From 709f7a12c49f2a5ff4545eddb5c455cdfefbd8de Mon Sep 17 00:00:00 2001 From: Michal Konecny Date: Wed, 25 Feb 2026 13:19:52 +0100 Subject: [PATCH 01/17] Add ignore-errors to skip list This will ignore CI errors in category ignore-errors in ansible-lint as this is something we don't need to care about. Signed-off-by: Michal Konecny --- .ansible-lint | 1 + 1 file changed, 1 insertion(+) diff --git a/.ansible-lint b/.ansible-lint index d50fc9a060..cc05ba098d 100644 --- a/.ansible-lint +++ b/.ansible-lint @@ -67,3 +67,4 @@ skip_list: - role-name[path] - var-naming[no-role-prefix] - no-changed-when + - ignore-errors From 76e6ffd412bfa6fa47a15eaeb3c09608872386b2 Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Thu, 26 Feb 2026 16:55:29 +0000 Subject: [PATCH 02/17] Zabbix: Try to improve SSL check to handle timeouts from whatcanido Signed-off-by: Greg Sutcliffe --- roles/zabbix/sslchecks/tasks/sslcheck.yml | 8 +++++--- .../zabbix_server/files/externalscripts/zext_ssl_cert.sh | 2 +- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/roles/zabbix/sslchecks/tasks/sslcheck.yml b/roles/zabbix/sslchecks/tasks/sslcheck.yml index 049f536a45..1a2954981d 100644 --- a/roles/zabbix/sslchecks/tasks/sslcheck.yml +++ b/roles/zabbix/sslchecks/tasks/sslcheck.yml @@ -12,7 +12,6 @@ tags: - zabbix_agent - zabbix_api - - pagure block: - name: Create {{ item.name }} cert age item community.zabbix.zabbix_item: @@ -25,9 +24,12 @@ units: 'days' timeout: '10s' interval: '12h' + preprocessing: + - type: check_unsupported + error_handler: set_custom_error_message + error_handler_params: 'failed to execute zext_ssl_cert.sh' + params: '-1' # corresponds to 'any value' in the UI params tags: - - tag: application - value: pagure - tag: component value: ssl diff --git a/roles/zabbix/zabbix_server/files/externalscripts/zext_ssl_cert.sh b/roles/zabbix/zabbix_server/files/externalscripts/zext_ssl_cert.sh index 0f9e70925c..788ff84310 100755 --- a/roles/zabbix/zabbix_server/files/externalscripts/zext_ssl_cert.sh +++ b/roles/zabbix/zabbix_server/files/externalscripts/zext_ssl_cert.sh @@ -14,7 +14,7 @@ EXPIRY=$(echo | timeout 5 openssl s_client -servername $HOST -connect $HOST:$POR openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2) if [ -z "$EXPIRY" ]; then - echo 0 + echo "timeout connecting to $HOST" exit 1 fi From d619073a1541dae1b7d0a7e6e09a0b332192c746 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADt=20Smol=C3=ADk?= Date: Sat, 14 Feb 2026 16:36:49 +0100 Subject: [PATCH 03/17] Add sysadmin-readonly group to openshift MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Vít Smolík --- .../templates/sysadmin-readonly-group.yml.j2 | 9 ++++++ .../templates/sysadmin-readonly-role.yml.j2 | 32 +++++++++++++++++++ .../sysadmin-readonly-rolebinding.yml.j2 | 13 ++++++++ 3 files changed, 54 insertions(+) create mode 100644 roles/openshift/cluster/templates/sysadmin-readonly-group.yml.j2 create mode 100644 roles/openshift/cluster/templates/sysadmin-readonly-role.yml.j2 create mode 100644 roles/openshift/cluster/templates/sysadmin-readonly-rolebinding.yml.j2 diff --git a/roles/openshift/cluster/templates/sysadmin-readonly-group.yml.j2 b/roles/openshift/cluster/templates/sysadmin-readonly-group.yml.j2 new file mode 100644 index 0000000000..4c4da2ab28 --- /dev/null +++ b/roles/openshift/cluster/templates/sysadmin-readonly-group.yml.j2 @@ -0,0 +1,9 @@ +--- +kind: Group +apiVersion: user.openshift.io/v1 +metadata: + name: "sysadmin-readonly" +users: +{% for item in cluster_appowners %} +- "{{ item }}" +{% endfor %} diff --git a/roles/openshift/cluster/templates/sysadmin-readonly-role.yml.j2 b/roles/openshift/cluster/templates/sysadmin-readonly-role.yml.j2 new file mode 100644 index 0000000000..320d57d1f4 --- /dev/null +++ b/roles/openshift/cluster/templates/sysadmin-readonly-role.yml.j2 @@ -0,0 +1,32 @@ +--- +kind: Role +apiVersion: user.openshift.io/v1 +metadata: + name: "sysadmin-openshift" +rules: +- apiGroups: + - "" + resources: + - endpoints + - persistentvolumeclaims + - persistentvolumeclaims/status + - pods + - replicationcontrollers + - replicationcontrollers/scale + - serviceaccounts + - services + - services/status + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - configmaps + resourceNames: + - SAFE_CONFIGMAPS, REPLACE THIS + verbs: + - get + - list + - watch diff --git a/roles/openshift/cluster/templates/sysadmin-readonly-rolebinding.yml.j2 b/roles/openshift/cluster/templates/sysadmin-readonly-rolebinding.yml.j2 new file mode 100644 index 0000000000..c55569625b --- /dev/null +++ b/roles/openshift/cluster/templates/sysadmin-readonly-rolebinding.yml.j2 @@ -0,0 +1,13 @@ +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: "sysadmin-readonly" +subjects: + - kind: Group + apiGroup: rbac.authorization.k8s.io + name: "sysadmin-readonly" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: cluster-readonly From ae70d6e83a16026b962de3be6a53ae1bf579da9a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADt=20Smol=C3=ADk?= Date: Mon, 16 Feb 2026 20:28:58 +0100 Subject: [PATCH 04/17] fix wrong role name in role definition MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Vít Smolík --- roles/openshift/cluster/templates/sysadmin-readonly-role.yml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/openshift/cluster/templates/sysadmin-readonly-role.yml.j2 b/roles/openshift/cluster/templates/sysadmin-readonly-role.yml.j2 index 320d57d1f4..811a93402c 100644 --- a/roles/openshift/cluster/templates/sysadmin-readonly-role.yml.j2 +++ b/roles/openshift/cluster/templates/sysadmin-readonly-role.yml.j2 @@ -2,7 +2,7 @@ kind: Role apiVersion: user.openshift.io/v1 metadata: - name: "sysadmin-openshift" + name: "sysadmin-readonly" rules: - apiGroups: - "" From f601a5ce0b0de9c3cfd25c757d4dccbf6e83c45a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADt=20Smol=C3=ADk?= Date: Mon, 16 Feb 2026 21:34:36 +0100 Subject: [PATCH 05/17] remove access to configmaps from sysadmin-readonly MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Vít Smolík --- .../cluster/templates/sysadmin-readonly-role.yml.j2 | 9 --------- 1 file changed, 9 deletions(-) diff --git a/roles/openshift/cluster/templates/sysadmin-readonly-role.yml.j2 b/roles/openshift/cluster/templates/sysadmin-readonly-role.yml.j2 index 811a93402c..20047ae7e7 100644 --- a/roles/openshift/cluster/templates/sysadmin-readonly-role.yml.j2 +++ b/roles/openshift/cluster/templates/sysadmin-readonly-role.yml.j2 @@ -20,13 +20,4 @@ rules: - get - list - watch -- apiGroups: - - "" - resources: - - configmaps - resourceNames: - - SAFE_CONFIGMAPS, REPLACE THIS - verbs: - - get - - list - watch From a7ce1173a6bde027720f957150e77b51e4f01126 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADt=20Smol=C3=ADk?= Date: Mon, 16 Feb 2026 21:35:15 +0100 Subject: [PATCH 06/17] apply sysadmin-readonly when env is staging MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Vít Smolík --- roles/openshift/cluster/tasks/main.yaml | 33 ++++++++++++++++++++++--- 1 file changed, 29 insertions(+), 4 deletions(-) diff --git a/roles/openshift/cluster/tasks/main.yaml b/roles/openshift/cluster/tasks/main.yaml index 76f2ce413b..3554a07e8b 100644 --- a/roles/openshift/cluster/tasks/main.yaml +++ b/roles/openshift/cluster/tasks/main.yaml @@ -11,24 +11,49 @@ - create-resources # generate the templates for project to be created -- name: Copy the templates +- name: Copy base templates ansible.builtin.template: src: "{{ item }}.j2" dest: "{{ cluster_filepath }}/{{ item }}" mode: "0640" + with_items: - sysadmin-openshift-group.yml - sysadmin-openshift-rolebinding.yml - webhooks-clusterrolebinding.yml - forward-logs-to-log01.yml - register: cluster_template_result + register: cluster_template_result_base + tags: + - create-resources + +- name: Copy stg-only templates + ansible.builtin.template: + src: "{{ item }}.j2" + dest: "{{ cluster_filepath }}/{{ item }}" + mode: "0640" + + with_items: + - sysadmin-readonly-group.yml + - sysadmin-readonly-rolebinding.yml + - sysadmin-readonly-role.yml + register: cluster_template_result_staging + when: env == "staging" tags: - create-resources # apply created openshift resources -- name: Oc apply resources +- name: Oc apply base resources ansible.builtin.command: "oc apply --validate=strict -f {{ item.dest }}" - with_items: "{{ cluster_template_result.results }}" + with_items: "{{ cluster_template_result_base.results }}" when: item.changed tags: - create-resources + +- name: Oc apply stg-only resources + ansible.builtin.command: "oc apply --validate=strict -f {{ item.dest }}" + with_items: "{{ cluster_template_result_staging.results }}" + when: + - item.changed + - env == "staging" + tags: + - create-resources From 7b4774117dfa2c9ab264becea956ecb59b17e0bc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADt=20Smol=C3=ADk?