From 42b2c57e66b7a550075839159ec423f6728daec7 Mon Sep 17 00:00:00 2001 From: Pavel Raiskup Date: Thu, 16 Apr 2026 18:38:14 +0200 Subject: [PATCH 001/151] copr-be: correctly define the macro override db location --- .../backend/templates/provision/copr-rpmbuild/main.ini.j2 | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/roles/copr/backend/templates/provision/copr-rpmbuild/main.ini.j2 b/roles/copr/backend/templates/provision/copr-rpmbuild/main.ini.j2 index edaf37a0ec..b739de8192 100644 --- a/roles/copr/backend/templates/provision/copr-rpmbuild/main.ini.j2 +++ b/roles/copr/backend/templates/provision/copr-rpmbuild/main.ini.j2 @@ -1,10 +1,12 @@ -# rpkg-util v3+ +# TODO: this file is used by both rpkg-util(?) and copr-rpmbuild. Move the +# copr-rpmbuild related stuff into copr-rpmbuild.yml. [main] frontend_url = {{ frontend_base_url }} distgit_lookaside_url = https://${% raw %}{{git_props:remote_netloc}}{% endraw %}/repo/pkgs/%(repo_path)s/%(filename)s/%(hashtype)s/%(hash)s/%(filename)s distgit_clone_url = {scheme}://{netloc}/%(repo_path)s rpm_vendor_copr_name = {{ rpm_vendor_copr_name }} +macro_override_db_url = https://copr-be.cloud.fedoraproject.org/config/distro-arch-specific.json [distgit0] distgit_hostname_pattern = src.fedoraproject.org From 41da32426822bf5da8cab79d5bdd777e85014f5c Mon Sep 17 00:00:00 2001 From: James Antill Date: Thu, 16 Apr 2026 22:35:49 -0400 Subject: [PATCH 002/151] ib01: sync exclude 44_Beta-1.1/1.2 for space. Signed-off-by: James Antill --- files/download/sync-up-downloads.sh.ib01 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/files/download/sync-up-downloads.sh.ib01 b/files/download/sync-up-downloads.sh.ib01 index fa2c3e64cc..1bfb1e38e5 100755 --- a/files/download/sync-up-downloads.sh.ib01 +++ b/files/download/sync-up-downloads.sh.ib01 @@ -8,7 +8,7 @@ RSYNC='/usr/bin/rsync' RS_OPT="-avSHP --numeric-ids" RS_DEADLY="--delete --delete-excluded --delete-delay --delay-updates" -ALT_EXCLUDES="" +ALT_EXCLUDES="--exclude 44_Beta*" # 2026-04-16 - tmp. running out of space EPL_EXCLUDES="" FED_EXCLUDES="" From 7236e236fff80bd5e07bceaf461237c3a1485760 Mon Sep 17 00:00:00 2001 From: Pavel Raiskup Date: Fri, 17 Apr 2026 11:02:49 +0200 Subject: [PATCH 003/151] copr: rotate buildsys SSH keys Split the key for production / staging. Drop the keys from hypervisors, as we don't actually need them there (we copy images from backend -> hypervisors these days, not from hypervisor to hypervisor). Relates: https://github.com/fedora-copr/copr/pull/4221 --- .../backend/files/buildsys.production.pub | 1 + roles/copr/backend/files/buildsys.staging.pub | 1 + .../files/provision/files/buildsys.pub | 1 - .../provision/provision_builder_tasks.yml | 8 +++++-- roles/copr/backend/tasks/main.yml | 14 ++++++++++--- roles/copr/backend/tasks/resalloc.yml | 2 +- .../tasks/setup_provisioning_environment.yml | 7 +++++++ roles/copr/hypervisor/files/buildsys.pub | 1 - roles/copr/hypervisor/tasks/main.yml | 21 ++++++------------- 9 files changed, 33 insertions(+), 23 deletions(-) create mode 100644 roles/copr/backend/files/buildsys.production.pub create mode 100644 roles/copr/backend/files/buildsys.staging.pub delete mode 100644 roles/copr/backend/files/provision/files/buildsys.pub delete mode 120000 roles/copr/hypervisor/files/buildsys.pub diff --git a/roles/copr/backend/files/buildsys.production.pub b/roles/copr/backend/files/buildsys.production.pub new file mode 100644 index 0000000000..e7a33183f1 --- /dev/null +++ b/roles/copr/backend/files/buildsys.production.pub @@ -0,0 +1 @@ +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCao0nJaZ5JIE8rn5M/l5VXU1e1LSqGKVbDjNYIwbbT2n7T9SK91D2s7EpUq0/QdoFKuZVsGgl/P7V2Vk4PT5W3k+RG/ndBToa/9AJzFRRK3dbJncgdIKYuOHO6hqSOegbXihiLhML95R/XtN9ywwDw6H+ZvdA5A8HtDs/2VctRZ28zT2BYqUITZ78/Nhgq8ul315Oz+RDiZHp0NH6p0JPhsqtXuCQw/C7GipVgUAm4y4rbkpprPDweGFGN2Xpaps0NWafx9IuC752Kb3vg2IDYCTr2jn4Y5ISBzcJix4K57hR33KRhtdVLc25r7jfXoJzyoaUuHHTEqaYpXCLMO+aHAPruEFEPVIFK68POjebqY/O6ppglpf/qQNKipy0ujnMXTj5ZPMCSQeoTe1ym6ws1R1Nctvp9CBuHKDJg0PHHOLwktpdI6LxBg7gqj76tMiUsclH75JfbM7eSzeX0lMHRca9PoZgFRqduinHonB5mHjnen4mHlumCPVX0fATJ98IoI7VVveI+cZJ4NDklXTedl0K/KV3BhUWeSIM0UrqYiooHDRftenslLDTUFgPAzPst1bLUr/Oqa+66pv8qpbH6g7IHPnf3/xaKd4899SUgBcr9KhFFOTu6HvG9lrk/bZDh+pxp/8NwpJhqN74e0qkokwBjC5YonVNa34DDVF+Y9Q== copr-buildsys-prod diff --git a/roles/copr/backend/files/buildsys.staging.pub b/roles/copr/backend/files/buildsys.staging.pub new file mode 100644 index 0000000000..65cf3e206d --- /dev/null +++ b/roles/copr/backend/files/buildsys.staging.pub @@ -0,0 +1 @@ +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDOcf6r8Q7qCELUVCc3jNYx2YiQ3wCnxwxfxKa76plR7jmbhhUdiXNZEeKybEKNzYd+7sKSxkT8rl9fympTziB7uGOL18350MvstVGRxsgtuZLfoh0yGa78ZNVuOHBCgwD8wl3swdogwgJydqJNijEaJbrYLru7CuTbbGcXLtPpA8blszH9CNH2OyWJtGXSiQyB5PmLyJXsATZiqAZI4/M53K8z3Zp4qiwTwGsS+OVRjlY5S+7MIgb5SH5JOsiTdEf5VkPM5j8WG70cL6Y6mp+DQ0KdDeCEPX7mUvqhRU9KImWuD2QKCfYXGzG9NmR+ycmK7NrR1sLkMTtjmJTm9gRVOtlE1QWMFGmkq/4NvQAm7Qw4G3QDbnMbVntUftWqeC6dQM2q2FX1yqA9ogoCIwkz5nIq8YH5cjO0UqVYICfw5rqN3LLALSsusKvPyiNGXwckSiV647i9PZgUxsnBfX8zZJaiBiwYE+S9dEhPSc3ejVx6INVXB8lXRvFO6A2i4KrXWpkL8NvCcUuH3q0CwxGpOrxB1NIadMNLVk6CiWPBWW03L55SIu82rgUcJqtP44/MLTUUseIB8sh7+ReFbbdNrpaX1pAfn67k8/Q4alisN0NLoCSucxN3tck1KgboAoGsN9s8YfUjGvOzy2h5c5jqgGF22/0asA4y6OLKHDEa4Q== copr-buildsys-2026-04-16 diff --git a/roles/copr/backend/files/provision/files/buildsys.pub b/roles/copr/backend/files/provision/files/buildsys.pub deleted file mode 100644 index 10790ee925..0000000000 --- a/roles/copr/backend/files/provision/files/buildsys.pub +++ /dev/null @@ -1 +0,0 @@ -ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCeTO0ddXuhDZYM9HyM0a47aeV2yIVWhTpddrQ7/RAIs99XyrsicQLABzmdMBfiZnP0FnHBF/e+2xEkT8hHJpX6bX81jjvs2bb8KP18Nh8vaXI3QospWrRygpu1tjzqZT0Llh4ZVFscum8TrMw4VWXclzdDw6x7csCBjSttqq8F3iTJtQ9XM9/5tCAAOzGBKJrsGKV1CNIrfUo5CSzY+IUVIr8XJ93IB2ZQVASK34T/49egmrWlNB32fqAbDMC+XNmobgn6gO33Yq5Ly7Dk4kqTUx2TEaqDkZfhsVu0YcwV81bmqsltRvpj6bIXrEoMeav7nbuqKcPLTxWEY/2icePF diff --git a/roles/copr/backend/files/provision/provision_builder_tasks.yml b/roles/copr/backend/files/provision/provision_builder_tasks.yml index 92fd5470f4..47847ca04c 100644 --- a/roles/copr/backend/files/provision/provision_builder_tasks.yml +++ b/roles/copr/backend/files/provision/provision_builder_tasks.yml @@ -274,10 +274,14 @@ - preparing_image - name: mockbuilder authorized_keys - authorized_key: user=mockbuilder key='{{ lookup('file', 'files/buildsys.pub') }}' + authorized_key: + user: mockbuilder + key: "{{ lookup('file', 'files/buildsys.pub') }}" - name: root authorized_keys - authorized_key: user=root key='{{ lookup('file', 'files/buildsys.pub') }}' + authorized_key: + use: root + key: "{{ lookup('file', 'files/buildsys.pub') }}" - name: setup 10x more fds in limits.conf ansible.builtin.copy: diff --git a/roles/copr/backend/tasks/main.yml b/roles/copr/backend/tasks/main.yml index cb50f54147..a4f06e8a06 100644 --- a/roles/copr/backend/tasks/main.yml +++ b/roles/copr/backend/tasks/main.yml @@ -61,7 +61,12 @@ - .ssh - name: Setup privkey for copr user - ansible.builtin.copy: src="{{ private }}/files/copr/buildsys.priv" dest=/home/copr/.ssh/id_rsa owner=copr group=copr mode=600 + ansible.builtin.copy: + src: "{{ private }}/files/copr/buildsys.{{ env }}.priv" + dest: /home/copr/.ssh/id_rsa + owner: copr + group: copr + mode: 600 - name: Setup copr user ssh config file ansible.builtin.template: @@ -88,11 +93,14 @@ - name: Replace bashrc for copr user ansible.builtin.copy: src="copr_bashrc" dest=/home/copr/.bashrc owner=copr group=copr mode=600 +# TODO(praiskup): this is weird, doesn't seem to be needed - name: Auth_key so we can login to localhost as the copr user from the copr user - authorized_key: user=copr key="{{ item }}" + authorized_key: + user: copr + key: "{{ item }}" no_log: true with_file: - - "provision/files/buildsys.pub" + - "buildsys.{{ env }}.pub" - name: Copy .boto file ansible.builtin.copy: src="boto" dest=/home/copr/.boto owner=copr group=copr diff --git a/roles/copr/backend/tasks/resalloc.yml b/roles/copr/backend/tasks/resalloc.yml index 506ff5232c..6aa132db1d 100644 --- a/roles/copr/backend/tasks/resalloc.yml +++ b/roles/copr/backend/tasks/resalloc.yml @@ -159,7 +159,7 @@ - name: Resalloc, copy backend ssh identity ansible.builtin.copy: - src: "{{ private }}/files/copr/buildsys.priv" + src: "{{ private }}/files/copr/buildsys.{{ env }}.priv" dest: /var/lib/resallocserver/.ssh/id_rsa owner: resalloc group: resalloc diff --git a/roles/copr/backend/tasks/setup_provisioning_environment.yml b/roles/copr/backend/tasks/setup_provisioning_environment.yml index 9612a3bda9..223832bf90 100644 --- a/roles/copr/backend/tasks/setup_provisioning_environment.yml +++ b/roles/copr/backend/tasks/setup_provisioning_environment.yml @@ -19,6 +19,13 @@ tags: - provision_config +- name: install the correct buildsys.pub + ansible.builtin.copy: + dest: "{{ provision_directory }}/files/buildsys.pub" + src: "buildsys.{{ env }}.pub" + tags: + - provision_config + - name: "Sync copr provisioning files [remove mock config leftovers]" ansible.posix.synchronize: src: "{{ roles_path }}/copr/backend/files/provision/files/mock/" diff --git a/roles/copr/hypervisor/files/buildsys.pub b/roles/copr/hypervisor/files/buildsys.pub deleted file mode 120000 index 3afbe620a2..0000000000 --- a/roles/copr/hypervisor/files/buildsys.pub +++ /dev/null @@ -1 +0,0 @@ -../../../copr/backend/files/provision/files/buildsys.pub \ No newline at end of file diff --git a/roles/copr/hypervisor/tasks/main.yml b/roles/copr/hypervisor/tasks/main.yml index 19dd6002e5..8939c00fab 100644 --- a/roles/copr/hypervisor/tasks/main.yml +++ b/roles/copr/hypervisor/tasks/main.yml @@ -139,10 +139,13 @@ - name: Create the copr user user: name=copr uid=11666 group=libvirt groups=qemu password_lock=true -- name: Assure that copr-be can ssh there as copr@... - authorized_key: user=copr key="{{ item }}" +- name: Assure that copr user on copr-backend can ssh as copr@... + authorized_key: + user: copr + key: "{{ item }}" with_file: - - buildsys.pub + - buildsys.production.pub + - buildsys.staging.pub - name: Add @copr keys for sysadmin-main and other allowed users authorized_key: user=copr key="{{ item }}" @@ -153,18 +156,6 @@ - config - sshkeys -# todo: generate it's own key -- name: Make sure hostA can ssh to hostB - ansible.builtin.copy: - src: "{{ private }}/files/copr/buildsys.priv" - dest: /home/copr/.ssh/id_rsa - owner: copr - mode: "0600" - -- name: Provide pub key, too, so we can install them to generated builder images - ansible.builtin.copy: src=buildsys.pub dest=/home/copr/.ssh/id_rsa.pub - owner=copr mode=0600 - - name: Enable praiskup-helpers repo ansible.builtin.shell: | dnf copr enable -y praiskup/helpers From 82e7f803a3759e56c381f2078ef3b85b85940086 Mon Sep 17 00:00:00 2001 From: Jiri Kyjovsky Date: Fri, 17 Apr 2026 12:48:57 +0200 Subject: [PATCH 004/151] copr-buildsys: new name for copr builder pubkeys --- roles/copr/backend/templates/provision/copr-resalloc-aws-new.j2 | 2 +- roles/copr/backend/templates/resalloc/osuosl-vm.j2 | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/copr/backend/templates/provision/copr-resalloc-aws-new.j2 b/roles/copr/backend/templates/provision/copr-resalloc-aws-new.j2 index 70410dac73..f21e9d2067 100644 --- a/roles/copr/backend/templates/provision/copr-resalloc-aws-new.j2 +++ b/roles/copr/backend/templates/provision/copr-resalloc-aws-new.j2 @@ -14,7 +14,7 @@ cmd=( /usr/bin/resalloc-aws-new --aws-profile default --ami {{ copr_builder_images.aws[item] }} - --ssh-key-name copr-builder + --ssh-key-name copr-builder-{{ env }} --security-group-id sg-0c3efdb681ced5d4f --debug {% for subnet in aws_arch_subnets[item] %} diff --git a/roles/copr/backend/templates/resalloc/osuosl-vm.j2 b/roles/copr/backend/templates/resalloc/osuosl-vm.j2 index 2c433bbf96..200e2e5e96 100755 --- a/roles/copr/backend/templates/resalloc/osuosl-vm.j2 +++ b/roles/copr/backend/templates/resalloc/osuosl-vm.j2 @@ -41,6 +41,6 @@ resalloc-openstack-new \ --flavor "$flavor" \ --name "$RESALLOC_NAME" \ --post-command "set -x ; resalloc-wait-for-ssh --timeout 250 --log debug \"\$RESALLOC_OS_IP\" >&2 && ansible-playbook $playbook -i \"\$RESALLOC_OS_IP,\" >&2 " \ - --key-pair-id copr-builder \ + --key-pair-id copr-builder-{{ env }} \ --nic net-id="$network" \ --print-ip From e9332887b4a50f28f91fe1c3c62369f4efe7a02d Mon Sep 17 00:00:00 2001 From: Jiri Kyjovsky Date: Fri, 17 Apr 2026 13:17:50 +0200 Subject: [PATCH 005/151] copr-hv: lookup for buildsys keys in backend role --- roles/copr/hypervisor/tasks/main.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/copr/hypervisor/tasks/main.yml b/roles/copr/hypervisor/tasks/main.yml index 8939c00fab..214db1d86c 100644 --- a/roles/copr/hypervisor/tasks/main.yml +++ b/roles/copr/hypervisor/tasks/main.yml @@ -142,8 +142,8 @@ - name: Assure that copr user on copr-backend can ssh as copr@... authorized_key: user: copr - key: "{{ item }}" - with_file: + key: "{{ lookup('file', roles_path ~ '/copr/backend/files/provision/files/' ~ item) }}" + loop: - buildsys.production.pub - buildsys.staging.pub From c53dd67f742525ed0faae85799c9ca342eeac479 Mon Sep 17 00:00:00 2001 From: Jiri Kyjovsky Date: Fri, 17 Apr 2026 13:33:21 +0200 Subject: [PATCH 006/151] Revert "copr-hv: lookup for buildsys keys in backend role" This reverts commit e9332887b4a50f28f91fe1c3c62369f4efe7a02d. --- roles/copr/hypervisor/tasks/main.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/copr/hypervisor/tasks/main.yml b/roles/copr/hypervisor/tasks/main.yml index 214db1d86c..8939c00fab 100644 --- a/roles/copr/hypervisor/tasks/main.yml +++ b/roles/copr/hypervisor/tasks/main.yml @@ -142,8 +142,8 @@ - name: Assure that copr user on copr-backend can ssh as copr@... authorized_key: user: copr - key: "{{ lookup('file', roles_path ~ '/copr/backend/files/provision/files/' ~ item) }}" - loop: + key: "{{ item }}" + with_file: - buildsys.production.pub - buildsys.staging.pub From 41b7cfdaf4097c9b74f6d10260d58205426feae1 Mon Sep 17 00:00:00 2001 From: Jiri Kyjovsky Date: Fri, 17 Apr 2026 13:44:04 +0200 Subject: [PATCH 007/151] copr-hv: add symlinks for buildsys pubkeys --- roles/copr/hypervisor/files/buildsys.production.pub | 1 + roles/copr/hypervisor/files/buildsys.staging.pub | 1 + 2 files changed, 2 insertions(+) create mode 120000 roles/copr/hypervisor/files/buildsys.production.pub create mode 120000 roles/copr/hypervisor/files/buildsys.staging.pub diff --git a/roles/copr/hypervisor/files/buildsys.production.pub b/roles/copr/hypervisor/files/buildsys.production.pub new file mode 120000 index 0000000000..9aecd5a027 --- /dev/null +++ b/roles/copr/hypervisor/files/buildsys.production.pub @@ -0,0 +1 @@ +../../backend/files/buildsys.production.pub \ No newline at end of file diff --git a/roles/copr/hypervisor/files/buildsys.staging.pub b/roles/copr/hypervisor/files/buildsys.staging.pub new file mode 120000 index 0000000000..420d50c2f9 --- /dev/null +++ b/roles/copr/hypervisor/files/buildsys.staging.pub @@ -0,0 +1 @@ +../../backend/files/buildsys.staging.pub \ No newline at end of file From 5c07c25ce19c107ed1c993dfbe41af965a591aaa Mon Sep 17 00:00:00 2001 From: Pavel Raiskup Date: Fri, 17 Apr 2026 14:43:32 +0200 Subject: [PATCH 008/151] copr-be: typo in root password setting --- roles/copr/backend/files/provision/provision_builder_tasks.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/copr/backend/files/provision/provision_builder_tasks.yml b/roles/copr/backend/files/provision/provision_builder_tasks.yml index 47847ca04c..65ffff2cd0 100644 --- a/roles/copr/backend/files/provision/provision_builder_tasks.yml +++ b/roles/copr/backend/files/provision/provision_builder_tasks.yml @@ -280,7 +280,7 @@ - name: root authorized_keys authorized_key: - use: root + user: root key: "{{ lookup('file', 'files/buildsys.pub') }}" - name: setup 10x more fds in limits.conf From 736b0835686296e949690b816619d7ce20fe2959 Mon Sep 17 00:00:00 2001 From: Pavel Raiskup Date: Fri, 17 Apr 2026 15:26:20 +0200 Subject: [PATCH 009/151] copr-be: provide ssh key in config.iso drive for libvirt This is the way to tell the instance's cloud-init what is the (currently rotated) correct ssh pub key. --- .../backend/templates/provision/libvirt-new | 22 ++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) diff --git a/roles/copr/backend/templates/provision/libvirt-new b/roles/copr/backend/templates/provision/libvirt-new index de99ba803e..3183a92b21 100755 --- a/roles/copr/backend/templates/provision/libvirt-new +++ b/roles/copr/backend/templates/provision/libvirt-new @@ -200,6 +200,21 @@ class LibvirtSpawner: """ todo_files = copy.copy(self.config_files) + + # Make sure the machine trusts our buildsys.pub key (via cloud-init). + with open("/var/lib/resallocserver/provision/files/buildsys.pub", "r", + encoding='utf-8') as file: + public_key = file.read() + + user_data = f"""\n +#cloud-config +ssh_authorized_keys: + - {public_key} +""" + todo_files.append(ConfigFile('user-data', user_data)) + meta_data = "instance-id: {self.vm_name}\n" + todo_files.append(ConfigFile('meta-data', meta_data)) + startup_script = self.get_startup_script() if startup_script: todo_files.append(startup_script) @@ -216,9 +231,10 @@ class LibvirtSpawner: image = os.path.join(self.workdir, 'config.iso') - # The 'eimg_config' label is not important, we search for /dev/sr0 - # anyway. - if self.call(['mkisofs', '-o', image, '-V', 'eimg_config', '-r', '-J', + # The 'cidata' label is important, otherwise cloud-init can't take the + # image as NoCloud drive. Other files shouldn't be a problem for cloud + # init. + if self.call(['mkisofs', '-o', image, '-V', 'cidata', '-r', '-J', '--quiet', config_dir]) != 0: raise Exception("mkisofs failed") return image From b94e384d2133be62b33f3e441f7c5e141882b96d Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 17 Apr 2026 08:27:22 -0700 Subject: [PATCH 010/151] proxies / wiki: disable RecentChanges for a bit Signed-off-by: Kevin Fenzi --- .../reverseproxy/templates/reversepassproxy.fp-wiki.conf | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/roles/httpd/reverseproxy/templates/reversepassproxy.fp-wiki.conf b/roles/httpd/reverseproxy/templates/reversepassproxy.fp-wiki.conf index 8b63c25e3a..ad659988b9 100644 --- a/roles/httpd/reverseproxy/templates/reversepassproxy.fp-wiki.conf +++ b/roles/httpd/reverseproxy/templates/reversepassproxy.fp-wiki.conf @@ -14,6 +14,10 @@ RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R=301,NE,L] RewriteCond %{HTTP_USER_AGENT} "(Bytespider|ClaudeBot|Amazonbot|YandexBot|ChatGLM-Spider|GPTBot|Barkrowler|YisouSpider|MJ12bot|Avengineers-Crawler)" [NC] RewriteRule .* - [F,L] +# temp disable recent changes for bots +RewriteCond %{QUERY_STRING} title=Special%3ARecentChanges [NC] +RewriteRule .* - [F,L] + # /wiki must come before /w due to prefix matching. ProxyPass {{wikipath}} {{proxyurl}}{{wikipath}} ProxyPassReverse {{wikipath}} {{proxyurl}}{{wikipath}} From b4858d172d38ea89c5c65934a7971067849d2eaf Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 17 Apr 2026 08:49:21 -0700 Subject: [PATCH 011/151] Revert "proxies / wiki: disable RecentChanges for a bit" This reverts commit b94e384d2133be62b33f3e441f7c5e141882b96d. --- .../reverseproxy/templates/reversepassproxy.fp-wiki.conf | 4 ---- 1 file changed, 4 deletions(-) diff --git a/roles/httpd/reverseproxy/templates/reversepassproxy.fp-wiki.conf b/roles/httpd/reverseproxy/templates/reversepassproxy.fp-wiki.conf index ad659988b9..8b63c25e3a 100644 --- a/roles/httpd/reverseproxy/templates/reversepassproxy.fp-wiki.conf +++ b/roles/httpd/reverseproxy/templates/reversepassproxy.fp-wiki.conf @@ -14,10 +14,6 @@ RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R=301,NE,L] RewriteCond %{HTTP_USER_AGENT} "(Bytespider|ClaudeBot|Amazonbot|YandexBot|ChatGLM-Spider|GPTBot|Barkrowler|YisouSpider|MJ12bot|Avengineers-Crawler)" [NC] RewriteRule .* - [F,L] -# temp disable recent changes for bots -RewriteCond %{QUERY_STRING} title=Special%3ARecentChanges [NC] -RewriteRule .* - [F,L] - # /wiki must come before /w due to prefix matching. ProxyPass {{wikipath}} {{proxyurl}}{{wikipath}} ProxyPassReverse {{wikipath}} {{proxyurl}}{{wikipath}} From b5e23007004f3e1afba2c9b33dce71a0fa226806 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 17 Apr 2026 09:05:29 -0700 Subject: [PATCH 012/151] wiki: increase cpus to 16 to handle load Signed-off-by: Kevin Fenzi --- inventory/group_vars/wiki | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/inventory/group_vars/wiki b/inventory/group_vars/wiki index 6e80764a73..f75a51f7b3 100644 --- a/inventory/group_vars/wiki +++ b/inventory/group_vars/wiki @@ -14,7 +14,7 @@ lvm_size: 30000 max_mem_size: 8192 mem_size: 8192 nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=3" -num_cpus: 4 +num_cpus: 16 primary_auth_source: ipa tcp_ports: [80] # mediawiki variables From f0de921632d3622e030efcf532fa67cba78f4f0f Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 17 Apr 2026 09:32:52 -0700 Subject: [PATCH 013/151] copr-hypervisor: add serial-console role to x86 hypervisors This sets up kernel and grub to provide a serial console, which can be accessed via ipmitool. Signed-off-by: Kevin Fenzi --- playbooks/groups/copr-hypervisor.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/playbooks/groups/copr-hypervisor.yml b/playbooks/groups/copr-hypervisor.yml index 512c145f59..e05596e502 100644 --- a/playbooks/groups/copr-hypervisor.yml +++ b/playbooks/groups/copr-hypervisor.yml @@ -41,6 +41,7 @@ - import_role: name: copr/hypervisor tags: copr_hypervisor + - {import_role: serial-console, when: datacenter == 'rdu3' and ansible_architecture != 'ppc64le'} - {import_role: name=linux-system-roles.nbde_client, tags: ['nbde_client'], when: (nbde|bool) } From 1c688fe30e8731409973183e99792de62f0fc103 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 17 Apr 2026 09:35:41 -0700 Subject: [PATCH 014/151] copr-hypervisor: fix syntax error Signed-off-by: Kevin Fenzi --- playbooks/groups/copr-hypervisor.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/playbooks/groups/copr-hypervisor.yml b/playbooks/groups/copr-hypervisor.yml index e05596e502..0bf65c2291 100644 --- a/playbooks/groups/copr-hypervisor.yml +++ b/playbooks/groups/copr-hypervisor.yml @@ -41,7 +41,7 @@ - import_role: name: copr/hypervisor tags: copr_hypervisor - - {import_role: serial-console, when: datacenter == 'rdu3' and ansible_architecture != 'ppc64le'} + - {import_role: name=serial-console, when: datacenter == 'rdu3' and ansible_architecture != 'ppc64le'} - {import_role: name=linux-system-roles.nbde_client, tags: ['nbde_client'], when: (nbde|bool) } From c8b087230dee2ebdbf953d99fe926d6895eeaf83 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 17 Apr 2026 10:12:51 -0700 Subject: [PATCH 015/151] copr-hypervisor: fix mode on ansible calls Signed-off-by: Kevin Fenzi --- playbooks/groups/copr-hypervisor.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/playbooks/groups/copr-hypervisor.yml b/playbooks/groups/copr-hypervisor.yml index 0bf65c2291..7e73eb0036 100644 --- a/playbooks/groups/copr-hypervisor.yml +++ b/playbooks/groups/copr-hypervisor.yml @@ -20,7 +20,7 @@ dest: /usr/bin/nbde_client-network-flush owner: root group: root - mode: 755 + mode: 0755 - name: tell NetworkManager we don't want any auto connections ansible.builtin.copy: @@ -28,7 +28,7 @@ dest: /etc/NetworkManager/conf.d/noautodefault.conf owner: root group: root - mode: 644 + mode: 0644 tasks: - import_role: name=base From 53234bcecef97301287418cfe86143a623552f02 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 17 Apr 2026 11:03:03 -0700 Subject: [PATCH 016/151] copr-hypervisor / x86: bind second and third luks devices These machines have a /dev/md3 and /dev/md4 that are encrypted, but we were only binding /dev/md2, so boots would wait for a passphrase. This binds all of them (they have the same passphrase and can use the same tang server they just need to be bound to do so) Signed-off-by: Kevin Fenzi --- inventory/group_vars/copr_hypervisor | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/inventory/group_vars/copr_hypervisor b/inventory/group_vars/copr_hypervisor index 7a2fe21d09..ca37f2dc2b 100644 --- a/inventory/group_vars/copr_hypervisor +++ b/inventory/group_vars/copr_hypervisor @@ -28,6 +28,26 @@ nbde_client_bindings: - http://tang01.rdu3.fedoraproject.org - http://tang02.rdu3.fedoraproject.org +nbde_device2: /dev/md3 +nbde_client_bindings: + - device: "{{ nbde_device2 }}" + encryption_password: "{{ nbde_password }}" + password_temporary: no + threshold: 1 + servers: + - http://tang01.rdu3.fedoraproject.org + - http://tang02.rdu3.fedoraproject.org + +nbde_device3: /dev/md4 +nbde_client_bindings: + - device: "{{ nbde_device3 }}" + encryption_password: "{{ nbde_password }}" + password_temporary: no + threshold: 1 + servers: + - http://tang01.rdu3.fedoraproject.org + - http://tang02.rdu3.fedoraproject.org + libvirt_host: "{{ inventory_hostname }}" nft_custom_rules: From bce5f8bbc9a7f64e64f2ec2ce47f477014f61afb Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 17 Apr 2026 11:06:20 -0700 Subject: [PATCH 017/151] copr-hypervisor: reform things as a single list which the role expects Signed-off-by: Kevin Fenzi --- inventory/group_vars/copr_hypervisor | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/inventory/group_vars/copr_hypervisor b/inventory/group_vars/copr_hypervisor index ca37f2dc2b..2dd7d4013e 100644 --- a/inventory/group_vars/copr_hypervisor +++ b/inventory/group_vars/copr_hypervisor @@ -19,6 +19,8 @@ primary_auth_source: ipa nbde: true nbde_device: /dev/md2 +nbde_device2: /dev/md3 +nbde_device3: /dev/md4 nbde_client_bindings: - device: "{{ nbde_device }}" encryption_password: "{{ nbde_password }}" @@ -27,9 +29,6 @@ nbde_client_bindings: servers: - http://tang01.rdu3.fedoraproject.org - http://tang02.rdu3.fedoraproject.org - -nbde_device2: /dev/md3 -nbde_client_bindings: - device: "{{ nbde_device2 }}" encryption_password: "{{ nbde_password }}" password_temporary: no @@ -37,9 +36,6 @@ nbde_client_bindings: servers: - http://tang01.rdu3.fedoraproject.org - http://tang02.rdu3.fedoraproject.org - -nbde_device3: /dev/md4 -nbde_client_bindings: - device: "{{ nbde_device3 }}" encryption_password: "{{ nbde_password }}" password_temporary: no From 72204472942926fb8d600b943c1af36b295cb519 Mon Sep 17 00:00:00 2001 From: Ryan Lerch Date: Mon, 20 Apr 2026 14:36:55 +1000 Subject: [PATCH 018/151] forge: add members team mapping for discussion org resolves: https://forge.fedoraproject.org/forge/forge/issues/449 Signed-off-by: Ryan Lerch --- roles/openshift-apps/forgejo/templates/values.yaml.j2 | 1 + 1 file changed, 1 insertion(+) diff --git a/roles/openshift-apps/forgejo/templates/values.yaml.j2 b/roles/openshift-apps/forgejo/templates/values.yaml.j2 index f013b5ee28..2a4e80d0fd 100644 --- a/roles/openshift-apps/forgejo/templates/values.yaml.j2 +++ b/roles/openshift-apps/forgejo/templates/values.yaml.j2 @@ -551,6 +551,7 @@ gitea: "forge-legal-owners":{"legal":["Owners"]}, "forge-podcast-owners":{"podcast":["Owners"]}, "forge-discussion-owners":{"discussion":["Owners"]}, + "forge-discussion-members":{"discussion":["Members"]}, "forge-science-owners":{"science":["Owners"]}, "forge-science-members":{"science":["Members"]}, "forge-eln-owners":{"eln":["Owners"]}, From 40213164a95a7613e20350752310095779264814 Mon Sep 17 00:00:00 2001 From: Ryan Lerch Date: Mon, 20 Apr 2026 16:55:40 +1000 Subject: [PATCH 019/151] forge: add group team mappings for the packager org related: https://forge.fedoraproject.org/forge/forge/issues/456 Signed-off-by: Ryan Lerch --- roles/openshift-apps/forgejo/templates/values.yaml.j2 | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/roles/openshift-apps/forgejo/templates/values.yaml.j2 b/roles/openshift-apps/forgejo/templates/values.yaml.j2 index 2a4e80d0fd..3917f852a7 100644 --- a/roles/openshift-apps/forgejo/templates/values.yaml.j2 +++ b/roles/openshift-apps/forgejo/templates/values.yaml.j2 @@ -559,7 +559,11 @@ gitea: "forge-koji-owners":{"koji":["Owners"]}, "forge-koji-members":{"koji":["Members"]}, "forge-i18n-owners":{"i18n":["Owners"]}, - "forge-i18n-members":{"i18n":["Members"]} + "forge-i18n-members":{"i18n":["Members"]}, + "forge-packaging-owners":{"packaging":["Owners"]}, + "forge-packaging-committee":{"packaging":["Committee"]}, + "forge-packaging-packager":{"packaging":["Packager"]}, + "forge-packaging-provenpackager":{"packaging":["Proven Packager"]} }' {% endif %} # - name: 'OAuth 1' From a995494928ebfd56dd9f6b8370b042b04a943783 Mon Sep 17 00:00:00 2001 From: Ryan Lerch Date: Mon, 20 Apr 2026 17:03:31 +1000 Subject: [PATCH 020/151] forge: update provenpackger team mapping typo Signed-off-by: Ryan Lerch --- roles/openshift-apps/forgejo/templates/values.yaml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/forgejo/templates/values.yaml.j2 b/roles/openshift-apps/forgejo/templates/values.yaml.j2 index 3917f852a7..8b23c92959 100644 --- a/roles/openshift-apps/forgejo/templates/values.yaml.j2 +++ b/roles/openshift-apps/forgejo/templates/values.yaml.j2 @@ -563,7 +563,7 @@ gitea: "forge-packaging-owners":{"packaging":["Owners"]}, "forge-packaging-committee":{"packaging":["Committee"]}, "forge-packaging-packager":{"packaging":["Packager"]}, - "forge-packaging-provenpackager":{"packaging":["Proven Packager"]} + "forge-packaging-provenpackager":{"packaging":["ProvenPackager"]} }' {% endif %} # - name: 'OAuth 1' From f1fdd141c708b98992a5af8fc500d029ddc6b164 Mon Sep 17 00:00:00 2001 From: Jakub Kadlcik Date: Mon, 20 Apr 2026 15:00:49 +0200 Subject: [PATCH 021/151] copr: configure SENTRY_DSN --- roles/copr/backend/templates/copr-be.conf.j2 | 5 +++++ roles/copr/dist_git/files/dist-git.conf | 3 +++ roles/copr/frontend/templates/copr.conf | 5 +++++ 3 files changed, 13 insertions(+) diff --git a/roles/copr/backend/templates/copr-be.conf.j2 b/roles/copr/backend/templates/copr-be.conf.j2 index 2d7801a1c3..bd21332638 100644 --- a/roles/copr/backend/templates/copr-be.conf.j2 +++ b/roles/copr/backend/templates/copr-be.conf.j2 @@ -114,6 +114,11 @@ pulp_content_url={{ pulp_content_url }} # praiskup +{% if env == 'production' %} +sentry_dsn={{ copr_sentry_dsn }} +{% endif %} + + [builder] # default is 1800, this probably has no effect! timeout=108000 diff --git a/roles/copr/dist_git/files/dist-git.conf b/roles/copr/dist_git/files/dist-git.conf index 3e1f871ebc..30c59e82ad 100644 --- a/roles/copr/dist_git/files/dist-git.conf +++ b/roles/copr/dist_git/files/dist-git.conf @@ -12,3 +12,6 @@ gitolite = False # name of the default branch (a.k.a. master or main) default_branch = master +{% if env == 'production' %} +sentry_dsn={{ copr_sentry_dsn }} +{% endif %} diff --git a/roles/copr/frontend/templates/copr.conf b/roles/copr/frontend/templates/copr.conf index 840257a23a..4de5c4040f 100644 --- a/roles/copr/frontend/templates/copr.conf +++ b/roles/copr/frontend/templates/copr.conf @@ -321,3 +321,8 @@ OIDC_METADATA = "https://id.fedoraproject.org/openidc/.well-known/openid-configu OIDC_SECRET = "{{ copr_oidc_stg_client_secret }}" OIDC_METADATA = "https://id.stg.fedoraproject.org/openidc/.well-known/openid-configuration" {% endif %} + + +{% if env == 'production' %} +SENTRY_DSN={{ copr_sentry_dsn }} +{% endif %} From 6585e9506e534bd5c4082ec9f770ea6425baea8c Mon Sep 17 00:00:00 2001 From: Jakub Kadlcik Date: Mon, 20 Apr 2026 15:10:52 +0200 Subject: [PATCH 022/151] copr-fe: oops, this needs to be in quotes --- roles/copr/frontend/templates/copr.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/copr/frontend/templates/copr.conf b/roles/copr/frontend/templates/copr.conf index 4de5c4040f..c52fa28dd9 100644 --- a/roles/copr/frontend/templates/copr.conf +++ b/roles/copr/frontend/templates/copr.conf @@ -324,5 +324,5 @@ OIDC_METADATA = "https://id.stg.fedoraproject.org/openidc/.well-known/openid-con {% if env == 'production' %} -SENTRY_DSN={{ copr_sentry_dsn }} +SENTRY_DSN="{{ copr_sentry_dsn }}" {% endif %} From cea0a27b737837df664b83cdcbce0b52b2293bc0 Mon Sep 17 00:00:00 2001 From: Pavel Raiskup Date: Mon, 20 Apr 2026 15:21:34 +0200 Subject: [PATCH 023/151] copr-be: pools: normalreserved => reserved --- roles/copr/backend/templates/resalloc/pools.yaml.j2 | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/roles/copr/backend/templates/resalloc/pools.yaml.j2 b/roles/copr/backend/templates/resalloc/pools.yaml.j2 index d3550dfd0c..e405be2819 100644 --- a/roles/copr/backend/templates/resalloc/pools.yaml.j2 +++ b/roles/copr/backend/templates/resalloc/pools.yaml.j2 @@ -3,9 +3,14 @@ # Notes for Resalloc configuration file: # {% if False %} -# - This is rather a complex Jinja template. Feel free to use the helper -# script to expand locally before you commit any change to this file: -# ./roles/copr/backend/templates/resalloc/pools.yaml.expand.sh +# +# =================================================================== +# =================================================================== +# This is rather a complex Jinja template. PLEASE use the helper +# script to expand locally before you commit any change to this file: +# ./roles/copr/backend/templates/resalloc/pools.yaml.expand.sh +# =================================================================== +# =================================================================== # {% endif %} # - You do NOT need to restart resalloc server after changing this file, it @@ -25,7 +30,7 @@ # d) remove the pool in PostgreSQL database. {% macro aws(arch, max, max_starting, max_prealloc, spot=False, on_demand=none, priority=0, reserved=False) %} -aws_{{ arch }}_{{ on_demand + '_' if on_demand is not none else '' }}{% if spot %}spot{% else %}normal{% endif %}{% if reserved %}reserved{% endif %}_{% if devel %}dev{% else %}prod{% endif %}: +aws_{{ arch }}_{{ on_demand + '_' if on_demand is not none else '' }}{% if spot %}spot{% elif reserved %}reserved{% else %}normal{% endif %}_{% if devel %}dev{% else %}prod{% endif %}: {% if on_demand and not reserved %} max: 10 max_starting: 4 From fa12d43951fb1bda273e61a5cd5f4a5e025379c5 Mon Sep 17 00:00:00 2001 From: Pavel Raiskup Date: Mon, 20 Apr 2026 16:28:39 +0200 Subject: [PATCH 024/151] copr-be: fix private key permissions --- roles/copr/backend/tasks/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/copr/backend/tasks/main.yml b/roles/copr/backend/tasks/main.yml index a4f06e8a06..417ff01704 100644 --- a/roles/copr/backend/tasks/main.yml +++ b/roles/copr/backend/tasks/main.yml @@ -66,7 +66,7 @@ dest: /home/copr/.ssh/id_rsa owner: copr group: copr - mode: 600 + mode: "0600" - name: Setup copr user ssh config file ansible.builtin.template: From e5bcb02c66425d571418b01b633b48b2dd159428 Mon Sep 17 00:00:00 2001 From: Lenka Segura Date: Tue, 21 Apr 2026 12:59:06 +0200 Subject: [PATCH 025/151] forgejo: Fix runner registration Signed-off-by: Lenka Segura --- roles/openshift-apps/forgejo/tasks/register-runners.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/roles/openshift-apps/forgejo/tasks/register-runners.yaml b/roles/openshift-apps/forgejo/tasks/register-runners.yaml index 424bee10c5..d5ce4e1bd1 100644 --- a/roles/openshift-apps/forgejo/tasks/register-runners.yaml +++ b/roles/openshift-apps/forgejo/tasks/register-runners.yaml @@ -14,7 +14,7 @@ kubernetes.core.k8s_exec: namespace: forgejo pod: "{{ forgejo_pods.resources[0].metadata.name }}" - command: "forgejo forgejo-cli actions register --name {{ item.name }} --labels {{ item.labels | join(',') }} --secret {{ item.secret }}{{ ' --scope ' + item.scope if item.scope is defined and item.scope != 'global' else '' }}" + command: "forgejo forgejo-cli actions register --name {{ item['name'] }} --labels {{ item['labels'] | join(',') }} --secret {{ item['secret'] }}{{ ' --scope ' + item['scope'] if item['scope'] is defined and item['scope'] != 'global' else '' }}" loop: "{{ (env == 'production') | ternary(forgejo_runner_secrets, forgejo_stg_runner_secrets) }}" register: forgejo_cli_outputs failed_when: >- @@ -28,8 +28,8 @@ - name: Display CLI registration results ansible.builtin.debug: msg: | - Runner: {{ item.item.name }} - Labels: {{ item.item.labels | join(', ') }} - Status: {% if item.rc is defined and item.rc == 0 %}Registered{% elif 'duplicate key' in (item.stderr | default('')) + (item.msg | default('')) %}Already exists{% else %}Failed: {{ item.msg | default('unknown error') }}{% endif %} + Runner: {{ item['item']['name'] }} + Labels: {{ item['item']['labels'] | join(', ') }} + Status: {% if item['rc'] is defined and item['rc'] == 0 %}Registered{% elif 'duplicate key' in (item['stderr'] | default('')) + (item['msg'] | default('')) %}Already exists{% else %}Failed: {{ item['msg'] | default('unknown error') }}{% endif %} loop: "{{ forgejo_cli_outputs.results }}" when: forgejo_cli_outputs is defined From cd5d720e6d7ef82bb744352943d5e3b210fd69f9 Mon Sep 17 00:00:00 2001 From: Pavel Raiskup Date: Wed, 22 Apr 2026 09:19:13 +0200 Subject: [PATCH 026/151] copr-be: drop Power8 hypervisors from our configuration --- inventory/group_vars/copr_aws | 5 --- inventory/group_vars/copr_dev_aws | 4 --- .../backend/templates/resalloc/pools.yaml.j2 | 35 ------------------- .../backend/templates/resalloc/vm-delete.j2 | 5 --- 4 files changed, 49 deletions(-) diff --git a/inventory/group_vars/copr_aws b/inventory/group_vars/copr_aws index ffcaca5ff6..77c3081267 100644 --- a/inventory/group_vars/copr_aws +++ b/inventory/group_vars/copr_aws @@ -33,11 +33,6 @@ builders: aws_spot: aarch64: [30, 4, 1] x86_64: [70, 8, 16] - ppc64le_hypervisor_01: - ppc64le: [0, 4, 15] - # There's the ppc64le-test machine, so keep 2 builders less. - ppc64le_hypervisor_02: - ppc64le: [0, 4, 13] p09_hypervisor_01: ppc64le: [15, 5, 15] p09_hypervisor_02: diff --git a/inventory/group_vars/copr_dev_aws b/inventory/group_vars/copr_dev_aws index 0ecc09b90a..9856cfe2a9 100644 --- a/inventory/group_vars/copr_dev_aws +++ b/inventory/group_vars/copr_dev_aws @@ -33,10 +33,6 @@ builders: aws_spot: aarch64: [3, 3, 1] x86_64: [0, 0, 1] - ppc64le_hypervisor_01: - ppc64le: [0, 1, 1] - ppc64le_hypervisor_02: - ppc64le: [0, 1, 1] p09_hypervisor_01: ppc64le: [1, 1, 1] p09_hypervisor_02: diff --git a/roles/copr/backend/templates/resalloc/pools.yaml.j2 b/roles/copr/backend/templates/resalloc/pools.yaml.j2 index e405be2819..e770a6ed42 100644 --- a/roles/copr/backend/templates/resalloc/pools.yaml.j2 +++ b/roles/copr/backend/templates/resalloc/pools.yaml.j2 @@ -252,41 +252,6 @@ vmhost_x86_{{ hv }}_{% if devel %}dev{% else %}prod{% endif %}: {% endif %} {% endfor %} -# Power8 hypervisors -{% for hv in ["01", "02", "03"] %} -{% if "ppc64le_hypervisor_" + hv in builders %} - -copr_hv_ppc64le_{{ hv }}_{% if devel %}dev{% else %}prod{% endif %}: - max: {{ builders["ppc64le_hypervisor_" + hv]["ppc64le"][0] }} - max_starting: {{ builders["ppc64le_hypervisor_" + hv]["ppc64le"][1] }} - max_prealloc: {{ builders["ppc64le_hypervisor_" + hv]["ppc64le"][2] }} - tags: - - copr_builder - - name: arch_noarch - priority: -8 - - arch_ppc64le - - arch_ppc64le_native - - hypervisor - - hypervisor_ppc64le - - hypervisor_ppc64le_{{ hv }} - - arch_power8 - cmd_new: "copr-resalloc-vm-ip-to-yaml /var/lib/resallocserver/provision/libvirt-new --swap-vol-size 168" - cmd_delete: "/var/lib/resallocserver/resalloc_provision/vm-delete" - cmd_livecheck: "resalloc-check-vm-ip" - cmd_release: "/var/lib/resallocserver/resalloc_provision/vm-release" - cmd_list: "/var/lib/resallocserver/provision/libvirt-list" - livecheck_period: 180 - reuse_opportunity_time: 90 - reuse_max_count: 8 - reuse_max_time: 1800 - description: > - A pool of ppc64le instances in the Fedora Community Cage. - These machines have POWER8 processors and are located in RDU (N Carolina). - Thank you Fedora Infrastructure team for maintaining the hypervisors. - -{% endif %} -{% endfor %} - # Power9 hypervisors {% for hv in ["01", "02", "03", "04"] %} {% if "p09_hypervisor_" + hv in builders %} diff --git a/roles/copr/backend/templates/resalloc/vm-delete.j2 b/roles/copr/backend/templates/resalloc/vm-delete.j2 index 81cc7be442..673e02b94b 100755 --- a/roles/copr/backend/templates/resalloc/vm-delete.j2 +++ b/roles/copr/backend/templates/resalloc/vm-delete.j2 @@ -41,11 +41,6 @@ copr_osuosl_*) *s390x*) exit 0 ;; - -*copr_hv_x86_64_*) - ;; -*copr_hv_ppc64le_*) - ;; vmhost*) # hypervisors ;; From 583c76363d0f67093611e1510dc9b093d6dc038a Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Wed, 22 Apr 2026 09:11:58 -0700 Subject: [PATCH 027/151] openQA: drop aarch64 concurrent workers to 45 We're just getting too many flakes on aarch64 tests. Let's see if this helps. Signed-off-by: Adam Williamson --- .../host_vars/openqa-a64-worker01.rdu3.fedoraproject.org | 4 ++-- .../host_vars/openqa-a64-worker02.rdu3.fedoraproject.org | 4 ++-- .../host_vars/openqa-a64-worker03.rdu3.fedoraproject.org | 4 ++-- .../host_vars/openqa-a64-worker04.rdu3.fedoraproject.org | 4 ++-- .../host_vars/openqa-a64-worker05.rdu3.fedoraproject.org | 4 ++-- .../host_vars/openqa-a64-worker06.rdu3.fedoraproject.org | 4 ++-- 6 files changed, 12 insertions(+), 12 deletions(-) diff --git a/inventory/host_vars/openqa-a64-worker01.rdu3.fedoraproject.org b/inventory/host_vars/openqa-a64-worker01.rdu3.fedoraproject.org index 6a27a6a941..aa02e092b4 100644 --- a/inventory/host_vars/openqa-a64-worker01.rdu3.fedoraproject.org +++ b/inventory/host_vars/openqa-a64-worker01.rdu3.fedoraproject.org @@ -67,7 +67,7 @@ nrpe_procs_warn: 1400 openqa_rngd: true openqa_tap_iface: bondbr0 # this is a very powerful machine, can handle so many openQA workers -openqa_workers: 60 +openqa_workers: 45 # also means we need to bump the load average threshold openqa_critical_threshold: 120 sudoers: "{{ private }}/files/sudo/qavirt-sudoers" @@ -76,7 +76,7 @@ sudoers: "{{ private }}/files/sudo/qavirt-sudoers" # QEMUPORT is: # $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002; # so for worker 1 it's 20012, for worker 2 it's 20022, etc etc -tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453', '20463', '20473', '20483', '20493', '20503', '20513', '20523', '20533', '20543', '20553', '20563', '20573', '20583', '20593', '20603'] +tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453'] # This is used to populate the inventory fields, only specific keys are allowed, see # https://www.zabbix.com/documentation/current/en/manual/api/reference/host/object#host-inventory diff --git a/inventory/host_vars/openqa-a64-worker02.rdu3.fedoraproject.org b/inventory/host_vars/openqa-a64-worker02.rdu3.fedoraproject.org index a5fc810824..1db5ac8d64 100644 --- a/inventory/host_vars/openqa-a64-worker02.rdu3.fedoraproject.org +++ b/inventory/host_vars/openqa-a64-worker02.rdu3.fedoraproject.org @@ -67,7 +67,7 @@ nrpe_procs_warn: 1400 openqa_rngd: true openqa_tap_iface: bondbr0 # this is a very powerful machine, can handle so many openQA workers -openqa_workers: 60 +openqa_workers: 45 # also means we need to bump the load average threshold openqa_critical_threshold: 120 sudoers: "{{ private }}/files/sudo/qavirt-sudoers" @@ -76,7 +76,7 @@ sudoers: "{{ private }}/files/sudo/qavirt-sudoers" # QEMUPORT is: # $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002; # so for worker 1 it's 20012, for worker 2 it's 20022, etc etc -tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453', '20463', '20473', '20483', '20493', '20503', '20513', '20523', '20533', '20543', '20553', '20563', '20573', '20583', '20593', '20603'] +tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453'] # This is used to populate the inventory fields, only specific keys are allowed, see # https://www.zabbix.com/documentation/current/en/manual/api/reference/host/object#host-inventory diff --git a/inventory/host_vars/openqa-a64-worker03.rdu3.fedoraproject.org b/inventory/host_vars/openqa-a64-worker03.rdu3.fedoraproject.org index 19ed4637ff..fe74f2b33d 100644 --- a/inventory/host_vars/openqa-a64-worker03.rdu3.fedoraproject.org +++ b/inventory/host_vars/openqa-a64-worker03.rdu3.fedoraproject.org @@ -67,7 +67,7 @@ nrpe_procs_warn: 1400 openqa_rngd: true openqa_tap_iface: bondbr0 # this is a very powerful machine, can handle so many openQA workers -openqa_workers: 60 +openqa_workers: 45 # also means we need to bump the load average threshold openqa_critical_threshold: 120 sudoers: "{{ private }}/files/sudo/qavirt-sudoers" @@ -76,7 +76,7 @@ sudoers: "{{ private }}/files/sudo/qavirt-sudoers" # QEMUPORT is: # $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002; # so for worker 1 it's 20012, for worker 2 it's 20022, etc etc -tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453', '20463', '20473', '20483', '20493', '20503', '20513', '20523', '20533', '20543', '20553', '20563', '20573', '20583', '20593', '20603'] +tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453'] # This is used to populate the inventory fields, only specific keys are allowed, see # https://www.zabbix.com/documentation/current/en/manual/api/reference/host/object#host-inventory diff --git a/inventory/host_vars/openqa-a64-worker04.rdu3.fedoraproject.org b/inventory/host_vars/openqa-a64-worker04.rdu3.fedoraproject.org index 62c971c506..1924e9a617 100644 --- a/inventory/host_vars/openqa-a64-worker04.rdu3.fedoraproject.org +++ b/inventory/host_vars/openqa-a64-worker04.rdu3.fedoraproject.org @@ -67,7 +67,7 @@ nrpe_procs_warn: 1400 openqa_rngd: true openqa_tap_iface: bondbr0 # this is a very powerful machine, can handle so many openQA workers -openqa_workers: 60 +openqa_workers: 45 # also means we need to bump the load average threshold openqa_critical_threshold: 120 sudoers: "{{ private }}/files/sudo/qavirt-sudoers" @@ -76,7 +76,7 @@ sudoers: "{{ private }}/files/sudo/qavirt-sudoers" # QEMUPORT is: # $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002; # so for worker 1 it's 20012, for worker 2 it's 20022, etc etc -tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453', '20463', '20473', '20483', '20493', '20503', '20513', '20523', '20533', '20543', '20553', '20563', '20573', '20583', '20593', '20603'] +tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453'] # This is used to populate the inventory fields, only specific keys are allowed, see # https://www.zabbix.com/documentation/current/en/manual/api/reference/host/object#host-inventory diff --git a/inventory/host_vars/openqa-a64-worker05.rdu3.fedoraproject.org b/inventory/host_vars/openqa-a64-worker05.rdu3.fedoraproject.org index faf5ba1cb2..a9d9851937 100644 --- a/inventory/host_vars/openqa-a64-worker05.rdu3.fedoraproject.org +++ b/inventory/host_vars/openqa-a64-worker05.rdu3.fedoraproject.org @@ -67,7 +67,7 @@ nrpe_procs_warn: 1400 openqa_rngd: true openqa_tap_iface: bondbr0 # this is a very powerful machine, can handle so many openQA workers -openqa_workers: 60 +openqa_workers: 45 # also means we need to bump the load average threshold openqa_critical_threshold: 120 sudoers: "{{ private }}/files/sudo/qavirt-sudoers" @@ -76,7 +76,7 @@ sudoers: "{{ private }}/files/sudo/qavirt-sudoers" # QEMUPORT is: # $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002; # so for worker 1 it's 20012, for worker 2 it's 20022, etc etc -tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453', '20463', '20473', '20483', '20493', '20503', '20513', '20523', '20533', '20543', '20553', '20563', '20573', '20583', '20593', '20603'] +tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453'] # This is used to populate the inventory fields, only specific keys are allowed, see # https://www.zabbix.com/documentation/current/en/manual/api/reference/host/object#host-inventory diff --git a/inventory/host_vars/openqa-a64-worker06.rdu3.fedoraproject.org b/inventory/host_vars/openqa-a64-worker06.rdu3.fedoraproject.org index d9bed19285..a936f17992 100644 --- a/inventory/host_vars/openqa-a64-worker06.rdu3.fedoraproject.org +++ b/inventory/host_vars/openqa-a64-worker06.rdu3.fedoraproject.org @@ -67,7 +67,7 @@ nrpe_procs_warn: 1400 openqa_rngd: true openqa_tap_iface: bondbr0 # this is a very powerful machine, can handle so many openQA workers -openqa_workers: 60 +openqa_workers: 45 # also means we need to bump the load average threshold openqa_critical_threshold: 120 sudoers: "{{ private }}/files/sudo/qavirt-sudoers" @@ -76,7 +76,7 @@ sudoers: "{{ private }}/files/sudo/qavirt-sudoers" # QEMUPORT is: # $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002; # so for worker 1 it's 20012, for worker 2 it's 20022, etc etc -tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453', '20463', '20473', '20483', '20493', '20503', '20513', '20523', '20533', '20543', '20553', '20563', '20573', '20583', '20593', '20603'] +tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303', '20313', '20323', '20333', '20343', '20353', '20363', '20373', '20383', '20393', '20403', '20413', '20423', '20433', '20443', '20453'] # This is used to populate the inventory fields, only specific keys are allowed, see # https://www.zabbix.com/documentation/current/en/manual/api/reference/host/object#host-inventory From 36df8e0ac5ce2a9d1912c87b3bfab8f9f9abd5a1 Mon Sep 17 00:00:00 2001 From: Pavel Raiskup Date: Thu, 23 Apr 2026 16:55:41 +0200 Subject: [PATCH 028/151] vmhost-x86-copr04 is down, let's not try to start VMs on it --- inventory/group_vars/copr_aws | 2 +- inventory/group_vars/copr_dev_aws | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/inventory/group_vars/copr_aws b/inventory/group_vars/copr_aws index 77c3081267..674dacaea8 100644 --- a/inventory/group_vars/copr_aws +++ b/inventory/group_vars/copr_aws @@ -56,7 +56,7 @@ builders: x86_hypervisor_03: x86_64: [20, 4, 20] x86_hypervisor_04: - x86_64: [20, 4, 20] + x86_64: [0, 4, 20] ibm_cloud_us_east_hp: s390x: [2, 1, 0] diff --git a/inventory/group_vars/copr_dev_aws b/inventory/group_vars/copr_dev_aws index 9856cfe2a9..697c9d88a1 100644 --- a/inventory/group_vars/copr_dev_aws +++ b/inventory/group_vars/copr_dev_aws @@ -56,7 +56,7 @@ builders: x86_hypervisor_03: x86_64: [2, 1, 1] x86_hypervisor_04: - x86_64: [2, 1, 1] + x86_64: [0, 1, 1] ibm_cloud_us_east_hp: s390x: [1, 1, 0] From 471fb7d3c2934e273e20d9b8f37938247c7ba419 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Thu, 23 Apr 2026 12:50:45 -0700 Subject: [PATCH 029/151] Put riscv Koji behind anubis it's getting spammed by scrapers ATM. This follows the prod Koji config as best I can: koji is always behind anubis, kojipkgs is behind anubis on external proxies, not on internal proxies. Signed-off-by: Adam Williamson --- playbooks/include/proxies-websites.