ansible/inventory/group_vars/oci_registry

---

fas_client_groups: sysadmin-releng

sudoers: "{{ private }}/files/sudo/00releng-sudoers"

ipa_host_group: oci-registry
ipa_host_group_desc: OCI Registry service
ipa_client_shell_groups:
- sysadmin-releng
ipa_client_sudo_groups:
- sysadmin-releng

tcp_ports: [ 5000 ]

nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=3"
Add docker-registry vars files Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> 2016-04-04 21:03:40 +00:00			`---`

			`fas_client_groups: sysadmin-releng`
Open port 443 for docker Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> 2016-04-08 15:17:39 +00:00
Grant sysadmin-releng access to docker registry Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> 2017-02-09 20:47:23 +00:00			`sudoers: "{{ private }}/files/sudo/00releng-sudoers"`

ipa/client: configure global shell access and sudo Almost global anyway, i.e. inside the VPN. The ipa/client-based shell access and sudo rules are only effective for staging right now, the respective playbook bits are masked out for prod. - Assign Ansible host groups to IPA host groups, the latter don't care about 'stg' in the name and use dashes rather than underscores. - Distill shell access groups from fas_client_groups in group and host vars. - Let all `sysadmin-` groups in the previous list run anything via sudo in the host group (except bastion & batcave). - Remove `fas_client_groups` from staging host and group vars. - Remove sudoers from staging host and group vars if only `sysadmin-` groups have shell access. - Set up `ipa_client_shell_groups` on bastion to be a super set of the same on batcave. Newly created IPA host groups: - autosign - badges - basset - bastion - batcave - blockerbugs - bodhi - bugzilla2fedmsg - busgateway - datagrepper - dbserver - dns - fedimg - github2fedmsg - ipa - kernel-qa - kerneltest - kojibuilder - kojihub - kojipkgs - logging - mailman - memcached - mirrormanager - nagios - notifs - oci-registry - odcs - openqa - openqa-workers - osbs - packages - pdc-web - pkgs - proxies - rabbitmq - releng-compose - resultsdb - secondary - sign-bridge - sundries - value - wiki Signed-off-by: Nils Philippsen <nils@redhat.com> 2021-01-25 11:58:04 +01:00			`ipa_host_group: oci-registry`
			`ipa_host_group_desc: OCI Registry service`
			`ipa_client_shell_groups:`
			`- sysadmin-releng`
			`ipa_client_sudo_groups:`
			`- sysadmin-releng`

base / iptables: just allow port 5000 for registries Signed-off-by: Kevin Fenzi <kevin@scrye.com> 2020-06-07 10:07:09 -07:00			`tcp_ports: [ 5000 ]`
open more ports... Signed-off-by: Rick Elrod <relrod@redhat.com> 2018-08-21 19:51:24 +00:00
Mount netapp RW Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> 2018-10-04 15:34:41 +00:00			`nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=3"`