mirror of
https://pagure.io/fedora-infra/ansible.git
synced 2026-05-04 01:32:20 +08:00
c84b99223c
This removes osbs and allmost all it's associated playbooks and files. It served long and well, but we no longer need it. flatpaks are building with a koji-flatpak plugin. base/minimal/toolbox containers are building with kiwi. We aren't building any other containers right now, and we did they could be added to kiwi. This is the end of an era... I look with nostolga on ansible-ansible-openshift-ansible (a role to setup ansible on a control host and run it from our ansible). Good bye osbs! Signed-off-by: Kevin Fenzi <kevin@scrye.com>
396 lines
9.9 KiB
YAML
396 lines
9.9 KiB
YAML
#
|
|
# This is a base koji_builder role.
|
|
#
|
|
- name: set hostname
|
|
hostname: name="{{inventory_hostname}}"
|
|
tags:
|
|
- koji_builder
|
|
|
|
- name: set root passwd
|
|
user: name=root password={{ builder_rootpw }} state=present
|
|
tags:
|
|
- koji_builder
|
|
- rootpw
|
|
|
|
- name: add mock user as 425
|
|
user: name=mock uid=425 state=present home=/var/lib/mock createhome=yes system=yes
|
|
tags:
|
|
- koji_builder
|
|
|
|
- name: make mock homedir perms
|
|
file: state=directory path=/var/lib/mock mode=2775 owner=root group=mock
|
|
tags:
|
|
- koji_builder
|
|
|
|
- name: add mock ssh dir
|
|
file: state=directory path=/var/lib/mock/.ssh mode=700 owner=mock group=mock
|
|
tags:
|
|
- koji_builder
|
|
|
|
- name: add mock ssh keys
|
|
copy: src=mock_auth_keys dest=/var/lib/mock/.ssh/authorized_keys mode=640 owner=mock group=mock
|
|
tags:
|
|
- koji_builder
|
|
|
|
- name: add kojibuilder
|
|
user: name=kojibuilder groups=mock
|
|
tags:
|
|
- koji_builder
|
|
|
|
- name: add mockbuilder
|
|
user: name=mockbuilder groups=mock
|
|
tags:
|
|
- koji_builder
|
|
|
|
- name: mockbuilder .ssh dir
|
|
file: state=directory path=/home/mockbuilder/.ssh mode=700 owner=mockbuilder group=mockbuilder
|
|
tags:
|
|
- koji_builder
|
|
|
|
- name: mockbuilder ssh key
|
|
copy: src=ftbfs_auth_keys dest=/home/mockbuilder/.ssh/authorized_keys mode=644 owner=mockbuilder group=mockbuilder
|
|
tags:
|
|
- koji_builder
|
|
|
|
- name: make a bunch of dirs
|
|
file: state=directory path={{ item }}
|
|
with_items:
|
|
- /pub
|
|
- /mnt/fedora_koji
|
|
- /pub/fedora
|
|
- /pub/epel
|
|
tags:
|
|
- koji_builder
|
|
|
|
- name: Install packages needed by koji_builders
|
|
package:
|
|
state: present
|
|
name:
|
|
- koji-builder
|
|
- koji-builder-plugins
|
|
- python3-koji
|
|
- koji-containerbuild-builder
|
|
- strace
|
|
- mock
|
|
- kernel-firmware
|
|
- kernel-modules
|
|
- rsyslog
|
|
- audit
|
|
- pycdio
|
|
- python3-kickstart
|
|
- libvirt-client
|
|
- oz
|
|
- imagefactory
|
|
- imagefactory-plugins-TinMan
|
|
- imagefactory-plugins-Docker
|
|
- imagefactory-plugins-GCE
|
|
- imagefactory-plugins-vSphere
|
|
- imagefactory-plugins-ovfcommon
|
|
- imagefactory-plugins
|
|
- imagefactory-plugins-OVA
|
|
- imagefactory-plugins-RHEVM
|
|
- pykickstart
|
|
- nosync
|
|
- koji-osbuild-builder
|
|
- ipset
|
|
tags:
|
|
- koji_builder
|
|
- koji_builder_osbuild
|
|
#
|
|
# rpmautospec plugin
|
|
#
|
|
|
|
- name: install koji builder rpmautospec plugin
|
|
package:
|
