Infrastructure/ansible
1
0
Fork 0
Code Issues Pull requests 6 Projects Releases Packages Wiki Activity Actions

Apply openvpn/client role before ipa/client

Browse source 
This is so hosts on the Fedora VPN are able to talk to IPA before they
try to enroll.

Signed-off-by: Nils Philippsen <nils@redhat.com>
This commit is contained in:
Nils Philippsen 2021-03-24 13:43:28 +01:00
parent bcfe96b710
commit 2d4ec8d259
43 changed files with 77 additions and 105 deletions
Download patch file Download diff file Expand all files Collapse all files

2
playbooks/groups/backup-server.yml
View file

@ -18,6 +18,7 @@
- rkhunter
- nagios_client
- hosts
- openvpn/client
- ipa/client
- sudo
- collectd/base
@ -25,7 +26,6 @@
mnt_dir: '/fedora_backups',
nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=3",
nfs_src_dir: 'fedora_backups' }
- openvpn/client
- grokmirror_mirror
pre_tasks:

4
playbooks/groups/badges-backend.yml
View file

@ -20,12 +20,12 @@
- rkhunter
- nagios_client
- hosts
- { role: openvpn/client,
when: env != "staging" }
- ipa/client
- collectd/base
- fedmsg/base
- sudo
- { role: openvpn/client,
when: env != "staging" }
pre_tasks:
- import_tasks: "{{ tasks_path }}/yumrepos.yml"

4
playbooks/groups/badges-web.yml
View file

@ -20,14 +20,14 @@
- rkhunter
- nagios_client
- hosts
- { role: openvpn/client,
when: env != "staging" }
- ipa/client
- collectd/base
- badges/frontend
- fedmsg/base
- rsyncd
- sudo
- { role: openvpn/client,
when: env != "staging" }
- mod_wsgi
- role: collectd/web-service
site: frontpage

4
playbooks/groups/basset.yml
View file

@ -17,12 +17,12 @@
- rkhunter
- nagios_client
- hosts
- { role: openvpn/client,
when: env != "staging" }
- ipa/client
- collectd/base
- rsyncd
- sudo
- { role: openvpn/client,
when: env != "staging" }
- mongodb
- rabbitmq
- mod_wsgi

2
playbooks/groups/bastion_stg.yml
View file

@ -15,11 +15,11 @@
- rkhunter
- nagios_client
- hosts
#- { role: openvpn/client, when: inventory_hostname.startswith('bastion13') }
- ipa/client
- sudo
#- collectd/base
#- { role: openvpn/server, when: not inventory_hostname.startswith('bastion-comm01') or inventory_hostname.startswith('bastion13') }
#- { role: openvpn/client, when: inventory_hostname.startswith('bastion13') }
#- { role: packager_alias, when: not inventory_hostname.startswith('bastion-comm01') or inventory_hostname.startswith('bastion13') }
#- opendkim

2
playbooks/groups/batcave.yml
View file

@ -15,6 +15,7 @@
- rkhunter
- nagios_client
- hosts
- openvpn/client
- ipa/client
- ansible-server
- sudo
@ -32,7 +33,6 @@
- role: httpd/certificate
certname: "{{wildcard_cert_name}}"
SSLCertificateChainFile: "{{wildcard_int_file}}"
- role: openvpn/client
- role: rabbit/user
username: "mirror_pagure_ansible{{ env_suffix }}"
- role: rabbit/user

4
playbooks/groups/blockerbugs.yml
View file

@ -16,12 +16,12 @@
- rkhunter
- nagios_client
- hosts
- { role: openvpn/client,
when: env != "staging" }
- ipa/client
- collectd/base
- sudo
- rsyncd
- { role: openvpn/client,
when: env != "staging" }
- mod_wsgi
- blockerbugs

4
playbooks/groups/busgateway.yml
View file

@ -15,12 +15,12 @@
- rkhunter
- nagios_client
- hosts
- { role: openvpn/client,
when: env != "staging" }
- ipa/client
- collectd/base
- fedmsg/base
- sudo
- { role: openvpn/client,
when: env != "staging" }
pre_tasks:
- import_tasks: "{{ tasks_path }}/yumrepos.yml"