= Date: Mon, 16 Feb 2026 22:38:14 +0100 Subject: [PATCH 07/17] setup handlers, so ansible-lint is happy MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Vít Smolík --- roles/openshift/cluster/handlers/main.yml | 20 ++++++++++++++++++++ roles/openshift/cluster/tasks/main.yaml | 17 ----------------- 2 files changed, 20 insertions(+), 17 deletions(-) create mode 100644 roles/openshift/cluster/handlers/main.yml diff --git a/roles/openshift/cluster/handlers/main.yml b/roles/openshift/cluster/handlers/main.yml new file mode 100644 index 0000000000..f491f00405 --- /dev/null +++ b/roles/openshift/cluster/handlers/main.yml @@ -0,0 +1,20 @@ +--- +- name: Apply base resources + ansible.builtin.command: "oc apply --validate=strict -f {{ cluster_filepath }}/{{ item }}" + with_items: + - sysadmin-openshift-group.yml + - sysadmin-openshift-rolebinding.yml + - webhooks-clusterrolebinding.yml + - forward-logs-to-log01.yml + tags: + - create-resources + +- name: Apply staging resources + ansible.builtin.command: "oc apply --validate=strict -f {{ cluster_filepath }}/{{ item }}" + with_items: + - sysadmin-readonly-group.yml + - sysadmin-readonly-rolebinding.yml + - sysadmin-readonly-role.yml + when: env == "staging" + tags: + - create-resources diff --git a/roles/openshift/cluster/tasks/main.yaml b/roles/openshift/cluster/tasks/main.yaml index 3554a07e8b..13d6487e56 100644 --- a/roles/openshift/cluster/tasks/main.yaml +++ b/roles/openshift/cluster/tasks/main.yaml @@ -40,20 +40,3 @@ when: env == "staging" tags: - create-resources - -# apply created openshift resources -- name: Oc apply base resources - ansible.builtin.command: "oc apply --validate=strict -f {{ item.dest }}" - with_items: "{{ cluster_template_result_base.results }}" - when: item.changed - tags: - - create-resources - -- name: Oc apply stg-only resources - ansible.builtin.command: "oc apply --validate=strict -f {{ item.dest }}" - with_items: "{{ cluster_template_result_staging.results }}" - when: - - item.changed - - env == "staging" - tags: - - create-resources From b4ff5f819d7edc8b2bd4448f3fb80c944636c578 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADt=20Smol=C3=ADk?= Date: Mon, 16 Feb 2026 22:43:37 +0100 Subject: [PATCH 08/17] remove trailing spaces MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Vít Smolík --- roles/openshift/cluster/tasks/main.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/openshift/cluster/tasks/main.yaml b/roles/openshift/cluster/tasks/main.yaml index 13d6487e56..6f5489f2ee 100644 --- a/roles/openshift/cluster/tasks/main.yaml +++ b/roles/openshift/cluster/tasks/main.yaml @@ -16,7 +16,7 @@ src: "{{ item }}.j2" dest: "{{ cluster_filepath }}/{{ item }}" mode: "0640" - + with_items: - sysadmin-openshift-group.yml - sysadmin-openshift-rolebinding.yml @@ -31,7 +31,7 @@ src: "{{ item }}.j2" dest: "{{ cluster_filepath }}/{{ item }}" mode: "0640" - + with_items: - sysadmin-readonly-group.yml - sysadmin-readonly-rolebinding.yml From 4d8a14db4e26fa2e6096258210a6ba6f2705f93a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADt=20Smol=C3=ADk?= Date: Tue, 17 Feb 2026 15:56:22 +0100 Subject: [PATCH 09/17] move handling back to main.yml and rename role to sysadmin-openshift-readonly MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Vít Smolík --- roles/openshift/cluster/handlers/main.yml | 20 --------- roles/openshift/cluster/tasks/main.yaml | 41 ++++++++++--------- ... sysadmin-openshift-readonly-group.yml.j2} | 2 +- ...