CPE Weekly: 2020-02-14

[Aoife Moloney]

# CPE Weekly: 2020-02-14

Background:
The Community Platform Engineering group is the Red Hat team combining
IT and release engineering from Fedora and CentOS. Our goal is to keep
core servers and services running and maintained, build releases, and
other strategic tasks that need more dedicated time than volunteers
can give.
For better communication, we will be giving weekly reports to the
CentOS and Fedora communities about the general tasks and work being
done.  Also for better communication between our groups we have
created #redhat-cpe on Freenode IRC! Please feel free to catch us
there, a mail has landed on both the CentOS and Fedora devel lists
with context here.

## Fedora Updates

### Data Centre Move
By June 15th 2020, dedicated Fedora servers will have moved to a new
data centre in Northern Virginia.
If you want to read more, check out our post on hackmd:
https://hackmd.io/@Ap8CkTlpSfmjb44UGV-kWA/rJsk7A-QL

Here are some key dates and actions we need you to know:
* On 28th Feb, the old OpenStack instance in Fedora Cloud will be retired.
* Please reach out to Kevin before 25th Feb if you need to take action
for your instance if you are an instance owner. Here is the link to
the current status: https://pagure.io/fedora-infrastructure/issue/8614
* On 13th April, the CPE team will begin to ship servers to our new
data centre - this does not affect F32 distribution or release
* From March 1st, the CPE team will begin to build the Minimum Viable
Fedora infrastructure in the new datacenter
* Between May 20th - July 1st, we will be redirecting Fedora services
to run on the 'MVF' offering to facilitate the final part of the move
and allow for re-racking and testing
* By July 1st we hope to have BAU (business as usual) for Fedora infra

### AAA Replacement
This project is replacing our old existing fas (fedora account system)
with a new freeipa based system.
* Check out our blog on the teams progress to date!
* You can also see our jira board for tickets we are working on
* And we have an IRC channel - #fedora-AAA
* We are currently working on the FreeIPA API integration and the
folks at FreeIPA have been really helpful so far to work with

### CI/CD
* The team have been trying to get a local instance of Koji running this week
* They are investigating different algorithms that could help generate
the next release if a package based on its git history.
* Monitoring-gating is being deployed in OpenShift in staging

### Sustaining Team
* The team meets daily @ 1900 UTC in #fedora-admin on IRC
* The priority work is:
** Fedora 32
** Assisting with technical debt to facilitate the colo move
** mbbox upgrading
** CentOS CI OpenShift upgrading
* The team also have a public thread on knowledge sharing,
https://lists.fedoraproject.org/archives/list/[e-mail]...
so take a look!

## Docs
* Merged https://pagure.io/fedora-docs/quick-docs/pull-request/175
* Merged https://pagure.io/fedora-docs/quick-docs/pull-request/174
* Merged https://pagure.io/fedora-docs/quick-docs/pull-request/173
* Merged https://pagure.io/fedora-docs/quick-docs/pull-request/167
* Reviewed https://pagure.io/fedora-docs/install-guide/pull-request/40
* Also work underway on CentOS 8.1 docs


### Misc Updates
* The team are also working on creating Fedora infra application map -
stay tuned for the publication soon!
* keys.fedoraproject.org has been turned off
* boot.fedoraproject.org will be retired this week
* Certs have been changed to letsencrypt for fedorahosted/fedoracommunity
* Moved Koji calls to a backend task worker in Bodhi:
https://github.com/fedora-infra/bodhi/issues/3061
* kdreyer's playbook repo has been integrated:
https://pagure.io/koji-vagrant/pull-request/1
* Testing dist-git repo as a submodule has been added:
https://pagure.io/koji-vagrant/pull-request/2
* Ticket in Monitor-Gating has been reviewed:
https://pagure.io/fedora-ci/monitor-gating/pull-request/8