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/playbooks/include/proxies-websites.yml b/playbooks/include/proxies-websites.yml index 2801d18fa2..7dd7a9ffee 100644 --- a/playbooks/include/proxies-websites.yml +++ b/playbooks/include/proxies-websites.yml @@ -1292,6 +1292,7 @@ cert_name: "{{wildcard_cert_name}}" tags: - riscv-koji + anubis: true - role: httpd/website site_name: riscv-kojipkgs.fedoraproject.org @@ -1299,6 +1300,17 @@ cert_name: "{{wildcard_cert_name}}" tags: - riscv-koji + anubis: true + when: "'proxies_internal' not in group_names" + + - role: httpd/website + site_name: riscv-kojipkgs.fedoraproject.org + sslonly: true + cert_name: "{{wildcard_cert_name}}" + tags: + - riscv-koji + anubis: false + when: "'proxies_internal' in group_names" - role: httpd/website site_name: "forge{{ env_suffix }}.fedoraproject.org" From 037447667151a8a8e47fe85e7ebcef2ff74c1a09 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Thu, 23 Apr 2026 13:03:39 -0700 Subject: [PATCH 030/151] Apply restrictive robots.txt to riscv-koji This is the same file used on primary koji. It disallows robots instead of just asking them to slow their roll like the default robots.txt does. Signed-off-by: Adam Williamson --- .../templates/robots/riscv-koji.fedoraproject.org-robots.txt | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 roles/httpd/website/templates/robots/riscv-koji.fedoraproject.org-robots.txt diff --git a/roles/httpd/website/templates/robots/riscv-koji.fedoraproject.org-robots.txt b/roles/httpd/website/templates/robots/riscv-koji.fedoraproject.org-robots.txt new file mode 100644 index 0000000000..1f53798bb4 --- /dev/null +++ b/roles/httpd/website/templates/robots/riscv-koji.fedoraproject.org-robots.txt @@ -0,0 +1,2 @@ +User-agent: * +Disallow: / From 15928472b0e037b28a8a2f18126619e399790745 Mon Sep 17 00:00:00 2001 From: Pavel Raiskup Date: Fri, 24 Apr 2026 08:28:37 +0200 Subject: [PATCH 031/151] copr-be: temporarily override fedora-eln mock config https://github.com/rpm-software-management/mock/pull/1747 --- .../files/mock/templates/fedora-eln.tpl | 392 ++++++++++++++++++ 1 file changed, 392 insertions(+) create mode 100644 roles/copr/backend/files/provision/files/mock/templates/fedora-eln.tpl diff --git a/roles/copr/backend/files/provision/files/mock/templates/fedora-eln.tpl b/roles/copr/backend/files/provision/files/mock/templates/fedora-eln.tpl new file mode 100644 index 0000000000..f809ebd4d8 --- /dev/null +++ b/roles/copr/backend/files/provision/files/mock/templates/fedora-eln.tpl @@ -0,0 +1,392 @@ +config_opts['releasever'] = 'eln' +config_opts['eln_rawhide_releasever'] = '45' + +config_opts['root'] = 'fedora-eln-{{ target_arch }}' + +config_opts['chroot_setup_cmd'] = 'install bash bzip2 coreutils cpio diffutils fedora-eln-release findutils gawk glibc-minimal-langpack grep gzip info patch redhat-rpm-config rpm-build sed tar unzip util-linux which xz' + +config_opts['dist'] = 'eln' # only useful for --resultdir variable subst +config_opts['extra_chroot_dirs'] = [ '/run/lock', ] + +# https://fedoraproject.org/wiki/Changes/BuildWithDNF5 +# https://pagure.io/releng/issue/11895 +config_opts['package_manager'] = 'dnf5' + +# Per https://github.com/fedora-eln/eln/issues/164 updated up to 4 times a day. +# Docs: https://docs.fedoraproject.org/en-US/eln/deliverables/#_container_image +config_opts['bootstrap_image'] = 'quay.io/fedora/eln:latest' + +# https://fedoraproject.org/wiki/Changes/ReplaceDnfWithDnf5 applied to ELN! +config_opts['bootstrap_image_ready'] = True + +config_opts['dnf.conf'] = """ +[main] +keepcache=1 +system_cachedir=/var/cache/dnf +debuglevel=2 +reposdir=/dev/null +logfile=/var/log/yum.log +retries=20 +obsoletes=1 +gpgcheck=0 +assumeyes=1 +syslog_ident=mock +syslog_device= +install_weak_deps=0 +metadata_expire=0 +best=1 +user_agent={{ user_agent }} + +# TODO +module_platform_id=platform:eln +protected_packages= + +{%- macro rawhide_gpg_keys() -%} +file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-rawhide-primary +{%- for version in [eln_rawhide_releasever|int, eln_rawhide_releasever|int - 1, eln_rawhide_releasever|int - 2] +%} file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-{{ version }}-primary +{%- endfor %} +{%- endmacro %} + +[eln-baseos] +name=Fedora - ELN BaseOS - Developmental packages for the next Enterprise Linux release +#baseurl=https://dl.fedoraproject.org/pub/eln/1/BaseOS/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-baseos-1&arch=$basearch +enabled=1 +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey={{ rawhide_gpg_keys() }} +skip_if_unavailable=False + +[eln-baseos-debuginfo] +name=Fedora - ELN BaseOS - Debug +#baseurl=https://dl.fedoraproject.org/pub/eln/1/BaseOS/$basearch/debug/tree +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-baseos-debug-1&arch=$basearch +enabled=0 +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey={{ rawhide_gpg_keys() }} +skip_if_unavailable=False + +[eln-baseos-source] +name=Fedora - ELN BaseOS - Source +#baseurl=https://dl.fedoraproject.org/pub/eln/1/BaseOS/source/tree/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-baseos-source-1&arch=source +enabled=0 +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey={{ rawhide_gpg_keys() }} +skip_if_unavailable=False + + +[eln-appstream] +name=Fedora - ELN AppStream - Developmental packages for the next Enterprise Linux release +#baseurl=https://dl.fedoraproject.org/pub/eln/1/AppStream/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-appstream-1&arch=$basearch +enabled=1 +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey={{ rawhide_gpg_keys() }} +skip_if_unavailable=False + +[eln-appstream-debuginfo] +name=Fedora - ELN AppStream - Debug +#baseurl=https://dl.fedoraproject.org/pub/eln/1/AppStream/$basearch/debug/tree +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-appstream-debug-1&arch=$basearch +enabled=0 +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey={{ rawhide_gpg_keys() }} +skip_if_unavailable=False + +[eln-appstream-source] +name=Fedora - ELN AppStream - Source +#baseurl=https://dl.fedoraproject.org/pub/eln/1/AppStream/source/tree/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-appstream-source-1&arch=source +enabled=0 +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey={{ rawhide_gpg_keys() }} +skip_if_unavailable=False + + +[eln-crb] +name=Fedora - ELN CodeReady Linux Builders - Build packages for the next Enterprise Linux release +#baseurl=https://dl.fedoraproject.org/pub/eln/1/CRB/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-crb-1&arch=$basearch +enabled=1 +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey={{ rawhide_gpg_keys() }} +skip_if_unavailable=False + +[eln-crb-debuginfo] +name=Fedora - ELN CodeReady Linux Builders - Debug +#baseurl=https://dl.fedoraproject.org/pub/eln/1/CRB/$basearch/debug/tree +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-crb-debug-1&arch=$basearch +enabled=0 +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey={{ rawhide_gpg_keys() }} +skip_if_unavailable=False + +[eln-crb-source] +name=Fedora - ELN CodeReady Linux Builders - Source +#baseurl=https://dl.fedoraproject.org/pub/eln/1/CRB/source/tree/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-crb-source-1&arch=source +enabled=0 +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey={{ rawhide_gpg_keys() }} +skip_if_unavailable=False + + + +[eln-extras] +name=Fedora - ELN Extras - Developmental packages for the next Enterprise Linux release +#baseurl=https://dl.fedoraproject.org/pub/eln/1/Extras/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-extras-1&arch=$basearch +enabled=1 +countme=1 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + +[eln-extras-debuginfo] +name=Fedora - ELN Extras - Debug +#baseurl=https://dl.fedoraproject.org/pub/eln/1/Extras/$basearch/debug/tree +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-extras-debug-1&arch=$basearch +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + +[eln-extras-source] +name=Fedora - ELN Extras - Source +#baseurl=https://dl.fedoraproject.org/pub/eln/1/Extras/source/tree/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-extras-source-1&arch=$basearch +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + + + +[eln-ha] +name=Fedora - ELN HighAvailability - Developmental packages for the next Enterprise Linux release +#baseurl=https://dl.fedoraproject.org/pub/eln/1/HighAvailability/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-highavailability-1&arch=$basearch +enabled=0 +countme=1 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + +[eln-ha-debuginfo] +name=Fedora - ELN HighAvailability - Debug +#baseurl=https://dl.fedoraproject.org/pub/eln/1/HighAvailability/$basearch/debug/tree +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-highavailability-debug-1&arch=$basearch +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + +[eln-ha-source] +name=Fedora - ELN HighAvailability - Source +#baseurl=https://dl.fedoraproject.org/pub/eln/1/HighAvailability/source/tree/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-highavailability-source-1&arch=source +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + + + +[eln-rt] +name=Fedora - ELN RT - Developmental packages for the next Enterprise Linux release +#baseurl=https://dl.fedoraproject.org/pub/eln/1/RT/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-rt-1&arch=$basearch +enabled=0 +countme=1 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + +[eln-rt-debuginfo] +name=Fedora - ELN RT - Debug +#baseurl=https://dl.fedoraproject.org/pub/eln/1/RT/$basearch/debug/tree +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-rt-debug-1&arch=$basearch +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + +[eln-rt-source] +name=Fedora - ELN RT - Source +#baseurl=https://dl.fedoraproject.org/pub/eln/1/RT/source/tree/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-rt-source-1&arch=source +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + + + +[eln-nfv] +name=Fedora - ELN NFV - Developmental packages for the next Enterprise Linux release +#baseurl=https://dl.fedoraproject.org/pub/eln/1/NFV/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-nfv-1&arch=$basearch +enabled=0 +countme=1 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + +[eln-nfv-debuginfo] +name=Fedora - ELN NFV - Debug +#baseurl=https://dl.fedoraproject.org/pub/eln/1/NFV/$basearch/debug/tree +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-nfv-debug-1&arch=$basearch +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + +[eln-nfv-source] +name=Fedora - ELN NFV - Source +#baseurl=https://dl.fedoraproject.org/pub/eln/1/NFV/source/tree/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-nfv-source-1&arch=source +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + + + +[eln-sap] +name=Fedora - ELN SAP - Developmental packages for the next Enterprise Linux release +#baseurl=https://dl.fedoraproject.org/pub/eln/1/SAP/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-sap-1&arch=$basearch +enabled=0 +countme=1 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + +[eln-sap-debuginfo] +name=Fedora - ELN SAP - Debug +#baseurl=https://dl.fedoraproject.org/pub/eln/1/SAP/$basearch/debug/tree +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-sap-debug-1&arch=$basearch +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + +[eln-sap-source] +name=Fedora - ELN SAP - Source +#baseurl=https://dl.fedoraproject.org/pub/eln/1/SAP/source/tree/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-sap-source-1&arch=$basearch +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + + + +[eln-saphana] +name=Fedora - ELN SAPHANA - Developmental packages for the next Enterprise Linux release +#baseurl=https://dl.fedoraproject.org/pub/eln/1/SAPHANA/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-saphana-1&arch=$basearch +enabled=0 +countme=1 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + +[eln-saphana-debuginfo] +name=Fedora - ELN SAPHANA - Debug +#baseurl=https://dl.fedoraproject.org/pub/eln/1/SAPHANA/$basearch/debug/tree +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-saphana-debug-1&arch=$basearch +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + +[eln-saphana-source] +name=Fedora - ELN SAPHANA - Source +#baseurl=https://dl.fedoraproject.org/pub/eln/1/SAPHANA/source/tree/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=eln-saphana-source-1&arch=source +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-eln-$basearch +skip_if_unavailable=False + +[local] +name=local +baseurl=https://kojipkgs.fedoraproject.org/repos/eln-build/latest/$basearch/ +cost=2000 +enabled=0 +skip_if_unavailable=False +""" From 6e36c38c7c8212df4daf3b8aa765b8f8fea2498a Mon Sep 17 00:00:00 2001 From: Samyak Jain Date: Fri, 24 Apr 2026 15:21:12 +0530 Subject: [PATCH 032/151] Fedora 44 is a GO Signed-off-by: Samyak Jain --- vars/all/00-FedoraCycleNumber.yaml | 2 +- vars/all/FedoraBranched.yaml | 2 +- vars/all/FedoraPreviousPrevious.yaml | 2 +- vars/all/Frozen.yaml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/vars/all/00-FedoraCycleNumber.yaml b/vars/all/00-FedoraCycleNumber.yaml index ee1684886b..339b47a9eb 100644 --- a/vars/all/00-FedoraCycleNumber.yaml +++ b/vars/all/00-FedoraCycleNumber.yaml @@ -1,2 +1,2 @@ --- -FedoraCycleNumber: 43 +FedoraCycleNumber: 44 diff --git a/vars/all/FedoraBranched.yaml b/vars/all/FedoraBranched.yaml index 5c007dd72d..9102df2ad2 100644 --- a/vars/all/FedoraBranched.yaml +++ b/vars/all/FedoraBranched.yaml @@ -1,2 +1,2 @@ --- -FedoraBranched: True +FedoraBranched: False diff --git a/vars/all/FedoraPreviousPrevious.yaml b/vars/all/FedoraPreviousPrevious.yaml index 519608fa95..af1e22a3b2 100644 --- a/vars/all/FedoraPreviousPrevious.yaml +++ b/vars/all/FedoraPreviousPrevious.yaml @@ -1,2 +1,2 @@ --- -FedoraPreviousPrevious: False +FedoraPreviousPrevious: True diff --git a/vars/all/Frozen.yaml b/vars/all/Frozen.yaml index 8a4b4163ce..fe64b35e1e 100644 --- a/vars/all/Frozen.yaml +++ b/vars/all/Frozen.yaml @@ -2,6 +2,6 @@ # is the infrastructure freeze currently in place? InfraFrozen: True # is the pending release (Branched) currently frozen? -NextReleaseFrozen: True +NextReleaseFrozen: False # for 'backwards compatibility' Frozen: "{{ InfraFrozen }}" From ad8ed9ef8adb22dcbcc41faf770b14cac0d35ca1 Mon Sep 17 00:00:00 2001 From: Ryan Lerch Date: Mon, 27 Apr 2026 13:42:43 +1000 Subject: [PATCH 033/151] forge: add group team mapping for dotnet org Related: https://forge.fedoraproject.org/forge/forge/issues/533 Signed-off-by: Ryan Lerch --- roles/openshift-apps/forgejo/templates/values.yaml.j2 | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/roles/openshift-apps/forgejo/templates/values.yaml.j2 b/roles/openshift-apps/forgejo/templates/values.yaml.j2 index 8b23c92959..bcc8fa8b30 100644 --- a/roles/openshift-apps/forgejo/templates/values.yaml.j2 +++ b/roles/openshift-apps/forgejo/templates/values.yaml.j2 @@ -563,7 +563,8 @@ gitea: "forge-packaging-owners":{"packaging":["Owners"]}, "forge-packaging-committee":{"packaging":["Committee"]}, "forge-packaging-packager":{"packaging":["Packager"]}, - "forge-packaging-provenpackager":{"packaging":["ProvenPackager"]} + "forge-packaging-provenpackager":{"packaging":["ProvenPackager"]}, + "forge-dotnet-owners":{"dotnet":["Owners"]} }' {% endif %} # - name: 'OAuth 1' From d9e17ab93c729803730cca02451dfc2e20780464 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Fri, 24 Apr 2026 12:12:01 -0400 Subject: [PATCH 034/151] IoT: sign stable with f44 key Signed-off-by: Paul Whalen --- roles/robosignatory/templates/robosignatory.toml.j2 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/robosignatory/templates/robosignatory.toml.j2 b/roles/robosignatory/templates/robosignatory.toml.j2 index 154c879d69..e83ce598b0 100644 --- a/roles/robosignatory/templates/robosignatory.toml.j2 +++ b/roles/robosignatory/templates/robosignatory.toml.j2 @@ -413,10 +413,10 @@ handlers = ["console"] [consumer_config.ostree_refs."fedora/stable/x86_64/iot"] directory = "/mnt/fedora_koji/koji/compose/iot/repo/" - key = "{{ (env == 'production')|ternary('fedora-43', 'testkey') }}" + key = "{{ (env == 'production')|ternary('fedora-44', 'testkey') }}" [consumer_config.ostree_refs."fedora/stable/aarch64/iot"] directory = "/mnt/fedora_koji/koji/compose/iot/repo/" - key = "{{ (env == 'production')|ternary('fedora-43', 'testkey') }}" + key = "{{ (env == 'production')|ternary('fedora-44', 'testkey') }}" # f42 silveblue ostree refs From 59704e4da723c7c923633a69385f4b15286ce381 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Fri, 24 Apr 2026 08:32:18 -0700 Subject: [PATCH 035/151] blockerbugs: add Forgejo vars to deploymentconfig as well I can't tell for sure, but I suspect if both deploymentconfig and deployment are present, deploymentconfig is used, so we need the vars here as well as deployment. Signed-off-by: Adam Williamson --- .../templates/deploymentconfig.yml.j2 | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/roles/openshift-apps/blockerbugs/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/blockerbugs/templates/deploymentconfig.yml.j2 index 05e9c733f4..d4753c002f 100644 --- a/roles/openshift-apps/blockerbugs/templates/deploymentconfig.yml.j2 +++ b/roles/openshift-apps/blockerbugs/templates/deploymentconfig.yml.j2 @@ -67,6 +67,10 @@ spec: value: "https://stg.pagure.io/api/0/" - name: BUGZILLA_URL value: "https://bugzilla.stage.redhat.com" + - name: FORGEJO_BOT_ACCESS_TOKEN + value: "{{ stg_blockerbugs_forge_bot_access_token }}" + - name: FORGEJO_REPO_WEBHOOK_SECRET + value: "{{ stg_blockerbugs_forge_repo_webhook_secret }}" {% else %} - name: POSTGRESQL_PASSWORD value: "{{ prod_blockerbugs_db_password }}" @@ -84,6 +88,10 @@ spec: value: "https://pagure.io/api/0/" - name: BUGZILLA_URL value: "https://bugzilla.redhat.com" + - name: FORGEJO_BOT_ACCESS_TOKEN + value: "{{ prod_blockerbugs_forge_bot_access_token }}" + - name: FORGEJO_REPO_WEBHOOK_SECRET + value: "{{ prod_blockerbugs_forge_repo_webhook_secret }}" {% endif %} - name: BLOCKERBUGS_URL value: "https://qa{{ env_suffix }}.fedoraproject.org/blockerbugs/" @@ -99,6 +107,20 @@ spec: value: "True" - name: PAGURE_REPO value: "fedora-qa/blocker-review" + - name: FORGEJO_REPO + value: "quality/blocker-review" + - name: FORGEJO_BOT_USERNAME + value: "blockerbot" + - name: FORGEJO_BOT_ENABLED + value: "True" + - name: FORGEJO_URL + value: "https://forge{{ env_suffix }}.fedoraproject.org/" + - name: FORGEJO_API + value: "https://forge{{ env_suffix }}.fedoraproject.org/api/v1/" + - name: FORGEJO_ADMIN_ORG + value: "quality" + - name: FORGEJO_ADMIN_TEAM + value: "members" - name: BODHI_URL value: "https://bodhi{{ env_suffix }}.fedoraproject.org/" - name: OPENSHIFT_PROD From 3357c380dd2b0e505aae4b47be9350b773fd411d Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Mon, 27 Apr 2026 09:38:07 -0700 Subject: [PATCH 036/151] blockerbugs: remove deploymentconfig We want to use deployment, and jskladan claims he's already done the migration: https://forge.fedoraproject.org/infra/tickets/issues/12142#issuecomment-271379 let's remove deploymentconfig to avoid confusion. Signed-off-by: Adam Williamson --- .../templates/deploymentconfig.yml.j2 | 162 ------------------ 1 file changed, 162 deletions(-) delete mode 100644 roles/openshift-apps/blockerbugs/templates/deploymentconfig.yml.j2 diff --git a/roles/openshift-apps/blockerbugs/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/blockerbugs/templates/deploymentconfig.yml.j2 deleted file mode 100644 index d4753c002f..0000000000 --- a/roles/openshift-apps/blockerbugs/templates/deploymentconfig.yml.j2 +++ /dev/null @@ -1,162 +0,0 @@ ---- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig -metadata: - labels: - app: blockerbugs - service: blockerbugs - name: blockerbugs -spec: - replicas: 0 - selector: - app: blockerbugs - deploymentconfig: blockerbugs - strategy: - type: Recreate - recreateParams: - mid: - failurePolicy: Abort - execNewPod: - containerName: blockerbugs - # BBA would automatically proceed with upgrade_db if necessary - # init_db isn't dropping anything, so it's safe to call every time the pod starts - command: ["python", "/opt/app-root/src/blockerbugs/cli.py", "init_db"] - # and then just the gunicorn for the frontend part - volumes: - - blockerbugs-secret-volume - template: - metadata: - labels: - app: blockerbugs - deploymentconfig: blockerbugs - spec: - containers: - - name: blockerbugs - image: blockerbugs:latest - ports: - - containerPort: 8080 - resources: {} - env: -{% if env == 'staging' %} - - name: POSTGRESQL_USER - value: "{{ stg_blockerbugs_db_user }}" -{% else %} - - name: POSTGRESQL_USER - value: "{{ prod_blockerbugs_db_user }}" -{% endif %} - - name: POSTGRESQL_DATABASE - value: "blockerbugs" - - name: POSTGRESQL_SERVICE_HOST - value: "db01{{ env_suffix }}.{{datacenter}}.fedoraproject.org" - - name: POSTGRESQL_SERVICE_PORT - value: "5432" -{% if env == 'staging' %} - - name: POSTGRESQL_PASSWORD - value: "{{ stg_blockerbugs_db_password }}" - - name: SECRET_KEY - value: "{{ stg_blockerbugs_secret_key }}" - - name: PAGURE_REPO_TOKEN - value: "{{ stg_blockerbugs_pagure_repo_token_secret }}" - - name: PAGURE_REPO_WEBHOOK_KEY - value: "{{ stg_blockerbugs_pagure_repo_webhook_key_secret }}" - - name: BUGZILLA_API_KEY - value: "{{ stg_blockerbugs_bz_api_key }}" - - name: PAGURE_URL - value: "https://stg.pagure.io/" - - name: PAGURE_API - value: "https://stg.pagure.io/api/0/" - - name: BUGZILLA_URL - value: "https://bugzilla.stage.redhat.com" - - name: FORGEJO_BOT_ACCESS_TOKEN - value: "{{ stg_blockerbugs_forge_bot_access_token }}" - - name: FORGEJO_REPO_WEBHOOK_SECRET - value: "{{ stg_blockerbugs_forge_repo_webhook_secret }}" -{% else %} - - name: POSTGRESQL_PASSWORD - value: "{{ prod_blockerbugs_db_password }}" - - name: SECRET_KEY - value: "{{ prod_blockerbugs_secret_key }}" - - name: PAGURE_REPO_TOKEN - value: "{{ prod_blockerbugs_pagure_repo_token_secret }}" - - name: PAGURE_REPO_WEBHOOK_KEY - value: "{{ prod_blockerbugs_pagure_repo_webhook_key_secret }}" - - name: BUGZILLA_API_KEY - value: "{{ prod_blockerbugs_bz_api_key }}" - - name: PAGURE_URL - value: "https://pagure.io/" - - name: PAGURE_API - value: "https://pagure.io/api/0/" - - name: BUGZILLA_URL - value: "https://bugzilla.redhat.com" - - name: FORGEJO_BOT_ACCESS_TOKEN - value: "{{ prod_blockerbugs_forge_bot_access_token }}" - - name: FORGEJO_REPO_WEBHOOK_SECRET - value: "{{ prod_blockerbugs_forge_repo_webhook_secret }}" -{% endif %} - - name: BLOCKERBUGS_URL - value: "https://qa{{ env_suffix }}.fedoraproject.org/blockerbugs/" - - name: BLOCKERBUGS_API - value: "https://qa{{ env_suffix }}.fedoraproject.org/blockerbugs/api/v0/" - - name: FAS_BASE_URL - value: "https://admin{{ env_suffix }}.fedoraproject.org/accounts/" - - name: FAS_ADMIN_GROUP - value: "qa-admin" - - name: PAGURE_BOT_USERNAME - value: "blockerbot" - - name: PAGURE_BOT_ENABLED - value: "True" - - name: PAGURE_REPO - value: "fedora-qa/blocker-review" - - name: FORGEJO_REPO - value: "quality/blocker-review" - - name: FORGEJO_BOT_USERNAME - value: "blockerbot" - - name: FORGEJO_BOT_ENABLED - value: "True" - - name: FORGEJO_URL - value: "https://forge{{ env_suffix }}.fedoraproject.org/" - - name: FORGEJO_API - value: "https://forge{{ env_suffix }}.fedoraproject.org/api/v1/" - - name: FORGEJO_ADMIN_ORG - value: "quality" - - name: FORGEJO_ADMIN_TEAM - value: "members" - - name: BODHI_URL - value: "https://bodhi{{ env_suffix }}.fedoraproject.org/" - - name: OPENSHIFT_PROD -{% if env == 'staging' %} - value: "0" -{% else %} - value: "1" -{% endif %} - volumeMounts: - - name: blockerbugs-secret-volume - mountPath: /opt/app-root/secret/ - readOnly: true - readinessProbe: - timeoutSeconds: 5 - initialDelaySeconds: 5 - httpGet: - path: /blockerbugs/ - port: 8080 - livenessProbe: - timeoutSeconds: 15 - initialDelaySeconds: 30 - httpGet: - path: /blockerbugs/ - port: 8080 - volumes: - - name: blockerbugs-secret-volume - secret: - secretName: blockerbugs-secret - - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - blockerbugs - from: - kind: ImageStreamTag - name: blockerbugs:latest From 70013ca3846e4705242b0d60e511aace532f3c92 Mon Sep 17 00:00:00 2001 From: Ryan Lerch Date: Tue, 28 Apr 2026 13:31:17 +1000 Subject: [PATCH 037/151] forge: set AUTO_WATCH_NEW_REPOS to false resolves: https://forge.fedoraproject.org/forge/forge/issues/529 Signed-off-by: Ryan Lerch --- roles/openshift-apps/forgejo/templates/values.yaml.j2 | 1 + 1 file changed, 1 insertion(+) diff --git a/roles/openshift-apps/forgejo/templates/values.yaml.j2 b/roles/openshift-apps/forgejo/templates/values.yaml.j2 index bcc8fa8b30..66d1abc5fd 100644 --- a/roles/openshift-apps/forgejo/templates/values.yaml.j2 +++ b/roles/openshift-apps/forgejo/templates/values.yaml.j2 @@ -703,6 +703,7 @@ gitea: ENABLE_NOTIFY_MAIL: true DEFAULT_ORG_MEMBER_VISIBLE: true REGISTER_EMAIL_CONFIRM: true + AUTO_WATCH_NEW_REPOS: false ## @param gitea.config.ssh.minimum_key_sizes SSH minimum key sizes ssh.minimum_key_sizes: {} From b0415adc16b030bb00960f9323294b7b8f7f2852 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Mon, 27 Apr 2026 11:15:36 -0700 Subject: [PATCH 038/151] blockerbugs: remove deploymentconfig from playbook Oops, we should have done this along with deleting it. Signed-off-by: Adam Williamson --- playbooks/openshift-apps/blockerbugs.yml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/playbooks/openshift-apps/blockerbugs.yml b/playbooks/openshift-apps/blockerbugs.yml index 5ab84eee75..b7652d6800 100644 --- a/playbooks/openshift-apps/blockerbugs.yml +++ b/playbooks/openshift-apps/blockerbugs.yml @@ -92,11 +92,6 @@ object_template: buildconfig.yml.j2 object_objectname: buildconfig.yml - - role: openshift/object - object_app: blockerbugs - object_template: deploymentconfig.yml.j2 - object_objectname: deploymentconfig.yml - - role: openshift/object object_app: blockerbugs object_template: deployment.yml.j2 From 7ec4975ead5a3dc3e1b43c805d2986bd2bace630 Mon Sep 17 00:00:00 2001 From: David Kirwan Date: Tue, 28 Apr 2026 11:25:27 +0100 Subject: [PATCH 039/151] forgejo: Update runnerhost configuration with zabbix agent configuration Signed-off-by: David Kirwan --- .../forgejo-runnerhost-sa-vm.yaml.j2 | 104 ------------------ .../forgejo/templates/forgejo-runners.yaml.j2 | 4 + 2 files changed, 4 insertions(+), 104 deletions(-) delete mode 100644 roles/openshift-apps/forgejo/templates/forgejo-runnerhost-sa-vm.yaml.j2 diff --git a/roles/openshift-apps/forgejo/templates/forgejo-runnerhost-sa-vm.yaml.j2 b/roles/openshift-apps/forgejo/templates/forgejo-runnerhost-sa-vm.yaml.j2 deleted file mode 100644 index d4b206d96f..0000000000 --- a/roles/openshift-apps/forgejo/templates/forgejo-runnerhost-sa-vm.yaml.j2 +++ /dev/null @@ -1,104 +0,0 @@ ---- -apiVersion: template.openshift.io/v1 -kind: Template -metadata: - name: forgejo-runner-vm - annotations: - description: KubeVirt VM for running Forgejo Action runners with a mounted SA token disk. -parameters: - - name: VM_NAME - description: Name of the VirtualMachine - required: true - - name: NAMESPACE - description: Target namespace - value: forgejo - - name: INSTANCE_TYPE - description: VirtualMachineClusterInstanceType name - value: u1.xlarge - - name: DISK_SIZE - description: Root disk size - value: 30Gi - - name: VM_USER - description: Default VM user - value: fedora - - name: VM_PASSWORD - description: Default VM password (change after first login) - generate: expression - from: "[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}" - - name: SERVICE_ACCOUNT - description: ServiceAccount name for Kubernetes API access - value: forgejo-runner-vm - - name: SA_TOKEN_SECRET - description: Name of the Secret containing the SA token - value: forgejo-runner-vm-token -objects: - - apiVersion: kubevirt.io/v1 - kind: VirtualMachine - metadata: - name: ${VM_NAME} - namespace: ${NAMESPACE} - labels: - app: forgejo-runner - spec: - dataVolumeTemplates: - - metadata: - name: ${VM_NAME}-volume - spec: - sourceRef: - kind: DataSource - name: fedora - namespace: openshift-virtualization-os-images - storage: - resources: - requests: - storage: ${DISK_SIZE} - instancetype: - kind: virtualmachineclusterinstancetype - name: ${INSTANCE_TYPE} - preference: - kind: virtualmachineclusterpreference - name: fedora - runStrategy: Always - template: - metadata: - labels: - network.kubevirt.io/headlessService: headless - spec: - serviceAccountName: ${SERVICE_ACCOUNT} - architecture: amd64 - domain: - devices: - autoattachPodInterface: false - disks: - - name: sa-token-disk - disk: {} - serial: SATOKEN000001 - interfaces: - - masquerade: {} - name: default - machine: - type: pc-q35-rhel9.6.0 - resources: {} - networks: - - name: default - pod: {} - subdomain: headless - volumes: - - dataVolume: - name: ${VM_NAME}-volume - name: rootdisk - - cloudInitNoCloud: - userData: | - #cloud-config - chpasswd: - expire: false - password: "${VM_PASSWORD}" - user: "${VM_USER}" - bootcmd: - - "mkdir -p /mnt/sa-token" - - "mount /dev/$(lsblk --nodeps -no name,serial | grep SATOKEN000001 | cut -f1 -d' ') /mnt/sa-token" - name: cloudinitdisk - - name: sa-token-disk - secret: - secretName: ${SA_TOKEN_SECRET} - diff --git a/roles/openshift-apps/forgejo/templates/forgejo-runners.yaml.j2 b/roles/openshift-apps/forgejo/templates/forgejo-runners.yaml.j2 index 556a43886d..cc8bf93dc0 100644 --- a/roles/openshift-apps/forgejo/templates/forgejo-runners.yaml.j2 +++ b/roles/openshift-apps/forgejo/templates/forgejo-runners.yaml.j2 @@ -16,3 +16,7 @@ forgejo_instance_url: "{{ (env == 'production') | ternary(forgejo_runner_instanc # - secret: 40-character hex string for idempotent registration # forgejo_runners: {{ (env == 'production') | ternary(forgejo_runner_secrets, forgejo_stg_runner_secrets) }} + +# Configuration for the zabbix agent running on the runnerhost +forgejo_runnerhost_zabbix_agent_identity: {{ zabbix_tls_psk_identity }} +forgejo_runnerhost_zabbix_agent_psk: {{ (env == 'production') | ternary(zabbix_tls_prod_psk, zabbix_tls_stg_psk) }} From 43a7a9e0fe6f5450cfc7174add93d0783a4a1c66 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Mon, 27 Apr 2026 14:00:25 -0700 Subject: [PATCH 040/151] proxies / gnome-software: move f44 to active This should be pushed tomorrow morning after release at 14utc. It will tell gnome-software to start offering dist upgrades to users. Signed-off-by: Kevin Fenzi --- roles/pkgdb-proxy/files/pkgdb-gnome-software-collections.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/pkgdb-proxy/files/pkgdb-gnome-software-collections.json b/roles/pkgdb-proxy/files/pkgdb-gnome-software-collections.json index d9d63fcdcc..5bed8416ac 100644 --- a/roles/pkgdb-proxy/files/pkgdb-gnome-software-collections.json +++ b/roles/pkgdb-proxy/files/pkgdb-gnome-software-collections.json @@ -15,11 +15,11 @@ "allow_retire": true, "branchname": "f44", "date_created": "2026-02-03 14:30:00", - "date_updated": "2026-02-03 14:30:00", + "date_updated": "2026-04-28 14:30:00", "dist_tag": ".fc44", "koji_name": "f44", "name": "Fedora Linux", - "status": "Under Development", + "status": "Active", "version": "44" }, { From 8c5923e1236a8f64fe30bff8f8d5363e75f8832f Mon Sep 17 00:00:00 2001 From: Pavel Raiskup Date: Tue, 28 Apr 2026 18:08:42 +0200 Subject: [PATCH 041/151] copr-hypervisor: avoid using vol-upload to avoid FD leaks Per discussion with @pkrempa it seems that it's anyway a good idea to upload this way, as scp is faster (we avoid many io layers). Relates: https://redhat.atlassian.net/browse/RHEL-170773 --- .../backend/templates/provision/libvirt-new | 34 +++++++++++++++---- 1 file changed, 28 insertions(+), 6 deletions(-) diff --git a/roles/copr/backend/templates/provision/libvirt-new b/roles/copr/backend/templates/provision/libvirt-new index 3183a92b21..27fd8ae900 100755 --- a/roles/copr/backend/templates/provision/libvirt-new +++ b/roles/copr/backend/templates/provision/libvirt-new @@ -17,6 +17,7 @@ import shlex import time import argparse import ipaddress +from urllib.parse import urlparse from helpers import get_hv_identification_from_pool_id @@ -65,13 +66,13 @@ class LibvirtSpawner: self.log.debug("Logging to %s", self.connection) self.cleanup_actions = {} - def call(self, cmd, *args, **kwargs): + def call(self, cmd, *args, call=subprocess.call, **kwargs): """ Run CMD, and log info. """ self.log.debug("cmd: %s", ' '.join([shlex.quote(str(x)) for x in cmd])) start = time.time() - status = subprocess.call(cmd, *args, **kwargs) + status = call(cmd, *args, **kwargs) self.log.debug(" -> exit_status=%s, time=%ss", status, round(time.time() - start, 3)) return status @@ -82,6 +83,13 @@ class LibvirtSpawner: """ return self.call(['virsh', '-c', self.connection] + args, stdout=sys.stderr) + def virsh_check_output(self, args): + """ + Call virsh without polluting stdout. + """ + return self.call(['virsh', '-c', self.connection] + args, + call=subprocess.check_output).decode("utf-8") + def wait_for_ssh(self, host): """ Knowing the IP address of recently started VM, wait for the SSH server @@ -240,10 +248,24 @@ ssh_authorized_keys: return image def create_volume_from_iso(self, name, prealloc_size, iso, pool=DEFAULT_POOL): - """ Create libvirt volume from ISO file """ - self.alloc_disk(name, prealloc_size, pool) - if self.virsh_silent(['vol-upload', name, iso, '--pool', pool]): - raise Exception("can not vol-upload the config disk") + """ + Create libvirt volume from ISO file + """ + parsed_url = urlparse(self.connection) + remote_host = parsed_url.netloc + if not remote_host: + raise RuntimeError(f"Could not deduce remote host from connection: {self.connection}") + + # /libvirt-images -> /libvirt-images + pool_path = self.virsh_check_output(["-q", "pool-dumpxml", pool, "--xpath", '//target/path']) + pool_path = pool_path.strip()[6:-7] + target_path = os.path.join(pool_path, name) + + scp_cmd = ['scp', '-p', iso, f"{remote_host}:{target_path}"] + if self.call(scp_cmd): + raise RuntimeError(f"Failed to upload ISO via SCP to {target_path} on {remote_host}") + + self.virsh_silent(["pool-refresh", pool]) def create_volume_from_volume(self, name, volume, pool=DEFAULT_POOL, size=None): """ From 7c02c4570f8892f4809a279c4b18121d56936306 Mon Sep 17 00:00:00 2001 From: Pavel Raiskup Date: Tue, 28 Apr 2026 19:03:28 +0200 Subject: [PATCH 042/151] copr-hypervisor: drop unused argument --- roles/copr/backend/templates/provision/libvirt-new | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/roles/copr/backend/templates/provision/libvirt-new b/roles/copr/backend/templates/provision/libvirt-new index 27fd8ae900..036e5f7330 100755 --- a/roles/copr/backend/templates/provision/libvirt-new +++ b/roles/copr/backend/templates/provision/libvirt-new @@ -247,7 +247,7 @@ ssh_authorized_keys: raise Exception("mkisofs failed") return image - def create_volume_from_iso(self, name, prealloc_size, iso, pool=DEFAULT_POOL): + def create_volume_from_iso(self, name, iso, pool=DEFAULT_POOL): """ Create libvirt volume from ISO file """ @@ -379,8 +379,7 @@ ssh_authorized_keys: if config_iso: self.log.info("using config image %s", config_iso) config_vol_name = self.vm_name + "_config" - self.create_volume_from_iso(config_vol_name, '1M', config_iso, - pool=pool) + self.create_volume_from_iso(config_vol_name, config_iso, pool=pool) root_image_volume = VOLUMES[self.arch] vol_root = self.vm_name + '_root' From 3e0e89ba7f46b60841840e6c2b4c2c4be8172c26 Mon Sep 17 00:00:00 2001 From: James Antill Date: Wed, 29 Apr 2026 12:16:42 -0400 Subject: [PATCH 043/151] riscv-koji: Permanently increase mem_size/max_mem_size. Signed-off-by: James Antill --- inventory/group_vars/koji_riscv | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/inventory/group_vars/koji_riscv b/inventory/group_vars/koji_riscv index 0f147d0c6e..84fa7ea95d 100644 --- a/inventory/group_vars/koji_riscv +++ b/inventory/group_vars/koji_riscv @@ -11,8 +11,8 @@ ipa_host_group_desc: riscv Koji Hub hosts koji_hub: "riscv-koji.fedoraproject.org/kojihub" koji_root: "riscv-koji.fedoraproject.org/koji" lvm_size: 100000 -mem_size: 32768 -max_mem_size: 65536 +mem_size: 45056 +max_mem_size: 90112 nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=4" num_cpus: 8 primary_auth_source: ipa From 37638d92893f6a4cac8d3d0cfb4b99499dabc765 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Tue, 28 Apr 2026 08:14:21 -0700 Subject: [PATCH 044/151] proxies: drop www.fedoraproject.org for now Signed-off-by: Kevin Fenzi --- playbooks/include/proxies-websites.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/playbooks/include/proxies-websites.yml b/playbooks/include/proxies-websites.yml index 7dd7a9ffee..aa852ecb37 100644 --- a/playbooks/include/proxies-websites.yml +++ b/playbooks/include/proxies-websites.yml @@ -48,8 +48,8 @@ server_aliases: - stg.fedoraproject.org - localhost - - www.fedoraproject.org - hotspot-nocache.fedoraproject.org + tags: fedoraproject.org # This is for all the other domains we own # that redirect to https://fedoraproject.org From 06dfffb772850fb3f72e21f01ef2b92a9e828acc Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Wed, 29 Apr 2026 10:12:11 -0700 Subject: [PATCH 045/151] Fedora 44 is released, we are out of freeze Signed-off-by: Kevin Fenzi --- vars/all/Frozen.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/vars/all/Frozen.yaml b/vars/all/Frozen.yaml index fe64b35e1e..d9bc53b221 100644 --- a/vars/all/Frozen.yaml +++ b/vars/all/Frozen.yaml @@ -1,6 +1,6 @@ --- # is the infrastructure freeze currently in place? -InfraFrozen: True +InfraFrozen: False # is the pending release (Branched) currently frozen? NextReleaseFrozen: False # for 'backwards compatibility' From 84f0b9db1e37fc8ed9503b5eb462ebd3a27e9db4 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Wed, 29 Apr 2026 10:13:15 -0700 Subject: [PATCH 046/151] public-db-copy: we no longer have pkgdb2 database/app This db is no longer used/copied/needed. Signed-off-by: Kevin Fenzi --- scripts/public-db-copy | 2 -- 1 file changed, 2 deletions(-) diff --git a/scripts/public-db-copy b/scripts/public-db-copy index 6cf9dbbe14..7b8d2c3524 100755 --- a/scripts/public-db-copy +++ b/scripts/public-db-copy @@ -21,8 +21,6 @@ scp db-datanommer02.${bkup_domain}:/backups/datanommer-incremental/$(date -d 'ye scp db-koji01.${bkup_domain}:/backups/koji-$(date +%F).dump.xz \ /srv/web/infra/db-dumps/koji.dump.xz -scp db01.${bkup_domain}:/backups/pkgdb2-$(date +%F).dump.xz \ - /srv/web/infra/db-dumps/pkgdb2.dump.xz scp db01.${bkup_domain}:/backups/koschei-$(date +%F).dump.xz \ /srv/web/infra/db-dumps/koschei.dump.xz scp db01.