4e70adc8d4
Fix yamllint trailing-spaces errors by removing trailing whitespace
...
Remove all trailing spaces from YAML files to comply with yamllint
formatting requirements.
Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2026-08-05 21:27:26 +00:00
224ae2aed0
Fix yamllint document-start errors by adding YAML document markers
...
Add document start marker (---) to 28 YAML files that were missing it
to comply with yamllint requirements for proper YAML document structure.
Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2026-08-05 21:27:26 +00:00
348549d7f8
[ipa] Set DNA range after obtaining ticket
...
We need to obtain ticket first before setting DNA range.
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2026-08-03 14:24:27 +02:00
cec04fd608
[ipa] Use variable for realm
...
There is no FEDORAPROJECT.ORG realm on staging.
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2026-08-03 13:46:40 +02:00
a9db4b94fe
[ipa] Add fix for keytab issue
...
One of the remaining changes I want to do for IPA playbook.
For more info see https://redhat.atlassian.net/browse/RHEL-220530
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2026-08-03 13:09:15 +02:00
275ec29f8a
[ipa] Set the dna range only when not set
...
infra/tickets#13485
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2026-07-31 14:48:21 +02:00
072d92dcb0
[ipa] Add dnarange to ansible playbook
...
This should remove one manual step from the playbook
infra/tickets#13485
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2026-07-31 13:57:15 +02:00
James Antill
d8ebddbe8a
ipa / user: adjust module path
...
Signed-off-by: James Antill <james@and.org>
2026-07-30 16:34:58 -04:00
d34b8df204
ipa / service: adjust module path
...
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2026-07-28 09:37:04 -07:00
27163adc12
ipa / sssd: rhel10 uses the root/sssd mode 640 sssd.conf files like fedora does
...
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2026-07-21 17:01:18 -07:00
d8adc2e4b4
ipa / client: now, fully qualify the freeipa modules
...
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2026-07-21 16:15:59 -07:00
09f4b8e41c
ipa / client: retry module path to debug rhel9
...
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2026-07-21 16:12:26 -07:00
d3d00dd742
ipa/client: back to the rhel9 version
...
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2026-07-21 15:24:35 -07:00
34b24f7048
Revert "ipa/client: seems to break rhel9, lets try conditionalizing for now"
...
This reverts commit 9f8f9778b1
2026-07-21 15:23:50 -07:00
9f8f9778b1
ipa/client: seems to break rhel9, lets try conditionalizing for now
...
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2026-07-21 15:22:09 -07:00
f5b0828023
ipa/client: try and refer to module/actions with module path
...
This seems to be needed on newer ansible-core, but not sure if it will
break older one. So, lets test this out.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2026-07-21 15:19:19 -07:00
33dc53f55b
IPA: add non-capturing group to handle optional .stg in match
...
Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
2026-07-16 14:35:37 +01:00
ec350055fd
IPA: improve regexes and triggers in free-ids Zabbix template
...
Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
2026-07-16 14:15:56 +01:00
4b8a238b78
[ipa] Remove nagios leftovers
...
There was a nagios task in IPA role and as the Nagios is no longer
around let's remove it.
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2026-07-10 12:47:21 +02:00
c51e04de81
Collectd: cleanup collectd everywhere except FMN
...
Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
2026-07-09 11:01:41 +00:00
83270e8b3b
ipa-free-ids: pass monitoring keytab to the cron jobs
...
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2026-07-01 14:53:49 -07:00
6eac650a10
Nagios: remove nrpe from a bunch of smaller things
...
Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
2026-07-01 14:22:40 +01:00
969a94bd18
Zabbix: add tags missed in previous commit
...
Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
2026-06-30 12:48:53 +01:00
a0c7bf49ad
Zabbix: migrate still-in-use Nagios plugins to the relevant roles
...
Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
2026-06-30 12:42:26 +01:00
1f036616d5
[ipa] Correctly disable NIS on RHEL10
...
Oops. I just enabled it only for RHEL10 and newer and it should be just
versions lesser than RHEL10.
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2026-06-26 10:44:03 +02:00
505e300ae4
[ipa] Disable NIS on RHEL10
...
NIS is no longer supported on RHEL10 IPA. We don't need to disable it anymore.
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2026-06-26 10:35:33 +02:00
James Antill
075447568c
roles/ipa/botuser: Drop the freeipa. prefix.
...
Signed-off-by: James Antill <james@and.org>
2026-06-15 13:10:21 -04:00
bb005e49aa
New roles: keytab/botuser and ipa/botuser
...
Allows the idempotent creation of a bot user with a randomized password.
Administrators can retrieve a keytab for this user without modifying the
password.