## CentOS Updates
### CentOS
* Tuning/adding more mirrorlist servers due to EC2/AWS change from last week
    * Updates are really faster now for CentOS users in AWS/EC2 (more
than 100TiB of updated packages served internally with a 98.33% ratio
served from cache, so faster than ever)
* Moving data from CentOs Infra and switching to a new solution for
backup for infra:
    * https://github.com/CentOS/ansible-role-centos-backup/
    * https://github.com/CentOS/ansible-role-restic
    * VDO
(https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...)
* Investigating how to incorporate CentOS auth into the new AAA solution
    * We'll need proper communication plan to ask everybody to get a
FAS account when we'll migrate


### CentOS Stream
* The CPE team are collaborating with the Packit team internally to
develop a workflow for contributor patches
* We are working towards demoing a contributor patch from submission
to end for Red Hat Summit in April!



As always, feedback is welcome, and we will continue to look at ways
to improve the delivery and readability of this weekly report.


Have a great weekend!

Aoife

--
Aoife Moloney
Product Owner
Community Platform Engineering Team
Red Hat EMEA
Communications House
Cork Road
Waterford

[Till Maas]

Hi,

awesome, how you improved the layout of this e-mail. Thank you! If the
original source is still a google doc please let me know how you convert
it.

On Fri, Feb 14, 2020 at 05:56:26PM +0000, Aoife Moloney wrote:

>  ### AAA Replacement 
IMHO this section should be labeled "AAA - Replacement for Fedora
Account System (FAS)" or is this not called AAA but securitas?


>  This project is replacing our old existing fas (fedora account
> system)
>  with a new freeipa based system.
>  * Check out our blog on the teams progress to date! 
It would be great if you could add the link to the blog (post?) here.

>  * You can also see our jira board for tickets we are working on
Also a link to the Jira board would be great.

>  * And we have an IRC channel - #fedora-AAA
>  * We are currently working on the FreeIPA API integration and the
>  folks at FreeIPA have been really helpful so far to work with 
The Fedora Council is investigating to provide hardware tokens to Fedora
contributors to be used for authentication to Fedora systems.
What are the authentication methods that will be supported by AAA in the
future? Will there be two-factor authentication for everyone?

The Fedora Council ticket is here for your reference:
https://pagure.io/Fedora-Council/tickets/issue/251

Kind regards
Till

[Neal Gompa]

On Wed, Feb 19, 2020 at 10:29 AM Till Maas <opensource(a)till.name&gt; wrote:
>  On Fri, Feb 14, 2020 at 05:56:26PM +0000, Aoife Moloney wrote:
>
>  > ### AAA Replacement
>
>  IMHO this section should be labeled "AAA - Replacement for Fedora
>  Account System (FAS)" or is this not called AAA but securitas?
>
>
>  > This project is replacing our old existing fas (fedora account system)
>  > with a new freeipa based system.
>  > * Check out our blog on the teams progress to date!
>
>  It would be great if you could add the link to the blog (post?) here.
>
>  > * You can also see our jira board for tickets we are working on
>
>  Also a link to the Jira board would be great.
>  
The JIRA board isn't terribly helpful, since only RHers can see it.

>  > * And we have an IRC channel - #fedora-AAA
>  > * We are currently working on the FreeIPA API integration and the
>  > folks at FreeIPA have been really helpful so far to work with
>  
There's also some interest from the openSUSE community about using it
to replace their account system. There's some work to be done to make
it suitable on that front, though...



-- 
真実はいつも一つ！/ Always, there's only one truth!

[Pierre-Yves Chibon]

On Wed, Feb 19, 2020 at 04:28:40PM +0100, Till Maas wrote:
>  Hi,
>  
>  awesome, how you improved the layout of this e-mail. Thank you! If the
>  original source is still a google doc please let me know how you convert
>  it. 
It was written in hackmd :)

>  On Fri, Feb 14, 2020 at 05:56:26PM +0000, Aoife Moloney wrote:
>  
>  > ### AAA Replacement
>  
>  IMHO this section should be labeled "AAA - Replacement for Fedora
>  Account System (FAS)" or is this not called AAA but securitas? 
The project needs to be renamed from securitas, the final name hasn't been
picked though iirc.


Pierre