${bkup_domain}:/backups/bodhi2-$(date +%F).dump.xz \ From 76f7751d117c0dc11ab53a4510dac4b8d6bbb9f7 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Wed, 29 Apr 2026 10:25:29 -0700 Subject: [PATCH 047/151] downloads: add osuosl mirrors to acls These osuosl mirrors want to get pre bitflip content, so add them to acls here. Signed-off-by: Kevin Fenzi --- inventory/group_vars/download | 3 +++ 1 file changed, 3 insertions(+) diff --git a/inventory/group_vars/download b/inventory/group_vars/download index 3f896606ca..272948f7d0 100644 --- a/inventory/group_vars/download +++ b/inventory/group_vars/download @@ -107,6 +107,9 @@ dl_tier1: - sv.mirrors.kernel.org - dfw.mirrors.kernel.org - mirror.raiolanetworks.com # 91.132.103.246 / 2a12:d282:102:f6::1 + - ftp-osl.osuosl.org # 140.211.166.134 / 2605:bc80:3010::134 + - ftp-chi.osuosl.org # 64.50.236.52 / 2600:3402:200:227::2 + - ftp-nyc.osuosl.org # 64.50.233.100 ipa_host_group: download ipa_host_group_desc: Download servers nagios_Check_Services: From aaa3c9403fe55c6aae15e9ea5bdeb81545c480ca Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 10 Apr 2026 16:58:00 -0700 Subject: [PATCH 048/151] Add buildhw-x86-05/06/07 These are all old iad2 hardware we want to add as builders. Signed-off-by: Kevin Fenzi --- inventory/builders | 6 ++ .../buildhw-x86-05.rdu3.fedoraproject.org | 70 +++++++++++++++++++ .../buildhw-x86-06.rdu3.fedoraproject.org | 70 +++++++++++++++++++ .../buildhw-x86-07.rdu3.fedoraproject.org | 68 ++++++++++++++++++ 4 files changed, 214 insertions(+) create mode 100644 inventory/host_vars/buildhw-x86-05.rdu3.fedoraproject.org create mode 100644 inventory/host_vars/buildhw-x86-06.rdu3.fedoraproject.org create mode 100644 inventory/host_vars/buildhw-x86-07.rdu3.fedoraproject.org diff --git a/inventory/builders b/inventory/builders index 1875224f87..13448e4fe8 100644 --- a/inventory/builders +++ b/inventory/builders @@ -289,6 +289,9 @@ buildhw-x86-01.rdu3.fedoraproject.org buildhw-x86-02.rdu3.fedoraproject.org buildhw-x86-03.rdu3.fedoraproject.org buildhw-x86-04.rdu3.fedoraproject.org +buildhw-x86-05.rdu3.fedoraproject.org +buildhw-x86-06.rdu3.fedoraproject.org +buildhw-x86-07.rdu3.fedoraproject.org buildhw-x86-08.rdu3.fedoraproject.org buildhw-x86-09.rdu3.fedoraproject.org buildhw-x86-10.rdu3.fedoraproject.org @@ -312,6 +315,9 @@ buildhw-x86-02.rdu3.fedoraproject.org buildhw-x86-03.rdu3.fedoraproject.org buildhw-x86-04.rdu3.fedoraproject.org # old iad2 hw +buildhw-x86-05.rdu3.fedoraproject.org +buildhw-x86-06.rdu3.fedoraproject.org +buildhw-x86-07.rdu3.fedoraproject.org buildhw-x86-08.rdu3.fedoraproject.org buildhw-x86-09.rdu3.fedoraproject.org buildhw-x86-10.rdu3.fedoraproject.org diff --git a/inventory/host_vars/buildhw-x86-05.rdu3.fedoraproject.org b/inventory/host_vars/buildhw-x86-05.rdu3.fedoraproject.org new file mode 100644 index 0000000000..a561490f04 --- /dev/null +++ b/inventory/host_vars/buildhw-x86-05.rdu3.fedoraproject.org @@ -0,0 +1,70 @@ +--- +bmc: + ip_address: 10.16.160.16 + ping: true + http: true + https: true +br0_ipv4_ip: 10.16.169.35 +br0_ipv4_gw: 10.16.169.254 +br0_ipv4_nm: 24 +datacenter: rdu3 +dns1: 10.16.163.33 +dns2: 10.16.163.34 +dns_search1: "rdu3.fedoraproject.org" +dns_search2: "fedoraproject.org" +has_ipv4: yes +mac0: c8:4b:d6:88:fb:c6 +mac1: c8:4b:d6:88:fb:c7 +mac2: 6c:fe:54:57:5f:48 +mac3: 6c:fe:54:57:5f:49 +network_connections: + # Bridge profile + - name: br0 + state: up + type: bridge + mtu: 1500 + autoconnect: yes + ip: + address: + - "{{ br0_ipv4_ip }}/{{ br0_ipv4_nm }}" + dhcp4: no + dns: + - "{{ dns1 }}" + - "{{ dns2 }}" + dns_search: + - "{{ dns_search1 }}" + - "{{ dns_search2 }}" + gateway4: "{{ br0_ipv4_gw }}" + # Bond profile + - name: bond0 + type: bond + interface_name: bond0 + mtu: 1500 + controller: br0 + bond: + mode: 802.3ad + # Port profile for the 1st Ethernet device + - name: bond0-port1 + mac: "{{ mac2 }}" + type: ethernet + controller: bond0 + state: up + mtu: 1500 + # Port profile for the 2nd Ethernet device + - name: bond0-port2 + mac: "{{ mac3 }}" + type: ethernet + controller: bond0 + state: up + mtu: 1500 +# This is used to populate the inventory fields, only specific keys are allowed, see +# https://www.zabbix.com/documentation/current/en/manual/api/reference/host/object#host-inventory +zabbix_inventory: + date_hw_expiry: "" + date_hw_purchase: "2022-12-31" + hardware: PowerEdge R650 + location: RDU3 + oob_ip: "{{ bmc.ip_address }}" + serialno_a: 3ZGTRT3 + type: Prod_Dedicated_HW + vendor: Dell diff --git a/inventory/host_vars/buildhw-x86-06.rdu3.fedoraproject.org b/inventory/host_vars/buildhw-x86-06.rdu3.fedoraproject.org new file mode 100644 index 0000000000..e925331e79 --- /dev/null +++ b/inventory/host_vars/buildhw-x86-06.rdu3.fedoraproject.org @@ -0,0 +1,70 @@ +--- +bmc: + ip_address: 10.16.160.17 + ping: true + http: true + https: true +br0_ipv4_ip: 10.16.169.36 +br0_ipv4_gw: 10.16.169.254 +br0_ipv4_nm: 24 +datacenter: rdu3 +dns1: 10.16.163.33 +dns2: 10.16.163.34 +dns_search1: "rdu3.fedoraproject.org" +dns_search2: "fedoraproject.org" +has_ipv4: yes +mac0: c8:4b:d6:89:f7:5c +mac1: c8:4b:d6:89:f7:5d +mac2: 6c:fe:54:57:80:2c +mac3: 6c:fe:54:57:80:2d +network_connections: + # Bridge profile + - name: br0 + state: up + type: bridge + mtu: 1500 + autoconnect: yes + ip: + address: + - "{{ br0_ipv4_ip }}/{{ br0_ipv4_nm }}" + dhcp4: no + dns: + - "{{ dns1 }}" + - "{{ dns2 }}" + dns_search: + - "{{ dns_search1 }}" + - "{{ dns_search2 }}" + gateway4: "{{ br0_ipv4_gw }}" + # Bond profile + - name: bond0 + type: bond + interface_name: bond0 + mtu: 1500 + controller: br0 + bond: + mode: 802.3ad + # Port profile for the 1st Ethernet device + - name: bond0-port1 + mac: "{{ mac2 }}" + type: ethernet + controller: bond0 + state: up + mtu: 1500 + # Port profile for the 2nd Ethernet device + - name: bond0-port2 + mac: "{{ mac3 }}" + type: ethernet + controller: bond0 + state: up + mtu: 1500 +# This is used to populate the inventory fields, only specific keys are allowed, see +# https://www.zabbix.com/documentation/current/en/manual/api/reference/host/object#host-inventory +zabbix_inventory: + date_hw_expiry: "" + date_hw_purchase: "2022-12-31" + hardware: PowerEdge R650 + location: RDU3 + oob_ip: "{{ bmc.ip_address }}" + serialno_a: 2ZGTRT3 + type: Prod_Dedicated_HW + vendor: Dell diff --git a/inventory/host_vars/buildhw-x86-07.rdu3.fedoraproject.org b/inventory/host_vars/buildhw-x86-07.rdu3.fedoraproject.org new file mode 100644 index 0000000000..9fa5f567c8 --- /dev/null +++ b/inventory/host_vars/buildhw-x86-07.rdu3.fedoraproject.org @@ -0,0 +1,68 @@ +--- +bmc: + ip_address: 10.16.160.18 + ping: true + http: true + https: true +br0_ipv4_ip: 10.16.169.37 +br0_ipv4_gw: 10.16.169.254 +br0_ipv4_nm: 24 +datacenter: rdu3 +dns1: 10.16.163.33 +dns2: 10.16.163.34 +dns_search1: "rdu3.fedoraproject.org" +dns_search2: "fedoraproject.org" +has_ipv4: yes +mac0: 6c:fe:54:57:4d:80 +mac1: 6c:fe:54:57:4d:81 +network_connections: + # Bridge profile + - name: br0 + state: up + type: bridge + mtu: 1500 + autoconnect: yes + ip: + address: + - "{{ br0_ipv4_ip }}/{{ br0_ipv4_nm }}" + dhcp4: no + dns: + - "{{ dns1 }}" + - "{{ dns2 }}" + dns_search: + - "{{ dns_search1 }}" + - "{{ dns_search2 }}" + gateway4: "{{ br0_ipv4_gw }}" + # Bond profile + - name: bond0 + type: bond + interface_name: bond0 + mtu: 1500 + controller: br0 + bond: + mode: 802.3ad + # Port profile for the 1st Ethernet device + - name: bond0-port1 + mac: "{{ mac0 }}" + type: ethernet + controller: bond0 + state: up + mtu: 1500 + # Port profile for the 2nd Ethernet device + - name: bond0-port2 + mac: "{{ mac1 }}" + type: ethernet + controller: bond0 + state: up + mtu: 1500 +# This is used to populate the inventory fields, only specific keys are allowed, see +# https://www.zabbix.com/documentation/current/en/manual/api/reference/host/object#host-inventory +zabbix_inventory: + date_hw_expiry: "2029-02-17" + date_hw_purchase: "2022-12-31" + hardware: PowerEdge R650 + location: RDU3 + oob_ip: "{{ bmc.ip_address }}" + serialno_a: 617DRT3 + type: Prod_Dedicated_HW + vendor: Dell From dce2333bb1eec641003260a143886f4bb79bb529 Mon Sep 17 00:00:00 2001 From: Pedro Moura Date: Mon, 16 Feb 2026 11:08:42 -0300 Subject: [PATCH 049/151] add noggin deployment Signed-off-by: Pedro Moura --- .../noggin/templates/deployment.yml.j2 | 114 ++++++++++++++++++ 1 file changed, 114 insertions(+) create mode 100644 roles/openshift-apps/noggin/templates/deployment.yml.j2 diff --git a/roles/openshift-apps/noggin/templates/deployment.yml.j2 b/roles/openshift-apps/noggin/templates/deployment.yml.j2 new file mode 100644 index 0000000000..000d6e3c7d --- /dev/null +++ b/roles/openshift-apps/noggin/templates/deployment.yml.j2 @@ -0,0 +1,114 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: noggin + labels: + app: {{ object_app }} +spec: + replicas: 1 + selector: + matchLabels: + app: {{ object_app }} + strategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 25% + maxUnavailable: 25% + template: + metadata: + labels: + app: {{ object_app }} + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"noggin:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"noggin\")].image"}]' + spec: + containers: + - name: noggin + image: noggin:latest + imagePullPolicy: Always + ports: + - containerPort: 8080 + volumeMounts: + - name: noggin-config-volume + mountPath: "/etc/noggin" + readOnly: true + - name: noggin-templates-volume + mountPath: "/etc/noggin-templates" + readOnly: true + - name: noggin-secrets-volume + mountPath: "/etc/noggin-secrets" + readOnly: true + - name: wsgi-script-volume + mountPath: "/opt/app-root/src/deploy" + readOnly: true + - name: fedora-messaging-config-volume + mountPath: "/etc/fedora-messaging" + readOnly: true + - name: fedora-messaging-ca-volume + mountPath: /etc/pki/fedora-messaging/cacert.pem + subPath: cacert.pem + readOnly: true + - name: fedora-messaging-crt-volume + mountPath: /etc/pki/fedora-messaging/noggin-cert.pem + subPath: noggin-cert.pem + readOnly: true + - name: fedora-messaging-key-volume + mountPath: /etc/pki/fedora-messaging/noggin-key.pem + subPath: noggin-key.pem + readOnly: true + - name: ipa-config-volume + mountPath: "/etc/ipa" + readOnly: true + env: + - name: NOGGIN_CONFIG_PATH + value: "/etc/noggin/noggin.cfg" + - name: APP_MODULE + value: "deploy.wsgi" + - name: APP_CONFIG + value: "/etc/noggin/gunicorn.conf.py" +{% if subdir is defined %} + - name: SCRIPT_NAME + value: "{{ subdir }}" +{% endif %} + readinessProbe: + timeoutSeconds: 10 + initialDelaySeconds: 5 + periodSeconds: 60 + httpGet: + path: "{{ subdir|default('') }}/healthz/ready" + port: 8080 + livenessProbe: + timeoutSeconds: 10 + initialDelaySeconds: 10 + periodSeconds: 60 + httpGet: + path: "{{ subdir|default('') }}/healthz/live" + port: 8080 + volumes: + - name: noggin-config-volume + configMap: + name: noggin-config + - name: noggin-templates-volume + configMap: + name: noggin-templates + - name: noggin-secrets-volume + secret: + secretName: noggin-secrets + - name: wsgi-script-volume + configMap: + name: wsgi-script + - name: fedora-messaging-config-volume + configMap: + name: fedora-messaging-config + - name: fedora-messaging-ca-volume + secret: + secretName: fedora-messaging-ca + - name: fedora-messaging-crt-volume + secret: + secretName: fedora-messaging-crt + - name: fedora-messaging-key-volume + secret: + secretName: fedora-messaging-key + - name: ipa-config-volume + configMap: + name: ipa-client-config From 4384f5150d63df9b3ad3786782ac9009b8daaddf Mon Sep 17 00:00:00 2001 From: Pedro Moura Date: Mon, 16 Mar 2026 18:20:30 -0300 Subject: [PATCH 050/151] replaced deployment file in playbook and fixed image path Signed-off-by: Pedro Moura --- playbooks/openshift-apps/noggin.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/playbooks/openshift-apps/noggin.yml b/playbooks/openshift-apps/noggin.yml index 54b84bb6dc..f111877419 100644 --- a/playbooks/openshift-apps/noggin.yml +++ b/playbooks/openshift-apps/noggin.yml @@ -98,8 +98,8 @@ - role: openshift/object object_app: noggin - object_template: deploymentconfig.yml.j2 - object_objectname: deploymentconfig.yml + object_template: deployment.yml.j2 + object_objectname: deployment.yml - role: openshift/start-build start_build_app: noggin From ac9d0a62ed6c12c2d7b79542a8c465f6fc501e5b Mon Sep 17 00:00:00 2001 From: Pedro Moura Date: Thu, 26 Mar 2026 20:17:37 -0300 Subject: [PATCH 051/151] noggin: use correct name of app in image stream Signed-off-by: Pedro Moura --- roles/openshift-apps/noggin/templates/deployment.yml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/noggin/templates/deployment.yml.j2 b/roles/openshift-apps/noggin/templates/deployment.yml.j2 index 000d6e3c7d..6309870ca1 100644 --- a/roles/openshift-apps/noggin/templates/deployment.yml.j2 +++ b/roles/openshift-apps/noggin/templates/deployment.yml.j2 @@ -24,7 +24,7 @@ spec: spec: containers: - name: noggin - image: noggin:latest + image: image-registry.openshift-image-registry.svc:5000/noggin/noggin:latest imagePullPolicy: Always ports: - containerPort: 8080 From 23cd904a0bbf7e2876a658010847028e02d6626d Mon Sep 17 00:00:00 2001 From: Pedro Moura Date: Thu, 26 Mar 2026 20:17:38 -0300 Subject: [PATCH 052/151] noggin: fix deployment reference Signed-off-by: Pedro Moura --- roles/openshift-apps/noggin/templates/service.yml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/noggin/templates/service.yml.j2 b/roles/openshift-apps/noggin/templates/service.yml.j2 index 55d0e5748c..59d47a5dab 100644 --- a/roles/openshift-apps/noggin/templates/service.yml.j2 +++ b/roles/openshift-apps/noggin/templates/service.yml.j2 @@ -12,4 +12,4 @@ spec: targetPort: 8080 selector: app: {{ object_app }} - deploymentconfig: noggin + deployment: noggin From 9d6c4314b35700ab4ae60d9bb0f55ee23745a412 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Wed, 29 Apr 2026 13:32:29 -0700 Subject: [PATCH 053/151] noggin: no need to add deployment selector here Signed-off-by: Kevin Fenzi --- roles/openshift-apps/noggin/templates/service.yml.j2 | 1 - 1 file changed, 1 deletion(-) diff --git a/roles/openshift-apps/noggin/templates/service.yml.j2 b/roles/openshift-apps/noggin/templates/service.yml.j2 index 59d47a5dab..cf01756cee 100644 --- a/roles/openshift-apps/noggin/templates/service.yml.j2 +++ b/roles/openshift-apps/noggin/templates/service.yml.j2 @@ -12,4 +12,3 @@ spec: targetPort: 8080 selector: app: {{ object_app }} - deployment: noggin From a633985c58ab4f8dd3f4a71b158460b907197e4a Mon Sep 17 00:00:00 2001 From: Pedro Moura Date: Mon, 16 Feb 2026 18:12:49 -0300 Subject: [PATCH 054/151] add mirrormanager deployment Signed-off-by: Pedro Moura --- .../mirrormanager/templates/deployment.yml.j2 | 42 +++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 roles/openshift-apps/mirrormanager/templates/deployment.yml.j2 diff --git a/roles/openshift-apps/mirrormanager/templates/deployment.yml.j2 b/roles/openshift-apps/mirrormanager/templates/deployment.yml.j2 new file mode 100644 index 0000000000..45b7736506 --- /dev/null +++ b/roles/openshift-apps/mirrormanager/templates/deployment.yml.j2 @@ -0,0 +1,42 @@ +{% from "_macros.yml.j2" import common_volume_mounts, common_volumes, common_env, security_context with context %} +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: frontend + labels: + app: mirrormanager +spec: + replicas: 1 + selector: + matchLabels: + app: mirrormanager + strategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 25% + maxUnavailable: 25% + template: + metadata: + labels: + app: mirrormanager + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"mirrormanager2:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"mirrormanager\")].image"}]' + spec: + containers: + - name: mirrormanager + image: mirrormanager2:latest + imagePullPolicy: Always + ports: + - containerPort: 8080 + env: + - name: APP_MODULE + value: "deploy.wsgi" + - name: APP_CONFIG + value: "/etc/mirrormanager/gunicorn.conf.py" + {{ common_env() }} + volumeMounts: + {{ common_volume_mounts() }} + volumes: + {{ common_volumes() }} + {{ security_context() }} From 720e354f9926453c2b51311ef0c65537b08312c8 Mon Sep 17 00:00:00 2001 From: Pedro Moura Date: Mon, 16 Mar 2026 18:20:36 -0300 Subject: [PATCH 055/151] replaced deployment file in playbook and fixed image path Signed-off-by: Pedro Moura --- playbooks/openshift-apps/mirrormanager.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/playbooks/openshift-apps/mirrormanager.yml b/playbooks/openshift-apps/mirrormanager.yml index 00f1fb7161..6a965741b8 100644 --- a/playbooks/openshift-apps/mirrormanager.yml +++ b/playbooks/openshift-apps/mirrormanager.yml @@ -133,8 +133,8 @@ # Deployment config - role: openshift/object object_app: mirrormanager - object_template: deploymentconfig.yml.j2 - object_objectname: deploymentconfig.yml + object_template: deployment.yml.j2 + object_objectname: deployment.yml # Cron jobs - role: openshift/object From 5cfb5141ab06cd9d83a5f9818c77d218c284a6ba Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Wed, 29 Apr 2026 14:10:28 -0700 Subject: [PATCH 056/151] mirrormanager: remove stray deploymentconfig call Signed-off-by: Kevin Fenzi --- roles/openshift-apps/mirrormanager/files/service.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/roles/openshift-apps/mirrormanager/files/service.yml b/roles/openshift-apps/mirrormanager/files/service.yml index d2382eee79..467c1df254 100644 --- a/roles/openshift-apps/mirrormanager/files/service.yml +++ b/roles/openshift-apps/mirrormanager/files/service.yml @@ -8,7 +8,6 @@ metadata: spec: selector: app: mirrormanager - deploymentconfig: frontend ports: - name: web port: 8080 From 384f14c337c73ce4396f0082138add1e29206edf Mon Sep 17 00:00:00 2001 From: Justin Wheeler Date: Thu, 2 Apr 2026 23:31:50 -0400 Subject: [PATCH 057/151] =?UTF-8?q?=F0=9F=90=9B=20roles(fasjson):=20Remove?= =?UTF-8?q?=20spaces=20after=20commas=20in=20email=20alias=20definitions?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Some email aliases defined in `aliases.static` used a mix of formatting: some entries separated recipients with ", " (comma-space) while others used "," (comma only). The inconsistency may cause recipient resolution failures if the MTA interprets the leading space as part of the alias name during expansion. Normalize all alias recipient lists to use comma-only separation, matching the format already used by the majority of entries in the file (e.g., `matrixadmin`, `swag-info`). This brings the following aliases into alignment: * codeofconduct * flock-coc * flock-staff * legal * sponsors If this resolves delivery issues, the root cause was whitespace- sensitive alias parsing. If not, it at least eliminates one variable and standardizes the file format for future troubleshooting. Assisted-by: Claude Opus 4.6 (1M context) Signed-off-by: Justin Wheeler --- roles/fasjson/files/aliases.static | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/roles/fasjson/files/aliases.static b/roles/fasjson/files/aliases.static index 7a3cf24a25..9affb4595f 100644 --- a/roles/fasjson/files/aliases.static +++ b/roles/fasjson/files/aliases.static @@ -150,7 +150,7 @@ legal-cla-archive: /dev/null vendors: distribution-members # Fedora Council -legal: fpl, bsutula@redhat.com, rfontana@redhat.com +legal: fpl,bsutula@redhat.com,rfontana@redhat.com board: council-private@lists.fedoraproject.org chair: fpl chairman: fpl @@ -180,9 +180,9 @@ diversity-inclusion: dei # Code of Conduct (CoC) Committee ## https://docs.fedoraproject.org/en-US/project/coc-committee/ -codeofconduct: fpl, fca, jonatoni, dcantrell, ankursinha, chris +codeofconduct: fpl,fca,jonatoni,dcantrell,ankursinha,chris ## a special CoC sub-committee for on-site response at Flock to Fedora contributor conference -flock-coc: codeofconduct, dvolavko, npazmino@redhat.com, shaunm@redhat.com, spotz +flock-coc: codeofconduct,dvolavko,npazmino@redhat.com,shaunm@redhat.com,spotz # Fedora Matrix admin matrixadmin: fpl,fca,kevin,nb @@ -212,13 +212,13 @@ fudcon-latam: flock-staff # flock #flockpress: fca,fpl #flockinfo: fca,fpl -flock-staff: flock-team-members@fedoraproject.org, jwheel@redhat.com +flock-staff: flock-team-members@fedoraproject.org,jwheel@redhat.com #flock-admin: flock-staff #flock-access: flock-admin # # flock/sponsor alias # https://forge.fedoraproject.org/infra/tickets/issues/10591 -sponsors: flock-team-sponsors@fedoraproject.org, jwheel@redhat.com +sponsors: flock-team-sponsors@fedoraproject.org,jwheel@redhat.com # swag customer email alias https://forge.fedoraproject.org/infra/tickets/issues/10794 swag-info: fca,shaunm,designteam-sponsors@fedoraproject.org From ce89bf1cc9f74c14ef3a1517a0beb9b8d2ad607e Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 17 Apr 2026 11:30:00 -0700 Subject: [PATCH 058/151] koji hub: move packit scratch builds to ci channel We don't want to move all packit builds, because it does a lot of official builds for maintainers. Instead, we want to just move the scratch builds over to the ci channel. See: https://forge.fedoraproject.org/infra/tickets/issues/13069 Signed-off-by: Kevin Fenzi --- roles/koji_hub/templates/hub.conf.j2 | 1 + 1 file changed, 1 insertion(+) diff --git a/roles/koji_hub/templates/hub.conf.j2 b/roles/koji_hub/templates/hub.conf.j2 index b33d831ad3..69632ffeb0 100644 --- a/roles/koji_hub/templates/hub.conf.j2 +++ b/roles/koji_hub/templates/hub.conf.j2 @@ -163,6 +163,7 @@ channel = method flatpakBuild :: use flatpak user bpeck/jenkins-continuous-infra.apps.ci.centos.org :: use ci user zuul :: use ci + user packit && scratch :: use ci {% if koji_instance == "secondary" %} # Some special policy for riscv koji to send generic tasks to x86 builders. # method build :: use generic From 3066851c810eabb9a9636afd6886523a746853af Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Wed, 15 Apr 2026 15:03:28 -0700 Subject: [PATCH 059/151] kickstarts / aarch64 / rhel10 / bvmhost-a64-01.stg Add a 6 nvme rhel10 kickstart for aarch64 machines. Set bvmhost-a64-01.stg to use it's 10G interface for provisioning now. (I fixed it to allow pxe booting). Signed-off-by: Kevin Fenzi --- .../dhcpd.conf.noc01.rdu3.fedoraproject.org | 9 +- roles/kickstarts/tasks/main.yml | 3 +- .../hardware-rhel-10-06disk-aarch64.j2 | 102 ++++++++++++++++++ 3 files changed, 108 insertions(+), 6 deletions(-) create mode 100644 roles/kickstarts/templates/hardware-rhel-10-06disk-aarch64.j2 diff --git a/roles/dhcp_server/files/dhcpd.conf.noc01.rdu3.fedoraproject.org b/roles/dhcp_server/files/dhcpd.conf.noc01.rdu3.fedoraproject.org index c2f7fb6da7..7fc6988205 100644 --- a/roles/dhcp_server/files/dhcpd.conf.noc01.rdu3.fedoraproject.org +++ b/roles/dhcp_server/files/dhcpd.conf.noc01.rdu3.fedoraproject.org @@ -1137,12 +1137,11 @@ host ocp03 { option routers 10.16.163.254; option subnet-mask 255.255.255.0; } -# These are for aarch64 boxes to initially provision on their 1g interfaces -host bvmhost-a64-01-provision { - hardware ethernet d8:5e:d3:e6:20:b0; - fixed-address 10.16.163.150; +host bvmhost-a64-01-stg { + hardware ethernet b8:ce:f6:51:56:c4; + fixed-address 10.16.167.16; next-server 10.16.163.10; - option routers 10.16.163.254; + option routers 10.16.167.254; option subnet-mask 255.255.255.0; } host bvmhost-a64-02-provision { diff --git a/roles/kickstarts/tasks/main.yml b/roles/kickstarts/tasks/main.yml index 1d799748ed..a3e40acefd 100644 --- a/roles/kickstarts/tasks/main.yml +++ b/roles/kickstarts/tasks/main.yml @@ -10,6 +10,8 @@ - kvm-rhel-8 - hardware-rhel-9-08disk - hardware-rhel-9-06disk + - hardware-rhel-9-06disk-aarch64 + - hardware-rhel-10-06disk-aarch64 - hardware-rhel-10-08disk - hardware-rhel-10-nodisk - hardware-fedora-01disk-nvme @@ -18,7 +20,6 @@ - hardware-fedora-06disk-nvme - hardware-fedora-ppc64le-02disk - hardware-fedora-ppc64le-08disk - - hardware-rhel-9-06disk-aarch64 - openqa-fedora-08disk tags: - config diff --git a/roles/kickstarts/templates/hardware-rhel-10-06disk-aarch64.j2 b/roles/kickstarts/templates/hardware-rhel-10-06disk-aarch64.j2 new file mode 100644 index 0000000000..eee3d4c7c5 --- /dev/null +++ b/roles/kickstarts/templates/hardware-rhel-10-06disk-aarch64.j2 @@ -0,0 +1,102 @@ +# Use network installation +vnc --password "{{ kickstart_vnc_password }}" +# Use network install +url --url=http://infrastructure.fedoraproject.org/repo/rhel/RHEL10-aarch64/ +repo --name=epel --baseurl=http://infrastructure.fedoraproject.org/pub/epel/10/Everything/aarch64/ +repo --name="net-baseos" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/aarch64/baseos/ +repo --name="net-appstream" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/aarch64/appstream/ +repo --name="net-crb" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/aarch64/crb/ + +# Firewall configuration +firewall --disabled +firstboot --disable +ignoredisk --only-use=nvme0n1,nvme1n1,nvme2n1,nvme3n1,nvme4n1,nvme5n1 +# Keyboard layouts +# old format: keyboard us +# new format: +keyboard --vckeymap=us --xlayouts='' +# System language +lang en_US.UTF-8 + +# Network information +# Reboot after installation +reboot +# Root password +rootpw --iscrypted "{{ kickstart_initial_password_encrypted }}" +# SELinux configuration +selinux --enforcing +# System services +services --disabled="firewalld,kdump" --enabled="postfix,rsyslog,chronyd" +# Do not configure the X Window System +skipx +# System timezone +timezone UTC --utc +# System bootloader configuration +bootloader --location=mbr --boot-drive=nvme0n1 --append="net.ifnames=0" --driveorder=nvme0n1,nvme1n1,nvme2n1,nvme3n1,nvme4n1,nvme5n1 +zerombr +clearpart --drives=nvme0n1,nvme1n1,nvme2n1,nvme3n1,nvme4n1,nvme5n1 --all --initlabel + +# Disk partitioning information +part raid.200 --fstype="mdmember" --ondisk=nvme0n1 --size=1000 +part raid.210 --fstype="mdmember" --ondisk=nvme1n1 --size=1000 +part raid.220 --fstype="mdmember" --ondisk=nvme2n1 --size=1000 +part raid.230 --fstype="mdmember" --ondisk=nvme3n1 --size=1000 +part raid.240 --fstype="mdmember" --ondisk=nvme4n1 --size=1000 +part raid.250 --fstype="mdmember" --ondisk=nvme5n1 --size=1000 +part raid.300 --fstype="mdmember" --ondisk=nvme0n1 --size=477 +part raid.310 --fstype="mdmember" --ondisk=nvme1n1 --size=477 +part raid.320 --fstype="mdmember" --ondisk=nvme2n1 --size=477 +part raid.330 --fstype="mdmember" --ondisk=nvme3n1 --size=477 +part raid.340 --fstype="mdmember" --ondisk=nvme4n1 --size=477 +part raid.350 --fstype="mdmember" --ondisk=nvme5n1 --size=477 +part raid.400 --fstype="mdmember" --ondisk=nvme0n1 --size=65536 --grow +part raid.410 --fstype="mdmember" --ondisk=nvme1n1 --size=65536 --grow +part raid.420 --fstype="mdmember" --ondisk=nvme2n1 --size=65536 --grow +part raid.430 --fstype="mdmember" --ondisk=nvme3n1 --size=65536 --grow +part raid.440 --fstype="mdmember" --ondisk=nvme4n1 --size=65536 --grow +part raid.450 --fstype="mdmember" --ondisk=nvme5n1 --size=65536 --grow + +raid /boot --device=0 --fstype="ext4" --level=RAID1 raid.200 raid.210 raid.220 raid.230 raid.240 raid.250 +raid /boot/efi --device=1 --fstype="efi" --level=RAID1 --fsoptions="umask=0077,shortname=winnt" raid.300 raid.310 raid.320 raid.330 raid.340 raid.350 +raid pv.610 --device=2 --fstype="lvmpv" --level=RAID6 --encrypted --passphrase="{{ luks_initial_password }}" --chunksize=512 raid.400 raid.410 raid.420 raid.430 raid.440 raid.450 + +volgroup vg_guests --pesize=4096 pv.610 + +logvol / --fstype="xfs" --size=32768 --name=LogVol00 --vgname=vg_guests +logvol swap --fstype="swap" --size=8192 --name=LogVol01 --vgname=vg_guests + +%packages +-geolite2-city +-iwl*firmware +-subscription-manager +bash-completion +bind-utils +clevis* +cronie-noanacron +crontabs +grubby +iptables-services +nfs-utils +nmap-ncat +openssh-clients +openssh-server +patch +postfix +rsync +screen +strace +s-nail +tmpwatch +tmux +traceroute +vim-enhanced +zsh +-insights-client +-rhc +%end + +%post --nochroot --log=/mnt/sysimage/root/post.output --erroronfail +mkdir /mnt/sysimage/root/tmp +chroot /mnt/sysimage /usr/bin/curl https://infrastructure.fedoraproject.org/rhel/ks/post/rhel10-post.sh -o /root/tmp/rhel10-post.sh +chroot /mnt/sysimage sh /root/tmp/rhel10-post.sh +%end From 8d7f48967ddfaefddb9625e565fb541907a1af10 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Wed, 29 Apr 2026 15:29:31 -0700 Subject: [PATCH 060/151] koji: tell policy scratch is a bool for testing Signed-off-by: Kevin Fenzi --- roles/koji_hub/templates/hub.conf.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/koji_hub/templates/hub.conf.j2 b/roles/koji_hub/templates/hub.conf.j2 index 69632ffeb0..af8ea40c5a 100644 --- a/roles/koji_hub/templates/hub.conf.j2 +++ b/roles/koji_hub/templates/hub.conf.j2 @@ -163,7 +163,7 @@ channel = method flatpakBuild :: use flatpak user bpeck/jenkins-continuous-infra.apps.ci.centos.org :: use ci user zuul :: use ci - user packit && scratch :: use ci + user packit && bool scratch :: use ci {% if koji_instance == "secondary" %} # Some special policy for riscv koji to send generic tasks to x86 builders. # method build :: use generic From d6e7adc2019ee7a0582a6f0c7f117d05d850c7f2 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Wed, 29 Apr 2026 16:06:24 -0700 Subject: [PATCH 061/151] dhcpd: bvmhost-a64-01.stg: other interface is the provision one Signed-off-by: Kevin Fenzi --- roles/dhcp_server/files/dhcpd.conf.noc01.rdu3.fedoraproject.org | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/dhcp_server/files/dhcpd.conf.noc01.rdu3.fedoraproject.org b/roles/dhcp_server/files/dhcpd.conf.noc01.rdu3.fedoraproject.org index 7fc6988205..8952e2f6bd 100644 --- a/roles/dhcp_server/files/dhcpd.conf.noc01.rdu3.fedoraproject.org +++ b/roles/dhcp_server/files/dhcpd.conf.noc01.rdu3.fedoraproject.org @@ -1138,7 +1138,7 @@ host ocp03 { option subnet-mask 255.255.255.0; } host bvmhost-a64-01-stg { - hardware ethernet b8:ce:f6:51:56:c4; + hardware ethernet b8:ce:f6:51:56:c5; fixed-address 10.16.167.16; next-server 10.16.163.10; option routers 10.16.167.254; From d5c4b09e6e028440ae973fa23fe4d2c020ffb432 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Wed, 29 Apr 2026 17:34:14 -0700 Subject: [PATCH 062/151] buildvm-a64 staging: move to fedora 44 Signed-off-by: Kevin Fenzi --- inventory/group_vars/buildvm_aarch64_stg | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/inventory/group_vars/buildvm_aarch64_stg b/inventory/group_vars/buildvm_aarch64_stg index 08f009690a..38e4097b0d 100644 --- a/inventory/group_vars/buildvm_aarch64_stg +++ b/inventory/group_vars/buildvm_aarch64_stg @@ -18,7 +18,7 @@ koji_topurl: "https://kojipkgs.stg.fedoraproject.org/" # Groups and individual hosts should ovveride them with specific info. koji_weburl: "https://koji.stg.fedoraproject.org/koji" -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/43/Server/aarch64/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/aarch64/os/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora lvm_size: 140000 max_cpu: "{{ num_cpus }}" From 2b8fecb1f727bf0347b24dd776353fa626cb9168 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Wed, 29 Apr 2026 17:49:41 -0700 Subject: [PATCH 063/151] openshift: disallow users self-provisioning We don't want authenticated users being able to self provision projects in our clusters. We only want that to happen via ansible. Signed-off-by: Kevin Fenzi --- roles/openshift/cluster/tasks/main.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/roles/openshift/cluster/tasks/main.yaml b/roles/openshift/cluster/tasks/main.yaml index c24717402e..6e7eb2a0b4 100644 --- a/roles/openshift/cluster/tasks/main.yaml +++ b/roles/openshift/cluster/tasks/main.yaml @@ -33,3 +33,7 @@ notify: Apply changes to openshift tags: - create-resources + +# Disable users from creating projects + - name: disable default user project creation + ansible.builtin.command: oc adm policy remove-cluster-role-from-group self-provisioner system:authenticated:oauth From 9d9edc96588fac6c793b9b1f2b9897a5ad00c8ec Mon Sep 17 00:00:00 2001 From: Victor Koycheff Date: Wed, 25 Feb 2026 19:22:36 +0200 Subject: [PATCH 064/151] proxies-reverseproxy: set keepalive=on ttl=10 for koji This fixes intermittent 502 Bad Gateway errors during long-running koji connections (like watch-task or watch-logs). For more details on proxy keepalive and ttl, see: https://httpd.apache.org/docs/2.4/mod/mod_proxy.html Fixes #12913 Signed-off-by: Victor Koycheff From e56db32aa62b729dca8f77e8d4c2ad0c08e4c9e5 Mon Sep 17 00:00:00 2001 From: Victor Koycheff Date: Thu, 12 Mar 2026 09:39:24 +0200 Subject: [PATCH 065/151] httpd/koji: set MaxKeepAliveRequests 0 to fix 502 race condition This acts as the second half of the fix for the 502 Bad Gateway errors on long-running koji connections. Fixes #12913 Signed-off-by: Victor Koycheff --- roles/httpd/proxy/templates/httpd.conf.j2 | 2 +- roles/koji_hub/templates/kojihub.conf.j2 | 1 + roles/koji_hub/templates/kojiweb.conf.j2 | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/roles/httpd/proxy/templates/httpd.conf.j2 b/roles/httpd/proxy/templates/httpd.conf.j2 index f0c2cdf7f8..188fdb286c 100644 --- a/roles/httpd/proxy/templates/httpd.conf.j2 +++ b/roles/httpd/proxy/templates/httpd.conf.j2 @@ -87,7 +87,7 @@ KeepAlive On # during a persistent connection. Set to 0 to allow an unlimited amount. # We recommend you leave this number high, for maximum performance. # -MaxKeepAliveRequests 500 +MaxKeepAliveRequests 0 # # KeepAliveTimeout: Number of seconds to wait for the next request from the diff --git a/roles/koji_hub/templates/kojihub.conf.j2 b/roles/koji_hub/templates/kojihub.conf.j2 index a3a69b5455..7a28811667 100644 --- a/roles/koji_hub/templates/kojihub.conf.j2 +++ b/roles/koji_hub/templates/kojihub.conf.j2 @@ -3,6 +3,7 @@ # KeepAlive On +MaxKeepAliveRequests 0 Alias /kojihub /usr/share/koji-hub/kojiapp.py diff --git a/roles/koji_hub/templates/kojiweb.conf.j2 b/roles/koji_hub/templates/kojiweb.conf.j2 index 2c881ad5fe..1686fe0027 100644 --- a/roles/koji_hub/templates/kojiweb.conf.j2 +++ b/roles/koji_hub/templates/kojiweb.conf.j2 @@ -2,7 +2,7 @@ RewriteEngine On RewriteRule ^/$ /koji/ [R,L] KeepAlive On KeepAliveTimeout 16 -MaxKeepAliveRequests 500 +MaxKeepAliveRequests 0 ServerLimit 2000 MaxRequestWorkers 2000 From bc2bd50a06dca8e9878a3d74d5eeac05ae2344df Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Aur=C3=A9lien=20Bompard?= Date: Mon, 20 Apr 2026 10:44:41 +0200 Subject: [PATCH 066/151] Add another Ipsilon patch MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Aurélien Bompard --- roles/ipsilon/defaults/main.yml | 1 + roles/ipsilon/tasks/patches.yml | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/roles/ipsilon/defaults/main.yml b/roles/ipsilon/defaults/main.yml index 6175e2bb9a..b29592e93e 100644 --- a/roles/ipsilon/defaults/main.yml +++ b/roles/ipsilon/defaults/main.yml @@ -1,3 +1,4 @@ --- ipsilon_patches: - 409 + - integrityerror diff --git a/roles/ipsilon/tasks/patches.yml b/roles/ipsilon/tasks/patches.yml index 561b974aba..497c57d082 100644 --- a/roles/ipsilon/tasks/patches.yml +++ b/roles/ipsilon/tasks/patches.yml @@ -13,7 +13,7 @@ - name: Download patches ansible.builtin.copy: - src: /srv/web/infra/bigfiles/hotfixes/ipsilon/{{ item }} + src: /srv/web/infra/bigfiles/hotfixes/ipsilon/{{ item }}.patch dest: /opt/ipsilon-patches/{{ item }}.patch owner: root group: root From b7551004fa87bcf541c0fa1af9fc2763030feb3d Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Tue, 14 Apr 2026 16:29:55 +0100 Subject: [PATCH 067/151] Zabbix: add some more macro overrides Signed-off-by: Greg Sutcliffe --- inventory/host_vars/db-datanommer02.rdu3.fedoraproject.org | 2 ++ inventory/host_vars/db01.rdu3.fedoraproject.org | 3 ++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/inventory/host_vars/db-datanommer02.rdu3.fedoraproject.org b/inventory/host_vars/db-datanommer02.rdu3.fedoraproject.org index d236314e3d..eef1208477 100644 --- a/inventory/host_vars/db-datanommer02.rdu3.fedoraproject.org +++ b/inventory/host_vars/db-datanommer02.rdu3.fedoraproject.org @@ -41,3 +41,5 @@ shared_buffers: "4GB" tcp_ports: [5432, 443] vmhost: vmhost-x86-04.rdu3.fedoraproject.org volgroup: /dev/vg_guests +zabbix_macros: + 'PG.LOCKS.MAX.WARN:"mirrormanager2"': 3000 diff --git a/inventory/host_vars/db01.rdu3.fedoraproject.org b/inventory/host_vars/db01.rdu3.fedoraproject.org index 5fdf9208b1..a2e97104fe 100644 --- a/inventory/host_vars/db01.rdu3.fedoraproject.org +++ b/inventory/host_vars/db01.rdu3.fedoraproject.org @@ -82,5 +82,6 @@ vmhost: vmhost-x86-04.rdu3.fedoraproject.org volgroup: /dev/vg_guests zabbix_macros: 'PG.LOCKS.MAX.WARN:"anitya"': 500 - 'PG.LOCKS.MAX.WARN:"bodhi2"': 200 + 'PG.LOCKS.MAX.WARN:"bodhi2"': 500 + 'PG.LOCKS.MAX.WARN:"datanommer2"': 1000 'PG.LOCKS.MAX.WARN:"hyperkitty"': 500 From 13f80f78dbbcbb24f742f65bbbb139f2447e9b4f Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Tue, 14 Apr 2026 16:28:57 +0100 Subject: [PATCH 068/151] DHCP: add p10-fco02 builder to the dhcp config Signed-off-by: Greg Sutcliffe --- .../files/dhcpd.conf.noc01.rdu3.fedoraproject.org | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/roles/dhcp_server/files/dhcpd.conf.noc01.rdu3.fedoraproject.org b/roles/dhcp_server/files/dhcpd.conf.noc01.rdu3.fedoraproject.org index 8952e2f6bd..b5aa60b191 100644 --- a/roles/dhcp_server/files/dhcpd.conf.noc01.rdu3.fedoraproject.org +++ b/roles/dhcp_server/files/dhcpd.conf.noc01.rdu3.fedoraproject.org @@ -1703,3 +1703,12 @@ host buildhw-p10-fcos01.rdu3.fedoraproject.org { option subnet-mask 255.255.255.0; option host-name "buildhw-p10-fcos01.rdu3.fedoraproject.org"; } + +host buildhw-p10-fcos02.rdu3.fedoraproject.org { + hardware ethernet be:86:ed:ba:1a:00; + fixed-address 10.16.171.36; + next-server 10.16.163.10; + option routers 10.16.171.254; + option subnet-mask 255.255.255.0; + option host-name "buildhw-p10-fcos02.rdu3.fedoraproject.org"; +} From 03e682247a97e9cc8d65fe38290b7ff926b079b4 Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Fri, 24 Apr 2026 12:13:45 +0100 Subject: [PATCH 069/151] Zabbix: add Varnish monitoring Signed-off-by: Greg Sutcliffe --- roles/varnish/files/zabbix/agent.conf | 1 + roles/varnish/files/zabbix/selinux.te | 12 + roles/varnish/files/zabbix/template.yml | 549 ++++++++++++++++++++++++ roles/varnish/tasks/main.yml | 7 + roles/varnish/tasks/monitoring.yml | 99 +++++ 5 files changed, 668 insertions(+) create mode 100644 roles/varnish/files/zabbix/agent.conf create mode 100644 roles/varnish/files/zabbix/selinux.te create mode 100644 roles/varnish/files/zabbix/template.yml create mode 100644 roles/varnish/tasks/monitoring.yml diff --git a/roles/varnish/files/zabbix/agent.conf b/roles/varnish/files/zabbix/agent.conf new file mode 100644 index 0000000000..7071744c77 --- /dev/null +++ b/roles/varnish/files/zabbix/agent.conf @@ -0,0 +1 @@ +UserParameter=varnish.raw_data,/usr/sbin/varnishstat -j diff --git a/roles/varnish/files/zabbix/selinux.te b/roles/varnish/files/zabbix/selinux.te new file mode 100644 index 0000000000..fd38f3da09 --- /dev/null +++ b/roles/varnish/files/zabbix/selinux.te @@ -0,0 +1,12 @@ +module zabbix_varnish 1.1; + +require { + type zabbix_agent_t; + type varnishd_var_lib_t; + class file read; + class file open; +} + +#============= zabbix_agent_t ============== +allow zabbix_agent_t varnishd_var_lib_t:file read; +allow zabbix_agent_t varnishd_var_lib_t:file open; diff --git a/roles/varnish/files/zabbix/template.yml b/roles/varnish/files/zabbix/template.yml new file mode 100644 index 0000000000..9c489ce896 --- /dev/null +++ b/roles/varnish/files/zabbix/template.yml @@ -0,0 +1,549 @@ +zabbix_export: + version: '7.0' + template_groups: + - uuid: a333cbd6a3ad44baaa4eee4b0c0b1bec + name: Fedora + templates: + - uuid: 8a0ae7759b4d4cda8da682f02ab95095 + template: 'Varnish Cache Monitoring' + name: 'Varnish Cache Monitoring' + description: | + ## Description + + Simple template for the Varnish cache using results from the varnishstat command. + + ## Overview + + Simple template for the Varnish cache using results from the varnishstat command. + + ## Author: Greg Sutcliffe + ## Forked from: Dave Humphrey (dave@uesp.net) + groups: + - name: Fedora + items: + - uuid: adf987b6d3df486db52d4b8148a865c9 + name: 'Varnish: Service response time' + type: ZABBIX_ACTIVE + key: 'net.tcp.service.perf[http,"{$VARNISH.STATUS.HOST}","{$VARNISH.STATUS.PORT}"]' + history: 7d + value_type: FLOAT + units: s + tags: + - tag: Application + value: Varnish + triggers: + - uuid: 85538643e3c24fbb8b4fdd222f3f44e0 + expression: 'min(/Varnish Cache Monitoring/net.tcp.service.perf[http,"{$VARNISH.STATUS.HOST}","{$VARNISH.STATUS.PORT}"],5m)={$VARNISH.RESPONSE_TIME.MAX.WARN}' + name: 'Varnish: Service response time is too high (over {$VARNISH.RESPONSE_TIME.MAX.WARN}s for 5m)' + priority: WARNING + manual_close: 'YES' + dependencies: + - name: 'Varnish: Process is not running' + expression: 'last(/Varnish Cache Monitoring/proc.num["{$VARNISH.PROCESS_NAME}"])=0' + - name: 'Varnish: Service is down' + expression: 'last(/Varnish Cache Monitoring/net.tcp.service[http,"{$VARNISH.STATUS.HOST}","{$VARNISH.STATUS.PORT}"])=0' + - uuid: 80295421232547dfba8159e974c236d6 + name: 'Varnish: Service ping' + type: ZABBIX_ACTIVE + key: 'net.tcp.service[http,"{$VARNISH.STATUS.HOST}","{$VARNISH.STATUS.PORT}"]' + history: 7d + tags: + - tag: Application + value: Varnish + triggers: + - uuid: 4c754b657d944992b309c0a92bb01499 + expression: 'last(/Varnish Cache Monitoring/net.tcp.service[http,"{$VARNISH.STATUS.HOST}","{$VARNISH.STATUS.PORT}"])=0' + name: 'Varnish: Service is down' + priority: AVERAGE + manual_close: 'YES' + dependencies: + - name: 'Varnish: Process is not running' + expression: 'last(/Varnish Cache Monitoring/proc.num["{$VARNISH.PROCESS_NAME}"])=0' + - uuid: 8d173a3deb874b1bab51dd698d9358fc + name: 'Varnish: CPU utilization' + type: ZABBIX_ACTIVE + key: 'proc.cpu.util["{$VARNISH.PROCESS_NAME}"]' + history: 7d + value_type: FLOAT + units: '%' + description: 'Process CPU utilization percentage.' + tags: + - tag: Application + value: Varnish + - uuid: fe4a28e44cdb492c8539914af45b39a3 + name: 'Varnish: Memory usage (rss)' + type: ZABBIX_ACTIVE + key: 'proc.mem["{$VARNISH.PROCESS_NAME}",,,,rss]' + history: 7d + units: B + description: 'Resident set size memory used by process in bytes.' + tags: + - tag: Application + value: Varnish + - uuid: 079f500025b840dcb5629e0c92539ddb + name: 'Varnish: Memory usage (vsize)' + type: ZABBIX_ACTIVE + key: 'proc.mem["{$VARNISH.PROCESS_NAME}",,,,vsize]' + history: 7d + units: B + description: 'Virtual memory size used by process in bytes.' + tags: + - tag: Application + value: Varnish + - uuid: 7db0bf02c0ca419d985a2b11fc1c25f6 + name: 'Varnish: Number of processes running' + type: ZABBIX_ACTIVE + key: 'proc.num["{$VARNISH.PROCESS_NAME}"]' + history: 7d + tags: + - tag: Application + value: Varnish + triggers: + - uuid: dc44a80d523f445c819071c9ebf48893 + expression: 'last(/Varnish Cache Monitoring/proc.num["{$VARNISH.PROCESS_NAME}"])=0' + name: 'Varnish: Process is not running' + priority: HIGH + - uuid: 645d42eafecc4b1a95b5e75ba10d9fc3 + name: 'Varnish: Backend connections' + type: DEPENDENT + key: varnish.backend.connections + delay: '0' + history: 7d + description: 'Backend connections succeeded' + preprocessing: + - type: JSONPATH + parameters: + - '$["MAIN.backend_conn"].value' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: e935889f0eaa40a8a3f7589e3136dbc8 + name: 'Varnish: Backend failed' + type: DEPENDENT + key: varnish.backend.failed + delay: '0' + history: 7d + description: 'Backend connections failed' + preprocessing: + - type: JSONPATH + parameters: + - '$["MAIN.backend_fail"].value' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: f0c8750857464c609f40cd803849dddb + name: 'Varnish: Backend requests' + type: DEPENDENT + key: varnish.backend.requests + delay: '0' + history: 7d + description: 'Backend requests made' + preprocessing: + - type: JSONPATH + parameters: + - '$["MAIN.backend_req"].value' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: ffd5566192bd44eeb9d93ebc9d6a2fc4 + name: 'Varnish: Backend unhealthy' + type: DEPENDENT + key: varnish.backend.unhealthy + delay: '0' + history: 7d + description: 'Backend connections not attempted' + preprocessing: + - type: JSONPATH + parameters: + - '$["MAIN.backend_unhealthy"].value' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: 75d72c6a11174f91862f72e2b05010d0 + name: 'Varnish: Bytes per second' + type: DEPENDENT + key: varnish.bytes.rate + delay: '0' + history: 7d + value_type: FLOAT + units: Bps + description: 'Calculated as change rate for ''Total bytes'' stat.' + preprocessing: + - type: JAVASCRIPT + parameters: + - | + var values = JSON.parse(value); + var headBytes = values["MAIN.s_resp_hdrbytes"].value; + var bodyBytes = values["MAIN.s_resp_bodybytes"].value; + return headBytes + bodyBytes; + - type: CHANGE_PER_SECOND + parameters: + - '' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: fd089d8419ff4d83a2c3fe7f0172ff5f + name: 'Varnish: Cache hit-pass' + type: DEPENDENT + key: varnish.cache.hitpasses + delay: '0' + history: 7d + description: 'Cache hits for pass' + preprocessing: + - type: JSONPATH + parameters: + - '$["MAIN.cache_hitpass"].value' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: a199ab12103345c4812ecc1472bd6dc4 + name: 'Varnish: Cache hits' + type: DEPENDENT + key: varnish.cache.hits + delay: '0' + history: 7d + description: 'Cache hits' + preprocessing: + - type: JSONPATH + parameters: + - '$["MAIN.cache_hit"].value' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: 7378704abbc24b05ad203a8e9735cd2c + name: 'Varnish: Cache misses' + type: DEPENDENT + key: varnish.cache.misses + delay: '0' + history: 7d + description: 'Cache misses' + preprocessing: + - type: JSONPATH + parameters: + - '$["MAIN.cache_miss"].value' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: 4bf458f277af4234a2971b6aaf8d8280 + name: 'Varnish: Client requests' + type: DEPENDENT + key: varnish.client.requests + delay: '0' + history: 7d + description: 'Good client requests received' + preprocessing: + - type: JSONPATH + parameters: + - '$["MAIN.client_req"].value' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: fca4b1afebab4edb91a9e9ac7174fef2 + name: 'Varnish: Cache hit rate' + type: DEPENDENT + key: varnish.hitrate + delay: '0' + history: 7d + value_type: FLOAT + units: '%' + description: 'Average hit rate since the cache was started' + preprocessing: + - type: JAVASCRIPT + parameters: + - | + var values = JSON.parse(value); + var hit = values["MAIN.cache_hit"].value; + var miss = values["MAIN.cache_miss"].value; + var hitpass = values["MAIN.cache_hitpass"].value; + return hit / (hit + miss) * 100; + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: 11b2739844e8482fb2d44cd936065977 + name: 'Varnish: Cache hit rate 5m' + type: CALCULATED + key: varnish.hitrate5m + history: 7d + value_type: FLOAT + units: '%' + params: '(last(//varnish.cache.hits) - last(//varnish.cache.hits,#2)) * 100 / ((last(//varnish.cache.misses) - last(//varnish.cache.misses,#2)) + (last(//varnish.cache.hits) - last(//varnish.cache.hits,#2)))' + description: 'Average cache hit rate in the past 5m' + tags: + - tag: Application + value: Varnish + - uuid: 2318e903bafd4f5c9d9bf1159fbc659e + name: 'Varnish: Expired objects' + type: DEPENDENT + key: varnish.objects.expired + delay: '0' + history: 7d + description: 'Number of expired objects' + preprocessing: + - type: JSONPATH + parameters: + - '$["MAIN.n_expired"].value' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: 36837e88b2344e94923f26bc15e4202b + name: 'Varnish: LRU nuked objects' + type: DEPENDENT + key: varnish.objects.lrunuked + delay: '0' + history: 7d + description: 'Number of LRU nuked objects' + preprocessing: + - type: JSONPATH + parameters: + - '$["MAIN.n_lru_nuked"].value' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: a04a8fd97456427d9b82e9856695ec88 + name: 'Varnish: Num purges' + type: DEPENDENT + key: varnish.objects.purges + delay: '0' + history: 7d + description: 'Number of purge operations executed' + preprocessing: + - type: JSONPATH + parameters: + - '$["MAIN.n_purges"].value' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: 05ee653674dd490fa99643d2253241e6 + name: 'Varnish: Get status' + type: ZABBIX_ACTIVE + key: varnish.raw_data + history: 1h + value_type: TEXT + trends: '0' + preprocessing: + - type: JSONPATH + parameters: + - $.counters + tags: + - tag: Application + value: 'Zabbix raw items' + triggers: + - uuid: 3b1aa70c7b104e2bb557c2db9ffe710b + expression: 'nodata(/Varnish Cache Monitoring/varnish.raw_data,10m)=1' + name: 'Varnish: Failed to fetch stats (or no data for 10m)' + priority: WARNING + description: 'Zabbix has not received data for stats for the last 10m.' + manual_close: 'YES' + dependencies: + - name: 'Varnish: Process is not running' + expression: 'last(/Varnish Cache Monitoring/proc.num["{$VARNISH.PROCESS_NAME}"])=0' + - name: 'Varnish: Service is down' + expression: 'last(/Varnish Cache Monitoring/net.tcp.service[http,"{$VARNISH.STATUS.HOST}","{$VARNISH.STATUS.PORT}"])=0' + - uuid: 017f130075e44226ab676b4758445a6c + name: 'Varnish: Total request bytes' + type: DEPENDENT + key: varnish.request.bytes + delay: '0' + history: 7d + units: B + description: 'Total bytes received' + preprocessing: + - type: JAVASCRIPT + parameters: + - | + var values = JSON.parse(value); + var headBytes = values["MAIN.s_req_hdrbytes"].value; + var bodyBytes = values["MAIN.s_req_bodybytes"].value; + return headBytes + bodyBytes; + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: 8c06df8a87fa46738fc80ab6441cfae1 + name: 'Varnish: Requests per second' + type: DEPENDENT + key: varnish.requests.rate + delay: '0' + history: 7d + value_type: FLOAT + preprocessing: + - type: JSONPATH + parameters: + - '$["MAIN.client_req"].value' + - type: CHANGE_PER_SECOND + parameters: + - '' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: f364881a918a4e678816360f61b46d43 + name: 'Varnish: Total response bytes' + type: DEPENDENT + key: varnish.response.bytes + delay: '0' + history: 7d + units: B + description: 'Total bytes sent' + preprocessing: + - type: JAVASCRIPT + parameters: + - | + var values = JSON.parse(value); + var headBytes = values["MAIN.s_resp_hdrbytes"].value; + var bodyBytes = values["MAIN.s_resp_bodybytes"].value; + return headBytes + bodyBytes; + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: c876276a1b93421ab8c0a12f80918893 + name: 'Varnish: Session dropped' + type: DEPENDENT + key: varnish.session.dropped + delay: '0' + history: 7d + description: 'Sessions dropped' + preprocessing: + - type: JSONPATH + parameters: + - '$["MAIN.sess_dropped"].value' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: fb2feb9ed69e414ca8c36d5b832ce79a + name: 'Varnish: Threads created' + type: DEPENDENT + key: varnish.threads.created + delay: '0' + history: 7d + description: 'Threads created' + preprocessing: + - type: JSONPATH + parameters: + - '$["MAIN.threads_created"].value' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: bd8e098f8d2f42aaa7fc901173162b6a + name: 'Varnish: Threads failed' + type: DEPENDENT + key: varnish.threads.failed + delay: '0' + history: 7d + description: 'Thread creation failure' + preprocessing: + - type: JSONPATH + parameters: + - '$["MAIN.threads_failed"].value' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: 83e9983fa64648be95e4e275fd582419 + name: 'Varnish: Threads limited' + type: DEPENDENT + key: varnish.threads.limited + delay: '0' + history: 7d + description: 'Threads hit max' + preprocessing: + - type: JSONPATH + parameters: + - '$["MAIN.threads_limited"].value' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + - uuid: 3cdec39a17bd42fcbc846432bc9d1ed1 + name: 'Varnish: Uptime' + type: DEPENDENT + key: varnish.uptime + delay: '0' + history: 7d + units: uptime + description: 'Service uptime in seconds' + preprocessing: + - type: JSONPATH + parameters: + - '$["MAIN.uptime"].value' + master_item: + key: varnish.raw_data + tags: + - tag: Application + value: Varnish + triggers: + - uuid: 038c5860369147238731776c5ec18410 + expression: 'last(/Varnish Cache Monitoring/varnish.uptime)=10m' + name: 'Varnish: Has been restarted (uptime < 10m)' + priority: INFO + description: 'Uptime is less than 10 minutes' + manual_close: 'YES' + macros: + - macro: '{$VARNISH.PROCESS_NAME}' + value: varnishd + description: 'Process name of the Varnish server.' + - macro: '{$VARNISH.RESPONSE_TIME.MAX.WARN}' + value: '5' + description: 'Max response time before a warning is given.' + - macro: '{$VARNISH.STATUS.HOST}' + value: 127.0.0.1 + description: 'IP or hostname of the Varnish server.' + - macro: '{$VARNISH.STATUS.PORT}' + value: '80' + description: 'Port of the Varnish server.' + graphs: + - uuid: ef40fb5ce9344c04b91e96d7d547ac84 + name: 'Cache hit rate' + graph_items: + - color: 1A7C11 + item: + host: 'Varnish Cache Monitoring' + key: varnish.hitrate + - sortorder: '1' + color: F63100 + item: + host: 'Varnish Cache Monitoring' + key: varnish.hitrate5m + - uuid: 73f2cd95eb664725a42051d495a5dadf + name: 'Request rate' + graph_items: + - color: 1A7C11 + item: + host: 'Varnish Cache Monitoring' + key: varnish.requests.rate diff --git a/roles/varnish/tasks/main.yml b/roles/varnish/tasks/main.yml index 3819a8a46b..e6acf0bc20 100644 --- a/roles/varnish/tasks/main.yml +++ b/roles/varnish/tasks/main.yml @@ -42,3 +42,10 @@ service: enabled=yes name=varnish tags: - varnish + +- name: Configure Varnish monitoring in Zabbix + ansible.builtin.include_tasks: monitoring.yml + tags: + - varnish + - zabbix_agent + - zabbix_api diff --git a/roles/varnish/tasks/monitoring.yml b/roles/varnish/tasks/monitoring.yml new file mode 100644 index 0000000000..3762efc26a --- /dev/null +++ b/roles/varnish/tasks/monitoring.yml @@ -0,0 +1,99 @@ +--- +# Configure Zabbix. A host including this file should +# - deploy the required scripts & agent config to the host +# - add itself to the required hostgroup +# - add itself to the required template + +# Custom SELinux requirements for Zabbix to execute monitoring binaries +- name: Ensure a directory exists for varnish+Zabbix selinux module + ansible.builtin.file: + path: /usr/local/share/zabbix + state: directory + mode: '0755' + tags: + - selinux + - varnish + - zabbix_agent + +- name: Copy Varnish Zabbix SELinux module + ansible.builtin.copy: + src: zabbix/selinux.te + dest: /usr/local/share/zabbix/zabbix_varnish.te + owner: root + group: root + mode: '0644' + register: selinux_zabbix_file + tags: + - selinux + - varnish + - zabbix_agent + +- name: Compile and install SELinux module + ansible.builtin.include_tasks: "{{ tasks_path }}/compile-selinux.yml" + vars: + selinux_module_dir: /usr/local/share/zabbix + selinux_module_name: zabbix_varnish + when: selinux_zabbix_file.changed # noqa: no-handler + tags: + - selinux + - varnish + - zabbix_agent + +# The agent needs to be in the varnish group to read the directory holding the stats +- name: Add zabbix to varnish group + ansible.builtin.user: + name: zabbix + groups: varnish + append: yes + notify: + - Restart zabbix agent + tags: + - varnish + - zabbix_agent + +- name: Install Zabbix agent config drop-in + ansible.builtin.copy: + src: zabbix/agent.conf + dest: /etc/zabbix/zabbix_agentd.d/varnish.conf + mode: '0644' + owner: zabbix + group: zabbix + notify: + - Restart zabbix agent + tags: + - varnish + - zabbix_agent + +- name: Zabbix API Block + vars: + ansible_zabbix_auth_key: "{{ zabbix_auth_key }}" + ansible_network_os: "{{ zabbix_network_os }}" + ansible_connection: "{{ zabbix_connection }}" + ansible_httpapi_port: "{{ zabbix_httpapi_port }}" + ansible_httpapi_use_ssl: "{{ zabbix_httpapi_use_ssl }}" + ansible_httpapi_validate_certs: "{{ zabbix_httpapi_validate_certs }}" + ansible_host: "{{ zabbix_server }}" + ansible_zabbix_url_path: "{{ zabbix_url_path }}" + tags: + - zabbix_api + - zabbix_agent + block: + - name: Import Varnish Zabbix template file + community.zabbix.zabbix_template: + template_yaml: "{{ lookup('file', 'zabbix/template.yml') }}" + state: present + run_once: true + + - name: Ensure Varnish Zabbix hostgroup is present + community.zabbix.zabbix_group: + host_groups: + - Varnish Servers + state: present + run_once: true + + - name: Add self to Varnish in Zabbix + community.zabbix.zabbix_host: + host_name: "{{ inventory_hostname }}" + host_groups: Varnish Servers + link_templates: Varnish Cache Monitoring + force: false From 85b34d77e8d807feef0e37e0ed15f2108c6d3649 Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Thu, 30 Apr 2026 12:49:14 +0100 Subject: [PATCH 070/151] Zabbix: add missing Varnish tag to Zabbix task Signed-off-by: Greg Sutcliffe --- roles/varnish/tasks/monitoring.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/roles/varnish/tasks/monitoring.yml b/roles/varnish/tasks/monitoring.yml index 3762efc26a..4f8f12bbce 100644 --- a/roles/varnish/tasks/monitoring.yml +++ b/roles/varnish/tasks/monitoring.yml @@ -77,6 +77,7 @@ tags: - zabbix_api - zabbix_agent + - varnish block: - name: Import Varnish Zabbix template file community.zabbix.zabbix_template: From 9f4fc542e46e949ee61b62cc4441ce5c9b5b4fa7 Mon Sep 17 00:00:00 2001 From: Pedro Moura Date: Mon, 23 Feb 2026 21:08:59 -0300 Subject: [PATCH 071/151] add poddlers deployment Signed-off-by: Pedro Moura --- .../poddlers/templates/deployment.yml.j2 | 51 +++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 roles/openshift-apps/poddlers/templates/deployment.yml.j2 diff --git a/roles/openshift-apps/poddlers/templates/deployment.yml.j2 b/roles/openshift-apps/poddlers/templates/deployment.yml.j2 new file mode 100644 index 0000000000..2e28ce1586 --- /dev/null +++ b/roles/openshift-apps/poddlers/templates/deployment.yml.j2 @@ -0,0 +1,51 @@ +{% from "_macros.yml.j2" import common_volume_mounts, common_volumes, common_env %} +{% for toddler in poddlers_toddlers %} +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ toddler.name }} + labels: + app: poddlers +spec: + replicas: {{ toddler.replicas|default(1) }} + selector: + matchLabels: + app: poddlers + deployment: {{ toddler.name }} + strategy: + type: Recreate + template: + metadata: + labels: + app: poddlers + deployment: {{ toddler.name }} + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"toddlers:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"toddlers\")].image"}]' + spec: + containers: + - name: toddlers + image: toddlers:latest + env: + - name: FEDORA_MESSAGING_CONF + value: /etc/fedora-messaging/{{ toddler.name }}.toml + {% if toddler.name == "cleaning-packager-groups" -%} + - name: KRB5_CLIENT_KTNAME + value: /etc/sync-group-keytabs/sync-group.keytab + {% endif -%} + {{ common_env() }} + volumeMounts: + {{ common_volume_mounts() }} + {% if toddler.name == "cleaning-packager-groups" -%} + - name: sync-group-keytab-volume + mountPath: /etc/sync-group-keytabs + readOnly: true + {% endif %} + volumes: + {{ common_volumes() }} + {% if toddler.name == "cleaning-packager-groups" -%} + - name: sync-group-keytab-volume + secret: + secretName: sync-group-keytab + {% endif %} +{% endfor %} From 0adc18a9b8644c8c994e195cb7eb5db1357732ca Mon Sep 17 00:00:00 2001 From: Pedro Moura Date: Mon, 16 Mar 2026 18:20:37 -0300 Subject: [PATCH 072/151] replaced deployment file in playbook and fixed image path Signed-off-by: Pedro Moura --- playbooks/openshift-apps/poddlers.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/playbooks/openshift-apps/poddlers.yml b/playbooks/openshift-apps/poddlers.yml index 932571b5fe..c6101cdd6b 100644 --- a/playbooks/openshift-apps/poddlers.yml +++ b/playbooks/openshift-apps/poddlers.yml @@ -104,8 +104,8 @@ - role: openshift/object object_app: poddlers - object_template: deploymentconfig.yml.j2 - object_objectname: deploymentconfig.yml + object_template: deployment.yml.j2 + object_objectname: deployment.yml - role: openshift/object object_app: poddlers From 2163e36fcc38fa25f00dc079728363a7753702e7 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Thu, 30 Apr 2026 11:07:26 -0700 Subject: [PATCH 073/151] poddlers: try and set temp-volume to emptydir explicitly Signed-off-by: Kevin Fenzi --- roles/openshift-apps/poddlers/templates/_macros.yml.j2 | 1 + 1 file changed, 1 insertion(+) diff --git a/roles/openshift-apps/poddlers/templates/_macros.yml.j2 b/roles/openshift-apps/poddlers/templates/_macros.yml.j2 index 2a77769c2b..26d06ba1a5 100644 --- a/roles/openshift-apps/poddlers/templates/_macros.yml.j2 +++ b/roles/openshift-apps/poddlers/templates/_macros.yml.j2 @@ -42,6 +42,7 @@ secret: secretName: keytab - name: temp-volume + emptyDir: {} {% endmacro %} From 64045f79bf62fb8229fc337a7548886045632126 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Thu, 30 Apr 2026 11:16:02 -0700 Subject: [PATCH 074/151] poddlers: try and not pass {} in the block Signed-off-by: Kevin Fenzi --- roles/openshift-apps/poddlers/templates/_macros.yml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/poddlers/templates/_macros.yml.j2 b/roles/openshift-apps/poddlers/templates/_macros.yml.j2 index 26d06ba1a5..34f6ee9102 100644 --- a/roles/openshift-apps/poddlers/templates/_macros.yml.j2 +++ b/roles/openshift-apps/poddlers/templates/_macros.yml.j2 @@ -42,7 +42,7 @@ secret: secretName: keytab - name: temp-volume - emptyDir: {} + emptyDir: {% endmacro %} From c4a4634f496d54b78196676f75afa158e325a006 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Thu, 30 Apr 2026 11:20:27 -0700 Subject: [PATCH 075/151] poddlers: add blank line in volumes for spacing and drop whitespace cleanup in cleaning-packager-groups toddlers Signed-off-by: Kevin Fenzi --- roles/openshift-apps/poddlers/templates/_macros.yml.j2 | 3 ++- roles/openshift-apps/poddlers/templates/deployment.yml.j2 | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/roles/openshift-apps/poddlers/templates/_macros.yml.j2 b/roles/openshift-apps/poddlers/templates/_macros.yml.j2 index 34f6ee9102..54767f684b 100644 --- a/roles/openshift-apps/poddlers/templates/_macros.yml.j2 +++ b/roles/openshift-apps/poddlers/templates/_macros.yml.j2 @@ -42,7 +42,8 @@ secret: secretName: keytab - name: temp-volume - emptyDir: + emptyDir: {} + {% endmacro %} diff --git a/roles/openshift-apps/poddlers/templates/deployment.yml.j2 b/roles/openshift-apps/poddlers/templates/deployment.yml.j2 index 2e28ce1586..864043ee29 100644 --- a/roles/openshift-apps/poddlers/templates/deployment.yml.j2 +++ b/roles/openshift-apps/poddlers/templates/deployment.yml.j2 @@ -43,7 +43,7 @@ spec: {% endif %} volumes: {{ common_volumes() }} - {% if toddler.name == "cleaning-packager-groups" -%} + {% if toddler.name == "cleaning-packager-groups" %} - name: sync-group-keytab-volume secret: secretName: sync-group-keytab From f6d0fec7f29e0a29e64cd0ee1c39d314d8fe5a2f Mon Sep 17 00:00:00 2001 From: Jiri Kyjovsky Date: Thu, 30 Apr 2026 20:22:14 +0200 Subject: [PATCH 076/151] copr: bring back s390x --- inventory/group_vars/copr_aws | 18 +++++++++--------- inventory/group_vars/copr_dev_aws | 16 ++++++++-------- .../backend/templates/resalloc/pools.yaml.j2 | 7 +------ 3 files changed, 18 insertions(+), 23 deletions(-) diff --git a/inventory/group_vars/copr_aws b/inventory/group_vars/copr_aws index 674dacaea8..389acc452e 100644 --- a/inventory/group_vars/copr_aws +++ b/inventory/group_vars/copr_aws @@ -62,36 +62,36 @@ builders: s390x: [2, 1, 0] ibm_cloud_br_sao_1: - s390x: [3, 1, 1] + s390x: [5, 5, 1] ibm_cloud_br_sao_2: - s390x: [3, 1, 1] + s390x: [5, 5, 1] ibm_cloud_br_sao_3: - s390x: [3, 1, 1] + s390x: [5, 5, 1] ibm_cloud_eu_es_1: - s390x: [3, 1, 1] + s390x: [5, 5, 1] ibm_cloud_eu_es_2: - s390x: [3, 1, 1] + s390x: [5, 5, 1] ibm_cloud_eu_es_3: - s390x: [3, 1, 1] + s390x: [5, 5, 1] cloud_instance_types: ibm_cloud: - s390x: mz2-2x16 + s390x: bz2-2x8 s390x_hp: bz2-16x64 ibm_cloud_regions: eu_es: name: eu-es name_humans: Madrid, Spain - ssh_key: r050-cbd10ece-a28f-45c8-bc3a-15ecb9ff66d5 + ssh_key: r050-4e396a17-294c-4197-9c56-e126185025a1 vpc: r050-190b8bac-3bae-47cf-9be7-ac70fc54ccb9 security_group: r050-cfc3db07-8cde-4807-9756-db91b242092a images: "{{ copr_builder_images.ibm_cloud.eu_es }}" br_sao: name: br-sao name_humans: Sao Paulo, Brazil - ssh_key: r042-4fb65a23-e7bd-440f-8d71-ff57b83a4152 + ssh_key: r042-b30ff308-ef4f-43bf-bdd6-e16f1cc614cd vpc: r042-c902f12d-556f-4334-95cb-d181ebb3d8ba security_group: r042-22ef3881-fa20-4caa-9873-c8dc41c5dcb7 images: "{{ copr_builder_images.ibm_cloud.br_sao }}" diff --git a/inventory/group_vars/copr_dev_aws b/inventory/group_vars/copr_dev_aws index 697c9d88a1..ae0e6961e2 100644 --- a/inventory/group_vars/copr_dev_aws +++ b/inventory/group_vars/copr_dev_aws @@ -64,34 +64,34 @@ builders: ibm_cloud_br_sao_1: s390x: [1, 1, 0] ibm_cloud_br_sao_2: - s390x: [1, 1, 0] + s390x: [0, 0, 0] ibm_cloud_br_sao_3: - s390x: [1, 1, 0] + s390x: [0, 0, 0] ibm_cloud_eu_es_1: - s390x: [1, 1, 0] + s390x: [0, 0, 0] ibm_cloud_eu_es_2: - s390x: [1, 1, 0] + s390x: [0, 0, 0] ibm_cloud_eu_es_3: - s390x: [1, 1, 0] + s390x: [0, 0, 0] cloud_instance_types: ibm_cloud: - s390x: mz2-2x16 + s390x: bz2-2x8 s390x_hp: bz2-16x64 ibm_cloud_regions: eu_es: name: eu-es name_humans: Madrid, Spain - ssh_key: r050-cbd10ece-a28f-45c8-bc3a-15ecb9ff66d5 + ssh_key: r050-ea3b598c-39ca-4963-b8ef-c9d6ac146fad vpc: r050-190b8bac-3bae-47cf-9be7-ac70fc54ccb9 security_group: r050-cfc3db07-8cde-4807-9756-db91b242092a images: "{{ copr_builder_images.ibm_cloud.eu_es }}" br_sao: name: br-sao name_humans: Sao Paulo, Brazil - ssh_key: r042-4fb65a23-e7bd-440f-8d71-ff57b83a4152 + ssh_key: r042-3ec7f0e1-3eb3-4f55-a922-915c85da09c2 vpc: r042-c902f12d-556f-4334-95cb-d181ebb3d8ba security_group: r042-22ef3881-fa20-4caa-9873-c8dc41c5dcb7 images: "{{ copr_builder_images.ibm_cloud.br_sao }}" diff --git a/roles/copr/backend/templates/resalloc/pools.yaml.j2 b/roles/copr/backend/templates/resalloc/pools.yaml.j2 index e770a6ed42..15021320b6 100644 --- a/roles/copr/backend/templates/resalloc/pools.yaml.j2 +++ b/roles/copr/backend/templates/resalloc/pools.yaml.j2 @@ -61,8 +61,6 @@ aws_{{ arch }}_{{ on_demand + '_' if on_demand is not none else '' }}{% if spot - arch_armhfp_emulated - arch_riscv64 - arch_riscv64_emulated - - arch_s390x - - arch_s390x_emulated {% else %} - arch_aarch64 - arch_aarch64_native @@ -227,8 +225,6 @@ vmhost_x86_{{ hv }}_{% if devel %}dev{% else %}prod{% endif %}: - arch_armhfp_emulated - arch_riscv64 - arch_riscv64_emulated - - arch_s390x - - arch_s390x_emulated - hypervisor - hypervisor_x86_64 - hypervisor_x86_64_{{ hv }} @@ -384,7 +380,7 @@ copr_ic_s390x_hp_us_east_{% if devel %}dev{% else %}prod{% endif %}: description: > A pool of high-performance s390x instances in the IBM Cloud, Washington, D.C. (us-east). Thanks to IBM for sponsoring these builders. - +#} {% for zone in ['br_sao_1', 'br_sao_2', 'br_sao_3', 'eu_es_1', 'eu_es_2', 'eu_es_3'] %} copr_ic_s390x_{{ zone }}_{% if devel %}dev{% else %}prod{% endif %}: @@ -439,7 +435,6 @@ copr_ic_s390x_{{ zone }}_{% if devel %}dev{% else %}prod{% endif %}: Thanks to IBM for sponsoring these builders. {% endfor %} -#} # Power9 builders in OSU osuosl {{ osuosl_p09_p10() }} From cc5d2576755ab7ef6c9b51d6207002cd34eb4dbb Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Thu, 30 Apr 2026 11:42:40 -0700 Subject: [PATCH 077/151] poddlers: some more template/macro whitespace fixes Signed-off-by: Kevin Fenzi --- roles/openshift-apps/poddlers/templates/deployment.yml.j2 | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/roles/openshift-apps/poddlers/templates/deployment.yml.j2 b/roles/openshift-apps/poddlers/templates/deployment.yml.j2 index 864043ee29..4ae0ad4664 100644 --- a/roles/openshift-apps/poddlers/templates/deployment.yml.j2 +++ b/roles/openshift-apps/poddlers/templates/deployment.yml.j2 @@ -36,16 +36,16 @@ spec: {{ common_env() }} volumeMounts: {{ common_volume_mounts() }} - {% if toddler.name == "cleaning-packager-groups" -%} + {%- if toddler.name == "cleaning-packager-groups" %} - name: sync-group-keytab-volume mountPath: /etc/sync-group-keytabs readOnly: true - {% endif %} + {%- endif %} volumes: {{ common_volumes() }} - {% if toddler.name == "cleaning-packager-groups" %} + {%- if toddler.name == "cleaning-packager-groups" %} - name: sync-group-keytab-volume secret: secretName: sync-group-keytab - {% endif %} + {%- endif %} {% endfor %} From 321968f756c5c523809e284d80fa25ea293012db Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Thu, 30 Apr 2026 12:07:37 -0700 Subject: [PATCH 078/151] poddlers: ok, try this for template expansion Signed-off-by: Kevin Fenzi --- roles/openshift-apps/poddlers/templates/deployment.yml.j2 | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/roles/openshift-apps/poddlers/templates/deployment.yml.j2 b/roles/openshift-apps/poddlers/templates/deployment.yml.j2 index 4ae0ad4664..3fa197a66a 100644 --- a/roles/openshift-apps/poddlers/templates/deployment.yml.j2 +++ b/roles/openshift-apps/poddlers/templates/deployment.yml.j2 @@ -36,16 +36,16 @@ spec: {{ common_env() }} volumeMounts: {{ common_volume_mounts() }} - {%- if toddler.name == "cleaning-packager-groups" %} +{% if toddler.name == "cleaning-packager-groups" %} - name: sync-group-keytab-volume mountPath: /etc/sync-group-keytabs readOnly: true - {%- endif %} +{% endif %} volumes: {{ common_volumes() }} - {%- if toddler.name == "cleaning-packager-groups" %} +{% if toddler.name == "cleaning-packager-groups" %} - name: sync-group-keytab-volume secret: secretName: sync-group-keytab - {%- endif %} +{% endif %} {% endfor %} From 402b7e4b92c4f30d014ef7efd8b51cf694ac99c4 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Thu, 30 Apr 2026 12:20:22 -0700 Subject: [PATCH 079/151] poddlers: adjust image path Signed-off-by: Kevin Fenzi --- roles/openshift-apps/poddlers/templates/deployment.yml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/poddlers/templates/deployment.yml.j2 b/roles/openshift-apps/poddlers/templates/deployment.yml.j2 index 3fa197a66a..b399a3f539 100644 --- a/roles/openshift-apps/poddlers/templates/deployment.yml.j2 +++ b/roles/openshift-apps/poddlers/templates/deployment.yml.j2 @@ -25,7 +25,7 @@ spec: spec: containers: - name: toddlers - image: toddlers:latest + image: image-registry.openshift-image-registry.svc:5000/poddlers/toddlers:latest env: - name: FEDORA_MESSAGING_CONF value: /etc/fedora-messaging/{{ toddler.name }}.toml From 9b08868901fa2f15659966253ce96a37807b6da1 Mon Sep 17 00:00:00 2001 From: Jiri Kyjovsky Date: Thu, 30 Apr 2026 21:21:13 +0200 Subject: [PATCH 080/151] copr: remove comment about emulated s390x --- roles/copr/frontend/files/chroots.conf | 4 ---- 1 file changed, 4 deletions(-) diff --git a/roles/copr/frontend/files/chroots.conf b/roles/copr/frontend/files/chroots.conf index 0d29d04919..ca7ffaafe2 100644 --- a/roles/copr/frontend/files/chroots.conf +++ b/roles/copr/frontend/files/chroots.conf @@ -19,8 +19,4 @@ config["rules"] = [{ "match_type": "arch", "match": ["riscv64"], "comment": "An emulated chroot. Builds are done on x86_64 using QEMU.", -}, { - "match_type": "arch", - "match": ["s390x"], - "comment": "An emulated chroot. Builds are done on x86_64 using QEMU.", }] From 262735fbd4ce76a17f8f3da25c2c5c45630316d2 Mon Sep 17 00:00:00 2001 From: Jiri Kyjovsky Date: Thu, 30 Apr 2026 21:41:02 +0200 Subject: [PATCH 081/151] copr: remove comment about emulated s390x, but empty --- roles/copr/frontend/files/chroots.conf | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/roles/copr/frontend/files/chroots.conf b/roles/copr/frontend/files/chroots.conf index ca7ffaafe2..a8364041d4 100644 --- a/roles/copr/frontend/files/chroots.conf +++ b/roles/copr/frontend/files/chroots.conf @@ -19,4 +19,8 @@ config["rules"] = [{ "match_type": "arch", "match": ["riscv64"], "comment": "An emulated chroot. Builds are done on x86_64 using QEMU.", +}, { + "match_type": "arch", + "match": ["s390x"], + "comment": "", }] From 2dd39340ea6966440713dc6f533cc8ff76c5ee87 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Thu, 30 Apr 2026 12:25:07 -0700 Subject: [PATCH 082/151] people robots.txt: disallow all of cgit There's a flood ATM. Dunno if the flood respects robots.txt, but if it does this might help? Signed-off-by: Adam Williamson --- roles/people/files/robots.txt | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/roles/people/files/robots.txt b/roles/people/files/robots.txt index 45c26312ca..8e7f594a0e 100644 --- a/roles/people/files/robots.txt +++ b/roles/people/files/robots.txt @@ -1,4 +1,2 @@ User-agent: * -Disallow: /cgit/*.tar.xz -Disallow: /cgit/*.tar.gz -Disallow: /cgit/*.zip +Disallow: /cgit From ec9984fcec463b994dd7022e059b65ccfb0afb92 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Thu, 30 Apr 2026 12:40:28 -0700 Subject: [PATCH 083/151] people: add anubis el container to fedorapeople Scrapers are hitting git projects really hard, so lets put this behind anubis as well. Signed-off-by: Kevin Fenzi --- playbooks/groups/people.yml | 4 ++++ roles/people/templates/people.conf | 32 ++++++++++++++++++++++++++++++ 2 files changed, 36 insertions(+) diff --git a/playbooks/groups/people.yml b/playbooks/groups/people.yml index 994138fb8d..c22376d88b 100644 --- a/playbooks/groups/people.yml +++ b/playbooks/groups/people.yml @@ -79,6 +79,10 @@ - role: apache + - role: anubis-el + tags: + - anubis + - role: httpd/certificate certname: wildcard-2025.fedorapeople.org SSLCertificateChainFile: wildcard-2025.fedorapeople.org.intermediate.cert diff --git a/roles/people/templates/people.conf b/roles/people/templates/people.conf index 809735b5f7..459e8c37aa 100644 --- a/roles/people/templates/people.conf +++ b/roles/people/templates/people.conf @@ -43,6 +43,38 @@ NameVirtualHost *:80 ErrorLog logs/fedorapeople.org-error.log CustomLog logs/fedorapeople.org-access.log vcombined + # proxy all requests to anubis after ssl termination + + RequestHeader set "X-Real-Ip" expr=%{REMOTE_ADDR} + RequestHeader set X-Forwarded-Proto "https" + RequestHeader set "X-Http-Version" "%{SERVER_PROTOCOL}s" + # Pagure uses X-Scheme, not X-Forwarded-Proto, see pagure/proxy.py + RequestHeader set X-Scheme "https" + + ProxyPreserveHost On + + ProxyRequests Off + ProxyVia Off + + ProxyPass / http://[::1]:8923/ + ProxyPassReverse / http://[::1]:8923/ + + + SetHandler server-status + + Require ip 127.0.0.1 + Require ip ::1 + Require host localhost + + + + + +# Once anubis has processed the request it sends it to port 3923 + +Listen 3923 http + + ExpiresActive On ExpiresDefault "access plus 30 minutes" From 6bd6eb63655c40a8e395c0b06ade422b2e9bb0fc Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Thu, 30 Apr 2026 14:26:08 -0700 Subject: [PATCH 084/151] people: add directives to log real remote ip in logs Signed-off-by: Kevin Fenzi --- roles/people/templates/people.conf | 3 +++ 1 file changed, 3 insertions(+) diff --git a/roles/people/templates/people.conf b/roles/people/templates/people.conf index 459e8c37aa..1013189365 100644 --- a/roles/people/templates/people.conf +++ b/roles/people/templates/people.conf @@ -75,6 +75,9 @@ NameVirtualHost *:80 Listen 3923 http + RemoteIPHeader X-Real-Ip + RemoteIPInternalProxy ::1 + ExpiresActive On ExpiresDefault "access plus 30 minutes" From a2f297a82b0413f290106cd599844ce115cb264a Mon Sep 17 00:00:00 2001 From: Pedro Moura Date: Mon, 23 Feb 2026 21:12:23 -0300 Subject: [PATCH 085/151] add webhook2fedmsg deployment Signed-off-by: Pedro Moura --- .../templates/deployment.yml.j2 | 99 +++++++++++++++++++ 1 file changed, 99 insertions(+) create mode 100644 roles/openshift-apps/webhook2fedmsg/templates/deployment.yml.j2 diff --git a/roles/openshift-apps/webhook2fedmsg/templates/deployment.yml.j2 b/roles/openshift-apps/webhook2fedmsg/templates/deployment.yml.j2 new file mode 100644 index 0000000000..1980ca085e --- /dev/null +++ b/roles/openshift-apps/webhook2fedmsg/templates/deployment.yml.j2 @@ -0,0 +1,99 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: webhook2fedmsg + service: webhook2fedmsg + name: app +spec: + replicas: 1 + selector: + matchLabels: + app: webhook2fedmsg + service: webhook2fedmsg + strategy: + type: Recreate + template: + metadata: + labels: + app: webhook2fedmsg + service: webhook2fedmsg + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"webhook2fedmsg:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"app\")].image"}]' + spec: + initContainers: + - name: setup + image: webhook2fedmsg:latest + command: ["/opt/app-root/bin/w2fm", "setup"] + volumeMounts: + - name: config + mountPath: "/etc/webhook-to-fedora-messaging" + readOnly: true + - name: ipa-config-volume + mountPath: /etc/ipa + readOnly: true + - name: keytab-volume + mountPath: /etc/keytabs + readOnly: true + - name: fedora-messaging-config + mountPath: "/etc/fedora-messaging" + readOnly: true + containers: + - name: app + image: webhook2fedmsg:latest + env: + - name: KRB5_CONFIG + value: /etc/ipa/krb5.conf + - name: KRB5_CLIENT_KTNAME + value: /etc/keytabs/service.keytab + ports: + - containerPort: 8080 + protocol: TCP + volumeMounts: + - name: config + mountPath: "/etc/webhook-to-fedora-messaging" + readOnly: true + - name: ipa-config-volume + mountPath: /etc/ipa + readOnly: true + - name: keytab-volume + mountPath: /etc/keytabs + readOnly: true + - name: fedora-messaging-config + mountPath: "/etc/fedora-messaging" + readOnly: true + - name: fedora-messaging-ca + mountPath: /etc/pki/fedora-messaging/cacert.pem + subPath: cacert.pem + readOnly: true + - name: fedora-messaging-crt + mountPath: /etc/pki/fedora-messaging/webhook2fedmsg-cert.pem + subPath: webhook2fedmsg-cert.pem + readOnly: true + - name: fedora-messaging-key + mountPath: /etc/pki/fedora-messaging/webhook2fedmsg-key.pem + subPath: webhook2fedmsg-key.pem + readOnly: true + volumes: + - name: config + configMap: + name: config + - name: ipa-config-volume + configMap: + name: ipa-client-config + - name: keytab-volume + secret: + secretName: keytab + - name: fedora-messaging-config + configMap: + name: fedora-messaging-config + - name: fedora-messaging-ca + secret: + secretName: fedora-messaging-ca + - name: fedora-messaging-crt + secret: + secretName: fedora-messaging-crt + - name: fedora-messaging-key + secret: + secretName: fedora-messaging-key From df68ebe1fadb5c4238d5e67dae0fbd792db66732 Mon Sep 17 00:00:00 2001 From: Pedro Moura Date: Mon, 16 Mar 2026 18:20:39 -0300 Subject: [PATCH 086/151] replaced deployment file in playbook and fixed image path Signed-off-by: Pedro Moura --- playbooks/openshift-apps/webhook2fedmsg.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/playbooks/openshift-apps/webhook2fedmsg.yml b/playbooks/openshift-apps/webhook2fedmsg.yml index 2313af0539..448b9908bd 100644 --- a/playbooks/openshift-apps/webhook2fedmsg.yml +++ b/playbooks/openshift-apps/webhook2fedmsg.yml @@ -110,8 +110,8 @@ # Deployment config - role: openshift/object object_app: webhook2fedmsg - object_template: deploymentconfig.yml.j2 - object_objectname: deploymentconfig.yml + object_template: deployment.yml.j2 + object_objectname: deployment.yml # - role: openshift/start-build # start_build_app: webhook2fedmsg From a41083cf70947cb10389cb52f40fdf6636a585ad Mon Sep 17 00:00:00 2001 From: Pedro Moura Date: Thu, 26 Mar 2026 20:17:47 -0300 Subject: [PATCH 087/151] webhook2fedmsg: use correct name of app in image stream Signed-off-by: Pedro Moura --- .../openshift-apps/webhook2fedmsg/templates/deployment.yml.j2 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/openshift-apps/webhook2fedmsg/templates/deployment.yml.j2 b/roles/openshift-apps/webhook2fedmsg/templates/deployment.yml.j2 index 1980ca085e..ec7341211a 100644 --- a/roles/openshift-apps/webhook2fedmsg/templates/deployment.yml.j2 +++ b/roles/openshift-apps/webhook2fedmsg/templates/deployment.yml.j2 @@ -24,7 +24,7 @@ spec: spec: initContainers: - name: setup - image: webhook2fedmsg:latest + image: image-registry.openshift-image-registry.svc:5000/webhook2fedmsg/webhook2fedmsg:latest command: ["/opt/app-root/bin/w2fm", "setup"] volumeMounts: - name: config @@ -41,7 +41,7 @@ spec: readOnly: true containers: - name: app - image: webhook2fedmsg:latest + image: image-registry.openshift-image-registry.svc:5000/webhook2fedmsg/webhook2fedmsg:latest env: - name: KRB5_CONFIG value: /etc/ipa/krb5.conf From d985fb7631f6baf5f59be3c05f69824f82ed5c53 Mon Sep 17 00:00:00 2001 From: Pedro Moura Date: Tue, 31 Mar 2026 20:23:58 -0300 Subject: [PATCH 088/151] Removed deploymentconfig files from ocp apps Signed-off-by: Pedro Moura --- .../templates/deploymentconfig.yml.j2 | 54 ---- .../easyfix/templates/deploymentconfig.yml.j2 | 75 ------ .../templates/deploymentconfig.yml.j2 | 232 ------------------ .../mdapi/templates/deploymentconfig.yml.j2 | 57 ----- .../templates/deploymentconfig.yml.j2 | 73 ------ .../noggin/templates/deploymentconfig.yml.j2 | 131 ---------- .../templates/deploymentconfig.yml.j2 | 61 ----- .../templates/deploymentconfig.yml.j2 | 122 --------- .../transtats/files/deploymentconfig.yml | 79 ------ .../templates/deploymentconfig.yml.j2 | 112 --------- .../zezere/templates/deploymentconfig.yml.j2 | 89 ------- 11 files changed, 1085 deletions(-) delete mode 100644 roles/openshift-apps/compose-tracker/templates/deploymentconfig.yml.j2 delete mode 100644 roles/openshift-apps/easyfix/templates/deploymentconfig.yml.j2 delete mode 100644 roles/openshift-apps/flatpak-indexer/templates/deploymentconfig.yml.j2 delete mode 100644 roles/openshift-apps/mdapi/templates/deploymentconfig.yml.j2 delete mode 100644 roles/openshift-apps/mirrormanager/templates/deploymentconfig.yml.j2 delete mode 100644 roles/openshift-apps/noggin/templates/deploymentconfig.yml.j2 delete mode 100644 roles/openshift-apps/poddlers/templates/deploymentconfig.yml.j2 delete mode 100644 roles/openshift-apps/the-new-hotness/templates/deploymentconfig.yml.j2 delete mode 100644 roles/openshift-apps/transtats/files/deploymentconfig.yml delete mode 100644 roles/openshift-apps/webhook2fedmsg/templates/deploymentconfig.yml.j2 delete mode 100644 roles/openshift-apps/zezere/templates/deploymentconfig.yml.j2 diff --git a/roles/openshift-apps/compose-tracker/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/compose-tracker/templates/deploymentconfig.yml.j2 deleted file mode 100644 index 5229929411..0000000000 --- a/roles/openshift-apps/compose-tracker/templates/deploymentconfig.yml.j2 +++ /dev/null @@ -1,54 +0,0 @@ ---- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig -metadata: - labels: - app: compose-tracker - name: compose-tracker -spec: - replicas: 1 - selector: - app: compose-tracker - strategy: - resources: {} - template: - metadata: - labels: - app: compose-tracker - name: compose-tracker - spec: - containers: - - envFrom: - - secretRef: - name: compose-tracker-forgejo-token - env: - - name: FORGEJO_NAMESPACE - value: "releng" - - name: FORGEJO_REPO - value: "compose-tracker-issues" - - name: FORGEJO_DOMAIN -{% if env == "staging" %} - value: "https://forge.stg.fedoraproject.org/" -{% else %} - value: "https://forge.fedoraproject.org/" -{% endif %} - # sleep infinity is useful for debugging environment issues - # comment out when not debugging -# args: ['infinity'] -# command: ['/usr/bin/sleep'] - image: "" - imagePullPolicy: IfNotPresent - name: compose-tracker - resources: {} - restartPolicy: Always - test: false - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - compose-tracker - from: - kind: ImageStreamTag - name: compose-tracker-img:latest diff --git a/roles/openshift-apps/easyfix/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/easyfix/templates/deploymentconfig.yml.j2 deleted file mode 100644 index ab06ac87fa..0000000000 --- a/roles/openshift-apps/easyfix/templates/deploymentconfig.yml.j2 +++ /dev/null @@ -1,75 +0,0 @@ ---- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig -metadata: - name: web - labels: - app: easyfix -spec: - replicas: 1 - selector: - app: easyfix - deploymentconfig: web - strategy: - type: Rolling - activeDeadlineSeconds: 21600 - rollingParams: - intervalSeconds: 1 - maxSurge: 25% - maxUnavailable: 25% - timeoutSeconds: 600 - updatePeriodSeconds: 1 - template: - metadata: - creationTimestamp: null - labels: - app: easyfix - deploymentconfig: web - spec: - containers: - - name: easyfix - imagePullPolicy: Always - ports: - - containerPort: 8080 - volumeMounts: - - name: httpdir-volume - mountPath: /httpdir - - name: data - mountPath: /srv - - name: config - mountPath: "/etc/easyfix" - readOnly: true - env: - - name: APP_SCRIPT - value: ".s2i/run-httpd.sh" - readinessProbe: - timeoutSeconds: 1 - initialDelaySeconds: 5 - httpGet: - path: / - port: 8080 - livenessProbe: - timeoutSeconds: 1 - initialDelaySeconds: 20 - httpGet: - path: / - port: 8080 - volumes: - - name: httpdir-volume - emptyDir: {} - - name: config - configMap: - name: config - - name: data - persistentVolumeClaim: - claimName: data - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - easyfix - from: - kind: ImageStreamTag - name: easyfix:latest diff --git a/roles/openshift-apps/flatpak-indexer/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/flatpak-indexer/templates/deploymentconfig.yml.j2 deleted file mode 100644 index 4372bd3e11..0000000000 --- a/roles/openshift-apps/flatpak-indexer/templates/deploymentconfig.yml.j2 +++ /dev/null @@ -1,232 +0,0 @@ ---- -kind: DeploymentConfig -apiVersion: apps.openshift.io/v1 -metadata: - labels: - app: flatpak-indexer - name: flatpak-indexer -spec: - replicas: 1 - selector: - app: flatpak-indexer - deploymentconfig: flatpak-indexer - strategy: - activeDeadlineSeconds: 21600 - resources: {} - rollingParams: - intervalSeconds: 1 - maxSurge: 25% - maxUnavailable: 25% - timeoutSeconds: 600 - updatePeriodSeconds: 1 - type: Rolling - template: - metadata: - labels: - app: flatpak-indexer - deploymentconfig: flatpak-indexer - spec: - containers: - - env: - - name: OUTPUT_DIR - value: /var/www/flatpaks - - name: REDIS_PASSWORD - valueFrom: - secretKeyRef: - name: redis-password - key: password - - name: REDIS_URL - value: redis://redis.flatpak-indexer.svc.cluster.local:6379 - image: flatpak-indexer:latest - name: flatpak-indexer - ports: - - containerPort: 8080 - protocol: TCP - resources: {} - volumeMounts: - - mountPath: /etc/flatpak-indexer - name: indexer-config-volume - readOnly: true - - mountPath: /etc/koji.conf - name: koji-conf-volume - readOnly: true - - mountPath: /var/www/flatpaks - name: index-output-volume - dnsPolicy: ClusterFirst - restartPolicy: Always - volumes: - - configMap: - defaultMode: 420 - name: indexer-config - name: indexer-config-volume - - configMap: - defaultMode: 420 - name: koji-conf - name: koji-conf-volume - - name: index-output-volume - persistentVolumeClaim: - claimName: flatpak-indexer-storage{{ '-stg' if env == 'staging' else '' }} - test: false - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - flatpak-indexer - from: - kind: ImageStreamTag - name: flatpak-indexer:latest ---- -kind: DeploymentConfig -apiVersion: apps.openshift.io/v1 -metadata: - labels: - app: flatpak-indexer-differ - name: flatpak-indexer-differ -spec: - replicas: 1 - revisionHistoryLimit: 10 - selector: - app: flatpak-indexer-differ - deploymentconfig: flatpak-indexer-differ - strategy: - activeDeadlineSeconds: 21600 - resources: {} - rollingParams: - intervalSeconds: 1 - maxSurge: 25% - maxUnavailable: 25% - timeoutSeconds: 600 - updatePeriodSeconds: 1 - type: Rolling - template: - metadata: - labels: - app: flatpak-indexer-differ - deploymentconfig: flatpak-indexer-differ - spec: - containers: - - env: - - name: OUTPUT_DIR - value: /var/www/flatpaks - - name: FLATPAK_INDEXER_COMMAND - value: differ - - name: REDIS_PASSWORD - valueFrom: - secretKeyRef: - name: redis-password - key: password - - name: REDIS_URL - value: redis://redis.flatpak-indexer.svc.cluster.local:6379 - image: flatpak-indexer:latest - name: flatpak-indexer-differ - ports: - - containerPort: 8080 - protocol: TCP - resources: - requests: - cpu: 2 - memory: 1Gi - limits: - cpu: 2 - memory: 8Gi - volumeMounts: - - mountPath: /etc/flatpak-indexer - name: indexer-config-volume - readOnly: true - - mountPath: /var/www/flatpaks - name: index-output-volume - dnsPolicy: ClusterFirst - restartPolicy: Always - volumes: - - configMap: - defaultMode: 420 - name: indexer-config - name: indexer-config-volume - - name: index-output-volume - persistentVolumeClaim: - claimName: flatpak-indexer-storage{{ '-stg' if env == 'staging' else '' }} - test: false - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - flatpak-indexer-differ - from: - kind: ImageStreamTag - name: flatpak-indexer:latest ---- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig -metadata: - labels: - app: redis - name: redis -spec: - replicas: 1 - revisionHistoryLimit: 10 - selector: - app: redis - deploymentconfig: redis - strategy: - activeDeadlineSeconds: 21600 - # Recreate so that the old pod is stopped before the new pod is created. - # Could also use a StatefulSet - type: Recreate - template: - metadata: - labels: - app: redis - deploymentconfig: redis - spec: - containers: - - env: - - name: REDIS_PASSWORD - valueFrom: - secretKeyRef: - name: redis-password - key: password - image: redis:latest - livenessProbe: - exec: - command: ['valkey-cli', '-a', '$REDIS_PASSWORD', 'ping'] - failureThreshold: 3 - initialDelaySeconds: 15 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 5 - name: redis - ports: - - containerPort: 6379 - protocol: TCP - readinessProbe: - exec: - command: ['valkey-cli', '-a', '$REDIS_PASSWORD', 'ping'] - failureThreshold: 3 - periodSeconds: 60 - successThreshold: 1 - timeoutSeconds: 1 - resources: {} - volumeMounts: - - mountPath: /data - name: redis-data-volume - dnsPolicy: ClusterFirst - restartPolicy: Always - volumes: - - name: redis-data-volume - persistentVolumeClaim: - claimName: flatpak-indexer-redis-storage{{ '-stg' if env == 'staging' else '' }} - test: false - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - redis - from: - kind: ImageStreamTag - name: redis:latest diff --git a/roles/openshift-apps/mdapi/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/mdapi/templates/deploymentconfig.yml.j2 deleted file mode 100644 index 58c37eea99..0000000000 --- a/roles/openshift-apps/mdapi/templates/deploymentconfig.yml.j2 +++ /dev/null @@ -1,57 +0,0 @@ ---- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig -metadata: - name: mdapi - labels: - app: mdapi - service: mdapi -spec: - replicas: 1 - selector: - app: mdapi - service: mdapi - template: - metadata: - labels: - app: mdapi - service: mdapi - spec: - containers: - - name: mdapi - image: registry/mdapi:latest - command: ["/metasource/meta"] - args: ["-location", "/var/tmp", "-loglevel", "info", "dispense", "-hostname", "mdapi{{ env_suffix }}.fedoraproject.org"] - ports: - - containerPort: 8080 - volumeMounts: - - name: data-volume - mountPath: /var/tmp/ - readinessProbe: - timeoutSeconds: 5 - initialDelaySeconds: 60 - periodSeconds: 60 - httpGet: - path: / - port: 8080 - livenessProbe: - timeoutSeconds: 15 - initialDelaySeconds: 60 - periodSeconds: 60 - httpGet: - path: / - port: 8080 - resources: - volumes: - - name: data-volume - persistentVolumeClaim: - claimName: mdapi-storage - triggers: - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - "mdapi" - from: - kind: ImageStreamTag - name: mdapi:latest diff --git a/roles/openshift-apps/mirrormanager/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/mirrormanager/templates/deploymentconfig.yml.j2 deleted file mode 100644 index c395520633..0000000000 --- a/roles/openshift-apps/mirrormanager/templates/deploymentconfig.yml.j2 +++ /dev/null @@ -1,73 +0,0 @@ -{% from "_macros.yml.j2" import common_volume_mounts, common_volumes, common_env, security_context with context %} ---- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig -metadata: - name: frontend - labels: - app: mirrormanager -spec: - replicas: 1 - selector: - app: mirrormanager - deploymentconfig: frontend - strategy: - type: Rolling - activeDeadlineSeconds: 21600 - rollingParams: - intervalSeconds: 1 - maxSurge: 25% - maxUnavailable: 25% - timeoutSeconds: 600 - updatePeriodSeconds: 1 - template: - metadata: - creationTimestamp: null - labels: - app: mirrormanager - deploymentconfig: frontend - spec: - containers: - - name: mirrormanager - imagePullPolicy: Always - ports: - - containerPort: 8080 - env: - - name: APP_MODULE - value: "deploy.wsgi" - - name: APP_CONFIG - value: "/etc/mirrormanager/gunicorn.conf.py" - {{ common_env() }} - - # readinessProbe: - # timeoutSeconds: 10 - # initialDelaySeconds: 5 - # periodSeconds: 60 - # httpGet: - # path: "/healthz/ready" - # port: 8080 - # livenessProbe: - # timeoutSeconds: 10 - # initialDelaySeconds: 10 - # periodSeconds: 60 - # httpGet: - # path: "/healthz/live" - # port: 8080 - - volumeMounts: - {{ common_volume_mounts() }} - - volumes: - {{ common_volumes() }} - {{ security_context() }} - - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - mirrormanager - from: - kind: ImageStreamTag - name: mirrormanager2:latest diff --git a/roles/openshift-apps/noggin/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/noggin/templates/deploymentconfig.yml.j2 deleted file mode 100644 index 6d956d4479..0000000000 --- a/roles/openshift-apps/noggin/templates/deploymentconfig.yml.j2 +++ /dev/null @@ -1,131 +0,0 @@ ---- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig -metadata: - name: noggin - labels: - app: {{ object_app }} -spec: - replicas: 1 - selector: - app: {{ object_app }} - deploymentconfig: noggin - strategy: - type: Rolling - activeDeadlineSeconds: 21600 - rollingParams: - intervalSeconds: 1 - maxSurge: 25% - maxUnavailable: 25% - timeoutSeconds: 600 - updatePeriodSeconds: 1 - template: - metadata: - creationTimestamp: null - labels: - app: {{ object_app }} - deploymentconfig: noggin - spec: - containers: - - name: noggin - imagePullPolicy: Always - ports: - - containerPort: 8080 - # protocol: TCP - # resources: {} - # terminationMessagePath: /dev/termination-log - # terminationMessagePolicy: File - volumeMounts: - - name: noggin-config-volume - mountPath: "/etc/noggin" - readOnly: true - - name: noggin-templates-volume - mountPath: "/etc/noggin-templates" - readOnly: true - - name: noggin-secrets-volume - mountPath: "/etc/noggin-secrets" - readOnly: true - - name: wsgi-script-volume - mountPath: "/opt/app-root/src/deploy" - readOnly: true - - name: fedora-messaging-config-volume - mountPath: "/etc/fedora-messaging" - readOnly: true - - name: fedora-messaging-ca-volume - mountPath: /etc/pki/fedora-messaging/cacert.pem - subPath: cacert.pem - readOnly: true - - name: fedora-messaging-crt-volume - mountPath: /etc/pki/fedora-messaging/noggin-cert.pem - subPath: noggin-cert.pem - readOnly: true - - name: fedora-messaging-key-volume - mountPath: /etc/pki/fedora-messaging/noggin-key.pem - subPath: noggin-key.pem - readOnly: true - - name: ipa-config-volume - mountPath: "/etc/ipa" - readOnly: true - env: - - name: NOGGIN_CONFIG_PATH - value: "/etc/noggin/noggin.cfg" - - name: APP_MODULE - value: "deploy.wsgi" - - name: APP_CONFIG - value: "/etc/noggin/gunicorn.conf.py" -{% if subdir is defined %} - - name: SCRIPT_NAME - value: "{{ subdir }}" -{% endif %} - readinessProbe: - timeoutSeconds: 10 - initialDelaySeconds: 5 - periodSeconds: 60 - httpGet: - path: "{{ subdir|default('') }}/healthz/ready" - port: 8080 - livenessProbe: - timeoutSeconds: 10 - initialDelaySeconds: 10 - periodSeconds: 60 - httpGet: - path: "{{ subdir|default('') }}/healthz/live" - port: 8080 - volumes: - - name: noggin-config-volume - configMap: - name: noggin-config - - name: noggin-templates-volume - configMap: - name: noggin-templates - - name: noggin-secrets-volume - secret: - secretName: noggin-secrets - - name: wsgi-script-volume - configMap: - name: wsgi-script - - name: fedora-messaging-config-volume - configMap: - name: fedora-messaging-config - - name: fedora-messaging-ca-volume - secret: - secretName: fedora-messaging-ca - - name: fedora-messaging-crt-volume - secret: - secretName: fedora-messaging-crt - - name: fedora-messaging-key-volume - secret: - secretName: fedora-messaging-key - - name: ipa-config-volume - configMap: - name: ipa-client-config - triggers: - - imageChangeParams: - automatic: true - containerNames: - - noggin - from: - kind: ImageStreamTag - name: noggin:latest - type: ImageChange - - type: ConfigChange diff --git a/roles/openshift-apps/poddlers/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/poddlers/templates/deploymentconfig.yml.j2 deleted file mode 100644 index f4786464b0..0000000000 --- a/roles/openshift-apps/poddlers/templates/deploymentconfig.yml.j2 +++ /dev/null @@ -1,61 +0,0 @@ -{% from "_macros.yml.j2" import common_volume_mounts, common_volumes, common_env %} -{% for toddler in poddlers_toddlers %} ---- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig -metadata: - name: {{ toddler.name }} - labels: - app: poddlers -spec: - replicas: {{ toddler.replicas|default(1) }} - selector: - app: poddlers - deploymentconfig: {{ toddler.name }} - strategy: - type: Recreate - template: - metadata: - labels: - app: poddlers - deploymentconfig: {{ toddler.name }} - spec: - containers: - - name: toddlers - image: toddlers:latest - env: - - name: FEDORA_MESSAGING_CONF - value: /etc/fedora-messaging/{{ toddler.name }}.toml - {% if toddler.name == "cleaning-packager-groups" -%} - - name: KRB5_CLIENT_KTNAME - value: /etc/sync-group-keytabs/sync-group.keytab - {% endif -%} - {{ common_env() }} - - volumeMounts: - {{ common_volume_mounts() }} - {% if toddler.name == "cleaning-packager-groups" -%} - - name: sync-group-keytab-volume - mountPath: /etc/sync-group-keytabs - readOnly: true - {% endif %} - - volumes: - {{ common_volumes() }} - {% if toddler.name == "cleaning-packager-groups" -%} - - name: sync-group-keytab-volume - secret: - secretName: sync-group-keytab - {% endif %} - - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - toddlers - from: - kind: ImageStreamTag - name: toddlers:latest -{% endfor %} diff --git a/roles/openshift-apps/the-new-hotness/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/the-new-hotness/templates/deploymentconfig.yml.j2 deleted file mode 100644 index 4b8e321555..0000000000 --- a/roles/openshift-apps/the-new-hotness/templates/deploymentconfig.yml.j2 +++ /dev/null @@ -1,122 +0,0 @@ ---- -apiVersion: apps.openshift.io/v1 -items: -- apiVersion: apps.openshift.io/v1 - kind: DeploymentConfig - metadata: - labels: - app: the-new-hotness - service: the-new-hotness - name: the-new-hotness - spec: - replicas: 1 - selector: - deploymentconfig: the-new-hotness - strategy: - activeDeadlineSeconds: 21600 - recreateParams: - timeoutSeconds: 600 - type: Recreate - template: - metadata: - creationTimestamp: null - labels: - app: the-new-hotness - deploymentconfig: the-new-hotness - spec: - containers: - - name: the-new-hotness - image: the-new-hotness/the-new-hotness:latest - command: ["fedora-messaging", "consume"] - env: - - name: RPM_PACKAGER - value: hotness - volumeMounts: - - name: keytab-volume - mountPath: /etc/keytabs - readOnly: true - - name: config-volume - mountPath: /etc/fedora-messaging - readOnly: true - - name: fedora-messaging-ca-volume - mountPath: /etc/pki/rabbitmq/ca - readOnly: true - - name: fedora-messaging-key-volume - mountPath: /etc/pki/rabbitmq/key - readOnly: true - - name: fedora-messaging-cert-volume - mountPath: /etc/pki/rabbitmq/cert - readOnly: true - - name: temp-volume - mountPath: /var/tmp - - name: krb-config-volume - mountPath: /etc/krb5 - readOnly: true - volumes: - - name: config-volume - configMap: - name: the-new-hotness-configmap - - name: fedora-messaging-ca-volume - secret: - secretName: the-new-hotness-fedora-messaging-ca - - name: fedora-messaging-key-volume - secret: - secretName: the-new-hotness-fedora-messaging-key - - name: fedora-messaging-cert-volume - secret: - secretName: the-new-hotness-fedora-messaging-cert - - name: temp-volume - - name: keytab-volume - secret: - secretName: the-new-hotness-keytab - - name: krb-config-volume - configMap: - name: krb5-configmap - triggers: - - imageChangeParams: - automatic: true - containerNames: - - the-new-hotness - from: - kind: ImageStreamTag - name: the-new-hotness:latest - namespace: the-new-hotness - type: ImageChange - - type: ConfigChange -- apiVersion: apps.openshift.io/v1 - kind: DeploymentConfig - metadata: - labels: - app: the-new-hotness - service: the-new-hotness-redis - name: the-new-hotness-redis - spec: - replicas: 1 # Never change this to more or less than ONE! - selector: - app: the-new-hotness - deploymentconfig: the-new-hotness-redis - template: - metadata: - labels: - app: the-new-hotness - deploymentconfig: the-new-hotness-redis - spec: - containers: - - name: the-new-hotness-redis - image: the-new-hotness-redis:latest - resources: {} - env: - - name: REDIS_PASSWORD - value: "{{ hotness_redis_pass }}" - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - the-new-hotness-redis - from: - kind: ImageStreamTag - name: the-new-hotness-redis:latest -kind: List -metadata: {} diff --git a/roles/openshift-apps/transtats/files/deploymentconfig.yml b/roles/openshift-apps/transtats/files/deploymentconfig.yml deleted file mode 100644 index 7acdbd4413..0000000000 --- a/roles/openshift-apps/transtats/files/deploymentconfig.yml +++ /dev/null @@ -1,79 +0,0 @@ ---- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig -metadata: - name: transtats-web - labels: - app: transtats - service: web -spec: - replicas: 2 - selector: - app: transtats - service: web - template: - metadata: - labels: - app: transtats - service: web - spec: - containers: - - name: web - image: transtats - ports: - - containerPort: 8080 - env: - - name: GUNICORN_CMD_ARGS - value: "--workers 3 --bind 0.0.0.0:8080 --timeout 500" - - name: DATABASE_ENGINE - value: postgresql - - name: DATABASE_NAME - valueFrom: - secretKeyRef: - name: transtats-secret - key: database-name - - name: DATABASE_HOST - valueFrom: - secretKeyRef: - name: transtats-secret - key: database-host - - name: DATABASE_USER - valueFrom: - secretKeyRef: - name: transtats-secret - key: database-user - - name: DATABASE_PASSWORD - valueFrom: - secretKeyRef: - name: transtats-secret - key: database-password - readinessProbe: - timeoutSeconds: 1 - initialDelaySeconds: 5 - httpGet: - path: /health - port: 8080 - livenessProbe: - timeoutSeconds: 1 - initialDelaySeconds: 30 - httpGet: - path: /health - port: 8080 - # TODO: re-evaluate these limits once we know how much memory is actually needed - resources: - requests: - cpu: 500m - memory: 1024Mi - limits: - cpu: 2000m - memory: 2048Mi - triggers: - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - web - from: - kind: ImageStreamTag - name: transtats:latest - - type: ConfigChange diff --git a/roles/openshift-apps/webhook2fedmsg/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/webhook2fedmsg/templates/deploymentconfig.yml.j2 deleted file mode 100644 index 7d4a14277b..0000000000 --- a/roles/openshift-apps/webhook2fedmsg/templates/deploymentconfig.yml.j2 +++ /dev/null @@ -1,112 +0,0 @@ ---- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig -metadata: - labels: - app: webhook2fedmsg - service: webhook2fedmsg - name: app -spec: - replicas: 1 - selector: - app: webhook2fedmsg - deploymentconfig: app - strategy: - type: Recreate - recreateParams: - mid: - execNewPod: - command: [/opt/app-root/bin/w2fm, setup] - containerName: app - volumes: - - config - failurePolicy: Abort - template: - metadata: - labels: - app: webhook2fedmsg - deploymentconfig: app - spec: - containers: - - image: webhook2fedmsg:latest - name: app - env: - - name: KRB5_CONFIG - value: /etc/ipa/krb5.conf - - name: KRB5_CLIENT_KTNAME - value: /etc/keytabs/service.keytab - ports: - - containerPort: 8080 - protocol: TCP - volumeMounts: - - name: config - mountPath: "/etc/webhook-to-fedora-messaging" - readOnly: true - - name: ipa-config-volume - mountPath: /etc/ipa - readOnly: true - - name: keytab-volume - mountPath: /etc/keytabs - readOnly: true - - name: fedora-messaging-config - mountPath: "/etc/fedora-messaging" - readOnly: true - - name: fedora-messaging-ca - mountPath: /etc/pki/fedora-messaging/cacert.pem - subPath: cacert.pem - readOnly: true - - name: fedora-messaging-crt - mountPath: /etc/pki/fedora-messaging/webhook2fedmsg-cert.pem - subPath: webhook2fedmsg-cert.pem - readOnly: true - - name: fedora-messaging-key - mountPath: /etc/pki/fedora-messaging/webhook2fedmsg-key.pem - subPath: webhook2fedmsg-key.pem - readOnly: true - # readinessProbe: - # timeoutSeconds: 10 - # initialDelaySeconds: 5 - # periodSeconds: 60 - # httpGet: - # path: "/api/v1/healthz/ready" - # port: 8080 - # livenessProbe: - # timeoutSeconds: 10 - # initialDelaySeconds: 3 - # periodSeconds: 60 - # httpGet: - # path: "/api/v1/healthz/live" - # port: 8080 - volumes: - - name: config - configMap: - name: config - - name: ipa-config-volume - configMap: - name: ipa-client-config - - name: keytab-volume - secret: - secretName: keytab - - name: fedora-messaging-config - configMap: - name: fedora-messaging-config - - name: fedora-messaging-ca - secret: - secretName: fedora-messaging-ca - - name: fedora-messaging-crt - secret: - secretName: fedora-messaging-crt - - name: fedora-messaging-key - secret: - secretName: fedora-messaging-key - - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - app - from: - kind: ImageStreamTag - name: webhook2fedmsg:latest diff --git a/roles/openshift-apps/zezere/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/zezere/templates/deploymentconfig.yml.j2 deleted file mode 100644 index 420e2c7853..0000000000 --- a/roles/openshift-apps/zezere/templates/deploymentconfig.yml.j2 +++ /dev/null @@ -1,89 +0,0 @@ ---- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig -metadata: - labels: - app: zezere - service: zezere - name: zezere -spec: - replicas: 1 - selector: - deploymentconfig: zezere - strategy: - activeDeadlineSeconds: 21600 - recreateParams: - timeoutSeconds: 600 - template: - metadata: - labels: - app: zezere - deploymentconfig: zezere - spec: - containers: - - name: zezere - image: image-registry.openshift-image-registry.svc:5000/zezere/zezere:latest - env: - - name: ALLOWED_HOSTS - value: "*" - - name: WEB_CONCURRENCY - value: "8" - - name: SECRET_KEY - valueFrom: - secretKeyRef: - name: zezere - key: secret_key - - name: DEBUG - value: "no" - - name: AUTH_METHOD - value: "oidc" - - name: OIDC_OP_AUTHORIZATION_ENDPOINT - value: "https://id{{ env_suffix }}.fedoraproject.org/openidc/Authorization" - - name: OIDC_OP_TOKEN_ENDPOINT - value: "https://id{{ env_suffix }}.fedoraproject.org/openidc/Token" - - name: OIDC_OP_USER_ENDPOINT - value: "https://id{{ env_suffix }}.fedoraproject.org/openidc/UserInfo" - - name: OIDC_OP_JWKS_ENDPOINT - value: "https://id{{ env_suffix }}.fedoraproject.org/openidc/Jwks" - - name: OIDC_RP_CLIENT_ID - value: "provisionfpo" - - name: OIDC_RP_CLIENT_SECRET - valueFrom: - secretKeyRef: - name: zezere - key: oidc_client_secret - - name: OIDC_RP_SIGN_ALGO - value: "RS256" - - name: SECURE_PROXY_SSL_HEADER_NAME - value: "HTTP_X_FORWARDED_PROTO" - - name: SECURE_PROXY_SSL_HEADER_VALUE - value: "https" - - name: DATABASE_engine - value: "django.db.backends.postgresql_psycopg2" - - name: DATABASE_host - value: "db01{{ env_suffix }}.{{datacenter}}.fedoraproject.org" - - name: DATABASE_name - value: "zezere" - - name: DATABASE_user - value: "zezere" - - name: DATABASE_password - valueFrom: - secretKeyRef: - name: zezere - key: database_password - ports: - - containerPort: 8080 - readinessProbe: - timeoutSeconds: 1 - initialDelaySeconds: 5 - httpGet: - path: /netboot - port: 8080 - livenessProbe: - timeoutSeconds: 1 - initialDelaySeconds: 30 - httpGet: - path: /netboot - port: 8080 - triggers: - - type: ConfigChange From 4c112ac0febdf3edbf4cb285b5e78154f114b5f2 Mon Sep 17 00:00:00 2001 From: Pedro Moura Date: Fri, 10 Apr 2026 18:50:16 -0300 Subject: [PATCH 089/151] Removed playbooks of deleted ocp apps Signed-off-by: Pedro Moura --- playbooks/openshift-apps/easyfix.yml | 71 -------------------------- playbooks/openshift-apps/transtats.yml | 56 -------------------- playbooks/openshift-apps/zezere.yml | 56 -------------------- 3 files changed, 183 deletions(-) delete mode 100644 playbooks/openshift-apps/easyfix.yml delete mode 100644 playbooks/openshift-apps/transtats.yml delete mode 100644 playbooks/openshift-apps/zezere.yml diff --git a/playbooks/openshift-apps/easyfix.yml b/playbooks/openshift-apps/easyfix.yml deleted file mode 100644 index 7bfcbc31a8..0000000000 --- a/playbooks/openshift-apps/easyfix.yml +++ /dev/null @@ -1,71 +0,0 @@ -# -# Fedora Project easyfixes -# ---- -- name: Make the app be real - # hosts: os_control_stg:os_control - hosts: os_control_stg - user: root - gather_facts: false - - vars_files: - - /srv/web/infra/ansible/vars/global.yml - - /srv/private/ansible/vars.yml - - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml - - vars: - - roles: - - role: openshift/project - project_app: easyfix - project_description: "Easyfixes" - project_appowners: - - abompard - tags: - - apply-appowners - - - role: openshift/object - object_app: easyfix - object_file: imagestream.yml - object_objectname: imagestream.yml - - - role: openshift/object - object_app: easyfix - object_template: buildconfig.yml.j2 - object_objectname: buildconfig.yml - - - role: openshift/object - object_app: easyfix - object_file: storage.yml - object_objectname: storage.yml - - - role: openshift/object - object_app: easyfix - object_template: configmap.yml.j2 - object_objectname: configmap.yml - - - role: openshift/object - object_app: easyfix - object_file: service.yml - object_objectname: service.yml - - # Routes - - role: openshift/route - route_app: easyfix - route_name: web - route_host: "easyfix.apps.ocp{{ env_suffix }}.fedoraproject.org" - route_servicename: web - route_serviceport: web - route_annotations: - haproxy.router.openshift.io/timeout: 5m - - - role: openshift/object - object_app: easyfix - object_template: deploymentconfig.yml.j2 - object_objectname: deploymentconfig.yml - - # Cron jobs - - role: openshift/object - object_app: easyfix - object_template: cron.yml.j2 - object_objectname: cron.yml diff --git a/playbooks/openshift-apps/transtats.yml b/playbooks/openshift-apps/transtats.yml deleted file mode 100644 index d6213dcaa3..0000000000 --- a/playbooks/openshift-apps/transtats.yml +++ /dev/null @@ -1,56 +0,0 @@ ---- -- name: Make the app be real - hosts: os_control[0]:os_control_stg[0] - user: root - gather_facts: false - - vars_files: - - /srv/web/infra/ansible/vars/global.yml - - "/srv/private/ansible/vars.yml" - - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml - - roles: - - role: openshift/project - project_app: transtats - project_description: transtats - project_appowners: - - suanand - - role: openshift/object - object_app: transtats - object_objectname: secret.yml - object_template: secret.yml.j2 - - role: openshift/imagestream - imagestream_app: transtats - imagestream_imagename: transtats - - role: openshift/object - object_app: transtats - object_template: buildconfig.yml.j2 - object_objectname: buildconfig.yml - - role: openshift/start-build - start_build_app: transtats - start_build_buildname: transtats-build - tags: - - never - - build - - role: openshift/object - object_app: transtats - object_file: service.yml - object_objectname: service.yml - - role: openshift/route - route_app: transtats - route_name: transtats-web - route_host: transtats{{ env_suffix }}.fedoraproject.org - route_serviceport: web - route_servicename: transtats-web - route_annotations: - haproxy.router.openshift.io/timeout: 8m - - role: openshift/object - object_app: transtats - object_file: deploymentconfig.yml - object_objectname: deploymentconfig.yml - - role: openshift/rollout - rollout_app: transtats - rollout_dcname: transtats-web - tags: - - never - - rollout diff --git a/playbooks/openshift-apps/zezere.yml b/playbooks/openshift-apps/zezere.yml deleted file mode 100644 index 6b46c6131e..0000000000 --- a/playbooks/openshift-apps/zezere.yml +++ /dev/null @@ -1,56 +0,0 @@ ---- -- name: Make the app be real - hosts: os_control[0]:os_control_stg[0] - user: root - gather_facts: false - - vars_files: - - /srv/web/infra/ansible/vars/global.yml - - "/srv/private/ansible/vars.yml" - - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml - - roles: - - role: openshift/project - project_app: zezere - project_description: Zezere provisioning service - project_appowners: - - pbrobinson - - role: openshift/imagestream - imagestream_app: zezere - imagestream_imagename: zezere - - role: openshift/object - object_app: zezere - object_objectname: buildconfig.yml - object_file: buildconfig.yml - - role: openshift/start-build - start_build_app: zezere - start_build_buildname: zezere-build - tags: - - never - - build - - role: openshift/object - object_app: zezere - object_file: service.yml - object_objectname: service.yml - - role: openshift/route - route_app: zezere - route_name: zezere - route_host: "provision{{ env_suffix }}.fedoraproject.org" - route_servicename: zezere - route_serviceport: 8080 - route_annotations: - haproxy.router.openshift.io/set-forwarded-headers: append - - role: openshift/object - object_app: zezere - object_template: secret.yml.j2 - object_objectname: secret.yml - - role: openshift/object - object_app: zezere - object_template: deploymentconfig.yml.j2 - object_objectname: deploymentconfig.yml - - role: openshift/rollout - rollout_app: zezere - rollout_dcname: zezere - tags: - - never - - rollout From 55fe803f4d5b4269ae6b86084aa88c17bdd2c1f5 Mon Sep 17 00:00:00 2001 From: Pedro Moura Date: Tue, 10 Feb 2026 17:38:44 -0300 Subject: [PATCH 090/151] add flatpak-indexer deployment Signed-off-by: Pedro Moura --- .../templates/deployment.yml.j2 | 178 ++++++++++++++++++ 1 file changed, 178 insertions(+) create mode 100644 roles/openshift-apps/flatpak-indexer/templates/deployment.yml.j2 diff --git a/roles/openshift-apps/flatpak-indexer/templates/deployment.yml.j2 b/roles/openshift-apps/flatpak-indexer/templates/deployment.yml.j2 new file mode 100644 index 0000000000..f2fe0e2053 --- /dev/null +++ b/roles/openshift-apps/flatpak-indexer/templates/deployment.yml.j2 @@ -0,0 +1,178 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: flatpak-indexer + name: flatpak-indexer +spec: + replicas: 1 + selector: + matchLabels: + app: flatpak-indexer + strategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 25% + maxUnavailable: 25% + template: + metadata: + labels: + app: flatpak-indexer + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"flatpak-indexer:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"flatpak-indexer\")].image"}]' + spec: + containers: + - name: flatpak-indexer + image: flatpak-indexer:latest + env: + - name: OUTPUT_DIR + value: /var/www/flatpaks + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: redis-password + key: password + - name: REDIS_URL + value: redis://redis.flatpak-indexer.svc.cluster.local:6379 + ports: + - containerPort: 8080 + protocol: TCP + volumeMounts: + - mountPath: /etc/flatpak-indexer + name: indexer-config-volume + readOnly: true + - mountPath: /etc/koji.conf + name: koji-conf-volume + readOnly: true + - mountPath: /var/www/flatpaks + name: index-output-volume + volumes: + - name: indexer-config-volume + configMap: + name: indexer-config + - name: koji-conf-volume + configMap: + name: koji-conf + - name: index-output-volume + persistentVolumeClaim: + claimName: flatpak-indexer-storage{{ '-stg' if env == 'staging' else '' }} +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: flatpak-indexer-differ + name: flatpak-indexer-differ +spec: + replicas: 1 + revisionHistoryLimit: 10 + selector: + matchLabels: + app: flatpak-indexer-differ + strategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 25% + maxUnavailable: 25% + template: + metadata: + labels: + app: flatpak-indexer-differ + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"flatpak-indexer:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"flatpak-indexer-differ\")].image"}]' + spec: + containers: + - name: flatpak-indexer-differ + image: flatpak-indexer:latest + env: + - name: OUTPUT_DIR + value: /var/www/flatpaks + - name: FLATPAK_INDEXER_COMMAND + value: differ + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: redis-password + key: password + - name: REDIS_URL + value: redis://redis.flatpak-indexer.svc.cluster.local:6379 + ports: + - containerPort: 8080 + protocol: TCP + resources: + requests: + cpu: 2 + memory: 1Gi + limits: + cpu: 2 + memory: 8Gi + volumeMounts: + - mountPath: /etc/flatpak-indexer + name: indexer-config-volume + readOnly: true + - mountPath: /var/www/flatpaks + name: index-output-volume + volumes: + - name: indexer-config-volume + configMap: + name: indexer-config + - name: index-output-volume + persistentVolumeClaim: + claimName: flatpak-indexer-storage{{ '-stg' if env == 'staging' else '' }} +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: redis + name: redis +spec: + replicas: 1 + revisionHistoryLimit: 10 + selector: + matchLabels: + app: redis + strategy: + type: Recreate + template: + metadata: + labels: + app: redis + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"redis:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"redis\")].image"}]' + spec: + containers: + - name: redis + image: redis:latest + env: + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: redis-password + key: password + ports: + - containerPort: 6379 + protocol: TCP + livenessProbe: + exec: + command: ['valkey-cli', '-a', '$REDIS_PASSWORD', 'ping'] + failureThreshold: 3 + initialDelaySeconds: 15 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 5 + readinessProbe: + exec: + command: ['valkey-cli', '-a', '$REDIS_PASSWORD', 'ping'] + failureThreshold: 3 + periodSeconds: 60 + successThreshold: 1 + timeoutSeconds: 1 + volumeMounts: + - mountPath: /data + name: redis-data-volume + volumes: + - name: redis-data-volume + persistentVolumeClaim: + claimName: flatpak-indexer-redis-storage{{ '-stg' if env == 'staging' else '' }} From a66483229fb44291453575ae92467eac12b0b466 Mon Sep 17 00:00:00 2001 From: Pedro Moura Date: Mon, 16 Mar 2026 18:20:21 -0300 Subject: [PATCH 091/151] replaced deployment file in playbook and fixed image path Signed-off-by: Pedro Moura --- playbooks/openshift-apps/flatpak-indexer.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/playbooks/openshift-apps/flatpak-indexer.yml b/playbooks/openshift-apps/flatpak-indexer.yml index 7a61fd982e..6b1dd8e1cc 100644 --- a/playbooks/openshift-apps/flatpak-indexer.yml +++ b/playbooks/openshift-apps/flatpak-indexer.yml @@ -60,5 +60,5 @@ - role: openshift/object object_app: flatpak-indexer - object_template: deploymentconfig.yml.j2 - object_objectname: deploymentconfig.yml + object_template: deployment.yml.j2 + object_objectname: deployment.yml From da98985e995ca05a49e2596e71ee01323ce02e51 Mon Sep 17 00:00:00 2001 From: Pedro Moura Date: Thu, 26 Mar 2026 20:17:25 -0300 Subject: [PATCH 092/151] flatpak-indexer: use correct name of app in image stream Signed-off-by: Pedro Moura --- .../flatpak-indexer/templates/deployment.yml.j2 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/openshift-apps/flatpak-indexer/templates/deployment.yml.j2 b/roles/openshift-apps/flatpak-indexer/templates/deployment.yml.j2 index f2fe0e2053..737f6dfedc 100644 --- a/roles/openshift-apps/flatpak-indexer/templates/deployment.yml.j2 +++ b/roles/openshift-apps/flatpak-indexer/templates/deployment.yml.j2 @@ -24,7 +24,7 @@ spec: spec: containers: - name: flatpak-indexer - image: flatpak-indexer:latest + image: image-registry.openshift-image-registry.svc:5000/flatpak-indexer/flatpak-indexer:latest env: - name: OUTPUT_DIR value: /var/www/flatpaks @@ -84,7 +84,7 @@ spec: spec: containers: - name: flatpak-indexer-differ - image: flatpak-indexer:latest + image: image-registry.openshift-image-registry.svc:5000/flatpak-indexer/flatpak-indexer:latest env: - name: OUTPUT_DIR value: /var/www/flatpaks From 6fec16e4f7aff5677722dcd53b2cb8eba6e3dff7 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Thu, 30 Apr 2026 14:51:37 -0700 Subject: [PATCH 093/151] flatpak-indexer: fix selector for new deployment Signed-off-by: Kevin Fenzi --- roles/openshift-apps/flatpak-indexer/files/service.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/roles/openshift-apps/flatpak-indexer/files/service.yml b/roles/openshift-apps/flatpak-indexer/files/service.yml index 8408b6dd10..2cc70f9259 100644 --- a/roles/openshift-apps/flatpak-indexer/files/service.yml +++ b/roles/openshift-apps/flatpak-indexer/files/service.yml @@ -13,4 +13,3 @@ spec: targetPort: 6379 selector: app: redis - deploymentconfig: redis From 4a51089c2e1d0faa07dfdb745f9ae83cb0f8841c Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Thu, 30 Apr 2026 15:31:43 -0700 Subject: [PATCH 094/151] flatpak-indexer: specify image more closely Signed-off-by: Kevin Fenzi --- .../openshift-apps/flatpak-indexer/templates/deployment.yml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/flatpak-indexer/templates/deployment.yml.j2 b/roles/openshift-apps/flatpak-indexer/templates/deployment.yml.j2 index 737f6dfedc..4bbbc78f37 100644 --- a/roles/openshift-apps/flatpak-indexer/templates/deployment.yml.j2 +++ b/roles/openshift-apps/flatpak-indexer/templates/deployment.yml.j2 @@ -144,7 +144,7 @@ spec: spec: containers: - name: redis - image: redis:latest + image: image-registry.openshift-image-registry.svc:5000/flatpak-indexer/redis:latest env: - name: REDIS_PASSWORD valueFrom: From 03114092f47560d7d5489def6ac0cd9044a9861b Mon Sep 17 00:00:00 2001 From: James Antill Date: Tue, 17 Jun 2025 15:26:04 -0400 Subject: [PATCH 095/151] proxies / provisioning: redirect https pages to /iot/ Signed-off-by: James Antill --- playbooks/include/proxies-redirects.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/playbooks/include/proxies-redirects.yml b/playbooks/include/proxies-redirects.yml index e3d7dfc65b..35d3277502 100644 --- a/playbooks/include/proxies-redirects.yml +++ b/playbooks/include/proxies-redirects.yml @@ -1018,3 +1018,10 @@ target: https://communityhealth.languages-in-floss.eu tags: - languages + + - role: httpd/redirectmatch + shortname: provisioning-server + website: provisioning.fedoraproject.org + target: https://fedoraproject.org/iot/ + tags: + - provisioning From b1fca1e0894e7f0572171b564fe9c35fa2acd7ab Mon Sep 17 00:00:00 2001 From: David Kirwan Date: Fri, 1 May 2026 10:42:51 +0100 Subject: [PATCH 096/151] communishift: Update email notification with summary Signed-off-by: David Kirwan --- .../communishift_send_email_notifications.yml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/playbooks/manual/communishift_send_email_notifications.yml b/playbooks/manual/communishift_send_email_notifications.yml index 551bd9ff7c..eb5dfac3fb 100644 --- a/playbooks/manual/communishift_send_email_notifications.yml +++ b/playbooks/manual/communishift_send_email_notifications.yml @@ -31,3 +31,21 @@ tags: - communishift_send_notifications loop: "{{ lookup('dict', communishift_projects) }}" + + - name: Summary of Communishift projects notified # noqa: run-once[task] + ansible.builtin.debug: + msg: | + {% set ns = namespace(names=[]) %} + {% for item in communishift_projects | dict2items | sort(attribute='value.name') %} + {% if not (item.value.do_not_delete | default(false)) %} + {% set _ = ns.names.append(item.value.name) %} + {% endif %} + {% endfor %} + Communishift notification run complete. Emails were sent for {{ ns.names | length }} project(s): + + {% for name in ns.names %} + - {{ name }} + {% endfor %} + run_once: true + tags: + - communishift_send_notifications From 7522b50a64faad33a2c4c9cd90b1b9746288595a Mon Sep 17 00:00:00 2001 From: David Kirwan Date: Fri, 1 May 2026 13:37:37 +0100 Subject: [PATCH 097/151] communishift: Print human readable list of projects once notification emails sent Signed-off-by: David Kirwan --- .../communishift_send_email_notifications.yml | 13 +------------ 1 file changed, 1 insertion(+), 12 deletions(-) diff --git a/playbooks/manual/communishift_send_email_notifications.yml b/playbooks/manual/communishift_send_email_notifications.yml index eb5dfac3fb..078c6bb028 100644 --- a/playbooks/manual/communishift_send_email_notifications.yml +++ b/playbooks/manual/communishift_send_email_notifications.yml @@ -34,18 +34,7 @@ - name: Summary of Communishift projects notified # noqa: run-once[task] ansible.builtin.debug: - msg: | - {% set ns = namespace(names=[]) %} - {% for item in communishift_projects | dict2items | sort(attribute='value.name') %} - {% if not (item.value.do_not_delete | default(false)) %} - {% set _ = ns.names.append(item.value.name) %} - {% endif %} - {% endfor %} - Communishift notification run complete. Emails were sent for {{ ns.names | length }} project(s): - - {% for name in ns.names %} - - {{ name }} - {% endfor %} + msg: "{%- set ns = namespace(names=[]) %}{%- for item in communishift_projects | dict2items | sort(attribute='value.name') %}{%- if not (item.value.do_not_delete | default(false)) %}{%- set _ = ns.names.append(item.value.name) %}{%- endif %}{%- endfor %} Communishift notification run complete. Emails were sent for {{ ns.names | length }} project(s): {{ ns.names | join(' ') }}" run_once: true tags: - communishift_send_notifications From 9f158138400064a35bcf39d677728931d9b5f127 Mon Sep 17 00:00:00 2001 From: David Kirwan Date: Fri, 1 May 2026 13:48:50 +0100 Subject: [PATCH 098/151] communishift: add ability to dry run notification sender Signed-off-by: David Kirwan --- .../communishift_send_email_notifications.yml | 5 ++++- ...eanup-administration-send-notifications.yml | 18 +++++++++++++++++- 2 files changed, 21 insertions(+), 2 deletions(-) diff --git a/playbooks/manual/communishift_send_email_notifications.yml b/playbooks/manual/communishift_send_email_notifications.yml index 078c6bb028..b42ccf1012 100644 --- a/playbooks/manual/communishift_send_email_notifications.yml +++ b/playbooks/manual/communishift_send_email_notifications.yml @@ -5,6 +5,9 @@ # Run notifications only: # ansible-playbook .../communishift_send_email_notifications.yml --tags communishift_send_notifications # +# Dry run (FASJSON + per-project preview, no SMTP mail): +# ansible-playbook .../communishift_send_email_notifications.yml --tags communishift_send_notifications -e communishift_email_notifications_dry_run=true +# - hosts: localhost user: root gather_facts: false @@ -34,7 +37,7 @@ - name: Summary of Communishift projects notified # noqa: run-once[task] ansible.builtin.debug: - msg: "{%- set ns = namespace(names=[]) %}{%- for item in communishift_projects | dict2items | sort(attribute='value.name') %}{%- if not (item.value.do_not_delete | default(false)) %}{%- set _ = ns.names.append(item.value.name) %}{%- endif %}{%- endfor %} Communishift notification run complete. Emails were sent for {{ ns.names | length }} project(s): {{ ns.names | join(' ') }}" + msg: "{%- set ns = namespace(names=[]) %}{%- for item in communishift_projects | dict2items | sort(attribute='value.name') %}{%- if not (item.value.do_not_delete | default(false)) %}{%- set _ = ns.names.append(item.value.name) %}{%- endif %}{%- endfor %} {% if communishift_email_notifications_dry_run | default(false) %}Communishift notification dry run complete (no email sent). Would notify {{ ns.names | length }} project(s): {{ ns.names | join(' ') }}{% else %}Communishift notification run complete. Emails were sent for {{ ns.names | length }} project(s): {{ ns.names | join(' ') }}{% endif %}" run_once: true tags: - communishift_send_notifications diff --git a/roles/communishift/tasks/cleanup-administration-send-notifications.yml b/roles/communishift/tasks/cleanup-administration-send-notifications.yml index 2ac08341f3..e4ecb6a597 100644 --- a/roles/communishift/tasks/cleanup-administration-send-notifications.yml +++ b/roles/communishift/tasks/cleanup-administration-send-notifications.yml @@ -28,6 +28,22 @@ headers: - Reply-To=admin@fedoraproject.org charset: us-ascii - when: "not should_not_delete" + when: + - not should_not_delete + - not communishift_email_notifications_dry_run | default(false) + tags: + - communishift_send_notifications + +- name: Communishift notification email (dry-run preview, mail not sent) + ansible.builtin.debug: + msg: + dry_run: true + project: "{{ item.value.name }}" + to: infrastructure@lists.fedoraproject.org + bcc: "{{ communishift_project_emails[item.value.name]['email_list'] }}" + subject: "Fedora Communishift Notification for project: {{ item.value.name }}" + when: + - not should_not_delete + - communishift_email_notifications_dry_run | default(false) tags: - communishift_send_notifications From 634a65bb02e591f4f9f8aff32534e2f8805f5a24 Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Fri, 1 May 2026 13:57:06 +0100 Subject: [PATCH 099/151] Zabbix: Add cron+prometheus monitoring of ipa-healthcheck Signed-off-by: Greg Sutcliffe --- roles/ipa/server/tasks/main.yml | 34 ++------------- roles/ipa/server/tasks/monitoring.yml | 59 +++++++++++++++++++++++++++ 2 files changed, 62 insertions(+), 31 deletions(-) create mode 100644 roles/ipa/server/tasks/monitoring.yml diff --git a/roles/ipa/server/tasks/main.yml b/roles/ipa/server/tasks/main.yml index cc44604d06..497199e185 100644 --- a/roles/ipa/server/tasks/main.yml +++ b/roles/ipa/server/tasks/main.yml @@ -24,6 +24,7 @@ - ipa-server - ipa-server-dns - ipa-fas + - ipa-healthcheck tags: - ipa/server - packages @@ -794,38 +795,9 @@ - ipa/server - config -# Zabbix monitoring of the internal IPA server -- name: Install Zabbix agent config drop-in - ansible.builtin.copy: - src: zabbix/agent-ipa-backup.conf - dest: /etc/zabbix/zabbix_agentd.d/ipa-backup.conf - mode: '0644' - notify: - - Restart zabbix agent +- name: Configure IPA monitoring in Zabbix + ansible.builtin.include_tasks: monitoring.yml tags: - ipa/server - zabbix_agent - -- name: Zabbix API Block - vars: - ansible_zabbix_auth_key: "{{ zabbix_auth_key }}" - ansible_network_os: "{{ zabbix_network_os }}" - ansible_connection: "{{ zabbix_connection }}" - ansible_httpapi_port: "{{ zabbix_httpapi_port }}" - ansible_httpapi_use_ssl: "{{ zabbix_httpapi_use_ssl }}" - ansible_httpapi_validate_certs: "{{ zabbix_httpapi_validate_certs }}" - ansible_host: "{{ zabbix_server }}" - ansible_zabbix_url_path: "{{ zabbix_url_path }}" - tags: - - ipa/server - zabbix_api - block: - - name: Import IPA template file - community.zabbix.zabbix_template: - template_yaml: "{{ lookup('file', 'zabbix/template-ipa.yml') }}" - state: present - - name: Add self to IPA template in Zabbix - community.zabbix.zabbix_host: - host_name: "{{ inventory_hostname }}" - link_templates: IPA Monitoring - force: false diff --git a/roles/ipa/server/tasks/monitoring.yml b/roles/ipa/server/tasks/monitoring.yml new file mode 100644 index 0000000000..38b81f4991 --- /dev/null +++ b/roles/ipa/server/tasks/monitoring.yml @@ -0,0 +1,59 @@ +# Zabbix monitoring of the internal IPA server + +# ipa-healthcheck can only be run by root, so cron the +# output to where Zabbix can find it +- name: Set cron for ipa-healthcheck + ansible.builtin.cron: + name: "Dump IPA healthcheck as root for Zabbix" + minute: "*/5" + user: root + job: "/usr/bin/ipa-healthcheck --output-type prometheus --all > /etc/zabbix/ipa-healthcheck.log 2> /dev/null" + tags: + - ipa/server + - zabbix_agent + +- name: Install Zabbix agent config drop-in + ansible.builtin.copy: + src: zabbix/agent-ipa-backup.conf + dest: /etc/zabbix/zabbix_agentd.d/ipa-backup.conf + mode: '0644' + notify: + - Restart zabbix agent + tags: + - ipa/server + - zabbix_agent + +- name: Zabbix API Block + vars: + ansible_zabbix_auth_key: "{{ zabbix_auth_key }}" + ansible_network_os: "{{ zabbix_network_os }}" + ansible_connection: "{{ zabbix_connection }}" + ansible_httpapi_port: "{{ zabbix_httpapi_port }}" + ansible_httpapi_use_ssl: "{{ zabbix_httpapi_use_ssl }}" + ansible_httpapi_validate_certs: "{{ zabbix_httpapi_validate_certs }}" + ansible_host: "{{ zabbix_server }}" + ansible_zabbix_url_path: "{{ zabbix_url_path }}" + tags: + - ipa/server + - zabbix_api + block: + - name: Import IPA template file + community.zabbix.zabbix_template: + template_yaml: "{{ lookup('file', 'zabbix/template-ipa.yml') }}" + state: present + run_once: true + + - name: Ensure IPA Zabbix hostgroup is present + community.zabbix.zabbix_group: + host_groups: + - IPA Servers + state: present + run_once: true + + - name: Add self to IPA template in Zabbix + community.zabbix.zabbix_host: + host_name: "{{ inventory_hostname }}" + host_groups: IPA Servers + link_templates: IPA Monitoring + force: false + From 95ad158c84d27d950f4e30f05983aa416b39de74 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 1 May 2026 08:21:20 -0700 Subject: [PATCH 100/151] webhook2fedmsg: drop deploymentconfig from service selector Signed-off-by: Kevin Fenzi --- roles/openshift-apps/webhook2fedmsg/files/service.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/roles/openshift-apps/webhook2fedmsg/files/service.yml b/roles/openshift-apps/webhook2fedmsg/files/service.yml index 42ddb7e745..d62efa9717 100644 --- a/roles/openshift-apps/webhook2fedmsg/files/service.yml +++ b/roles/openshift-apps/webhook2fedmsg/files/service.yml @@ -12,4 +12,3 @@ spec: targetPort: 8080 selector: app: webhook2fedmsg - deploymentconfig: app From fe0f017ef635e5b543ca7c8a3f7db21f7194e57c Mon Sep 17 00:00:00 2001 From: Pedro Moura Date: Tue, 14 Apr 2026 18:30:40 -0300 Subject: [PATCH 101/151] badges: fix deployment reference Signed-off-by: Pedro Moura --- playbooks/openshift-apps/badges.yml | 4 ++-- roles/openshift-apps/badges/files/service.