> sysadmin-openshift-readonly-role.yml.j2} | 2 +- ...min-openshift-readonly-rolebinding.yml.j2} | 4 +- 5 files changed, 25 insertions(+), 44 deletions(-) delete mode 100644 roles/openshift/cluster/handlers/main.yml rename roles/openshift/cluster/templates/{sysadmin-readonly-group.yml.j2 => sysadmin-openshift-readonly-group.yml.j2} (77%) rename roles/openshift/cluster/templates/{sysadmin-readonly-role.yml.j2 => sysadmin-openshift-readonly-role.yml.j2} (89%) rename roles/openshift/cluster/templates/{sysadmin-readonly-rolebinding.yml.j2 => sysadmin-openshift-readonly-rolebinding.yml.j2} (74%) diff --git a/roles/openshift/cluster/handlers/main.yml b/roles/openshift/cluster/handlers/main.yml deleted file mode 100644 index f491f00405..0000000000 --- a/roles/openshift/cluster/handlers/main.yml +++ /dev/null @@ -1,20 +0,0 @@ ---- -- name: Apply base resources - ansible.builtin.command: "oc apply --validate=strict -f {{ cluster_filepath }}/{{ item }}" - with_items: - - sysadmin-openshift-group.yml - - sysadmin-openshift-rolebinding.yml - - webhooks-clusterrolebinding.yml - - forward-logs-to-log01.yml - tags: - - create-resources - -- name: Apply staging resources - ansible.builtin.command: "oc apply --validate=strict -f {{ cluster_filepath }}/{{ item }}" - with_items: - - sysadmin-readonly-group.yml - - sysadmin-readonly-rolebinding.yml - - sysadmin-readonly-role.yml - when: env == "staging" - tags: - - create-resources diff --git a/roles/openshift/cluster/tasks/main.yaml b/roles/openshift/cluster/tasks/main.yaml index 6f5489f2ee..5c5efe5029 100644 --- a/roles/openshift/cluster/tasks/main.yaml +++ b/roles/openshift/cluster/tasks/main.yaml @@ -10,33 +10,34 @@ tags: - create-resources +- name: Set template lists + ansible.builtin.set_fact: + base_templates: + - sysadmin-openshift-group.yml + - sysadmin-openshift-rolebinding.yml + - webhooks-clusterrolebinding.yml + - forward-logs-to-log01.yml + stg_templates: + - sysadmin-openshift-readonly-rolebinding.yml + - sysadmin-openshift-readonly-role.yml + - sysadmin-openshift-readonly-group.yml + # generate the templates for project to be created -- name: Copy base templates +- name: Copy templates ansible.builtin.template: src: "{{ item }}.j2" dest: "{{ cluster_filepath }}/{{ item }}" mode: "0640" - - with_items: - - sysadmin-openshift-group.yml - - sysadmin-openshift-rolebinding.yml - - webhooks-clusterrolebinding.yml - - forward-logs-to-log01.yml - register: cluster_template_result_base + with_items: "{{ base_templates + (stg_templates if env == 'staging' else []) }}" + register: cluster_template_result tags: - create-resources -- name: Copy stg-only templates - ansible.builtin.template: - src: "{{ item }}.j2" - dest: "{{ cluster_filepath }}/{{ item }}" - mode: "0640" - - with_items: - - sysadmin-readonly-group.yml - - sysadmin-readonly-rolebinding.yml - - sysadmin-readonly-role.yml - register: cluster_template_result_staging - when: env == "staging" +# apply created openshift resources +- name: Oc apply resources + ansible.builtin.command: "oc apply --validate=strict -f {{ item.dest }}" + with_items: "{{ cluster_template_result.results }}" + when: item_changed + changed_when: true tags: - create-resources diff --git a/roles/openshift/cluster/templates/sysadmin-readonly-group.yml.j2 b/roles/openshift/cluster/templates/sysadmin-openshift-readonly-group.yml.j2 similarity index 77% rename from roles/openshift/cluster/templates/sysadmin-readonly-group.yml.j2 rename to roles/openshift/cluster/templates/sysadmin-openshift-readonly-group.yml.j2 index 4c4da2ab28..d3edf2cd71 100644 --- a/roles/openshift/cluster/templates/sysadmin-readonly-group.yml.j2 +++ b/roles/openshift/cluster/templates/sysadmin-openshift-readonly-group.yml.j2 @@ -2,7 +2,7 @@ kind: Group apiVersion: user.openshift.io/v1 metadata: - name: "sysadmin-readonly" + name: "sysadmin-openshift-readonly" users: {% for item in cluster_appowners %} - "{{ item }}" diff --git a/roles/openshift/cluster/templates/sysadmin-readonly-role.yml.j2 b/roles/openshift/cluster/templates/sysadmin-openshift-readonly-role.yml.j2 similarity index 89% rename from roles/openshift/cluster/templates/sysadmin-readonly-role.yml.j2 rename to roles/openshift/cluster/templates/sysadmin-openshift-readonly-role.yml.j2 