opendev/system-config
Code Issues Proposed changes
b01291b832
system-config/playbooks/zuul/run-base.yaml

148 lines
5.7 KiB
YAML
Raw Normal View History

Rename bridge.yaml to install-ansible.yaml We have a bridge.yaml and a service-bridge.yaml and it keeps being confusing. Rename bridge.yaml to install-ansible.yaml to make it clear what it is that it actually does. Add a soft-depend on it for manage-projects, because if something updates with the ansible config, we want it to happen before running manage-projects. Change-Id: Ia7c8dd0e32b2c4aaa674061037be5ab66d9a3581
2020-04-01 14:12:57 -05:00
- import_playbook: ../install-ansible.yaml
Add system-config-run-base job This adds a job which creates a bridge-like node and bootstraps it, and then runs the base playbook against all of the node types we use in our control plane. It uses testinfra to validate the results. Change-Id: Ibdbaf511bbdaee46e1335f2c83b95ba1553a1d94 Depends-On: https://review.openstack.org/595905
2018-08-22 09:46:07 -07:00
vars:
run-base : don't strip root ssh private key Builds running on the new container-based executors started failing to connect to remote hosts with Load key "/root/.ssh/id_rsa": invalid format It turns out the new executor is writing keys in OpenSSH format, rather than the older PEM format. And it seems that the OpenSSH format is more picky about having a trailing space after the -----END OPENSSH PRIVATE KEY----- bit of the id_rsa file. By default, the file lookup runs an rstrip on the incoming file to remove the trailing space. Turn that off so we generate a valid key. Change-Id: I49bb255f359bd595e1b88eda890d04cb18205b6e
2020-07-14 13:13:13 +10:00
root_rsa_key: "{{ lookup('file', zuul.executor.work_root + '/' + zuul.build + '_id_rsa', rstrip=False) }}"
Disable cloud launcher cron job during CI This takes a similar approach to the extant ansible_cron_install_cron variable to disable the cron job for the cloud launcher when running under CI. If you happen to have your CI jobs when the cron job decides to fire, you end up with a harmless but confusing failed run of the cloud launcher (that has tried to contact real clouds) in the ARA results. Use the "disbaled" flag to ensure the cron job doesn't run. Using "disabled" means we can still check that the job was installed via testinfra however. Convert ansible_cron_install_cron to a similar method using disable, document the variable in the README and add a test for the run_all.sh script in crontab too. Change-Id: If4911a5fa4116130c39b5a9717d610867ada7eb1
2019-07-16 14:56:04 +10:00
ansible_cron_disable_job: true
cloud_launcher_disable_job: true
Add system-config-run-base job This adds a job which creates a bridge-like node and bootstraps it, and then runs the base playbook against all of the node types we use in our control plane. It uses testinfra to validate the results. Change-Id: Ibdbaf511bbdaee46e1335f2c83b95ba1553a1d94 Depends-On: https://review.openstack.org/595905
2018-08-22 09:46:07 -07:00
- hosts: bridge.openstack.org
become: true
tasks:
- name: Write inventory on bridge
include_role:
name: write-inventory
vars:
Split inventory into multiple dirs and move hostvars Make inventory/service for service-specific things, including the groups.yaml group definitions, and inventory/base for hostvars related to the base system, including the list of hosts. Move the exisitng host_vars into inventory/service, since most of them are likely service-specific. Move group_vars/all.yaml into base/group_vars as almost all of it is related to base things, with the execption of the gerrit public key. A followup patch will move host-specific values into equivilent files in inventory/base. This should let us override hostvars in gate jobs. It should also allow us to do better file matchers - and to be able to organize our playbooks move if we want to. Depends-On: https://review.opendev.org/731583 Change-Id: Iddf57b5be47c2e9de16b83a1bc83bee25db995cf
2020-05-26 15:46:41 -05:00
write_inventory_dest: /home/zuul/src/opendev.org/opendev/system-config/inventory/base/gate-hosts.yaml
Add system-config-run-base job This adds a job which creates a bridge-like node and bootstraps it, and then runs the base playbook against all of the node types we use in our control plane. It uses testinfra to validate the results. Change-Id: Ibdbaf511bbdaee46e1335f2c83b95ba1553a1d94 Depends-On: https://review.openstack.org/595905
2018-08-22 09:46:07 -07:00
write_inventory_exclude_hostvars:
- ansible_user