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/playbooks/openshift-apps/badges.yml b/playbooks/openshift-apps/badges.yml index 2cc5c50774..58a05b7338 100644 --- a/playbooks/openshift-apps/badges.yml +++ b/playbooks/openshift-apps/badges.yml @@ -182,8 +182,8 @@ # Deployment config - role: openshift/object object_app: badges - object_template: deploymentconfig.yml.j2 - object_objectname: deploymentconfig.yml + object_template: deployment.yml.j2 + object_objectname: deployment.yml # Cron jobs - role: openshift/object diff --git a/roles/openshift-apps/badges/files/service.yml b/roles/openshift-apps/badges/files/service.yml index 617ceba8c4..b7bc3aec6a 100644 --- a/roles/openshift-apps/badges/files/service.yml +++ b/roles/openshift-apps/badges/files/service.yml @@ -13,7 +13,7 @@ spec: port: 8080 targetPort: 8080 selector: - deploymentconfig: frontend + deployment: frontend --- apiVersion: v1 kind: Service @@ -29,4 +29,4 @@ spec: targetPort: 6379 selector: app: badges - deploymentconfig: redis + deployment: redis From ba88e1c63b7b5198d6438aeca69f76c7ada4b33a Mon Sep 17 00:00:00 2001 From: Pedro Moura Date: Tue, 14 Apr 2026 18:36:23 -0300 Subject: [PATCH 102/151] badges: moved deploymentconfig.yml.j2 to deployment.yml.j2 Signed-off-by: Pedro Moura --- ...loymentconfig.yml.j2 => deployment.yml.j2} | 100 ++++++------------ 1 file changed, 33 insertions(+), 67 deletions(-) rename roles/openshift-apps/badges/templates/{deploymentconfig.yml.j2 => deployment.yml.j2} (78%) diff --git a/roles/openshift-apps/badges/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/badges/templates/deployment.yml.j2 similarity index 78% rename from roles/openshift-apps/badges/templates/deploymentconfig.yml.j2 rename to roles/openshift-apps/badges/templates/deployment.yml.j2 index 10a2cf765b..6b7163070e 100644 --- a/roles/openshift-apps/badges/templates/deploymentconfig.yml.j2 +++ b/roles/openshift-apps/badges/templates/deployment.yml.j2 @@ -1,7 +1,7 @@ --- # Frontend component (Python/Pyramid served by gunicorn) -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: name: frontend labels: @@ -9,27 +9,23 @@ metadata: spec: replicas: 1 selector: - app: badges - deploymentconfig: frontend + matchLabels: + app: badges strategy: - type: Rolling - activeDeadlineSeconds: 21600 - rollingParams: - intervalSeconds: 1 + type: RollingUpdate + rollingUpdate: maxSurge: 25% maxUnavailable: 25% - timeoutSeconds: 600 - updatePeriodSeconds: 1 template: metadata: - creationTimestamp: null labels: app: badges - deploymentconfig: frontend + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"tahrir:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"frontend\")].image"}]' spec: containers: - name: frontend - image: tahrir:latest + image: image-registry.openshift-image-registry.svc:5000/tahrir/tahrir:latest imagePullPolicy: Always ports: - containerPort: 8080 @@ -58,7 +54,6 @@ spec: - name: tahrir-fedora-messaging-crt-volume mountPath: /etc/pki/fedora-messaging/crt readOnly: true - env: - name: FLASK_CONFIG value: "/etc/badges/tahrir.cfg" @@ -72,7 +67,6 @@ spec: value: /etc/keytabs/fedbadges.keytab - name: FEDORA_MESSAGING_CONF value: /etc/badges/fm-tahrir.toml - readinessProbe: timeoutSeconds: 10 initialDelaySeconds: 5 @@ -87,7 +81,6 @@ spec: httpGet: path: "/healthz/live" port: 8080 - volumes: - name: etc-badges configMap: @@ -113,49 +106,39 @@ spec: - name: tahrir-fedora-messaging-crt-volume secret: secretName: tahrir-fedora-messaging-crt - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - frontend - from: - kind: ImageStreamTag - name: tahrir:latest --- # Consumer component (Fedora Messaging consume command) -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: name: consumer labels: app: badges spec: - # There can be as many as necessary replicas: {{ (env == 'production')|ternary(2, 1) }} selector: - app: badges - deploymentconfig: consumer + matchLabels: + app: badges strategy: type: Recreate - recreateParams: - mid: - execNewPod: - command: [/opt/app-root/bin/tahrir-sync-db, /etc/badges/tahrir.cfg] - containerName: consumer - volumes: - - etc-badges - failurePolicy: Abort template: metadata: - creationTimestamp: null labels: app: badges - deploymentconfig: consumer + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fedbadges:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"consumer\")].image"}]' spec: + initContainers: + - name: db-sync + image: image-registry.openshift-image-registry.svc:5000/fedbadges/fedbadges:latest + command: ["/opt/app-root/bin/tahrir-sync-db", "/etc/badges/tahrir.cfg"] + volumeMounts: + - name: etc-badges + mountPath: "/etc/badges" + readOnly: true containers: - name: consumer + image: image-registry.openshift-image-registry.svc:5000/fedbadges/fedbadges:latest imagePullPolicy: Always volumeMounts: - name: etc-badges @@ -206,20 +189,10 @@ spec: - name: fedora-messaging-crt-volume secret: secretName: fedora-messaging-crt - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - consumer - from: - kind: ImageStreamTag - name: fedbadges:latest --- # Redis, for caching -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: name: redis labels: @@ -228,17 +201,20 @@ metadata: spec: replicas: 1 selector: - app: badges - deploymentconfig: redis + matchLabels: + app: badges + strategy: {} template: metadata: labels: app: badges - deploymentconfig: redis + service: redis + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"redis:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"redis\")].image"}]' spec: containers: - name: redis - image: redis:latest + image: image-registry.openshift-image-registry.svc:5000/redis/redis:latest volumeMounts: - name: data mountPath: "/bitnami/redis/data" @@ -267,13 +243,3 @@ spec: - name: data persistentVolumeClaim: claimName: redis - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - redis - from: - kind: ImageStreamTag - name: redis:latest From 0f2dd689e08d4f9c56a831a89254ad5f04e0415a Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 1 May 2026 09:37:10 -0700 Subject: [PATCH 103/151] badges: fix selectors and annotations Signed-off-by: Kevin Fenzi --- .../openshift-apps/badges/templates/deployment.yml.j2 | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/roles/openshift-apps/badges/templates/deployment.yml.j2 b/roles/openshift-apps/badges/templates/deployment.yml.j2 index 6b7163070e..8c99825da2 100644 --- a/roles/openshift-apps/badges/templates/deployment.yml.j2 +++ b/roles/openshift-apps/badges/templates/deployment.yml.j2 @@ -6,11 +6,15 @@ metadata: name: frontend labels: app: badges + deployment: frontend + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"tahrir:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"frontend\")].image"}]' spec: replicas: 1 selector: matchLabels: app: badges + deployment: frontend strategy: type: RollingUpdate rollingUpdate: @@ -20,8 +24,6 @@ spec: metadata: labels: app: badges - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"tahrir:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"frontend\")].image"}]' spec: containers: - name: frontend @@ -114,11 +116,13 @@ metadata: name: consumer labels: app: badges + deployment: consumer spec: replicas: {{ (env == 'production')|ternary(2, 1) }} selector: matchLabels: app: badges + deployment: consumer strategy: type: Recreate template: @@ -198,11 +202,13 @@ metadata: labels: app: badges service: redis + deployment: redis spec: replicas: 1 selector: matchLabels: app: badges + deployment: redis strategy: {} template: metadata: From 2cc4befb839c36e5a053edc2cce649423fedb580 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 1 May 2026 09:41:20 -0700 Subject: [PATCH 104/151] badges: fix more labels Signed-off-by: Kevin Fenzi --- roles/openshift-apps/badges/templates/deployment.yml.j2 | 3 +++ 1 file changed, 3 insertions(+) diff --git a/roles/openshift-apps/badges/templates/deployment.yml.j2 b/roles/openshift-apps/badges/templates/deployment.yml.j2 index 8c99825da2..c55cb256fd 100644 --- a/roles/openshift-apps/badges/templates/deployment.yml.j2 +++ b/roles/openshift-apps/badges/templates/deployment.yml.j2 @@ -24,6 +24,7 @@ spec: metadata: labels: app: badges + deployment: frontend spec: containers: - name: frontend @@ -129,6 +130,7 @@ spec: metadata: labels: app: badges + deployment: consumer annotations: image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fedbadges:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"consumer\")].image"}]' spec: @@ -215,6 +217,7 @@ spec: labels: app: badges service: redis + deployment: redis annotations: image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"redis:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"redis\")].image"}]' spec: From 68cef3f2ebc43d679cbee23adf25ad192028cac9 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 1 May 2026 09:48:17 -0700 Subject: [PATCH 105/151] badges: fix namespace for images Signed-off-by: Kevin Fenzi --- roles/openshift-apps/badges/templates/deployment.yml.j2 | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/roles/openshift-apps/badges/templates/deployment.yml.j2 b/roles/openshift-apps/badges/templates/deployment.yml.j2 index c55cb256fd..ad22b68600 100644 --- a/roles/openshift-apps/badges/templates/deployment.yml.j2 +++ b/roles/openshift-apps/badges/templates/deployment.yml.j2 @@ -28,7 +28,7 @@ spec: spec: containers: - name: frontend - image: image-registry.openshift-image-registry.svc:5000/tahrir/tahrir:latest + image: image-registry.openshift-image-registry.svc:5000/badges/tahrir:latest imagePullPolicy: Always ports: - containerPort: 8080 @@ -136,7 +136,7 @@ spec: spec: initContainers: - name: db-sync - image: image-registry.openshift-image-registry.svc:5000/fedbadges/fedbadges:latest + image: image-registry.openshift-image-registry.svc:5000/badges/fedbadges:latest command: ["/opt/app-root/bin/tahrir-sync-db", "/etc/badges/tahrir.cfg"] volumeMounts: - name: etc-badges @@ -144,7 +144,7 @@ spec: readOnly: true containers: - name: consumer - image: image-registry.openshift-image-registry.svc:5000/fedbadges/fedbadges:latest + image: image-registry.openshift-image-registry.svc:5000/badges/fedbadges:latest imagePullPolicy: Always volumeMounts: - name: etc-badges @@ -223,7 +223,7 @@ spec: spec: containers: - name: redis - image: image-registry.openshift-image-registry.svc:5000/redis/redis:latest + image: image-registry.openshift-image-registry.svc:5000/badges/redis:latest volumeMounts: - name: data mountPath: "/bitnami/redis/data" From c6087306fea7d030ad7d4abadc0c0fbed95054d5 Mon Sep 17 00:00:00 2001 From: David Kirwan Date: Fri, 1 May 2026 18:24:25 +0100 Subject: [PATCH 106/151] communishift: communishift-standupbot marked do not delete. Signed-off-by: David Kirwan --- inventory/group_vars/all | 1 + 1 file changed, 1 insertion(+) diff --git a/inventory/group_vars/all b/inventory/group_vars/all index cd8f8c2a22..2ae29716a2 100644 --- a/inventory/group_vars/all +++ b/inventory/group_vars/all @@ -100,6 +100,7 @@ communishift_projects: name: communishift-planet communishift-standupbot: name: communishift-standupbot + do_not_delete: true # Marked do not delete 2026-05-01 - dkirwan communishift-weekly-bootc: do_not_delete: true # Marked do not delete 2024-11-26. Needed until end of bootc initative. - dkirwan name: communishift-weekly-bootc From a9d3b403bcb22792cf7f9d5b4de5b697b2e1a9eb Mon Sep 17 00:00:00 2001 From: Pedro Moura Date: Wed, 15 Apr 2026 18:35:01 -0300 Subject: [PATCH 107/151] elections: moved deploymentconfig.yml to deployment.yml Signed-off-by: Pedro Moura --- .../{deploymentconfig.yml => deployment.yml} | 62 +++++++++---------- 1 file changed, 29 insertions(+), 33 deletions(-) rename roles/openshift-apps/elections/files/{deploymentconfig.yml => deployment.yml} (66%) diff --git a/roles/openshift-apps/elections/files/deploymentconfig.yml b/roles/openshift-apps/elections/files/deployment.yml similarity index 66% rename from roles/openshift-apps/elections/files/deploymentconfig.yml rename to roles/openshift-apps/elections/files/deployment.yml index 49c1baf666..024eab3a95 100644 --- a/roles/openshift-apps/elections/files/deploymentconfig.yml +++ b/roles/openshift-apps/elections/files/deployment.yml @@ -1,6 +1,6 @@ --- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: labels: app: elections @@ -9,35 +9,42 @@ metadata: spec: replicas: 1 selector: - app: elections - deploymentconfig: elections + matchLabels: + app: elections strategy: type: Recreate - recreateParams: - mid: - failurePolicy: Abort - execNewPod: - containerName: elections - command: ["/opt/app-root/src/alembic_upgrade.sh"] - env: - - name: PYTHONPATH - value: /opt/app-root/src - - name: KRB5_CONFIG - value: /etc/ipa/krb5.conf - volumes: - - config-volume - - elections-secret-volume - - ipa-config-volume - - keytab-volume template: metadata: labels: app: elections - deploymentconfig: elections + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"elections:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"elections\")].image"}]' spec: + initContainers: + - name: alembic-upgrade + image: image-registry.openshift-image-registry.svc:5000/elections/elections:latest + command: ["/opt/app-root/src/alembic_upgrade.sh"] + env: + - name: PYTHONPATH + value: /opt/app-root/src + - name: KRB5_CONFIG + value: /etc/ipa/krb5.conf + volumeMounts: + - name: config-volume + mountPath: /opt/app-root/config/ + readOnly: true + - name: elections-secret-volume + mountPath: /opt/app-root/secret/ + readOnly: true + - name: ipa-config-volume + mountPath: /etc/ipa + readOnly: true + - name: keytab-volume + mountPath: /etc/keytabs + readOnly: true containers: - name: elections - image: elections:latest + image: image-registry.openshift-image-registry.svc:5000/elections/elections:latest ports: - containerPort: 8000 resources: {} @@ -102,14 +109,3 @@ spec: - name: keytab-volume secret: secretName: elections-keytab - - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - elections - from: - kind: ImageStreamTag - name: elections:latest From 75fea49569c2c0fb9f90a915ff133bc4ff0f28f9 Mon Sep 17 00:00:00 2001 From: Pedro Moura Date: Wed, 15 Apr 2026 18:38:19 -0300 Subject: [PATCH 108/151] elections: fix deployment reference --- playbooks/openshift-apps/elections.yml | 4 ++-- roles/openshift-apps/elections/files/service.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/playbooks/openshift-apps/elections.yml b/playbooks/openshift-apps/elections.yml index b5a2d1fe0a..b6f14c7f95 100644 --- a/playbooks/openshift-apps/elections.yml +++ b/playbooks/openshift-apps/elections.yml @@ -119,5 +119,5 @@ - role: openshift/object object_app: elections - object_file: deploymentconfig.yml - object_objectname: deploymentconfig.yml + object_file: deployment.yml + object_objectname: deployment.yml diff --git a/roles/openshift-apps/elections/files/service.yml b/roles/openshift-apps/elections/files/service.yml index 6f85983e4c..ae3bb1a1a5 100644 --- a/roles/openshift-apps/elections/files/service.yml +++ b/roles/openshift-apps/elections/files/service.yml @@ -13,4 +13,4 @@ spec: targetPort: 8000 selector: app: elections - deploymentconfig: elections + deployment: elections From 140bbcc071e889682be8387a9a9573864b46437c Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 1 May 2026 11:56:51 -0700 Subject: [PATCH 109/151] elections: drop unneeded selector on deployment label Signed-off-by: Kevin Fenzi --- roles/openshift-apps/elections/files/service.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/roles/openshift-apps/elections/files/service.yml b/roles/openshift-apps/elections/files/service.yml index ae3bb1a1a5..a6df54ad59 100644 --- a/roles/openshift-apps/elections/files/service.yml +++ b/roles/openshift-apps/elections/files/service.yml @@ -13,4 +13,3 @@ spec: targetPort: 8000 selector: app: elections - deployment: elections From 7b4bae5003c12989236316ae28a239e9957af51d Mon Sep 17 00:00:00 2001 From: Pedro Moura Date: Thu, 16 Apr 2026 18:15:05 -0300 Subject: [PATCH 110/151] datanommer: fix deployment reference Signed-off-by: Pedro Moura --- playbooks/openshift-apps/datanommer.yml | 4 +- .../templates/deploymentconfig.yml.j2 | 76 ------------------- 2 files changed, 2 insertions(+), 78 deletions(-) delete mode 100644 roles/openshift-apps/datanommer/templates/deploymentconfig.yml.j2 diff --git a/playbooks/openshift-apps/datanommer.yml b/playbooks/openshift-apps/datanommer.yml index 685458b35e..035b2d8611 100644 --- a/playbooks/openshift-apps/datanommer.yml +++ b/playbooks/openshift-apps/datanommer.yml @@ -80,8 +80,8 @@ - role: openshift/object object_app: datanommer - object_template: deploymentconfig.yml.j2 - object_objectname: deploymentconfig.yml + object_template: deployment.yml.j2 + object_objectname: deployment.yml - role: openshift/object object_app: datanommer diff --git a/roles/openshift-apps/datanommer/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/datanommer/templates/deploymentconfig.yml.j2 deleted file mode 100644 index 3dd37976e3..0000000000 --- a/roles/openshift-apps/datanommer/templates/deploymentconfig.yml.j2 +++ /dev/null @@ -1,76 +0,0 @@ ---- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig -metadata: - name: datanommer - labels: - app: Datanommer -spec: - replicas: 1 - selector: - app: Datanommer - deploymentconfig: datanommer - strategy: - type: Recreate - recreateParams: - mid: - execNewPod: - command: [/opt/app-root/bin/alembic, -c, /etc/fedora-messaging/alembic.ini, upgrade, head] - containerName: datanommer - volumes: - - fedora-messaging-config-volume - failurePolicy: Abort - template: - metadata: - creationTimestamp: null - labels: - app: Datanommer - deploymentconfig: datanommer - spec: - containers: - - name: datanommer - imagePullPolicy: Always - ports: - - containerPort: 8080 - resources: - limits: - memory: 2Gi - volumeMounts: - - name: fedora-messaging-config-volume - mountPath: "/etc/fedora-messaging" - readOnly: true - - name: fedora-messaging-ca-volume - mountPath: /etc/pki/fedora-messaging/cacert.pem - subPath: cacert.pem - readOnly: true - - name: fedora-messaging-crt-volume - mountPath: /etc/pki/fedora-messaging/datanommer-cert.pem - subPath: datanommer-cert.pem - readOnly: true - - name: fedora-messaging-key-volume - mountPath: /etc/pki/fedora-messaging/datanommer-key.pem - subPath: datanommer-key.pem - readOnly: true - volumes: - - name: fedora-messaging-config-volume - configMap: - name: fedora-messaging-config - - name: fedora-messaging-ca-volume - secret: - secretName: fedora-messaging-ca - - name: fedora-messaging-crt-volume - secret: - secretName: fedora-messaging-crt - - name: fedora-messaging-key-volume - secret: - secretName: fedora-messaging-key - triggers: - - imageChangeParams: - automatic: true - containerNames: - - datanommer - from: - kind: ImageStreamTag - name: datanommer:latest - type: ImageChange - - type: ConfigChange From 6f7b1a7043fda14ce030fd5b584a215dcb4a1a57 Mon Sep 17 00:00:00 2001 From: Pedro Moura Date: Thu, 16 Apr 2026 18:17:32 -0300 Subject: [PATCH 111/151] datanommer: moved deploymentconfig.yml to deployment.yml Signed-off-by: Pedro Moura --- .../datanommer/templates/deployment.yml.j2 | 67 +++++++++++++++++++ 1 file changed, 67 insertions(+) create mode 100644 roles/openshift-apps/datanommer/templates/deployment.yml.j2 diff --git a/roles/openshift-apps/datanommer/templates/deployment.yml.j2 b/roles/openshift-apps/datanommer/templates/deployment.yml.j2 new file mode 100644 index 0000000000..1fa0dd2523 --- /dev/null +++ b/roles/openshift-apps/datanommer/templates/deployment.yml.j2 @@ -0,0 +1,67 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: datanommer + labels: + app: Datanommer +spec: + replicas: 1 + selector: + matchLabels: + app: Datanommer + strategy: + type: Recreate + template: + metadata: + labels: + app: Datanommer + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"datanommer:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"datanommer\")].image"}]' + spec: + initContainers: + - name: alembic-upgrade + image: image-registry.openshift-image-registry.svc:5000/datanommer/datanommer:latest + command: ["/opt/app-root/bin/alembic", "-c", "/etc/fedora-messaging/alembic.ini", "upgrade", "head"] + volumeMounts: + - name: fedora-messaging-config-volume + mountPath: "/etc/fedora-messaging" + readOnly: true + containers: + - name: datanommer + image: image-registry.openshift-image-registry.svc:5000/datanommer/datanommer:latest + imagePullPolicy: Always + ports: + - containerPort: 8080 + resources: + limits: + memory: 2Gi + volumeMounts: + - name: fedora-messaging-config-volume + mountPath: "/etc/fedora-messaging" + readOnly: true + - name: fedora-messaging-ca-volume + mountPath: /etc/pki/fedora-messaging/cacert.pem + subPath: cacert.pem + readOnly: true + - name: fedora-messaging-crt-volume + mountPath: /etc/pki/fedora-messaging/datanommer-cert.pem + subPath: datanommer-cert.pem + readOnly: true + - name: fedora-messaging-key-volume + mountPath: /etc/pki/fedora-messaging/datanommer-key.pem + subPath: datanommer-key.pem + readOnly: true + volumes: + - name: fedora-messaging-config-volume + configMap: + name: fedora-messaging-config + - name: fedora-messaging-ca-volume + secret: + secretName: fedora-messaging-ca + - name: fedora-messaging-crt-volume + secret: + secretName: fedora-messaging-crt + - name: fedora-messaging-key-volume + secret: + secretName: fedora-messaging-key From 63bfac6cc9dfa42b087e8b7733138a7934ff513a Mon Sep 17 00:00:00 2001 From: Pedro Moura Date: Mon, 20 Apr 2026 18:30:28 -0300 Subject: [PATCH 112/151] fmn: fix deployment reference Signed-off-by: Pedro Moura --- playbooks/openshift-apps/fmn.yml | 4 ++-- roles/openshift-apps/fmn/files/service.yml | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/playbooks/openshift-apps/fmn.yml b/playbooks/openshift-apps/fmn.yml index 9c7169905d..b22930b1a7 100644 --- a/playbooks/openshift-apps/fmn.yml +++ b/playbooks/openshift-apps/fmn.yml @@ -217,8 +217,8 @@ # Deployment config - role: openshift/object object_app: fmn - object_template: deploymentconfig.yml.j2 - object_objectname: deploymentconfig.yml + object_template: deployment.yml.j2 + object_objectname: deployment.yml # FASJSON access - role: openshift/ipa-client diff --git a/roles/openshift-apps/fmn/files/service.yml b/roles/openshift-apps/fmn/files/service.yml index cfa76c83ea..90ab120db1 100644 --- a/roles/openshift-apps/fmn/files/service.yml +++ b/roles/openshift-apps/fmn/files/service.yml @@ -12,7 +12,7 @@ spec: targetPort: 8080 selector: app: fmn - deploymentconfig: frontend + deployment: frontend --- apiVersion: v1 kind: Service @@ -27,7 +27,7 @@ spec: targetPort: 8080 selector: app: fmn - deploymentconfig: api + deployment: api --- apiVersion: v1 kind: Service @@ -45,7 +45,7 @@ spec: targetPort: 1025 selector: app: fmn - deploymentconfig: sendria + deployment: sendria --- apiVersion: v1 kind: Service @@ -61,4 +61,4 @@ spec: targetPort: 6379 selector: app: fmn - deploymentconfig: redis + deployment: redis From a19387aa220709353027022fdbba0f225526b7a8 Mon Sep 17 00:00:00 2001 From: Pedro Moura Date: Wed, 22 Apr 2026 18:19:35 -0300 Subject: [PATCH 113/151] fmn: moved deploymentconfig.yml to deployment.yml Signed-off-by: Pedro Moura --- ...loymentconfig.yml.j2 => deployment.yml.j2} | 248 ++++++------------ 1 file changed, 76 insertions(+), 172 deletions(-) rename roles/openshift-apps/fmn/templates/{deploymentconfig.yml.j2 => deployment.yml.j2} (73%) diff --git a/roles/openshift-apps/fmn/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/fmn/templates/deployment.yml.j2 similarity index 73% rename from roles/openshift-apps/fmn/templates/deploymentconfig.yml.j2 rename to roles/openshift-apps/fmn/templates/deployment.yml.j2 index eb2f17e40c..bdb928724a 100644 --- a/roles/openshift-apps/fmn/templates/deploymentconfig.yml.j2 +++ b/roles/openshift-apps/fmn/templates/deployment.yml.j2 @@ -1,7 +1,7 @@ --- # Frontend component (Javascript served by Apache httpd) -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: name: frontend labels: @@ -9,26 +9,23 @@ metadata: spec: replicas: 1 selector: - app: fmn - deploymentconfig: frontend + matchLabels: + app: fmn strategy: - type: Rolling - activeDeadlineSeconds: 21600 - rollingParams: - intervalSeconds: 1 + type: RollingUpdate + rollingUpdate: maxSurge: 25% maxUnavailable: 25% - timeoutSeconds: 600 - updatePeriodSeconds: 1 template: metadata: - creationTimestamp: null labels: app: fmn - deploymentconfig: frontend + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"frontend\")].image"}]' spec: containers: - name: frontend + image: image-registry.openshift-image-registry.svc:5000/fmn/fmn:latest imagePullPolicy: Always ports: - containerPort: 8080 @@ -53,20 +50,10 @@ spec: volumes: - name: httpdir-volume emptyDir: {} - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - frontend - from: - kind: ImageStreamTag - name: fmn:latest --- # API component (Python/FastAPI served by Uvicorn) -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: name: api labels: @@ -74,26 +61,23 @@ metadata: spec: replicas: 1 selector: - app: fmn - deploymentconfig: api + matchLabels: + app: fmn strategy: - type: Rolling - activeDeadlineSeconds: 21600 - rollingParams: - intervalSeconds: 1 + type: RollingUpdate + rollingUpdate: maxSurge: 25% maxUnavailable: 25% - timeoutSeconds: 600 - updatePeriodSeconds: 1 template: metadata: - creationTimestamp: null labels: app: fmn - deploymentconfig: api + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"api\")].image"}]' spec: containers: - name: api + image: image-registry.openshift-image-registry.svc:5000/fmn/fmn:latest imagePullPolicy: Always ports: - containerPort: 8080 @@ -116,7 +100,6 @@ spec: - name: fedora-messaging-crt-volume mountPath: /etc/pki/fedora-messaging/crt readOnly: true - env: - name: APP_SCRIPT value: ".s2i/run-api.sh" @@ -141,7 +124,6 @@ spec: key: cache-hash-key - name: FEDORA_MESSAGING_CONF value: /etc/fmn/api.toml - readinessProbe: timeoutSeconds: 1 initialDelaySeconds: 5 @@ -154,7 +136,6 @@ spec: httpGet: path: /api/v1/healthz/live port: 8080 - volumes: - name: etc-fmn configMap: @@ -174,49 +155,39 @@ spec: - name: fedora-messaging-crt-volume secret: secretName: fedora-messaging-crt - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - api - from: - kind: ImageStreamTag - name: fmn:latest --- # Consumer component (Fedora Messaging consume command) -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: name: consumer labels: app: fmn spec: - # There can be as many as necessary replicas: 1 selector: - app: fmn - deploymentconfig: consumer + matchLabels: + app: fmn strategy: type: Recreate - recreateParams: - mid: - execNewPod: - command: [/opt/app-root/bin/fmn, database, sync] - containerName: consumer - volumes: - - etc-fmn - failurePolicy: Abort template: metadata: - creationTimestamp: null labels: app: fmn - deploymentconfig: consumer + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"consumer\")].image"}]' spec: + initContainers: + - name: database-sync + image: image-registry.openshift-image-registry.svc:5000/fmn/fmn:latest + command: ["/opt/app-root/bin/fmn", "database", "sync"] + volumeMounts: + - name: etc-fmn + mountPath: "/etc/fmn" + readOnly: true containers: - name: consumer + image: image-registry.openshift-image-registry.svc:5000/fmn/fmn:latest imagePullPolicy: Always volumeMounts: - name: etc-fmn @@ -273,41 +244,31 @@ spec: - name: fedora-messaging-crt-volume secret: secretName: fedora-messaging-crt - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - consumer - from: - kind: ImageStreamTag - name: fmn:latest --- # Email sending component (custom python runner) -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: name: sender-email labels: app: fmn spec: - # There can be many pods for email. replicas: 1 selector: - app: fmn - deploymentconfig: sender-email + matchLabels: + app: fmn strategy: type: Recreate template: metadata: - creationTimestamp: null labels: app: fmn - deploymentconfig: sender-email + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"sender-email\")].image"}]' spec: containers: - name: sender-email + image: image-registry.openshift-image-registry.svc:5000/fmn/fmn:latest imagePullPolicy: Always volumeMounts: - name: etc-fmn @@ -338,42 +299,31 @@ spec: - name: fedora-messaging-crt-volume secret: secretName: fedora-messaging-crt - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - sender-email - from: - kind: ImageStreamTag - name: fmn:latest --- # IRC sending component (custom python runner) -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: name: sender-irc labels: app: fmn spec: - # There can be only one pod for IRC - # Staging is currently unable to connect to IRC outside because of firewall rules. replicas: {{ (env == 'production')|ternary('1', '0') }} selector: - app: fmn - deploymentconfig: sender-irc + matchLabels: + app: fmn strategy: type: Recreate template: metadata: - creationTimestamp: null labels: app: fmn - deploymentconfig: sender-irc + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"sender-irc\")].image"}]' spec: containers: - name: sender-irc + image: image-registry.openshift-image-registry.svc:5000/fmn/fmn:latest imagePullPolicy: Always volumeMounts: - name: etc-fmn @@ -404,42 +354,31 @@ spec: - name: fedora-messaging-crt-volume secret: secretName: fedora-messaging-crt - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - sender-irc - from: - kind: ImageStreamTag - name: fmn:latest --- # Matrix sending component (custom python runner) -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: name: sender-matrix labels: app: fmn spec: - # Not sure how many concurrent connections are supported by Matrix with the - # same token. Let's just have one for now. replicas: 1 selector: - app: fmn - deploymentconfig: sender-matrix + matchLabels: + app: fmn strategy: type: Recreate template: metadata: - creationTimestamp: null labels: app: fmn - deploymentconfig: sender-matrix + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"sender-matrix\")].image"}]' spec: containers: - name: sender-matrix + image: image-registry.openshift-image-registry.svc:5000/fmn/fmn:latest imagePullPolicy: Always volumeMounts: - name: etc-fmn @@ -470,20 +409,10 @@ spec: - name: fedora-messaging-crt-volume secret: secretName: fedora-messaging-crt - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - sender-matrix - from: - kind: ImageStreamTag - name: fmn:latest --- # Redis, for caching -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: name: redis labels: @@ -492,13 +421,16 @@ metadata: spec: replicas: 1 selector: - app: fmn - deploymentconfig: redis + matchLabels: + app: fmn + strategy: {} template: metadata: labels: app: fmn - deploymentconfig: redis + service: redis + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"redis:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"redis\")].image"}]' spec: containers: - name: redis @@ -509,20 +441,10 @@ spec: secretKeyRef: name: fmn key: redis-password - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - redis - from: - kind: ImageStreamTag - name: redis:latest --- # Collectd stats collector -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: name: collectd labels: @@ -530,19 +452,20 @@ metadata: spec: replicas: 1 selector: - app: fmn - deploymentconfig: collectd + matchLabels: + app: fmn strategy: type: Recreate template: metadata: - creationTimestamp: null labels: app: fmn - deploymentconfig: collectd + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"collectd\")].image"}]' spec: containers: - name: collectd + image: image-registry.openshift-image-registry.svc:5000/fmn/fmn:latest imagePullPolicy: Always volumeMounts: - name: etc-fmn @@ -561,26 +484,15 @@ spec: secretKeyRef: name: fmn key: cache-hash-key - volumes: - name: etc-fmn configMap: name: fmn - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - collectd - from: - kind: ImageStreamTag - name: fmn:latest --- # Sendria, to display email notifications in staging {% if env == 'staging' %} -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: labels: app: fmn @@ -589,15 +501,17 @@ metadata: spec: replicas: 1 selector: - app: fmn - deploymentconfig: sendria + matchLabels: + app: fmn strategy: type: Recreate template: metadata: labels: app: fmn - deploymentconfig: sendria + service: sendria + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"sendria:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"sendria\")].image"}]' spec: containers: - name: sendria @@ -623,14 +537,4 @@ spec: volumes: - name: data emptyDir: {} - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - sendria - from: - kind: ImageStreamTag - name: sendria:latest {% endif %} From 23f3a62dda5631e38473314b222c56e6538988ac Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 1 May 2026 12:18:07 -0700 Subject: [PATCH 114/151] fmn: adjust selectors and labels Signed-off-by: Kevin Fenzi --- roles/openshift-apps/fmn/files/service.yml | 12 ++++++++---- .../fmn/templates/deployment.yml.j2 | 18 +++++++++++++++++- 2 files changed, 25 insertions(+), 5 deletions(-) diff --git a/roles/openshift-apps/fmn/files/service.yml b/roles/openshift-apps/fmn/files/service.yml index 90ab120db1..c829b884f4 100644 --- a/roles/openshift-apps/fmn/files/service.yml +++ b/roles/openshift-apps/fmn/files/service.yml @@ -5,6 +5,7 @@ metadata: name: frontend labels: app: fmn + service: frontend spec: ports: - name: web @@ -12,7 +13,7 @@ spec: targetPort: 8080 selector: app: fmn - deployment: frontend + service: frontend --- apiVersion: v1 kind: Service @@ -20,6 +21,7 @@ metadata: name: api labels: app: fmn + service: api spec: ports: - name: web @@ -27,7 +29,7 @@ spec: targetPort: 8080 selector: app: fmn - deployment: api + service: api --- apiVersion: v1 kind: Service @@ -35,6 +37,7 @@ metadata: name: sendria labels: app: fmn + service: sendria spec: ports: - name: web @@ -45,7 +48,7 @@ spec: targetPort: 1025 selector: app: fmn - deployment: sendria + service: sendria --- apiVersion: v1 kind: Service @@ -53,6 +56,7 @@ metadata: name: redis labels: app: fmn + service: redis spec: ports: - name: redis @@ -61,4 +65,4 @@ spec: targetPort: 6379 selector: app: fmn - deployment: redis + service: redis diff --git a/roles/openshift-apps/fmn/templates/deployment.yml.j2 b/roles/openshift-apps/fmn/templates/deployment.yml.j2 index bdb928724a..85c941336e 100644 --- a/roles/openshift-apps/fmn/templates/deployment.yml.j2 +++ b/roles/openshift-apps/fmn/templates/deployment.yml.j2 @@ -6,11 +6,13 @@ metadata: name: frontend labels: app: fmn + service: frontend spec: replicas: 1 selector: matchLabels: app: fmn + service: frontend strategy: type: RollingUpdate rollingUpdate: @@ -58,11 +60,13 @@ metadata: name: api labels: app: fmn + service: api spec: replicas: 1 selector: matchLabels: app: fmn + service: api strategy: type: RollingUpdate rollingUpdate: @@ -160,14 +164,16 @@ spec: apiVersion: apps/v1 kind: Deployment metadata: - name: consumer + name: fmn labels: app: fmn + service consumer spec: replicas: 1 selector: matchLabels: app: fmn + service: consumer strategy: type: Recreate template: @@ -252,11 +258,13 @@ metadata: name: sender-email labels: app: fmn + service: sender-email spec: replicas: 1 selector: matchLabels: app: fmn + service: sender-email strategy: type: Recreate template: @@ -307,11 +315,13 @@ metadata: name: sender-irc labels: app: fmn + service: sender-irc spec: replicas: {{ (env == 'production')|ternary('1', '0') }} selector: matchLabels: app: fmn + service: sender-irc strategy: type: Recreate template: @@ -362,11 +372,13 @@ metadata: name: sender-matrix labels: app: fmn + service: sender-matrix spec: replicas: 1 selector: matchLabels: app: fmn + service: sender-matrix strategy: type: Recreate template: @@ -423,6 +435,7 @@ spec: selector: matchLabels: app: fmn + service: redis strategy: {} template: metadata: @@ -449,11 +462,13 @@ metadata: name: collectd labels: app: fmn + service: collectd spec: replicas: 1 selector: matchLabels: app: fmn + service: collectd strategy: type: Recreate template: @@ -503,6 +518,7 @@ spec: selector: matchLabels: app: fmn + service: sendria strategy: type: Recreate template: From 89fc83945d23da7150fef1adee856e86cee8e273 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 1 May 2026 12:23:33 -0700 Subject: [PATCH 115/151] fmn: switch to more generic label instead of service Signed-off-by: Kevin Fenzi --- roles/openshift-apps/fmn/files/service.yml | 16 ++++---- .../fmn/templates/deployment.yml.j2 | 40 +++++++++---------- 2 files changed, 28 insertions(+), 28 deletions(-) diff --git a/roles/openshift-apps/fmn/files/service.yml b/roles/openshift-apps/fmn/files/service.yml index c829b884f4..ee15e36ddc 100644 --- a/roles/openshift-apps/fmn/files/service.yml +++ b/roles/openshift-apps/fmn/files/service.yml @@ -5,7 +5,7 @@ metadata: name: frontend labels: app: fmn - service: frontend + component: frontend spec: ports: - name: web @@ -13,7 +13,7 @@ spec: targetPort: 8080 selector: app: fmn - service: frontend + component: frontend --- apiVersion: v1 kind: Service @@ -21,7 +21,7 @@ metadata: name: api labels: app: fmn - service: api + component: api spec: ports: - name: web @@ -29,7 +29,7 @@ spec: targetPort: 8080 selector: app: fmn - service: api + component: api --- apiVersion: v1 kind: Service @@ -37,7 +37,7 @@ metadata: name: sendria labels: app: fmn - service: sendria + component: sendria spec: ports: - name: web @@ -48,7 +48,7 @@ spec: targetPort: 1025 selector: app: fmn - service: sendria + component: sendria --- apiVersion: v1 kind: Service @@ -56,7 +56,7 @@ metadata: name: redis labels: app: fmn - service: redis + component: redis spec: ports: - name: redis @@ -65,4 +65,4 @@ spec: targetPort: 6379 selector: app: fmn - service: redis + component: redis diff --git a/roles/openshift-apps/fmn/templates/deployment.yml.j2 b/roles/openshift-apps/fmn/templates/deployment.yml.j2 index 85c941336e..4cde43ada2 100644 --- a/roles/openshift-apps/fmn/templates/deployment.yml.j2 +++ b/roles/openshift-apps/fmn/templates/deployment.yml.j2 @@ -6,13 +6,13 @@ metadata: name: frontend labels: app: fmn - service: frontend + component: frontend spec: replicas: 1 selector: matchLabels: app: fmn - service: frontend + component: frontend strategy: type: RollingUpdate rollingUpdate: @@ -60,13 +60,13 @@ metadata: name: api labels: app: fmn - service: api + component: api spec: replicas: 1 selector: matchLabels: app: fmn - service: api + component: api strategy: type: RollingUpdate rollingUpdate: @@ -167,13 +167,13 @@ metadata: name: fmn labels: app: fmn - service consumer + component consumer spec: replicas: 1 selector: matchLabels: app: fmn - service: consumer + component: consumer strategy: type: Recreate template: @@ -258,13 +258,13 @@ metadata: name: sender-email labels: app: fmn - service: sender-email + component: sender-email spec: replicas: 1 selector: matchLabels: app: fmn - service: sender-email + component: sender-email strategy: type: Recreate template: @@ -315,13 +315,13 @@ metadata: name: sender-irc labels: app: fmn - service: sender-irc + component: sender-irc spec: replicas: {{ (env == 'production')|ternary('1', '0') }} selector: matchLabels: app: fmn - service: sender-irc + component: sender-irc strategy: type: Recreate template: @@ -372,13 +372,13 @@ metadata: name: sender-matrix labels: app: fmn - service: sender-matrix + component: sender-matrix spec: replicas: 1 selector: matchLabels: app: fmn - service: sender-matrix + component: sender-matrix strategy: type: Recreate template: @@ -429,19 +429,19 @@ metadata: name: redis labels: app: fmn - service: redis + component: redis spec: replicas: 1 selector: matchLabels: app: fmn - service: redis + component: redis strategy: {} template: metadata: labels: app: fmn - service: redis + component: redis annotations: image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"redis:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"redis\")].image"}]' spec: @@ -462,13 +462,13 @@ metadata: name: collectd labels: app: fmn - service: collectd + component: collectd spec: replicas: 1 selector: matchLabels: app: fmn - service: collectd + component: collectd strategy: type: Recreate template: @@ -511,21 +511,21 @@ kind: Deployment metadata: labels: app: fmn - service: sendria + component: sendria name: sendria spec: replicas: 1 selector: matchLabels: app: fmn - service: sendria + component: sendria strategy: type: Recreate template: metadata: labels: app: fmn - service: sendria + component: sendria annotations: image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"sendria:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"sendria\")].image"}]' spec: From 447c746a803ebeca8c1a7ca7938a022c42ab068a Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 1 May 2026 12:30:34 -0700 Subject: [PATCH 116/151] fmn: fix some more labels Signed-off-by: Kevin Fenzi --- roles/openshift-apps/fmn/templates/deployment.yml.j2 | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/roles/openshift-apps/fmn/templates/deployment.yml.j2 b/roles/openshift-apps/fmn/templates/deployment.yml.j2 index 4cde43ada2..d3d6f17dd2 100644 --- a/roles/openshift-apps/fmn/templates/deployment.yml.j2 +++ b/roles/openshift-apps/fmn/templates/deployment.yml.j2 @@ -22,6 +22,7 @@ spec: metadata: labels: app: fmn + component: frontend annotations: image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"frontend\")].image"}]' spec: @@ -76,6 +77,7 @@ spec: metadata: labels: app: fmn + component: api annotations: image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"api\")].image"}]' spec: @@ -167,7 +169,7 @@ metadata: name: fmn labels: app: fmn - component consumer + component: consumer spec: replicas: 1 selector: @@ -180,6 +182,7 @@ spec: metadata: labels: app: fmn + component: consumer annotations: image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"consumer\")].image"}]' spec: @@ -271,6 +274,7 @@ spec: metadata: labels: app: fmn + component: sender-email annotations: image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"sender-email\")].image"}]' spec: @@ -328,6 +332,7 @@ spec: metadata: labels: app: fmn + component: sender-irc annotations: image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"sender-irc\")].image"}]' spec: @@ -385,6 +390,7 @@ spec: metadata: labels: app: fmn + component: sender-matrix annotations: image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"sender-matrix\")].image"}]' spec: @@ -475,6 +481,7 @@ spec: metadata: labels: app: fmn + component: collectd annotations: image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"collectd\")].image"}]' spec: From b2483df5f6397fdab60970ae93d424fa6d116d21 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 1 May 2026 12:33:45 -0700 Subject: [PATCH 117/151] fmn: specify local image for sendria Signed-off-by: Kevin Fenzi --- roles/openshift-apps/fmn/templates/deployment.yml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/fmn/templates/deployment.yml.j2 b/roles/openshift-apps/fmn/templates/deployment.yml.j2 index d3d6f17dd2..e94a9c2747 100644 --- a/roles/openshift-apps/fmn/templates/deployment.yml.j2 +++ b/roles/openshift-apps/fmn/templates/deployment.yml.j2 @@ -538,7 +538,7 @@ spec: spec: containers: - name: sendria - image: sendria:latest + image: image-registry.openshift-image-registry.svc:5000/fmn/sendria:latest ports: - containerPort: 1025 - containerPort: 1080 From eb71459da1fcefe503a90e9dab9aab5e38e424b1 Mon Sep 17 00:00:00 2001 From: Pedro Moura Date: Thu, 23 Apr 2026 17:22:21 -0300 Subject: [PATCH 118/151] release-monitoring: fix deployment reference Signed-off-by: Pedro Moura --- playbooks/openshift-apps/release-monitoring.yml | 4 ++-- roles/openshift-apps/release-monitoring/files/service.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/playbooks/openshift-apps/release-monitoring.yml b/playbooks/openshift-apps/release-monitoring.yml index e9a1e7a377..a7d3e54376 100644 --- a/playbooks/openshift-apps/release-monitoring.yml +++ b/playbooks/openshift-apps/release-monitoring.yml @@ -63,8 +63,8 @@ object_objectname: route.yml - role: openshift/object object_app: release-monitoring - object_template: deploymentconfig.yml.j2 - object_objectname: deploymentconfig.yml + object_template: deployment.yml.j2 + object_objectname: deployment.yml - role: openshift/rollout rollout_app: release-monitoring rollout_dcname: release-monitoring-web diff --git a/roles/openshift-apps/release-monitoring/files/service.yml b/roles/openshift-apps/release-monitoring/files/service.yml index d0d778e155..831f6c97f4 100644 --- a/roles/openshift-apps/release-monitoring/files/service.yml +++ b/roles/openshift-apps/release-monitoring/files/service.yml @@ -13,4 +13,4 @@ spec: port: 8080 targetPort: 8080 selector: - deploymentconfig: release-monitoring-web + deployment: release-monitoring-web From d68317c6a4ecb500b079664dba209b03cb2d4981 Mon Sep 17 00:00:00 2001 From: Pedro Moura Date: Thu, 23 Apr 2026 17:54:01 -0300 Subject: [PATCH 119/151] release-monitoring: moved deploymentconfig.yml to deployment.yml Signed-off-by: Pedro Moura --- .../templates/deployment.yml.j2 | 168 +++++++++++++++ .../templates/deploymentconfig.yml.j2 | 198 ------------------ 2 files changed, 168 insertions(+), 198 deletions(-) create mode 100644 roles/openshift-apps/release-monitoring/templates/deployment.yml.j2 delete mode 100644 roles/openshift-apps/release-monitoring/templates/deploymentconfig.yml.j2 diff --git a/roles/openshift-apps/release-monitoring/templates/deployment.yml.j2 b/roles/openshift-apps/release-monitoring/templates/deployment.yml.j2 new file mode 100644 index 0000000000..03e1db04ff --- /dev/null +++ b/roles/openshift-apps/release-monitoring/templates/deployment.yml.j2 @@ -0,0 +1,168 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: release-monitoring-web + service: web + name: release-monitoring-web +spec: + replicas: 1 + selector: + matchLabels: + app: release-monitoring-web + strategy: + type: Recreate + template: + metadata: + labels: + app: release-monitoring-web + service: web + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"release-monitoring-web:latest","namespace":"release-monitoring"},"fieldPath":"spec.template.spec.containers[?(@.name==\"release-monitoring-web\")].image"}]' + spec: + initContainers: + - name: alembic-upgrade + image: image-registry.openshift-image-registry.svc:5000/release-monitoring/release-monitoring-web:latest + command: ["/usr/bin/python3", "-m", "alembic", "-c", "/etc/anitya/alembic.ini", "upgrade", "head"] + volumeMounts: + - name: config-volume + mountPath: /etc/anitya + readOnly: true + containers: + - name: release-monitoring-web + image: image-registry.openshift-image-registry.svc:5000/release-monitoring/release-monitoring-web:latest + command: ["bash"] + args: ["/etc/anitya/start.sh"] + env: + - name: ANITYA_WEB_CONFIG + value: /etc/anitya/anitya.toml + ports: + - containerPort: 8080 + resources: {} + volumeMounts: + - name: config-volume + mountPath: /etc/anitya + readOnly: true + - name: fedora-messaging-config-volume + mountPath: /etc/fedora-messaging + readOnly: true + - name: fedora-messaging-ca-volume + mountPath: /etc/pki/rabbitmq/ca + readOnly: true + - name: fedora-messaging-key-volume + mountPath: /etc/pki/rabbitmq/key + readOnly: true + - name: fedora-messaging-cert-volume + mountPath: /etc/pki/rabbitmq/cert + readOnly: true + readinessProbe: + timeoutSeconds: 10 + initialDelaySeconds: 15 + httpGet: + path: / + port: 8080 + livenessProbe: + timeoutSeconds: 10 + initialDelaySeconds: 30 + httpGet: + path: / + port: 8080 + volumes: + - name: config-volume + configMap: + name: release-monitoring-configmap + - name: fedora-messaging-config-volume + configMap: + name: fedora-messaging-configmap + - name: fedora-messaging-ca-volume + secret: + secretName: release-monitoring-fedora-messaging-ca + - name: fedora-messaging-key-volume + secret: + secretName: release-monitoring-fedora-messaging-key + - name: fedora-messaging-cert-volume + secret: + secretName: release-monitoring-fedora-messaging-cert +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: release-monitoring-check-service + service: web + name: release-monitoring-check-service +spec: +{% if env == 'staging' %} + replicas: 0 +{% else %} + replicas: 1 +{% endif %} + selector: + matchLabels: + app: release-monitoring-check-service + strategy: + type: Recreate + template: + metadata: + labels: + app: release-monitoring-check-service + service: web + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"release-monitoring-web:latest","namespace":"release-monitoring"},"fieldPath":"spec.template.spec.containers[?