We don't have new F39 backgrounds yet, so this test will always
fail. Let's split the test into its own policy so we can easily
control whether we're gating on it (this will be useful for
future cycles, probably).
Signed-off-by: Adam Williamson <awilliam@redhat.com>
F39 updates can't pass testing fully till we have a new compose
and can build new non-Rawhide base images, but we need some
updates that are currently pending to go in the compose. It's
a catch-22, just disabling gating till this is sorted seems
like the least worst option.
Signed-off-by: Adam Williamson <awilliam@redhat.com>
Since there is no central place to inspect osbuild worker logs (such
as Splunk instance), the sysadmin-osbuild group needs access to the
logging server.
Signed-off-by: Tomáš Hozza <thozza@redhat.com>
The IPA client groups configuration for osbuild workers was missed in
the original PR#1498 [1]. As a result, no member of the
`sysadmin-osbuild` FAS group can SSH to the osbuild workers.
Set the appropriate IPA client variables to grant access for this
group.
Also grant access for the `sysadmin-releng` group. There is no specific
reason, it just felt sensible since osbuild workers are running in the
Fedora infrastructure.
[1] https://pagure.io/fedora-infra/ansible/pull-request/1498
Signed-off-by: Tomáš Hozza <thozza@redhat.com>
Branching of f39 is next week, so we need to resign most of everything
with the f40 key so rawhide can be signed after branching.
we will need to make another pass after this one is done.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
We are hitting a NFS caching issue with openqa (at least, possibly
others) where a fetch of repomd.xml will hit one of the kojipkgs servers
and then fetching the rest of the repodata will hit the other that still
has the previous koji buildroot repodata, resulting in 404's.
So, setting this should make nfs only cache postive lookups (ie, file
exists in dir), not negative ones (file does not exist). It will recheck
before returing a 404, which should prevent this issue.
Hopefully this theory is correct. We will see. :)
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
Add the nagios_client role to the buildvm-osbuild.yml playbook to allow
monitoring of osbuild workers. E.g. when they are down or have a full
disk.
Signed-off-by: Tomáš Hozza <thozza@redhat.com>
The buildvm-osbuild.yml playbook fails when running the base role,
specifically when configuring chronyd and restarting it. The reason is
that the role is notifying a handler, which is not defined in the role,
but it is defined in the main handlers file restart_services.yml.
Import handlers from restart_services.yml in the buildvm-osbuild.yml
playbook to ensure that all common handlers are available.
Signed-off-by: Tomáš Hozza <thozza@redhat.com>
Move kojipkgs to nfsv4 from v3. This might help us with some caching
issues. Or it might not! we will see.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
It is extremely slow to run, and we figured out that the problem
on openqa01 was excessive space being used by Netapp snapshots,
so we don't need this any more. It was actually deleting old
jobs before their time, because it had already wiped every
video file and didn't know what else to do...
Signed-off-by: Adam Williamson <awilliam@redhat.com>
This reverts commit cef30714a2.
Turns out the problem was just that asset cleanup wasn't running
because the testresults/images minimization job was blocking it.
prod is running out of disk space. Not sure why this has only
just started to happen, but...the numbers do seem to more or
less add up...
Signed-off-by: Adam Williamson <awilliam@redhat.com>
mktemp needs X's in the name passed to it to apply it's random template
to. Without that it just fails with:
mktemp: too few X's in template ‘/tmp/sig_policy’
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
fas was redirecting to the old https://admin.fedoraproject.org/accounts
and that in turn was still trying to proxy to the old fas2 app on the
ocp3 cluster. That app is retired and that cluster is long gone too, so
we should just redirect it to the current account system.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
These instances served long and well as fallback resolvers for
dnssec-trigger. This is no longer needed or used, so lets remove them.
See https://pagure.io/fedora-infrastructure/issue/11415
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