Exclude ansible_python_interpreter from write-inventory Zuul now includes an ansible_python_interpreter hostvar in every host in its inventory. It defaults to python2. The write-inventory role, which takes the Zuul inventory and makes an inventory for the fake bridge server in the gate passes that through. Because it's in /etc/ansible/inventory.yaml, it overrides any settings which may arrive via group vars, but this is the way we set the interpreter for all the hosts on bridge (we do not do so in the actual inventory file). To correct this, tell write-inventory to strip the ansible_python_interpreter variable when it writes out the new inventory. This restores the behavior to match what happens on the real bridge host. One instance of setting the interpreter for the fake "trusty" host used in base platform tests is moved to a hostvars file to match the rest of the real hosts. Change-Id: I60f0acb64e7b90ed8af266f21f2114fd598f4a3c
2019-07-10 10:05:18 -07:00
- ansible_python_interpreter
Add iptables_extra_allowed_groups This adds a new variable for the iptables role that allows us to indicate all members of an ansible inventory group should have iptables rules added. It also removes the unused zuul-executor-opendev group, and some unused variables related to the snmp rule. Also, collect the generated iptables rules for debugging. Change-Id: I48746a6527848a45a4debf62fd833527cc392398 Depends-On: https://review.opendev.org/728952
2020-05-08 14:15:01 -07:00
write_inventory_additional_hostvars:
Stop using backend hostname in zuul testinfra tests Tests that call host.backend.get_hostname() to switch on test assertions are likely to fail open. Stop using this in zuul tests and instead add new files for each of the types of zuul hosts where we want to do additional verification. Share the iptables related code between all the tests that perform iptables checks. Also, some extra merger test and some negative assertions are added. Move multi-node-hosts-file to after set-hostname. multi-node-hosts-file is designed to append, and set-hostname is designed to write. When we write the gate version of the inventory, map the nodepool private_ipv4 address as the public_v4 address of the inventory host since that's what is written to /etc/hosts, and is therefore, in the context of a gate job, the "public" address. Change-Id: Id2dad08176865169272a8c135d232c2b58a7a2c1
2020-06-03 14:20:36 -07:00
public_v4: nodepool.private_ipv4
Add iptables_extra_allowed_groups This adds a new variable for the iptables role that allows us to indicate all members of an ansible inventory group should have iptables rules added. It also removes the unused zuul-executor-opendev group, and some unused variables related to the snmp rule. Also, collect the generated iptables rules for debugging. Change-Id: I48746a6527848a45a4debf62fd833527cc392398 Depends-On: https://review.opendev.org/728952
2020-05-08 14:15:01 -07:00
public_v6: nodepool.public_ipv6
Add yamlgroup inventory plugin The constructed inventory plugin allows expressing additional groups, but it's too heavy weight for our needs. Additionally, it is a full inventory plugin that will add hosts to the inventory if they don't exist. What we want instead is something that will associate existing hosts (that would have come from another source) with groups. This also switches to using emergency.yaml instead of emergency, which uses the same format. We add an extra groups file for gate testing to ensure the CI nodes get puppet installed. Change-Id: Iea8b2eb2e9c723aca06f75d3d3307893e320cced
2018-09-12 11:32:42 -06:00
- name: Add groups config for test nodes
template:
src: "templates/gate-groups.yaml.j2"
dest: "/etc/ansible/hosts/gate-groups.yaml"
Add system-config-run-eavesdrop Add a job which runs testinfra for the eavesdrop server. When we have a per-hostgroup playbook, we will add it to this job too. The puppet group is removed from the run-base job because the groups.yaml file is now used to construct groups (as it does in production) and will construct the group correctly. The testinfra iptables module may throw an error if it's run multiple times simultaneously on the same host. To avoid this, stop using parallel execution. Change-Id: I1a7bab5c14b0da22393ab568000d0921c28675aa
2018-08-29 11:04:07 -07:00
- name: Update ansible.cfg to use job inventory
ini_file:
path: /etc/ansible/ansible.cfg
section: defaults
option: inventory
Split inventory into multiple dirs and move hostvars Make inventory/service for service-specific things, including the groups.yaml group definitions, and inventory/base for hostvars related to the base system, including the list of hosts. Move the exisitng host_vars into inventory/service, since most of them are likely service-specific. Move group_vars/all.yaml into base/group_vars as almost all of it is related to base things, with the execption of the gerrit public key. A followup patch will move host-specific values into equivilent files in inventory/base. This should let us override hostvars in gate jobs. It should also allow us to do better file matchers - and to be able to organize our playbooks move if we want to. Depends-On: https://review.opendev.org/731583 Change-Id: Iddf57b5be47c2e9de16b83a1bc83bee25db995cf
