The repos created through docker push are created as private by default.
This script will run every hour and sets any private repo visibility to
public.
This should be next step to finish
infra/tickets#11543
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
Seems like there are a ton of really small connections and it starts
hitting the limit (although it never logs that it's out, I think because
they free up quickly).
See if this solves the transitory alerts we see.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
If a host has a secondary ipv4 or ipv6 address, only have sshd listen on
the primary ip. This will allow hosts with secondary ips to use ssh port
on secondary ip's for other things.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
This pr attempts to move sshd to port 222 on proxy01.stg and
proxy02.stg.
We want to do this (first here and then in prod) because we want to nat
in ssh from external and use haproxy to send that into
forge.fedoraproject.org. If we were using port 22 to connect here
it would conflict with forwarding it on to haproxy.
Note that we still need to actually get networking folks to make the nat
mapping and we still need to add haproxy config to send it into forge in
openshift, but this is the first step we need to get working before we
can do those things.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
There are six global 'fedora' runners in staging forgejo, each with a
different label. This makes it awkward to create workflows as you have to
arbitrarily tie them to a single runner for no very good reason. If we
give them all the 'fedora' label you can just set your workflow to run on
'fedora' and it will run on any available runner.
Also, at least for the quality org, our prod runners have the 'fedora' label,
so if the global staging runners have the same label, we can reuse workflows
between staging and prod.
Signed-off-by: Adam Williamson <awilliam@redhat.com>
- split off the template into a node template and a cluster template
(that only needs to be instanciated on one node)
- add certificate expiration monitoring in the cluster template
This is only on staging for now.
Signed-off-by: Aurélien Bompard <aurelien@bompard.org>
See infra/tickets#13422
for details on this. It seems like rabbitmq staging has been
switch to the 'new' CA cert, and the consumers don't actually
read/trust both certs in the combined CA cert file, only the
first (old) one, so they don't trust the new one. This should
deploy and use a new file with only the new CA cert in it. We
copy it out of the private repo for convenience but it's not
actually private, hence the 0644 perms.
Signed-off-by: Adam Williamson <awilliam@redhat.com>
I'm having auth issues on openQA staging, I believe it *may* be
to do with the changes Aurelien made in
6fe8b98de21747dc16d59dcf5096da719a541296 . Let's see if using the
old key and cert helps.
Signed-off-by: Adam Williamson <awilliam@redhat.com>
This *should* configure a new queue and consumer for openQA to
report dist-git PR test results back. It's all a bit speculative
ATM, may need some tweaking. Mostly applied only on staging for
now.
Signed-off-by: Adam Williamson <awilliam@redhat.com>
AI caught that I've been cargo-culting a dumb message queue
config around from somewhere or other forever. Non-durable,
exclusive, and auto-delete is just about the worst config for a
queue you want to survive transitory issues like the server or
client going down or whatever. This might actually explain the
occasional issues we have with test results not showing up in
resultsdb, even.
This brings the config in line with most other message queues in
infra.
Signed-off-by: Adam Williamson <awilliam@redhat.com>
See https://bugzilla.redhat.com/show_bug.cgi?id=2490607
We have found a bug in FreeIPA replica enrolment with the
OpenSSL 4 update. However, the bug is tricky to fix and the update
is massive and maintaining its side tag is very painful. As a
very exceptional case, we're disabling gating on these tests so
the update can be merged without causing all subsequent updates
to fail gating. We will endeavour to fix the bug and re-enable
normal gating service ASAP.
Signed-off-by: Adam Williamson <awilliam@redhat.com>
This commit updates the `matrixadmin@fp.o` email address alias to now
use the `commops-wg-matrix` sponsor membership for the people who will
automatically receive email to the Matrix admin email. This is one step
to somewhat simplify membership of the email alias to a FAS-backed
mechanism for tracking and updating the sponsors.
Of course, sponsors cannot be updated in Noggin at the moment, so this
requires an IPA FAS admin to update the sponsor list for membership, but
this is an interim step for now.
Additionally, the `cle-managers@fp.o` email alias is added, which
ensures that key members of the CLE Team management will receive comms
to this email address, in the event that a key person from Fedora Infra
is on PTO, unavailable to respond, and to ensure delegation of access in
case of the "lottery factor".
People impacted by this change: @gwmngilfen@jasonbrooks@shaunm@blc@smilner@ancarrol@jbley@mattdm
Signed-off-by: Justin Wheeler <jwheel@redhat.com>
