infrastructure September 2018

infrastructure@lists.fedoraproject.org

35 participants
56 discussions

a few more changes for lists.pagure.io
by Kevin Fenzi 24 Sep '18

24 Sep '18

I had to make a few more changes to get lists.pagure.io working. I haven't pushed these to all the proxies yet, will wait until I get +1's or revert. commit 2359610fd4298fd9e54fbb49bdf809ff387639e5 Author: Kevin Fenzi <kevin(a)scrye.com> Date: Sat Sep 22 20:01:06 2018 +0000 add lists.pagure.io to varnish config diff --git a/roles/varnish/templates/proxies.vcl.j2 b/roles/varnish/templates/proxies.vcl.j2 index 121fbec..5150c36 100644 --- a/roles/varnish/templates/proxies.vcl.j2 +++ b/roles/varnish/templates/proxies.vcl.j2 @@ -282,7 +282,7 @@ sub vcl_recv { } } } - if (req.http.X-Forwarded-Server ~ "^lists.fedoraproject.org" || req.http.X-Forwarded-Server ~ "^lists.stg.fedoraproject.org" || req.http.X-Forwarded-Server ~ "^lists.fedorahosted.org" || req.http.X-Forwarded-Server ~ "^lists.stg.fedorahosted.org" ) { + if (req.http.X-Forwarded-Server ~ "^lists.fedoraproject.org" || req.http.X-Forwarded-Server ~ "^lists.stg.fedoraproject.org" || req.http.X-Forwarded-Server ~ "^lists.fedorahosted.org" || req.http.X-Forwarded-Server ~ "^lists.stg.fedorahosted.org" || req.http.X-Forwarded-Server ~ "^lists.pagure.io" ) { set req.backend_hint = mailman; } if (req.http.X-Forwarded-Server ~ "^apps.fedoraproject.org" || req.http.X-Forwarded-Server ~ "^apps.stg.fedoraproject.org") { and commit 3363db41b29f017d1365a91feec102d0b2a5ce7f Author: Kevin Fenzi <kevin(a)scrye.com> Date: Sat Sep 22 19:36:58 2018 +0000 need certbot here and it will use the right names diff --git a/playbooks/include/proxies-websites.yml b/playbooks/include/proxies-websites.yml index 65597cd..d76c963 100644 --- a/playbooks/include/proxies-websites.yml +++ b/playbooks/include/proxies-websites.yml @@ -904,8 +904,9 @@ - role: httpd/website site_name: lists.pagure.io sslonly: true - cert_name: lists.pagure.io.cert - SSLCertificateChainFile: lists.pagure.io.intermediate.cert + certbot: true + tags: + - lists.pagure.io # fedorahosted is retired. We have the site here so we can redirect it.

3 2

Moving forward with Fedora's PDC
by Clement Verna 24 Sep '18

24 Sep '18

Hi all, I would like to start working on the replacement application for PDC in Fedora. So far I have been mostly looking at the technical side of the application and how it will be setup in our infrastructure. Below is a list of the design decisions I am looking to take. I would really value some feedback on this in order to see if this is realistic or not. # Technical stack * Python 3 (just making it obvious) * Django 1.11 LTS (supported until at least April 2020) [0] * DRF 3.8.2 (latest version) Using Django and DRF (Django REST Framework) should allow us to reuse some of PDC code. # Application architecture * 1 backend service used to update the PDC database (currently pdc-updater [1]) * 1 frontend service serving the API HTTP endpoint and the HTML documentation of these endpoint. * 1 database # Deployment architecture * Backend service runs in Openshift (need access to the fedora-messaging bus) * Frontend service runs in Openshift * Database runs in on Fedora Infrastructure database hosts. # Development Workflow * I would like to have the possibility for these services to be automatically deployed on our Openshift instances (stg and prod) using the Github build trigger [2] available in Openshift. An idea to achieve this is to use Openshift S2I (source-to-image) [3] feature and use PyPi to install the application dependencies. In order to control which dependencies we are using and pulling from PyPi we could use devpi [4] as a caching proxy. Thanks, Clément [0] - https://www.djangoproject.com/download/ [1] - https://github.com/fedora-infra/pdc-updater [2] - https://docs.openshift.com/online/dev_guide/builds/triggering_builds.html#g… [3] - https://github.com/openshift/source-to-image [4] - https://devpi.net/docs/devpi/devpi/latest/%2Bd/index.html

