releng/tickets

Fork 2

Task 1: Convert the toggle script for switching koji for external builders into playbook #13161

New issue

Closed

opened 2026-01-12 12:37:11 +00:00 by jnsamyak · 4 comments

jnsamyak commented

2026-01-12 12:37:11 +00:00

Owner

Describe the issue

When do you need this? (YYYY/MM/DD)

When is this no longer needed or useful? (YYYY/MM/DD)

If we cannot complete this, what is the impact? [Dependencies/Blocker]

Checklist

I have checked existing issues for duplicates
I have filled out all the fields above
I have provided relevant links or references (if applicable)

## Describe the issue  ## When do you need this? (YYYY/MM/DD)  ## When is this no longer needed or useful? (YYYY/MM/DD)  ## If we cannot complete this, what is the impact? [Dependencies/Blocker]  --- ## Checklist - [x] I have checked existing issues for duplicates - [ ] I have filled out all the fields above - [ ] I have provided relevant links or references (if applicable)

jnsamyak added the

Work Item

Task

points

labels

2026-01-12 12:37:11 +00:00

jnsamyak self-assigned this

2026-01-12 12:37:11 +00:00

jnsamyak added this to the Fedora Releng Sprint 7 project

2026-01-12 12:37:11 +00:00

jnsamyak added a new dependency

2026-01-12 12:37:28 +00:00

#9674 Create an ansible playbook to do the mass-branching

jnsamyak commented

2026-01-14 15:02:12 +00:00

Author

Owner

cf: https://pagure.io/fedora-infra/ansible/pull-request/3040

jnsamyak modified the project from Fedora Releng Sprint 7 to Sprint ( 2026-02-09 - 2026-02-22 )

2026-02-10 12:13:21 +00:00

patrikp modified the project from Sprint ( 2026-02-09 - 2026-02-22 ) to Sprint ( 2026-02-23 to 2026-03-08 )

2026-02-23 13:09:41 +00:00

jnsamyak removed this from the Sprint ( 2026-02-23 to 2026-03-08 ) project

2026-02-23 15:41:27 +00:00

jnsamyak added this to the Backlog project

2026-02-23 15:41:43 +00:00

jnsamyak modified the project from Backlog to Current Sprint ( 2026-06-29 to 2026-07-12 )

2026-06-29 13:32:25 +00:00

jnsamyak commented

2026-07-07 06:38:43 +00:00

Author

Owner

okay so I added this back: infra/ansible#3488; Plan to get this in the sprint.

okay so I added this back: https://forge.fedoraproject.org/infra/ansible/pulls/3488; Plan to get this in the sprint.

jnsamyak commented

2026-07-07 07:56:26 +00:00

Author

Owner

Okay, so I tried testing things in koji staging, looks good, happy to let you folks test it once

ok: [koji01.stg.rdu3.fedoraproject.org] => {
    "msg": "Blocked tcp/80 from 10.16.166.74, 10.16.166.75"
}

Commands to follow (to test it out):

$PLAYBOOK="/srv/web/infra/ansible/playbooks/manual/releng/koji-http-toggle.yml"

# 1. Baseline should show (no table) / (no set) if never blocked
sudo -i ansible-playbook $PLAYBOOK \
  -e "koji_action=status" \
  -e "koji_hosts=koji_stg"

# 2. Block staging Koji from proxies
sudo -i ansible-playbook $PLAYBOOK \
  -e "koji_action=block" \
  -e "koji_hosts=koji_stg"

# 3. Verify nftables state: expect table, set with proxy IPs, drop rule
sudo -i ansible-playbook $PLAYBOOK \
  -e "koji_action=status" \
  -e "koji_hosts=koji_stg"

# 4. Unblock staging
sudo -i ansible-playbook $PLAYBOOK \
  -e "koji_action=unblock" \
  -e "koji_hosts=koji_stg"

# 5. Confirm clean state again
sudo -i ansible-playbook $PLAYBOOK \
  -e "koji_action=status" \
  -e "koji_hosts=koji_stg"

Unblock restores access as soon as the nftables set is flushed (even if rule cleanup fails), because an empty set means the drop rule matches nothing.

CC: @patrikp @kevin

Okay, so I tried testing things in koji staging, looks good, happy to let you folks test it once ``` ok: [koji01.stg.rdu3.fedoraproject.org] => { "msg": "Blocked tcp/80 from 10.16.166.74, 10.16.166.75" } ``` Commands to follow (to test it out): ``` $PLAYBOOK="/srv/web/infra/ansible/playbooks/manual/releng/koji-http-toggle.yml" # 1. Baseline should show (no table) / (no set) if never blocked sudo -i ansible-playbook $PLAYBOOK \ -e "koji_action=status" \ -e "koji_hosts=koji_stg" # 2. Block staging Koji from proxies sudo -i ansible-playbook $PLAYBOOK \ -e "koji_action=block" \ -e "koji_hosts=koji_stg" # 3. Verify nftables state: expect table, set with proxy IPs, drop rule sudo -i ansible-playbook $PLAYBOOK \ -e "koji_action=status" \ -e "koji_hosts=koji_stg" # 4. Unblock staging sudo -i ansible-playbook $PLAYBOOK \ -e "koji_action=unblock" \ -e "koji_hosts=koji_stg" # 5. Confirm clean state again sudo -i ansible-playbook $PLAYBOOK \ -e "koji_action=status" \ -e "koji_hosts=koji_stg" ``` Unblock restores access as soon as the nftables set is flushed (even if rule cleanup fails), because an empty set means the drop rule matches nothing. CC: @patrikp @kevin

jnsamyak referenced this issue from infra/ansible

2026-07-07 07:56:57 +00:00

fix(koji-http-toggle): resolve proxy IPs via shell so awk pipe works #3489

jnsamyak referenced this issue from infra/ansible

2026-07-07 07:57:15 +00:00

Add Ansible playbook to toggle Koji HTTP access with nftables #3488

jnsamyak referenced this issue from infra/ansible

2026-07-07 07:57:59 +00:00

fix(koji-http-toggle): delete each nft drop rule handle separately #3490

jnsamyak added the

Priority

Medium