4
playbooks/groups/certgetter.yml
View file

@ -15,12 +15,12 @@
- rkhunter
- nagios_client
- hosts
- { role: openvpn/client,
when: env != "staging" }
- ipa/client
- rsyncd
- sudo
- apache
- { role: openvpn/client,
when: env != "staging" }
pre_tasks:
- import_tasks: "{{ tasks_path }}/yumrepos.yml"

4
playbooks/groups/datagrepper.yml
View file

@ -17,6 +17,8 @@
- rkhunter
- nagios_client
- hosts
- { role: openvpn/client,
when: env != "staging" }
- ipa/client
- collectd/base
- fedmsg/base
@ -24,8 +26,6 @@
username: "datagrepper{{ env_suffix }}"}
- rsyncd
- sudo
- { role: openvpn/client,
when: env != "staging" }
- mod_wsgi
pre_tasks:

4
playbooks/groups/dns.yml
View file

@ -17,13 +17,13 @@
- hosts
- rkhunter
- nagios_client
- { role: openvpn/client,
when: datacenter != "rdu" and datacenter != 'iad2' }
- ipa/client
- collectd/base
- collectd/bind
- rsyncd
- sudo
- { role: openvpn/client,
when: datacenter != "rdu" and datacenter != 'iad2' }
- dns
pre_tasks:

2
playbooks/groups/download.yml
View file

@ -31,6 +31,7 @@
- rkhunter
- nagios_client
- hosts
- { role: openvpn/client, when: vpn == True }
- ipa/client
- collectd/base
- apache
@ -40,7 +41,6 @@
- { role: nfs/client, when: datacenter == "iad2", mnt_dir: '/mnt/koji', nfs_src_dir: 'fedora_koji/koji/' } # needed for internal sync and odcs
- { role: nfs/client, when: datacenter == "iad2", mnt_dir: '/srv/odcs', nfs_src_dir: 'fedora_odcs' } # needed for internal sync
- sudo
- { role: openvpn/client, when: vpn == True }
pre_tasks:
- include_vars: dir=/srv/web/infra/ansible/vars/all/ ignore_files=README

8
playbooks/groups/fedimg.yml
View file

@ -16,16 +16,16 @@
roles:
- base
- rkhunter
# The proxies don't actually need to talk to these hosts so we won't bother
# putting them on the vpn.
#- { role: openvpn/client,
# when: env != "staging" }
- ipa/client
- nagios_client
- hosts
- collectd/base
- fedmsg/base
- sudo
# The proxies don't actually need to talk to these hosts so we won't bother
# putting them on the vpn.
#- { role: openvpn/client,
# when: env != "staging" }
pre_tasks:
- import_tasks: "{{ tasks_path }}/yumrepos.yml"

4
playbooks/groups/fedocal.yml
View file

@ -15,11 +15,11 @@
- rkhunter
- nagios_client
- hosts
- { role: openvpn/client,
when: env != "staging" }
- ipa/client
- rsyncd
- sudo
- { role: openvpn/client,
when: env != "staging" }
- mod_wsgi
- collectd/base

4
playbooks/groups/github2fedmsg.yml
View file

@ -20,12 +20,12 @@
- rkhunter
- nagios_client
- hosts
- { role: openvpn/client,
when: env != "staging" }
- ipa/client
- collectd/base
- rsyncd
- sudo
- { role: openvpn/client,
when: env != "staging" }
- mod_wsgi
pre_tasks:

4
playbooks/groups/ipa.yml
View file

@ -16,11 +16,11 @@
- nagios_client
- collectd/base
- hosts
- { role: openvpn/client,
when: env != "staging" }
- ipa/client
- rsyncd
- sudo
- { role: openvpn/client,
when: env != "staging" }
pre_tasks:
- import_tasks: "{{ tasks_path }}/yumrepos.yml"

4
playbooks/groups/kerneltest.yml
View file

@ -20,12 +20,12 @@
- rkhunter
- nagios_client
- hosts
- { role: openvpn/client,
when: env != "staging" }
- ipa/client
- collectd/base
- rsyncd
- sudo
- { role: openvpn/client,
when: env != "staging" }
- mod_wsgi
pre_tasks:

