest - command: ["/metasource/meta"] - args: ["-location", "/var/tmp", "-loglevel", "info", "dispense", "-hostname", "mdapi{{ env_suffix }}.fedoraproject.org"] - ports: - - containerPort: 8080 - volumeMounts: - - name: data-volume - mountPath: /var/tmp/ - readinessProbe: - timeoutSeconds: 5 - initialDelaySeconds: 60 - periodSeconds: 60 - httpGet: - path: / - port: 8080 - livenessProbe: - timeoutSeconds: 15 - initialDelaySeconds: 60 - periodSeconds: 60 - httpGet: - path: / - port: 8080 - resources: - volumes: - - name: data-volume - persistentVolumeClaim: - claimName: mdapi-storage - triggers: - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - "mdapi" - from: - kind: ImageStreamTag - name: mdapi:latest diff --git a/roles/openshift-apps/mirrormanager/files/imagestream.yml b/roles/openshift-apps/mirrormanager/files/imagestream.yml index e96e0e370b..e6a732a2eb 100644 --- a/roles/openshift-apps/mirrormanager/files/imagestream.yml +++ b/roles/openshift-apps/mirrormanager/files/imagestream.yml @@ -7,11 +7,11 @@ items: kind: ImageStream metadata: name: mirrormanager2 - # The Python 3.11 builder image + # The Python 3.14 builder image - apiVersion: image.openshift.io/v1 kind: ImageStream metadata: - name: python-311 + name: python-314 spec: lookupPolicy: local: false @@ -19,13 +19,13 @@ items: - name: latest from: kind: DockerImage - name: quay.io/fedora/python-311:latest + name: quay.io/fedora/python-314:latest importPolicy: scheduled: true referencePolicy: type: Source - # The Python 3.11 builder image plus rust + # The Python 3.14 builder image plus rust - apiVersion: image.openshift.io/v1 kind: ImageStream metadata: - name: python-311-with-rust + name: python-314-with-rust diff --git a/roles/openshift-apps/mirrormanager/files/service.yml b/roles/openshift-apps/mirrormanager/files/service.yml index d2382eee79..467c1df254 100644 --- a/roles/openshift-apps/mirrormanager/files/service.yml +++ b/roles/openshift-apps/mirrormanager/files/service.yml @@ -8,7 +8,6 @@ metadata: spec: selector: app: mirrormanager - deploymentconfig: frontend ports: - name: web port: 8080 diff --git a/roles/openshift-apps/mirrormanager/templates/buildconfig.yml.j2 b/roles/openshift-apps/mirrormanager/templates/buildconfig.yml.j2 index d9746eeb22..33eefaf81f 100644 --- a/roles/openshift-apps/mirrormanager/templates/buildconfig.yml.j2 +++ b/roles/openshift-apps/mirrormanager/templates/buildconfig.yml.j2 @@ -1,13 +1,13 @@ {% macro load_file(filename) %}{% include filename %}{%- endmacro -%} --- -# Build a derivative of the python-311 builder image with Rust added to it +# Build a derivative of the python-314 builder image with Rust added to it apiVersion: build.openshift.io/v1 kind: BuildConfig metadata: - name: python-311-with-rust + name: python-314-with-rust labels: app: mirrormanager - build: python-311-with-rust + build: python-314-with-rust spec: runPolicy: Serial source: @@ -19,14 +19,15 @@ spec: dockerStrategy: from: kind: ImageStreamTag - # name: python:3.11 + # name: python:3.14 # namespace: openshift - # OpenShift does not have Python 3.11 (yet), use our own ImageStream - name: python-311:latest + # OpenShift does not have Python 3.14 (yet), use our own ImageStream + # (use `oc -n openshift describe is/python` to ckeck) + name: python-314:latest output: to: kind: ImageStreamTag - name: python-311-with-rust:latest + name: python-314-with-rust:latest triggers: - type: ImageChange @@ -53,7 +54,7 @@ spec: from: kind: ImageStreamTag # Our own ImageStream with rust added to it - name: python-311-with-rust:latest + name: python-314-with-rust:latest output: to: kind: ImageStreamTag diff --git a/roles/openshift-apps/mirrormanager/templates/deployment.yml.j2 b/roles/openshift-apps/mirrormanager/templates/deployment.yml.j2 new file mode 100644 index 0000000000..44347637c9 --- /dev/null +++ b/roles/openshift-apps/mirrormanager/templates/deployment.yml.j2 @@ -0,0 +1,42 @@ +{% from "_macros.yml.j2" import common_volume_mounts, common_volumes, common_env, security_context with context %} +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: frontend + labels: + app: mirrormanager +spec: + replicas: 1 + selector: + matchLabels: + app: mirrormanager + strategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 25% + maxUnavailable: 25% + template: + metadata: + labels: + app: mirrormanager + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"mirrormanager2:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"mirrormanager\")].image"}]' + spec: + containers: + - name: mirrormanager + image: image-registry.openshift-image-registry.svc:5000/mirrormanager/mirrormanager2:latest + imagePullPolicy: Always + ports: + - containerPort: 8080 + env: + - name: APP_MODULE + value: "deploy.wsgi" + - name: APP_CONFIG + value: "/etc/mirrormanager/gunicorn.conf.py" + {{ common_env() }} + volumeMounts: + {{ common_volume_mounts() }} + volumes: + {{ common_volumes() }} + {{ security_context() }} diff --git a/roles/openshift-apps/mirrormanager/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/mirrormanager/templates/deploymentconfig.yml.j2 deleted file mode 100644 index c395520633..0000000000 --- a/roles/openshift-apps/mirrormanager/templates/deploymentconfig.yml.j2 +++ /dev/null @@ -1,73 +0,0 @@ -{% from "_macros.yml.j2" import common_volume_mounts, common_volumes, common_env, security_context with context %} ---- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig -metadata: - name: frontend - labels: - app: mirrormanager -spec: - replicas: 1 - selector: - app: mirrormanager - deploymentconfig: frontend - strategy: - type: Rolling - activeDeadlineSeconds: 21600 - rollingParams: - intervalSeconds: 1 - maxSurge: 25% - maxUnavailable: 25% - timeoutSeconds: 600 - updatePeriodSeconds: 1 - template: - metadata: - creationTimestamp: null - labels: - app: mirrormanager - deploymentconfig: frontend - spec: - containers: - - name: mirrormanager - imagePullPolicy: Always - ports: - - containerPort: 8080 - env: - - name: APP_MODULE - value: "deploy.wsgi" - - name: APP_CONFIG - value: "/etc/mirrormanager/gunicorn.conf.py" - {{ common_env() }} - - # readinessProbe: - # timeoutSeconds: 10 - # initialDelaySeconds: 5 - # periodSeconds: 60 - # httpGet: - # path: "/healthz/ready" - # port: 8080 - # livenessProbe: - # timeoutSeconds: 10 - # initialDelaySeconds: 10 - # periodSeconds: 60 - # httpGet: - # path: "/healthz/live" - # port: 8080 - - volumeMounts: - {{ common_volume_mounts() }} - - volumes: - {{ common_volumes() }} - {{ security_context() }} - - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - mirrormanager - from: - kind: ImageStreamTag - name: mirrormanager2:latest diff --git a/roles/openshift-apps/noggin/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/noggin/templates/deployment.yml.j2 similarity index 82% rename from roles/openshift-apps/noggin/templates/deploymentconfig.yml.j2 rename to roles/openshift-apps/noggin/templates/deployment.yml.j2 index 6d956d4479..2b998bd2dd 100644 --- a/roles/openshift-apps/noggin/templates/deploymentconfig.yml.j2 +++ b/roles/openshift-apps/noggin/templates/deployment.yml.j2 @@ -1,6 +1,6 @@ --- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: name: noggin labels: @@ -8,33 +8,26 @@ metadata: spec: replicas: 1 selector: - app: {{ object_app }} - deploymentconfig: noggin + matchLabels: + app: {{ object_app }} strategy: - type: Rolling - activeDeadlineSeconds: 21600 - rollingParams: - intervalSeconds: 1 + type: RollingUpdate + rollingUpdate: maxSurge: 25% maxUnavailable: 25% - timeoutSeconds: 600 - updatePeriodSeconds: 1 template: metadata: - creationTimestamp: null labels: app: {{ object_app }} - deploymentconfig: noggin + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"noggin:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"noggin\")].image"}]' spec: containers: - name: noggin + image: image-registry.openshift-image-registry.svc:5000/{{ object_os_app }}/noggin:latest imagePullPolicy: Always ports: - containerPort: 8080 - # protocol: TCP - # resources: {} - # terminationMessagePath: /dev/termination-log - # terminationMessagePolicy: File volumeMounts: - name: noggin-config-volume mountPath: "/etc/noggin" @@ -119,13 +112,3 @@ spec: - name: ipa-config-volume configMap: name: ipa-client-config - triggers: - - imageChangeParams: - automatic: true - containerNames: - - noggin - from: - kind: ImageStreamTag - name: noggin:latest - type: ImageChange - - type: ConfigChange diff --git a/roles/openshift-apps/noggin/templates/service.yml.j2 b/roles/openshift-apps/noggin/templates/service.yml.j2 index 55d0e5748c..cf01756cee 100644 --- a/roles/openshift-apps/noggin/templates/service.yml.j2 +++ b/roles/openshift-apps/noggin/templates/service.yml.j2 @@ -12,4 +12,3 @@ spec: targetPort: 8080 selector: app: {{ object_app }} - deploymentconfig: noggin diff --git a/roles/openshift-apps/poddlers/templates/_macros.yml.j2 b/roles/openshift-apps/poddlers/templates/_macros.yml.j2 index 2a77769c2b..54767f684b 100644 --- a/roles/openshift-apps/poddlers/templates/_macros.yml.j2 +++ b/roles/openshift-apps/poddlers/templates/_macros.yml.j2 @@ -42,6 +42,8 @@ secret: secretName: keytab - name: temp-volume + emptyDir: {} + {% endmacro %} diff --git a/roles/openshift-apps/poddlers/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/poddlers/templates/deployment.yml.j2 similarity index 64% rename from roles/openshift-apps/poddlers/templates/deploymentconfig.yml.j2 rename to roles/openshift-apps/poddlers/templates/deployment.yml.j2 index f4786464b0..b399a3f539 100644 --- a/roles/openshift-apps/poddlers/templates/deploymentconfig.yml.j2 +++ b/roles/openshift-apps/poddlers/templates/deployment.yml.j2 @@ -1,8 +1,8 @@ {% from "_macros.yml.j2" import common_volume_mounts, common_volumes, common_env %} {% for toddler in poddlers_toddlers %} --- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: name: {{ toddler.name }} labels: @@ -10,19 +10,22 @@ metadata: spec: replicas: {{ toddler.replicas|default(1) }} selector: - app: poddlers - deploymentconfig: {{ toddler.name }} + matchLabels: + app: poddlers + deployment: {{ toddler.name }} strategy: type: Recreate template: metadata: labels: app: poddlers - deploymentconfig: {{ toddler.name }} + deployment: {{ toddler.name }} + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"toddlers:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"toddlers\")].image"}]' spec: containers: - name: toddlers - image: toddlers:latest + image: image-registry.openshift-image-registry.svc:5000/poddlers/toddlers:latest env: - name: FEDORA_MESSAGING_CONF value: /etc/fedora-messaging/{{ toddler.name }}.toml @@ -31,31 +34,18 @@ spec: value: /etc/sync-group-keytabs/sync-group.keytab {% endif -%} {{ common_env() }} - volumeMounts: {{ common_volume_mounts() }} - {% if toddler.name == "cleaning-packager-groups" -%} +{% if toddler.name == "cleaning-packager-groups" %} - name: sync-group-keytab-volume mountPath: /etc/sync-group-keytabs readOnly: true - {% endif %} - +{% endif %} volumes: {{ common_volumes() }} - {% if toddler.name == "cleaning-packager-groups" -%} +{% if toddler.name == "cleaning-packager-groups" %} - name: sync-group-keytab-volume secret: secretName: sync-group-keytab - {% endif %} - - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - toddlers - from: - kind: ImageStreamTag - name: toddlers:latest +{% endif %} {% endfor %} diff --git a/roles/openshift-apps/release-monitoring/files/service.yml b/roles/openshift-apps/release-monitoring/files/service.yml index d0d778e155..2f3499b0c5 100644 --- a/roles/openshift-apps/release-monitoring/files/service.yml +++ b/roles/openshift-apps/release-monitoring/files/service.yml @@ -13,4 +13,4 @@ spec: port: 8080 targetPort: 8080 selector: - deploymentconfig: release-monitoring-web + service: web diff --git a/roles/openshift-apps/release-monitoring/templates/deployment.yml.j2 b/roles/openshift-apps/release-monitoring/templates/deployment.yml.j2 new file mode 100644 index 0000000000..03e1db04ff --- /dev/null +++ b/roles/openshift-apps/release-monitoring/templates/deployment.yml.j2 @@ -0,0 +1,168 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: release-monitoring-web + service: web + name: release-monitoring-web +spec: + replicas: 1 + selector: + matchLabels: + app: release-monitoring-web + strategy: + type: Recreate + template: + metadata: + labels: + app: release-monitoring-web + service: web + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"release-monitoring-web:latest","namespace":"release-monitoring"},"fieldPath":"spec.template.spec.containers[?(@.name==\"release-monitoring-web\")].image"}]' + spec: + initContainers: + - name: alembic-upgrade + image: image-registry.openshift-image-registry.svc:5000/release-monitoring/release-monitoring-web:latest + command: ["/usr/bin/python3", "-m", "alembic", "-c", "/etc/anitya/alembic.ini", "upgrade", "head"] + volumeMounts: + - name: config-volume + mountPath: /etc/anitya + readOnly: true + containers: + - name: release-monitoring-web + image: image-registry.openshift-image-registry.svc:5000/release-monitoring/release-monitoring-web:latest + command: ["bash"] + args: ["/etc/anitya/start.sh"] + env: + - name: ANITYA_WEB_CONFIG + value: /etc/anitya/anitya.toml + ports: + - containerPort: 8080 + resources: {} + volumeMounts: + - name: config-volume + mountPath: /etc/anitya + readOnly: true + - name: fedora-messaging-config-volume + mountPath: /etc/fedora-messaging + readOnly: true + - name: fedora-messaging-ca-volume + mountPath: /etc/pki/rabbitmq/ca + readOnly: true + - name: fedora-messaging-key-volume + mountPath: /etc/pki/rabbitmq/key + readOnly: true + - name: fedora-messaging-cert-volume + mountPath: /etc/pki/rabbitmq/cert + readOnly: true + readinessProbe: + timeoutSeconds: 10 + initialDelaySeconds: 15 + httpGet: + path: / + port: 8080 + livenessProbe: + timeoutSeconds: 10 + initialDelaySeconds: 30 + httpGet: + path: / + port: 8080 + volumes: + - name: config-volume + configMap: + name: release-monitoring-configmap + - name: fedora-messaging-config-volume + configMap: + name: fedora-messaging-configmap + - name: fedora-messaging-ca-volume + secret: + secretName: release-monitoring-fedora-messaging-ca + - name: fedora-messaging-key-volume + secret: + secretName: release-monitoring-fedora-messaging-key + - name: fedora-messaging-cert-volume + secret: + secretName: release-monitoring-fedora-messaging-cert +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: release-monitoring-check-service + service: web + name: release-monitoring-check-service +spec: +{% if env == 'staging' %} + replicas: 0 +{% else %} + replicas: 1 +{% endif %} + selector: + matchLabels: + app: release-monitoring-check-service + strategy: + type: Recreate + template: + metadata: + labels: + app: release-monitoring-check-service + service: web + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"release-monitoring-web:latest","namespace":"release-monitoring"},"fieldPath":"spec.template.spec.containers[?(@.name==\"release-monitoring-web\")].image"}]' + spec: + initContainers: + - name: alembic-check + image: image-registry.openshift-image-registry.svc:5000/release-monitoring/release-monitoring-web:latest + command: ["/bin/bash", "-c"] + args: + - | + python3 -m alembic -c /etc/anitya/alembic.ini current | grep '(head)' + env: + - name: ANITYA_WEB_CONFIG + value: /etc/anitya/anitya.toml + volumeMounts: + - name: config-volume + mountPath: /etc/anitya + readOnly: true + containers: + - name: release-monitoring-web + image: image-registry.openshift-image-registry.svc:5000/release-monitoring/release-monitoring-web:latest + command: ["python3"] + args: ["/usr/local/bin/check_service"] + env: + - name: ANITYA_WEB_CONFIG + value: /etc/anitya/anitya.toml + resources: {} + volumeMounts: + - name: config-volume + mountPath: /etc/anitya + readOnly: true + - name: fedora-messaging-config-volume + mountPath: /etc/fedora-messaging + readOnly: true + - name: fedora-messaging-ca-volume + mountPath: /etc/pki/rabbitmq/ca + readOnly: true + - name: fedora-messaging-key-volume + mountPath: /etc/pki/rabbitmq/key + readOnly: true + - name: fedora-messaging-cert-volume + mountPath: /etc/pki/rabbitmq/cert + readOnly: true + volumes: + - name: config-volume + configMap: + name: release-monitoring-configmap + - name: fedora-messaging-config-volume + configMap: + name: fedora-messaging-configmap + - name: fedora-messaging-ca-volume + secret: + secretName: release-monitoring-fedora-messaging-ca + - name: fedora-messaging-key-volume + secret: + secretName: release-monitoring-fedora-messaging-key + - name: fedora-messaging-cert-volume + secret: + secretName: release-monitoring-fedora-messaging-cert diff --git a/roles/openshift-apps/release-monitoring/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/release-monitoring/templates/deploymentconfig.yml.j2 deleted file mode 100644 index dab3f952a9..0000000000 --- a/roles/openshift-apps/release-monitoring/templates/deploymentconfig.yml.j2 +++ /dev/null @@ -1,198 +0,0 @@ ---- -apiVersion: apps.openshift.io/v1 -items: -- apiVersion: apps.openshift.io/v1 - kind: DeploymentConfig - metadata: - labels: - app: release-monitoring-web - service: web - name: release-monitoring-web - spec: - replicas: 1 - selector: - deploymentconfig: release-monitoring-web - strategy: - activeDeadlineSeconds: 900 - recreateParams: - timeoutSeconds: 600 - mid: - failurePolicy: Abort - execNewPod: - containerName: release-monitoring-web - command: ["/usr/bin/python3", "-m", "alembic", "-c", "/etc/anitya/alembic.ini", "upgrade", "head"] - volumes: - - config-volume - resources: {} - type: Recreate - template: - metadata: - creationTimestamp: null - labels: - app: release-monitoring-web - deploymentconfig: release-monitoring-web - spec: - containers: - - name: release-monitoring-web - image: release-monitoring/release-monitoring-web:latest - command: - - bash - args: - - /etc/anitya/start.sh - env: - - name: ANITYA_WEB_CONFIG - value: /etc/anitya/anitya.toml - ports: - - containerPort: 8080 - resources: {} - volumeMounts: - - name: config-volume - mountPath: /etc/anitya - readOnly: true - - name: fedora-messaging-config-volume - mountPath: /etc/fedora-messaging - readOnly: true - - name: fedora-messaging-ca-volume - mountPath: /etc/pki/rabbitmq/ca - readOnly: true - - name: fedora-messaging-key-volume - mountPath: /etc/pki/rabbitmq/key - readOnly: true - - name: fedora-messaging-cert-volume - mountPath: /etc/pki/rabbitmq/cert - readOnly: true - readinessProbe: - timeoutSeconds: 10 - initialDelaySeconds: 15 - httpGet: - path: / - port: 8080 - livenessProbe: - timeoutSeconds: 10 - initialDelaySeconds: 30 - httpGet: - path: / - port: 8080 - volumes: - - name: config-volume - configMap: - name: release-monitoring-configmap - - name: fedora-messaging-config-volume - configMap: - name: fedora-messaging-configmap - - name: fedora-messaging-ca-volume - secret: - secretName: release-monitoring-fedora-messaging-ca - - name: fedora-messaging-key-volume - secret: - secretName: release-monitoring-fedora-messaging-key - - name: fedora-messaging-cert-volume - secret: - secretName: release-monitoring-fedora-messaging-cert - triggers: - - imageChangeParams: - automatic: true - containerNames: - - release-monitoring-web - from: - kind: ImageStreamTag - name: release-monitoring-web:latest - namespace: release-monitoring - type: ImageChange -- apiVersion: apps.openshift.io/v1 - kind: DeploymentConfig - metadata: - labels: - app: release-monitoring-check-service - service: web - name: release-monitoring-check-service - spec: -{% if env == 'staging' %} - replicas: 0 -{% else %} - replicas: 1 -{% endif %} - selector: - deploymentconfig: release-monitoring-check-service - strategy: - activeDeadlineSeconds: 900 - recreateParams: - timeoutSeconds: 30 - mid: - failurePolicy: Retry - execNewPod: - containerName: release-monitoring-web - command: - - /bin/bash - - -c - - | - python3 -m alembic -c /etc/anitya/alembic.ini current | grep '(head)' - env: - - name: ANITYA_WEB_CONFIG - value: /etc/anitya/anitya.toml - volumes: - - config-volume - resources: {} - type: Recreate - template: - metadata: - creationTimestamp: null - labels: - app: release-monitoring-check-service - deploymentconfig: release-monitoring-check-service - spec: - containers: - - name: release-monitoring-web - image: release-monitoring/release-monitoring-web:latest - command: - - python3 - args: - - /usr/local/bin/check_service - env: - - name: ANITYA_WEB_CONFIG - value: /etc/anitya/anitya.toml - resources: {} - volumeMounts: - - name: config-volume - mountPath: /etc/anitya - readOnly: true - - name: fedora-messaging-config-volume - mountPath: /etc/fedora-messaging - readOnly: true - - name: fedora-messaging-ca-volume - mountPath: /etc/pki/rabbitmq/ca - readOnly: true - - name: fedora-messaging-key-volume - mountPath: /etc/pki/rabbitmq/key - readOnly: true - - name: fedora-messaging-cert-volume - mountPath: /etc/pki/rabbitmq/cert - readOnly: true - volumes: - - name: config-volume - configMap: - name: release-monitoring-configmap - - name: fedora-messaging-config-volume - configMap: - name: fedora-messaging-configmap - - name: fedora-messaging-ca-volume - secret: - secretName: release-monitoring-fedora-messaging-ca - - name: fedora-messaging-key-volume - secret: - secretName: release-monitoring-fedora-messaging-key - - name: fedora-messaging-cert-volume - secret: - secretName: release-monitoring-fedora-messaging-cert - triggers: - - imageChangeParams: - automatic: true - containerNames: - - release-monitoring-web - from: - kind: ImageStreamTag - name: release-monitoring-web:latest - namespace: release-monitoring - type: ImageChange -kind: List -metadata: {} diff --git a/roles/openshift-apps/testdays/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/testdays/templates/deploymentconfig.yml.j2 deleted file mode 100644 index 02b93c7eb5..0000000000 --- a/roles/openshift-apps/testdays/templates/deploymentconfig.yml.j2 +++ /dev/null @@ -1,124 +0,0 @@ ---- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig -metadata: - labels: - app: testdays-old - service: testdays-old - name: testdays -spec: - replicas: 0 - selector: - app: testdays-old - deploymentconfig: testdays - strategy: - type: Recreate - recreateParams: - mid: - failurePolicy: Abort - execNewPod: - containerName: testdays - # We only need to init the database the first time, after we just need to check - # for DB upgrades - command: ["python", "/opt/app-root/src/testdays/cli.py", "init_db"] - template: - metadata: - labels: - app: testdays-old - deploymentconfig: testdays - spec: - containers: - - name: testdays - image: testdays:latest - ports: - - containerPort: 8080 - resources: {} - env: - - name: POSTGRESQL_USER - value: "{{ testdays_db_user }}" - - name: POSTGRESQL_PASSWORD - value: "{{ testdays_db_pass }}" - - name: POSTGRESQL_DATABASE - value: "{{ testdays_db_name }}" - - name: POSTGRESQL_SERVICE_HOST - value: "db01{{ env_suffix }}.rdu3.fedoraproject.org" - - name: POSTGRESQL_SERVICE_PORT - value: "5432" - - name: SECRET_KEY - value: "{{ testdays_secret_key }}" - - name: RESULTSDB_URL - value: "http://resultsdb.testdays.svc.cluster.local:8081/api/v2.0" - - name: OPENSHIFT_PROD - value: "1" - - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - testdays - from: - kind: ImageStreamTag - name: testdays:latest ---- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig -metadata: - labels: - app: resultsdb-old - service: resultsdb-old - name: resultsdb -spec: - replicas: 0 - selector: - app: resultsdb-old - deploymentconfig: resultsdb - strategy: - type: Recreate - recreateParams: - mid: - failurePolicy: Abort - execNewPod: - containerName: resultsdb - # We only need to init the database the first time, after we just need to check - # for DB upgrades - command: ["python", "/opt/app-root/src/resultsdb/cli.py", "init_db"] - template: - metadata: - labels: - app: resultsdb-old - deploymentconfig: resultsdb - spec: - containers: - - name: resultsdb - image: resultsdb:latest - ports: - - containerPort: 8080 - resources: {} - env: - - name: POSTGRESQL_USER - value: "{{ resultsdb_testdays_db_user }}" - - name: POSTGRESQL_PASSWORD - value: "{{ resultsdb_testdays_db_pass }}" - - name: POSTGRESQL_DATABASE - value: "{{ resultsdb_testdays_db_name }}" - - name: POSTGRESQL_SERVICE_HOST - value: "db01{{ env_suffix }}.rdu3.fedoraproject.org" - - name: POSTGRESQL_SERVICE_PORT - value: "5432" - - name: SECRET_KEY - value: "{{ resultsdb_testdays_secret_key }}" - - name: OPENSHIFT_PROD - value: "1" - - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - resultsdb - from: - kind: ImageStreamTag - name: resultsdb:latest diff --git a/roles/openshift-apps/the-new-hotness/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/the-new-hotness/templates/deploymentconfig.yml.j2 deleted file mode 100644 index 4b8e321555..0000000000 --- a/roles/openshift-apps/the-new-hotness/templates/deploymentconfig.yml.j2 +++ /dev/null @@ -1,122 +0,0 @@ ---- -apiVersion: apps.openshift.io/v1 -items: -- apiVersion: apps.openshift.io/v1 - kind: DeploymentConfig - metadata: - labels: - app: the-new-hotness - service: the-new-hotness - name: the-new-hotness - spec: - replicas: 1 - selector: - deploymentconfig: the-new-hotness - strategy: - activeDeadlineSeconds: 21600 - recreateParams: - timeoutSeconds: 600 - type: Recreate - template: - metadata: - creationTimestamp: null - labels: - app: the-new-hotness - deploymentconfig: the-new-hotness - spec: - containers: - - name: the-new-hotness - image: the-new-hotness/the-new-hotness:latest - command: ["fedora-messaging", "consume"] - env: - - name: RPM_PACKAGER - value: hotness - volumeMounts: - - name: keytab-volume - mountPath: /etc/keytabs - readOnly: true - - name: config-volume - mountPath: /etc/fedora-messaging - readOnly: true - - name: fedora-messaging-ca-volume - mountPath: /etc/pki/rabbitmq/ca - readOnly: true - - name: fedora-messaging-key-volume - mountPath: /etc/pki/rabbitmq/key - readOnly: true - - name: fedora-messaging-cert-volume - mountPath: /etc/pki/rabbitmq/cert - readOnly: true - - name: temp-volume - mountPath: /var/tmp - - name: krb-config-volume - mountPath: /etc/krb5 - readOnly: true - volumes: - - name: config-volume - configMap: - name: the-new-hotness-configmap - - name: fedora-messaging-ca-volume - secret: - secretName: the-new-hotness-fedora-messaging-ca - - name: fedora-messaging-key-volume - secret: - secretName: the-new-hotness-fedora-messaging-key - - name: fedora-messaging-cert-volume - secret: - secretName: the-new-hotness-fedora-messaging-cert - - name: temp-volume - - name: keytab-volume - secret: - secretName: the-new-hotness-keytab - - name: krb-config-volume - configMap: - name: krb5-configmap - triggers: - - imageChangeParams: - automatic: true - containerNames: - - the-new-hotness - from: - kind: ImageStreamTag - name: the-new-hotness:latest - namespace: the-new-hotness - type: ImageChange - - type: ConfigChange -- apiVersion: apps.openshift.io/v1 - kind: DeploymentConfig - metadata: - labels: - app: the-new-hotness - service: the-new-hotness-redis - name: the-new-hotness-redis - spec: - replicas: 1 # Never change this to more or less than ONE! - selector: - app: the-new-hotness - deploymentconfig: the-new-hotness-redis - template: - metadata: - labels: - app: the-new-hotness - deploymentconfig: the-new-hotness-redis - spec: - containers: - - name: the-new-hotness-redis - image: the-new-hotness-redis:latest - resources: {} - env: - - name: REDIS_PASSWORD - value: "{{ hotness_redis_pass }}" - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - the-new-hotness-redis - from: - kind: ImageStreamTag - name: the-new-hotness-redis:latest -kind: List -metadata: {} diff --git a/roles/openshift-apps/transtats/files/deploymentconfig.yml b/roles/openshift-apps/transtats/files/deploymentconfig.yml deleted file mode 100644 index 7acdbd4413..0000000000 --- a/roles/openshift-apps/transtats/files/deploymentconfig.yml +++ /dev/null @@ -1,79 +0,0 @@ ---- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig -metadata: - name: transtats-web - labels: - app: transtats - service: web -spec: - replicas: 2 - selector: - app: transtats - service: web - template: - metadata: - labels: - app: transtats - service: web - spec: - containers: - - name: web - image: transtats - ports: - - containerPort: 8080 - env: - - name: GUNICORN_CMD_ARGS - value: "--workers 3 --bind 0.0.0.0:8080 --timeout 500" - - name: DATABASE_ENGINE - value: postgresql - - name: DATABASE_NAME - valueFrom: - secretKeyRef: - name: transtats-secret - key: database-name - - name: DATABASE_HOST - valueFrom: - secretKeyRef: - name: transtats-secret - key: database-host - - name: DATABASE_USER - valueFrom: - secretKeyRef: - name: transtats-secret - key: database-user - - name: DATABASE_PASSWORD - valueFrom: - secretKeyRef: - name: transtats-secret - key: database-password - readinessProbe: - timeoutSeconds: 1 - initialDelaySeconds: 5 - httpGet: - path: /health - port: 8080 - livenessProbe: - timeoutSeconds: 1 - initialDelaySeconds: 30 - httpGet: - path: /health - port: 8080 - # TODO: re-evaluate these limits once we know how much memory is actually needed - resources: - requests: - cpu: 500m - memory: 1024Mi - limits: - cpu: 2000m - memory: 2048Mi - triggers: - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - web - from: - kind: ImageStreamTag - name: transtats:latest - - type: ConfigChange diff --git a/roles/openshift-apps/webhook2fedmsg/files/service.yml b/roles/openshift-apps/webhook2fedmsg/files/service.yml index 42ddb7e745..d62efa9717 100644 --- a/roles/openshift-apps/webhook2fedmsg/files/service.yml +++ b/roles/openshift-apps/webhook2fedmsg/files/service.yml @@ -12,4 +12,3 @@ spec: targetPort: 8080 selector: app: webhook2fedmsg - deploymentconfig: app diff --git a/roles/openshift-apps/webhook2fedmsg/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/webhook2fedmsg/templates/deployment.yml.j2 similarity index 66% rename