March 2019 - infrastructure - Fedora mailing-lists

Pre-FBR: Please discuss [httpd proxy robots.conf]
by Stephen John Smoogen 18 Mar '19

18 Mar '19

So in looking at a problem with greenwave getting hit with various web-bots I found that very few of our configured robots.txt for sites work because we normally proxypass everything to the backend. This causes extra work on each backend needing to either add this to their codebase (if they are a flask containers) and could be slow for other reasons. However this will change all robots.conf for all websites so I don't want to look at a FBR without discussion. diff --git a/roles/httpd/website/templates/robots.conf b/roles/httpd/website/templates/robots.conf index f442128..a59eb68 100644 --- a/roles/httpd/website/templates/robots.conf +++ b/roles/httpd/website/templates/robots.conf @@ -1 +1,7 @@ +## Make sure that we don't skip this because we proxy pass it to a +## slow backend +<Location "/robots.txt"> + ProxyPass ! +</Location> + Alias /robots.txt /srv/web/{{site_name}}-robots.txt -- Stephen J Smoogen.

2 2

2FA in FAS for external Fedora contributors
by Marcin Zajaczkowski 18 Mar '19

18 Mar '19

Hi. As I use FAS as an OpenID provider in a few places I would like to enable 2FA in it. I made steps described on the wiki page https://fedoraproject.org/wiki/Infrastructure_Two_Factor_Auth#Enrolling , configured FreeOTP and "It should be ready to use immediately" (athough the page itself in general seems to be not fully configured/adjusted) . Unfortunately it's not. I can still login using just my password. This group is mentioned as a place to get help in the related situations. Q. How can I activate 2FA/MFA with TOTP not being a RedHat employee, but "only" an external Fedora contributor? Marcin

3 3

Freeze Break Request (FBR): Fix nagios for aarch64 cloud unit
by Stephen John Smoogen 18 Mar '19

18 Mar '19

The following should allow nagios to pass its checks on configs [smooge@batcave01 ansible (master)]$ git diff 625acabd001455659b2486b972a01c41abfbbf49 diff --git a/inventory/group_vars/nagios b/inventory/group_vars/nagios index 64df4b7..b79b4b1 100644 --- a/inventory/group_vars/nagios +++ b/inventory/group_vars/nagios @@ -153,5 +153,3 @@ phx2_external: - secondary01.fedoraproject.org - secondarykoji.fedoraproject.org - stg.fedoraproject.org - - virthost-aarch64-os01.fedorainfracloud.org - - virthost-aarch64-os02.fedorainfracloud.org diff --git a/inventory/inventory b/inventory/inventory index bf1a471..d523d96 100644 --- a/inventory/inventory +++ b/inventory/inventory @@ -145,8 +145,6 @@ virthost-rdu02.fedoraproject.org virthost-cc-rdu01.fedoraproject.org virthost-cc-rdu02.fedoraproject.org virthost-cc-rdu03.fedoraproject.org -virthost-aarch64-os01.fedorainfracloud.org -virthost-aarch64-os02.fedorainfracloud.org [datagrepper] datagrepper01.phx2.fedoraproject.org @@ -1066,6 +1064,8 @@ fed-cloud15.cloud.fedoraproject.org #fed-cloud-ppc01.cloud.fedoraproject.org fed-cloud-ppc02.cloud.fedoraproject.org cloud-noc01.cloud.fedoraproject.org +virthost-aarch64-os01.fedorainfracloud.org +virthost-aarch64-os02.fedorainfracloud.org [openstack-compute] fed-cloud03.cloud.fedoraproject.org -- Stephen J Smoogen.