2
playbooks/groups/logserver.yml
View file

@ -15,12 +15,12 @@
- rkhunter
- nagios_client
- hosts
- openvpn/client
- ipa/client
- apache
- collectd/base
- collectd/server
- sudo
- openvpn/client
- awstats
- web-data-analysis
- role: keytab/service

4
playbooks/groups/mailman.yml
View file

@ -19,11 +19,11 @@
- rkhunter
- nagios_client
- hosts
- { role: openvpn/client,
when: env != "staging" }
- ipa/client
- collectd/base
- sudo
- { role: openvpn/client,
when: env != "staging" }
- spamassassin
- mod_wsgi

18
playbooks/groups/mbs.yml
View file

@ -18,6 +18,8 @@
- rkhunter
- nagios_client
- hosts
# openvpn on the prod frontend nodes
- { role: openvpn/client, when: "'mbs_frontend' in group_names and datacenter == 'iad2'" }
- ipa/client
- rsyncd
- sudo
@ -29,22 +31,6 @@
handlers:
- import_tasks: "{{ handlers_path }}/restart_services.yml"
- name: openvpn on the prod frontend nodes
hosts: mbs_frontend
user: root
gather_facts: True
vars_files:
- /srv/web/infra/ansible/vars/global.yml
- "/srv/private/ansible/vars.yml"
- "{{ vars_path }}/{{ ansible_distribution }}.yml"
roles:
- { role: openvpn/client, when: datacenter == 'iad2' }
handlers:
- import_tasks: "{{ handlers_path }}/restart_services.yml"
- name: Set up apache on the frontend MBS API app
hosts: mbs_frontend:mbs_frontend_stg
user: root

2
playbooks/groups/mirrormanager.yml
View file

@ -15,10 +15,10 @@
- rkhunter
- nagios_client
- hosts
- { role: openvpn/client, when: env != "staging" and inventory_hostname.startswith('mm-frontend') }
- ipa/client
- sudo
- collectd/base
- { role: openvpn/client, when: env != "staging" and inventory_hostname.startswith('mm-frontend') }
- { role: nfs/client, when: inventory_hostname.startswith('mm-backend01'), mnt_dir: '/srv/pub', nfs_src_dir: 'fedora_ftp/fedora.redhat.com/pub' }
pre_tasks:

2
playbooks/groups/noc.yml
View file

@ -19,11 +19,11 @@
- rkhunter
- nagios_client
- hosts
- { role: openvpn/client, when: env != "staging" }
- ipa/client
- collectd/base
- { role: rsyncd, when: datacenter == 'iad2' }
- sudo
- { role: openvpn/client, when: env != "staging" }
- mod_wsgi
- role: keytab/service
owner_user: apache

8
playbooks/groups/notifs-backend.yml
View file

@ -22,6 +22,10 @@
- base
- rkhunter
- hosts
# The proxies don't actually need to talk to these hosts so we won't bother
# putting them on the vpn.
#- { role: openvpn/client,
# when: env != "staging" }
- ipa/client
- nagios_client
- collectd/base
@ -30,10 +34,6 @@
- { role: rabbit/user,
username: "notifs-backend{{ env_suffix }}"}
- sudo
# The proxies don't actually need to talk to these hosts so we won't bother
# putting them on the vpn.
#- { role: openvpn/client,
# when: env != "staging" }
tasks:
- import_tasks: "{{ tasks_path }}/motd.yml"

4
playbooks/groups/notifs-web.yml
View file

@ -20,6 +20,8 @@
- rkhunter
- nagios_client
- hosts
- { role: openvpn/client,
when: env != "staging" }
- ipa/client
- collectd/base
- mod_wsgi
@ -29,8 +31,6 @@
username: "notifs-web{{ env_suffix }}"}
- notifs/frontend
- sudo
- { role: openvpn/client,
when: env != "staging" }
pre_tasks:
- import_tasks: "{{ tasks_path }}/yumrepos.yml"

4
playbooks/groups/nuancier.yml
View file

@ -20,11 +20,11 @@
- rkhunter
- nagios_client
- hosts
- { role: openvpn/client,
when: env != "staging" }
- ipa/client
- collectd/base
- sudo
- { role: openvpn/client,
when: env != "staging" }
- mod_wsgi
pre_tasks:

4
playbooks/groups/oci-registry.yml
View file

@ -16,12 +16,12 @@
- rkhunter
- nagios_client
- hosts
- { role: openvpn/client,
when: env != "staging" }
- ipa/client
- collectd/base
- rsyncd
- sudo
- { role: openvpn/client,
when: env != "staging" }
- role: nfs/client
mnt_dir: '/srv/registry'
nfs_src_dir: "oci_registry"

18
playbooks/groups/odcs.yml
View file

@ -18,6 +18,8 @@
- rkhunter
- nagios_client
- hosts
# openvpn on the prod frontend nodes
#- { role: openvpn/client, when: "'odcs_frontend' in group_names" }
- ipa/client
- rsyncd
- sudo
@ -29,22 +31,6 @@
handlers:
- import_tasks: "{{ handlers_path }}/restart_services.yml"
#- name: openvpn on the prod frontend nodes
# hosts: odcs_frontend
# user: root
# gather_facts: True
#
# vars_files:
# - /srv/web/infra/ansible/vars/global.yml
# - "/srv/private/ansible/vars.yml"
# - "{{ vars_path }}/{{ ansible_distribution }}.yml"
#
# roles:
# - openvpn/client
#
# handlers:
# - import_tasks: "{{ handlers_path }}/restart_services.yml"
- name: Set up odcs frontend service
hosts: odcs_frontend:odcs_frontend_stg
user: root

2
playbooks/groups/os-cluster.yml
View file

@ -16,11 +16,11 @@
- rkhunter
- nagios_client
- hosts
- { role: openvpn/client, when: env != "staging" }
- ipa/client
- collectd/base
- rsyncd
- sudo
- { role: openvpn/client, when: env != "staging" }
tasks:
- name: put openshift repo on os- systems

4
playbooks/groups/packages.yml
View file

@ -23,12 +23,12 @@
- rkhunter
- nagios_client
- hosts
- { role: openvpn/client,
when: env != "staging" }
- ipa/client
- collectd/base
- rsyncd
- sudo
- { role: openvpn/client,
when: env != "staging" }
- mod_wsgi
tasks:

2
playbooks/groups/pagure.yml
View file

@ -15,10 +15,10 @@
- rkhunter
- nagios_client
- hosts
- openvpn/client
- ipa/client
- sudo
- collectd/base
- openvpn/client
- postgresql_server
pre_tasks:

4
playbooks/groups/pdc.yml
View file

@ -23,6 +23,8 @@
- collectd/base
- hosts
- ipa/client
- role: openvpn/client
when: env != "staging" and datacenter == 'iad2'
- sudo
tasks:
@ -40,8 +42,6 @@
- import_tasks: "{{ handlers_path }}/restart_services.yml"
roles:
- role: openvpn/client
when: env != "staging" and datacenter == 'iad2'
- mod_wsgi
- role: fedmsg/base
# Set up for fedora-messaging

2
playbooks/groups/people.yml
View file

@ -59,13 +59,13 @@
roles:
- base
- collectd/base
- { role: openvpn/client, when: env != "staging" }
- ipa/client
- hosts
- nagios_client
- rkhunter
- rsyncd
- sudo
- { role: openvpn/client, when: env != "staging" }
- cgit/base
- cgit/clean_lock_cron
- cgit/make_pkgs_list

4
playbooks/groups/proxies.yml
View file

@ -18,6 +18,8 @@
roles:
- base
- { role: openvpn/client,
when: env != "staging" }
- ipa/client
- rkhunter
- nagios_client
@ -28,8 +30,6 @@
- rsyncd
- { role: mirrormanager/mirrorlist_proxy,
when: env == "staging" or "'mirrorlist_proxy' in group_names" }
- { role: openvpn/client,
when: env != "staging" }
- apache
tasks:

4
playbooks/groups/resultsdb.yml
View file

@ -23,11 +23,11 @@
- { role: rkhunter, tags: ['rkhunter'] }
- { role: nagios_client, tags: ['nagios_client'] }
- { role: hosts, tags: ['hosts']}
- { role: openvpn/client,
when: deployment_type == "prod" }
- ipa/client
- { role: collectd/base, tags: ['collectd_base'] }
- { role: sudo, tags: ['sudo'] }
- { role: openvpn/client,
when: deployment_type == "prod" }
- apache
- fedmsg/base
- { role: dnf-automatic, tags: ['dnfautomatic'] }

