add explicite sec=sys to nfsvers=4 mounts so writes work consistently.

inventory/group_vars/autosign

@@ -21,7 +21,7 @@ host_group: autosign
 fedmsg_error_recipients:
 - puiterwijk@fedoraproject.org
 
-nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,nfsvers=4"
+nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=4"
 
 # For the MOTD
 csi_security_category: High

inventory/group_vars/batcave

@@ -12,7 +12,7 @@ fas_client_groups: sysadmin-ask,sysadmin-build,sysadmin-cvs,sysadmin-main,sysadm
 
 ansible_base: /srv/web/infra
 freezes: false
-nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,nfsvers=4"
+nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=4"
 
 fedmsg_certs:
 - service: shell

inventory/group_vars/bodhi-backend

@@ -42,7 +42,7 @@ fedmsg_error_recipients:
 # happens instead at the inventory/host_vars/ level since bodhi-backend03 and
 # bodhi-backend02 have different roles and responsibilities.
 
-nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,nfsvers=4"
+nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=4"
 
 fas_client_groups: sysadmin-releng,sysadmin-bodhi
 sudoers: "{{ private }}/files/sudo/00releng-sudoers"

inventory/group_vars/buildvm-aarch64-stg

@@ -17,7 +17,7 @@ host_group: kojibuilder
 fas_client_groups: sysadmin-releng
 sudoers: "{{ private }}/files/sudo/00releng-sudoers"
 datacenter: staging
-nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,nfsvers=4"
+nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=4"
 
 koji_hub_nfs: "fedora_koji"
 koji_server_url: "https://koji.stg.fedoraproject.org/kojihub"

inventory/group_vars/buildvm-armv7-stg

@@ -17,7 +17,7 @@ host_group: kojibuilder
 fas_client_groups: sysadmin-releng
 sudoers: "{{ private }}/files/sudo/00releng-sudoers"
 datacenter: staging
-nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,nfsvers=4"
+nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=4"
 
 koji_hub_nfs: "fedora_koji"
 koji_server_url: "https://koji.stg.fedoraproject.org/kojihub"

inventory/group_vars/buildvm-ppc64-stg

@@ -17,7 +17,7 @@ host_group: kojibuilder
 fas_client_groups: sysadmin-releng
 sudoers: "{{ private }}/files/sudo/00releng-sudoers"
 datacenter: staging
-nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,nfsvers=4"
+nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=4"
 
 koji_hub_nfs: "fedora_koji"
 koji_server_url: "https://koji.stg.fedoraproject.org/kojihub"

inventory/group_vars/buildvm-ppc64le-stg

@@ -17,7 +17,7 @@ host_group: kojibuilder
 fas_client_groups: sysadmin-releng
 sudoers: "{{ private }}/files/sudo/00releng-sudoers"
 datacenter: staging
-nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,nfsvers=4"
+nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=4"
 
 koji_hub_nfs: "fedora_koji"
 koji_server_url: "https://koji.stg.fedoraproject.org/kojihub"

inventory/group_vars/buildvm-stg

@@ -17,7 +17,7 @@ host_group: kojibuilder
 fas_client_groups: sysadmin-releng
 sudoers: "{{ private }}/files/sudo/00releng-sudoers"
 datacenter: staging
-nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,nfsvers=4"
+nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=4"
 
 koji_hub_nfs: "fedora_koji"
 koji_server_url: "https://koji.stg.fedoraproject.org/kojihub"

inventory/group_vars/koji

@@ -41,7 +41,7 @@ fedmsg_certs:
   - buildsys.task.state.change
   - buildsys.untag
 
-nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,nfsvers=4"
+nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=4"
 virt_install_command: "{{ virt_install_command_two_nic }}"
 
 osbs_url: "osbs.fedoraproject.org"

inventory/group_vars/releng-compose

@@ -20,7 +20,7 @@ fas_client_groups: sysadmin-releng
 freezes: true
 sudoers: "{{ private }}/files/sudo/00releng-sudoers"
 
-nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,nfsvers=4"
+nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=4"
 
 # For the mock config
 kojipkgs_url: kojipkgs.fedoraproject.org

inventory/group_vars/releng-secondary

@@ -11,7 +11,7 @@ dns: 10.5.126.21
 nrpe_procs_warn: 900
 nrpe_procs_crit: 1000
 
-nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,nfsvers=4"
+nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=4"
 
 fas_client_groups: sysadmin-releng,sysadmin-secondary,sysadmin-noc,sysadmin-veteran
 sudoers: "{{ private }}/files/sudo/00releng-sudoers"

inventory/group_vars/releng-stg

@@ -3,7 +3,7 @@ koji_server_url: "https://koji.stg.fedoraproject.org/kojihub"
 koji_weburl: "https://koji.stg.fedoraproject.org/koji"
 koji_topurl: "https://kojipkgs.fedoraproject.org/"
 
-nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,nfsvers=4"
+nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=4"
 
 mem_size: 8192
 num_cpus: 4

inventory/group_vars/runroot

@@ -3,4 +3,4 @@
 # We need to mount koji storage rw here so run_root can work. 
 # The rest of the group can be ro, it's only builders in the 
 # compose channel that need a rw mount
-nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,nfsvers=4"
+nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=4"

inventory/group_vars/wiki

@@ -31,7 +31,7 @@ fedmsg_certs:
   - wiki.article.edit
   - wiki.upload.complete
 
-nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,nfsvers=4"
+nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=4"
 
 csi_security_category: Moderate
 csi_primary_contact: "#fedora-admin"

inventory/group_vars/wiki-stg

@@ -29,4 +29,4 @@ fedmsg_certs:
   - wiki.article.edit
   - wiki.upload.complete
 
-nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,nfsvers=4"
+nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=4"

inventory/host_vars/data-analysis01.phx2.fedoraproject.org

@@ -5,7 +5,7 @@ freezes: false
 # this box mounts a large share from the netapp to store combined http
 # logs from the proxies.
 
-nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,nfsvers=4"
+nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=4"
 
 # general configs
 nrpe_procs_warn: 900

inventory/host_vars/pkgs02.phx2.fedoraproject.org

@@ -17,7 +17,7 @@ num_cpus: 8
 virt_install_command: "{{ virt_install_command_two_nic }}"
 
 host_backup_targets: ['/srv']
-nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,nfsvers=4"
+nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=4"
 
 ssh_hostnames:
 - pkgs.fedoraproject.org

playbooks/groups/backup-server.yml

@@ -23,7 +23,7 @@
   - collectd/base
   - { role: nfs/client,
       mnt_dir: '/fedora_backups',
-      nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,nfsvers=4",
+      nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=4",
       nfs_src_dir: 'fedora_backups' }
   - openvpn/client
 

playbooks/groups/gnome-backups.yml

@@ -21,7 +21,7 @@
   - gnome_backups
   - { role: nfs/client,
       mnt_dir: '/gnome_backups',
-      nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,nfsvers=4",
+      nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=4",
       nfs_src_dir: 'gnome_backups' }
 
   tasks:

playbooks/groups/logserver.yml

@@ -59,7 +59,7 @@
   - cloudstats
   - role: nfs/client
     mnt_dir: '/mnt/fedora_stats'
-    nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,nfsvers=4"
+    nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=4"
     nfs_src_dir: 'fedora_stats'
 
   handlers:

playbooks/groups/pkgs.yml

@@ -32,11 +32,11 @@
   - { role: nfs/client,
       when: env != "staging",
       mnt_dir: '/srv/cache/lookaside',
-      nfs_src_dir: 'fedora_sourcecache', nfs_mount_opts='rw,hard,bg,intr,noatime,nodev,nosuid,nfsvers=4' }
+      nfs_src_dir: 'fedora_sourcecache', nfs_mount_opts='rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=4' }
   - { role: nfs/client,
       when: env == "staging" and inventory_hostname.startswith('pkgs02'),
       mnt_dir: '/srv/cache/lookaside_prod',
-      nfs_src_dir: 'fedora_sourcecache', nfs_mount_opts='ro,hard,bg,intr,noatime,nodev,nosuid,nfsvers=4' }
+      nfs_src_dir: 'fedora_sourcecache', nfs_mount_opts='ro,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=4' }
   - role: distgit/pagure
   - role: distgit
     tags: distgit

playbooks/groups/secondary.yml

@@ -25,11 +25,11 @@
       nfs_src_dir: 'fedora_ftp/fedora.redhat.com/pub/archive' }
   - { role: nfs/client,
       mnt_dir: '/srv/pub/alt',
-      nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,nfsvers=4",
+      nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=4",
       nfs_src_dir: 'fedora_ftp/fedora.redhat.com/pub/alt' }
   - { role: nfs/client,
       mnt_dir: '/srv/pub/fedora-secondary',
-      nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,nfsvers=4",
+      nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=4",
       nfs_src_dir: 'fedora_ftp/fedora.redhat.com/pub/fedora-secondary' }
 
   - role: apache

playbooks/hosts/data-analysis01.phx2.fedoraproject.org.yml

@@ -51,7 +51,7 @@
   roles:
    - role: nfs/client
      mnt_dir: '/mnt/fedora_stats'
-     nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,nfsvers=4"
+     nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=4"
      nfs_src_dir: 'fedora_stats'
    - geoip