mirror of
https://pagure.io/fedora-infra/ansible.git
synced 2026-05-01 05:51:56 +08:00
0571feb2ce
In the beginning, this just handled Azure images. Now it does Azure, AWS, GCP, and containers. Currently, it processes images serially, which is mostly okay. However, it does mean that whatever service is handled last has to wait for all the others to succeed before it starts, and it also means if any of the handlers for their respective platform fail, it retries *all* the images again. For most things this is a no-op (or a few inexpensive calls), but it does have to re-download the image from Koji to checksum it. This adds an AMQP message queue for each content type we handle, and produces a fedora-messaging config for each content type. The deployment is now made up of 4 containers: azure-image-uploader, aws-image-uploader, container-image-uploader, and google-cloud-image-uploader. They only differ in the secrets injected into them and the fedora-messaging config file they use. The end result is that images should be available faster and its more resilient to remote services being down. Finally, it's worth noting that this bumps the warning threshold for queue sizes. It can take some services (Azure and AWS) upwards of 30 minutes to replicate the images around the world, and since we subscribe to _any_ compose status changes, it's not unreasonable for 5-10 messages to stack up when we hit a compose change that is "FINISHED" with images. Signed-off-by: Jeremy Cline <jeremycline@linux.microsoft.com>
169 lines
5.3 KiB
YAML
169 lines
5.3 KiB
YAML
---
|
|
- name: Make the app be real
|
|
hosts: os_control[0]:os_control_stg[0]
|
|
user: root
|
|
gather_facts: false
|
|
|
|
vars_files:
|
|
- /srv/web/infra/ansible/vars/global.yml
|
|
- "/srv/private/ansible/vars.yml"
|
|
- /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml
|
|
|
|
roles:
|
|
- role: rabbit/user
|
|
user_name: "cloud-image-uploader{{ env_suffix }}"
|
|
user_sent_topics: ^org\.fedoraproject\.{{ env_short }}\.fedora_image_uploader\..*
|
|
|
|
- role: rabbit/queue
|
|
queue_username: "cloud-image-uploader{{ env_suffix }}"
|
|
queue_name: "cloud-image-uploader{{ env_suffix }}-aws"
|
|
queue_routing_keys:
|
|
- "org.fedoraproject.*.pungi.compose.status.change"
|
|
queue_thresholds:
|
|
warning: 25
|
|
critical: 50
|
|
|
|
- role: rabbit/queue
|
|
queue_username: "cloud-image-uploader{{ env_suffix }}"
|
|
queue_name: "cloud-image-uploader{{ env_suffix }}-azure"
|
|
queue_routing_keys:
|
|
- "org.fedoraproject.*.pungi.compose.status.change"
|
|
queue_thresholds:
|
|
warning: 25
|
|
critical: 50
|
|
|
|
- role: rabbit/queue
|
|
queue_username: "cloud-image-uploader{{ env_suffix }}"
|
|
queue_name: "cloud-image-uploader{{ env_suffix }}-containers"
|
|
queue_routing_keys:
|
|
- "org.fedoraproject.*.pungi.compose.status.change"
|
|
queue_thresholds:
|
|
warning: 25
|
|
critical: 50
|
|
|
|
- role: rabbit/queue
|
|
queue_username: "cloud-image-uploader{{ env_suffix }}"
|
|
queue_name: "cloud-image-uploader{{ env_suffix }}-gcp"
|
|
queue_routing_keys:
|
|
- "org.fedoraproject.*.pungi.compose.status.change"
|
|
queue_thresholds:
|
|
warning: 25
|
|
critical: 50
|
|
|
|
- role: openshift/project
|
|
project_app: cloud-image-uploader
|
|
project_description: AMQP consumer that uploads Cloud images to cloud providers
|
|
project_appowners:
|
|
- jcline
|
|
|
|
- role: openshift/object
|
|
object_app: cloud-image-uploader
|
|
object_file: imagestream.yml
