From 224e28131d80cb4a822acc57c75f28e9d867a296 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Mon, 6 Dec 2021 10:39:11 -0800 Subject: [PATCH] openQA: prepare for prod deployment of latest releases This unifies prod and stg onto the ways of doing things for the latest packages, and rejigs the swtpm stuff a bit to tear down more (we shouldn't need the custom SELinux policy any more). Signed-off-by: Adam Williamson --- inventory/group_vars/openqa | 3 ++ inventory/group_vars/openqa_lab | 7 ----- inventory/group_vars/openqa_lab_workers | 2 -- inventory/group_vars/openqa_servers_common | 7 +++-- inventory/group_vars/openqa_workers | 3 ++ .../openqa/worker/files/openqa-swtpm@.service | 13 -------- roles/openqa/worker/files/systemd-swtpm.pp | Bin 1101 -> 0 bytes roles/openqa/worker/files/systemd-swtpm.te | 12 -------- roles/openqa/worker/tasks/main.yml | 12 ++++++-- roles/openqa/worker/tasks/swtpm-setup.yml | 28 ------------------ roles/openqa/worker/tasks/swtpm-teardown.yml | 7 +++++ 11 files changed, 26 insertions(+), 68 deletions(-) delete mode 100644 roles/openqa/worker/files/openqa-swtpm@.service delete mode 100644 roles/openqa/worker/files/systemd-swtpm.pp delete mode 100644 roles/openqa/worker/files/systemd-swtpm.te delete mode 100644 roles/openqa/worker/tasks/swtpm-setup.yml diff --git a/inventory/group_vars/openqa b/inventory/group_vars/openqa index 4c14ea06f5..262a56bc70 100644 --- a/inventory/group_vars/openqa +++ b/inventory/group_vars/openqa @@ -16,6 +16,9 @@ openqa_env_suffix: openqa_key: "{{ prod_openqa_apikey }}" # all our workers need NFS access openqa_nfs_workers: "{{ groups['openqa_workers'] }}" +# install openQA from updates-testing for now, we want to update to +# latest builds, don't want to wait for the 7 day threshold +openqa_repo: updates-testing openqa_resultsdb_url: http://resultsdb01.iad2.fedoraproject.org/resultsdb_api/api/v2.0/ openqa_secret: "{{ prod_openqa_apisecret }}" openqa_update_arches: ['x86_64'] diff --git a/inventory/group_vars/openqa_lab b/inventory/group_vars/openqa_lab index 18a57ee454..dcc7805c79 100644 --- a/inventory/group_vars/openqa_lab +++ b/inventory/group_vars/openqa_lab @@ -19,11 +19,6 @@ freezes: false # is working again: # https://pagure.io/fedora-infrastructure/issue/8381 openqa_amqp_wiki_reporter_queue: -# lab-specific until newer openQA is on prod (2021-11) -openqa_amqp_publisher_exchange: "amq.topic" -openqa_amqp_publisher_cacertfile: "/etc/fedora-messaging/{{ openqa_env_prefix }}cacert.pem" -openqa_amqp_publisher_certfile: "/etc/pki/fedora-messaging/openqa{{ openqa_env_suffix }}-cert.pem" -openqa_amqp_publisher_keyfile: "/etc/pki/fedora-messaging/openqa{{ openqa_env_suffix }}-key.pem" openqa_assetsize_ppc: 300 openqa_compose_arches: x86_64,aarch64,ppc64le openqa_dbname: openqa-stg @@ -42,8 +37,6 @@ openqa_nfs_workers: "{{ groups['openqa_lab_workers'] }}" # install openQA from updates-testing - this is staging, we live # ON THE EDGE (radical guitar riff) openqa_repo: updates-testing -# 2021-11 scratch builds for testing (plus the updated Mojolicious needed) -openqa_scratch: ["79442168", "79272379"] openqa_resultsdb_url: http://resultsdb01.stg.iad2.fedoraproject.org/resultsdb_api/api/v2.0/ openqa_secret: "{{ stg_openqa_apisecret }}" openqa_update_arches: ['x86_64', 'ppc64le'] diff --git a/inventory/group_vars/openqa_lab_workers b/inventory/group_vars/openqa_lab_workers index e8b2976e54..2de4f878e1 100644 --- a/inventory/group_vars/openqa_lab_workers +++ b/inventory/group_vars/openqa_lab_workers @@ -21,8 +21,6 @@ openqa_nfs_worker: true # install openQA and os-autoinst from updates-testing - this is # staging, we live ON THE EDGE (radical guitar riff) openqa_repo: updates-testing -# 2021-11 scratch builds for testing (plus the updated Mojolicious needed) -openqa_scratch: ["79299369", "79442168", "79272379"] openqa_secret: "{{ stg_openqa_apisecret }}" openqa_workers: 4 primary_auth_source: ipa diff --git a/inventory/group_vars/openqa_servers_common b/inventory/group_vars/openqa_servers_common index 8587e14e88..295ffbbe9d 100644 --- a/inventory/group_vars/openqa_servers_common +++ b/inventory/group_vars/openqa_servers_common @@ -16,9 +16,10 @@ openqa_amqp_mailto: ["adamwill@fedoraproject.org", "lruzicka@fedoraproject.org"] # we need this for all our fedora-messaging consumers as they are not # allowed to create queues on the infra AMQP broker, by broker config openqa_amqp_passive: true -# openQA isn't very ssl-aware here, so we're abusing its URL construction -# to stuff the cert and key values in here -openqa_amqp_publisher_exchange: "amq.topic&cacertfile=/etc/fedora-messaging/{{ openqa_env_prefix }}cacert.pem&certfile=/etc/pki/fedora-messaging/openqa{{ openqa_env_suffix }}-cert.pem&keyfile=/etc/pki/fedora-messaging/openqa{{ openqa_env_suffix }}-key.pem" +openqa_amqp_publisher_exchange: "amq.topic" +openqa_amqp_publisher_cacertfile: "/etc/fedora-messaging/{{ openqa_env_prefix }}cacert.pem" +openqa_amqp_publisher_certfile: "/etc/pki/fedora-messaging/openqa{{ openqa_env_suffix }}-cert.pem" +openqa_amqp_publisher_keyfile: "/etc/pki/fedora-messaging/openqa{{ openqa_env_suffix }}-key.pem" # fedora-messaging publisher settings openqa_amqp_publisher_prefix: org.fedoraproject.{{ fedmsg_env }} openqa_amqp_publisher_url: "amqps://openqa{{ openqa_env_suffix }}:@rabbitmq{{ openqa_env_suffix }}.fedoraproject.org/%2Fpubsub" diff --git a/inventory/group_vars/openqa_workers b/inventory/group_vars/openqa_workers index ae6fe400e7..d6142cd96e 100644 --- a/inventory/group_vars/openqa_workers +++ b/inventory/group_vars/openqa_workers @@ -18,6 +18,9 @@ openqa_hostname: openqa01.iad2.fedoraproject.org openqa_key: "{{ prod_openqa_apikey }}" # we are all NFS workers for now at least openqa_nfs_worker: true +# install openQA from updates-testing for now, we want to update to +# latest builds, don't want to wait for the 7 day threshold +openqa_repo: updates-testing openqa_secret: "{{ prod_openqa_apisecret }}" openqa_workers: 4 primary_auth_source: ipa diff --git a/roles/openqa/worker/files/openqa-swtpm@.service b/roles/openqa/worker/files/openqa-swtpm@.service deleted file mode 100644 index e078ba1b9a..0000000000 --- a/roles/openqa/worker/files/openqa-swtpm@.service +++ /dev/null @@ -1,13 +0,0 @@ -[Unit] -Description=openQA swtpm service - -[Service] -User=_openqa-worker -ExecStartPre=-/usr/bin/rm -rf /tmp/mytpm%I -ExecStartPre=/usr/bin/mkdir -p /tmp/mytpm%I -ExecStart=/usr/bin/swtpm socket --tpm2 --tpmstate dir=/tmp/mytpm%I --ctrl type=unixio,path=/tmp/mytpm%I/swtpm-sock --log level=20 -ExecReload=/bin/true -Restart=on-success - -[Install] -WantedBy=multi-user.target diff --git a/roles/openqa/worker/files/systemd-swtpm.pp b/roles/openqa/worker/files/systemd-swtpm.pp deleted file mode 100644 index 095e54a3612c2853eebec8dd25c1bd20a5054159..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1101 zcmcIj%TB{E5F9Ab9zby5#)1AoEBFI0+~C9qSfMdes>X>DM--{QfcV~?iiYk=D+}M+ zkyf_%H4|t3v)gP>0MKp#eD5~fYXEQ0)0Zj?>*;G#4l92O;8xNm*y9R7|J6rdm$Uve zw)F_W%1eNHS z>@+>=YE=%u)0&tR*xdh;S3RJA4Sg3-f6FUDazFx%6};6 ff8%@N-Wp$nz5<;e#&xRg