c1aff2ed38
This adds a role and related testing to manage our Kerberos KDC servers, intended to replace the puppet modules currently performing this task. This role automates realm creation, initial setup, key material distribution and replica host configuration. None of this is intended to run on the production servers which are already setup with an active database, and the role should be effectively idempotent in production. Note that this does not yet switch the production servers into the new groups; this can be done in a separate step under controlled conditions and with related upgrades of the host OS to Focal. Change-Id: I60b40897486b29beafc76025790c501b5055313d
371 lines
14 KiB
YAML
371 lines
14 KiB
YAML
- project:
|
|
templates:
|
|
- system-config-zuul-role-integration
|
|
- system-config-gerrit-images
|
|
- system-config-puppet-apply-jobs
|
|
- system-config-logstash-filter-jobs
|
|
check:
|
|
jobs:
|
|
- opendev-tox-docs
|
|
- opendev-buildset-registry
|
|
- tox-linters:
|
|
timeout: 3600
|
|
- system-config-run-base
|
|
- system-config-run-base-ansible-devel:
|
|
voting: false
|
|
- system-config-run-borg-backup
|
|
- system-config-run-dns
|
|
- system-config-run-eavesdrop:
|
|
dependencies:
|
|
- name: opendev-buildset-registry
|
|
- name: system-config-build-image-accessbot
|
|
soft: true
|
|
- system-config-run-codesearch:
|
|
dependencies:
|
|
- name: opendev-buildset-registry
|
|
- name: system-config-build-image-hound
|
|
soft: true
|
|
- system-config-run-kerberos
|
|
- system-config-run-lists
|
|
- system-config-run-nodepool
|
|
- system-config-run-meetpad:
|
|
dependencies:
|
|
- name: opendev-buildset-registry
|
|
- name: system-config-build-image-jitsi-meet
|
|
soft: true
|
|
- system-config-run-mirror-x86
|
|
- system-config-run-mirror-update
|
|
- system-config-run-static
|
|
- system-config-run-docker-registry
|
|
- system-config-run-etherpad:
|
|
dependencies:
|
|
- name: opendev-buildset-registry
|
|
- name: system-config-build-image-etherpad
|
|
soft: true
|
|
- system-config-run-gitea:
|
|
dependencies:
|
|
- name: opendev-buildset-registry
|
|
- name: system-config-build-image-gitea
|
|
soft: true
|
|
- name: system-config-build-image-haproxy-statsd
|
|
soft: true
|
|
- system-config-run-grafana:
|
|
dependencies:
|
|
- name: opendev-buildset-registry
|
|
- name: system-config-build-image-grafana
|
|
soft: true
|
|
- system-config-run-graphite
|
|
- system-config-run-review-3.2:
|
|
dependencies:
|
|
- name: opendev-buildset-registry
|
|
- name: system-config-build-image-gerrit-3.2
|
|
soft: true
|
|
- system-config-run-review-3.3:
|
|
dependencies:
|
|
- name: opendev-buildset-registry
|
|
- name: system-config-build-image-gerrit-3.3
|
|
soft: true
|
|
- system-config-build-image-refstack
|
|
- system-config-run-refstack:
|
|
dependencies:
|
|
- name: opendev-buildset-registry
|
|
- name: system-config-build-image-refstack
|
|
soft: true
|
|
- system-config-run-zookeeper
|
|
- system-config-run-zuul
|
|
- system-config-run-zuul-preview
|
|
- system-config-run-letsencrypt
|
|
- system-config-build-image-jinja-init:
|
|
dependencies:
|
|
- name: opendev-buildset-registry
|
|