|
|
object_objectname: imagestream.yml
|
|
|
|
- role: openshift/object
|
|
object_app: cloud-image-uploader
|
|
object_template: buildconfig.yml.j2
|
|
object_objectname: buildconfig.yml
|
|
|
|
- role: openshift/object
|
|
object_app: cloud-image-uploader
|
|
object_template: configmap.yml.j2
|
|
object_objectname: configmap.yml
|
|
vars:
|
|
azure_image_regions:
|
|
- "australiaeast"
|
|
- "brazilsouth"
|
|
- "canadacentral"
|
|
- "centralindia"
|
|
- "centralus"
|
|
- "eastasia"
|
|
- "eastus"
|
|
- "eastus2"
|
|
- "francecentral"
|
|
- "germanywestcentral"
|
|
- "israelcentral"
|
|
- "italynorth"
|
|
- "japaneast"
|
|
- "koreacentral"
|
|
- "mexicocentral"
|
|
- "northeurope"
|
|
- "norwayeast"
|
|
- "polandcentral"
|
|
- "qatarcentral"
|
|
- "southafricanorth"
|
|
- "southcentralus"
|
|
- "southeastasia"
|
|
- "spaincentral"
|
|
- "swedencentral"
|
|
- "switzerlandnorth"
|
|
- "uaenorth"
|
|
- "uksouth"
|
|
- "westeurope"
|
|
- "westus2"
|
|
- "westus3"
|
|
|
|
- role: openshift/secret-file
|
|
secret_file_app: cloud-image-uploader
|
|
secret_file_secret_name: cloud-image-uploader-fedora-messaging-key
|
|
secret_file_key: cloud-image-uploader.key
|
|
secret_file_privatefile: "rabbitmq/{{env}}/pki/private/cloud-image-uploader{{env_suffix}}.key"
|
|
|
|
- role: openshift/secret-file
|
|
secret_file_app: cloud-image-uploader
|
|
secret_file_secret_name: cloud-image-uploader-fedora-messaging-crt
|
|
secret_file_key: cloud-image-uploader.crt
|
|
secret_file_privatefile: "rabbitmq/{{env}}/pki/issued/cloud-image-uploader{{env_suffix}}.crt"
|
|
|
|
- role: openshift/secret-file
|
|
secret_file_app: cloud-image-uploader
|
|
secret_file_secret_name: cloud-image-uploader-fedora-messaging-ca
|
|
secret_file_key: cloud-image-uploader.ca
|
|
secret_file_privatefile: "rabbitmq/{{env}}/ca-combined.crt"
|
|
|
|
- role: openshift/secret-file
|
|
secret_file_app: cloud-image-uploader
|
|
secret_file_secret_name: registry-fedoraproject-cert
|
|
secret_file_key: registry-fedoraproject.cert
|
|
secret_file_privatefile: "docker-registry/{{env}}/pki/issued/containerstable.crt"
|
|
|
|
- role: openshift/secret-file
|
|
secret_file_app: cloud-image-uploader
|
|
secret_file_secret_name: registry-fedoraproject-key
|
|
secret_file_key: registry-fedoraproject.key
|
|
secret_file_privatefile: "docker-registry/{{env}}/pki/private/containerstable.key"
|
|
|
|
- role: openshift/secret-file
|
|
secret_file_app: cloud-image-uploader
|
|
secret_file_secret_name: cloud-image-uploader-google-cloud-key
|
|
secret_file_key: google_cloud_image_uploader.json
|
|
secret_file_privatefile: "gcp/{{env}}/image_uploader.json"
|
|
|
|
- role: openshift/object
|
|
object_app: cloud-image-uploader
|
|
object_template: secret.yml.j2
|
|
object_objectname: secret.yml
|
|
|
|
- role: openshift/object
|
|
object_app: cloud-image-uploader
|
|
object_template: aws-secrets.yml.j2
|
|
object_objectname: aws-secrets.yml
|
|
|
|
- role: openshift/object
|
|
object_app: cloud-image-uploader
|
|
object_template: container-secrets.yml.j2
|
|
object_objectname: container-secrets.yml
|
|
|
|
- role: openshift/start-build
|
|
start_build_app: cloud-image-uploader
|
|
start_build_buildname: cloud-image-uploader-build
|
|
start_build_objectname: cloud-image-uploader-build
|
|
tags:
|
|
- never
|
|
- build
|
|
|
|
- role: openshift/object
|
|
object_app: cloud-image-uploader
|
|
object_template: deployment.yml.j2
|
|
object_objectname: deployment.yml
|