3 3

FBR - [PATCH] mbs: Increase number of concurrent builds to 100
by ignatenkobrain＠fedoraproject.org 17 Mar '19

17 Mar '19

From: Igor Gnatenko <ignatenkobrain(a)fedoraproject.org> The value was defined 3 years ago, in March 2017 when there were much fewer modules in Fedora. Our Koji has capacity to run many more builds. Currently we have 158 Koji builders in default channel that are able to run RPM builds. Their total capacity is 566. Therefore it should be safe to increase MBS NUM_CONCURRENT_BUILDS to at least 100. Especially since Koji builds submitted by MBS have lower priority than default for non-modular component builds submitted by packagers, so packager-submitted builds will tak precedence over builds submitted by MBS. Signed-off-by: Igor Gnatenko <ignatenkobrain(a)fedoraproject.org> --- roles/mbs/common/templates/config.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/mbs/common/templates/config.py b/roles/mbs/common/templates/config.py index 8e5e86c..278c651 100644 --- a/roles/mbs/common/templates/config.py +++ b/roles/mbs/common/templates/config.py @@ -180,7 +180,7 @@ class ProdConfiguration(BaseConfiguration): DEFAULT_DIST_TAG_PREFIX = 'module_' # New name - NUM_CONCURRENT_BUILDS = 20 + NUM_CONCURRENT_BUILDS = 100 # Delete module-* targets one hour after build KOJI_TARGET_DELETE_TIME = 3600 -- 2.21.0

4 7

Fwd: problems with fedora accounts ?
by Cătălin George Feștilă 16 Mar '19

16 Mar '19

---------- Forwarded message --------- From: Cătălin George Feștilă <catalinfest(a)gmail.com> Date: Sat, Mar 16, 2019 at 12:50 PM Subject: problems with fedora accounts ? To: Fedora Marketing team <marketing(a)lists.fedoraproject.org> I apologize for the intervention but I saw some problems: 1. I got a mail with this cleaning issue: rhea <radka.janek(a)redhat.com> has removed you from the 'dotnet-team' group of the Fedora Accounts System This change is effective immediately for new operations, and should propagate into the e-mail aliases within an hour. reply is: Hi, that's spring cleaning of inactive members who were not seen in an eternity! (Also removed, +cc: nb, nmilosev, brettg, tarunpothulapati) 2. I saw now the https://id.fedoraproject.org come with this text: This is the Federated Open Authentication provider homepage. You will be redirected to this application whenever another application requires you to authenticate. Can you tell me what happened? Are new rules for the accounts?

2 1

FBR: Renew TLS certificate for whatcanidoforfedora.org
by Mikolaj Izdebski 15 Mar '19

15 Mar '19

LetsEncrypt TLS certificate for whatcanidoforfedora.org expires on April 8, 2019. I would like to renew it by running the following command on batcave01: ansible-playbook playbooks/groups/proxies.yml -t whatcanidoforfedora.org No code changes in ansible.git are need. I've already tested this on staging and it worked. Expiry date is after expected Fedora 30 beta release, but I would still like to renew this certificate to prevent future outage if we forget to renew it after freeze is lifted, and to clear Nagios alerts. -- Mikolaj Izdebski

3 3

FBR - Greenwave investigation bigger timeout
by Clement Verna 15 Mar '19

15 Mar '19

Hi all Still going on with greenwave investigation, I would like to double the timeout (from 330s to 660s) to see if that helps getting the last few tests results that are still failing. I would like to apply the following patch diff --git a/playbooks/openshift-apps/greenwave.yml b/playbooks/openshift-apps/greenwave.yml index d15499c19..21ce08aeb 100644 --- a/playbooks/openshift-apps/greenwave.yml +++ b/playbooks/openshift-apps/greenwave.yml @@ -95,7 +95,7 @@ tasks: - name: Set the timeout to the openshift route - command: "oc -n greenwave annotate route {{ item }} --overwrite haproxy.router.openshift.io/timeout=330s" + command: "oc -n greenwave annotate route {{ item }} --overwrite haproxy.router.openshift.io/timeout=660s" with_items: - greenwave-web - web-pretty diff --git a/roles/openshift-apps/greenwave/templates/buildconfig.yml b/roles/openshift-apps/greenwave/templates/buildconfig.yml index e293809b8..d836b482d 100644 --- a/roles/openshift-apps/greenwave/templates/buildconfig.yml +++ b/roles/openshift-apps/greenwave/templates/buildconfig.yml @@ -30,7 +30,7 @@ spec: # Become non-root again USER 1001 - ENTRYPOINT docker/install-ca.sh && gunicorn-3 --workers 8 --timeout 330 --graceful-timeout 300 --bind 0.0.0.0:8080 --access-logfile=- --enable-stdio-inheritance greenwave.wsgi:app + ENTRYPOINT docker/install-ca.sh && gunicorn-3 --workers 8 --timeout 660 --graceful-timeout 300 --bind 0.0.0.0:8080 --access-logfile=- --enable-stdio-inheritance greenwave.wsgi:app strategy: type: Docker dockerStrategy: -- +1s ? Thanks