from roles/openshift-apps/webhook2fedmsg/templates/deploymentconfig.yml.j2 rename to roles/openshift-apps/webhook2fedmsg/templates/deployment.yml.j2 index 7d4a14277b..ec7341211a 100644 --- a/roles/openshift-apps/webhook2fedmsg/templates/deploymentconfig.yml.j2 +++ b/roles/openshift-apps/webhook2fedmsg/templates/deployment.yml.j2 @@ -1,6 +1,6 @@ --- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: labels: app: webhook2fedmsg @@ -9,27 +9,39 @@ metadata: spec: replicas: 1 selector: - app: webhook2fedmsg - deploymentconfig: app + matchLabels: + app: webhook2fedmsg + service: webhook2fedmsg strategy: type: Recreate - recreateParams: - mid: - execNewPod: - command: [/opt/app-root/bin/w2fm, setup] - containerName: app - volumes: - - config - failurePolicy: Abort template: metadata: labels: app: webhook2fedmsg - deploymentconfig: app + service: webhook2fedmsg + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"webhook2fedmsg:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"app\")].image"}]' spec: + initContainers: + - name: setup + image: image-registry.openshift-image-registry.svc:5000/webhook2fedmsg/webhook2fedmsg:latest + command: ["/opt/app-root/bin/w2fm", "setup"] + volumeMounts: + - name: config + mountPath: "/etc/webhook-to-fedora-messaging" + readOnly: true + - name: ipa-config-volume + mountPath: /etc/ipa + readOnly: true + - name: keytab-volume + mountPath: /etc/keytabs + readOnly: true + - name: fedora-messaging-config + mountPath: "/etc/fedora-messaging" + readOnly: true containers: - - image: webhook2fedmsg:latest - name: app + - name: app + image: image-registry.openshift-image-registry.svc:5000/webhook2fedmsg/webhook2fedmsg:latest env: - name: KRB5_CONFIG value: /etc/ipa/krb5.conf @@ -63,20 +75,6 @@ spec: mountPath: /etc/pki/fedora-messaging/webhook2fedmsg-key.pem subPath: webhook2fedmsg-key.pem readOnly: true - # readinessProbe: - # timeoutSeconds: 10 - # initialDelaySeconds: 5 - # periodSeconds: 60 - # httpGet: - # path: "/api/v1/healthz/ready" - # port: 8080 - # livenessProbe: - # timeoutSeconds: 10 - # initialDelaySeconds: 3 - # periodSeconds: 60 - # httpGet: - # path: "/api/v1/healthz/live" - # port: 8080 volumes: - name: config configMap: @@ -99,14 +97,3 @@ spec: - name: fedora-messaging-key secret: secretName: fedora-messaging-key - - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - app - from: - kind: ImageStreamTag - name: webhook2fedmsg:latest diff --git a/roles/openshift-apps/zezere/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/zezere/templates/deploymentconfig.yml.j2 deleted file mode 100644 index 420e2c7853..0000000000 --- a/roles/openshift-apps/zezere/templates/deploymentconfig.yml.j2 +++ /dev/null @@ -1,89 +0,0 @@ ---- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig -metadata: - labels: - app: zezere - service: zezere - name: zezere -spec: - replicas: 1 - selector: - deploymentconfig: zezere - strategy: - activeDeadlineSeconds: 21600 - recreateParams: - timeoutSeconds: 600 - template: - metadata: - labels: - app: zezere - deploymentconfig: zezere - spec: - containers: - - name: zezere - image: image-registry.openshift-image-registry.svc:5000/zezere/zezere:latest - env: - - name: ALLOWED_HOSTS - value: "*" - - name: WEB_CONCURRENCY - value: "8" - - name: SECRET_KEY - valueFrom: - secretKeyRef: - name: zezere - key: secret_key - - name: DEBUG - value: "no" - - name: AUTH_METHOD - value: "oidc" - - name: OIDC_OP_AUTHORIZATION_ENDPOINT - value: "https://id{{ env_suffix }}.fedoraproject.org/openidc/Authorization" - - name: OIDC_OP_TOKEN_ENDPOINT - value: "https://id{{ env_suffix }}.fedoraproject.org/openidc/Token" - - name: OIDC_OP_USER_ENDPOINT - value: "https://id{{ env_suffix }}.fedoraproject.org/openidc/UserInfo" - - name: OIDC_OP_JWKS_ENDPOINT - value: "https://id{{ env_suffix }}.fedoraproject.org/openidc/Jwks" - - name: OIDC_RP_CLIENT_ID - value: "provisionfpo" - - name: OIDC_RP_CLIENT_SECRET - valueFrom: - secretKeyRef: - name: zezere - key: oidc_client_secret - - name: OIDC_RP_SIGN_ALGO - value: "RS256" - - name: SECURE_PROXY_SSL_HEADER_NAME - value: "HTTP_X_FORWARDED_PROTO" - - name: SECURE_PROXY_SSL_HEADER_VALUE - value: "https" - - name: DATABASE_engine - value: "django.db.backends.postgresql_psycopg2" - - name: DATABASE_host - value: "db01{{ env_suffix }}.{{datacenter}}.fedoraproject.org" - - name: DATABASE_name - value: "zezere" - - name: DATABASE_user - value: "zezere" - - name: DATABASE_password - valueFrom: - secretKeyRef: - name: zezere - key: database_password - ports: - - containerPort: 8080 - readinessProbe: - timeoutSeconds: 1 - initialDelaySeconds: 5 - httpGet: - path: /netboot - port: 8080 - livenessProbe: - timeoutSeconds: 1 - initialDelaySeconds: 30 - httpGet: - path: /netboot - port: 8080 - triggers: - - type: ConfigChange diff --git a/roles/openshift/cluster/tasks/main.yaml b/roles/openshift/cluster/tasks/main.yaml index c24717402e..6e7eb2a0b4 100644 --- a/roles/openshift/cluster/tasks/main.yaml +++ b/roles/openshift/cluster/tasks/main.yaml @@ -33,3 +33,7 @@ notify: Apply changes to openshift tags: - create-resources + +# Disable users from creating projects + - name: disable default user project creation + ansible.builtin.command: oc adm policy remove-cluster-role-from-group self-provisioner system:authenticated:oauth diff --git a/roles/people/files/robots.txt b/roles/people/files/robots.txt index 45c26312ca..8e7f594a0e 100644 --- a/roles/people/files/robots.txt +++ b/roles/people/files/robots.txt @@ -1,4 +1,2 @@ User-agent: * -Disallow: /cgit/*.tar.xz -Disallow: /cgit/*.tar.gz -Disallow: /cgit/*.zip +Disallow: /cgit diff --git a/roles/people/files/rsyslog-logrotate b/roles/people/files/rsyslog-logrotate new file mode 100644 index 0000000000..8804bce6cc --- /dev/null +++ b/roles/people/files/rsyslog-logrotate @@ -0,0 +1,17 @@ +/var/log/cron +/var/log/maillog +/var/log/messages +/var/log/secure +/var/log/spooler +{ + missingok + sharedscripts + postrotate + /usr/bin/systemctl reload rsyslog.service >/dev/null 2>&1 || true + endscript + compress + compresscmd /usr/bin/xz + uncompresscmd /usr/bin/xz + compressext .xz + dateext +} diff --git a/roles/people/tasks/main.yml b/roles/people/tasks/main.yml index 49560ee16c..f259bc2113 100644 --- a/roles/people/tasks/main.yml +++ b/roles/people/tasks/main.yml @@ -308,3 +308,14 @@ - config notify: - Restart sssd + +# We don't have much space on / and anubis makes messages big, default +# doesn't compress rotations and this does. +- name: People log rotate + ansible.builtin.copy: src=rsyslog-logrotate dest=/etc/logrotate.d/rsyslog mode=0644 + notify: + - Restart rsyslog + tags: + - rsyslogd + - config + - base diff --git a/roles/people/templates/people.conf b/roles/people/templates/people.conf index 809735b5f7..3e18e101fb 100644 --- a/roles/people/templates/people.conf +++ b/roles/people/templates/people.conf @@ -43,6 +43,54 @@ NameVirtualHost *:80 ErrorLog logs/fedorapeople.org-error.log CustomLog logs/fedorapeople.org-access.log vcombined + # proxy all requests to anubis after ssl termination + + RequestHeader set "X-Real-Ip" expr=%{REMOTE_ADDR} + RequestHeader set X-Forwarded-Proto "https" + RequestHeader set "X-Http-Version" "%{SERVER_PROTOCOL}s" + # Pagure uses X-Scheme, not X-Forwarded-Proto, see pagure/proxy.py + RequestHeader set X-Scheme "https" + + ProxyPreserveHost On + + ProxyRequests Off + ProxyVia Off + + ProxyPass / http://[::1]:8923/ + ProxyPassReverse / http://[::1]:8923/ + + + SetHandler server-status + + Require ip 127.0.0.1 + Require ip ::1 + Require host localhost + + + + + +# Once anubis has processed the request it sends it to port 3923 + +Listen 3923 http + + + # Don't redirect to :3923 + # This fixes the redirects but breaks ols.fp.o and .fp.o pages. + # UseCanonicalName On + + ServerName fedorapeople.org + ServerAlias *.fedorapeople.org + ServerAlias ols.fedoraproject.org + ServerAlias people.fedoraproject.org + ServerAlias people1.fedoraproject.org + ServerAdmin admin@fedoraproject.org + + DocumentRoot /srv/people/site + + RemoteIPHeader X-Real-Ip + RemoteIPInternalProxy ::1 + ExpiresActive On ExpiresDefault "access plus 30 minutes" diff --git a/roles/pkgdb-proxy/files/pkgdb-gnome-software-collections.json b/roles/pkgdb-proxy/files/pkgdb-gnome-software-collections.json index d9d63fcdcc..5bed8416ac 100644 --- a/roles/pkgdb-proxy/files/pkgdb-gnome-software-collections.json +++ b/roles/pkgdb-proxy/files/pkgdb-gnome-software-collections.json @@ -15,11 +15,11 @@ "allow_retire": true, "branchname": "f44", "date_created": "2026-02-03 14:30:00", - "date_updated": "2026-02-03 14:30:00", + "date_updated": "2026-04-28 14:30:00", "dist_tag": ".fc44", "koji_name": "f44", "name": "Fedora Linux", - "status": "Under Development", + "status": "Active", "version": "44" }, { diff --git a/roles/robosignatory/templates/robosignatory.toml.j2 b/roles/robosignatory/templates/robosignatory.toml.j2 index 154c879d69..e83ce598b0 100644 --- a/roles/robosignatory/templates/robosignatory.toml.j2 +++ b/roles/robosignatory/templates/robosignatory.toml.j2 @@ -413,10 +413,10 @@ handlers = ["console"] [consumer_config.ostree_refs."fedora/stable/x86_64/iot"] directory = "/mnt/fedora_koji/koji/compose/iot/repo/" - key = "{{ (env == 'production')|ternary('fedora-43', 'testkey') }}" + key = "{{ (env == 'production')|ternary('fedora-44', 'testkey') }}" [consumer_config.ostree_refs."fedora/stable/aarch64/iot"] directory = "/mnt/fedora_koji/koji/compose/iot/repo/" - key = "{{ (env == 'production')|ternary('fedora-43', 'testkey') }}" + key = "{{ (env == 'production')|ternary('fedora-44', 'testkey') }}" # f42 silveblue ostree refs diff --git a/roles/siguldry/bridge/handlers/main.yml b/roles/siguldry/bridge/handlers/main.yml new file mode 100644 index 0000000000..4dc212b8ec --- /dev/null +++ b/roles/siguldry/bridge/handlers/main.yml @@ -0,0 +1,8 @@ +--- +- name: Restart siguldry-bridge + ansible.builtin.systemd: + name: siguldry-bridge.service + state: restarted + tags: + - siguldry + - siguldry/bridge