5 9

FBR: Add key for f29 modular
by Patrick Uiterwijk 21 Sep '18

21 Sep '18

Hi all, Can I get +1s to merge the following, which should allow us to actually push out f29 module updates? Patrick commit b39a70e1f58bd3f7e9960499f23717bda7d01b06 (HEAD -> master) Author: Patrick Uiterwijk <patrick(a)puiterwijk.org> Date: Fri Sep 21 12:56:58 2018 +0200 Define the key for modular bodhi composes Signed-off-by: Patrick Uiterwijk <patrick(a)puiterwijk.org> diff --git a/roles/bodhi2/backend/templates/pungi.module.conf.j2 b/roles/bodhi2/backend/templates/pungi.module.conf.j2 index e7bac1721..bb021eb13 100644 --- a/roles/bodhi2/backend/templates/pungi.module.conf.j2 +++ b/roles/bodhi2/backend/templates/pungi.module.conf.j2 @@ -12,6 +12,8 @@ variants_file='module-variants.xml' sigkeys = [ [% if release.version_int == 28 %] '9db62fb1', +[% elif release.version_int == 29 %] + '429476b4', [% endif %] {% if env == "staging" %} None

3 2

Freeze break request: backup pagure / src.fedoraproject.org db
by Kevin Fenzi 21 Sep '18

21 Sep '18

Greetings. While I was doing a sync of production src.fedoraproject.org to staging today I found out that we are not actually backing up the production database. ;( Can I get +1s for the following and running the postgresql-server playbook? From 57e03cec512b9837d45d45b0b462dde67828c593 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi <kevin(a)scrye.com> Date: Thu, 20 Sep 2018 21:27:55 +0000 Subject: [PATCH] Back up pagure / src.fedoraproject.org database Signed-off-by: Kevin Fenzi <kevin(a)scrye.com> --- inventory/host_vars/db01.phx2.fedoraproject.org | 2 ++ 1 file changed, 2 insertions(+) diff --git a/inventory/host_vars/db01.phx2.fedoraproject.org b/inventory/host_vars/db01.phx2.fedoraproject.org index 5ac5154..6c7545a 100644 --- a/inventory/host_vars/db01.phx2.fedoraproject.org +++ b/inventory/host_vars/db01.phx2.fedoraproject.org @@ -29,6 +29,7 @@ databases: - notifications - nuancier_lite - odcs +- pagure - pdc - statscache - tahrir @@ -53,6 +54,7 @@ dbs_to_backup: - notifications - nuancier_lite - odcs +- pagure - pdc - statscache - tahrir -- 1.8.3.1

3 2

Anitya 0.13.1 (release-monitoring) deployed on staging
by Michal Konečný 20 Sep '18

20 Sep '18

Hi everybody, I want to announce that the Anitya 0.13.1 was finally deployed on staging (https://stg.release-monitoring.org/) Feel free to test it. You can see the changelog here: https://github.com/release-monitoring/anitya/releases/tag/0.13.1 Regards, mkonecny

1 0

Fedora Infrastructure Meeting 2018-09-20 1400 UTC Agenda
by Stephen John Smoogen 19 Sep '18

19 Sep '18

This shared document is for the next fedora infrastructure meeting. = Preamble = The infrastructure team will be having its weekly meeting tomorrow, 2018-09-20 at 15:00 UTC in #fedora-meeting-1 on the freenode network. We have a gobby document (see: https://fedoraproject.org/wiki/Gobby ) fedora-infrastructure-meeting-next is the document. Please try and review and edit that document before the meeting and we will use it to have our agenda of things to discuss. A copy as of today is included in this email. If you have something to discuss, add the topic to the discussion area with your name. If you would like to teach other folks about some application or setup in our infrastructure, please add that topic and your name to the learn about section. = Introduction = We will use it over the week before the meeting to gather status and info and discussion items and so forth, then use it in the irc meeting to transfer information to the meetbot logs. = Meeting start stuff = #startmeeting Infrastructure (2018-09-20) #meetingname infrastructure #topic aloha #chair nirik pingou puiterwijk relrod smooge tflink threebean cverna = Let new people say hello = #topic New folks introductions #info This is a place where people who are interested in Fedora Infrastructure can introduce themselves = Status / Information / Trivia / Announcements = (We put things here we want others on the team to know, but don't need to discuss) (Please use #info <the thing> - your name) #topic announcements and information #info tflink is on extended PTO #info Beta Freeze is in effect. All changes to frozen systems in Infrastructure will require +1 = Things we should discuss = We use this section to bring up discussion topics. Things we want to talk about as a group and come up with some consensus /suor decision or just brainstorm a problem or issue. If there are none of these we skip this section. (Use #topic your discussion topic - your username) #topic Oncall #info Smooge is on call from 2018-09-13->2018-09-20 #info Nirik is on call from 2018-09-20->2018-09-27 #info ??? is on call from 2018-09-27->2018-10-04 #info Summary of last week: (from Smooge) #topic container registry and Quay.io - cverna #topic Tickets discussion #info https://pagure.io/fedora-infrastructure/report/Meetings%20ticket Go thru each ticket one by one = Apprentice office hours = #topic Apprentice Open office minutes #info A time where apprentices may ask for help or look at problems. Here we will discuss any apprentice questions, try and match up people looking for things to do with things to do, progress, testing anything like that. = Learn about some application or setup in infrastructure = (This section, each week we get 1 person to talk about an application or setup that we have. Just going over what it is, how to contribute, ideas for improvement, etc. Whoever would like to do this, just add the i/nfo in this section. In the event we don't find someone to teach about something, we skip this section and just move on to open floor.) #info = Meeting end stuff = #topic Open Floor #endmeeting -- Stephen J Smoogen.