2020-05-26 15:46:41 -05:00
value: /home/zuul/src/opendev.org/opendev/system-config/inventory/base/gate-hosts.yaml,/home/zuul/src/opendev.org/opendev/system-config/inventory/service/groups.yaml,/etc/ansible/hosts/gate-groups.yaml
Add system-config-run-base job This adds a job which creates a bridge-like node and bootstraps it, and then runs the base playbook against all of the node types we use in our control plane. It uses testinfra to validate the results. Change-Id: Ibdbaf511bbdaee46e1335f2c83b95ba1553a1d94 Depends-On: https://review.openstack.org/595905
2018-08-22 09:46:07 -07:00
- name: Make host_vars directory
file:
path: "/etc/ansible/hosts/host_vars"
state: directory
- name: Make group_vars directory
file:
path: "/etc/ansible/hosts/group_vars"
state: directory
- name: Write hostvars files
vars:
bastion_ipv4: "{{ nodepool['public_ipv4'] }}"
bastion_ipv6: "{{ nodepool['public_ipv6'] }}"
bastion_public_key: "{{ lookup('file', zuul.executor.work_root + '/' + zuul.build + '_id_rsa.pub') }}"
run-selenium: run selenium on a node This runs selenium from a container on a node, and exposes port 4444 so you can issue commands to it. This is used in the follow-on I56cda99790d3c172e10b664e57abeca10efc5566 to take some screenshots of gerrit. Change-Id: Idcbcd9a8f33bd86b5f3e546dd563792212e0751b
2020-12-15 15:22:26 +11:00
iptables_test_public_tcp_ports:
# Zuul web console
- 19885
# selenium
- 4444
Add system-config-run-base job This adds a job which creates a bridge-like node and bootstraps it, and then runs the base playbook against all of the node types we use in our control plane. It uses testinfra to validate the results. Change-Id: Ibdbaf511bbdaee46e1335f2c83b95ba1553a1d94 Depends-On: https://review.openstack.org/595905
2018-08-22 09:46:07 -07:00
template:
src: "templates/{{ item }}.j2"
dest: "/etc/ansible/hosts/{{ item }}"
loop:
- group_vars/all.yaml
Configure adns1.opendev.org server via ansible Change-Id: Ib4d3cd7501a276bff62e3bc0998d93c41f3ab185
2018-10-31 16:13:33 -07:00
- group_vars/adns.yaml
Split eavesdrop into its own playbook Extract eavedrop into its own service playbook and puppet manifest. While doing that, stop using jenkinsuser on eavesdrop in favor of zuul-user. Add the ability to override the keys for the zuul user. Remove openstack_project::server, it doesn't do anything. Containerize and anisblize accessbot. The structure of how we're doing it in puppet makes it hard to actually run the puppet in the gate. Run the script in its own playbook so that we can avoid running it in the gate. Change-Id: I53cb63ffa4ae50575d4fa37b24323ad13ec1bac3
2020-04-19 12:34:06 -05:00
- group_vars/eavesdrop.yaml
Manage clouds.yaml files in ansible This manages the clouds.yaml files in ansible so that we can get them updated automatically on bridge.openstack.org (which does not puppet). Co-Authored-By: James E. Blair <jeblair@redhat.com> Depends-On: https://review.openstack.org/598378 Change-Id: I2071f2593f57024bc985e18eaf1ffbf6f3d38140
2018-08-30 12:17:31 -07:00
- group_vars/nodepool.yaml
Configure opendev nameservers using ansible Change-Id: Ie6430053159bf5a09b2c002ad6a4f84334a5bca3
2018-11-01 13:24:41 -07:00
- group_vars/ns.yaml
Run a docker registry for CI Change-Id: If9669bb3286e25bb16ab09373e823b914b645f26
2019-01-31 09:59:26 -08:00
- group_vars/registry.yaml
Deploy gitea with docker-compose This deploys a shared-nothing gitea server using docker-compose. It includes a mariadb server. Change-Id: I58aff016c7108c69dfc5f2ebd46667c4117ba5da
2019-02-15 15:18:15 -08:00
- group_vars/gitea.yaml
Run an haproxy load balancer for gitea This runs an haproxy which is strikingly similar to the one we currently run for git.openstack.org, but it is run in a docker container. Change-Id: I647ae8c02eb2cd4f3db2b203d61a181f7eb632d2
2019-02-19 14:41:54 -08:00
- group_vars/gitea-lb.yaml
kerberos-kdc: role to manage Kerberos KDC servers This adds a role and related testing to manage our Kerberos KDC servers, intended to replace the puppet modules currently performing this task. This role automates realm creation, initial setup, key material distribution and replica host configuration. None of this is intended to run on the production servers which are already setup with an active database, and the role should be effectively idempotent in production. Note that this does not yet switch the production servers into the new groups; this can be done in a separate step under controlled conditions and with related upgrades of the host OS to Focal. Change-Id: I60b40897486b29beafc76025790c501b5055313d
2021-03-05 16:10:01 +11:00
- group_vars/kerberos-kdc.yaml
