WarlockFish/fedora-infra_ansible
1
0
Fork 0
mirror of https://pagure.io/fedora-infra/ansible.git synced 2026-03-20 03:57:02 +08:00
Code Issues Packages Projects Releases Wiki Activity
45,353 Commits 9 Branches 0 Tags
6706723eea466bc9ffedc00a2fc86a0797279113
Commit Graph

201 Commits

Author SHA1 Message Date
Greg Sutcliffe
01ab35531a Zabbix: fixes infra/tickets#12992 - add IPA backup monitoring 
Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
 2026-01-23 10:22:29 +00:00
Aurélien Bompard
2d80cc95c2 Cleanup stage users: loop over all the pages 
Signed-off-by: Aurélien Bompard <aurelien@bompard.org>
 2026-01-13 17:31:12 +01:00
Greg Sutcliffe
038ed9e151 Zabbix: add IPA http checks against the internal webserver 
Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
 2025-12-11 15:53:26 +00:00
Kevin Fenzi
25ef9ffdae ipa: fix typo in logrotate 
Seems this was missing a leading /, so it was not working.

Signed-off-by: Kevin Fenzi <kevin@scrye.com>
 2025-09-26 12:22:20 -07:00
Aurélien Bompard
beb724ee65 IPA: setup a permission to modify group managers 
Signed-off-by: Aurélien Bompard <aurelien@bompard.org>
 2025-09-01 11:18:45 +02:00
Aurélien Bompard
0c6153cebe Create an IPA service for monitoring and use it for check-ipa-free-ids 
Signed-off-by: Aurélien Bompard <aurelien@bompard.org>
 2025-07-10 11:46:05 +02:00
Michal Konecny
f1b1deb66f [ipa/server] Increase nsslapd sizelimit 
It seems that the issue https://github.com/dogtagpki/pki/issues/5133 we
are hitting now is because the limit on the newly deployed is set only
to 2000, which makes it reach the LDAP administrative limit.
 2025-06-25 11:47:25 +00:00
Aurélien Bompard
2695b3448a Toddlers in IPA: use the full host name 
Signed-off-by: Aurélien Bompard <aurelien@bompard.org>
 2025-06-23 17:24:03 +02:00
Aurélien Bompard
8be052d10f Toddler cleaning-packager-groups: fix service name 
Signed-off-by: Aurélien Bompard <aurelien@bompard.org>
 2025-06-23 17:05:17 +02:00
Michal Konecny
f431d2f851 [ipa/server] Remove the version restriction 
https://issues.redhat.com/browse/RHEL-97591 is now resolved so we can
remove the versions restriction.
 2025-06-23 09:23:46 +00:00
Michal Konecny
6cbff995cb [ipa/server] Remove parameters from replication 
When trying to debug RDU3 replication issue I found out that these two
parameters actually obfuscating any issues that could happen.

Let's remove them than.
 2025-06-19 15:37:17 +02:00
Michal Konecny
57e5bd9eda [ipa/server] Install older version of ipa-server-dns 
Another package affected by https://issues.redhat.com/browse/RHEL-97591
 2025-06-19 10:53:46 +02:00
Michal Konecny
07d296fbcd [ipa/server] Install older version of ipa-server 
This is just a temporary solution till
https://issues.redhat.com/browse/RHEL-97591 is solved.
 2025-06-19 10:26:08 +02:00
Michal Konecny
9ade63d3ba [ipa/server] Remove KRA role from deployment 
We never used the KRA vault in IPA, so let's remove it till we really
have usage for it.
 2025-06-17 10:17:38 +00:00
Lenka Segura
cdf6c65af3 [ipaserver] Add toddlers tag to Get admin ticket 
Signed-off-by: Lenka Segura <lsegura@redhat.com>
 2025-05-29 11:26:50 +02:00
Lenka Segura
82354291b6 [ipaserver] Include toddlers setup for prod 
Signed-off-by: Lenka Segura <lsegura@redhat.com>
 2025-05-29 10:26:09 +02:00
Michal Konecny
c4948ba32e [ipa] Add kra role to replicas 
As we were finally able to resolve the issue of replica installation
failing when KRA role is enabled. We can now enable it by default in
playbook.

See https://pagure.io/fedora-infrastructure/issue/12158 for more info.
 2025-05-22 15:11:06 +02:00
Aurélien Bompard
d884a0f8ba Use the combined RabbitMQ CA cert in the clients 
Signed-off-by: Aurélien Bompard <aurelien@bompard.org>
 2025-04-11 15:15:45 +02:00
Aurélien Bompard
46a8152c61 Deploy journal2fedmsg to prod 
Signed-off-by: Aurélien Bompard <aurelien@bompard.org>
 2025-04-01 12:05:17 +02:00
Aurélien Bompard
394b92cb19 simplify the config file using a variable 
Signed-off-by: Aurélien Bompard <aurelien@bompard.org>
 2025-04-01 11:47:42 +02:00
Michal Konecny
80adc4e729 [ipa/server] Don't ask for user input 
As the pause module is only executed on first machine in the group I
decided to rather remove it completely.

This means that the replica will only be reinstalled, if the machine
isn't master node and the /var/log/ipainstall.log doesn't exist.

