Seems like there are a ton of really small connections and it starts
hitting the limit (although it never logs that it's out, I think because
they free up quickly).
See if this solves the transitory alerts we see.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
This pr attempts to move sshd to port 222 on proxy01.stg and
proxy02.stg.
We want to do this (first here and then in prod) because we want to nat
in ssh from external and use haproxy to send that into
forge.fedoraproject.org. If we were using port 22 to connect here
it would conflict with forwarding it on to haproxy.
Note that we still need to actually get networking folks to make the nat
mapping and we still need to add haproxy config to send it into forge in
openshift, but this is the first step we need to get working before we
can do those things.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
See infra/tickets#13422
for details on this. It seems like rabbitmq staging has been
switch to the 'new' CA cert, and the consumers don't actually
read/trust both certs in the combined CA cert file, only the
first (old) one, so they don't trust the new one. This should
deploy and use a new file with only the new CA cert in it. We
copy it out of the private repo for convenience but it's not
actually private, hence the 0644 perms.
Signed-off-by: Adam Williamson <awilliam@redhat.com>
I'm having auth issues on openQA staging, I believe it *may* be
to do with the changes Aurelien made in
6fe8b98de21747dc16d59dcf5096da719a541296 . Let's see if using the
old key and cert helps.
Signed-off-by: Adam Williamson <awilliam@redhat.com>
This *should* configure a new queue and consumer for openQA to
report dist-git PR test results back. It's all a bit speculative
ATM, may need some tweaking. Mostly applied only on staging for
now.
Signed-off-by: Adam Williamson <awilliam@redhat.com>
For infra/tickets#13351
This makes a staging rhel10 vm thats just the same size / place
as pagure-stg01.
It still needs external ip's and nat in from those, but this should be
enough to install it and start setting things up.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
* nftables: (2 commits)
Cleanup nft merge. Chg osbuildapi and nft_custom_rules to use nft_table_filter.
...
Signed-off-by: James Antill <james@and.org>
It seems like the alerts we have been getting have been when proxies are
near the limit rejecting things via anubis, but unable to keep up.
So, lets try and jump this up a bit and see if it solves those
alerts/slowdowns.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
This had the hard coded mac address of the previous vm.
We moved to using ansible to just fill in the current mac, so fix that
here too.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
We need to do this anyhow, but this will test to see if the weird alerts
we have been getting persist on f44 with the latest libvirt machine
setup.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