4 5

[FBR ] nagios: monitor resultsdb.ci.centos.org. Ticket 7601.
by kevin＠scrye.com 14 Mar '19

14 Mar '19

From: Kevin Fenzi <kevin(a)scrye.com> Signed-off-by: Kevin Fenzi <kevin(a)scrye.com> --- roles/nagios_server/templates/nagios/services/websites.cfg.j2 | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/roles/nagios_server/templates/nagios/services/websites.cfg.j2 b/roles/nagios_server/templates/nagios/services/websites.cfg.j2 index e90027c..17601d4 100644 --- a/roles/nagios_server/templates/nagios/services/websites.cfg.j2 +++ b/roles/nagios_server/templates/nagios/services/websites.cfg.j2 @@ -153,6 +153,13 @@ define service { use websitetemplate } +define service { + host_name resultsdb.ci.centos.org + service_description http-resultsdb.ci.centos.org + check_command check_website!resultsdb.ci.centos.org!/resultsdb_api/api/v2.0/!PASSED + use websitetemplate +} + {% if vars['nagios_location'] == 'internal' %} ## ## Other Frontend Websites -- 1.8.3.1

1 0

FBR: upgrade oz on builders
by Peter Robinson 14 Mar '19

14 Mar '19

To deal with the cloud image issue I was originally going to resolve it slightly differently, I've not dealt with it in oz. the current "Fedora version" that pungi specifies (F-22) now retains BIOS by default, to use UEFI you can specify F-30 and if edk2 is available it will use that by default. So I'd like to upgrade the builders to oz-0.17.0-0.2.fc29

5 8

Meeting Agenda Item: Introduction Garrett
by garrett＠jansen.sh 14 Mar '19

14 Mar '19

Hey all, I just wanted to introduce myself before the meeting this morning. My name is Garrett and I'm on IRC and FAS as frailtyy. I've been using Fedora for a stretch of years and have never really tried to give back yet so I wanted to fix that! Currently, I work as a systems/applications admin for a large scale company and have some knowledge of Python, Bash scripting & Ansible. As for associations, I sometimes drop in on the New York Linux Users Group (NYLUG) if any of you guys end up there! As of now, I'm mostly wanting to get a sense of how Fedora does things on the infrastructure side and seeing where I can helping with time. I look forward to getting to know the Fedora Infra side a bit more! Let me know if you have any questions for me or any advice. I'm sure it'll help. Regards, Garrett J.

3 2

FBR: running noc.yml on nagios servers
by Stephen John Smoogen 14 Mar '19

14 Mar '19

We are removing some hosts and other inventory clean up and need to run noc.yml on the nagios servers to update monitoring. -- Stephen J Smoogen.

3 2

Freeze Break Request: fix resolv.conf on armv7 builders
by Kevin Fenzi 14 Mar '19

14 Mar '19

Greetings. I'd like votes on restarting NetworkManager on buildvm-armv7-10 thru 21 and then running the buildvm playbook with -t resolvconf -l buildvm-armv7 to update some arm builders that don't have the correct /etc/resolv.conf. These are ones I reinstalled before freeze and I think what happened is that they got the correct /etc/resolv.conf, then updated NetworkManager to never update it, but it wasn't restarted so the currently running one is doing so. The change on those builders looks like: --- before: /etc/resolv.conf +++ after: /srv/web/infra/ansible/roles/base/files/resolv.conf/kojibuilder @@ -1,3 +1,6 @@ -# Generated by NetworkManager -search arm.fedoraproject.org +search phx2.fedoraproject.org vpn.fedoraproject.org fedoraproject.org nameserver 10.5.126.21 +nameserver 10.5.126.22 +options rotate timeout:1 + + I am hoping this helps us with rawhide composes, where they have failed in armv7 image builds with a '[Could not resolve host: kojipkgs.fedoraproject.org]'. +1s? kevin

