Config tweaks for new openQA aarch64 workers

Including an enhancement (I hope) to how we do the special
firewall config for the tap worker hosts: use a variable for the
ethernet interface rather than hardcoding a set of them.

Signed-off-by: Adam Williamson <awilliam@redhat.com>

inventory/group_vars/openqa_tap_workers

@@ -5,12 +5,9 @@ openqa_tap: true
 host_group: openqa-tap-workers
 
 # firewall rules to allow openQA openvswitch guests to communicate
-# eth0 for older x86_64 worker hosts, eth2 for ppc64 worker host,
-# em3 for newer x86_64 worker hosts
+# uses interface definition from host vars
 custom_rules: [
     '-A FORWARD -i br0 -j ACCEPT',
-    '-A FORWARD -m state -i eth0 -o br0 --state RELATED,ESTABLISHED -j ACCEPT',
-    '-A FORWARD -m state -i eth2 -o br0 --state RELATED,ESTABLISHED -j ACCEPT',
-    '-A FORWARD -m state -i em3 -o br0 --state RELATED,ESTABLISHED -j ACCEPT',
+    '-A FORWARD -m state -i {{ openqa_tap_iface }} -o br0 --state RELATED,ESTABLISHED -j ACCEPT',
     '-A INPUT -i br0 -j ACCEPT'
 ]

inventory/host_vars/openqa-aarch64-01.arm.fedoraproject.org

@@ -17,11 +17,13 @@ sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
 # openQA tap worker hosts (like this one) do stuff with ifcfg that base
 # doesn't understand. terrible, terrible stuff. seriously - it doesn't
 # handle the openvswitch config well. so let's tell it to just configure
-# the regular interfaces (which on this system is eth0-eth3) for us,
-# disabling all but the one we want to use (eth2), and leave everything
-# else alone.
-ansible_ifcfg_whitelist: ['eth3']
-ansible_ifcfg_disabled: ['eth0', 'eth1', 'eth2']
+# the regular interfaces (which on this system is eth0-eth2) for us,
+# disabling all but the one we want to use (eth0), and leave everything
+# else alone. We use a variable definition here so the firewall config
+# (in the openqa_tap_workers group_vars) can reuse it.
+openqa_tap_iface: eth0
+ansible_ifcfg_whitelist: [{{ openqa_tap_iface }}, 'eth1', 'eth2']
+ansible_ifcfg_disabled: ['eth1', 'eth2']
 
 # this is a powerful machine, can handle more openQA workers
 openqa_workers: 8

inventory/host_vars/openqa-aarch64-02.arm.fedoraproject.org

@@ -14,15 +14,6 @@ nrpe_procs_crit: 300
 
 sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
 
-# openQA tap worker hosts (like this one) do stuff with ifcfg that base
-# doesn't understand. terrible, terrible stuff. seriously - it doesn't
-# handle the openvswitch config well. so let's tell it to just configure
-# the regular interfaces (which on this system is eth0-eth3) for us,
-# disabling all but the one we want to use (eth2), and leave everything
-# else alone.
-ansible_ifcfg_whitelist: ['eth3']
-ansible_ifcfg_disabled: ['eth0', 'eth1', 'eth2']
-
 # this is a powerful machine, can handle more openQA workers
 openqa_workers: 8
 # firewall ports for server->worker websockets connections

inventory/host_vars/openqa-aarch64-03.arm.fedoraproject.org

@@ -14,15 +14,6 @@ nrpe_procs_crit: 300
 
 sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
 
-# openQA tap worker hosts (like this one) do stuff with ifcfg that base
-# doesn't understand. terrible, terrible stuff. seriously - it doesn't
-# handle the openvswitch config well. so let's tell it to just configure
-# the regular interfaces (which on this system is eth0-eth3) for us,
-# disabling all but the one we want to use (eth2), and leave everything
-# else alone.
-ansible_ifcfg_whitelist: ['eth3']
-ansible_ifcfg_disabled: ['eth0', 'eth1', 'eth2']
-
 # this is a powerful machine, can handle more openQA workers
 openqa_workers: 8
 # firewall ports for server->worker websockets connections