- name: system-config-build-image-python-base-3.7
|
|
soft: true
|
|
- system-config-build-image-gitea-init:
|
|
dependencies:
|
|
- name: opendev-buildset-registry
|
|
- name: system-config-build-image-jinja-init
|
|
soft: true
|
|
- system-config-build-image-hound:
|
|
dependencies:
|
|
- name: opendev-buildset-registry
|
|
- name: system-config-build-image-python-base-3.8
|
|
soft: true
|
|
- system-config-build-image-etherpad
|
|
- system-config-build-image-gitea
|
|
- system-config-build-image-grafana
|
|
- system-config-build-image-jitsi-meet
|
|
- system-config-build-image-haproxy-statsd:
|
|
dependencies:
|
|
- name: opendev-buildset-registry
|
|
- name: system-config-build-image-python-base-3.7
|
|
soft: true
|
|
- system-config-build-image-accessbot:
|
|
dependencies:
|
|
- name: opendev-buildset-registry
|
|
- name: system-config-build-image-python-base-3.7
|
|
soft: true
|
|
- system-config-build-image-python-base-3.7
|
|
- system-config-build-image-python-base-3.8
|
|
- system-config-build-image-python-builder-3.7
|
|
- system-config-build-image-python-builder-3.8
|
|
- system-config-build-image-uwsgi-base-3.7
|
|
- system-config-build-image-uwsgi-base-3.8
|
|
check-arm64:
|
|
jobs:
|
|
- system-config-run-base-arm64
|
|
- system-config-run-mirror-arm64
|
|
gate:
|
|
jobs:
|
|
- opendev-tox-docs
|
|
- opendev-buildset-registry
|
|
- tox-linters:
|
|
timeout: 3600
|
|
- system-config-run-base
|
|
- system-config-run-dns
|
|
- system-config-run-eavesdrop:
|
|
dependencies:
|
|
- name: opendev-buildset-registry
|
|
- name: system-config-upload-image-accessbot
|
|
soft: true
|
|
- system-config-run-codesearch:
|
|
dependencies:
|
|
- name: opendev-buildset-registry
|
|
- name: system-config-upload-image-hound
|
|
soft: true
|
|
- system-config-run-kerberos
|
|
- system-config-run-lists
|
|
- system-config-run-nodepool
|
|
- system-config-run-meetpad:
|
|
dependencies:
|
|
- name: opendev-buildset-registry
|
|
- name: system-config-upload-image-jitsi-meet
|
|
soft: true
|
|
- system-config-run-mirror-x86
|
|
- system-config-run-mirror-update
|
|
- system-config-run-static
|
|
- system-config-run-docker-registry
|
|
- system-config-run-etherpad:
|
|
dependencies:
|
|
- name: opendev-buildset-registry
|
|
- name: system-config-upload-image-etherpad
|
|
soft: true
|
|
- system-config-run-gitea:
|
|
dependencies:
|
|
- name: opendev-buildset-registry
|
|
- name: system-config-upload-image-gitea
|
|
soft: true
|
|
- name: system-config-upload-image-haproxy-statsd
|
|
soft: true
|
|
- system-config-run-grafana:
|
|
dependencies:
|
|
- name: opendev-buildset-registry
|
|
- name: system-config-upload-image-grafana
|
|
soft: true
|
|
- system-config-run-graphite
|
|
- system-config-run-review-3.2:
|
|
dependencies:
|
|
- name: opendev-buildset-registry
|
|
- name: system-config-upload-image-gerrit-3.2
|
|
soft: true
|
|
- system-config-run-review-3.3:
|
|
dependencies:
|
|
- name: opendev-buildset-registry
|
|
- name: system-config-upload-image-gerrit-3.3
|
|
soft: true
|
|
- system-config-run-refstack:
|
|
dependencies:
|
|
- name: opendev-buildset-registry
|
|
- name: system-config-upload-image-refstack
|
|
soft: true