(@.name==\"release-monitoring-web\")].image"}]' + spec: + initContainers: + - name: alembic-check + image: image-registry.openshift-image-registry.svc:5000/release-monitoring/release-monitoring-web:latest + command: ["/bin/bash", "-c"] + args: + - | + python3 -m alembic -c /etc/anitya/alembic.ini current | grep '(head)' + env: + - name: ANITYA_WEB_CONFIG + value: /etc/anitya/anitya.toml + volumeMounts: + - name: config-volume + mountPath: /etc/anitya + readOnly: true + containers: + - name: release-monitoring-web + image: image-registry.openshift-image-registry.svc:5000/release-monitoring/release-monitoring-web:latest + command: ["python3"] + args: ["/usr/local/bin/check_service"] + env: + - name: ANITYA_WEB_CONFIG + value: /etc/anitya/anitya.toml + resources: {} + volumeMounts: + - name: config-volume + mountPath: /etc/anitya + readOnly: true + - name: fedora-messaging-config-volume + mountPath: /etc/fedora-messaging + readOnly: true + - name: fedora-messaging-ca-volume + mountPath: /etc/pki/rabbitmq/ca + readOnly: true + - name: fedora-messaging-key-volume + mountPath: /etc/pki/rabbitmq/key + readOnly: true + - name: fedora-messaging-cert-volume + mountPath: /etc/pki/rabbitmq/cert + readOnly: true + volumes: + - name: config-volume + configMap: + name: release-monitoring-configmap + - name: fedora-messaging-config-volume + configMap: + name: fedora-messaging-configmap + - name: fedora-messaging-ca-volume + secret: + secretName: release-monitoring-fedora-messaging-ca + - name: fedora-messaging-key-volume + secret: + secretName: release-monitoring-fedora-messaging-key + - name: fedora-messaging-cert-volume + secret: + secretName: release-monitoring-fedora-messaging-cert diff --git a/roles/openshift-apps/release-monitoring/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/release-monitoring/templates/deploymentconfig.yml.j2 deleted file mode 100644 index dab3f952a9..0000000000 --- a/roles/openshift-apps/release-monitoring/templates/deploymentconfig.yml.j2 +++ /dev/null @@ -1,198 +0,0 @@ ---- -apiVersion: apps.openshift.io/v1 -items: -- apiVersion: apps.openshift.io/v1 - kind: DeploymentConfig - metadata: - labels: - app: release-monitoring-web - service: web - name: release-monitoring-web - spec: - replicas: 1 - selector: - deploymentconfig: release-monitoring-web - strategy: - activeDeadlineSeconds: 900 - recreateParams: - timeoutSeconds: 600 - mid: - failurePolicy: Abort - execNewPod: - containerName: release-monitoring-web - command: ["/usr/bin/python3", "-m", "alembic", "-c", "/etc/anitya/alembic.ini", "upgrade", "head"] - volumes: - - config-volume - resources: {} - type: Recreate - template: - metadata: - creationTimestamp: null - labels: - app: release-monitoring-web - deploymentconfig: release-monitoring-web - spec: - containers: - - name: release-monitoring-web - image: release-monitoring/release-monitoring-web:latest - command: - - bash - args: - - /etc/anitya/start.sh - env: - - name: ANITYA_WEB_CONFIG - value: /etc/anitya/anitya.toml - ports: - - containerPort: 8080 - resources: {} - volumeMounts: - - name: config-volume - mountPath: /etc/anitya - readOnly: true - - name: fedora-messaging-config-volume - mountPath: /etc/fedora-messaging - readOnly: true - - name: fedora-messaging-ca-volume - mountPath: /etc/pki/rabbitmq/ca - readOnly: true - - name: fedora-messaging-key-volume - mountPath: /etc/pki/rabbitmq/key - readOnly: true - - name: fedora-messaging-cert-volume - mountPath: /etc/pki/rabbitmq/cert - readOnly: true - readinessProbe: - timeoutSeconds: 10 - initialDelaySeconds: 15 - httpGet: - path: / - port: 8080 - livenessProbe: - timeoutSeconds: 10 - initialDelaySeconds: 30 - httpGet: - path: / - port: 8080 - volumes: - - name: config-volume - configMap: - name: release-monitoring-configmap - - name: fedora-messaging-config-volume - configMap: - name: fedora-messaging-configmap - - name: fedora-messaging-ca-volume - secret: - secretName: release-monitoring-fedora-messaging-ca - - name: fedora-messaging-key-volume - secret: - secretName: release-monitoring-fedora-messaging-key - - name: fedora-messaging-cert-volume - secret: - secretName: release-monitoring-fedora-messaging-cert - triggers: - - imageChangeParams: - automatic: true - containerNames: - - release-monitoring-web - from: - kind: ImageStreamTag - name: release-monitoring-web:latest - namespace: release-monitoring - type: ImageChange -- apiVersion: apps.openshift.io/v1 - kind: DeploymentConfig - metadata: - labels: - app: release-monitoring-check-service - service: web - name: release-monitoring-check-service - spec: -{% if env == 'staging' %} - replicas: 0 -{% else %} - replicas: 1 -{% endif %} - selector: - deploymentconfig: release-monitoring-check-service - strategy: - activeDeadlineSeconds: 900 - recreateParams: - timeoutSeconds: 30 - mid: - failurePolicy: Retry - execNewPod: - containerName: release-monitoring-web - command: - - /bin/bash - - -c - - | - python3 -m alembic -c /etc/anitya/alembic.ini current | grep '(head)' - env: - - name: ANITYA_WEB_CONFIG - value: /etc/anitya/anitya.toml - volumes: - - config-volume - resources: {} - type: Recreate - template: - metadata: - creationTimestamp: null - labels: - app: release-monitoring-check-service - deploymentconfig: release-monitoring-check-service - spec: - containers: - - name: release-monitoring-web - image: release-monitoring/release-monitoring-web:latest - command: - - python3 - args: - - /usr/local/bin/check_service - env: - - name: ANITYA_WEB_CONFIG - value: /etc/anitya/anitya.toml - resources: {} - volumeMounts: - - name: config-volume - mountPath: /etc/anitya - readOnly: true - - name: fedora-messaging-config-volume - mountPath: /etc/fedora-messaging - readOnly: true - - name: fedora-messaging-ca-volume - mountPath: /etc/pki/rabbitmq/ca - readOnly: true - - name: fedora-messaging-key-volume - mountPath: /etc/pki/rabbitmq/key - readOnly: true - - name: fedora-messaging-cert-volume - mountPath: /etc/pki/rabbitmq/cert - readOnly: true - volumes: - - name: config-volume - configMap: - name: release-monitoring-configmap - - name: fedora-messaging-config-volume - configMap: - name: fedora-messaging-configmap - - name: fedora-messaging-ca-volume - secret: - secretName: release-monitoring-fedora-messaging-ca - - name: fedora-messaging-key-volume - secret: - secretName: release-monitoring-fedora-messaging-key - - name: fedora-messaging-cert-volume - secret: - secretName: release-monitoring-fedora-messaging-cert - triggers: - - imageChangeParams: - automatic: true - containerNames: - - release-monitoring-web - from: - kind: ImageStreamTag - name: release-monitoring-web:latest - namespace: release-monitoring - type: ImageChange -kind: List -metadata: {} From 3c46c0c543c8beea8af817eabdc5ea98bfebd4c9 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 1 May 2026 12:46:03 -0700 Subject: [PATCH 120/151] release-monitoring: fix selector for web Signed-off-by: Kevin Fenzi --- roles/openshift-apps/release-monitoring/files/service.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/release-monitoring/files/service.yml b/roles/openshift-apps/release-monitoring/files/service.yml index 831f6c97f4..2f3499b0c5 100644 --- a/roles/openshift-apps/release-monitoring/files/service.yml +++ b/roles/openshift-apps/release-monitoring/files/service.yml @@ -13,4 +13,4 @@ spec: port: 8080 targetPort: 8080 selector: - deployment: release-monitoring-web + service: web From d574d284337f582707aef1354a9a989fdb2b82af Mon Sep 17 00:00:00 2001 From: James Antill Date: Sat, 2 May 2026 11:30:45 -0400 Subject: [PATCH 121/151] people: Use our rsyslog-logrotate to compress, anubis msgs ftw. Signed-off-by: James Antill --- roles/people/files/rsyslog-logrotate | 17 +++++++++++++++++ roles/people/tasks/main.yml | 11 +++++++++++ 2 files changed, 28 insertions(+) create mode 100644 roles/people/files/rsyslog-logrotate diff --git a/roles/people/files/rsyslog-logrotate b/roles/people/files/rsyslog-logrotate new file mode 100644 index 0000000000..8804bce6cc --- /dev/null +++ b/roles/people/files/rsyslog-logrotate @@ -0,0 +1,17 @@ +/var/log/cron +/var/log/maillog +/var/log/messages +/var/log/secure +/var/log/spooler +{ + missingok + sharedscripts + postrotate + /usr/bin/systemctl reload rsyslog.service >/dev/null 2>&1 || true + endscript + compress + compresscmd /usr/bin/xz + uncompresscmd /usr/bin/xz + compressext .xz + dateext +} diff --git a/roles/people/tasks/main.yml b/roles/people/tasks/main.yml index 7d2834968b..7d6386edd9 100644 --- a/roles/people/tasks/main.yml +++ b/roles/people/tasks/main.yml @@ -308,3 +308,14 @@ - config notify: - Restart sssd + +# We don't have much space on / and anubis makes messages big, default +# doesn't compress rotations and this does. +- name: People log rotate + ansible.builtin.copy: src=rsyslog-logrotate dest=/etc/logrotate.d/rsyslog mode=0644 + notify: + - Restart rsyslog + tags: + - rsyslogd + - config + - base From 11a7d7adf0816f6a143b2ebf2de4c7eabc50d384 Mon Sep 17 00:00:00 2001 From: Pedro Moura Date: Wed, 29 Apr 2026 18:26:03 -0300 Subject: [PATCH 122/151] noggin: fix deployment reference in noggin-centos playbook Signed-off-by: Pedro Moura --- playbooks/openshift-apps/noggin-centos.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/playbooks/openshift-apps/noggin-centos.yml b/playbooks/openshift-apps/noggin-centos.yml index 4c1314007e..8f15a924dd 100644 --- a/playbooks/openshift-apps/noggin-centos.yml +++ b/playbooks/openshift-apps/noggin-centos.yml @@ -103,8 +103,8 @@ - role: openshift/object object_app: noggin object_os_app: noggin-centos - object_template: deploymentconfig.yml.j2 - object_objectname: deploymentconfig.yml + object_template: deployment.yml.j2 + object_objectname: deployment.yml - role: openshift/start-build start_build_app: noggin-centos From b5de39dc82c182fe39fd4db0d38347e9375b54aa Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sat, 2 May 2026 09:39:58 -0700 Subject: [PATCH 123/151] noggin-centos / noggin: use object_os_app name for image stream namespace for nogin vs nogin-centos Signed-off-by: Kevin Fenzi --- playbooks/openshift-apps/noggin.yml | 1 + roles/openshift-apps/noggin/templates/deployment.yml.j2 | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/playbooks/openshift-apps/noggin.yml b/playbooks/openshift-apps/noggin.yml index f111877419..1bb8fac8db 100644 --- a/playbooks/openshift-apps/noggin.yml +++ b/playbooks/openshift-apps/noggin.yml @@ -98,6 +98,7 @@ - role: openshift/object object_app: noggin + object_os_app: noggin object_template: deployment.yml.j2 object_objectname: deployment.yml diff --git a/roles/openshift-apps/noggin/templates/deployment.yml.j2 b/roles/openshift-apps/noggin/templates/deployment.yml.j2 index 6309870ca1..2b998bd2dd 100644 --- a/roles/openshift-apps/noggin/templates/deployment.yml.j2 +++ b/roles/openshift-apps/noggin/templates/deployment.yml.j2 @@ -24,7 +24,7 @@ spec: spec: containers: - name: noggin - image: image-registry.openshift-image-registry.svc:5000/noggin/noggin:latest + image: image-registry.openshift-image-registry.svc:5000/{{ object_os_app }}/noggin:latest imagePullPolicy: Always ports: - containerPort: 8080 From 36218c17e28845634216475cd91bfd771563b250 Mon Sep 17 00:00:00 2001 From: Pedro Moura Date: Fri, 24 Apr 2026 17:56:24 -0300 Subject: [PATCH 124/151] bodhi: fix deployment reference Signed-off-by: Pedro Moura --- playbooks/openshift-apps/bodhi.yml | 4 ++-- roles/openshift-apps/bodhi/files/service.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/playbooks/openshift-apps/bodhi.yml b/playbooks/openshift-apps/bodhi.yml index eb933f6456..fc8ced553c 100644 --- a/playbooks/openshift-apps/bodhi.yml +++ b/playbooks/openshift-apps/bodhi.yml @@ -139,8 +139,8 @@ haproxy.router.openshift.io/timeout: 180s - role: openshift/object object_app: bodhi - object_template: deploymentconfig.yml.j2 - object_objectname: deploymentconfig.yml + object_template: deployment.yml.j2 + object_objectname: deployment.yml - role: openshift/object object_app: bodhi object_template: critpathcron.yml.j2 diff --git a/roles/openshift-apps/bodhi/files/service.yml b/roles/openshift-apps/bodhi/files/service.yml index 3f5fecedc3..058b1b681f 100644 --- a/roles/openshift-apps/bodhi/files/service.yml +++ b/roles/openshift-apps/bodhi/files/service.yml @@ -13,4 +13,4 @@ spec: port: 8080 targetPort: 8080 selector: - deploymentconfig: bodhi-web + deployment: bodhi-web From 1fa8aa6700fc32022b14eb5c78cc6514d7ff7750 Mon Sep 17 00:00:00 2001 From: Pedro Moura Date: Fri, 24 Apr 2026 18:02:18 -0300 Subject: [PATCH 125/151] bodhi: moved deploymentconfig.yml to deployment.yml Signed-off-by: Pedro Moura --- .../bodhi/templates/deployment.yml.j2 | 354 ++++++++++++++ .../bodhi/templates/deploymentconfig.yml.j2 | 436 ------------------ 2 files changed, 354 insertions(+), 436 deletions(-) create mode 100644 roles/openshift-apps/bodhi/templates/deployment.yml.j2 delete mode 100644 roles/openshift-apps/bodhi/templates/deploymentconfig.yml.j2 diff --git a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 new file mode 100644 index 0000000000..1da8e2a77f --- /dev/null +++ b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 @@ -0,0 +1,354 @@ +--- +# bodhi-web +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: bodhi + service: web + name: bodhi-web +spec: + replicas: {{ bodhi_openshift_pods }} + selector: + matchLabels: + app: bodhi-web + strategy: + type: Recreate + template: + metadata: + labels: + app: bodhi-web +{% if env == "staging" %} + monitoring-key: cpe +{% endif %} + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-base:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-web\")].image"}]' + spec: + initContainers: + - name: alembic-upgrade + image: bodhi-base:latest + command: ["/bin/sh", "-c"] + args: + - | + (/usr/bin/alembic-3 -c /etc/bodhi/alembic.ini current | grep -q "(head)") || ( cd /etc/bodhi && /usr/bin/alembic-3 -c /etc/bodhi/alembic.ini upgrade head) + volumeMounts: + - name: config-volume + mountPath: /etc/bodhi + readOnly: true + containers: + - name: bodhi-web + image: bodhi-base:latest + command: ["gunicorn"] + args: ["--paste", "/etc/bodhi/production.ini", "-b", "0.0.0.0:8080", "-w", "4", "--log-level", "DEBUG", "-k", "gthread", "--threads", "2", "--log-file=-"] + ports: + - containerPort: 8080 + name: web + resources: {} + volumeMounts: + - name: config-volume + mountPath: /etc/bodhi + readOnly: true + - name: bodhi-critpath-storage + mountPath: /etc/bodhi/critpath + readOnly: true + - name: keytab-volume + mountPath: /etc/keytabs + readOnly: true + - name: httpdir-volume + mountPath: /httpdir + - name: fedora-messaging-config-volume + mountPath: /etc/fedora-messaging + readOnly: true + - name: fedora-messaging-ca-volume + mountPath: /etc/pki/fedora-messaging/cacert.pem + subPath: cacert.pem + readOnly: true + - name: fedora-messaging-crt-volume + mountPath: /etc/pki/fedora-messaging/bodhi-cert.pem + subPath: bodhi-cert.pem + readOnly: true + - name: fedora-messaging-key-volume + mountPath: /etc/pki/fedora-messaging/bodhi-key.pem + subPath: bodhi-key.pem + readOnly: true + readinessProbe: + timeoutSeconds: 10 + initialDelaySeconds: 5 + periodSeconds: 60 + httpGet: + path: /healthz/ready + port: 8080 + livenessProbe: + timeoutSeconds: 60 + initialDelaySeconds: 30 + periodSeconds: 120 + failureThreshold: 5 + httpGet: + path: /healthz/live + port: 8080 + volumes: + - name: config-volume + configMap: + name: bodhi-configmap + - name: bodhi-critpath-storage + persistentVolumeClaim: + claimName: "bodhi-critpath-storage" + - name: keytab-volume + secret: + secretName: bodhi-keytab + - name: httpdir-volume + emptyDir: {} + - name: fedora-messaging-config-volume + configMap: + name: fedora-messaging-configmap + - name: fedora-messaging-ca-volume + secret: + secretName: bodhi-fedora-messaging-ca + - name: fedora-messaging-crt-volume + secret: + secretName: bodhi-fedora-messaging-crt + - name: fedora-messaging-key-volume + secret: + secretName: bodhi-fedora-messaging-key +--- +# bodhi-consumer +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: bodhi + service: consumer + name: bodhi-consumer +spec: +{% if env == 'staging' %} + replicas: {{ bodhi_openshift_pods_stg_consumers }} +{% else %} + replicas: {{ bodhi_openshift_pods }} +{% endif %} + selector: + matchLabels: + app: bodhi-consumer + strategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 25% + maxUnavailable: 25% + template: + metadata: + labels: + app: bodhi-consumer + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-base:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-consumer\")].image"}]' + spec: + containers: + - name: bodhi-consumer + image: bodhi-base:latest + command: ["/usr/bin/fedora-messaging"] + args: ["consume"] + resources: {} + volumeMounts: + - name: config-volume + mountPath: /etc/bodhi + readOnly: true + - name: bodhi-critpath-storage + mountPath: /etc/bodhi/critpath + readOnly: true + - name: keytab-volume + mountPath: /etc/keytabs + readOnly: true + - name: fedora-messaging-config-volume + mountPath: /etc/fedora-messaging + readOnly: true + - name: fedora-messaging-ca-volume + mountPath: /etc/pki/fedora-messaging/cacert.pem + subPath: cacert.pem + readOnly: true + - name: fedora-messaging-crt-volume + mountPath: /etc/pki/fedora-messaging/bodhi-cert.pem + subPath: bodhi-cert.pem + readOnly: true + - name: fedora-messaging-key-volume + mountPath: /etc/pki/fedora-messaging/bodhi-key.pem + subPath: bodhi-key.pem + readOnly: true + volumes: + - name: config-volume + configMap: + name: bodhi-configmap + - name: bodhi-critpath-storage + persistentVolumeClaim: + claimName: "bodhi-critpath-storage" + - name: keytab-volume + secret: + secretName: bodhi-keytab + - name: fedora-messaging-config-volume + configMap: + name: fedora-messaging-configmap + - name: fedora-messaging-ca-volume + secret: + secretName: bodhi-fedora-messaging-ca + - name: fedora-messaging-crt-volume + secret: + secretName: bodhi-fedora-messaging-crt + - name: fedora-messaging-key-volume + secret: + secretName: bodhi-fedora-messaging-key +--- +# bodhi-celery +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: bodhi + service: celery + name: bodhi-celery +spec: + replicas: {{ bodhi_openshift_pods }} + selector: + matchLabels: + app: bodhi-celery + strategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 25% + maxUnavailable: 25% + template: + metadata: + labels: + app: bodhi-celery + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-base:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-celery\")].image"}]' + spec: + containers: + - name: bodhi-celery + image: bodhi-base:latest + command: ["/usr/bin/celery"] + args: ["-A", "bodhi.server.tasks.app", "worker", "-l", "info", "-Q", "celery"] + resources: {} + volumeMounts: + - name: config-volume + mountPath: /etc/bodhi + readOnly: true + - name: bodhi-critpath-storage + mountPath: /etc/bodhi/critpath + readOnly: true + - name: keytab-volume + mountPath: /etc/keytabs + readOnly: true + - name: fedora-messaging-config-volume + mountPath: /etc/fedora-messaging + readOnly: true + - name: fedora-messaging-ca-volume + mountPath: /etc/pki/fedora-messaging/cacert.pem + subPath: cacert.pem + readOnly: true + - name: fedora-messaging-crt-volume + mountPath: /etc/pki/fedora-messaging/bodhi-cert.pem + subPath: bodhi-cert.pem + readOnly: true + - name: fedora-messaging-key-volume + mountPath: /etc/pki/fedora-messaging/bodhi-key.pem + subPath: bodhi-key.pem + readOnly: true + volumes: + - name: config-volume + configMap: + name: bodhi-configmap + - name: bodhi-critpath-storage + persistentVolumeClaim: + claimName: "bodhi-critpath-storage" + - name: keytab-volume + secret: + secretName: bodhi-keytab + - name: fedora-messaging-config-volume + configMap: + name: fedora-messaging-configmap + - name: fedora-messaging-ca-volume + secret: + secretName: bodhi-fedora-messaging-ca + - name: fedora-messaging-crt-volume + secret: + secretName: bodhi-fedora-messaging-crt + - name: fedora-messaging-key-volume + secret: + secretName: bodhi-fedora-messaging-key +--- +# bodhi-celery-beat +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: bodhi + service: celery-beat + name: bodhi-celery-beat +spec: + replicas: 1 + selector: + matchLabels: + app: bodhi-celery-beat + strategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 25% + maxUnavailable: 25% + template: + metadata: + labels: + app: bodhi-celery-beat + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-base:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-celery-beat\")].image"}]' + spec: + containers: + - name: bodhi-celery-beat + image: bodhi-base:latest + workingDir: "/tmp" + command: ["/usr/bin/celery"] + args: ["-A", "bodhi.server.tasks.app", "beat", "-l", "info"] + resources: {} + volumeMounts: + - name: config-volume + mountPath: /etc/bodhi + readOnly: true + - name: bodhi-critpath-storage + mountPath: /etc/bodhi/critpath + readOnly: true + - name: keytab-volume + mountPath: /etc/keytabs + readOnly: true + - name: fedora-messaging-config-volume + mountPath: /etc/fedora-messaging + readOnly: true + - name: fedora-messaging-ca-volume + mountPath: /etc/pki/fedora-messaging/cacert.pem + subPath: cacert.pem + readOnly: true + - name: fedora-messaging-crt-volume + mountPath: /etc/pki/fedora-messaging/bodhi-cert.pem + subPath: bodhi-cert.pem + readOnly: true + - name: fedora-messaging-key-volume + mountPath: /etc/pki/fedora-messaging/bodhi-key.pem + subPath: bodhi-key.pem + readOnly: true + volumes: + - name: config-volume + configMap: + name: bodhi-configmap + - name: bodhi-critpath-storage + persistentVolumeClaim: + claimName: "bodhi-critpath-storage" + - name: keytab-volume + secret: + secretName: bodhi-keytab + - name: fedora-messaging-config-volume + configMap: + name: fedora-messaging-configmap + - name: fedora-messaging-ca-volume + secret: + secretName: bodhi-fedora-messaging-ca + - name: fedora-messaging-crt-volume + secret: + secretName: bodhi-fedora-messaging-crt + - name: fedora-messaging-key-volume + secret: + secretName: bodhi-fedora-messaging-key diff --git a/roles/openshift-apps/bodhi/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/bodhi/templates/deploymentconfig.yml.j2 deleted file mode 100644 index 16689e8000..0000000000 --- a/roles/openshift-apps/bodhi/templates/deploymentconfig.yml.j2 +++ /dev/null @@ -1,436 +0,0 @@ ---- -apiVersion: apps.openshift.io/v1 -items: -- apiVersion: apps.openshift.io/v1 - kind: DeploymentConfig - metadata: - labels: - app: bodhi - service: web - name: bodhi-web - spec: - replicas: {{ bodhi_openshift_pods }} - selector: - deploymentconfig: bodhi-web - strategy: - activeDeadlineSeconds: 21600 - recreateParams: - mid: - execNewPod: - command: - - /bin/sh - - '-c' - - >- - (/usr/bin/alembic-3 -c /etc/bodhi/alembic.ini current | grep -q - "(head)") || ( cd /etc/bodhi && /usr/bin/alembic-3 -c - /etc/bodhi/alembic.ini upgrade head) - containerName: bodhi-web - volumes: - - config-volume - failurePolicy: Abort - timeoutSeconds: 600 - resources: {} - type: Recreate - template: - metadata: - creationTimestamp: null - labels: - app: bodhi-web - deploymentconfig: bodhi-web -{% if env == "staging" %} - monitoring-key: cpe -{% endif %} - spec: - containers: - - name: bodhi-web - image: bodhi-base:latest - command: ["gunicorn"] - # Don't use --preload, it causes threading errors with Fedora Messaging on Python 3.13 - # https://github.com/fedora-infra/fedora-messaging/issues/431 - args: ["--paste", "/etc/bodhi/production.ini", "-b", "0.0.0.0:8080", "-w", "4", "--log-level", "DEBUG", "-k", "gthread", "--threads", "2", "--log-file=-"] - ports: - - containerPort: 8080 - name: web - resources: {} - volumeMounts: - - name: config-volume - mountPath: /etc/bodhi - readOnly: true - - name: bodhi-critpath-storage - mountPath: /etc/bodhi/critpath - readOnly: true - - name: keytab-volume - mountPath: /etc/keytabs - readOnly: true - - name: httpdir-volume - mountPath: /httpdir - - name: fedora-messaging-config-volume - mountPath: /etc/fedora-messaging - readOnly: true - - name: fedora-messaging-ca-volume - mountPath: /etc/pki/fedora-messaging/cacert.pem - subPath: cacert.pem - readOnly: true - - name: fedora-messaging-crt-volume - mountPath: /etc/pki/fedora-messaging/bodhi-cert.pem - subPath: bodhi-cert.pem - readOnly: true - - name: fedora-messaging-key-volume - mountPath: /etc/pki/fedora-messaging/bodhi-key.pem - subPath: bodhi-key.pem - readOnly: true - readinessProbe: - timeoutSeconds: 10 - initialDelaySeconds: 5 - periodSeconds: 60 - httpGet: - path: /healthz/ready - port: 8080 - livenessProbe: - timeoutSeconds: 60 - initialDelaySeconds: 30 - periodSeconds: 120 - failureThreshold: 5 - httpGet: - path: /healthz/live - port: 8080 - volumes: - - name: config-volume - configMap: - name: bodhi-configmap - - name: bodhi-critpath-storage - persistentVolumeClaim: - claimName: "bodhi-critpath-storage" - - name: keytab-volume - secret: - secretName: bodhi-keytab - - name: httpdir-volume - emptyDir: {} - - name: fedora-messaging-config-volume - configMap: - name: fedora-messaging-configmap - - name: fedora-messaging-ca-volume - secret: - secretName: bodhi-fedora-messaging-ca - - name: fedora-messaging-crt-volume - secret: - secretName: bodhi-fedora-messaging-crt - - name: fedora-messaging-key-volume - secret: - secretName: bodhi-fedora-messaging-key - triggers: - - imageChangeParams: - automatic: true - containerNames: - - bodhi-web - from: - kind: ImageStreamTag - name: bodhi-base:latest - namespace: bodhi - type: ImageChange - - type: ConfigChange -kind: List -metadata: {} ---- -apiVersion: apps.openshift.io/v1 -items: -- apiVersion: apps.openshift.io/v1 - kind: DeploymentConfig - metadata: - labels: - app: bodhi - service: consumer - name: bodhi-consumer - spec: -{% if env == 'staging' %} - replicas: {{ bodhi_openshift_pods_stg_consumers }} -{% else %} - replicas: {{ bodhi_openshift_pods }} -{% endif %} - selector: - deploymentconfig: bodhi-consumer - strategy: - activeDeadlineSeconds: 21600 - recreateParams: - timeoutSeconds: 600 - resources: {} - rollingParams: - intervalSeconds: 1 - maxSurge: 25% - maxUnavailable: 25% - timeoutSeconds: 600 - updatePeriodSeconds: 1 - type: Rolling - template: - metadata: - creationTimestamp: null - labels: - app: bodhi-consumer - deploymentconfig: bodhi-consumer - spec: - containers: - - name: bodhi-consumer - image: bodhi-base:latest - command: ["/usr/bin/fedora-messaging"] - args: ["consume"] - resources: {} - volumeMounts: - - name: config-volume - mountPath: /etc/bodhi - readOnly: true - - name: bodhi-critpath-storage - mountPath: /etc/bodhi/critpath - readOnly: true - - name: keytab-volume - mountPath: /etc/keytabs - readOnly: true - - name: fedora-messaging-config-volume - mountPath: /etc/fedora-messaging - readOnly: true - - name: fedora-messaging-ca-volume - mountPath: /etc/pki/fedora-messaging/cacert.pem - subPath: cacert.pem - readOnly: true - - name: fedora-messaging-crt-volume - mountPath: /etc/pki/fedora-messaging/bodhi-cert.pem - subPath: bodhi-cert.pem - readOnly: true - - name: fedora-messaging-key-volume - mountPath: /etc/pki/fedora-messaging/bodhi-key.pem - subPath: bodhi-key.pem - readOnly: true - volumes: - - name: config-volume - configMap: - name: bodhi-configmap - - name: bodhi-critpath-storage - persistentVolumeClaim: - claimName: "bodhi-critpath-storage" - - name: keytab-volume - secret: - secretName: bodhi-keytab - - name: fedora-messaging-config-volume - configMap: - name: fedora-messaging-configmap - - name: fedora-messaging-ca-volume - secret: - secretName: bodhi-fedora-messaging-ca - - name: fedora-messaging-crt-volume - secret: - secretName: bodhi-fedora-messaging-crt - - name: fedora-messaging-key-volume - secret: - secretName: bodhi-fedora-messaging-key - triggers: - - imageChangeParams: - automatic: true - containerNames: - - bodhi-consumer - from: - kind: ImageStreamTag - name: bodhi-base:latest - namespace: bodhi - type: ImageChange - - type: ConfigChange -kind: List -metadata: {} ---- -apiVersion: apps.openshift.io/v1 -items: -- apiVersion: apps.openshift.io/v1 - kind: DeploymentConfig - metadata: - labels: - app: bodhi - service: celery - name: bodhi-celery - spec: - replicas: {{ bodhi_openshift_pods }} - selector: - deploymentconfig: bodhi-celery - strategy: - activeDeadlineSeconds: 21600 - recreateParams: - timeoutSeconds: 600 - resources: {} - rollingParams: - intervalSeconds: 1 - maxSurge: 25% - maxUnavailable: 25% - timeoutSeconds: 600 - updatePeriodSeconds: 1 - type: Rolling - template: - metadata: - creationTimestamp: null - labels: - app: bodhi-celery - deploymentconfig: bodhi-celery - spec: - containers: - - name: bodhi-celery - image: bodhi-base:latest - command: ["/usr/bin/celery"] - args: ["-A", "bodhi.server.tasks.app", "worker", "-l", "info", "-Q", "celery"] - resources: {} - volumeMounts: - - name: config-volume - mountPath: /etc/bodhi - readOnly: true - - name: bodhi-critpath-storage - mountPath: /etc/bodhi/critpath - readOnly: true - - name: keytab-volume - mountPath: /etc/keytabs - readOnly: true - - name: fedora-messaging-config-volume - mountPath: /etc/fedora-messaging - readOnly: true - - name: fedora-messaging-ca-volume - mountPath: /etc/pki/fedora-messaging/cacert.pem - subPath: cacert.pem - readOnly: true - - name: fedora-messaging-crt-volume - mountPath: /etc/pki/fedora-messaging/bodhi-cert.pem - subPath: bodhi-cert.pem - readOnly: true - - name: fedora-messaging-key-volume - mountPath: /etc/pki/fedora-messaging/bodhi-key.pem - subPath: bodhi-key.pem - readOnly: true - volumes: - - name: config-volume - configMap: - name: bodhi-configmap - - name: bodhi-critpath-storage - persistentVolumeClaim: - claimName: "bodhi-critpath-storage" - - name: keytab-volume - secret: - secretName: bodhi-keytab - - name: fedora-messaging-config-volume - configMap: - name: fedora-messaging-configmap - - name: fedora-messaging-ca-volume - secret: - secretName: bodhi-fedora-messaging-ca - - name: fedora-messaging-crt-volume - secret: - secretName: bodhi-fedora-messaging-crt - - name: fedora-messaging-key-volume - secret: - secretName: bodhi-fedora-messaging-key - triggers: - - imageChangeParams: - automatic: true - containerNames: - - bodhi-celery - from: - kind: ImageStreamTag - name: bodhi-base:latest - namespace: bodhi - type: ImageChange - - type: ConfigChange -kind: List -metadata: {} ---- -apiVersion: apps.openshift.io/v1 -items: -- apiVersion: apps.openshift.io/v1 - kind: DeploymentConfig - metadata: - labels: - app: bodhi - service: celery-beat - name: bodhi-celery-beat - spec: - # There must be only one celery-beat worker - replicas: 1 - selector: - deploymentconfig: bodhi-celery-beat - strategy: - activeDeadlineSeconds: 21600 - recreateParams: - timeoutSeconds: 600 - resources: {} - rollingParams: - intervalSeconds: 1 - maxSurge: 25% - maxUnavailable: 25% - timeoutSeconds: 600 - updatePeriodSeconds: 1 - type: Rolling - template: - metadata: - creationTimestamp: null - labels: - app: bodhi-celery-beat - deploymentconfig: bodhi-celery-beat - spec: - containers: - - name: bodhi-celery-beat - image: bodhi-base:latest - workingDir: "/tmp" - command: ["/usr/bin/celery"] - args: ["-A", "bodhi.server.tasks.app", "beat", "-l", "info"] - resources: {} - volumeMounts: - - name: config-volume - mountPath: /etc/bodhi - readOnly: true - - name: bodhi-critpath-storage - mountPath: /etc/bodhi/critpath - readOnly: true - - name: keytab-volume - mountPath: /etc/keytabs - readOnly: true - - name: fedora-messaging-config-volume - mountPath: /etc/fedora-messaging - readOnly: true - - name: fedora-messaging-ca-volume - mountPath: /etc/pki/fedora-messaging/cacert.pem - subPath: cacert.pem - readOnly: true - - name: fedora-messaging-crt-volume - mountPath: /etc/pki/fedora-messaging/bodhi-cert.pem - subPath: bodhi-cert.pem - readOnly: true - - name: fedora-messaging-key-volume - mountPath: /etc/pki/fedora-messaging/bodhi-key.pem - subPath: bodhi-key.pem - readOnly: true - volumes: - - name: config-volume - configMap: - name: bodhi-configmap - - name: bodhi-critpath-storage - persistentVolumeClaim: - claimName: "bodhi-critpath-storage" - - name: keytab-volume - secret: - secretName: bodhi-keytab - - name: fedora-messaging-config-volume - configMap: - name: fedora-messaging-configmap - - name: fedora-messaging-ca-volume - secret: - secretName: bodhi-fedora-messaging-ca - - name: fedora-messaging-crt-volume - secret: - secretName: bodhi-fedora-messaging-crt - - name: fedora-messaging-key-volume - secret: - secretName: bodhi-fedora-messaging-key - triggers: - - imageChangeParams: - automatic: true - containerNames: - - bodhi-celery-beat - from: - kind: ImageStreamTag - name: bodhi-base:latest - namespace: bodhi - type: ImageChange - - type: ConfigChange -kind: List -metadata: {} From 91a49488aeefe22bec6e3026dfac00e5b7f8fc28 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sat, 2 May 2026 09:48:36 -0700 Subject: [PATCH 126/151] bodhi: adjust selectors Signed-off-by: Kevin Fenzi --- roles/openshift-apps/bodhi/files/service.yml | 2 +- .../openshift-apps/bodhi/templates/deployment.yml.j2 | 12 ++++++++---- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/roles/openshift-apps/bodhi/files/service.yml b/roles/openshift-apps/bodhi/files/service.yml index 058b1b681f..cde38fc778 100644 --- a/roles/openshift-apps/bodhi/files/service.yml +++ b/roles/openshift-apps/bodhi/files/service.yml @@ -13,4 +13,4 @@ spec: port: 8080 targetPort: 8080 selector: - deployment: bodhi-web + service: web diff --git a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 index 1da8e2a77f..a42277fa5a 100644 --- a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 +++ b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 @@ -11,7 +11,8 @@ spec: replicas: {{ bodhi_openshift_pods }} selector: matchLabels: - app: bodhi-web + app: bodhi + service: web strategy: type: Recreate template: @@ -127,7 +128,8 @@ spec: {% endif %} selector: matchLabels: - app: bodhi-consumer + app: bodhi + service: consumer strategy: type: RollingUpdate rollingUpdate: @@ -206,7 +208,8 @@ spec: replicas: {{ bodhi_openshift_pods }} selector: matchLabels: - app: bodhi-celery + app: bodhi + service: celery strategy: type: RollingUpdate rollingUpdate: @@ -285,7 +288,8 @@ spec: replicas: 1 selector: matchLabels: - app: bodhi-celery-beat + app: bodhi + service: celery-beat strategy: type: RollingUpdate rollingUpdate: From 83a1f1393c9066d37eba0cd205302e6dcf1d404f Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sat, 2 May 2026 09:54:36 -0700 Subject: [PATCH 127/151] Revert "bodhi: adjust selectors" This reverts commit 91a49488aeefe22bec6e3026dfac00e5b7f8fc28. --- roles/openshift-apps/bodhi/files/service.yml | 2 +- .../openshift-apps/bodhi/templates/deployment.yml.j2 | 12 ++++-------- 2 files changed, 5 insertions(+), 9 deletions(-) diff --git a/roles/openshift-apps/bodhi/files/service.yml b/roles/openshift-apps/bodhi/files/service.yml index cde38fc778..058b1b681f 100644 --- a/roles/openshift-apps/bodhi/files/service.yml +++ b/roles/openshift-apps/bodhi/files/service.yml @@ -13,4 +13,4 @@ spec: port: 8080 targetPort: 8080 selector: - service: web + deployment: bodhi-web diff --git a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 index a42277fa5a..1da8e2a77f 100644 --- a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 +++ b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 @@ -11,8 +11,7 @@ spec: replicas: {{ bodhi_openshift_pods }} selector: matchLabels: - app: bodhi - service: web + app: bodhi-web strategy: type: Recreate template: @@ -128,8 +127,7 @@ spec: {% endif %} selector: matchLabels: - app: bodhi - service: consumer + app: bodhi-consumer strategy: type: RollingUpdate rollingUpdate: @@ -208,8 +206,7 @@ spec: replicas: {{ bodhi_openshift_pods }} selector: matchLabels: - app: bodhi - service: celery + app: bodhi-celery strategy: type: RollingUpdate rollingUpdate: @@ -288,8 +285,7 @@ spec: replicas: 1 selector: matchLabels: - app: bodhi - service: celery-beat + app: bodhi-celery-beat strategy: type: RollingUpdate rollingUpdate: From ad19395d7b38264b331a0bda859ef2d7aa75e10b Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sat, 2 May 2026 09:57:32 -0700 Subject: [PATCH 128/151] bodhi: qualify imagestream location Signed-off-by: Kevin Fenzi --- roles/openshift-apps/bodhi/templates/deployment.yml.j2 | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 index 1da8e2a77f..af6b29b6f3 100644 --- a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 +++ b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 @@ -26,7 +26,7 @@ spec: spec: initContainers: - name: alembic-upgrade - image: bodhi-base:latest + image: image-registry.openshift-image-registry.svc:5000/bodhi/bodhi-base:latest command: ["/bin/sh", "-c"] args: - | @@ -37,7 +37,7 @@ spec: readOnly: true containers: - name: bodhi-web - image: bodhi-base:latest + image: image-registry.openshift-image-registry.svc:5000/bodhi/bodhi-base:latest command: ["gunicorn"] args: ["--paste", "/etc/bodhi/production.ini", "-b", "0.0.0.0:8080", "-w", "4", "--log-level", "DEBUG", "-k", "gthread", "--threads", "2", "--log-file=-"] ports: @@ -142,7 +142,7 @@ spec: spec: containers: - name: bodhi-consumer - image: bodhi-base:latest + image: image-registry.openshift-image-registry.svc:5000/bodhi/bodhi-base:latest command: ["/usr/bin/fedora-messaging"] args: ["consume"] resources: {} @@ -221,7 +221,7 @@ spec: spec: containers: - name: bodhi-celery - image: bodhi-base:latest + image: image-registry.openshift-image-registry.svc:5000/bodhi/bodhi-base:latest command: ["/usr/bin/celery"] args: ["-A", "bodhi.server.tasks.app", "worker", "-l", "info", "-Q", "celery"] resources: {} @@ -300,7 +300,7 @@ spec: spec: containers: - name: bodhi-celery-beat - image: bodhi-base:latest + image: image-registry.openshift-image-registry.svc:5000/bodhi/bodhi-base:latest workingDir: "/tmp" command: ["/usr/bin/celery"] args: ["-A", "bodhi.server.tasks.app", "beat", "-l", "info"] From 830d4d55602b5131874626458f7fa4d45bbb94a2 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sat, 2 May 2026 10:06:44 -0700 Subject: [PATCH 129/151] bodhi: try and standardize the app names and also adjust playbook for deployment instead of deploymentconfig for scaling Signed-off-by: Kevin Fenzi --- playbooks/openshift-apps/bodhi.yml | 12 ++++++------ .../openshift-apps/bodhi/templates/deployment.yml.j2 | 12 ++++-------- 2 files changed, 10 insertions(+), 14 deletions(-) diff --git a/playbooks/openshift-apps/bodhi.yml b/playbooks/openshift-apps/bodhi.yml index fc8ced553c..b2f288fbf8 100644 --- a/playbooks/openshift-apps/bodhi.yml +++ b/playbooks/openshift-apps/bodhi.yml @@ -169,22 +169,22 @@ post_tasks: - name: Scale up pods - ansible.builtin.command: oc -n bodhi scale dc/bodhi-consumer --replicas={{ bodhi_openshift_pods }} + ansible.builtin.command: oc -n bodhi scale deployment bodhi-consumer --replicas={{ bodhi_openshift_pods }} when: env == "production" - name: Scale up pods - ansible.builtin.command: oc -n bodhi scale dc/bodhi-celery --replicas={{ bodhi_openshift_pods }} + ansible.builtin.command: oc -n bodhi scale deployment bodhi-celery --replicas={{ bodhi_openshift_pods }} when: env == "production" - name: Scale up pods - ansible.builtin.command: oc -n bodhi scale dc/bodhi-web --replicas=4 + ansible.builtin.command: oc -n bodhi scale deployment bodhi-web --replicas=4 when: env == "production" - name: Scale up pods - ansible.builtin.command: oc -n bodhi scale dc/bodhi-consumer --replicas={{ bodhi_openshift_pods_stg_consumers }} + ansible.builtin.command: oc -n bodhi scale deployment bodhi-consumer --replicas={{ bodhi_openshift_pods_stg_consumers }} when: env == "staging" - name: Scale up pods - ansible.builtin.command: oc -n bodhi scale dc/bodhi-celery --replicas={{ bodhi_openshift_pods }} + ansible.builtin.command: oc -n bodhi scale deployment bodhi-celery --replicas={{ bodhi_openshift_pods }} when: env == "staging" - name: Scale up pods - ansible.builtin.command: oc -n bodhi scale dc/bodhi-web --replicas={{ bodhi_openshift_pods }} + ansible.builtin.command: oc -n bodhi scale deployment bodhi-web --replicas={{ bodhi_openshift_pods }} when: env == "staging" - name: Set the timeout to the openshift route ansible.builtin.command: "oc -n bodhi annotate route bodhi-web --overwrite haproxy.router.openshift.io/timeout=180s" diff --git a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 index af6b29b6f3..9487ebeafd 100644 --- a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 +++ b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 @@ -4,8 +4,7 @@ apiVersion: apps/v1 kind: Deployment metadata: labels: - app: bodhi - service: web + app: bodhi-web name: bodhi-web spec: replicas: {{ bodhi_openshift_pods }} @@ -116,8 +115,7 @@ apiVersion: apps/v1 kind: Deployment metadata: labels: - app: bodhi - service: consumer + app: bodhi-consumer name: bodhi-consumer spec: {% if env == 'staging' %} @@ -199,8 +197,7 @@ apiVersion: apps/v1 kind: Deployment metadata: labels: - app: bodhi - service: celery + app: bodhi-celery name: bodhi-celery spec: replicas: {{ bodhi_openshift_pods }} @@ -278,8 +275,7 @@ apiVersion: apps/v1 kind: Deployment metadata: labels: - app: bodhi - service: celery-beat + app: bodhi-celery-beat name: bodhi-celery-beat spec: replicas: 1 From 4b6c24f76a2720efef90ec80bbe5133146674cca Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sat, 2 May 2026 10:08:47 -0700 Subject: [PATCH 130/151] bodhi: also adjust the service selectors Signed-off-by: Kevin Fenzi --- roles/openshift-apps/bodhi/files/service.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/roles/openshift-apps/bodhi/files/service.yml b/roles/openshift-apps/bodhi/files/service.yml index 058b1b681f..e44d011aca 100644 --- a/roles/openshift-apps/bodhi/files/service.yml +++ b/roles/openshift-apps/bodhi/files/service.yml @@ -4,8 +4,7 @@ kind: Service metadata: name: bodhi-web labels: - app: bodhi - service: web + app: bodhi-web namespace: bodhi spec: ports: @@ -13,4 +12,4 @@ spec: port: 8080 targetPort: 8080 selector: - deployment: bodhi-web + app: bodhi-web From c16b2932dbc8bc6fae2387f03011d74b1888f452 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sat, 2 May 2026 10:28:55 -0700 Subject: [PATCH 131/151] testdays: switched to deployment Signed-off-by: Kevin Fenzi --- .../templates/deploymentconfig.yml.j2 | 124 ------------------ 1 file changed, 124 deletions(-) delete mode 100644 roles/openshift-apps/testdays/templates/deploymentconfig.yml.j2 diff --git a/roles/openshift-apps/testdays/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/testdays/templates/deploymentconfig.yml.j2 deleted file mode 100644 index 02b93c7eb5..0000000000 --- a/roles/openshift-apps/testdays/templates/deploymentconfig.yml.j2 +++ /dev/null @@ -1,124 +0,0 @@ ---- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig -metadata: - labels: - app: testdays-old - service: testdays-old - name: testdays -spec: - replicas: 0 - selector: - app: testdays-old - deploymentconfig: testdays - strategy: - type: Recreate - recreateParams: - mid: - failurePolicy: Abort - execNewPod: - containerName: testdays - # We only need to init the database the first time, after we just need to check - # for DB upgrades - command: ["python", "/opt/app-root/src/testdays/cli.py", "init_db"] - template: - metadata: - labels: - app: testdays-old - deploymentconfig: testdays - spec: - containers: - - name: testdays - image: testdays:latest - ports: - - containerPort: 8080 - resources: {} - env: - - name: POSTGRESQL_USER - value: "{{ testdays_db_user }}" - - name: POSTGRESQL_PASSWORD - value: "{{ testdays_db_pass }}" - - name: POSTGRESQL_DATABASE - value: "{{ testdays_db_name }}" - - name: POSTGRESQL_SERVICE_HOST - value: "db01{{ env_suffix }}.rdu3.fedoraproject.org" - - name: POSTGRESQL_SERVICE_PORT - value: "5432" - - name: SECRET_KEY - value: "{{ testdays_secret_key }}" - - name: RESULTSDB_URL - value: "http://resultsdb.testdays.svc.cluster.local:8081/api/v2.0" - - name: OPENSHIFT_PROD - value: "1" - - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - testdays - from: - kind: ImageStreamTag - name: testdays:latest ---- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig -metadata: - labels: - app: resultsdb-old - service: resultsdb-old - name: resultsdb -spec: - replicas: 0 - selector: - app: resultsdb-old - deploymentconfig: resultsdb - strategy: - type: Recreate - recreateParams: - mid: - failurePolicy: Abort - execNewPod: - containerName: resultsdb - # We only need to init the database the first time, after we just need to check - # for DB upgrades - command: ["python", "/opt/app-root/src/resultsdb/cli.py", "init_db"] - template: - metadata: - labels: - app: resultsdb-old - deploymentconfig: resultsdb - spec: - containers: - - name: resultsdb - image: resultsdb:latest - ports: - - containerPort: 8080 - resources: {} - env: - - name: POSTGRESQL_USER - value: "{{ resultsdb_testdays_db_user }}" - - name: POSTGRESQL_PASSWORD - value: "{{ resultsdb_testdays_db_pass }}" - - name: POSTGRESQL_DATABASE - value: "{{ resultsdb_testdays_db_name }}" - - name: POSTGRESQL_SERVICE_HOST - value: "db01{{ env_suffix }}.rdu3.fedoraproject.org" - - name: POSTGRESQL_SERVICE_PORT - value: "5432" - - name: SECRET_KEY - value: "{{ resultsdb_testdays_secret_key }}" - - name: OPENSHIFT_PROD - value: "1" - - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - resultsdb - from: - kind: ImageStreamTag - name: resultsdb:latest From 6545b1b1771b2f0d243b667a58f9747797b72656 Mon Sep 17 00:00:00 2001 From: James Antill Date: Sun, 3 May 2026 11:02:13 -0400 Subject: [PATCH 132/151] people: Fix redirects after anubis. Signed-off-by: James Antill --- roles/people/templates/people.conf | 3 +++ 1 file changed, 3 insertions(+) diff --git a/roles/people/templates/people.conf b/roles/people/templates/people.conf index 1013189365..9ef445091f 100644 --- a/roles/people/templates/people.conf +++ b/roles/people/templates/people.conf @@ -75,6 +75,9 @@ NameVirtualHost *:80 Listen 3923 http + # Don't redirect to :3923 + UseCanonicalPhysicalPort Off + RemoteIPHeader X-Real-Ip RemoteIPInternalProxy ::1 From c635e5ec5c6c59d989c36bd25d6c331a3edb1198 Mon Sep 17 00:00:00 2001 From: James Antill Date: Sun, 3 May 2026 11:24:44 -0400 Subject: [PATCH 133/151] people: Fix redirects after anubis using ServerName, as reqs come in weird. Signed-off-by: James Antill --- roles/people/templates/people.conf | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/roles/people/templates/people.conf b/roles/people/templates/people.conf index 9ef445091f..c73202704f 100644 --- a/roles/people/templates/people.conf +++ b/roles/people/templates/people.conf @@ -76,7 +76,10 @@ Listen 3923 http # Don't redirect to :3923 - UseCanonicalPhysicalPort Off + UseCanonicalName On + + ServerName fedorapeople.org + ServerAlias *.fedorapeople.org RemoteIPHeader X-Real-Ip RemoteIPInternalProxy ::1 From 15eb15bdaf818c5b1584d87b1ab3623dc290d64d Mon Sep 17 00:00:00 2001 From: James Antill Date: Sun, 3 May 2026 20:46:23 -0400 Subject: [PATCH 134/151] people: Fix main page, copying DocRoot. Also copy the other ServerAliases. Signed-off-by: James Antill --- roles/people/templates/people.conf | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/roles/people/templates/people.conf b/roles/people/templates/people.conf index c73202704f..e50c741476 100644 --- a/roles/people/templates/people.conf +++ b/roles/people/templates/people.conf @@ -80,6 +80,12 @@ Listen 3923 http ServerName fedorapeople.org ServerAlias *.fedorapeople.org + ServerAlias ols.fedoraproject.org + ServerAlias people.fedoraproject.org + ServerAlias people1.fedoraproject.org + ServerAdmin admin@fedoraproject.org + + DocumentRoot /srv/people/site RemoteIPHeader X-Real-Ip RemoteIPInternalProxy ::1 From 451ce29956d8d330b3aa91853a71d7d5a9dd69f3 Mon Sep 17 00:00:00 2001 From: James Antill Date: Sun, 3 May 2026 21:25:13 -0400 Subject: [PATCH 135/151] people: Fix user pages, but break redirects again. Signed-off-by: James Antill --- roles/people/templates/people.conf | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/roles/people/templates/people.conf b/roles/people/templates/people.conf index e50c741476..3e18e101fb 100644 --- a/roles/people/templates/people.conf +++ b/roles/people/templates/people.conf @@ -76,7 +76,8 @@ Listen 3923 http # Don't redirect to :3923 - UseCanonicalName On + # This fixes the redirects but breaks ols.fp.o and .fp.o pages. + # UseCanonicalName On ServerName fedorapeople.org ServerAlias *.fedorapeople.org From 18dc8053f7f5c961063735b9712a6a76edc3c1e2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Aur=C3=A9lien=20Bompard?