zlopez/ansible
1
0
Fork 0
forked from infra/ansible
Code Pull requests Activity
ansible/inventory/group_vars/logging

14 lines
294 B
Text
Raw Normal View History

ipa/client: configure global shell access and sudo Almost global anyway, i.e. inside the VPN. The ipa/client-based shell access and sudo rules are only effective for staging right now, the respective playbook bits are masked out for prod. - Assign Ansible host groups to IPA host groups, the latter don't care about 'stg' in the name and use dashes rather than underscores. - Distill shell access groups from fas_client_groups in group and host vars. - Let all `sysadmin-*` groups in the previous list run anything via sudo in the host group (except bastion & batcave). - Remove `fas_client_groups` from staging host and group vars. - Remove sudoers from staging host and group vars if only `sysadmin-*` groups have shell access. - Set up `ipa_client_shell_groups` on bastion to be a super set of the same on batcave. Newly created IPA host groups: - autosign - badges - basset - bastion - batcave - blockerbugs - bodhi - bugzilla2fedmsg - busgateway - datagrepper - dbserver - dns - fedimg - github2fedmsg - ipa - kernel-qa - kerneltest - kojibuilder - kojihub - kojipkgs - logging - mailman - memcached - mirrormanager - nagios - notifs - oci-registry - odcs - openqa - openqa-workers - osbs - packages - pdc-web - pkgs - proxies - rabbitmq - releng-compose - resultsdb - secondary - sign-bridge - sundries - value - wiki Signed-off-by: Nils Philippsen <nils@redhat.com>
2021-01-25 11:58:04 +01:00
---
Inventory group/host variables: Sort yaml This was done using yq ( https://mikefarah.gitbook.io/yq/operators/sort-keys ) Doing things this way makes it much easier to see if a variable is set in a file or if two hosts differ in what variables they set. Hopefully we can keep things sorted moving forward. Basically this means just sort a-z anything you add to any host or group vaiable and it will be in the right place. Additionally, this enforces 'normal' intent rules for all the variable files which we should also try and obey. 2 spaces for first level, 3 for next, etc. When in doubt you can run yq on it. This should cause NO actual vairable changes, it's all just readability fixing for humans, ansible parses it exactly the same. Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2021-11-16 13:27:57 -08:00
ipa_client_shell_groups:
- fi-apprentice
- sysadmin-analysis
- sysadmin-logs
- sysadmin-noc
Grant sysadmin-osbuild shell access to the logging server Since there is no central place to inspect osbuild worker logs (such as Splunk instance), the sysadmin-osbuild group needs access to the logging server. Signed-off-by: Tomáš Hozza <thozza@redhat.com>
2023-07-31 14:20:38 +02:00
- sysadmin-osbuild
Inventory group/host variables: Sort yaml This was done using yq ( https://mikefarah.gitbook.io/yq/operators/sort-keys ) Doing things this way makes it much easier to see if a variable is set in a file or if two hosts differ in what variables they set. Hopefully we can keep things sorted moving forward. Basically this means just sort a-z anything you add to any host or group vaiable and it will be in the right place. Additionally, this enforces 'normal' intent rules for all the variable files which we should also try and obey. 2 spaces for first level, 3 for next, etc. When in doubt you can run yq on it. This should cause NO actual vairable changes, it's all just readability fixing for humans, ansible parses it exactly the same. Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2021-11-16 13:27:57 -08:00
- sysadmin-veteran
ipa_client_sudo_groups:
- sysadmin-analysis
- sysadmin-logs
ipa/client: configure global shell access and sudo Almost global anyway, i.e. inside the VPN. The ipa/client-based shell access and sudo rules are only effective for staging right now, the respective playbook bits are masked out for prod. - Assign Ansible host groups to IPA host groups, the latter don't care about 'stg' in the name and use dashes rather than underscores. - Distill shell access groups from fas_client_groups in group and host vars. - Let all `sysadmin-*` groups in the previous list run anything via sudo in the host group (except bastion & batcave). - Remove `fas_client_groups` from staging host and group vars. - Remove sudoers from staging host and group vars if only `sysadmin-*` groups have shell access. - Set up `ipa_client_shell_groups` on bastion to be a super set of the same on batcave. Newly created IPA host groups: - autosign - badges - basset - bastion - batcave - blockerbugs - bodhi - bugzilla2fedmsg - busgateway - datagrepper - dbserver - dns - fedimg - github2fedmsg - ipa - kernel-qa - kerneltest - kojibuilder - kojihub - kojipkgs - logging - mailman - memcached - mirrormanager - nagios - notifs - oci-registry - odcs - openqa - openqa-workers - osbs - packages - pdc-web - pkgs - proxies - rabbitmq - releng-compose - resultsdb - secondary - sign-bridge - sundries - value - wiki Signed-off-by: Nils Philippsen <nils@redhat.com>
2021-01-25 11:58:04 +01:00
ipa_host_group: logging
ipa_host_group_desc: Logging hosts
Inventory group/host variables: Sort yaml This was done using yq ( https://mikefarah.gitbook.io/yq/operators/sort-keys ) Doing things this way makes it much easier to see if a variable is set in a file or if two hosts differ in what variables they set. Hopefully we can keep things sorted moving forward. Basically this means just sort a-z anything you add to any host or group vaiable and it will be in the right place. Additionally, this enforces 'normal' intent rules for all the variable files which we should also try and obey. 2 spaces for first level, 3 for next, etc. When in doubt you can run yq on it. This should cause NO actual vairable changes, it's all just readability fixing for humans, ansible parses it exactly the same. Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2021-11-16 13:27:57 -08:00
primary_auth_source: ipa
Copy permalink