3 2

FBR: Add tag to update appowners for Greenwave and Bodhi
by Clement Verna 14 Mar '19

14 Mar '19

Hi all, I would like to update the appowners for Greenwave and Bodhi in Openshift but I don't want to restart the services so following is a Patch to add an ansible tag to only update the appowners. diff --git a/playbooks/openshift-apps/bodhi.yml b/playbooks/openshift-apps/bodhi.yml index 0e0ccae4c..e5b7f37ed 100644 --- a/playbooks/openshift-apps/bodhi.yml +++ b/playbooks/openshift-apps/bodhi.yml @@ -18,6 +18,8 @@ appowners: - bowlofeggs - cverna + tags: + - apply-appowners - role: openshift/keytab app: bodhi key: koji-keytab diff --git a/playbooks/openshift-apps/greenwave.yml b/playbooks/openshift-apps/greenwave.yml index ce86f6951..0f96fb9c7 100644 --- a/playbooks/openshift-apps/greenwave.yml +++ b/playbooks/openshift-apps/greenwave.yml @@ -20,6 +20,8 @@ - lholecek - ralph - cverna + tags: + - apply-appowners - role: openshift/secret-file app: greenwave secret_name: greenwave-fedmsg-key -- +1s ? Thanks

3 4

FBR : Add cverna to Greenwave appowners
by Clement Verna 14 Mar '19

14 Mar '19

Hi all, After talking with Giulia on irc, I would like to add myself to the Greenwave appowners to be able to access the logs in openshift. Here is the diff diff --git a/playbooks/openshift-apps/greenwave.yml b/playbooks/openshift-apps/greenwave.yml index b1002abcf..ce86f6951 100644 --- a/playbooks/openshift-apps/greenwave.yml +++ b/playbooks/openshift-apps/greenwave.yml @@ -19,6 +19,7 @@ - gnaponie - lholecek - ralph + - cverna - role: openshift/secret-file app: greenwave secret_name: greenwave-fedmsg-key -- +1s ?

3 4

FBR: Add cverna to Bodhi appowners
by Clement Verna 14 Mar '19

14 Mar '19

Hi all, I would like to be able to check Bodhi's log in openshift, so I would like to add myself to the appowners. diff --git a/playbooks/openshift-apps/bodhi.yml b/playbooks/openshift-apps/bodhi.yml index e761e090f..0e0ccae4c 100644 --- a/playbooks/openshift-apps/bodhi.yml +++ b/playbooks/openshift-apps/bodhi.yml @@ -17,6 +17,7 @@ description: bodhi appowners: - bowlofeggs + - cverna - role: openshift/keytab app: bodhi key: koji-keytab -- +1s ? Thanks Clément