diff --git a/roles/siguldry/bridge/tasks/main.yml b/roles/siguldry/bridge/tasks/main.yml new file mode 100644 index 0000000000..790ca8fe1f --- /dev/null +++ b/roles/siguldry/bridge/tasks/main.yml @@ -0,0 +1,116 @@ +--- +- name: Install siguldry package + ansible.builtin.package: + state: present + name: siguldry + tags: + - packages + - siguldry + - siguldry/bridge + +# We only need to grant the service explicit access to the TPM on systemd < 258 +- name: Get systemd version + ansible.builtin.command: systemctl --version + register: systemd_version_output + changed_when: systemd_version_output.rc != 0 + +- name: Set whether explicit AllowDevice override is needed + ansible.builtin.set_fact: + explicit_allow_tpm: "{{ (systemd_version_output.stdout_lines[0] | regex_search('\\d+') | int) < 258 }}" + +- name: Create siguldry config directory + ansible.builtin.file: + path: /etc/siguldry + state: directory + owner: root + group: root + mode: '0755' + tags: + - config + - siguldry + - siguldry/bridge + +- name: Create credstore.encrypted directory + ansible.builtin.file: + path: /etc/credstore.encrypted + state: directory + owner: root + group: root + mode: '0700' + tags: + - config + - siguldry + - siguldry/bridge + +- name: Create siguldry-bridge systemd override directory + ansible.builtin.file: + path: /etc/systemd/system/siguldry-bridge.service.d + state: directory + owner: root + group: root + mode: '0755' + tags: + - config + - siguldry + - siguldry/bridge + +- name: Setup siguldry-bridge systemd override file + ansible.builtin.template: + src: override.conf.j2 + dest: /etc/systemd/system/siguldry-bridge.service.d/override.conf + owner: root + group: root + mode: '0644' + notify: Restart siguldry-bridge + tags: + - config + - siguldry + - siguldry/bridge + +- name: Setup siguldry-bridge config file + ansible.builtin.template: + src: bridge.toml.j2 + dest: /etc/siguldry/bridge.toml + owner: root + group: root + mode: '0644' + notify: Restart siguldry-bridge + tags: + - config + - siguldry + - siguldry/bridge + +- name: Setup bridge certificate + ansible.builtin.copy: + src: "{{ private }}/files/siguldryca/{{ env }}/pki/issued/siguldry-bridge.crt" + dest: /etc/siguldry/bridge.crt + owner: root + group: root + mode: '0644' + tags: + - config + - siguldry + - siguldry/bridge + +- name: Setup CA certificate + ansible.builtin.copy: + src: "{{ private }}/files/siguldryca/{{ env }}/pki/ca.crt" + dest: /etc/siguldry/ca.crt + owner: root + group: root + mode: '0644' + tags: + - config + - siguldry + - siguldry/bridge + +- name: Enable and start siguldry-bridge service + ansible.builtin.systemd: + name: siguldry-bridge.service + enabled: yes + state: started + daemon_reload: yes + tags: + - services + - siguldry + - siguldry/bridge diff --git a/roles/siguldry/bridge/templates/bridge.toml.j2 b/roles/siguldry/bridge/templates/bridge.toml.j2 new file mode 100644 index 0000000000..4b2a168565 --- /dev/null +++ b/roles/siguldry/bridge/templates/bridge.toml.j2 @@ -0,0 +1,21 @@ +# The socket address to listen on for incoming connections from Siguldry servers. +# +# The default is to listen on all interfaces on port 44333. +server_listening_address = "[::]:44333" + +# The socket address to listen on for incoming connections from Siguldry clients. +# +# The default is to listen on all interfaces on port 44334. +client_listening_address = "[::]:44334" + +# The TLS credentials for the server and client listeners. +# +# Both clients and servers connect to the above addresses and perform mutual TLS. +# Note that the certificate must have `serverAuth` in its extended key usage extension. +# +# Paths that aren't absolute are loaded relative to systemd's credentials directory, +# which are encrypted, see https://systemd.io/CREDENTIALS/ +[credentials] +private_key = "siguldry.bridge.private_key.pem" +certificate = "/etc/siguldry/bridge.crt" +ca_certificate = "/etc/siguldry/ca.crt" diff --git a/roles/siguldry/bridge/templates/override.conf.j2 b/roles/siguldry/bridge/templates/override.conf.j2 new file mode 100644 index 0000000000..a33171f49c --- /dev/null +++ b/roles/siguldry/bridge/templates/override.conf.j2 @@ -0,0 +1,12 @@ +[Service] +# Tweak for lower/higher log verbosity. +# Refer to https://docs.rs/tracing-subscriber/0.3.19/tracing_subscriber/filter/struct.EnvFilter.html#directives +Environment=SIGULDRY_BRIDGE_LOG="WARN,siguldry=INFO" + +{% if explicit_allow_tpm %} +# Credentials require the TPM to decrypt. +# +# For systemd 257 and older you'll need to explicitly allow access to the TPM +# Refer to https://github.com/systemd/systemd/issues/35959. +DeviceAllow=/dev/tpmrm0 +{% endif %} diff --git a/roles/siguldry/server/defaults/main.yml b/roles/siguldry/server/defaults/main.yml new file mode 100644 index 0000000000..45d5f3c18c --- /dev/null +++ b/roles/siguldry/server/defaults/main.yml @@ -0,0 +1,7 @@ +--- + +siguldry_kryoptic_conf: "/etc/siguldry/kryoptic.toml" +siguldry_kryoptic_db: "/var/lib/siguldry/kryoptic.sqlite" + +siguldry_kryoptic_so_pin: "12345678" +siguldry_kryoptic_user_pin: "123456" diff --git a/roles/siguldry/server/handlers/main.yml b/roles/siguldry/server/handlers/main.yml new file mode 100644 index 0000000000..a956d31dca --- /dev/null +++ b/roles/siguldry/server/handlers/main.yml @@ -0,0 +1,8 @@ +--- +- name: Restart siguldry-server + ansible.builtin.systemd: + name: siguldry-server.service + state: restarted + tags: + - siguldry + - siguldry/server diff --git a/roles/siguldry/server/tasks/kryoptic.yml b/roles/siguldry/server/tasks/kryoptic.yml new file mode 100644 index 0000000000..bb474bd97c --- /dev/null +++ b/roles/siguldry/server/tasks/kryoptic.yml @@ -0,0 +1,151 @@ +--- +# For staging, use Kryoptic as a software HSM for binding +- name: Install kryoptic and PKCS#11 tools (staging only) + ansible.builtin.package: + state: present + name: + - kryoptic + - opensc + - openssl + - pkcs11-provider + tags: + - packages + - siguldry + - siguldry/server + +- name: Setup kryoptic configuration + ansible.builtin.template: + src: kryoptic.toml.j2 + dest: "{{ siguldry_kryoptic_conf }}" + owner: root + group: root + mode: '0644' + tags: + - config + - siguldry + - siguldry/server + +- name: Check if kryoptic token is initialized + ansible.builtin.stat: + path: "{{ siguldry_kryoptic_db }}" + register: kryoptic_db + tags: + - config + - siguldry + - siguldry/server + +- name: Initialize kryoptic PKCS#11 token + ansible.builtin.command: + cmd: >- + pkcs11-tool + --module /usr/lib64/pkcs11/libkryoptic_pkcs11.so + --init-token + --label siguldry-stg-token + --so-pin env:KRYOPTIC_SO_PIN + environment: + KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}" + KRYOPTIC_SO_PIN: "{{ siguldry_kryoptic_so_pin }}" + when: not kryoptic_db.stat.exists + tags: + - config + - siguldry + - siguldry/server + +- name: Initialize kryoptic user PIN + ansible.builtin.command: + cmd: >- + pkcs11-tool + --module /usr/lib64/pkcs11/libkryoptic_pkcs11.so + --login + --so-pin env:KRYOPTIC_SO_PIN + --init-pin + --new-pin env:KRYOPTIC_USER_PIN + environment: + KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}" + KRYOPTIC_SO_PIN: "{{ siguldry_kryoptic_so_pin }}" + KRYOPTIC_USER_PIN: "{{ siguldry_kryoptic_user_pin }}" + when: not kryoptic_db.stat.exists + tags: + - config + - siguldry + - siguldry/server + +- name: Check for existing binding key + ansible.builtin.command: + cmd: >- + pkcs11-tool + --module /usr/lib64/pkcs11/libkryoptic_pkcs11.so + --login + --pin env:KRYOPTIC_USER_PIN + --list-objects + --type privkey + environment: + KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}" + KRYOPTIC_USER_PIN: "{{ siguldry_kryoptic_user_pin }}" + register: kryoptic_objects + changed_when: false + tags: + - config + - siguldry + - siguldry/server + +- name: Generate RSA binding key pair + ansible.builtin.command: + cmd: >- + pkcs11-tool + --module /usr/lib64/pkcs11/libkryoptic_pkcs11.so + --login + --pin env:KRYOPTIC_USER_PIN + --keypairgen + --key-type rsa:4096 + --usage-sign + --usage-decrypt + --id 1 + --label siguldry-binding-key + environment: + KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}" + KRYOPTIC_USER_PIN: "{{ siguldry_kryoptic_user_pin }}" + when: "'siguldry-binding-key' not in kryoptic_objects.stdout" + tags: + - config + - siguldry + - siguldry/server + +- name: Create self-signed x509 binding certificate + ansible.builtin.command: + cmd: >- + openssl req -x509 + -provider pkcs11 + -subj /CN=siguldry-binding-key + -passin pass:{{ siguldry_kryoptic_user_pin }} + -key pkcs11:token=siguldry-stg-token;type=private + -out /etc/siguldry/kryoptic-binding.crt + creates: /etc/siguldry/kryoptic-binding.crt + environment: + KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}" + tags: + - config + - siguldry + - siguldry/server + +- name: Import x509 certificate to token + ansible.builtin.command: + cmd: >- + pkcs11-tool + --module /usr/lib64/pkcs11/libkryoptic_pkcs11.so + --login + --pin env:KRYOPTIC_USER_PIN + --keypairgen + --key-type rsa:4096 + --usage-sign + --usage-decrypt + --id 1 + --label siguldry-binding-key + environment: + KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}" + KRYOPTIC_USER_PIN: "{{ siguldry_kryoptic_user_pin }}" + when: "'siguldry-binding-key' not in kryoptic_objects.stdout" + tags: + - config + - siguldry + - siguldry/server diff --git a/roles/siguldry/server/tasks/main.yml b/roles/siguldry/server/tasks/main.yml new file mode 100644 index 0000000000..c205deb2bc --- /dev/null +++ b/roles/siguldry/server/tasks/main.yml @@ -0,0 +1,202 @@ +--- +- name: Install siguldry package + ansible.builtin.package: + state: present + name: siguldry + tags: + - packages + - siguldry + - siguldry/server + +# We only need to grant the service explicit access to the TPM on systemd < 258 +- name: Get systemd version + ansible.builtin.command: systemctl --version + register: systemd_version_output + changed_when: systemd_version_output.rc != 0 + +- name: Set whether explicit AllowDevice override