We run the playbook first against the `copr-be-temp.aws..`
inventory_hostname, and then once more against `copr-be.aws..`. We need
to re-sign the pub keys for the later run.
https://pagure.io/fedora-infrastructure/issue/11006
Right now we just run the cron to update osbuildapi ip on buildhw-x86 in
prod, but we need to run it on the osbuild channel builders in staging
too. Fixes ticket 11575.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
For details, see the changelog for flask-oidc:
https://github.com/fedora-infra/flask-oidc/blob/develop/docs/changelog.md
The entry for 2.0.0 says:
> The callback route (aka "redirect URL") is not configurable with
> `OIDC_CALLBACK_ROUTE` anymore. It is always `/authorize`,
The option `OIDC_CALLBACK_ROUTE` is available again in version 2.0.3,
but we can override the whole redirect URL with
`OIDC_OVERWRITE_REDIRECT_URI` (since 2.1.0).
On RHEL9 ipa-replica-install fails if there is already client installed with
"Your system is partly configured." To prevent this we need to uninstall the
existing installation before trying to do replica.
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
The deploy replica step wasn't executed because it's checking if
`/etc/ipa/default.conf` exists. Remove that and use only the return code from
ipactl to check if the replication is done.
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
The ipactl status returns non 0 code when the IPA server is not set yet. We need
to ignore the error code when checking that.
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
As the /etc/ipa/default.conf is already created by ipa/client role, we need to
find another way to check if replication is needed. Calling `ipactl status`
should be more reliable.
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
The ipa02.stg is currently behaving strangely, let's try to move it to RHEL9, as
discussed in https://pagure.io/fedora-infrastructure/issue/10358, to solve the
issue.
The backup is available on vmhost-x86-02.stg in case anything goes wrong.
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
These are old rhel7 instances. The only thing left on them is fedmsg-irc
(sending to one irc channel, fedora-releng). Move everything to use the
newer rhel8 value02 instead.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
