mirror of
https://pagure.io/fedora-infra/ansible.git
synced 2026-06-27 23:57:02 +08:00
dbbf94a411
Almost global anyway, i.e. inside the VPN. The ipa/client-based shell access and sudo rules are only effective for staging right now, the respective playbook bits are masked out for prod. - Assign Ansible host groups to IPA host groups, the latter don't care about 'stg' in the name and use dashes rather than underscores. - Distill shell access groups from fas_client_groups in group and host vars. - Let all `sysadmin-*` groups in the previous list run anything via sudo in the host group (except bastion & batcave). - Remove `fas_client_groups` from staging host and group vars. - Remove sudoers from staging host and group vars if only `sysadmin-*` groups have shell access. - Set up `ipa_client_shell_groups` on bastion to be a super set of the same on batcave. Newly created IPA host groups: - autosign - badges - basset - bastion - batcave - blockerbugs - bodhi - bugzilla2fedmsg - busgateway - datagrepper - dbserver - dns - fedimg - github2fedmsg - ipa - kernel-qa - kerneltest - kojibuilder - kojihub - kojipkgs - logging - mailman - memcached - mirrormanager - nagios - notifs - oci-registry - odcs - openqa - openqa-workers - osbs - packages - pdc-web - pkgs - proxies - rabbitmq - releng-compose - resultsdb - secondary - sign-bridge - sundries - value - wiki Signed-off-by: Nils Philippsen <nils@redhat.com>
46 lines
1.0 KiB
Plaintext
46 lines
1.0 KiB
Plaintext
---
|
|
# Define resources for this group of hosts here.
|
|
lvm_size: 60000
|
|
mem_size: 8192
|
|
num_cpus: 2
|
|
|
|
tcp_ports: [ 80, 443, 8443]
|
|
|
|
fas_client_groups: sysadmin-releng,fi-apprentice,sysadmin-noc,sysadmin-veteran,sysadmin-osbs
|
|
sudoers: "{{ private }}/files/sudo/osbs-sudoers"
|
|
|
|
ipa_host_group: osbs
|
|
ipa_host_group_desc: OpenShift Build Service
|
|
ipa_client_shell_groups:
|
|
- fi-apprentice
|
|
- sysadmin-noc
|
|
- sysadmin-osbs
|
|
- sysadmin-releng
|
|
- sysadmin-veteran
|
|
ipa_client_sudo_groups:
|
|
- sysadmin-noc
|
|
- sysadmin-osbs
|
|
- sysadmin-releng
|
|
- sysadmin-veteran
|
|
|
|
docker_cert_dir: "/etc/docker/certs.d/candidate-registry.fedoraproject.org"
|
|
docker_registry: "candidate-registry.fedoraproject.org"
|
|
source_registry: "registry.fedoraproject.org"
|
|
|
|
osbs_url: "osbs.fedoraproject.org"
|
|
osbs_koji_username: "kojibuilder"
|
|
|
|
koji_url: "koji.fedoraproject.org"
|
|
|
|
osbs_client_conf_path: /etc/osbs.conf
|
|
|
|
baseiptables: False
|
|
|
|
#openshift_ansible_upgrading: True
|
|
|
|
# docker images required by OpenShift Origin
|
|
openshift_required_images:
|
|
- "openshift/origin-pod"
|
|
|
|
nm_controlled_resolv: True
|