2
playbooks/groups/retrace.yml
View file

@ -64,10 +64,10 @@
tasks:
- import_role: name=base
- import_role: name=hosts
- import_role: name=openvpn/client
- import_role: name=ipa/client
- import_role: name=rkhunter
- import_role: name=nagios_client
- import_role: name=openvpn/client
- import_role: name=sudo
- import_tasks: "{{ tasks_path }}/motd.yml"

4
playbooks/groups/smtp-mm.yml
View file

@ -17,11 +17,11 @@
- rkhunter
- nagios_client
- hosts
- { role: openvpn/client,
when: env != "staging" }
- ipa/client
- collectd/base
- sudo
- { role: openvpn/client,
when: env != "staging" }
pre_tasks:
- import_tasks: "{{ tasks_path }}/yumrepos.yml"

4
playbooks/groups/sundries.yml
View file

@ -20,6 +20,8 @@
- rkhunter
- nagios_client
- hosts
- { role: openvpn/client,
when: env != "staging" }
- ipa/client
- collectd/base
- mod_wsgi
@ -35,8 +37,6 @@
- freemedia
- sudo
- pager_server
- { role: openvpn/client,
when: env != "staging" }
- role: zanata
when: master_sundries_node|bool
- role: fedora-web/build

2
playbooks/groups/torrent.yml
View file

@ -15,11 +15,11 @@
- hosts
- rkhunter
- nagios_client
- openvpn/client
- ipa/client
- collectd/base
- rsyncd
- sudo
- openvpn/client
- torrent
- apache

4
playbooks/groups/unbound.yml
View file

@ -15,12 +15,12 @@
- rkhunter
- nagios_client
- hosts
- { role: openvpn/client,
when: env != "staging" }
- ipa/client
- collectd/base
- unbound
- sudo
- { role: openvpn/client,
when: env != "staging" }
pre_tasks:
- import_tasks: "{{ tasks_path }}/yumrepos.yml"

4
playbooks/groups/value.yml
View file

@ -15,6 +15,8 @@
- rkhunter
- nagios_client
- hosts
- { role: openvpn/client,
when: env != "staging" }
- ipa/client
- collectd/base
- apache
@ -26,8 +28,6 @@
- supybot
- sudo
- rsyncd
- { role: openvpn/client,
when: env != "staging" }
- role: collectd/fedmsg-service
process: fedmsg-irc
- mote

2
playbooks/groups/virthost.yml
View file

@ -23,12 +23,12 @@
- rkhunter
- nagios_client
- hosts
- { role: openvpn/client, when: vpn|bool }
- ipa/client
- collectd/base
- { role: iscsi_client, when: "inventory_hostname.startswith(('bvirthost', 'buildvmhost-0'))" }
- { role: iscsi_client, when: "inventory_hostname.startswith(('bvmhost-x86-06', 'bvmhost-x86-07')) and datacenter == 'iad2'" }
- sudo
- { role: openvpn/client, when: vpn|bool }
- virthost
- { role: clevis, when: datacenter == 'iad2'}
- { role: serial-console, when: datacenter == 'iad2' and not inventory_hostname.startswith('buildvmhost-s390x') }

4
playbooks/groups/vmhost_copr.yml
View file

@ -24,11 +24,11 @@
- rkhunter
- nagios_client
- hosts
- { role: openvpn/client, when: vpn|bool }
- virthost
- ipa/client
- collectd/base
- sudo
- { role: openvpn/client, when: vpn|bool }
- virthost
tasks:
- import_tasks: "{{ tasks_path }}/motd.yml"

4
playbooks/groups/wiki.yml
View file

@ -23,6 +23,8 @@
- rkhunter
- nagios_client
- hosts
- { role: openvpn/client,
when: env != "staging" }
- ipa/client
- collectd/base
- apache
@ -34,8 +36,6 @@
- { role: nfs/client, when: env != "staging", mnt_dir: '/mnt/web/attachments', nfs_src_dir: 'fedora_app/app/attachments' }
- mediawiki
- sudo
- { role: openvpn/client,
when: env != "staging" }
tasks:
- import_tasks: "{{ tasks_path }}/motd.yml"