1 0

[PATCH] Add a role to deploy buildconfig instead of using openshift/object
by Michael Scherer 19 Sep '18

19 Sep '18

Signed-off-by: Michael Scherer <misc(a)zarb.org> --- roles/openshift/buildconfig/tasks/main.yml | 7 ++++ .../buildconfig/templates/buildconfig.yml | 42 ++++++++++++++++++++++ 2 files changed, 49 insertions(+) create mode 100644 roles/openshift/buildconfig/tasks/main.yml create mode 100644 roles/openshift/buildconfig/templates/buildconfig.yml diff --git a/roles/openshift/buildconfig/tasks/main.yml b/roles/openshift/buildconfig/tasks/main.yml new file mode 100644 index 0000000..7b5ac89 --- /dev/null +++ b/roles/openshift/buildconfig/tasks/main.yml @@ -0,0 +1,7 @@ +--- +- name: buildconfig-{{buildconfigname}}.yml + include_role: + name: openshift/object + vars: + objectname: buildconfig-{{buildconfigname}}.yml + template_fullpath: "{{roles_path}}/openshift/buildconfig/templates/buildconfig.yml" diff --git a/roles/openshift/buildconfig/templates/buildconfig.yml b/roles/openshift/buildconfig/templates/buildconfig.yml new file mode 100644 index 0000000..c1fa155 --- /dev/null +++ b/roles/openshift/buildconfig/templates/buildconfig.yml @@ -0,0 +1,42 @@ +apiVersion: v1 +kind: BuildConfig +metadata: + name: {{ buildconfigname }} + labels: + environment: {{ app }} +spec: + completionDeadlineSeconds: 1800 + output: + to: + kind: ImageStreamTag + name: {{ app }}:latest + source: +{% if git_url is defined %} + type: Git + git: + uri: {{ git_url }} +{% else %} + type: Dockerfile + dockerfile: |- + {{ dockerfile | indent(8) }} +{% endif %} + strategy: +{% if git_url is defined %} + type: Source + sourceStrategy: + from: + kind: ImageStreamTag + name: {{ s2i_image }}:latest +{% else %} + type: Docker + dockerStrategy: + noCache: false +{% endif %} + triggers: +{% if github_secret is defined %} + - type: GitHub + github: + secret: "{{ github_secret }}" +{% endif %} + - type: ConfigChange + - type: ImageChange -- 1.8.3.1