letsencrypt support This change contains the roles and testing for deploying certificates on hosts using letsencrypt with domain authentication. From a top level, the process is implemented in the roles as follows: 1) letsencrypt-acme-sh-install This role installs the acme.sh tool on hosts in the letsencrypt group, along with a small custom driver script to help parse output that is used by later roles. 2) letsencrypt-request-certs This role runs on each host, and reads a host variable describing the certificates required. It uses the acme.sh tool (via the driver) to request the certificates from letsencrypt. It populates a global Ansible variable with the authentication TXT records required. If the certificate exists on the host and is not within the renewal period, it should do nothing. 3) letsencrypt-install-txt-record This role runs on the adns server. It installs the TXT records generated in step 2 to the acme.opendev.org domain and then refreshes the server. Hosts wanting certificates will have pre-provisioned CNAME records for _acme-challenge.host.opendev.org pointing to acme.opendev.org. 4) letsencrypt-create-certs This role runs on each host, reading the same variable as in step 2. However this time the acme.sh tool is run to authenticate and create the certificates, which should now work correctly via the TXT records from step 3. After this, the host will have the full certificate material. Testing is added via testinfra. For testing purposes requests are made to the staging letsencrypt servers and a self-signed certificate is provisioned in step 4 (as the authentication is not available during CI). We test that the DNS TXT records are created locally on the CI adns server, however. Related-Spec: https://review.openstack.org/587283 Change-Id: I1f66da614751a29cc565b37cdc9ff34d70fdfd3f
2019-02-14 08:10:51 +11:00
- group_vars/letsencrypt.yaml
Use real passwords for meetpad The docker containers expect this now and refuse to start with fake passwords. Change-Id: I4c4bd243c9684e3987eeb99e4c66d31a882336a0
2020-04-20 09:05:51 -07:00
- group_vars/meetpad.yaml
Add support for multiple jvbs behind meetpad The jitsi video bridge (jvb) appears to be the main component we'll need to scale up to handle more users on meetpad. Start preliminary ansiblification of scale out jvb hosts. Note this requires each new jvb to run on a separate host as the jvb docker images seem to rely on $HOSTNAME to uniquely identify each jvb. Change-Id: If6d055b6ec163d4a9d912bee9a9912f5a7b58125
2020-05-18 12:28:51 -07:00
- group_vars/jvb.yaml
Run nodepool launchers with ansible and containers We don't run start in prod normally but we do need to run it in the gate. Change-Id: Iec50684280409eb978bf5638bf74ae16fad8aa26
2020-04-16 10:18:51 -05:00
- group_vars/nodepool-launcher.yaml
Rename refstack group variables When we cleaned up the puppet in I6b6dfd0f8ef89a5362f64cfbc8016ba5b1a346b3 we renamed the group s/refstack-docker/refstack/ but didn't move the variables and some other references too. Change-Id: Ib07d1e9ede628c43b4d5d94b64ec35c101e11be8
2021-03-19 14:55:02 +11:00
- group_vars/refstack.yaml
Use swift to back intermediate docker registry Note, this does not have complete tests yet (we will need to update the job to start a swift for that). Change-Id: I2ee7a9e4fb503a3431366c16c380cf09327f6050
2019-04-17 14:39:32 -07:00
- group_vars/registry.yaml
Run a gerrit container on review-dev01 This runs gerrit in a container on review-dev01 using podman. Remove an unused web_server.py file that we found from copying it from puppet to ansible. Change-Id: I399d3cf8471bc8063022b0db0ff81718b2ee2941
2019-01-31 09:26:38 -08:00
- group_vars/review.yaml
Add control plane clouds to nodepool builder clouds.yaml In order to have nodepool build images and upload them to control plane clouds, add them to the clouds.yaml on the nodepool-builder hosts. Keep them out of the launcher configs by splitting the config templates. So that we can keep our copies of things to a minimum, create a group called "control-plane-clouds" and put bridge and nb0* in it. There are clouds mentions in here that we no longer use, a followup patch will clean those up. NOTE: Requires shifting the clouds config dict from host_vars/bridge.openstack.org.yaml to group_vars/control-plane-clouds.yaml in the secrets on bridge. Needed-By: https://review.opendev.org/640044 Change-Id: Id1161bca8f23129202599dba299c288a6aa29212
2019-02-28 12:10:49 +00:00
- group_vars/control-plane-clouds.yaml
afs-client: move reduced cache to group variable For gate testing we need the smaller AFS cache size applied to everything that might install openafs, not just the mirror nodes. Move the definition to the afs-client group. Change-Id: Id27efd2f12f5ac3f351f65fa1ae513624a53df90
2019-12-10 13:11:14 +11:00
- group_vars/afs-client.yaml
Run Zuul using Ansible and Containers Zuul is publishing lovely container images, so we should go ahead and start using them. We can't use containers for zuul-executor because of the docker->bubblewrap->AFS issue, so install from pip there. Don't start any of the containers by default, which should let us safely roll this out and then do a rolling restart. For things (like web or mergers) where it's safe to do so, a followup change will swap the flag. Change-Id: I37dcce3a67477ad3b2c36f2fd3657af18bc25c40