inventory/host_vars/openqa-aarch64-04.arm.fedoraproject.org

@@ -12,15 +12,6 @@ nrpe_procs_crit: 300
 
 sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
 
-# openQA tap worker hosts (like this one) do stuff with ifcfg that base
-# doesn't understand. terrible, terrible stuff. seriously - it doesn't
-# handle the openvswitch config well. so let's tell it to just configure
-# the regular interfaces (which on this system is eth0-eth3) for us,
-# disabling all but the one we want to use (eth2), and leave everything
-# else alone.
-ansible_ifcfg_whitelist: ['eth0', 'eth1', 'eth2', 'eth3']
-ansible_ifcfg_disabled: ['eth2', 'eth1', 'eth3']
-
 # this is a powerful machine, can handle more openQA workers
 openqa_workers: 8
 # firewall ports for server->worker websockets connections

inventory/host_vars/openqa-ppc64le-02.qa.fedoraproject.org

@@ -18,8 +18,10 @@ sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
 # handle the openvswitch config well. so let's tell it to just configure
 # the regular interfaces (which on this system is eth0-eth3) for us,
 # disabling all but the one we want to use (eth2), and leave everything
-# else alone.
-ansible_ifcfg_whitelist: ['eth0', 'eth1', 'eth2', 'eth3']
+# else alone. We use a variable definition here so the firewall config
+# (in the openqa_tap_workers group_vars) can reuse it.
+openqa_tap_iface: eth2
+ansible_ifcfg_whitelist: ['eth0', 'eth1', {{ openqa_tap_iface }}, 'eth3']
 ansible_ifcfg_disabled: ['eth0', 'eth1', 'eth3']
 
 # this is a powerful machine, can handle more openQA workers

inventory/host_vars/qa01.qa.fedoraproject.org

@@ -17,8 +17,10 @@ gw: 10.5.124.254
 # handle the openvswitch config well. so let's tell it to just configure
 # the regular interfaces (which on this system is em1-4) for us,
 # disabling all but the one we want to use (em3), and leave everything
-# else alone.
-ansible_ifcfg_whitelist: ['em1', 'em2', 'em3', 'em4']
+# else alone. We use a variable definition here so the firewall config
+# (in the openqa_tap_workers group_vars) can reuse it.
+openqa_tap_iface: em3
+ansible_ifcfg_whitelist: ['em1', 'em2', {{ openqa_tap_iface }}, 'em4']
 ansible_ifcfg_disabled: ['em1', 'em2', 'em4']
 
 # Has a hardware RNG

inventory/host_vars/qa02.qa.fedoraproject.org

@@ -17,8 +17,10 @@ gw: 10.5.124.254
 # handle the openvswitch config well. so let's tell it to just configure
 # the regular interfaces (which on this system is em1-4) for us,
 # disabling all but the one we want to use (em3), and leave everything
-# else alone.
-ansible_ifcfg_whitelist: ['em1', 'em2', 'em3', 'em4']
+# else alone. We use a variable definition here so the firewall config
+# (in the openqa_tap_workers group_vars) can reuse it.
+openqa_tap_iface: em3
+ansible_ifcfg_whitelist: ['em1', 'em2', {{ openqa_tap_iface }}, 'em4']
 ansible_ifcfg_disabled: ['em1', 'em2', 'em4']
 
 # Has a hardware RNG

inventory/inventory

@@ -519,21 +519,19 @@ openqa-aarch64-01.arm.fedoraproject.org
 openqa-aarch64-02.arm.fedoraproject.org
 openqa-aarch64-03.arm.fedoraproject.org
 
-
-
 # the workers that can run networked jobs. each server should have *one* of these per arch
 [openqa_tap_workers]
 qa01.qa.fedoraproject.org
 qa02.qa.fedoraproject.org
 openqa-ppc64le-02.qa.fedoraproject.org
-aarch64-c26n1-oqa.arm.fedoraproject.org
+openqa-aarch64-01.arm.fedoraproject.org
 
 # the workers that need rw access to the factory share to run createhdds. again,
 # only one per arch per instance should be present. usually x86_64 images are created
 # on the server, images for other arches on a worker.
 [openqa_hdds_workers]
 openqa-ppc64le-02.qa.fedoraproject.org
-aarch64-c26n1-oqa.arm.fedoraproject.org
+openqa-aarch64-01.arm.fedoraproject.org
 qa01.qa.fedoraproject.org
 qa02.qa.fedoraproject.org