3 4

[RFC] Add a public vhost for the rabbitmq cluster
by Jeremy Cline 14 Mar '19

14 Mar '19

This adds a new virtual host in RabbitMQ, /public_pubsub, intended to be used by consumers outside Fedora's infrastructure. The federation plugin is used to push any messages published to the /pubsub amq.topic exchange into the /public_pubsub amq.topic exchange. A user called "fedora" with the password of "fedora" is created in this virtual host with permissions to create UUIDish queues. A policy is applied to queues that deletes them after 7 days of not being used and sets a maximum size of 50MB to a queue to ensure abandoned queues don't get too big. Signed-off-by: Jeremy Cline <jcline(a)redhat.com> --- I'm sending this out for review, but I'm happy to apply it myself, run the playbooks when it's convenient for folks, and troubleshoot. I'm dubious about my ability to get the URL correct on the first try, and it also needs certificates to be generated for federation user it creates. roles/rabbitmq_cluster/tasks/main.yml | 88 ++++++++++++++++++++++++++- 1 file changed, 87 insertions(+), 1 deletion(-) diff --git a/roles/rabbitmq_cluster/tasks/main.yml b/roles/rabbitmq_cluster/tasks/main.yml index d88fb8102..753d7596e 100644 --- a/roles/rabbitmq_cluster/tasks/main.yml +++ b/roles/rabbitmq_cluster/tasks/main.yml @@ -101,7 +101,10 @@ - name: Enable the HTTP management console and SSL authentication plugins rabbitmq_plugin: - names: rabbitmq_management,rabbitmq_auth_mechanism_ssl + names: "rabbitmq_management,\ + rabbitmq_auth_mechanism_ssl,\ + rabbitmq_federation,\ + rabbitmq_federation_management" tags: - rabbitmq_cluster - config @@ -177,3 +180,86 @@ tags: - rabbitmq_cluster - config + +# This is the publicly accessible virtual host +- name: Configure the publicly accessible vhost + rabbitmq_vhost: + name: /public_pubsub + state: present + tags: + - rabbitmq_cluster + - config + +- name: Configure a policy to ensure the public vhost stays swept up and tidy + rabbitmq_policy: + apply_to: queues + name: sweeper + state: present + pattern: ".*" + tags: + # Unused queues are killed after 1000 * 60 * 60 * 24 * 7 (1 week in milliseconds) + expires: 604800000 + # Queues can use at most 1024 * 1024 * 50 (50MB) to store messages + max-length-bytes: 52428800 + vhost: /public_pubsub + tags: + - rabbitmq_cluster + - config + +# Create a user with: +# * permission to configure and write to any uuidish-named objects +# * permission to read anything since users need to read exchanges for bindings +# read queues for consuming +- name: Create a user for public access + rabbitmq_user: + user: fedora + password: fedora + permissions: + - vhost: /public_pubsub + # Matches, for example, de23804a-304a-4228-b239-35099c98bd1e + # Regex is Erlang flavored: http://erlang.org/doc/man/re.html + configure_priv: "^(\w{8}(-\w{4}){3}-\w{12})$" + write_priv: "^(\w{8}(-\w{4}){3}-\w{12})$" + read_priv: .* + state: present + tags: + - rabbitmq_cluster + - config + +# User with permissions to shovel messages out of pubsub into the public vhost. +# This user needs permissions to create a new exchange, bind an exchange to an +# exchange, create a queue, and bind a queue to an exchange. +- name: Create a user for federation + rabbitmq_user: + user: pubsub_federation + password: pubsub_federation + permissions: + - vhost: /pubsub + configure_priv: "^federation.*" + write_priv: "^federation.*" + read_priv: .* + state: present + tags: + - rabbitmq_cluster + - config + +# This is the connection from our public vhost to the private pubsub vhost. +# Note that at present they live on the same cluster, but they don't need to. +- name: Configure federation upstream from pubsub to the public_pubsub vhost + rabbitmq_parameter: + component: federation-upstream + name: pubsub-to-public_pubsub + value: '{"uri":"amqp://pubsub_federation:@rabbitmq01{{ env_suffix }}.phx2.fedoraproject.org/%2Fpubsub?cacertfile=/etc/pki/rabbitmq/ca/rabbitmq-ca.crt&certfile=/etc/pki/rabbitmq/crt/rabbitmq-pubsub_federation.crt&keyfile=/etc/pki/rabbitmq/key/rabbitmq-pubsub_federation.key&verify=verify_peer&fail_if_no_peer_cert=true&auth_mechanism=external","ack-mode":"on-confirm"}' + state: present + vhost: /public_pubsub + +- name: Configure a policy to federate the pubsub topic exchange to public_pubsub + rabbitmq_policy: + apply_to: exchanges + name: pubsub-to-public_pubsub + state: present + pattern: "^amq\\.topic$" + tags: + federation-upstream: "pubsub-to-public_pubsub" + vhost: /public_pubsub -- 2.20.1

3 2

Koji 1.17.0 and Python 3
by Neal Gompa 13 Mar '19

13 Mar '19

Hey all, I've proposed a pull request to switch our Koji package to use Python 3 wherever possible: https://src.fedoraproject.org/rpms/koji/pull-request/4 The PR is a bit complex, but it's based on the upstream spec for Koji, which accounts for all the variations (Py2 Koji + Py3 client for Fedora < 30, Py3 Koji + client + Py2 API for Fedora 30+, Py2 Koji for EPEL). I'd like to merge this in and submit updates for all currently supported releases we ship the Koji package to (Fedora and EPEL). Note that this is independent of testing and upgrading the infrastructure. But I'd like to merge this in now so that we could look at having staging Koji switch over now. -- 真実はいつも一つ！/ Always, there's only one truth!