2020-04-05 09:25:28 -05:00
- group_vars/zuul.yaml
Add nodepool node key Change-Id: I28ccb83fc984190b1ce8e3e18c5945209fcb2387
2020-04-24 17:40:32 -05:00
- group_vars/zuul-executor.yaml
Run Zuul using Ansible and Containers Zuul is publishing lovely container images, so we should go ahead and start using them. We can't use containers for zuul-executor because of the docker->bubblewrap->AFS issue, so install from pip there. Don't start any of the containers by default, which should let us safely roll this out and then do a rolling restart. For things (like web or mergers) where it's safe to do so, a followup change will swap the flag. Change-Id: I37dcce3a67477ad3b2c36f2fd3657af18bc25c40
2020-04-05 09:25:28 -05:00
- group_vars/zuul-merger.yaml
- group_vars/zuul-scheduler.yaml
- group_vars/zuul-web.yaml
Manage clouds.yaml files in ansible This manages the clouds.yaml files in ansible so that we can get them updated automatically on bridge.openstack.org (which does not puppet). Co-Authored-By: James E. Blair <jeblair@redhat.com> Depends-On: https://review.openstack.org/598378 Change-Id: I2071f2593f57024bc985e18eaf1ffbf6f3d38140
2018-08-30 12:17:31 -07:00
- host_vars/bridge.openstack.org.yaml
Migrate codesearch site to container The hound project has undergone a small re-birth and moved to https://github.com/hound-search/hound which has broken our deployment. We've talked about leaving codesearch up to gitea, but it's not quite there yet. There seems to be no point working on the puppet now. This builds a container than runs houndd. It's an opendev specific container; the config is pulled from project-config directly. There's some custom scripts that drive things. Some points for reviewers: - update-hound-config.sh uses "create-hound-config" (which is in jeepyb for historical reasons) to generate the config file. It grabs the latest projects.yaml from project-config and exits with a return code to indicate if things changed. - when the container starts, it runs update-hound-config.sh to populate the initial config. There is a testing environment flag and small config so it doesn't have to clone the entire opendev for functional testing. - it runs under supervisord so we can restart the daemon when projects are updated. Unlike earlier versions that didn't start listening till indexing was done, this version now puts up a "Hound is not ready yet" message when while it is working; so we can drop all the magic we were doing to probe if hound is listening via netstat and making Apache redirect to a status page. - resync-hound.sh is run from an external cron job daily, and does this update and restart check. Since it only reloads if changes are made, this should be relatively rare anyway. - There is a PR to monitor the config file (https://github.com/hound-search/hound/pull/357) which would mean the restart is unnecessary. This would be good in the near and we could remove the cron job. - playbooks/roles/codesearch is unexciting and deploys the container, certificates and an apache proxy back to localhost:6080 where hound is listening. I've combined removal of the old puppet bits here as the "-codesearch" namespace was already being used. Change-Id: I8c773b5ea6b87e8f7dfd8db2556626f7b2500473
2020-11-17 17:13:46 +11:00
- host_vars/codesearch01.opendev.org.yaml
Make a new dockerized etherpad.opendev.org Upstream likes building the settings file into the image, but that's less exciting, let's bind-mount ours in. Depends-On: https://review.opendev.org/717491/ Change-Id: Ia1894d884ef2a84e1282345b77fe07bf8898f367
2020-03-31 16:33:26 -05:00
- host_vars/etherpad01.opendev.org.yaml
letsencrypt support This change contains the roles and testing for deploying certificates on hosts using letsencrypt with domain authentication. From a top level, the process is implemented in the roles as follows: 1) letsencrypt-acme-sh-install This role installs the acme.sh tool on hosts in the letsencrypt group, along with a small custom driver script to help parse output that is used by later roles. 2) letsencrypt-request-certs This role runs on each host, and reads a host variable describing the certificates required. It uses the acme.sh tool (via the driver) to request the certificates from letsencrypt. It populates a global Ansible variable with the authentication TXT records required. If the certificate exists on the host and is not within the renewal period, it should do nothing. 