If somebody wants to re-install the replica they just need to remove
/var/log/ipainstall.log and the playbook will do the rest.
 2025-03-31 15:44:16 +02:00
Michal Konecny
40136bda42 [ipa/server] Don't ask for reinstall in some cases 
Don't ask for reinstall when this is master node or the install log is
already created.
 2025-03-31 15:17:48 +02:00
Aurélien Bompard
17cd3edbc7 Create missing dir 
Signed-off-by: Aurélien Bompard <aurelien@bompard.org>
 2025-03-28 14:50:37 +01:00
Aurélien Bompard
292c7f6c6e Deploy journal-to-fedora-messaging on IPA (staging for now) 
Signed-off-by: Aurélien Bompard <aurelien@bompard.org>
 2025-03-28 12:37:56 +01:00
Kevin Fenzi
58bbbca299 ipa: make sure a bunch of calls do not log sensitive data 
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
 2025-03-20 14:48:12 -07:00
Aurélien Bompard
097b8f9214 Give the clean packagers groups toddler access to the corresponding service's keytab 
Signed-off-by: Aurélien Bompard <aurelien@bompard.org>
 2025-02-25 08:54:06 +01:00
Aurélien Bompard
a508708744 IPA: do the toddlers user setup before destroying the admin ticket 
Signed-off-by: Aurélien Bompard <aurelien@bompard.org>
 2025-02-19 12:20:08 +01:00
Aurélien Bompard
b3c7a683e2 IPA: setup a toddlers service to remove users from groups 
Signed-off-by: Aurélien Bompard <aurelien@bompard.org>
 2025-02-19 12:16:05 +01:00
Michal Konecny
2ec055db6f Use first uppercase letter for all handlers 
This will unify all the handlers to use first uppercase letter for
ansible-lint to stop complaining.

I went through all `notify:` occurrences and fixed them by running
```
set TEXT "text_to_replace"; set REPLACEMENT "replacement_text"; git grep
-rlz "$TEXT" . | xargs -0 sed -i "s/$TEXT/$REPLACEMENT/g"
```

Then I went through all the changes and removed the ones that wasn't
expected to be changed.

Fixes https://pagure.io/fedora-infrastructure/issue/12391

Signed-off-by: Michal Konecny <mkonecny@redhat.com>
 2025-02-10 20:31:49 +00:00
Ryan Lerch
462176464b ansiblelint fixes-- fqcn[action-core] - command to ansible.builtin.command 
Replaces many references to  command: with ansible.builtin.command

Signed-off-by: Ryan Lerch <rlerch@redhat.com>
 2025-01-15 11:26:47 +10:00
Kevin Fenzi
ae7be1e4e0 ipa: add a tag to fix the ipa re-writes 
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
 2024-11-20 12:42:36 -08:00
Michal Konecny
3860204d34 [ipa/server] Add tags to logrotate config 
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
 2024-11-07 14:15:35 +01:00
Michal Konecny
d85e39b488 [ipa/server] Correctly format the failure condition 
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
 2024-11-07 14:07:38 +01:00
Michal Konecny
f1eae89e18 [ipa/server] Move the files to separate line 
It seems that the command module in argv is adding space at the start of
file name when it's not on it's own line.

Signed-off-by: Michal Konecny <mkonecny@redhat.com>
 2024-11-07 13:41:57 +01:00
Michal Konecny
a40c051f55 [ipa/server] Use full path to ldapmodify binary 
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
 2024-11-07 13:26:43 +01:00
Michal Konecny
e2ca17657a [ipa/server] Wrap jinja2 parameter in string 
This should hopefully fix the "No such file or directory" error

Signed-off-by: Michal Konecny <mkonecny@redhat.com>
 2024-11-07 11:54:45 +01:00
Michal Konecny
a1aaa3183c [ipa/server] Fix ipa_user for noggin user 
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
 2024-11-07 11:54:45 +01:00
Michal Konecny
f21a270008 [ipa/server] Try to fix the deployment errors 
The answer from ipa03 is ignored, let's hope this will fix it.

The ipa_user module is returning "response user_mod: no modifications to
be performed", which should be OK, but it's treated like fatal error.

Signed-off-by: Michal Konecny <mkonecny@redhat.com>
 2024-11-06 19:46:48 +01:00
Michal Konecny
3883563303 [ipa/server] Disable yamllint checks 
We already checking yaml related errors with yamllint.

Signed-off-by: Michal Konecny <mkonecny@redhat.com>
 2024-11-06 19:25:06 +01:00
Michal Konecny
b86cb7dd7c [ipa/server] Add ipa_host to corresponding ipa roles 
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
 2024-11-06 18:46:41 +01:00
Michal Konecny
e5b2f1afae [ipa/server] Split the long string 
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
 2024-11-06 18:15:32 +01:00
Michal Konecny
c19563b3db [ipa/server] Use the correct parameters for ipa_user 
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
 2024-11-06 18:09:14 +01:00
Michal Konecny
5bca4dcea3 [ipa/server] Use correct parameters for ipa_user module 
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
 2024-11-06 16:56:13 +01:00
Michal Konecny
4a39c39740 [ipa/server] Don't split prompt for pause module 
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
 2024-11-06 16:54:10 +01:00
Michal Konecny
2f94e51c2e [ipa/server] Fix another typo in module name 
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
 2024-11-06 16:40:29 +01:00
Michal Konecny
606d446bd0 [ipa/server] Fix the module name typo 
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
 2024-11-06 16:35:08 +01:00
Michal Konecny
5f6ad93f4f [ipa/server] Use the correct ipa module 
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
 2024-11-06 16:22:45 +01:00
Michal Konecny
792bc60a8a [ipa/server] Fix ansible-lint errors 
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
 2024-11-06 15:12:16 +00:00
Michal Konecny
b3a22d9049 [ipa/server] Add logrotate config for krb5kdc 
The log files for krb5kdc had around 1 GB each on ipa01.stg. To prevent this in
future let us replace the original config with one that is compressing the old logs.

Signed-off-by: Michal Konecny <mkonecny@redhat.com>
 2024-11-06 15:12:16 +00:00
Michal Konecny
f842d785d8 Revert "[ipa/server] Add KRA role to replicas as well" 
This reverts commit 03f57303e2.
 2024-10-11 18:00:55 +02:00