is needed + ansible.builtin.set_fact: + explicit_allow_tpm: "{{ (systemd_version_output.stdout_lines[0] | regex_search('\\d+') | int) < 258 }}" + +- name: Create siguldry config directory + ansible.builtin.file: + path: /etc/siguldry + state: directory + owner: root + group: root + mode: '0755' + tags: + - config + - siguldry + - siguldry/server + +- name: Create credstore.encrypted directory + ansible.builtin.file: + path: /etc/credstore.encrypted + state: directory + owner: root + group: root + mode: '0700' + tags: + - config + - siguldry + - siguldry/server + +- name: Ensure the siguldry state directory exists + ansible.builtin.file: + path: /var/lib/siguldry + state: directory + owner: siguldry + group: siguldry + mode: '0750' + tags: + - siguldry + - siguldry/server + +- name: Create siguldry-signer systemd override directory + ansible.builtin.file: + path: /etc/systemd/system/siguldry-signer@.service.d + state: directory + owner: root + group: root + mode: '0755' + tags: + - config + - siguldry + - siguldry/server + +- name: Setup siguldry-signer systemd override file + ansible.builtin.template: + src: signer-override.conf.j2 + dest: /etc/systemd/system/siguldry-signer@.service.d/override.conf + owner: root + group: root + mode: '0644' + notify: Restart siguldry-server + tags: + - config + - siguldry + - siguldry/server + +- name: Create siguldry-server systemd override directory + ansible.builtin.file: + path: /etc/systemd/system/siguldry-server.service.d + state: directory + owner: root + group: root + mode: '0755' + tags: + - config + - siguldry + - siguldry/server + +- name: Setup siguldry-server systemd override file + ansible.builtin.template: + src: server-override.conf.j2 + dest: /etc/systemd/system/siguldry-server.service.d/override.conf + owner: root + group: root + mode: '0644' + notify: Restart siguldry-server + tags: + - config + - siguldry + - siguldry/server + +- name: Setup siguldry-server config file + ansible.builtin.template: + src: server.toml.j2 + dest: /etc/siguldry/server.toml + owner: root + group: root + mode: '0644' + notify: Restart siguldry-server + tags: + - config + - siguldry + - siguldry/server + +- name: Setup server certificate + ansible.builtin.copy: + src: "{{ private }}/files/siguldryca/{{ env }}/pki/issued/siguldry-server.crt" + dest: /etc/siguldry/server.crt + owner: root + group: root + mode: '0644' + tags: + - config + - siguldry + - siguldry/server + +- name: Setup CA certificate + ansible.builtin.copy: + src: "{{ private }}/files/siguldryca/{{ env }}/pki/ca.crt" + dest: /etc/siguldry/ca.crt + owner: root + group: root + mode: '0644' + tags: + - config + - siguldry + - siguldry/server + +- name: Setup binding certificates + ansible.builtin.copy: + src: "{{ private }}/files/sigul/{{ item }}" + dest: "/etc/siguldry/{{ item }}" + owner: root + group: root + mode: '0644' + with_items: + - yubikey_sv03.pem + - yubikey_sv04.pem + - yubikey_sv05.pem + - yubikey_sv06.pem + when: env == "production" + tags: + - config + - siguldry + - siguldry/server + +- name: Setup software HSM for binding certificate in staging + ansible.builtin.include_tasks: kryoptic.yml + when: env != "production" + tags: + - siguldry + - siguldry/server + +- name: Check if siguldry database is initialized + ansible.builtin.stat: + path: /var/lib/siguldry/siguldry.sqlite + register: siguldry_db + tags: + - config + - siguldry + - siguldry/server + +- name: Initialize Siguldry database + ansible.builtin.command: + cmd: >- + systemd-run --pty --wait --collect + --working-directory=/var/lib/siguldry + --setenv=SIGULDRY_SERVER_CONFIG=/etc/siguldry/server.toml + --property=UMask=017 + --uid=siguldry + --gid=siguldry + siguldry-server manage migrate + when: not siguldry_db.stat.exists + tags: + - config + - siguldry + - siguldry/server + +- name: Enable and start siguldry-server service + ansible.builtin.systemd: + name: siguldry-server.service + enabled: yes + state: started + daemon_reload: yes + tags: + - services + - siguldry + - siguldry/server diff --git a/roles/siguldry/server/templates/kryoptic.toml.j2 b/roles/siguldry/server/templates/kryoptic.toml.j2 new file mode 100644 index 0000000000..4880b0a7cf --- /dev/null +++ b/roles/siguldry/server/templates/kryoptic.toml.j2 @@ -0,0 +1,4 @@ +[[slots]] +slot = 1 +dbtype = "sqlite" +dbargs = "{{ siguldry_kryoptic_db }}" diff --git a/roles/siguldry/server/templates/server-override.conf.j2 b/roles/siguldry/server/templates/server-override.conf.j2 new file mode 100644 index 0000000000..208a3ce655 --- /dev/null +++ b/roles/siguldry/server/templates/server-override.conf.j2 @@ -0,0 +1,17 @@ +[Service] +# Tweak for lower/higher log verbosity. +# Refer to https://docs.rs/tracing-subscriber/0.3.19/tracing_subscriber/filter/struct.EnvFilter.html#directives +Environment=SIGULDRY_SERVER_LOG="WARN,siguldry=INFO" + +{% if env != "production" %} +# Kryoptic software HSM configuration for staging +Environment=KRYOPTIC_CONF="{{ siguldry_kryoptic_conf }}" +{% endif %} + +{% if explicit_allow_tpm %} +# Credentials require the TPM to decrypt. +# +# For systemd 257 and older you'll need to explicitly allow access to the TPM +# Refer to https://github.com/systemd/systemd/issues/35959. +DeviceAllow=/dev/tpmrm0 +{% endif %} diff --git a/roles/siguldry/server/templates/server.toml.j2 b/roles/siguldry/server/templates/server.toml.j2 new file mode 100644 index 0000000000..759673e6c6 --- /dev/null +++ b/roles/siguldry/server/templates/server.toml.j2 @@ -0,0 +1,101 @@ +# The location where the server should store its state. +# +# To back up the service, back up this directory. +state_directory = "/var/lib/siguldry/" + +# The hostname of the Siguldry bridge. +{% if env == "production" %} +bridge_hostname = "sign-bridge.{{datacenter}}.fedoraproject.org" +{% else %} +bridge_hostname = "sign-bridge.stg.{{datacenter}}.fedoraproject.org" +{% endif %} + +# The port to use when connecting to the Siguldry bridge. +bridge_port = 44333 + +# The number of ready connections to maintain with the bridge. This decreases the latency of +# responses when multiple client connections are established, at the expense of some idle +# connections. Be aware that the bridge has its own limits on the allowable number of idle +# server connections. If you use multiple servers with a single bridge, be sure that the +# bridge allows enough idle connections to cover each server's pool size. The default is 32. +connection_pool_size = 32 + +# The minimum length for user's access password, in *bytes*. For example, the multi-byte +# UTF-8 character "🪿" counts as 4 bytes. +user_password_length = 64 + +# The user ID to use when creating OpenPGP keys. +# +# This is typically an email like "Signing Key ". +openpgp_user_id = "Fedora " + +# The set of certificates to encrypt passwords with. +# +# At least one entry should include a PKCS#11 URI for a private key. Signing keys are encrypted +# using each certificate, so providing more than one binding means *any* of the private keys +# associated with the certificates will allow you to access the signing key, assuming you have +# the user-set password for the key as well. +# +# When binding is used, the admin needs to unlock the token by entering the PIN using +# "siguldry-server enter-pin". +# +# If no bindings are configured, the keys are protected using only the user-provided +# password. +# +# An example binding entry: +# +# [[pkcs11_bindings]] +# certificate = "/path/to/cert.pem" +# private_key = "pkcs11:token=some-token;type=private" +# +# [[pkcs11_bindings]] +# certificate = "/path/to/a/second/cert.pem" +{% if env == "production" %} +[[pkcs11_bindings]] +certificate = "/etc/sigul/yubikey_sv03.pem" +{% if inventory_hostname.startswith('sign-vault03') %} +private_key = "pkcs11:serial=8f2a341e00d7a665;id=%03;type=private" +{% endif %} + +[[pkcs11_bindings]] +certificate = "/etc/sigul/yubikey_sv04.pem" +{% if inventory_hostname.startswith('sign-vault04') %} +private_key = "pkcs11:serial=b38ee13e56b3b987;id=%03;type=private" +{% endif %} + +[[pkcs11_bindings]] +certificate = "/etc/siguldry/yubikey_sv05.pem" +{% if inventory_hostname.startswith('sign-vault05') %} +private_key = "pkcs11:serial=e8dae68ae187ff13;id=%03;type=private" +{% endif %} + +[[pkcs11_bindings]] +certificate = "/etc/siguldry/yubikey_sv06.pem" +{% if inventory_hostname.startswith('sign-vault06') or inventory_hostname == "sign-vault01.rdu3.fedoraproject.org" %} +private_key = "pkcs11:serial=e3c4804a6631dd5f;id=%03;type=private" +{% endif %} + +{% else %} +# In staging, use Kryoptic as a software HSM for binding +[[pkcs11_bindings]] +certificate = "/etc/siguldry/kryoptic-binding.crt" +private_key = "pkcs11:token=siguldry-stg-token;type=private" +{% endif %} + +# The credentials to use when connecting to the bridge and when accepting client connections +# tunneled through the bridge. Note that the certificate must have both `clientAuth` and +# `serverAuth` in its extended key usage extension. +[credentials] +private_key = "siguldry.server.private_key.pem" +certificate = "/etc/siguldry/server.crt" +ca_certificate = "/etc/siguldry/ca.crt" + +# Certificates created by Siguldry allow the user to specify the subject's common name. +# +# The rest of the certificate's subject is specified here. +[certificate_subject] +country = "US" +state_or_province = "North Carolina" +locality = "Raleigh" +organization = "Red Hat, Inc." +organizational_unit = "The Fedora Project" diff --git a/roles/siguldry/server/templates/signer-override.conf.j2 b/roles/siguldry/server/templates/signer-override.conf.j2 new file mode 100644 index 0000000000..cf279bc5b6 --- /dev/null +++ b/roles/siguldry/server/templates/signer-override.conf.j2 @@ -0,0 +1,11 @@ +[Service] +# Tweak for lower/higher log verbosity. +# Refer to https://docs.rs/tracing-subscriber/0.3.19/tracing_subscriber/filter/struct.EnvFilter.html#directives +Environment=SIGULDRY_SERVER_LOG="WARN,siguldry=INFO" + +# Unbinding keys requires access to a Yubikey +# I'm