|
|
- system-config-run-zookeeper
|
|
- system-config-run-zuul
|
|
- system-config-run-zuul-preview
|
|
- system-config-run-letsencrypt
|
|
- system-config-upload-image-jinja-init:
|
|
dependencies:
|
|
- name: opendev-buildset-registry
|
|
- name: system-config-upload-image-python-base-3.7
|
|
soft: true
|
|
- system-config-upload-image-gitea-init:
|
|
dependencies:
|
|
- name: opendev-buildset-registry
|
|
- name: system-config-upload-image-jinja-init
|
|
soft: true
|
|
- system-config-upload-image-hound
|
|
- system-config-upload-image-etherpad
|
|
- system-config-upload-image-gitea
|
|
- system-config-upload-image-grafana
|
|
- system-config-upload-image-refstack
|
|
- system-config-upload-image-jitsi-meet
|
|
- system-config-upload-image-haproxy-statsd:
|
|
dependencies:
|
|
- name: opendev-buildset-registry
|
|
- name: system-config-upload-image-python-base-3.7
|
|
soft: true
|
|
- system-config-upload-image-accessbot:
|
|
dependencies:
|
|
- name: opendev-buildset-registry
|
|
- name: system-config-build-image-python-base-3.7
|
|
soft: true
|
|
- system-config-upload-image-python-base-3.7
|
|
- system-config-upload-image-python-base-3.8
|
|
- system-config-upload-image-python-builder-3.7
|
|
- system-config-upload-image-python-builder-3.8
|
|
- system-config-upload-image-uwsgi-base-3.7
|
|
- system-config-upload-image-uwsgi-base-3.8
|
|
promote:
|
|
jobs:
|
|
- opendev-promote-docs
|
|
deploy:
|
|
jobs:
|
|
- system-config-promote-image-hound
|
|
- system-config-promote-image-jinja-init
|
|
- system-config-promote-image-gitea-init
|
|
- system-config-promote-image-gitea
|
|
- system-config-promote-image-grafana
|
|
- system-config-promote-image-etherpad
|
|
- system-config-promote-image-jitsi-meet
|
|
- system-config-promote-image-haproxy-statsd
|
|
- system-config-promote-image-accessbot
|
|
- system-config-promote-image-refstack
|
|
- system-config-promote-image-python-base-3.7
|
|
- system-config-promote-image-python-base-3.8
|
|
- system-config-promote-image-python-builder-3.7
|
|
- system-config-promote-image-python-builder-3.8
|
|
- system-config-promote-image-uwsgi-base-3.7
|
|
- system-config-promote-image-uwsgi-base-3.8
|
|
- infra-prod-install-ansible
|
|
- infra-prod-base
|
|
- infra-prod-letsencrypt
|
|
- infra-prod-manage-projects:
|
|
files:
|
|
- inventory/.*
|
|
- playbooks/manage-projects.yaml
|
|
- inventory/service/group_vars/gerrit.yaml
|
|
- inventory/service/group_vars/gitea.yaml
|
|
- inventory/service/host_vars/gitea
|
|
- inventory/service/host_vars/review
|
|
- playbooks/roles/gitea-git-repos/
|
|
- playbooks/roles/gerrit/defaults/main.yaml
|
|
- playbooks/roles/gerrit/tasks/manage-projects.yaml
|
|
dependencies:
|
|
- name: system-config-promote-image-gerrit-3.2
|
|
soft: true
|
|
- name: infra-prod-install-ansible
|
|
soft: true
|
|
- infra-prod-service-bridge
|
|
- infra-prod-service-gitea-lb
|
|
- infra-prod-service-kerberos
|
|
- infra-prod-service-nameserver
|
|
- infra-prod-service-nodepool
|
|
- infra-prod-service-codesearch:
|
|
dependencies:
|
|
- name: infra-prod-letsencrypt
|
|
soft: true
|
|
- name: system-config-promote-image-hound
|
|
soft: true
|
|