5 13

Reminder: Fedora Infrastructure Meeting 2019-03-14
by Stephen John Smoogen 13 Mar '19

13 Mar '19

Please update the gobby with items and events = Preamble = The infrastructure team will be having its weekly meeting tomorrow, 2019-03-14 at 15:00 UTC in #fedora-meeting-1 on the freenode network. We have a gobby document at https://infinote.fedoraproject.org/cgit/infinote/tree/fedora-infrastructure… which can be edited for the agenda (see: https://fedoraproject.org/wiki/Gobby ) Please try and review and edit that document before the meeting and we will use it to have our agenda of things to discuss. A copy as of today is included in this email. If you have something to discuss, add the topic to the discussion area with your name. If you would like to teach other folks about some application or setup in our infrastructure, please add that topic and your name to the learn about section. = Introduction = We will use it over the week before the meeting to gather status and info and discussion items and so forth, then use it in the irc meeting to transfer information to the meetbot logs. = Meeting start stuff = #startmeeting Infrastructure (2019-03-14) #meetingname infrastructure #topic aloha #chair nirik pingou puiterwijk relrod smooge tflink threebean cverna mizdebsk mkonecny = Let new people say hello = #topic New folks introductions #info This is a place where people who are interested in Fedora Infrastructure can introduce themselves #info Getting Started Guide: https://fedoraproject.org/wiki/Infrastructure/GettingStarted = Status / Information / Trivia / Announcements = (We put things here we want others on the team to know, but don't need to discuss) (Please use #info <the thing> - your name) #topic announcements and information #info Beta Freeze Is Currently Going On. Please get FBR for frozen systems. #info Staging Koji sync still going on #info Started working on fedora-messaging migration, status here https://github.com/orgs/fedora-infra/projects/2 #info Reminder: use good commit messages #info Published blogpost about release-monitoring.org https://communityblog.fedoraproject.org/stories-from-the-amazing-world-of-r… = Things we should discuss = We use this section to bring up discussion topics. Things we want to talk about as a group and come up with some consensus /suor decision or just brainstorm a problem or issue. If there are none of these we skip this section. (Use #topic your discussion topic - your username) #topic Oncall #info mizdebsk is on call from 2019-03-07 -> 2019-03-14 #info bowlofeggs is on call from 2019-03-14 -> 2019-03-21 #info nirik is on call from 2019-03-21 -> 2019-03-28 #info ????? is on call from 2019-03-28 -> 2019-04-04 #info Summary of last week: (from mizdebsk ) #topic Monitoring discussion #info https://nagios.fedoraproject.org/nagios #info Go over existing out items and fix #topic Tickets discussion #info https://pagure.io/fedora-infrastructure/report/Meetings%20ticket Go thru each ticket one by one #topic hotfixes - kevin #topic Priorities for next week? #info please put tickets needing to be focused on here #topic Discuss: Is the Fedora pastebin still useful? - relrod #info how many users are using it? [3000 posts a day from 350 ips] #info should we look at converging with CentOS one so simpler setup? = Apprentice office hours = #topic Apprentice Open office minutes #info A time where apprentices may ask for help or look at problems. Here we will discuss any apprentice questions, try and match up people looking for things to do with things to do, progress, testing anything like that. = Learn about some application or setup in infrastructure = (This section, each week we get 1 person to talk about an application or setup that we have. Just going over what it is, how to contribute, ideas for improvement, etc. Whoever would like to do this, just add the i/nfo in this section. In the event we don't find someone to teach about something, we skip this section and just move on to open floor.) #info = Meeting end stuff = #topic Open Floor #endmeeting -- Stephen J Smoogen.

