infrastructure March 2019

infrastructure@lists.fedoraproject.org

40 participants
97 discussions

Pre-FBR: Please discuss [httpd proxy robots.conf]
by Stephen John Smoogen 18 Mar '19

18 Mar '19

So in looking at a problem with greenwave getting hit with various web-bots I found that very few of our configured robots.txt for sites work because we normally proxypass everything to the backend. This causes extra work on each backend needing to either add this to their codebase (if they are a flask containers) and could be slow for other reasons. However this will change all robots.conf for all websites so I don't want to look at a FBR without discussion. diff --git a/roles/httpd/website/templates/robots.conf b/roles/httpd/website/templates/robots.conf index f442128..a59eb68 100644 --- a/roles/httpd/website/templates/robots.conf +++ b/roles/httpd/website/templates/robots.conf @@ -1 +1,7 @@ +## Make sure that we don't skip this because we proxy pass it to a +## slow backend +<Location "/robots.txt"> + ProxyPass ! +</Location> + Alias /robots.txt /srv/web/{{site_name}}-robots.txt -- Stephen J Smoogen.

2 2

2FA in FAS for external Fedora contributors
by Marcin Zajaczkowski 18 Mar '19

18 Mar '19

Hi. As I use FAS as an OpenID provider in a few places I would like to enable 2FA in it. I made steps described on the wiki page https://fedoraproject.org/wiki/Infrastructure_Two_Factor_Auth#Enrolling , configured FreeOTP and "It should be ready to use immediately" (athough the page itself in general seems to be not fully configured/adjusted) . Unfortunately it's not. I can still login using just my password. This group is mentioned as a place to get help in the related situations. Q. How can I activate 2FA/MFA with TOTP not being a RedHat employee, but "only" an external Fedora contributor? Marcin

3 3

Freeze Break Request (FBR): Fix nagios for aarch64 cloud unit
by Stephen John Smoogen 18 Mar '19

18 Mar '19

The following should allow nagios to pass its checks on configs [smooge@batcave01 ansible (master)]$ git diff 625acabd001455659b2486b972a01c41abfbbf49 diff --git a/inventory/group_vars/nagios b/inventory/group_vars/nagios index 64df4b7..b79b4b1 100644 --- a/inventory/group_vars/nagios +++ b/inventory/group_vars/nagios @@ -153,5 +153,3 @@ phx2_external: - secondary01.fedoraproject.org - secondarykoji.fedoraproject.org - stg.fedoraproject.org - - virthost-aarch64-os01.fedorainfracloud.org - - virthost-aarch64-os02.fedorainfracloud.org diff --git a/inventory/inventory b/inventory/inventory index bf1a471..d523d96 100644 --- a/inventory/inventory +++ b/inventory/inventory @@ -145,8 +145,6 @@ virthost-rdu02.fedoraproject.org virthost-cc-rdu01.fedoraproject.org virthost-cc-rdu02.fedoraproject.org virthost-cc-rdu03.fedoraproject.org -virthost-aarch64-os01.fedorainfracloud.org -virthost-aarch64-os02.fedorainfracloud.org [datagrepper] datagrepper01.phx2.fedoraproject.org @@ -1066,6 +1064,8 @@ fed-cloud15.cloud.fedoraproject.org #fed-cloud-ppc01.cloud.fedoraproject.org fed-cloud-ppc02.cloud.fedoraproject.org cloud-noc01.cloud.fedoraproject.org +virthost-aarch64-os01.fedorainfracloud.org +virthost-aarch64-os02.fedorainfracloud.org [openstack-compute] fed-cloud03.cloud.fedoraproject.org -- Stephen J Smoogen.

3 3

FBR - [PATCH] mbs: Increase number of concurrent builds to 100
by ignatenkobrain＠fedoraproject.org 17 Mar '19

17 Mar '19

From: Igor Gnatenko <ignatenkobrain(a)fedoraproject.org> The value was defined 3 years ago, in March 2017 when there were much fewer modules in Fedora. Our Koji has capacity to run many more builds. Currently we have 158 Koji builders in default channel that are able to run RPM builds. Their total capacity is 566. Therefore it should be safe to increase MBS NUM_CONCURRENT_BUILDS to at least 100. Especially since Koji builds submitted by MBS have lower priority than default for non-modular component builds submitted by packagers, so packager-submitted builds will tak precedence over builds submitted by MBS. Signed-off-by: Igor Gnatenko <ignatenkobrain(a)fedoraproject.org> --- roles/mbs/common/templates/config.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/mbs/common/templates/config.py b/roles/mbs/common/templates/config.py index 8e5e86c..278c651 100644 --- a/roles/mbs/common/templates/config.py +++ b/roles/mbs/common/templates/config.py @@ -180,7 +180,7 @@ class ProdConfiguration(BaseConfiguration): DEFAULT_DIST_TAG_PREFIX = 'module_' # New name - NUM_CONCURRENT_BUILDS = 20 + NUM_CONCURRENT_BUILDS = 100 # Delete module-* targets one hour after build KOJI_TARGET_DELETE_TIME = 3600 -- 2.21.0

4 7

Fwd: problems with fedora accounts ?
by Cătălin George Feștilă 16 Mar '19

16 Mar '19

---------- Forwarded message --------- From: Cătălin George Feștilă <catalinfest(a)gmail.com> Date: Sat, Mar 16, 2019 at 12:50 PM Subject: problems with fedora accounts ? To: Fedora Marketing team <marketing(a)lists.fedoraproject.org> I apologize for the intervention but I saw some problems: 1. I got a mail with this cleaning issue: rhea <radka.janek(a)redhat.com> has removed you from the 'dotnet-team' group of the Fedora Accounts System This change is effective immediately for new operations, and should propagate into the e-mail aliases within an hour. reply is: Hi, that's spring cleaning of inactive members who were not seen in an eternity! (Also removed, +cc: nb, nmilosev, brettg, tarunpothulapati) 2. I saw now the https://id.fedoraproject.org come with this text: This is the Federated Open Authentication provider homepage. You will be redirected to this application whenever another application requires you to authenticate. Can you tell me what happened? Are new rules for the accounts?

