only osbs-client on buildvm (just schedules with osbs) and koji-hub (status checking), ssl_verify everywhere, enable in prod

Signed-off-by: Adam Miller <admiller@redhat.com>

playbooks/groups/buildhw.yml

@@ -24,37 +24,6 @@
   - hosts
   - { role: fas_client, when: not inventory_hostname.startswith('bkernel') }
   - { role: sudo, when: not inventory_hostname.startswith('bkernel') }
-  - {
-      role: osbs-client,
-        when: env == 'staging',
-        general: {
-          verbose: 0,
-          build_json_dir: '/usr/share/osbs/',
-          openshift_required_version: 1.1.0,
-        },
-        default: {
-          username: "{{ osbs_koji_stg_username }}",
-          password: "{{ osbs_koji_stg_password }}",
-          koji_certs_secret: "koji",
-          openshift_url: 'https://{{ osbs_fqdn }}/',
-          registry_uri: 'https://{{ docker_registry }}/v2',
-          source_registry_uri: 'https://{{ docker_registry }}/v2',
-          build_host: '{{ osbs_fqdn }}',
-          koji_root: 'http://{{ koji_root }}',
-          koji_hub: 'http://{{ koji_hub }}',
-          sources_command: 'fedpkg sources',
-          build_type: 'prod',
-          authoritative_registry: 'registry.example.com',
-          vendor: 'Fedora Project',
-          verify_ssl: false,
-          use_auth: true,
-          builder_use_auth: true,
-          distribution_scope: 'private',
-          registry_api_versions: 'v2',
-          builder_openshift_url: 'https://172.17.0.1:8443/'
-        }
-    }
-
 
   tasks:
   - include: "{{ tasks }}/2fa_client.yml"

playbooks/groups/buildvm.yml

@@ -50,7 +50,37 @@
           build_type: 'prod',
           authoritative_registry: 'registry.example.com',
           vendor: 'Fedora Project',
-          verify_ssl: false,
+          verify_ssl: true,
+          use_auth: true,
+          builder_use_auth: true,
+          distribution_scope: 'private',
+          registry_api_versions: 'v2',
+          builder_openshift_url: 'https://172.17.0.1:8443/'
+        }
+    }
+  - {
+      role: osbs-client,
+        when: env == 'production',
+        general: {
+          verbose: 0,
+          build_json_dir: '/usr/share/osbs/',
+          openshift_required_version: 1.1.0,
+        },
+        default: {
+          username: "{{ osbs_koji_prod_username }}",
+          password: "{{ osbs_koji_prod_password }}",
+          koji_certs_secret: "koji",
+          openshift_url: 'https://{{ osbs_fqdn }}/',
+          registry_uri: 'https://{{ docker_registry }}/v2',
+          source_registry_uri: 'https://{{ docker_registry }}/v2',
+          build_host: '{{ osbs_fqdn }}',
+          koji_root: 'http://{{ koji_root }}',
+          koji_hub: 'http://{{ koji_hub }}',
+          sources_command: 'fedpkg sources',
+          build_type: 'prod',
+          authoritative_registry: 'registry.example.com',
+          vendor: 'Fedora Project',
+          verify_ssl: true,
           use_auth: true,
           builder_use_auth: true,
           distribution_scope: 'private',

playbooks/groups/koji-hub.yml

@@ -62,7 +62,36 @@
           builder_openshift_url: 'https://172.17.0.1:8443/'
         }
     }
-
+  - {
+      role: osbs-client,
+        when: env == 'staging',
+        general: {
+          verbose: 0,
+          build_json_dir: '/usr/share/osbs/',
+          openshift_required_version: 1.1.0,
+        },
+        default: {
+          username: "{{ osbs_koji_prod_username }}",
+          password: "{{ osbs_koji_prod_password }}",
+          koji_certs_secret: "koji",
+          openshift_url: 'https://{{ osbs_fqdn }}/',
+          registry_uri: 'https://{{ docker_registry }}/v2',
+          source_registry_uri: 'https://{{ docker_registry }}/v2',
+          build_host: '{{ osbs_fqdn }}',
+          koji_root: 'http://{{ koji_root }}',
+          koji_hub: 'http://{{ koji_hub }}',
+          sources_command: 'fedpkg sources',
+          build_type: 'prod',
+          authoritative_registry: 'registry.example.com',
+          vendor: 'Fedora Project',
+          verify_ssl: false,
+          use_auth: true,
+          builder_use_auth: true,
+          distribution_scope: 'private',
+          registry_api_versions: 'v2',
+          builder_openshift_url: 'https://172.17.0.1:8443/'
+        }
+    }
   - { role: nfs/server, when: env == "staging" }
   - { role: keepalived, when: env == "production" and inventory_hostname.startswith('koji') }
   - role: nfs/client

roles/koji_builder/templates/kojid.conf

@@ -77,15 +77,11 @@ serverca = /etc/kojid/cacert.pem
 
 {% if 'runroot' in group_names %}
 ; Config for it lives in /etc/kojid/runroot.conf
-{% if env == 'staging' %}
 plugins = runroot builder_containerbuild
-{% else %}
-plugins = runroot
-{% endif %}
 
 {% else %}
 
-{% if env == 'staging' and not inventory_hostname.startswith('arm') %}
+{% if not inventory_hostname.startswith('arm') %}
 plugins = builder_containerbuild
 {% else %}
 plugins =