index 20047ae7e7..7c078b631c 100644 --- a/roles/openshift/cluster/templates/sysadmin-readonly-role.yml.j2 +++ b/roles/openshift/cluster/templates/sysadmin-openshift-readonly-role.yml.j2 @@ -2,7 +2,7 @@ kind: Role apiVersion: user.openshift.io/v1 metadata: - name: "sysadmin-readonly" + name: "sysadmin-openshift-readonly" rules: - apiGroups: - "" diff --git a/roles/openshift/cluster/templates/sysadmin-readonly-rolebinding.yml.j2 b/roles/openshift/cluster/templates/sysadmin-openshift-readonly-rolebinding.yml.j2 similarity index 74% rename from roles/openshift/cluster/templates/sysadmin-readonly-rolebinding.yml.j2 rename to roles/openshift/cluster/templates/sysadmin-openshift-readonly-rolebinding.yml.j2 index c55569625b..13ed76a271 100644 --- a/roles/openshift/cluster/templates/sysadmin-readonly-rolebinding.yml.j2 +++ b/roles/openshift/cluster/templates/sysadmin-openshift-readonly-rolebinding.yml.j2 @@ -2,11 +2,11 @@ kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: "sysadmin-readonly" + name: "sysadmin-openshift-readonly" subjects: - kind: Group apiGroup: rbac.authorization.k8s.io - name: "sysadmin-readonly" + name: "sysadmin-openshift-readonly" roleRef: apiGroup: rbac.authorization.k8s.io kind: Role From 4392472669413b6519fc48da026e140e5e01b912 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADt=20Smol=C3=ADk?= Date: Fri, 20 Feb 2026 08:54:01 +0100 Subject: [PATCH 10/17] separate template copying for stg/prod MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Vít Smolík --- roles/openshift/cluster/tasks/main.yaml | 31 ++++++++++++++++--- .../sysadmin-openshift-readonly-group.yml.j2 | 2 +- .../sysadmin-openshift-readonly-role.yml.j2 | 1 - 3 files changed, 27 insertions(+), 7 deletions(-) diff --git a/roles/openshift/cluster/tasks/main.yaml b/roles/openshift/cluster/tasks/main.yaml index 5c5efe5029..137c5d4382 100644 --- a/roles/openshift/cluster/tasks/main.yaml +++ b/roles/openshift/cluster/tasks/main.yaml @@ -23,21 +23,42 @@ - sysadmin-openshift-readonly-group.yml # generate the templates for project to be created -- name: Copy templates +- name: Copy tempaltes to production ansible.builtin.template: src: "{{ item }}.j2" dest: "{{ cluster_filepath }}/{{ item }}" mode: "0640" - with_items: "{{ base_templates + (stg_templates if env == 'staging' else []) }}" + with_items: + - sysadmin-openshift-group.yml + - sysadmin-openshift-rolebinding.yml + - webhooks-clusterrolebinding.yml + - forward-logs-to-log01.yml register: cluster_template_result - tags: - - create-resources + when: env == 'production' + + +- name: Copy templates to staging + ansible.builtin.template: + src: "{{ item }}.j2" + dest: "{{ cluster_filepath }}/{{ item }}" + mode: "0640" + with_items: + - sysadmin-openshift-group.yml + - sysadmin-openshift-rolebinding.yml + - webhooks-clusterrolebinding.yml + - forward-logs-to-log01.yml + - sysadmin-readonly-group.yml + - sysadmin-readonly-rolebinding.yml + - sysadmin-readonly-role.yml + register: cluster_template_result + when: env == 'staging' + # apply created openshift resources - name: Oc apply resources ansible.builtin.command: "oc apply --validate=strict -f {{ item.dest }}" with_items: "{{ cluster_template_result.results }}" - when: item_changed + when: item.changed changed_when: true tags: - create-resources diff --git a/roles/openshift/cluster/templates/sysadmin-openshift-readonly-group.yml.j2 b/roles/openshift/cluster/templates/sysadmin-openshift-readonly-group.yml.j2 index d3edf2cd71..78a30dd1b4 100644 --- a/roles/openshift/cluster/templates/sysadmin-openshift-readonly-group.yml.j2 +++ b/roles/openshift/cluster/templates/sysadmin-openshift-readonly-group.yml.j2 @@ -4,6 +4,6 @@ apiVersion: user.openshift.io/v1 metadata: name: "sysadmin-openshift-readonly" users: -{% for item in cluster_appowners %} +{% for item in cluster_readonly_appowners %} - "{{ item }}" {% endfor %} diff --git a/roles/openshift/cluster/templates/sysadmin-openshift-readonly-role.yml.j2 b/roles/openshift/cluster/templates/sysadmin-openshift-readonly-role.yml.j2 index 7c078b631c..44da84d331 100644 --- a/roles/openshift/cluster/templates/sysadmin-openshift-readonly-role.yml.j2 +++ b/roles/openshift/cluster/templates/sysadmin-openshift-readonly-role.yml.j2 @@ -20,4 +20,3 @@ rules: - get - list - watch - - watch From 08928917e6605c23c8237f07a264d312907b56e3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADt=20Smol=C3=ADk?