2 1

FBR: Renew TLS certificate for whatcanidoforfedora.org
by Mikolaj Izdebski 15 Mar '19

15 Mar '19

LetsEncrypt TLS certificate for whatcanidoforfedora.org expires on April 8, 2019. I would like to renew it by running the following command on batcave01: ansible-playbook playbooks/groups/proxies.yml -t whatcanidoforfedora.org No code changes in ansible.git are need. I've already tested this on staging and it worked. Expiry date is after expected Fedora 30 beta release, but I would still like to renew this certificate to prevent future outage if we forget to renew it after freeze is lifted, and to clear Nagios alerts. -- Mikolaj Izdebski

3 3

FBR - Greenwave investigation bigger timeout
by Clement Verna 15 Mar '19

15 Mar '19

Hi all Still going on with greenwave investigation, I would like to double the timeout (from 330s to 660s) to see if that helps getting the last few tests results that are still failing. I would like to apply the following patch diff --git a/playbooks/openshift-apps/greenwave.yml b/playbooks/openshift-apps/greenwave.yml index d15499c19..21ce08aeb 100644 --- a/playbooks/openshift-apps/greenwave.yml +++ b/playbooks/openshift-apps/greenwave.yml @@ -95,7 +95,7 @@ tasks: - name: Set the timeout to the openshift route - command: "oc -n greenwave annotate route {{ item }} --overwrite haproxy.router.openshift.io/timeout=330s" + command: "oc -n greenwave annotate route {{ item }} --overwrite haproxy.router.openshift.io/timeout=660s" with_items: - greenwave-web - web-pretty diff --git a/roles/openshift-apps/greenwave/templates/buildconfig.yml b/roles/openshift-apps/greenwave/templates/buildconfig.yml index e293809b8..d836b482d 100644 --- a/roles/openshift-apps/greenwave/templates/buildconfig.yml +++ b/roles/openshift-apps/greenwave/templates/buildconfig.yml @@ -30,7 +30,7 @@ spec: # Become non-root again USER 1001 - ENTRYPOINT docker/install-ca.sh && gunicorn-3 --workers 8 --timeout 330 --graceful-timeout 300 --bind 0.0.0.0:8080 --access-logfile=- --enable-stdio-inheritance greenwave.wsgi:app + ENTRYPOINT docker/install-ca.sh && gunicorn-3 --workers 8 --timeout 660 --graceful-timeout 300 --bind 0.0.0.0:8080 --access-logfile=- --enable-stdio-inheritance greenwave.wsgi:app strategy: type: Docker dockerStrategy: -- +1s ? Thanks

4 5

[FBR ] nagios: monitor resultsdb.ci.centos.org. Ticket 7601.
by kevin＠scrye.com 14 Mar '19

14 Mar '19

From: Kevin Fenzi <kevin(a)scrye.com> Signed-off-by: Kevin Fenzi <kevin(a)scrye.com> --- roles/nagios_server/templates/nagios/services/websites.cfg.j2 | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/roles/nagios_server/templates/nagios/services/websites.cfg.j2 b/roles/nagios_server/templates/nagios/services/websites.cfg.j2 index e90027c..17601d4 100644 --- a/roles/nagios_server/templates/nagios/services/websites.cfg.j2 +++ b/roles/nagios_server/templates/nagios/services/websites.cfg.j2 @@ -153,6 +153,13 @@ define service { use websitetemplate } +define service { + host_name resultsdb.ci.centos.org + service_description http-resultsdb.ci.centos.org + check_command check_website!resultsdb.ci.centos.org!/resultsdb_api/api/v2.0/!PASSED + use websitetemplate +} + {% if vars['nagios_location'] == 'internal' %} ## ## Other Frontend Websites -- 1.8.3.1

1 0

FBR: upgrade oz on builders
by Peter Robinson 14 Mar '19

14 Mar '19

To deal with the cloud image issue I was originally going to resolve it slightly differently, I've not dealt with it in oz. the current "Fedora version" that pungi specifies (F-22) now retains BIOS by default, to use UEFI you can specify F-30 and if edk2 is available it will use that by default. So I'd like to upgrade the builders to oz-0.17.0-0.2.fc29

5 8

Meeting Agenda Item: Introduction Garrett
by garrett＠jansen.sh 14 Mar '19

14 Mar '19

Hey all, I just wanted to introduce myself before the meeting this morning. My name is Garrett and I'm on IRC and FAS as frailtyy. I've been using Fedora for a stretch of years and have never really tried to give back yet so I wanted to fix that! Currently, I work as a systems/applications admin for a large scale company and have some knowledge of Python, Bash scripting & Ansible. As for associations, I sometimes drop in on the New York Linux Users Group (NYLUG) if any of you guys end up there! As of now, I'm mostly wanting to get a sense of how Fedora does things on the infrastructure side and seeing where I can helping with time. I look forward to getting to know the Fedora Infra side a bit more! Let me know if you have any questions for me or any advice. I'm sure it'll help. Regards, Garrett J.

3 2

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

infrastructure March 2019