3) letsencrypt-install-txt-record This role runs on the adns server. It installs the TXT records generated in step 2 to the acme.opendev.org domain and then refreshes the server. Hosts wanting certificates will have pre-provisioned CNAME records for _acme-challenge.host.opendev.org pointing to acme.opendev.org. 4) letsencrypt-create-certs This role runs on each host, reading the same variable as in step 2. However this time the acme.sh tool is run to authenticate and create the certificates, which should now work correctly via the TXT records from step 3. After this, the host will have the full certificate material. Testing is added via testinfra. For testing purposes requests are made to the staging letsencrypt servers and a self-signed certificate is provisioned in step 4 (as the authentication is not available during CI). We test that the DNS TXT records are created locally on the CI adns server, however. Related-Spec: https://review.openstack.org/587283 Change-Id: I1f66da614751a29cc565b37cdc9ff34d70fdfd3f
2019-02-14 08:10:51 +11:00
- host_vars/letsencrypt01.opendev.org.yaml
- host_vars/letsencrypt02.opendev.org.yaml
Set up robots.txt on lists servers This sets up a robots.txt on our lists servers. To start this file prevents SEMrush bot from indexing our lists as that has been causing lists.openstack.org to OOM with many listinfo processes started by Apache. We've avoided this OOM by manually configuring this robots.txt. Other things we have ruled out are bup and input email causes qrunner's to grow unexpectedly large. Fairly confident this bot is the trigger. Note this fixes testing by adding 'hieradata' to set listpassword var. Depends-On: https://review.opendev.org/724389 Change-Id: Id4f6739a8cf6a01f9796fa54c86ba1af3e31fecf
2020-04-29 08:24:50 -07:00
- host_vars/lists.openstack.org.yaml
Manage opendev.org cert with LE This is the first step in managing the opendev.org cert with LE. We modify gitea01.opendev.org only to request the cert so that if this breaks the other 7 giteas can continue to serve opendev.org. When we are happy with the results we can merge the followup change to update the other 7 giteas. Depends-On: https://review.opendev.org/694182 Change-Id: I9587b8c2896975aa0148cc3d9b37f325a0be8970
2019-11-13 16:33:35 -08:00
- host_vars/gitea99.opendev.org.yaml
Grafana container deployment This uses the Grafana container created with Iddfafe852166fe95b3e433420e2e2a4a6380fc64 to run the grafana.opendev.org service. We retain the old model of an Apache reverse-proxy; it's well tested and understood, it's much easier than trying to map all the SSL termination/renewal/etc. into the Grafana container and we don't have to convince ourselves the container is safe to be directly web-facing. Otherwise this is a fairly straight forward deployment of the container. As before, it uses the graph configuration kept in project-config which is loaded in with grafyaml, which is included in the container. Once nice advantage is that it makes it quite easy to develop graphs locally, using the container which can talk to the public graphite instance. The documentation has been updated with a reference on how to do this. Change-Id: I0cc76d29b6911aecfebc71e5fdfe7cf4fcd071a4
2020-06-23 11:41:27 +10:00
- host_vars/grafana01.opendev.org.yaml
Separate openafs CI mirror This is an intermediate step to having both kafs and openafs testing in the gate; this just makes it clear which host is which. Change-Id: I8cd006227ed47ad5f2c5eec664083477dd7ba397
2019-06-17 11:15:38 +10:00
- host_vars/mirror01.openafs.provider.opendev.org.yaml
Add focal testing for mirror nodes Change-Id: I64de9a61c5044b93f6ce7e2d31cf51d78fd4ec16
2020-05-12 08:53:25 +10:00
- host_vars/mirror02.openafs.provider.opendev.org.yaml
Move rsync mirror updates to new opendev.org mirror-update host This move was prompted by wishing to expose the mirror update logs for the rsync updates so that debugging problems does not require a root user (note: not actually done in this change; will be a follow-on). Rather than start hacking at puppet, the rsync mirror scripts make a nice delination point for starting an Ansible-first/Bionic update. Most magic is included in the scripts, so there is not much more to do than copy them. The host uses the existing kerberos and openafs roles and copies the key material into place (to be added before merge). Note the scripts are removed from the extant puppet so we don't have two updates happening simultaneously. This will also require a manual clean to remove the cron jobs as a once-off when merging. The other part of mirror-update is the reprepro based scripts for the various debuntu repositories. They are left as future work for now. Testing is added to ensure dependencies and scripts are all in place. Change-Id: I525ac18b55f0e11b0a541b51fa97ee5d6512bf70
2019-06-27 14:20:02 +10:00
- host_vars/mirror-update01.opendev.org.yaml
Deploy refstack with ansible docker This adds a dockerfile to build an opendevorg/refstack image as well as the jobs to build and publish it. Change-Id: Icade6c713fa9bf6ab508fd4d8d65debada2ddb30
2020-01-31 09:27:34 -08:00