= Date: Wed, 25 Feb 2026 15:25:02 +0100 Subject: [PATCH 11/17] feat: add handler in openshift/clustr for applying changes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Vít Smolík --- roles/openshift/cluster/main.yaml | 7 +++++ roles/openshift/cluster/tasks/main.yaml | 35 +++---------------------- 2 files changed, 10 insertions(+), 32 deletions(-) create mode 100644 roles/openshift/cluster/main.yaml diff --git a/roles/openshift/cluster/main.yaml b/roles/openshift/cluster/main.yaml new file mode 100644 index 0000000000..636076db42 --- /dev/null +++ b/roles/openshift/cluster/main.yaml @@ -0,0 +1,7 @@ +--- +- name: Apply changes to openshift + ansible.builtin.command: "oc apply --validate=strict -f {{ cluster_filepath }}/{{ item }}" + loop: "{{ base_templates + (stg_templates if env == 'staging' else []) }}" + changed_when: true + tags: + - create-resources diff --git a/roles/openshift/cluster/tasks/main.yaml b/roles/openshift/cluster/tasks/main.yaml index 137c5d4382..4f5c46c12e 100644 --- a/roles/openshift/cluster/tasks/main.yaml +++ b/roles/openshift/cluster/tasks/main.yaml @@ -23,42 +23,13 @@ - sysadmin-openshift-readonly-group.yml # generate the templates for project to be created -- name: Copy tempaltes to production +- name: Copy templates ansible.builtin.template: src: "{{ item }}.j2" dest: "{{ cluster_filepath }}/{{ item }}" mode: "0640" - with_items: - - sysadmin-openshift-group.yml - - sysadmin-openshift-rolebinding.yml - - webhooks-clusterrolebinding.yml - - forward-logs-to-log01.yml + with_items: "{{ base_templates + (stg_templates if env == 'staging' else []) }}" register: cluster_template_result - when: env == 'production' - - -- name: Copy templates to staging - ansible.builtin.template: - src: "{{ item }}.j2" - dest: "{{ cluster_filepath }}/{{ item }}" - mode: "0640" - with_items: - - sysadmin-openshift-group.yml - - sysadmin-openshift-rolebinding.yml - - webhooks-clusterrolebinding.yml - - forward-logs-to-log01.yml - - sysadmin-readonly-group.yml - - sysadmin-readonly-rolebinding.yml - - sysadmin-readonly-role.yml - register: cluster_template_result - when: env == 'staging' - - -# apply created openshift resources -- name: Oc apply resources - ansible.builtin.command: "oc apply --validate=strict -f {{ item.dest }}" - with_items: "{{ cluster_template_result.results }}" - when: item.changed - changed_when: true + notify: Apply changes to openshift tags: - create-resources From 96d23293a29f3be27603944b9a4dfb9b157d24bc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADt=20Smol=C3=ADk?= Date: Wed, 25 Feb 2026 15:37:43 +0100 Subject: [PATCH 12/17] fix: cluster/main.yaml should have been in cluser/handlers/main.yaml MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Vít Smolík --- roles/openshift/cluster/{ => handlers}/main.yaml | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename roles/openshift/cluster/{ => handlers}/main.yaml (100%) diff --git a/roles/openshift/cluster/main.yaml b/roles/openshift/cluster/handlers/main.yaml similarity index 100% rename from roles/openshift/cluster/main.yaml rename to roles/openshift/cluster/handlers/main.yaml From 488e9ae7e510db584c0bcd796f4d58bcc48892b0 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 27 Feb 2026 09:54:40 -0800 Subject: [PATCH 13/17] ocp4: add someone to readonly to test with in staging Signed-off-by: Kevin Fenzi --- playbooks/manual/ocp4-postinstall-setup.