1 0

[Fedocal] Reminder meeting : Fedora Infrastructure
by smooge＠gmail.com 13 Mar '19

13 Mar '19

Dear all, You are kindly invited to the meeting: Fedora Infrastructure on 2019-03-14 from 15:00:00 to 16:00:00 UTC At fedora-meeting-1(a)irc.freenode.net The meeting will be about: Weekly Fedora Infrastructure meeting. See infrastructure list for agenda a day before or view it at https://infinote.fedoraproject.org/cgit/infinote/tree/fedora-infrastructure… Source: https://apps.fedoraproject.org/calendar/meeting/22/

1 0

FBR to add host to mirrors tier1
by Stephen John Smoogen 12 Mar '19

12 Mar '19

I tried to make format-patch work but I have some problems in places still in my setup :/ From 49ab54526b57d0cde534b2887a4e77cf021090ea Mon Sep 17 00:00:00 2001 From: Stephen Smoogen <smooge(a)redhat.com> Date: Mon, 11 Mar 2019 22:39:30 +0000 Subject: [Freeze Break Request] FBR: rsyncd/download servers Add dotsrc to tier1 To: infrastructure(a)lists.fedoraproject.org Add dotsrc to tier1 so that europe has another large mirror. --- inventory/group_vars/download | 2 ++ roles/rsyncd/templates/rsyncd.conf.download.j2 | 10 ++++++++++ 2 files changed, 12 insertions(+) diff --git a/inventory/group_vars/download b/inventory/group_vars/download index 7d3fe98..a806797 100644 --- a/inventory/group_vars/download +++ b/inventory/group_vars/download @@ -70,3 +70,5 @@ dl_tier1: - 147.75.69.165 # sjc.edge.kernel.org - 147.75.197.195 # ewr.edge.kernel.org - 147.75.101.1 # ams.edge.kernel.org + - 130.225.254.116 # dotsrc.org + - 2001:878:346::116 # dotsrc.org diff --git a/roles/rsyncd/templates/rsyncd.conf.download.j2 b/roles/rsyncd/templates/rsyncd.conf.download.j2 index 9a7b0fc..aa2f8f0 100644 --- a/roles/rsyncd/templates/rsyncd.conf.download.j2 +++ b/roles/rsyncd/templates/rsyncd.conf.download.j2 @@ -149,6 +149,7 @@ refuse options = checksum gid = 263 hosts allow = {% for host in vars['dl_tier1'] %}{{host}},{% endfor %} +{% if datacenter == 'phx2' %} [fedora-compose0] comment = Fedora composes path = /mnt/koji/compose @@ -156,7 +157,16 @@ refuse options = checksum uid = nobody gid = nobody hosts allow = 10.0.0.0/8, 209.132.0.0/16 +{% endif %} +{% if inventory_hostname == 'download-cc-rdu01.fedoraproject.org' %} +[centos] + comment = CentOS + path = /srv/pub/centos + list = no + uid = nobody + gid = nobody +{% endif %} # For distributing applications [log] -- 1.8.3.1 -- Stephen J Smoogen.

3 3

dist-git 1.10 release
by Michal Novotny 12 Mar '19

12 Mar '19

Hello, I've released a new version of dist-git 1.10 (https://github.com/release-engineering/dist-git) The main thing in there is python2/3 compatibility. When deployed in Fedora, it uses python3 now. I've also fixed a small bug in post-receive hook when there were no hooks to run in post-receive-chained.d and did a few fixes in tests. You can see the updates here: https://bodhi.fedoraproject.org/updates/?packages=dist-git clime

1 0

Proposal to increase number of concurrent MBS builds
by Mikolaj Izdebski 11 Mar '19