= Date: Mon, 4 May 2026 09:24:15 +0200 Subject: [PATCH 136/151] Move mirrormanager to the Python 3.14 image The Python 3.11 image is no longer updated on quay.io Fixes: https://forge.fedoraproject.org/infra/tickets/issues/13300 --- .../mirrormanager/files/imagestream.yml | 10 +++++----- .../mirrormanager/templates/buildconfig.yml.j2 | 17 +++++++++-------- .../mirrormanager/templates/deployment.yml.j2 | 2 +- 3 files changed, 15 insertions(+), 14 deletions(-) diff --git a/roles/openshift-apps/mirrormanager/files/imagestream.yml b/roles/openshift-apps/mirrormanager/files/imagestream.yml index e96e0e370b..e6a732a2eb 100644 --- a/roles/openshift-apps/mirrormanager/files/imagestream.yml +++ b/roles/openshift-apps/mirrormanager/files/imagestream.yml @@ -7,11 +7,11 @@ items: kind: ImageStream metadata: name: mirrormanager2 - # The Python 3.11 builder image + # The Python 3.14 builder image - apiVersion: image.openshift.io/v1 kind: ImageStream metadata: - name: python-311 + name: python-314 spec: lookupPolicy: local: false @@ -19,13 +19,13 @@ items: - name: latest from: kind: DockerImage - name: quay.io/fedora/python-311:latest + name: quay.io/fedora/python-314:latest importPolicy: scheduled: true referencePolicy: type: Source - # The Python 3.11 builder image plus rust + # The Python 3.14 builder image plus rust - apiVersion: image.openshift.io/v1 kind: ImageStream metadata: - name: python-311-with-rust + name: python-314-with-rust diff --git a/roles/openshift-apps/mirrormanager/templates/buildconfig.yml.j2 b/roles/openshift-apps/mirrormanager/templates/buildconfig.yml.j2 index d9746eeb22..33eefaf81f 100644 --- a/roles/openshift-apps/mirrormanager/templates/buildconfig.yml.j2 +++ b/roles/openshift-apps/mirrormanager/templates/buildconfig.yml.j2 @@ -1,13 +1,13 @@ {% macro load_file(filename) %}{% include filename %}{%- endmacro -%} --- -# Build a derivative of the python-311 builder image with Rust added to it +# Build a derivative of the python-314 builder image with Rust added to it apiVersion: build.openshift.io/v1 kind: BuildConfig metadata: - name: python-311-with-rust + name: python-314-with-rust labels: app: mirrormanager - build: python-311-with-rust + build: python-314-with-rust spec: runPolicy: Serial source: @@ -19,14 +19,15 @@ spec: dockerStrategy: from: kind: ImageStreamTag - # name: python:3.11 + # name: python:3.14 # namespace: openshift - # OpenShift does not have Python 3.11 (yet), use our own ImageStream - name: python-311:latest + # OpenShift does not have Python 3.14 (yet), use our own ImageStream + # (use `oc -n openshift describe is/python` to ckeck) + name: python-314:latest output: to: kind: ImageStreamTag - name: python-311-with-rust:latest + name: python-314-with-rust:latest triggers: - type: ImageChange @@ -53,7 +54,7 @@ spec: from: kind: ImageStreamTag # Our own ImageStream with rust added to it - name: python-311-with-rust:latest + name: python-314-with-rust:latest output: to: kind: ImageStreamTag diff --git a/roles/openshift-apps/mirrormanager/templates/deployment.yml.j2 b/roles/openshift-apps/mirrormanager/templates/deployment.yml.j2 index 45b7736506..ddc953dd95 100644 --- a/roles/openshift-apps/mirrormanager/templates/deployment.yml.j2 +++ b/roles/openshift-apps/mirrormanager/templates/deployment.yml.j2 @@ -25,7 +25,7 @@ spec: spec: containers: - name: mirrormanager - image: mirrormanager2:latest + image: image-registry.openshift-image-registry.svc:5000/mirrormanager2:latest imagePullPolicy: Always ports: - containerPort: 8080 From 412125fdcb042f5f0928a1fe48f108f698a751f4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Aur=C3=A9lien=20Bompard?= Date: Mon, 4 May 2026 09:28:15 +0200 Subject: [PATCH 137/151] Fix image location MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Aurélien Bompard --- roles/openshift-apps/mirrormanager/templates/deployment.yml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/mirrormanager/templates/deployment.yml.j2 b/roles/openshift-apps/mirrormanager/templates/deployment.yml.j2 index ddc953dd95..44347637c9 100644 --- a/roles/openshift-apps/mirrormanager/templates/deployment.yml.j2 +++ b/roles/openshift-apps/mirrormanager/templates/deployment.yml.j2 @@ -25,7 +25,7 @@ spec: spec: containers: - name: mirrormanager - image: image-registry.openshift-image-registry.svc:5000/mirrormanager2:latest + image: image-registry.openshift-image-registry.svc:5000/mirrormanager/mirrormanager2:latest imagePullPolicy: Always ports: - containerPort: 8080 From 21f9d92f8a22725076639bd4715a37cde0604a27 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20Such=C3=BD?= Date: Mon, 4 May 2026 09:53:04 +0200 Subject: [PATCH 138/151] copr: enable powerful builders for firefox and thunderbird --- roles/copr/frontend/templates/copr.conf | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/roles/copr/frontend/templates/copr.conf b/roles/copr/frontend/templates/copr.conf index c52fa28dd9..bbe58b5e5a 100644 --- a/roles/copr/frontend/templates/copr.conf +++ b/roles/copr/frontend/templates/copr.conf @@ -288,6 +288,10 @@ EXTRA_BUILDCHROOT_TAGS = [{ # https://github.com/fedora-copr/copr/issues/4256 "pattern": "^@python/python3\.\d+/.*/root$", "tags": ["on_demand_powerful"], +},{ + # packages that always takes time to build + "pattern": ".*/.*/.*/(firefox|thunderbird)$", + "tags": ["on_demand_powerful"], }] {% endif %} From d9f9f04d3d35dd9480eb850e456a3699bd89d0cf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20Such=C3=BD?= Date: Mon, 4 May 2026 10:03:47 +0200 Subject: [PATCH 139/151] copr: add one reserved powerful builder --- inventory/group_vars/copr_aws | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/inventory/group_vars/copr_aws b/inventory/group_vars/copr_aws index 389acc452e..14d3688764 100644 --- a/inventory/group_vars/copr_aws +++ b/inventory/group_vars/copr_aws @@ -26,7 +26,7 @@ builders: aarch64: [50, 20, 33] x86_64: [70, 20, 52] aws_reserved_powerful: - x86_64: [1, 1, 1] + x86_64: [2, 2, 2] aws_powerful: aarch64: [10, 2, 0] x86_64: [10, 2, 1] From c4f2fcfeff3428c8fd6c1f48959c4a290f2fdd2b Mon Sep 17 00:00:00 2001 From: Jiri Kyjovsky Date: Mon, 4 May 2026 10:39:17 +0200 Subject: [PATCH 140/151] copr-ibm: less workers per location --- inventory/group_vars/copr_aws | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/inventory/group_vars/copr_aws b/inventory/group_vars/copr_aws index 14d3688764..db4fb0dcf3 100644 --- a/inventory/group_vars/copr_aws +++ b/inventory/group_vars/copr_aws @@ -62,18 +62,18 @@ builders: s390x: [2, 1, 0] ibm_cloud_br_sao_1: - s390x: [5, 5, 1] + s390x: [3, 3, 1] ibm_cloud_br_sao_2: - s390x: [5, 5, 1] + s390x: [3, 3, 1] ibm_cloud_br_sao_3: - s390x: [5, 5, 1] + s390x: [3, 3, 1] ibm_cloud_eu_es_1: - s390x: [5, 5, 1] + s390x: [3, 3, 1] ibm_cloud_eu_es_2: - s390x: [5, 5, 1] + s390x: [3, 3, 1] ibm_cloud_eu_es_3: - s390x: [5, 5, 1] + s390x: [3, 3, 1] cloud_instance_types: ibm_cloud: From 1250c0d961c438d59591c3e5ac54007376e04fa7 Mon Sep 17 00:00:00 2001 From: Michal Konecny Date: Mon, 4 May 2026 14:28:01 +0200 Subject: [PATCH 141/151] Fix ansible-lint forgejo action Signed-off-by: Michal Konecny --- .forgejo/workflows/ci.yaml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.forgejo/workflows/ci.yaml b/.forgejo/workflows/ci.yaml index 63673333da..9e409437b3 100644 --- a/.forgejo/workflows/ci.yaml +++ b/.forgejo/workflows/ci.yaml @@ -39,11 +39,15 @@ jobs: steps: - name: Install testing tools run: | - dnf install -y ansible-lint nodejs git ansible + dnf install -y python3-pip nodejs git + pip3 install ansible-core ansible-lint - name: Install ansible collections run: | - ansible-galaxy collection install community.zabbix + ansible-galaxy collection install \ + community.zabbix \ + community.general \ + ansible.posix - name: Checkout code uses: https://code.forgejo.org/actions/checkout@v6 From f6b50eb89cb6165dbdc498a7071b60d5e2d4fa4e Mon Sep 17 00:00:00 2001 From: Michal Konecny Date: Mon, 4 May 2026 14:18:09 +0200 Subject: [PATCH 142/151] Remove OpenID from Fedora This change will remove routing and configuration for OpenID in Fedora. Which was originally announced to sunset on 1st May 2026. Signed-off-by: Michal Konecny --- roles/haproxy/templates/haproxy.cfg | 29 ---------------------- roles/ipsilon/files/openid_banner.patch | 15 ----------- roles/ipsilon/tasks/main.yml | 11 -------- roles/ipsilon/templates/configuration.conf | 23 ----------------- roles/ipsilon/templates/httpd.conf.j2 | 13 ---------- 5 files changed, 91 deletions(-) delete mode 100644 roles/ipsilon/files/openid_banner.patch diff --git a/roles/haproxy/templates/haproxy.cfg b/roles/haproxy/templates/haproxy.cfg index 19881b670d..47f92281bf 100644 --- a/roles/haproxy/templates/haproxy.cfg +++ b/roles/haproxy/templates/haproxy.cfg @@ -160,38 +160,9 @@ backend oci-registry-backend frontend ipsilon-frontend bind 0.0.0.0:10020 - option http-buffer-request - # Define ipsilon OpenID only instance - acl path_openidc path_beg /openidc - acl path_openid path_beg /openid - acl is_openid_cookie req.cook(OPENID) true -{% if env == 'staging' %} - acl host_is_id_sub hdr(host) -m reg -i ^.+\.id\.stg\.fedoraproject\.org$ -{% else %} - acl host_is_id_sub hdr(host) -m reg -i ^.+\.id\.fedoraproject\.org$ -{% endif %} - - use_backend ipsilon-backend if path_openidc - use_backend ipsilon-backend-openid if path_openid - use_backend ipsilon-backend-openid if is_openid_cookie - use_backend ipsilon-backend-openid if host_is_id_sub - - default_backend ipsilon-backend - -backend ipsilon-backend-openid - balance hdr(appserver) - cookie OPENID insert indirect nocache attr Max-Age=300 -{% if env == "staging" %} - server ipsilon01 ipsilon01:80 cookie true check inter 10s rise 1 fall 3 -{% else %} - server ipsilon03 ipsilon03:80 cookie true check inter 10s rise 1 fall 3 -{% endif %} - option httpchk GET / - backend ipsilon-backend balance hdr(appserver) server ipsilon01 ipsilon01:80 check inter 10s rise 1 fall 3 - http-response set-header x-xrds-location "https://id{{ env_suffix }}.fedoraproject.org/openid/XRDS" {% if env == "production" %} server ipsilon02 ipsilon02:80 check inter 10s rise 1 fall 3 {% endif %} diff --git a/roles/ipsilon/files/openid_banner.patch b/roles/ipsilon/files/openid_banner.patch deleted file mode 100644 index 0fe9df268b..0000000000 --- a/roles/ipsilon/files/openid_banner.patch +++ /dev/null @@ -1,15 +0,0 @@ ---- layout.html 2025-10-03 10:54:25.879128022 +0000 -+++ layout.html 2025-10-03 10:56:46.554758341 +0000 -@@ -21,6 +21,12 @@ - {%- endif %} - - -+
-+

-+ You are using OpenID to authenticate. This authentication method will go away on 1st May 2026. Please consider migrating to OpenID Connect. -+ For more info look at https://forge.fedoraproject.org/infra/tickets/issues/10241 -+

-+
-
-
- logo diff --git a/roles/ipsilon/tasks/main.yml b/roles/ipsilon/tasks/main.yml index ff21492adb..61b551a502 100644 --- a/roles/ipsilon/tasks/main.yml +++ b/roles/ipsilon/tasks/main.yml @@ -7,7 +7,6 @@ update_cache: yes name: - ipsilon - - ipsilon-openid - ipsilon-saml2 - ipsilon-openidc - ipsilon-authgssapi @@ -51,15 +50,6 @@ tags: - ipsilon -- name: Apply patch for OpenID banner - ansible.posix.patch: - src: openid_banner.patch - dest: /usr/share/ipsilon/themes/Fedora/templates/layout.html - when: openid is defined and openid - tags: - - ipsilon - - patch - - name: Apply patch for forge.fp.o links ansible.posix.patch: src: forge_fp_o.patch @@ -87,7 +77,6 @@ --admin-user=admin --ipa=yes --openidc=yes - --openid=yes --saml2=yes --info-sssd=yes --form=yes diff --git a/roles/ipsilon/templates/configuration.conf b/roles/ipsilon/templates/configuration.conf index 97bb7bc3c9..90fba51a69 100644 --- a/roles/ipsilon/templates/configuration.conf +++ b/roles/ipsilon/templates/configuration.conf @@ -11,27 +11,6 @@ fas aws groups=[["aws-master", "arn:aws:iam::125523088429:role/aws-master"], ["a global enabled=allow [provider_config] -{% if openid is defined and openid %} -global enabled=openid - -openid endpoint url=https://id{{env_suffix}}.fedoraproject.org/openid/ -openid identity url template=http://%(username)s.id{{env_suffix}}.fedoraproject.org/ -{% if env == 'staging' %} -openid trusted roots= -{% else %} -openid trusted roots=https://ask.fedoraproject.org/,https://fedorahosted.org/,https://badges.fedoraproject.org,https://apps.fedoraproject.org/datagrepper/,https://apps.fedoraproject.org/calendar/,http://notifications.fedoraproject.org/,http://copr.fedoraproject.org/,https://copr.fedoraproject.org/,https://admin.fedoraproject.org/voting/,https://admin.fedoraproject.org,https://apps.fedoraproject.org/,https://release-monitoring.org/,http://pagure.io/,http://admin.fedoraproject.org/mirrormanager/,https://koschei.fedoraproject.org/,https://bodhi.fedoraproject.org,https://lists.fedoraproject.org/,https://openqa.fedoraproject.org/,https://src.fedoraproject.org/ -{% endif %} -{% if env == 'staging' %} -openid database url=postgresql://{{ ipsilon_db_user }}:{{ ipsilon_stg_db_pass }}@{{ ipsilon_db_host }}/{{ ipsilon_db_openid_name }} -{% else %} -openid database url=postgresql://{{ ipsilon_db_user }}:{{ ipsilon_db_pass }}@{{ ipsilon_db_host }}/{{ ipsilon_db_openid_name }} -{% endif %} -openid untrusted roots= -openid enabled extensions=Fedora Teams,Attribute Exchange,CLAs,Simple Registration,API -openid default attribute mapping=[["*", "*"], ["_groups", "groups"], [["_extras", "cla"], "cla"], ["fullname", "name"], ["_username", "nickname"], ["_username", "preferred_username"], ["fasIRCNick", "ircnick"], ["fasLocale", "locale"], ["fasTimeZone", "zoneinfo"], ["fasTimeZone", "timezone"], ["fasWebsiteURL", "website"], ["fasGPGKeyId", "gpg_keyid"], ["ipaSshPubKey", "ssh_key"], ["fasIsPrivate", "privacy"], ["fullname", "human_name"]] - -# End of OpenID configuration -{% else %} global enabled=saml2,openidc openidc enabled extensions=fedora-account,waiverdb,wiki,src,kerneltest @@ -80,5 +59,3 @@ saml2 session database url=postgresql://{{ ipsilon_db_user }}:{{ ipsilon_db_pass {% else %} {% include "saml2_data" %} {% endif %} - -{% endif %} diff --git a/roles/ipsilon/templates/httpd.conf.j2 b/roles/ipsilon/templates/httpd.conf.j2 index 557dd5b1f4..0764c10eec 100644 --- a/roles/ipsilon/templates/httpd.conf.j2 +++ b/roles/ipsilon/templates/httpd.conf.j2 @@ -6,19 +6,6 @@ Alias /.well-known /var/lib/ipsilon/root/public/well-known Alias /cache /var/cache/ipsilon Redirect /.well-known/webfinger /webfinger -# This is for mapping $username.id.fp.o -> id.fp.o/id/$username -RewriteEngine on -RewriteMap lowercase int:tolower -{% if env == "staging" %} -RewriteCond ${lowercase:%{SERVER_NAME}} ^[a-z0-9_\.-]+\.id\.stg\.fedoraproject\.org$ -RewriteRule ^(.+) /${lowercase:%{SERVER_NAME}}$1 [C] -{% else %} -RewriteCond ${lowercase:%{SERVER_NAME}} ^[a-z0-9_\.-]+\.id\.fedoraproject\.org$ -RewriteRule ^(.+) /${lowercase:%{SERVER_NAME}}$1 [C] -RewriteRule ^/([a-z0-9_\.-]+)\.id\.fedoraproject\.org/.* /openid/id/$1/ [PT] -{% endif %} - - WSGIScriptAlias / /usr/libexec/ipsilon/ipsilon WSGIDaemonProcess ipsilon user=ipsilon group=ipsilon home=/var/lib/ipsilon/root display-name=ipsilon processes=6 threads=2 maximum-requests=1000 WSGISocketPrefix run/wsgi From c03a11f09cc2b188d078008fd6f108cf4e77ccc6 Mon Sep 17 00:00:00 2001 From: Michal Konecny Date: Mon, 4 May 2026 16:08:04 +0200 Subject: [PATCH 143/151] [haproxy] Don't remove default_backend for ipsilon Signed-off-by: Michal Konecny --- roles/haproxy/templates/haproxy.cfg | 1 + 1 file changed, 1 insertion(+) diff --git a/roles/haproxy/templates/haproxy.cfg b/roles/haproxy/templates/haproxy.cfg index 47f92281bf..5e565f2e00 100644 --- a/roles/haproxy/templates/haproxy.cfg +++ b/roles/haproxy/templates/haproxy.cfg @@ -159,6 +159,7 @@ backend oci-registry-backend frontend ipsilon-frontend bind 0.0.0.0:10020 + default_backend ipsilon-backend backend ipsilon-backend balance hdr(appserver) From 086414024f46931938f586fbeee3246493225fad Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Mon, 4 May 2026 07:39:11 -0700 Subject: [PATCH 144/151] fmn: try and set the redis password for fmn on the redis pod Signed-off-by: Kevin Fenzi --- roles/openshift-apps/fmn/templates/deployment.yml.j2 | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/roles/openshift-apps/fmn/templates/deployment.yml.j2 b/roles/openshift-apps/fmn/templates/deployment.yml.j2 index e94a9c2747..cf043387bd 100644 --- a/roles/openshift-apps/fmn/templates/deployment.yml.j2 +++ b/roles/openshift-apps/fmn/templates/deployment.yml.j2 @@ -454,6 +454,10 @@ spec: containers: - name: redis image: redis:latest + command: + - redis-server + - --requirepass + - $(REDIS_PASSWORD) env: - name: REDIS_PASSWORD valueFrom: From 6e50e5d9b8c07fa654494491cae9796982e3cf0c Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Mon, 4 May 2026 07:42:30 -0700 Subject: [PATCH 145/151] fmn: use the _right_ redis image Signed-off-by: Kevin Fenzi --- roles/openshift-apps/fmn/templates/deployment.yml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/fmn/templates/deployment.yml.j2 b/roles/openshift-apps/fmn/templates/deployment.yml.j2 index cf043387bd..dd1c092309 100644 --- a/roles/openshift-apps/fmn/templates/deployment.yml.j2 +++ b/roles/openshift-apps/fmn/templates/deployment.yml.j2 @@ -447,7 +447,7 @@ spec: metadata: labels: app: fmn - component: redis + component: image-registry.openshift-image-registry.svc:5000/fmn/redis annotations: image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"redis:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"redis\")].image"}]' spec: From 6e02c3d79ddbeaa4f2446422608b523edfb2fc5b Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Mon, 4 May 2026 07:44:26 -0700 Subject: [PATCH 146/151] Revert "fmn: use the _right_ redis image" This reverts commit 6e50e5d9b8c07fa654494491cae9796982e3cf0c. --- roles/openshift-apps/fmn/templates/deployment.yml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/fmn/templates/deployment.yml.j2 b/roles/openshift-apps/fmn/templates/deployment.yml.j2 index dd1c092309..cf043387bd 100644 --- a/roles/openshift-apps/fmn/templates/deployment.yml.j2 +++ b/roles/openshift-apps/fmn/templates/deployment.yml.j2 @@ -447,7 +447,7 @@ spec: metadata: labels: app: fmn - component: image-registry.openshift-image-registry.svc:5000/fmn/redis + component: redis annotations: image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"redis:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"redis\")].image"}]' spec: From 5293ff4fcf270a89bcf432dfe82b57890628884b Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Mon, 4 May 2026 07:45:40 -0700 Subject: [PATCH 147/151] fmn: use the correct place to define the correct image Signed-off-by: Kevin Fenzi --- roles/openshift-apps/fmn/templates/deployment.yml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/fmn/templates/deployment.yml.j2 b/roles/openshift-apps/fmn/templates/deployment.yml.j2 index cf043387bd..cbf7307ee8 100644 --- a/roles/openshift-apps/fmn/templates/deployment.yml.j2 +++ b/roles/openshift-apps/fmn/templates/deployment.yml.j2 @@ -453,7 +453,7 @@ spec: spec: containers: - name: redis - image: redis:latest + image: image-registry.openshift-image-registry.svc:5000/fmn/redis:latest command: - redis-server - --requirepass From bbdd8c7b1fe701a0f1fac7ce0718482f5232c4e0 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Mon, 4 May 2026 07:47:44 -0700 Subject: [PATCH 148/151] Revert "fmn: use the correct place to define the correct image" This reverts commit 5293ff4fcf270a89bcf432dfe82b57890628884b. ok, this wasn't it. --- roles/openshift-apps/fmn/templates/deployment.yml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift-apps/fmn/templates/deployment.yml.j2 b/roles/openshift-apps/fmn/templates/deployment.yml.j2 index cbf7307ee8..cf043387bd 100644 --- a/roles/openshift-apps/fmn/templates/deployment.yml.j2 +++ b/roles/openshift-apps/fmn/templates/deployment.yml.j2 @@ -453,7 +453,7 @@ spec: spec: containers: - name: redis - image: image-registry.openshift-image-registry.svc:5000/fmn/redis:latest + image: redis:latest command: - redis-server - --requirepass From 85b073eda14bb047180fc64dd89c5fff60ed8fcd Mon Sep 17 00:00:00 2001 From: Michal Konecny Date: Mon, 4 May 2026 16:38:03 +0200 Subject: [PATCH 149/151] [ipsilon] Remove ipsilon03 VM This is an OpenID VM and this is done as part of https://forge.fedoraproject.org/infra/tickets/issues/13265 Signed-off-by: Michal Konecny --- .../host_vars/ipsilon03.rdu3.fedoraproject.org | 16 ---------------- inventory/inventory | 2 -- 2 files changed, 18 deletions(-) delete mode 100644 inventory/host_vars/ipsilon03.rdu3.fedoraproject.org diff --git a/inventory/host_vars/ipsilon03.rdu3.fedoraproject.org b/inventory/host_vars/ipsilon03.rdu3.fedoraproject.org deleted file mode 100644 index c487278ee1..0000000000 --- a/inventory/host_vars/ipsilon03.rdu3.fedoraproject.org +++ /dev/null @@ -1,16 +0,0 @@ ---- -datacenter: rdu3 -eth0_ipv4_gw: 10.16.163.254 -eth0_ipv4_ip: 10.16.163.117 -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/43/Server/x86_64/os/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora -vmhost: vmhost-x86-02.rdu3.fedoraproject.org -volgroup: /dev/vg_guests -# Network configuration for RDU3 -dns: 10.16.163.33 -dns1: 10.16.163.33 -dns2: 10.16.163.34 -dns_search1: "rdu3.fedoraproject.org" -dns_search2: "vpn.fedoraproject.org" -dns_search3: "fedoraproject.org" -openid: yes diff --git a/inventory/inventory b/inventory/inventory index a7ffdc9623..25542fccc8 100644 --- a/inventory/inventory +++ b/inventory/inventory @@ -330,12 +330,10 @@ ipsilon01.stg.rdu3.fedoraproject.org [ipsilon] ipsilon01.rdu3.fedoraproject.org ipsilon02.rdu3.fedoraproject.org -ipsilon03.rdu3.fedoraproject.org [ipsilon_rdu3] ipsilon01.rdu3.fedoraproject.org ipsilon02.rdu3.fedoraproject.org -ipsilon03.rdu3.fedoraproject.org [nagios] noc02.fedoraproject.org From 42e605c499cd6465a7426f56bfe20973cfcde20e Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Mon, 4 May 2026 07:56:50 -0700 Subject: [PATCH 150/151] fmn: try adding a emptydir for redis data Signed-off-by: Kevin Fenzi --- roles/openshift-apps/fmn/templates/deployment.yml.j2 | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/roles/openshift-apps/fmn/templates/deployment.yml.j2 b/roles/openshift-apps/fmn/templates/deployment.yml.j2 index cf043387bd..593f076b78 100644 --- a/roles/openshift-apps/fmn/templates/deployment.yml.j2 +++ b/roles/openshift-apps/fmn/templates/deployment.yml.j2 @@ -464,6 +464,12 @@ spec: secretKeyRef: name: fmn key: redis-password + volumeMounts: + - name: redis-data + mountPath: /data + volumes: + - name: redis-data + emptyDir: {} --- # Collectd stats collector apiVersion: apps/v1 From 7749af776055236773def3ff1bc6f86ab8f16573 Mon Sep 17 00:00:00 2001 From: Jeremy Cline Date: Tue, 31 Mar 2026 11:29:19 -0400 Subject: [PATCH 151/151] draft: add roles for siguldry server and bridge These roles deploy the Siguldry server and bridge. There's a few TODOs, and one step that isn't covered at all is the deployment of the TLS private keys. These need to be encrypted with systemd-creds, which should be doable via ansible, but the pesign bridge isn't doing it so I've left it out for now. Signed-off-by: Jeremy Cline --- roles/siguldry/bridge/handlers/main.yml | 8 + roles/siguldry/bridge/tasks/main.yml | 116 ++++++++++ .../siguldry/bridge/templates/bridge.toml.j2 | 21 ++ .../bridge/templates/override.conf.j2 | 12 ++ roles/siguldry/server/defaults/main.yml | 7 + roles/siguldry/server/handlers/main.yml | 8 + roles/siguldry/server/tasks/kryoptic.yml | 151 +++++++++++++ roles/siguldry/server/tasks/main.yml | 202 ++++++++++++++++++ .../server/templates/kryoptic.toml.j2 | 4 + .../server/templates/server-override.conf.j2 | 17 ++ .../siguldry/server/templates/server.toml.j2 | 101 +++++++++ .../server/templates/signer-override.conf.j2 | 11 + 12 files changed, 658 insertions(+) create mode 100644 roles/siguldry/bridge/handlers/main.yml create mode 100644 roles/siguldry/bridge/tasks/main.yml create mode 100644 roles/siguldry/bridge/templates/bridge.toml.j2 create mode 100644 roles/siguldry/bridge/templates/override.conf.j2 create mode 100644 roles/siguldry/server/defaults/main.yml create mode 100644 roles/siguldry/server/handlers/main.yml create mode 100644 roles/siguldry/server/tasks/kryoptic.yml create mode 100644 roles/siguldry/server/tasks/main.yml create mode 100644 roles/siguldry/server/templates/kryoptic.toml.j2 create mode 100644 roles/siguldry/server/templates/server-override.conf.j2 create mode 100644 roles/siguldry/server/templates/server.toml.j2 create mode 100644 roles/siguldry/server/templates/signer-override.conf.j2 diff --git a/roles/siguldry/bridge/handlers/main.yml b/roles/siguldry/bridge/handlers/main.yml new file mode 100644 index 0000000000..4dc212b8ec --- /dev/null +++ b/roles/siguldry/bridge/handlers/main.yml @@ -0,0 +1,8 @@ +--- +- name: Restart siguldry-bridge + ansible.builtin.systemd: + name: siguldry-bridge.service + state: restarted + tags: + - siguldry + - siguldry/bridge diff --git a/roles/siguldry/bridge/tasks/main.yml b/roles/siguldry/bridge/tasks/main.yml new file mode 100644 index 0000000000..790ca8fe1f --- /dev/null +++ b/roles/siguldry/bridge/tasks/main.yml @@ -0,0 +1,116 @@ +--- +- name: Install siguldry package + ansible.builtin.package: + state: present + name: siguldry + tags: + - packages + - siguldry + - siguldry/bridge + +# We only need to grant the service explicit access to the TPM on systemd < 258 +- name: Get systemd version + ansible.builtin.command: systemctl --version + register: systemd_version_output + changed_when: systemd_version_output.rc != 0 + +- name: Set whether explicit AllowDevice override is needed + ansible.builtin.set_fact: + explicit_allow_tpm: "{{ (systemd_version_output.stdout_lines[0] | regex_search('\\d+') | int) < 258 }}" + +- name: Create siguldry config directory + ansible.builtin.file: + path: /etc/siguldry + state: directory + owner: root + group: root + mode: '0755' + tags: + - config + - siguldry + - siguldry/bridge + +- name: Create credstore.encrypted directory + ansible.builtin.file: + path: /etc/credstore.encrypted + state: directory + owner: root + group: root + mode: '0700' + tags: + - config + - siguldry + - siguldry/bridge + +- name: Create siguldry-bridge systemd override directory + ansible.builtin.file: + path: /etc/systemd/system/siguldry-bridge.service.d + state: directory + owner: root + group: root + mode: '0755' + tags: + - config + - siguldry + - siguldry/bridge + +- name: Setup siguldry-bridge systemd override file + ansible.builtin.template: + src: override.conf.j2 + dest: /etc/systemd/system/siguldry-bridge.service.d/override.conf + owner: root + group: root + mode: '0644' + notify: Restart siguldry-bridge + tags: + - config + - siguldry + - siguldry/bridge + +- name: Setup siguldry-bridge config file + ansible.builtin.template: + src: bridge.toml.j2 + dest: /etc/siguldry/bridge.toml + owner: root + group: root + mode: '0644' + notify: Restart siguldry-bridge + tags: + - config + - siguldry + - siguldry/bridge + +- name: Setup bridge certificate + ansible.builtin.copy: + src: "{{ private }}/files/siguldryca/{{ env }}/pki/issued/siguldry-bridge.crt" + dest: /etc/siguldry/bridge.crt + owner: root + group: root + mode: '0644' + tags: + - config + - siguldry + - siguldry/bridge + +- name: Setup CA certificate + ansible.builtin.copy: + src: "{{ private }}/files/siguldryca/{{ env }}/pki/ca.crt" + dest: /etc/siguldry/ca.crt + owner: root + group: root + mode: '0644' + tags: + - config + - siguldry + - siguldry/bridge + +- name: Enable and start siguldry-bridge service + ansible.builtin.systemd: + name: siguldry-bridge.service + enabled: yes + state: started + daemon_reload: yes + tags: + - services + - siguldry + - siguldry/bridge diff --git a/roles/siguldry/bridge/templates/bridge.toml.j2 b/roles/siguldry/bridge/templates/bridge.toml.j2 new file mode 100644 index 0000000000..4b2a168565 --- /dev/null +++ b/roles/siguldry/bridge/templates/bridge.toml.j2 @@ -0,0 +1,21 @@ +# The socket address to listen on for incoming connections from Siguldry servers. +# +# The default is to listen on all interfaces on port 44333. +server_listening_address = "[::]:44333" + +# The socket address to listen on for incoming connections from Siguldry clients. +# +# The default is to listen on all interfaces on port 44334. +client_listening_address = "[::]:44334" + +# The TLS credentials for the server and client listeners. +# +# Both clients and servers connect to the above addresses and perform mutual TLS. +# Note that the certificate must have `serverAuth` in its extended key usage extension. +# +# Paths that aren't absolute are loaded relative to systemd's credentials directory, +# which are encrypted, see https://systemd.io/CREDENTIALS/ +[credentials] +private_key = "siguldry.bridge.private_key.pem" +certificate = "/etc/siguldry/bridge.crt" +ca_certificate = "/etc/siguldry/ca.crt" diff --git a/roles/siguldry/bridge/templates/override.conf.j2 b/roles/siguldry/bridge/templates/override.conf.j2 new file mode 100644 index 0000000000..a33171f49c --- /dev/null +++ b/roles/siguldry/bridge/templates/override.conf.j2 @@ -0,0 +1,12 @@ +[Service] +# Tweak for lower/higher log verbosity. +# Refer to https://docs.rs/tracing-subscriber/0.3.19/tracing_subscriber/filter/struct.EnvFilter.html#directives +Environment=SIGULDRY_BRIDGE_LOG="WARN,siguldry=INFO" + +{% if explicit_allow_tpm %} +# Credentials require the TPM to decrypt. +# +# For systemd 257 and older you'll need to explicitly allow access to the TPM +# Refer to https://github.com/systemd/systemd/issues/35959. +DeviceAllow=/dev/tpmrm0 +{% endif %} diff --git a/roles/siguldry/server/defaults/main.yml b/roles/siguldry/server/defaults/main.yml new file mode 100644 index 0000000000..45d5f3c18c --- /dev/null +++ b/roles/siguldry/server/defaults/main.yml @@ -0,0 +1,7 @@ +--- + +siguldry_kryoptic_conf: "/etc/siguldry/kryoptic.toml" +siguldry_kryoptic_db: "/var/lib/siguldry/kryoptic.sqlite" + +siguldry_kryoptic_so_pin: "12345678" +siguldry_kryoptic_user_pin: "123456" diff --git a/roles/siguldry/server/handlers/main.yml b/roles/siguldry/server/handlers/main.yml new file mode 100644 index 0000000000..a956d31dca --- /dev/null +++ b/roles/siguldry/server/handlers/main.yml @@ -0,0 +1,8 @@ +--- +- name: Restart siguldry-server + ansible.builtin.systemd: + name: siguldry-server.service + state: restarted + tags: + - siguldry + - siguldry/server diff --git a/roles/siguldry/server/tasks/kryoptic.yml b/roles/siguldry/server/tasks/kryoptic.yml new file mode 100644 index 0000000000..bb474bd97c --- /dev/null +++ b/roles/siguldry/server/tasks/kryoptic.yml @@ -0,0 +1,151 @@ +--- +# For staging, use Kryoptic as a software HSM for binding +- name: Install kryoptic and PKCS#11 tools (staging only) + ansible.builtin.package: + state: present + name: + - kryoptic + - opensc + - openssl + - pkcs11-provider + tags: + - packages + - siguldry + - siguldry/server + +- name: Setup kryoptic configuration + ansible.builtin.template: + src: kryoptic.toml.j2 + dest: "{{ siguldry_kryoptic_conf }}" + owner: root + group: root + mode: '0644' + tags: + - config + - siguldry + - siguldry/server + +- name: Check if kryoptic token is initialized + ansible.builtin.stat: + path: "{{ siguldry_kryoptic_db }}" + register: kryoptic_db + tags: + - config + - siguldry + - siguldry/server + +- name: Initialize kryoptic PKCS#11 token + ansible.builtin.command: + cmd: >- + pkcs11-tool + --module /usr/lib64/pkcs11/libkryoptic_pkcs11.so + --init-token + --label siguldry-stg-token + --so-pin env:KRYOPTIC_SO_PIN + environment: + KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}" + KRYOPTIC_SO_PIN: "{{ siguldry_kryoptic_so_pin }}" + when: not kryoptic_db.stat.exists + tags: + - config + - siguldry + - siguldry/server + +- name: Initialize kryoptic user PIN + ansible.builtin.command: + cmd: >- + pkcs11-tool + --module /usr/lib64/pkcs11/libkryoptic_pkcs11.so + --login + --so-pin env:KRYOPTIC_SO_PIN + --init-pin + --new-pin env:KRYOPTIC_USER_PIN + environment: + KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}" + KRYOPTIC_SO_PIN: "{{ siguldry_kryoptic_so_pin }}" + KRYOPTIC_USER_PIN: "{{ siguldry_kryoptic_user_pin }}" + when: not kryoptic_db.stat.exists + tags: + - config + - siguldry + - siguldry/server + +- name: Check for existing binding key + ansible.builtin.command: + cmd: >- + pkcs11-tool + --module /usr/lib64/pkcs11/libkryoptic_pkcs11.so + --login + --pin env:KRYOPTIC_USER_PIN + --list-objects + --type privkey + environment: + KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}" + KRYOPTIC_USER_PIN: "{{ siguldry_kryoptic_user_pin }}" + register: kryoptic_objects + changed_when: false + tags: + - config + - siguldry + - siguldry/server + +- name: Generate RSA binding key pair + ansible.builtin.command: + cmd: >- + pkcs11-tool + --module /usr/lib64/pkcs11/libkryoptic_pkcs11.so + --login + --pin env:KRYOPTIC_USER_PIN + --keypairgen + --key-type rsa:4096 + --usage-sign + --usage-decrypt + --id 1 + --label siguldry-binding-key + environment: + KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}" + KRYOPTIC_USER_PIN: "{{ siguldry_kryoptic_user_pin }}" + when: "'siguldry-binding-key' not in kryoptic_objects.stdout" + tags: + - config + - siguldry + - siguldry/server + +- name: Create self-signed x509 binding certificate + ansible.builtin.command: + cmd: >- + openssl req -x509 + -provider pkcs11 + -subj /CN=siguldry-binding-key + -passin pass:{{ siguldry_kryoptic_user_pin }} + -key pkcs11:token=siguldry-stg-token;type=private + -out /etc/siguldry/kryoptic-binding.crt + creates: /etc/siguldry/kryoptic-binding.crt + environment: + KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}" + tags: + - config + - siguldry + - siguldry/server + +- name: Import x509 certificate to token + ansible.builtin.command: + cmd: >- + pkcs11-tool + --module /usr/lib64/pkcs11/libkryoptic_pkcs11.so + --login + --pin env:KRYOPTIC_USER_PIN + --keypairgen + --key-type rsa:4096 + --usage-sign + --usage-decrypt + --id 1 + --label siguldry-binding-key + environment: + KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}" + KRYOPTIC_USER_PIN: "{{ siguldry_kryoptic_user_pin }}" + when: "'siguldry-binding-key' not in kryoptic_objects.stdout" + tags: + - config + - siguldry + - siguldry/server diff --git a/roles/siguldry/server/tasks/main.yml b/roles/siguldry/server/tasks/main.yml new file mode 100644 index 0000000000..c205deb2bc --- /dev/null +++ b/roles/siguldry/server/tasks/main.yml @@ -0,0 +1,202 @@ +--- +- name: Install siguldry package + ansible.builtin.package: + state: present + name: siguldry + tags: + - packages + - siguldry + - siguldry/server + +# We only need to grant the service explicit access to the TPM on systemd < 258 +- name: Get systemd version + ansible.builtin.command: systemctl --version + register: systemd_version_output + changed_when: systemd_version_output.rc != 0 + +- name: Set whether explicit AllowDevice override is needed + ansible.builtin.set_fact: + explicit_allow_tpm: "{{ (systemd_version_output.stdout_lines[0] | regex_search('\\d+') | int) < 258 }}" + +- name: Create siguldry config directory + ansible.builtin.file: + path: /etc/siguldry + state: directory + owner: root + group: root + mode: '0755' + tags: + - config + - siguldry + - siguldry/server + +- name: Create credstore.encrypted directory + ansible.builtin.file: + path: /etc/credstore.encrypted + state: directory + owner: root + group: root + mode: '0700' + tags: + - config + - siguldry + - siguldry/server + +- name: Ensure the siguldry state directory exists + ansible.builtin.file: + path: /var/lib/siguldry + state: directory + owner: siguldry + group: siguldry + mode: '0750' + tags: + - siguldry + - siguldry/server + +- name: Create siguldry-signer systemd override directory + ansible.builtin.file: + path: /etc/systemd/system/siguldry-signer@.service.d + state: directory + owner: root + group: root + mode: '0755' + tags: + - config + - siguldry + - siguldry/server + +- name: Setup siguldry-signer systemd override file + ansible.builtin.template: + src: signer-override.conf.j2 + dest: /etc/systemd/system/siguldry-signer@.service.d/override.conf + owner: root + group: root + mode: '0644' + notify: Restart siguldry-server + tags: + - config + - siguldry + - siguldry/server + +- name: Create siguldry-server systemd override directory + ansible.builtin.file: + path: /etc/systemd/system/siguldry-server.service.d + state: directory + owner: root + group: root + mode: '0755' + tags: + - config + - siguldry + - siguldry/server + +- name: Setup siguldry-server systemd override file + ansible.builtin.template: + src: server-override.conf.j2 + dest: /etc/systemd/system/siguldry-server.service.d/override.conf + owner: root + group: root + mode: '0644' + notify: Restart siguldry-server + tags: + - config + - siguldry + - siguldry/server + +- name: Setup siguldry-server config file + ansible.builtin.template: + src: server.toml.j2 + dest: /etc/siguldry/server.toml + owner: root + group: root + mode: '0644' + notify: Restart siguldry-server + tags: + - config + - siguldry + - siguldry/server + +- name: Setup server certificate + ansible.builtin.copy: + src: "{{ private }}/files/siguldryca/{{ env }}/pki/issued/siguldry-server.crt" + dest: /etc/siguldry/server.crt + owner: root + group: root + mode: '0644' + tags: + - config + - siguldry + - siguldry/server + +- name: Setup CA certificate + ansible.builtin.copy: + src: "{{ private }}/files/siguldryca/{{ env }}/pki/ca.crt" + dest: /etc/siguldry/ca.crt + owner: root + group: root + mode: '0644' + tags: + - config + - siguldry + - siguldry/server + +- name: Setup binding certificates + ansible.builtin.copy: + src: "{{ private }}/files/sigul/{{ item }}" + dest: "/etc/siguldry/{{ item }}" + owner: root + group: root + mode: '0644' + with_items: + - yubikey_sv03.pem + - yubikey_sv04.pem + - yubikey_sv05.pem + - yubikey_sv06.pem + when: env == "production" + tags: + - config + - siguldry + - siguldry/server + +- name: Setup software HSM for binding certificate in staging + ansible.builtin.include_tasks: kryoptic.yml + when: env != "production" + tags: + - siguldry + - siguldry/server + +- name: Check if siguldry database is initialized + ansible.builtin.stat: + path: /var/lib/siguldry/siguldry.sqlite + register: siguldry_db + tags: + - config + - siguldry + - siguldry/server + +- name: Initialize Siguldry database + ansible.builtin.command: + cmd: >- + systemd-run --pty --wait --collect + --working-directory=/var/lib/siguldry + --setenv=SIGULDRY_SERVER_CONFIG=/etc/siguldry/server.toml + --property=UMask=017 + --uid=siguldry + --gid=siguldry + siguldry-server manage migrate + when: not siguldry_db.stat.exists + tags: + - config + - siguldry + - siguldry/server + +- name: Enable and start siguldry-server service + ansible.builtin.systemd: + name: siguldry-server.service + enabled: yes + state: started + daemon_reload: yes + tags: + - services + - siguldry + - siguldry/server diff --git a/roles/siguldry/server/templates/kryoptic.toml.j2 b/roles/siguldry/server/templates/kryoptic.toml.j2 new file mode 100644 index 0000000000..4880b0a7cf --- /dev/null +++ b/roles/siguldry/server/templates/kryoptic.toml.j2 @@ -0,0 +1,4 @@ +[[slots]] +slot = 1 +dbtype = "sqlite" +dbargs = "{{ siguldry_kryoptic_db }}" diff --git a/roles/siguldry/server/templates/server-override.conf.j2 b/roles/siguldry/server/templates/server-override.conf.j2 new file mode 100644 index 0000000000..208a3ce655 --- /dev/null +++ b/roles/siguldry/server/templates/server-override.conf.j2 @@ -0,0 +1,17 @@ +[Service] +# Tweak for lower/higher log verbosity. +# Refer to https://docs.rs/tracing-subscriber/0.3.19/tracing_subscriber/filter/struct.EnvFilter.html#directives +Environment=SIGULDRY_SERVER_LOG="WARN,siguldry=INFO" + +{% if env != "production" %} +# Kryoptic software HSM configuration for staging +Environment=KRYOPTIC_CONF="{{ siguldry_kryoptic_conf }}" +{% endif %} + +{% if explicit_allow_tpm %} +# Credentials require the TPM to decrypt. +# +# For systemd 257 and older you'll need to explicitly allow access to the TPM +# Refer to https://github.com/systemd/systemd/issues/35959. +DeviceAllow=/dev/tpmrm0 +{% endif %} diff --git a/roles/siguldry/server/templates/server.toml.j2 b/roles/siguldry/server/templates/server.toml.j2 new file mode 100644 index 0000000000..759673e6c6 --- /dev/null +++ b/roles/siguldry/server/templates/server.toml.j2 @@ -0,0 +1,101 @@ +# The location where the server should store its state. +# +# To back up the service, back up this directory. +state_directory = "/var/lib/siguldry/" + +# The hostname of the Siguldry bridge. +{% if env == "production" %} +bridge_hostname = "sign-bridge.{{datacenter}}.fedoraproject.org" +{% else %} +bridge_hostname = "sign-bridge.stg.{{datacenter}}.fedoraproject.org" +{% endif %} + +# The port to use when connecting to the Siguldry bridge. +bridge_port = 44333 + +# The number of ready connections to maintain with the bridge. This decreases the latency of +# responses when multiple client connections are established, at the expense of some idle +# connections. Be aware that the bridge has its own limits on the allowable number of idle +# server connections. If you use multiple servers with a single bridge, be sure that the +# bridge allows enough idle connections to cover each server's pool size. The default is 32. +connection_pool_size = 32 + +# The minimum length for user's access password, in *bytes*. For example, the multi-byte +# UTF-8 character "🪿" counts as 4 bytes. +user_password_length = 64 + +# The user ID to use when creating OpenPGP keys. +# +# This is typically an email like "Signing Key ". +openpgp_user_id = "Fedora " + +# The set of certificates to encrypt passwords with. +# +# At least one entry should include a PKCS#11 URI for a private key. Signing keys are encrypted +# using each certificate, so providing more than one binding means *any* of the private keys +# associated with the certificates will allow you to access the signing key, assuming you have +# the user-set password for the key as well. +# +# When binding is used, the admin needs to unlock the token by entering the PIN using +# "siguldry-server enter-pin". +# +# If no bindings are configured, the keys are protected using only the user-provided +# password. +# +# An example binding entry: +# +# [[pkcs11_bindings]] +# certificate = "/path/to/cert.pem" +# private_key = "pkcs11:token=some-token;type=private" +# +# [[pkcs11_bindings]] +# certificate = "/path/to/a/second/cert.pem" +{% if env == "production" %} +[[pkcs11_bindings]] +certificate = "/etc/sigul/yubikey_sv03.pem" +{% if inventory_hostname.startswith('sign-vault03') %} +private_key = "pkcs11:serial=8f2a341e00d7a665;id=%03;type=private" +{% endif %} + +[[pkcs11_bindings]] +certificate = "/etc/sigul/yubikey_sv04.pem" +{% if inventory_hostname.startswith('sign-vault04') %} +private_key = "pkcs11:serial=b38ee13e56b3b987;id=%03;type=private" +{% endif %} + +[[pkcs11_bindings]] +certificate = "/etc/siguldry/yubikey_sv05.pem" +{% if inventory_hostname.startswith('sign-vault05') %} +private_key = "pkcs11:serial=e8dae68ae187ff13;id=%03;type=private" +{% endif %} + +[[pkcs11_bindings]] +certificate = "/etc/siguldry/yubikey_sv06.pem" +{% if inventory_hostname.startswith('sign-vault06') or inventory_hostname == "sign-vault01.rdu3.fedoraproject.org" %} +private_key = "pkcs11:serial=e3c4804a6631dd5f;id=%03;type=private" +{% endif %} + +{% else %} +# In staging, use Kryoptic as a software HSM for binding +[[pkcs11_bindings]] +certificate = "/etc/siguldry/kryoptic-binding.crt" +private_key = "pkcs11:token=siguldry-stg-token;type=private" +{% endif %} + +# The credentials to use when connecting to the bridge and when accepting client connections +# tunneled through the bridge. Note that the certificate must have both `clientAuth` and +# `serverAuth` in its extended key usage extension. +[credentials] +private_key = "siguldry.server.private_key.pem" +certificate = "/etc/siguldry/server.crt" +ca_certificate = "/etc/siguldry/ca.crt" + +# Certificates created by Siguldry allow the user to specify the subject's common name. +# +# The rest of the certificate's subject is specified here. +[certificate_subject] +country = "US" +state_or_province = "North Carolina" +locality = "Raleigh" +organization = "Red Hat, Inc." +organizational_unit = "The Fedora Project" diff --git a/roles/siguldry/server/templates/signer-override.conf.j2 b/roles/siguldry/server/templates/signer-override.conf.j2 new file mode 100644 index 0000000000..cf279bc5b6 --- /dev/null +++ b/roles/siguldry/server/templates/signer-override.conf.j2 @@ -0,0 +1,11 @@ +[Service] +# Tweak for lower/higher log verbosity. +# Refer to https://docs.rs/tracing-subscriber/0.3.19/tracing_subscriber/filter/struct.EnvFilter.html#directives +Environment=SIGULDRY_SERVER_LOG="WARN,siguldry=INFO" + +# Unbinding keys requires access to a Yubikey +# I'm not sure there's a good way to allow _only_ the Yubikey device. +# +# TODO: also need to add access to whatever device has the Secure Boot keys. +# Also TODO: is this even the right way to expose USB devices? +DeviceAllow=/dev/bus/usb