2 1

OpenShift logs now working on web
by Patrick Uiterwijk 19 Sep '18

19 Sep '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi all, Just wanted to inform people that as of a few minutes (after my last FBR went live), logs now work in the Production and Staging OpenShift web interfaces. This means that you can now click the Logs tab on the openshift web interface, or use "oc log" from your own computer and have it work. Note that at this moment, this is only working for Chromium/Chrome and epiphany (GNOME Web), and Firefox is not working. Regards, Patrick -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJbmTumAAoJEIZXmA2atR5Q+k4P/ArZim0fGvA77hMS2m86/o7U 0IYOOEQ6Ba4Fpn9zFX9Q7KZh6J5Io4e59Ir+ikAVHujaJVwfLz21pCu+xjFzYksI ZKTGAZyO2xgM0cU1ev4OhL2QUuOCN7KVHqMDoCusKri6K1kpbvfXIDYj/s+PX8Zl PHiucPAtSuYu7nAQRfizti7eo5s60MLSFElzPf8EoocH1cobiMieKWM34oK/dxgI F8tTbvUYdvoQF6yVraFJ8X3EMzL81qZ4cH4j3V36359IiSanBSg7aDyEfQhVIguw ynMdNmnmAIw8uvMNynDZq55vP0LAB9phXECstOPkJ2ezPOybZNi42wxxFHD3YptD uD8RfNNy2sTGWZt5QUg7o0cBzb6BNF1B0KMfnVIrOhjVrXtSNRE0wVy7Sr0hDsWp 4Rlhm4Q7MSke/0h0/4U/xNyJeSpnCHLvO4wIG453ku9PFUHQ3uej9P1kzGsf4fOA rtnvJSdNT4kFO0KP/QdcrEUETFJDKG5uk+7zwTTahW2DeLPaYV892NZONmKcKdDm Iq6TQXTm64iHoBdWnCk7FZQCjK0dj9Ckztjji2To0L0d+plimt6zt6c0dmAgxqp6 IbQCRLW1b0BA/PNmWwK7lrA8a5D1T5mFoWRT4vb+NteNvLbWlk2VtKijlWRflelu ByDaleTmUUuYmiWYcqpH =+e+6 -----END PGP SIGNATURE-----

3 2

FBR: Make pki.fedoraproject.org a redirect
by Stephen John Smoogen 19 Sep '18

19 Sep '18

This is one part of a change to try and make pki.fedoraproject.org not spit out an ugly "you are going to a bad site" warning. The other change is taking out the cname and making pki go to wildcard. diff --git a/playbooks/include/proxies-redirects.yml b/playbooks/include/proxies-redirects.yml index 21b1583..919d911 100644 --- a/playbooks/include/proxies-redirects.yml +++ b/playbooks/include/proxies-redirects.yml @@ -539,6 +539,11 @@ target: https://fedorahosted.org/k12linux/ + - role: httpd/redirect + shortname: dogtagpki + website: pki.fedoraproject.org + target: http://dogtagpki.org/ + # Cloudy bits - role: httpd/redirect shortname: cloud-front-page diff --git a/playbooks/include/proxies-websites.yml b/playbooks/include/proxies-websites.yml index 132bea5..9c0e173 100644 --- a/playbooks/include/proxies-websites.yml +++ b/playbooks/include/proxies-websites.yml @@ -190,6 +190,11 @@ cert_name: "{{wildcard_cert_name}}" - role: httpd/website + site_name: pki.fedoraproject.org + sslonly: true + cert_name: "{{wildcard_cert_name}}" + + - role: httpd/website site_name: spins.fedoraproject.org server_aliases: - spins.stg.fedoraproject.org -- Stephen J Smoogen.

4 3

FBR: Remove containers.fedoraproject.org subdomain
by Stephen John Smoogen 19 Sep '18

19 Sep '18

diff --git a/playbooks/include/proxies-reverseproxy.yml b/playbooks/include/proxies-reverseproxy.yml index 50ba745..8d35a5f 100644 --- a/playbooks/include/proxies-reverseproxy.yml +++ b/playbooks/include/proxies-reverseproxy.yml @@ -730,14 +730,6 @@ tags: coreos - role: httpd/reverseproxy - website: containers.fedoraproject.org - destname: containers - # haproxy entry for os-nodes-frontend - proxyurl: http://localhost:10065 - keephost: true - tags: containers - - - role: httpd/reverseproxy website: silverblue.fedoraproject.org destname: silverblue # haproxy entry for os-nodes-frontend diff --git a/playbooks/include/proxies-websites.yml b/playbooks/include/proxies-websites.yml index 5e9bf89..132bea5 100644 --- a/playbooks/include/proxies-websites.yml +++ b/playbooks/include/proxies-websites.yml @@ -883,12 +883,6 @@ cert_name: "{{wildcard_cert_name}}" - role: httpd/website - site_name: containers.fedoraproject.org - sslonly: true - server_aliases: [containers.stg.fedoraproject.org] - cert_name: "{{wildcard_cert_name}}" - - - role: httpd/website site_name: silverblue.fedoraproject.org sslonly: true server_aliases: [silverblue.stg.fedoraproject.org] -- Stephen J Smoogen.

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

infrastructure September 2018