- host_vars/refstack01.openstack.org.yaml
Add system-config-run-eavesdrop Add a job which runs testinfra for the eavesdrop server. When we have a per-hostgroup playbook, we will add it to this job too. The puppet group is removed from the run-base job because the groups.yaml file is now used to construct groups (as it does in production) and will construct the group correctly. The testinfra iptables module may throw an error if it's run multiple times simultaneously on the same host. To avoid this, stop using parallel execution. Change-Id: I1a7bab5c14b0da22393ab568000d0921c28675aa
2018-08-29 11:04:07 -07:00
- name: Display group membership
command: ansible localhost -m debug -a 'var=groups'
Add system-config-run-base job This adds a job which creates a bridge-like node and bootstraps it, and then runs the base playbook against all of the node types we use in our control plane. It uses testinfra to validate the results. Change-Id: Ibdbaf511bbdaee46e1335f2c83b95ba1553a1d94 Depends-On: https://review.openstack.org/595905
2018-08-22 09:46:07 -07:00
- name: Run base.yaml
Run test playbooks with more forks As we add jobs that have more nodes in them, we need to make sure we're running ansible with enough forks that the jobs don't take forever. Change-Id: I2b5bf55bd65eaf0fc2671f5379bd0cb5c3696f87
2020-04-29 08:02:11 -05:00
command: ansible-playbook -f 50 -v /home/zuul/src/opendev.org/opendev/system-config/playbooks/base.yaml
Split the base playbook into services This is a first step toward making smaller playbooks which can be run by Zuul in CD. Zuul should be able to handle missing projects now, so remove it from the puppet_git playbook and into puppet. Make the base playbook be merely the base roles. Make service playbooks for each service. Remove the run-docker job because it's covered by service jobs. Stop testing that puppet is installed in testinfra. It's accidentally working due to the selection of non-puppeted hosts only being on bionic nodes and not installing puppet on bionic. Instead, we can now rely on actually *running* puppet when it's important, such as in the eavesdrop job. Also remove the installation of puppet on the nodes in the base job, since it's only useful to test that a synthetic test of installing puppet on nodes we don't use works. Don't run remote_puppet_git on gitea for now - it's too slow. A followup patch will rework gitea project creation to not take hours. Change-Id: Ibb78341c2c6be28005cea73542e829d8f7cfab08
2019-05-02 15:07:32 -06:00
- name: Run bridge service playbook
command: ansible-playbook -v /home/zuul/src/opendev.org/opendev/system-config/playbooks/service-bridge.yaml
Use dstat to record performance of system-config-run hosts We have seen some poor performance from gitea which may be related to manage project updates. Start a dstat service which logs to a csv file on our system-config-run job hosts in order to collect performance info from our services in pre merge testing. This will include gitea and should help us evaluate service upgrades and other changes from a performance perspective before they hit production. Change-Id: I7bdaab0a0aeb9e1c00fcfcca3d114ae13a76ccc9
2021-02-10 16:32:51 -08:00
- name: Run dstat logger playbook
command: ansible-playbook -v /home/zuul/src/opendev.org/opendev/system-config/playbooks/service-dstatlogger.yaml
Split the base playbook into services This is a first step toward making smaller playbooks which can be run by Zuul in CD. Zuul should be able to handle missing projects now, so remove it from the puppet_git playbook and into puppet. Make the base playbook be merely the base roles. Make service playbooks for each service. Remove the run-docker job because it's covered by service jobs. Stop testing that puppet is installed in testinfra. It's accidentally working due to the selection of non-puppeted hosts only being on bionic nodes and not installing puppet on bionic. Instead, we can now rely on actually *running* puppet when it's important, such as in the eavesdrop job. Also remove the installation of puppet on the nodes in the base job, since it's only useful to test that a synthetic test of installing puppet on nodes we don't use works. Don't run remote_puppet_git on gitea for now - it's too slow. A followup patch will rework gitea project creation to not take hours. Change-Id: Ibb78341c2c6be28005cea73542e829d8f7cfab08
2019-05-02 15:07:32 -06:00
- name: Run playbook
when: run_playbooks is defined
loop: "{{ run_playbooks }}"
Run test playbooks with more forks As we add jobs that have more nodes in them, we need to make sure we're running ansible with enough forks that the jobs don't take forever. Change-Id: I2b5bf55bd65eaf0fc2671f5379bd0cb5c3696f87
2020-04-29 08:02:11 -05:00
command: "ansible-playbook -f 50 -v /home/zuul/src/opendev.org/opendev/system-config/{{ item }}"