not sure there's a good way to allow _only_ the Yubikey device. +# +# TODO: also need to add access to whatever device has the Secure Boot keys. +# Also TODO: is this even the right way to expose USB devices? +DeviceAllow=/dev/bus/usb diff --git a/roles/varnish/files/zabbix/agent.conf b/roles/varnish/files/zabbix/agent.conf new file mode 100644 index 0000000000..7071744c77 --- /dev/null +++ b/roles/varnish/files/zabbix/agent.conf @@ -0,0 +1 @@ +UserParameter=varnish.raw_data,/usr/sbin/varnishstat -j diff --git a/roles/varnish/files/zabbix/selinux.te b/roles/varnish/files/zabbix/selinux.te new file mode 100644 index 0000000000..fd38f3da09 --- /dev/null +++ b/roles/varnish/files/zabbix/selinux.te @@ -0,0 +1,12 @@ +module zabbix_varnish 1.1; + +require { + type zabbix_agent_t; + type varnishd_var_lib_t; + class file read; + class file open; +} + +#============= zabbix_agent_t ============== +allow zabbix_agent_t varnishd_var_lib_t:file read; +allow zabbix_agent_t varnishd_var_lib_t:file open; diff --git a/roles/varnish/files/zabbix/template.yml b/roles/varnish/files/zabbix/template.yml new file mode 100644 index 0000000000..9c489ce896 --- /dev/null +++ b/roles/varnish/files/zabbix/template.yml @@ -0,0 +1,549 @@ +zabbix_export: + version: '7.0' + template_groups: + - uuid: a333cbd6a3ad44baaa4eee4b0c0b1bec + name: Fedora + templates: + - uuid: 8a0ae7759b4d4cda8da682f02ab95095 + template: 'Varnish Cache Monitoring' + name: 'Varnish Cache Monitoring' + description: | + ## Description + + Simple template for the Varnish cache using results from the varnishstat command. + + ## Overview + + Simple template for the Varnish cache using results from the varnishstat command. + + ## Author: Greg Sutcliffe + ## Forked from: Dave Humphrey (dave@uesp.net) + groups: + - name: Fedora + items: + - uuid: adf987b6d3df486db52d4b8148a865c9 + name: 'Varnish: Service response time' + type: ZABBIX_ACTIVE + key: 'net.tcp.service.perf[http,"{$VARNISH.STATUS.HOST}","{$VARNISH.STATUS.PORT}"]' + history: 7d + value_type: FLOAT + units: s + tags: + - tag: Application + value: Varnish + triggers: + - uuid: 85538643e3c24fbb8b4fdd222f3f44e0 + expression: 'min(/Varnish Cache Monitoring/net.tcp.service.perf[http,"{$VARNISH.STATUS.HOST}","{$VARNISH.STATUS.PORT}"],5m)={$VARNISH.RESPONSE_TIME.MAX.WARN}' + name: 'Varnish: Service response time is too high (over {$VARNISH.RESPONSE_TIME.MAX.WARN}s for 5m)' + priority: WARNING + manual_close: 'YES' + dependencies: + - name: 'Varnish: Process is not running' + expression: 'last(/Varnish Cache Monitoring/proc.num["{$VARNISH.PROCESS_NAME}"])=0' + - name: 'Varnish: Service is down' + expression: 'last(/Varnish Cache Monitoring/net.tcp.service[http,"{$VARNISH.STATUS.HOST}","{$VARNISH.STATUS.PORT}"])=0' + - uuid: 80295421232547dfba8159e974c236d6 + name: 'Varnish: Service ping' + type: ZABBIX_ACTIVE + key: 'net.tcp.service[http,"{$VARNISH.STATUS.HOST}","{$VARNISH.STATUS.PORT}"]' + history: 7d + tags: + - tag: Application + value: Varnish + triggers: + - uuid: 4c754b657d944992b309c0a92bb01499 + expression: 'last(/Varnish Cache Monitoring/net.tcp.service[http,"{$VARNISH.STATUS.HOST}","{$VARNISH.STATUS.PORT}"])=0' + name: 'Varnish: Service is down' + priority: AVERAGE + manual_close: 'YES' + dependencies: + - name: 'Varnish: Process is not running' + expression: 'last(/Varnish Cache Monitoring/proc.num["{$VARNISH.PROCESS_NAME}"])=0' + - uuid: 8d173a3deb874b1bab51dd698d9358fc + name: 'Varnish: CPU utilization' + type: ZABBIX_ACTIVE + key: 'proc.cpu.util["{$VARNISH.PROCESS_NAME}"]' + history: 7d + value_type: FLOAT + units: '%' + description: 'Process CPU utilization percentage.' + tags: + - tag: Application + value: Varnish + - uuid: fe4a28e44cdb492c8539914af45b39a3 + name: 'Varnish: Memory usage (rss)' + type: ZABBIX_ACTIVE + key: 'proc.mem["{$VARNISH.PROCESS_NAME}",,,,rss]' + history: 7d + units: B + description: 'Resident set size memory used by process in bytes.' + tags: + - tag: Application + value: Varnish + - uuid: 079f500025b840dcb5629e0c92539ddb + name: 'Varnish: Memory usage (vsize)' + type: ZABBIX_ACTIVE + key: 'proc.mem["{$VARNISH.PROCESS_NAME}",,,,vsize]' + history: 7d + units: B + description: 'Virtual memory size used by process in bytes.' + tags: + - tag: Application + value: Varnish + - uuid: 7db0bf02c0ca419d985a2b11fc1c25f6 + name: 'Varnish: Number of processes running' + type: ZABBIX_ACTIVE + key: 'proc.num["{$VARNISH.PROCESS_NAME}"]' + history: 7d + tags: + - tag: Application + value: Varnish + triggers: + - uuid: dc44a80d523f445c819071c9ebf48893 + expression: 'last(/Varnish Cache Monitoring/proc.num["{$VARNISH.PROCESS_NAME}"])=0' + name: 'Varnish: Process is not running' + priority: HIGH + - uuid: 645d42eafecc4b1a95b5e75ba10d9fc3 + name: 'Varnish: Backend connections' + type: DEPENDENT + key: varnish.backend.connections + delay: '0' + history: 7d + description: 'Backend connections succeeded' + preprocessing: + - type: JSONPATH + parameters: + - '$["MAIN.backend_conn"].value' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: e935889f0eaa40a8a3f7589e3136dbc8 + name: 'Varnish: Backend failed' + type: DEPENDENT + key: varnish.backend.failed + delay: '0' + history: 7d + description: 'Backend connections failed' + preprocessing: + - type: JSONPATH + parameters: + - '$["MAIN.backend_fail"].value' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: f0c8750857464c609f40cd803849dddb + name: 'Varnish: Backend requests' + type: DEPENDENT + key: varnish.backend.requests + delay: '0' + history: 7d + description: 'Backend requests made' + preprocessing: + - type: JSONPATH + parameters: + - '$["MAIN.backend_req"].value' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: ffd5566192bd44eeb9d93ebc9d6a2fc4 + name: 'Varnish: Backend unhealthy' + type: DEPENDENT + key: varnish.backend.unhealthy + delay: '0' + history: 7d + description: 'Backend connections not attempted' + preprocessing: + - type: JSONPATH + parameters: + - '$["MAIN.backend_unhealthy"].value' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: 75d72c6a11174f91862f72e2b05010d0 + name: 'Varnish: Bytes per second' + type: DEPENDENT + key: varnish.bytes.rate + delay: '0' + history: 7d + value_type: FLOAT + units: Bps + description: 'Calculated as change rate for ''Total bytes'' stat.' + preprocessing: + - type: JAVASCRIPT + parameters: + - | + var values = JSON.parse(value); + var headBytes = values["MAIN.s_resp_hdrbytes"].value; + var bodyBytes = values["MAIN.s_resp_bodybytes"].value; + return headBytes + bodyBytes; + - type: CHANGE_PER_SECOND + parameters: + - '' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: fd089d8419ff4d83a2c3fe7f0172ff5f + name: 'Varnish: Cache hit-pass' + type: DEPENDENT + key: varnish.cache.hitpasses + delay: '0' + history: 7d + description: 'Cache hits for pass' + preprocessing: + - type: JSONPATH + parameters: + - '$["MAIN.cache_hitpass"].value' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: a199ab12103345c4812ecc1472bd6dc4 + name: 'Varnish: Cache hits' + type: DEPENDENT + key: varnish.cache.hits + delay: '0' + history: 7d + description: 'Cache hits' + preprocessing: + - type: JSONPATH + parameters: + - '$["MAIN.cache_hit"].value' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: 7378704abbc24b05ad203a8e9735cd2c + name: 'Varnish: Cache misses' + type: DEPENDENT + key: varnish.cache.misses + delay: '0' + history: 7d + description: 'Cache misses' + preprocessing: + - type: JSONPATH + parameters: + - '$["MAIN.cache_miss"].value' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: 4bf458f277af4234a2971b6aaf8d8280 + name: 'Varnish: Client requests' + type: DEPENDENT + key: varnish.client.requests + delay: '0' + history: 7d + description: 'Good client requests received' + preprocessing: + - type: JSONPATH + parameters: + - '$["MAIN.client_req"].value' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: fca4b1afebab4edb91a9e9ac7174fef2 + name: 'Varnish: Cache hit rate' + type: DEPENDENT + key: varnish.hitrate + delay: '0' + history: 7d + value_type: FLOAT + units: '%' + description: 'Average hit rate since the cache was started' + preprocessing: + - type: JAVASCRIPT + parameters: + - | + var values = JSON.parse(value); + var hit = values["MAIN.cache_hit"].value; + var miss = values["MAIN.cache_miss"].value; + var hitpass = values["MAIN.cache_hitpass"].value; + return hit / (hit + miss) * 100; + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: 11b2739844e8482fb2d44cd936065977 + name: 'Varnish: Cache hit rate 5m' + type: CALCULATED + key: varnish.hitrate5m + history: 7d + value_type: FLOAT + units: '%' + params: '(last(//varnish.cache.hits) - last(//varnish.cache.hits,#2)) * 100 / ((last(//varnish.cache.misses) - last(//varnish.cache.misses,#2)) + (last(//varnish.cache.hits) - last(//varnish.cache.hits,#2)))' + description: 'Average cache hit rate in the past 5m' + tags: + - tag: Application + value: Varnish + - uuid: 2318e903bafd4f5c9d9bf1159fbc659e + name: 'Varnish: Expired objects' + type: DEPENDENT + key: varnish.objects.expired + delay: '0' + history: 7d + description: 'Number of expired objects' + preprocessing: + - type: JSONPATH + parameters: + - '$["MAIN.n_expired"].value' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: 36837e88b2344e94923f26bc15e4202b + name: 'Varnish: LRU nuked objects' + type: DEPENDENT + key: varnish.objects.lrunuked + delay: '0' + history: 7d + description: 'Number of LRU nuked objects' + preprocessing: + - type: JSONPATH + parameters: + - '$["MAIN.n_lru_nuked"].value' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: a04a8fd97456427d9b82e9856695ec88 + name: 'Varnish: Num purges' + type: DEPENDENT + key: varnish.objects.purges + delay: '0' + history: 7d + description: 'Number of purge operations executed' + preprocessing: + - type: JSONPATH + parameters: + - '$["MAIN.n_purges"].value' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: 05ee653674dd490fa99643d2253241e6 + name: 'Varnish: Get status' + type: ZABBIX_ACTIVE + key: varnish.raw_data + history: 1h + value_type: TEXT + trends: '0' + preprocessing: + - type: JSONPATH + parameters: + - $.counters + tags: + - tag: Application + value: 'Zabbix raw items' + triggers: + - uuid: 3b1aa70c7b104e2bb557c2db9ffe710b + expression: 'nodata(/Varnish Cache Monitoring/varnish.raw_data,10m)=1' + name: 'Varnish: Failed to fetch stats (or no data for 10m)' + priority: WARNING + description: 'Zabbix has not received data for stats for the last 10m.' + manual_close: 'YES' + dependencies: + - name: 'Varnish: Process is not running' + expression: 'last(/Varnish Cache Monitoring/proc.num["{$VARNISH.PROCESS_NAME}"])=0' + - name: 'Varnish: Service is down' + expression: 'last(/Varnish Cache Monitoring/net.tcp.service[http,"{$VARNISH.STATUS.HOST}","{$VARNISH.STATUS.PORT}"])=0' + - uuid: 017f130075e44226ab676b4758445a6c + name: 'Varnish: Total request bytes' + type: DEPENDENT + key: varnish.request.bytes + delay: '0' + history: 7d + units: B + description: 'Total bytes received' + preprocessing: + - type: JAVASCRIPT + parameters: + - | + var values = JSON.parse(value); + var headBytes = values["MAIN.s_req_hdrbytes"].value; + var bodyBytes = values["MAIN.s_req_bodybytes"].value; + return headBytes + bodyBytes; + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: 8c06df8a87fa46738fc80ab6441cfae1 + name: 'Varnish: Requests per second' + type: DEPENDENT + key: varnish.requests.rate + delay: '0' + history: 7d + value_type: FLOAT + preprocessing: + - type: JSONPATH + parameters: + - '$["MAIN.client_req"].value' + - type: CHANGE_PER_SECOND + parameters: + - '' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: f364881a918a4e678816360f61b46d43 + name: 'Varnish: Total response bytes' + type: DEPENDENT + key: varnish.response.bytes + delay: '0' + history: 7d + units: B + description: 'Total bytes sent' + preprocessing: + - type: JAVASCRIPT + parameters: + - | + var values = JSON.parse(value); + var headBytes = values["MAIN.s_resp_hdrbytes"].value; + var bodyBytes = values["MAIN.s_resp_bodybytes"].value; + return headBytes + bodyBytes; + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: c876276a1b93421ab8c0a12f80918893 + name: 'Varnish: Session dropped' + type: DEPENDENT + key: varnish.session.dropped + delay: '0' + history: 7d + description: 'Sessions dropped' + preprocessing: + - type: JSONPATH + parameters: + - '$["MAIN.sess_dropped"].value' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: fb2feb9ed69e414ca8c36d5b832ce79a + name: 'Varnish: Threads created' + type: DEPENDENT + key: varnish.threads.created + delay: '0' + history: 7d + description: 'Threads created' + preprocessing: + - type: JSONPATH + parameters: + - '$["MAIN.threads_created"].value' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: bd8e098f8d2f42aaa7fc901173162b6a + name: 'Varnish: Threads failed' + type: DEPENDENT + key: varnish.threads.failed + delay: '0' + history: 7d + description: 'Thread creation failure' + preprocessing: + - type: JSONPATH + parameters: + - '$["MAIN.threads_failed"].value' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: 83e9983fa64648be95e4e275fd582419 + name: 'Varnish: Threads limited' + type: DEPENDENT + key: varnish.threads.limited + delay: '0' + history: 7d + description: 'Threads hit max' + preprocessing: + - type: JSONPATH + parameters: + - '$["MAIN.threads_limited"].value' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: 3cdec39a17bd42fcbc846432bc9d1ed1 + name: 'Varnish: Uptime' + type: DEPENDENT + key: varnish.uptime + delay: '0' + history: 7d + units: uptime + description: 'Service uptime in seconds' + preprocessing: + - type: JSONPATH + parameters: + - '$["MAIN.uptime"].value' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + triggers: + - uuid: 038c5860369147238731776c5ec18410 + expression: 'last(/Varnish Cache Monitoring/varnish.uptime)=10m' + name: 'Varnish: Has been restarted (uptime < 10m)' + priority: INFO + description: 'Uptime is less than 10 minutes' + manual_close: 'YES' + macros: + - macro: '{$VARNISH.PROCESS_NAME}' + value: varnishd + description: 'Process name of the Varnish server.' + - macro: '{$VARNISH.RESPONSE_TIME.MAX.WARN}' + value: '5' + description: 'Max response time before a warning is given.' + - macro: '{$VARNISH.STATUS.HOST}' + value: 127.0.0.1 + description: 'IP or hostname of the Varnish server.' + - macro: '{$VARNISH.STATUS.PORT}' + value: '80' + description: 'Port of the Varnish server.' + graphs: + - uuid: ef40fb5ce9344c04b91e96d7d547ac84 + name: 'Cache hit rate' + graph_items: + - color: 1A7C11 + item: + host: 'Varnish Cache Monitoring' + key: varnish.hitrate + - sortorder: '1' + color: F63100 + item: + host: 'Varnish Cache Monitoring' + key: varnish.hitrate5m + - uuid: 73f2cd95eb664725a42051d495a5dadf + name: 'Request rate' + graph_items: + - color: 1A7C11 + item: + host: 'Varnish Cache Monitoring' + key: varnish.requests.rate diff --git a/roles/varnish/tasks/main.yml b/roles/varnish/tasks/main.yml index 3819a8a46b..e6acf0bc20 100644 --- a/roles/varnish/tasks/main.yml +++ b/roles/varnish/tasks/main.yml @@ -42,3 +42,10 @@ service: enabled=yes name=varnish tags: - varnish + +- name: Configure Varnish monitoring in Zabbix + ansible.builtin.include_tasks: monitoring.yml + tags: + - varnish + - zabbix_agent + - zabbix_api diff --git a/roles/varnish/tasks/monitoring.yml b/roles/varnish/tasks/monitoring.yml new file mode 100644 index 0000000000..4f8f12bbce --- /dev/null +++ b/roles/varnish/tasks/monitoring.yml @@ -0,0 +1,100 @@ +--- +# Configure Zabbix. A host including this file should +# - deploy the required scripts & agent config to the host +# - add itself to the required hostgroup +# - add itself to the required template + +# Custom SELinux requirements for Zabbix to execute monitoring binaries +- name: Ensure a directory exists for varnish+Zabbix selinux module + ansible.builtin.file: + path: /usr/local/share/zabbix + state: directory + mode: '0755' + tags: + - selinux + - varnish + - zabbix_agent + +- name: Copy Varnish Zabbix SELinux module + ansible.builtin.copy: + src: zabbix/selinux.te + dest: /usr/local/share/zabbix/zabbix_varnish.te + owner: root + group: root + mode: '0644' + register: selinux_zabbix_file + tags: + - selinux + - varnish + - zabbix_agent + +- name: Compile and install SELinux module + ansible.builtin.include_tasks: "{{ tasks_path }}/compile-selinux.yml" + vars: + selinux_module_dir: /usr/local/share/zabbix + selinux_module_name: zabbix_varnish + when: selinux_zabbix_file.changed # noqa: no-handler + tags: + - selinux + - varnish + - zabbix_agent + +# The agent needs to be in the varnish group to read the directory holding the stats +- name: Add zabbix to varnish group + ansible.builtin.user: + name: zabbix + groups: varnish + append: yes + notify: + - Restart zabbix agent + tags: + - varnish + - zabbix_agent + +- name: Install Zabbix agent config drop-in + ansible.builtin.copy: + src: zabbix/agent.conf + dest: /etc/zabbix/zabbix_agentd.d/varnish.conf + mode: '0644' + owner: zabbix + group: zabbix + notify: + - Restart zabbix agent + tags: + - varnish + - zabbix_agent + +- name: Zabbix API Block + vars: + ansible_zabbix_auth_key: "{{ zabbix_auth_key }}" + ansible_network_os: "{{ zabbix_network_os }}" + ansible_connection: "{{ zabbix_connection }}" + ansible_httpapi_port: "{{ zabbix_httpapi_port }}" + ansible_httpapi_use_ssl: "{{ zabbix_httpapi_use_ssl }}" + ansible_httpapi_validate_certs: "{{ zabbix_httpapi_validate_certs }}" + ansible_host: "{{ zabbix_server }}" + ansible_zabbix_url_path: "{{ zabbix_url_path }}" + tags: + - zabbix_api + - zabbix_agent + - varnish + block: + - name: Import Varnish Zabbix template file + community.zabbix.zabbix_template: + template_yaml: "{{ lookup('file', 'zabbix/template.yml') }}" + state: present + run_once: true + + - name: Ensure Varnish Zabbix hostgroup is present + community.zabbix.zabbix_group: + host_groups: + - Varnish Servers + state: present + run_once: true + + - name: Add self to Varnish in Zabbix + community.zabbix.zabbix_host: + host_name: "{{ inventory_hostname }}" + host_groups: Varnish Servers + link_templates: Varnish Cache Monitoring + force: false diff --git a/scripts/public-db-copy b/scripts/public-db-copy index 6cf9dbbe14..7b8d2c3524 100755 --- a/scripts/public-db-copy +++ b/scripts/public-db-copy @@ -21,8 +21,6 @@ scp db-datanommer02.${bkup_domain}:/backups/datanommer-incremental/$(date -d 'ye scp db-koji01.${bkup_domain}:/backups/koji-$(date +%F).dump.xz \ /srv/web/infra/db-dumps/koji.dump.xz -scp db01.${bkup_domain}:/backups/pkgdb2-$(date +%F).dump.xz \ - /srv/web/infra/db-dumps/pkgdb2.dump.xz scp db01.${bkup_domain}:/backups/koschei-$(date +%F).dump.xz \ /srv/web/infra/db-dumps/koschei.dump.xz scp db01.${bkup_domain}:/backups/bodhi2-$(date +%F).dump.xz \ diff --git a/vars/all/00-FedoraCycleNumber.yaml b/vars/all/00-FedoraCycleNumber.yaml index ee1684886b..339b47a9eb 100644 --- a/vars/all/00-FedoraCycleNumber.yaml +++ b/vars/all/00-FedoraCycleNumber.yaml @@ -1,2 +1,2 @@ --- -FedoraCycleNumber: 43 +FedoraCycleNumber: 44 diff --git a/vars/all/FedoraBranched.yaml b/vars/all/FedoraBranched.yaml index 5c007dd72d..9102df2ad2 100644 --- a/vars/all/FedoraBranched.yaml +++ b/vars/all/FedoraBranched.yaml @@ -1,2 +1,2 @@ --- -FedoraBranched: True +FedoraBranched: False diff --git a/vars/all/FedoraPreviousPrevious.yaml b/vars/all/FedoraPreviousPrevious.yaml index 519608fa95..af1e22a3b2 100644 --- a/vars/all/FedoraPreviousPrevious.yaml +++ b/vars/all/FedoraPreviousPrevious.yaml @@ -1,2 +1,2 @@ --- -FedoraPreviousPrevious: False +FedoraPreviousPrevious: True diff --git a/vars/all/Frozen.yaml b/vars/all/Frozen.yaml index 8a4b4163ce..d9bc53b221 100644 --- a/vars/all/Frozen.yaml +++ b/vars/all/Frozen.yaml @@ -1,7 +1,7 @@ --- # is the infrastructure freeze currently in place? -InfraFrozen: True +InfraFrozen: False # is the pending release (Branched) currently frozen? -NextReleaseFrozen: True +NextReleaseFrozen: False # for 'backwards compatibility' Frozen: "{{ InfraFrozen }}"