Playbook usage:
- role: keytab/botuser
username: "somebot"
kt_location: /etc/keytabs/somebot.keytab
tags:
- config
- krb5
Also accepts `first` and `last` arguments for given and family name, if
desired.
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
rh-pre-commit.version: 2.4.0
rh-pre-commit.check-secrets: ENABLED
2026-06-12 14:17:30 -04:00
78db1e778c
Zabbix: Add IPA free_ids monitoring via cronjob
...
Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
2026-06-09 11:25:46 +01:00
15a6768ad7
Zabbix: Update IPA template to include healthcheck items/triggers
...
Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
2026-05-05 15:01:16 +01:00
634a65bb02
Zabbix: Add cron+prometheus monitoring of ipa-healthcheck
...
Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
2026-05-01 14:18:00 +01:00
5134a6c604
ipa/service: add one more "already exists" condition
2026-02-24 08:46:22 +01:00
01ab35531a
Zabbix: fixes infra/tickets#12992 - add IPA backup monitoring
...
Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
2026-01-23 10:22:29 +00:00
2d80cc95c2
Cleanup stage users: loop over all the pages
...
Signed-off-by: Aurélien Bompard <aurelien@bompard.org>
2026-01-13 17:31:12 +01:00
038ed9e151
Zabbix: add IPA http checks against the internal webserver
...
Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
2025-12-11 15:53:26 +00:00
c567d80f3f
ipa / client: block paguremirroring user in ipa
...
We want to use a local version of this user, not the ipa one.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2025-11-21 12:51:46 -08:00
17fb5e7e3a
ipa / client: filter the git user
...
We want to use the local git user, not the ipa one on pagure.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2025-11-18 18:30:06 -08:00
888d5632ea
ipa / client: stop removing the 04-ipa.conf ssh config
...
We removed this because it had some options we didn't like long ago.
However, now it's basically all stuff thats already in our base ssh
config.
It causes anoying, but harmless scriptlet messages on updates
and there's no need to remove it to only have it get re-added by
freeipa-client every update.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2025-11-14 12:34:23 -08:00
25ef9ffdae
ipa: fix typo in logrotate
...
Seems this was missing a leading /, so it was not working.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2025-09-26 12:22:20 -07:00
beb724ee65
IPA: setup a permission to modify group managers
...
Signed-off-by: Aurélien Bompard <aurelien@bompard.org>
2025-09-01 11:18:45 +02:00
e57e3dd7e4
ipa/client: mode should be 640 on fedora instances
...
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2025-08-08 12:29:13 -07:00
db0e5eb546
ipa / client: fedora systems use root:sssd ownership
...
On rhel the sssd dropin files (which need to be the same owner/group as
the main sssd.conf file) are root:root, but on fedora they are
root:sssd. So, split out this task to handle the two different cases.
Assisted-by: claude
(I had it generate this, and it actually did a reasonable job I think)
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2025-08-08 11:54:33 -07:00
0c6153cebe
Create an IPA service for monitoring and use it for check-ipa-free-ids
...
Signed-off-by: Aurélien Bompard <aurelien@bompard.org>
2025-07-10 11:46:05 +02:00
1b67cfcf3b
releng-compose: filter some more users that should be local
...
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2025-07-03 13:58:56 -07:00
6c85fda0c9
Mass remove/replace iad2 -> rdu3, 10.3. -> 10.16.
...
Signed-off-by: Nils Philippsen <nils@redhat.com>
2025-07-03 20:05:02 +02:00
90ed0a38e0
pkgs: change the pagure user to uid 1000 for suexec, block in sssd
...
The pagure user needs to be uid 1000 because suexec won't let users with
uid under that suexec. ;(
Also, filter pagure user out in sssd so we get the local user.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2025-07-02 15:25:17 -07:00
f1b1deb66f
[ipa/server] Increase nsslapd sizelimit
...
It seems that the issue https://github.com/dogtagpki/pki/issues/5133 we
are hitting now is because the limit on the newly deployed is set only
to 2000, which makes it reach the LDAP administrative limit.
2025-06-25 11:47:25 +00:00
2e243f0b28
SSSd wants its conf snippets to have the same perms as sssd.conf
...
Signed-off-by: Aurélien Bompard <aurelien@bompard.org>
2025-06-24 17:38:45 +02:00
2695b3448a
Toddlers in IPA: use the full host name
...
Signed-off-by: Aurélien Bompard <aurelien@bompard.org>
2025-06-23 17:24:03 +02:00
8be052d10f
Toddler cleaning-packager-groups: fix service name
...
Signed-off-by: Aurélien Bompard <aurelien@bompard.org>
2025-06-23 17:05:17 +02:00