Test gitea project creation playbook Add an option to run a playbook (in the fake bridge context) after running the base playbook. Use this to run a new playbook which exercises gitea project creation after bootstrapping the gitea service. Disable ansible-lint 304 because it erroneously thinks shell and command are the same thing. Change-Id: I0394b614771bc62b9fe23d811defd7767b3d10db
2019-03-05 15:24:24 -08:00
- name: Run test playbook
Split the base playbook into services This is a first step toward making smaller playbooks which can be run by Zuul in CD. Zuul should be able to handle missing projects now, so remove it from the puppet_git playbook and into puppet. Make the base playbook be merely the base roles. Make service playbooks for each service. Remove the run-docker job because it's covered by service jobs. Stop testing that puppet is installed in testinfra. It's accidentally working due to the selection of non-puppeted hosts only being on bionic nodes and not installing puppet on bionic. Instead, we can now rely on actually *running* puppet when it's important, such as in the eavesdrop job. Also remove the installation of puppet on the nodes in the base job, since it's only useful to test that a synthetic test of installing puppet on nodes we don't use works. Don't run remote_puppet_git on gitea for now - it's too slow. A followup patch will rework gitea project creation to not take hours. Change-Id: Ibb78341c2c6be28005cea73542e829d8f7cfab08
2019-05-02 15:07:32 -06:00
when: run_test_playbook is defined
shell: "ANSIBLE_ROLES_PATH=/home/zuul/src/opendev.org/opendev/system-config/playbooks/roles ansible-playbook -v /home/zuul/src/opendev.org/opendev/system-config/{{ run_test_playbook }}"
testinfra: pass inventory and zuul data Create a zuul_data fixture for testinfra. The fixture directly loads the inventory from the inventory YAML file written out. This lets you get easy access to the IP addresses of the hosts. We pass in the "zuul" variable by writing it out to a YAML file on disk, and then passing an environment variable to this. This is useful for things like determining which job is running. Additional arbitrary data could be added to this if required. Change-Id: I8adb7601f7eec6d48509f8f1a42840beca70120c
2020-05-20 09:06:40 +10:00
- name: Generate testinfra extra data fixture
set_fact:
testinfra_extra_data:
zuul_job: '{{ zuul.job }}'
zuul: '{{ zuul }}'
- name: Write out testinfra extra data fixture
copy:
Stop running ansible-lint on this repo It is buggy (throwing exceptions for undefinied variables which are actualyl defined via set_fact), and we frequently run into problems using it in this repo. It was designed to lint roles for Galaxy, not the way we write ansible. As of the 5.0.0 release it's generating >4.5K lines of complaints about files in this repository. Change-Id: If9d8c19b5e663bdd6b6f35ffed88db3cff3d79f8
2020-06-03 13:58:18 -07:00
content: '{{ testinfra_extra_data | to_nice_yaml(indent=2) }}'
testinfra: pass inventory and zuul data Create a zuul_data fixture for testinfra. The fixture directly loads the inventory from the inventory YAML file written out. This lets you get easy access to the IP addresses of the hosts. We pass in the "zuul" variable by writing it out to a YAML file on disk, and then passing an environment variable to this. This is useful for things like determining which job is running. Additional arbitrary data could be added to this if required. Change-Id: I8adb7601f7eec6d48509f8f1a42840beca70120c
2020-05-20 09:06:40 +10:00
dest: '/home/zuul/testinfra_extra_data_fixture.yaml'
run-selenium: run selenium on a node This runs selenium from a container on a node, and exposes port 4444 so you can issue commands to it. This is used in the follow-on I56cda99790d3c172e10b664e57abeca10efc5566 to take some screenshots of gerrit. Change-Id: Idcbcd9a8f33bd86b5f3e546dd563792212e0751b
2020-12-15 15:22:26 +11:00
- name: Make screenshots directory
file:
path: '/var/log/screenshots'
state: directory
- name: Return screenshots artifact
zuul_return:
data:
zuul:
artifacts:
- name: Screenshots
url: "bridge.openstack.org/screenshots"
Fix junit error, add HTML report Specifying the family stops a deprecation warning being output. Add a HTML report and report it as an artifact as well; this is easier to read. Change-Id: I2bd6505c19cee2d51e9af27e9344cfe2e1110572
2020-07-13 14:27:58 +10:00
- name: Run and collect testinfra
block:
- name: Run testinfra to validate configuration
include_role:
name: tox
vars:
tox_envlist: testinfra
# This allows us to run from external projects (like testinfra
# itself)
tox_environment:
TESTINFRA_EXTRA_DATA: '/home/zuul/testinfra_extra_data_fixture.yaml'
zuul_work_dir: src/opendev.org/opendev/system-config
always:
- name: Return testinfra report artifact
zuul_return:
data:
zuul:
artifacts:
- name: testinfra results
url: "bridge.openstack.org/test-results.html"
Copy Permalink