11 Mar '19

I would like to propose increasing NUM_CONCURRENT_BUILDS for MBS to value 100 after beta freeze is over. The above MBS setting controls how many parallel component builds MBS can run at the same time. Current value is only 20. That value was defined 3 years ago, in March 2017 when there were much fewer modules in Fedora. Our Koji has capacity to run many more builds. Currently we have 158 Koji builders in default channel that are able to run RPM builds. Their total capacity is 566. Therefore it should be safe to increase MBS NUM_CONCURRENT_BUILDS to at least 100. Especially since Koji builds submitted by MBS have lower priority than default for non-modular component builds submitted by packagers, so packager-submitted builds will take precedence over builds submitted by MBS. -- Mikolaj Izdebski

3 6

[PATCH] Add zchunk support to updates and updates-testing repositories
by Jonathan Dieter 11 Mar '19

11 Mar '19

This adds zchunk support for the updates and updates-testing repositories for both rpms and modularity Signed-off-by: Jonathan Dieter <jdieter(a)gmail.com> --- roles/bodhi2/backend/templates/pungi.module.conf.j2 | 3 +++ roles/bodhi2/backend/templates/pungi.rpm.conf.j2 | 3 +++ 2 files changed, 6 insertions(+) diff --git a/roles/bodhi2/backend/templates/pungi.module.conf.j2 b/roles/bodhi2/backend/templates/pungi.module.conf.j2 index bb021eb13..7dad35403 100644 --- a/roles/bodhi2/backend/templates/pungi.module.conf.j2 +++ b/roles/bodhi2/backend/templates/pungi.module.conf.j2 @@ -59,6 +59,9 @@ greedy_method = 'build' createrepo_c = True createrepo_checksum = 'sha256' createrepo_deltas = False +[% if release.version_int >= 30 %] +createrepo_extra_args = ['--zck', '--zck-dict-dir=/usr/share/fedora-repo-zdicts/f[[ release.version_int ]]'] +[% endif %] #jigdo create_jigdo = False diff --git a/roles/bodhi2/backend/templates/pungi.rpm.conf.j2 b/roles/bodhi2/backend/templates/pungi.rpm.conf.j2 index 8d9e9a3f2..020736aee 100644 --- a/roles/bodhi2/backend/templates/pungi.rpm.conf.j2 +++ b/roles/bodhi2/backend/templates/pungi.rpm.conf.j2 @@ -66,6 +66,9 @@ createrepo_deltas = [ ('^Everything$', {'*': True}) ] createrepo_database = True +[% if release.version_int >= 30 %] +createrepo_extra_args = ['--zck', '--zck-dict-dir=/usr/share/fedora-repo-zdicts/f[[ release.version_int ]]'] +[% endif %] # CHECKSUMS media_checksums = ['sha256'] -- 2.20.1

3 2

[FBR] Adding f30 key to bodhi modular pungi config
by Mohan Boddu 11 Mar '19

11 Mar '19

This patch will add fedora-30 key to bodhi modular pungi config. diff --git a/roles/bodhi2/backend/templates/pungi.module.conf.j2 b/roles/bodhi2/backend/templates/pungi.module.conf.j2 index bb021eb..43c6a7e 100644 --- a/roles/bodhi2/backend/templates/pungi.module.conf.j2 +++ b/roles/bodhi2/backend/templates/pungi.module.conf.j2 @@ -14,6 +14,8 @@ sigkeys = [ '9db62fb1', [% elif release.version_int == 29 %] '429476b4', +[% elif release.version_int == 30 %] + 'cfc659b9', [% endif %] {% if env == "staging" %} None Please +1 this patch to resume the failed f30-modular-updates-testing. Thanks.

3 3

FBR: Rebuild Bodhi frontend containers
by Randy Barlow 11 Mar '19

11 Mar '19

Greetings! The Bodhi frontend container was not rebuilt when the Fedora 30 configurations were added to production.ini. This means that the frontend is not aware of the policy of 3 days to stable, while the backend is aware. This means that the backend is adding comments to updates to tell packagers they can push their packages, but the frontend is not allowing them to push the packages. To fix this, I will run this command: $ sudo rbac-playbook openshift-apps/bodhi.yml I will also send a patch to the releng SOP which doesn't explicitly mention this step - it really should just link to the Bodhi SOP where this is mentioned.

3 3

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

infrastructure March 2019