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/playbooks/manual/ocp4-postinstall-setup.yml b/playbooks/manual/ocp4-postinstall-setup.yml index 272cf302b2..81f11a183d 100644 --- a/playbooks/manual/ocp4-postinstall-setup.yml +++ b/playbooks/manual/ocp4-postinstall-setup.yml @@ -18,3 +18,5 @@ - gwmngilfen - nphilipp - zlopez + cluster_readonly_appowners: + - smoliicek From 5b88ef525f554c0fb6ea532f96e1fb7b78d70175 Mon Sep 17 00:00:00 2001 From: Pedro Moura Date: Tue, 24 Feb 2026 16:22:24 -0300 Subject: [PATCH 14/17] Removed ocp app ipsilon-website Signed-off-by: Pedro Moura --- .../ipsilon-website/files/service.yml | 15 ----- .../templates/buildconfig.yml.j2 | 33 ----------- .../templates/deploymentconfig.yml.j2 | 59 ------------------- 3 files changed, 107 deletions(-) delete mode 100644 roles/openshift-apps/ipsilon-website/files/service.yml delete mode 100644 roles/openshift-apps/ipsilon-website/templates/buildconfig.yml.j2 delete mode 100644 roles/openshift-apps/ipsilon-website/templates/deploymentconfig.yml.j2 diff --git a/roles/openshift-apps/ipsilon-website/files/service.yml b/roles/openshift-apps/ipsilon-website/files/service.yml deleted file mode 100644 index cd3876c0a5..0000000000 --- a/roles/openshift-apps/ipsilon-website/files/service.yml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: web - labels: - app: ipsilon-website -spec: - ports: - - name: web - port: 8080 - targetPort: 8080 - selector: - app: ipsilon-website - deploymentconfig: web diff --git a/roles/openshift-apps/ipsilon-website/templates/buildconfig.yml.j2 b/roles/openshift-apps/ipsilon-website/templates/buildconfig.yml.j2 deleted file mode 100644 index 4aa9514f1b..0000000000 --- a/roles/openshift-apps/ipsilon-website/templates/buildconfig.yml.j2 +++ /dev/null @@ -1,33 +0,0 @@ ---- -apiVersion: build.openshift.io/v1 -kind: BuildConfig -metadata: - name: web - labels: - app: ipsilon-website - build: ipsilon-website -spec: - runPolicy: Serial - source: - type: Git - git: - uri: https://pagure.io/ipsilon-website.git - ref: master - contextDir: / - strategy: - type: Docker - output: - to: - kind: ImageStreamTag - name: ipsilon-website:latest - triggers: - - type: ConfigChange - - type: ImageChange - - type: "Generic" - generic: - secretReference: -{% if env == "staging" %} - name: "{{ ipsilon_website_stg_webhook_secret }}" -{% else %} - name: "{{ ipsilon_website_webhook_secret }}" -{% endif %} diff --git a/roles/openshift-apps/ipsilon-website/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/ipsilon-website/templates/deploymentconfig.yml.j2 deleted file mode 100644 index b4435d13e6..0000000000 --- a/roles/openshift-apps/ipsilon-website/templates/deploymentconfig.yml.j2 +++ /dev/null @@ -1,59 +0,0 @@ ---- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig -metadata: - name: web - labels: - app: ipsilon-website -spec: - replicas: 1 - selector: - app: ipsilon-website - deploymentconfig: web - strategy: - type: Rolling - activeDeadlineSeconds: 21600 - rollingParams: - intervalSeconds: 1 - maxSurge: 25% - maxUnavailable: 25% - timeoutSeconds: 600 - updatePeriodSeconds: 1 - template: - metadata: - creationTimestamp: null - labels: - app: ipsilon-website - deploymentconfig: web - spec: - containers: - - name: ipsilon-website - imagePullPolicy: Always - ports: - - containerPort: 8080 - # protocol: TCP - readinessProbe: - timeoutSeconds: 5 - initialDelaySeconds: 30 - httpGet: - path: / - port: 8080 - livenessProbe: - timeoutSeconds: 5 - initialDelaySeconds: 30 - httpGet: - path: / - port: 8080 - # resources: {} - # terminationMessagePath: /dev/termination-log - # terminationMessagePolicy: File - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - ipsilon-website - from: - kind: ImageStreamTag - name: ipsilon-website:latest From 8fa05b2955da763f52602c264868b63e272bff97 Mon Sep 17 00:00:00 2001 From: Pedro Moura Date: Fri, 27 Feb 2026 12:59:38 -0300 Subject: [PATCH 15/17] deleted ipsilon-website playbook Signed-off-by: Pedro Moura --- playbooks/openshift-apps/ipsilon-website.yml | 58 -------------------- 1 file changed, 58 deletions(-) delete mode 100644 playbooks/openshift-apps/ipsilon-website.yml diff --git a/playbooks/openshift-apps/ipsilon-website.yml b/playbooks/openshift-apps/ipsilon-website.yml deleted file mode 100644 index 1b94e6fa16..0000000000 --- a/playbooks/openshift-apps/ipsilon-website.yml +++ /dev/null @@ -1,58 +0,0 @@ ---- -- name: Make the app be real - hosts: os_control_stg[0]:os_control[0] - user: root - gather_facts: false - - vars_files: - - /srv/web/infra/ansible/vars/global.yml - - "/srv/private/ansible/vars.yml" - - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml - - vars: - - roles: - - role: openshift/project - project_app: ipsilon-website - project_description: "ipsilon-project.org" - project_appowners: - - abompard - tags: - - apply-appowners - - - role: openshift/imagestream - imagestream_app: ipsilon-website - imagestream_imagename: ipsilon-website - - - role: openshift/object - object_app: ipsilon-website - object_template: buildconfig.yml.j2 - object_objectname: buildconfig.yml - - - role: openshift/object - object_app: ipsilon-website - object_file: service.yml - object_objectname: service.yml - - - role: openshift/route - route_app: ipsilon-website - route_name: web-internal - route_host: "ipsilon-website.apps.ocp{{ env_suffix }}.fedoraproject.org" - route_serviceport: web - route_servicename: web - route_annotations: - haproxy.router.openshift.io/timeout: 5m - - - role: openshift/route - route_app: ipsilon-website - route_name: web - route_host: "ipsilon-project.org" - route_serviceport: web - route_servicename: web - route_annotations: - haproxy.router.openshift.io/timeout: 5m - - - role: openshift/object - object_app: ipsilon-website - object_template: deploymentconfig.yml.j2 - object_objectname: deploymentconfig.yml From b4ddcdd8309ddce66663769d415f624554d8c3ec Mon Sep 17 00:00:00 2001 From: Pedro Moura Date: Fri, 27 Feb 2026 13:05:56 -0300 Subject: [PATCH 16/17] removed ipsilon-website entries in proxies-reverseproxy.yml and proxies-websites.yml playbooks Signed-off-by: Pedro Moura --- playbooks/include/proxies-reverseproxy.yml | 14 -------------- playbooks/include/proxies-websites.yml | 12 ------------ 2 files changed, 26 deletions(-) diff --git a/playbooks/include/proxies-reverseproxy.yml b/playbooks/include/proxies-reverseproxy.yml index de9aef4e52..2bd8c2eb68 100644 --- a/playbooks/include/proxies-reverseproxy.yml +++ b/playbooks/include/proxies-reverseproxy.yml @@ -896,20 +896,6 @@ keephost: true tags: discourse2fedmsg -# - role: httpd/reverseproxy -# website: ipsilon-project.org -# destname: ipsilon-website -# balancer_name: apps-ocp -# balancer_members: "{{ (env == 'staging')|ternary(ocp_nodes_rdu3_stg, ocp_nodes) }}" -# targettype: openshift -# ocp4: "{{ (env == 'production') | bool }}" -# ocp4_rdu3: "{{ (env == 'staging') | bool }}" -# # When prod has moved to rdu3: -# #ocp4: false -# #ocp4_rdu3: true -# keephost: true -# tags: ipsilon-website - - role: httpd/reverseproxy website: awx.fedoraproject.org destname: awx diff --git a/playbooks/include/proxies-websites.yml b/playbooks/include/proxies-websites.yml index 40a7c40ee0..e6ceb68d97 100644 --- a/playbooks/include/proxies-websites.yml +++ b/playbooks/include/proxies-websites.yml @@ -1210,18 +1210,6 @@ tags: - fedora.im -# - role: httpd/website -# site_name: ipsilon-project.org -# cert_name: ipsilon-project.org -# server_aliases: -# - ipsilon-project.org -# - www.ipsilon-project.org -# ssl: true -# sslonly: true -# certbot: true -# tags: -# - ipsilon-website - - role: httpd/website site_name: directory.fedoraproject.org ssl: true From 4af6011bb810dec6646b8dd8636ea0b946259bfb Mon Sep 17 00:00:00 2001 From: Victor Koycheff Date: Wed, 25 Feb 2026 09:53:27 +0200 Subject: [PATCH 17/17] distgit: disable mod_deflate for lookaside cache in staging Fixes #12812. This disables mod_deflate for the lookaside cache directory to prevent incorrect 'Content-Encoding: gzip' headers being sent with archives. Wrapped in a staging block for initial testing as requested. Signed-off-by: Victor Koycheff --- roles/distgit/templates/lookaside.conf | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/roles/distgit/templates/lookaside.conf b/roles/distgit/templates/lookaside.conf index de5b441c14..08d258d5e4 100644 --- a/roles/distgit/templates/lookaside.conf +++ b/roles/distgit/templates/lookaside.conf @@ -3,5 +3,12 @@ Alias /lookaside /srv/cache/lookaside Options Indexes FollowSymLinks AllowOverride None Require all granted + +{% if env == 'staging' %} + # Disable global mod_deflate for lookaside cache + # to prevent double-compression and false gzip headers + SetEnv no-gzip 1 + SetEnv dont-vary 1 +{% endif %}