|
name: "{{ item }}"
|
|
state: present
|
|
with_items:
|
|
- koji-builder-plugin-rpmautospec
|
|
tags:
|
|
- packages
|
|
- koji_builder
|
|
- rpmautospec
|
|
|
|
- name: remove obsolete configuration of rpmautospec
|
|
file:
|
|
path: "/etc/kojid/plugins/{{ item }}"
|
|
state: absent
|
|
loop:
|
|
- rpmautospec.conf
|
|
- rpmautospec.conf.rpmnew
|
|
- rpmautospec.conf.rpmsave
|
|
- rpmautospec.conf.rpmorig
|
|
tags:
|
|
- koji_builder
|
|
- rpmautospec
|
|
|
|
- name: install Flatpak builder plugin
|
|
package: name=koji-flatpak-builder state=present
|
|
tags:
|
|
- koji_builder
|
|
|
|
- name: configure flatpak-builder plugin
|
|
template: src=flatpak.conf dest=/etc/kojid/plugins/flatpak.conf
|
|
vars:
|
|
candidate_registry: "candidate-registry{{ env_suffix }}.fedoraproject.org"
|
|
notify:
|
|
- restart kojid
|
|
tags:
|
|
- koji_builder
|
|
|
|
- name: Install arm UEFI firmware package (aarch64 only)
|
|
package: name=edk2-arm state=present
|
|
tags:
|
|
- koji_builder
|
|
when: "ansible_architecture is defined and ansible_architecture == 'aarch64'"
|
|
|
|
- name: enable virtlogd service
|
|
service: name=virtlogd state=started enabled=yes
|
|
tags:
|
|
- koji_builder
|
|
|
|
- name: build /etc/kojid/kojid.conf from group vars
|
|
template: src=kojid.conf dest=/etc/kojid/kojid.conf
|
|
notify:
|
|
- restart kojid
|
|
tags:
|
|
- koji_builder
|
|
- rpmautospec
|
|
|
|
- name: Create osbuild builder config directory
|
|
file: path=/etc/koji-osbuild state=directory mode=0755
|
|
tags:
|
|
- koji_builder
|
|
- koji_builder_osbuild
|
|
|
|
- name: build /etc/koji-osbuild/builder.conf
|
|
template: src=builder.conf{{env_suffix}} dest=/etc/koji-osbuild/builder.conf
|
|
notify:
|
|
- restart kojid
|
|
tags:
|
|
- koji_builder
|
|
- koji_builder_osbuild
|
|
|
|
- name: build /etc/koji/koji.conf from group vars
|
|
template: src=koji.conf dest=/etc/koji.conf
|
|
tags:
|
|
- koji_builder
|
|
|
|
- name: config for the kojid runroot plugin (only some builders)
|
|
template: src=runroot.conf.j2 dest=/etc/kojid/plugins/runroot.conf
|
|
when: "'runroot' in group_names"
|
|
notify:
|
|
- restart kojid
|
|
tags:
|
|
- koji_builder
|
|
|
|
- name: override kojid.service file to set TasksMax to unlimited
|
|
copy: src=kojid.service dest=/etc/systemd/system/kojid.service
|
|
notify:
|
|
- reload systemd
|
|
- restart kojid
|
|
tags:
|
|
- koji_builder
|
|
|
|
# setup for oz/imagefactory
|
|
- name: make .psphere dir
|
|
file: state=directory path=/root/.psphere mode=775 owner=root group=root
|
|
tags:
|
|
- koji_builder
|
|
|
|
- name: make .psphere/templates dir
|
|
file: state=directory path=/root/.psphere/templates mode=775 owner=root group=root
|
|
tags:
|
|
- koji_builder
|
|
|
|
- name: copy over /root/.psphere/config.yaml
|
|
copy: src={{ private }}/files/koji/config.yaml dest=/root/.psphere/config.yaml
|
|
tags:
|
|
- koji_builder
|
|
# done oz/imagefactory
|
|
|
|
- name: copy over /etc/security/limits.conf
|
|
copy: src=limits.conf dest=/etc/security/limits.conf
|
|
tags:
|
|
- koji_builder
|
|
|
|
# oz.cfg upstream ram and cpu definitions are not enough
|
|
- name: oz.cfg
|
|
template: src=oz.cfg.j2 dest=/etc/oz/oz.cfg
|
|
tags:
