koji-ansible modules update for 2019

[Ken Dreyer]

Hi folks,

Last year I started a project to manage Koji resources with Ansible
modules. The project is https://github.com/ktdreyer/koji-ansible

There are several modules now:

  koji_archivetype
  koji_btype
  koji_call (in progress at https://github.com/ktdreyer/koji-ansible/pull/64)
  koji_cg
  koji_external_repo
  koji_host
  koji_tag_inheritance
  koji_tag
  koji_target
  koji_user

I'm using this to manage a couple different Koji instances, and it's
going well so far. Here are some things I've learned along the way.

I have some playbooks that use these modules, and I maintain those
playbooks using Git pull requests. I don't have administrator access
to some of the important Koji instances, so this is a great way for
the administrators to delegate some of the configuration to myself and
other non-admins. In the past there have been some discussions about
increasing the granularity of Koji's ACLs in order to delegate more
configuration to wider groups of users. I think that capturing these
configurations in Ansible is a great way to meet that need without
increasing the complexity of the Koji Hub codebase. In a typical
workflow, I can modify a playbook, run it in "check" mode to verify
that my changes are going to do what I expect, and then I submit the
playbook pull request to the admins to review and merge.

Ansible provides a level of automation that makes large Koji changes
much easier. For some products in Red Hat we have several hundred tags
in Koji that we're managing with Ansible now.

With the level of automation Ansible provides, the accident blast
radius can be large. It's important to have good CI testing here so we
don't destroy things on the hub and fail to notice until it's much too
late. I've found it's tricky to mock or fake Koji's behavior in an
accurate way for anything but the simplest of cases. We do have fakes
and unit tests in koji-ansible for simple test cases, and these are
good for development velocity, but we really need assurance that these
modules will continue to work against real Koji hubs.

To that end, I'm developing an integration test suite for the
koji-ansible project. This integration suite sets up a Koji hub on
Travis CI's environment using Apache, mod_wsgi, SSL authentication,
and a Git clone of Koji's master branch. Once the hub is online, the
test suite runs many different playbooks against the hub, verifying
that the playbooks are doing what I expect. I plan to merge this
integration test suite into master in a week or two.

If you are interested in Koji, please take a look at the modules and
the inline documentation there. This project has taught me a lot about
how Koji's tags, inheritance, external repos, etc fit together, and
I've tried to provide plenty of examples in the module documentation.

- Ken

[Kevin Fenzi]

On Wed, Nov 13, 2019 at 03:34:14PM -0700, Ken Dreyer wrote:
>  Hi folks,
>  
>  Last year I started a project to manage Koji resources with Ansible
>  modules. The project is https://github.com/ktdreyer/koji-ansible
>  
>  There are several modules now:
>  
>    koji_archivetype
>    koji_btype
>    koji_call (in progress at https://github.com/ktdreyer/koji-ansible/pull/64)
>    koji_cg
>    koji_external_repo
>    koji_host
>    koji_tag_inheritance
>    koji_tag
>    koji_target
>    koji_user
>  
>  I'm using this to manage a couple different Koji instances, and it's
>  going well so far. Here are some things I've learned along the way.
>   
...snip...
>  
>  If you are interested in Koji, please take a look at the modules and
>  the inline documentation there. This project has taught me a lot about
>  how Koji's tags, inheritance, external repos, etc fit together, and
>  I've tried to provide plenty of examples in the module documentation. 
I've watched this project with interest. :) 

I'd really like to move Fedora's koji config into ansible too. 
I'm not sure when I will have time to work on it, but I'd really like to
do this at some point. I really think it would help avoid typos/issues
at branching and allow people to more transparently request things (with
PRs :) 

Anyhow, thanks for working on this and I hope myself (or anyone else
interested) can start using it soon...

kevin