The old key we were using for old releases had some sha1 in it
somewhere, so rhel10 rejects it (great!). So, lets use a newly generated
key that is acceptable to rhel10 and much nicer.
This adds the public key file, the repos that use that file, the rhel10
post kickstart that sets up the repo, robosignatory to sign epel10-infra
stuff with this new key and finally on rhel10 hosts put the new repo in
place.
Note that this only changes the rhel10 setup, all rhel8/9 machines are
still using the old key. We may want to move them over, or just not care
as we retire all of them.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
Adds better protection for the loglevel endpoints and adds control
endpoints to pause/unpause operation immediately.
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
rh-pre-commit.version: 2.4.0
rh-pre-commit.check-secrets: ENABLED
Try another approach to separate the instances. Create a separate redis
instance for quay.io, that should allow to have completely separate
quay.io resources and registry.fp.o resources.
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
This commit updates the `logo` alias to make sure trademark permission
requests are correctly routed to the Fedora Design Team Admins as the
most responsible party for the legal stewardship of the Fedora Project
trademark and brand. Therefore, to encourage use of FAS group membership
to better manage access to these hand-coded email aliases, this will now
send all emails to this alias to FAS account users with membership as
sponsors in the `designteam` FAS group.
Once this change is deployed and updated in production, this mail alias
will begin sending mail to @duffy (no change), @ekidney, @jesschitas,
@jflory7, @madelinepeck (no change), and @mleonova.
Signed-off-by: Justin Wheeler <jwheel@redhat.com>
We never deployed this in the new clusters since we moved and the folks
who were working on it have left. If we want to revive it later, we can
always pull it out of git history.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
When `nftables=True` the base role deploys nftables rules and enables the
nftables service, but never disables the iptables service. On freshly
provisioned hosts the iptables service can be left running from cloud-init,
overwriting nftables rules and silently dropping traffic on ports defined
in `tcp_ports`.
Stop and disable the iptables service explicitly when nftables is the
intended firewall backend.
Today the bastion relayhost didn't work for sign-bridge. So we changed
it to bastion01.rdu3.fedoraproject.org. This worked, so let's reflect
that change in ansible as well.
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