|
|
- koji_builder
|
|
- koji_builder/oz.cfg
|
|
|
|
# install libvirtd.conf
|
|
#
|
|
# This provides us with the ability to use virt-manager from non root accounts.
|
|
# This is useful in the oz/imagefactory context for debugging
|
|
|
|
- name: install libvirtd.conf
|
|
copy: src="{{ files }}/virthost/libvirtd.conf" dest=/etc/libvirt/libvirtd.conf
|
|
notify:
|
|
- restart libvirtd
|
|
tags:
|
|
- koji_builder
|
|
when: env != "staging"
|
|
|
|
#
|
|
# On primary we want to make a /mnt/koji link to /mnt/fedora_koji/koji
|
|
#
|
|
|
|
- name: make a mnt/koji link
|
|
file: state=link src=/mnt/fedora_koji/koji dest=/mnt/koji
|
|
when: koji_hub_nfs is defined and koji_hub_nfs == "fedora_koji" and createrepo == True
|
|
tags:
|
|
- koji_builder
|
|
|
|
- name: make a mnt/koji link
|
|
file: state=link src=/mnt/fedora_koji/koji dest=/mnt/koji force=yes
|
|
when: inventory_hostname.startswith(('buildvm-s390x-11', 'buildvm-s390x-12', 'buildvm-s390x-13'))
|
|
tags:
|
|
- koji_builder
|
|
|
|
#
|
|
# alternative arch builders however want to link to just /mnt/fedora_koji
|
|
#
|
|
|
|
- name: make a mnt/koji link
|
|
file: state=link src=/mnt/fedora_koji dest=/mnt/koji
|
|
when: koji_hub_nfs is defined and koji_hub_nfs != "fedora_koji" and createrepo == True
|
|
tags:
|
|
- koji_builder
|
|
|
|
- name: mock site-defaults.cfg
|
|
template: src=builders/site-defaults.cfg dest=/etc/mock/site-defaults.cfg mode=0644 owner=root group=mock
|
|
when: not inventory_hostname.startswith(('bkernel'))
|
|
tags:
|
|
- koji_builder
|
|
- site-defaults
|
|
|
|
# x86_64 builders run both x86_64 and i686 builds, that requires multilib
|
|
# version of nosync installed to fully take advantage of nosync
|
|
- name: special pkgs for the x86_64 builders
|
|
package:
|
|
state: present
|
|
name:
|
|
- nosync.i686
|
|
when: ansible_architecture == 'x86_64'
|
|
tags:
|
|
- koji_builder
|
|
|
|
# Before, the builders had the "apache" role. This is a temporary play to remove the httpd daemon everywhere
|
|
- name: Uninstall httpd
|
|
package: name=httpd
|
|
state=absent
|
|
tags:
|
|
- koji_builder
|
|
- removehttpd
|
|
|
|
- name: Add the Apache group
|
|
group: name=apache
|
|
gid=48
|
|
system=yes
|
|
state=present
|
|
tags:
|
|
- koji_builder
|
|
- removehttpd
|
|
|
|
- name: Create the apache user
|
|
user: name=apache
|
|
uid=48
|
|
createhome=no
|
|
group=apache
|
|
home=/usr/share/httpd
|
|
shell=/sbin/nologin
|
|
system=yes
|
|
state=present
|
|
tags:
|
|
- koji_builder
|
|
- removehttpd
|
|
|
|
- name: make sure we are in permissive selinux mode
|
|
selinux: policy=targeted state=permissive
|
|
tags:
|
|
- koji_builder
|
|
- selinux
|
|
|
|
- name: Create directory for shared secrets
|
|
file:
|
|
path: /etc/kojid/secrets
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: 0660
|
|
tags:
|
|
- koji_builder
|
|
when: env == "staging"
|
|
|
|
# https://pagure.io/fedora-infrastructure/issue/6636
|
|
- name: install libkcapi to get increased sockets on armv7
|
|
dnf: name=libkcapi enablerepo=updates-testing state=present
|
|
tags:
|
|
- koji_builder
|
|
when: ansible_architecture == 'armv7l'
|
|
|
|
# set highmem_is_dirtyable in compose armv7 machines.
|
|
# see: https://bugzilla.redhat.com/show_bug.cgi?id=1504264
|
|
#
|
|
- name: set highmem_is_dirtyable on armv7 builders that are in the compose channel.
|
|
sysctl: name=vm.highmem_is_dirtyable value=1 state=present sysctl_set=yes reload=yes
|
|
tags:
|
|
- koji_builder
|
|
when: inventory_hostname.startswith(('buildvm-armv7-01.arm', 'buildvm-armv7-02', 'buildvm-armv7-03'))
|
|
|
|
#
|
|
# Add rngd so that virtual maachines have enough randomness to boot in our lifetimes
|
|
#
|
|
- name: Install rng-tools for entropy
|
|
package: name=rng-tools state=present
|
|
tags:
|
|
- koji_builder
|
|
- koji_builder/rngd
|
|
|
|
- name: Start rngd
|
|
service: name=rngd state=started enabled=yes
|
|
tags:
|
|
- koji_builder
|
|
- koji_builder/rngd
|
|
when: ansible_architecture != 's390x' and ansible_architecture != 'ppc64le'
|
|
|
|
- name: disable systemd-oomd we do not need or want it
|
|
systemd: name=systemd-oomd state=stopped enabled=no masked=true
|
|
tags:
|
|
- koji_builder
|
|
- koji_builder/oomd
|
|
|
|
- name: install script to update osbuild api ip in the firewall
|
|
template: src=osbuildapi-update.sh dest=/usr/local/bin/osbuildapi-update.sh mode=755
|
|
tags:
|
|
- koji_builder
|
|
- koji_builder/osbuildapi
|
|
|
|
- name: install cron job to run osbuild api ip update script every minute.
|
|
template: src=osbuildapi-update.cron dest=/etc/cron.d/osbuildapi-update.cron mode=644
|
|
tags:
|
|
- koji_builder
|
|
- koji_builder/osbuildapi
|
|
|
|
- name: create override dir for systemd-nspawn containers config
|
|
file:
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: 0755
|
|
path: /etc/systemd/system/machine-.scope.d
|
|
when: inventory_hostname.startswith(('buildhw-a64'))
|
|
tags:
|
|
- koji_builder
|
|
- koji_builder/nspawn
|
|
|
|
- name: create override config for systemd-nspawn containers to allow coredumps
|
|
template: src=nspawn-override.conf dest=/etc/systemd/system/machine-.scope.d/80-infra.conf mode=0644
|
|
when: inventory_hostname.startswith(('buildhw-a64'))
|
|
tags:
|
|
- koji_builder
|
|
- koji_builder/nspawn
|