- infra-prod-service-etherpad:
|
|
dependencies:
|
|
- name: infra-prod-install-ansible
|
|
soft: true
|
|
- name: infra-prod-letsencrypt
|
|
soft: true
|
|
- name: system-config-promote-image-etherpad
|
|
soft: true
|
|
- infra-prod-service-grafana:
|
|
dependencies:
|
|
- name: infra-prod-letsencrypt
|
|
soft: true
|
|
- name: system-config-promote-image-grafana
|
|
soft: true
|
|
- infra-prod-service-graphite
|
|
- infra-prod-service-meetpad
|
|
- infra-prod-service-mirror-update
|
|
- infra-prod-service-mirror
|
|
- infra-prod-service-static
|
|
- infra-prod-service-borg-backup
|
|
- infra-prod-service-registry
|
|
- infra-prod-service-refstack
|
|
- infra-prod-service-zookeeper
|
|
- infra-prod-service-zuul
|
|
- infra-prod-service-zuul-preview
|
|
- infra-prod-service-review
|
|
- infra-prod-service-review-dev
|
|
- infra-prod-service-gitea
|
|
- infra-prod-service-codesearch
|
|
- infra-prod-service-eavesdrop
|
|
- infra-prod-run-accessbot:
|
|
dependencies:
|
|
- infra-prod-service-eavesdrop
|
|
- name: system-config-promote-image-accessbot
|
|
soft: true
|
|
- infra-prod-service-afs
|
|
- infra-prod-remote-puppet-else
|
|
- infra-prod-run-cloud-launcher
|
|
periodic:
|
|
jobs:
|
|
- developer-openstack-goaccess-report
|
|
- docs-opendev-goaccess-report
|
|
- docs-openstack-goaccess-report
|
|
- docs-starlingx-goaccess-report
|
|
- governance-openstack-goaccess-report
|
|
- releases-openstack-goaccess-report
|
|
- security-openstack-goaccess-report
|
|
- specs-openstack-goaccess-report
|
|
- tarballs-opendev-goaccess-report
|
|
- zuul-ci-goaccess-report
|
|
# Nightly runs of ansible things for catchup
|
|
- infra-prod-install-ansible
|
|
- infra-prod-base
|
|
- infra-prod-letsencrypt
|
|
- infra-prod-service-bridge
|
|
- infra-prod-service-gitea-lb
|
|
- infra-prod-service-nameserver
|
|
- infra-prod-service-etherpad
|
|
- infra-prod-service-meetpad
|
|
- infra-prod-service-kerberos
|
|
- infra-prod-service-mirror-update
|
|
- infra-prod-service-mirror
|
|
- infra-prod-service-static
|
|
- infra-prod-service-borg-backup
|
|
- infra-prod-service-zookeeper
|
|
- infra-prod-service-review
|
|
- infra-prod-service-review-dev
|
|
- infra-prod-service-gitea
|
|
- infra-prod-service-codesearch
|
|
- infra-prod-service-eavesdrop
|
|
- infra-prod-run-accessbot
|
|
- infra-prod-service-afs
|
|
opendev-prod-hourly:
|
|
jobs:
|
|
- infra-prod-install-ansible
|
|
- infra-prod-service-bridge:
|
|
dependencies:
|
|
- name: infra-prod-install-ansible
|
|
soft: true
|
|
- infra-prod-run-cloud-launcher
|
|
- infra-prod-service-nodepool:
|
|
dependencies:
|
|
- name: infra-prod-install-ansible
|
|
soft: true
|
|
- infra-prod-service-registry:
|
|
dependencies:
|
|
- name: infra-prod-install-ansible
|
|
soft: true
|
|
- infra-prod-service-zuul:
|
|
dependencies:
|
|
- name: infra-prod-install-ansible
|
|
soft: true
|
|
- infra-prod-service-zuul-preview:
|
|
dependencies:
|
|
- name: infra-prod-install-ansible
|
|
soft: true
|
|
- infra-prod-service-eavesdrop:
|
|
dependencies:
|
|
- name: infra-prod-install-ansible
|
|
soft: true
|
|
- infra-prod-remote-puppet-else:
|
|
dependencies:
|
|
- name: infra-prod-install-ansible
|
|
soft: true
|