From 8d74b615870ff445d43c2633f925f1fed6f32c83 Mon Sep 17 00:00:00 2001 From: Matej Focko Date: Mon, 5 Oct 2026 12:36:58 +0200 Subject: [PATCH 01/10] docs: update the renewal docs to use wildcards Fixes PACKIT-5244 Signed-off-by: Matej Focko --- docs/deployment/tls-certs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/deployment/tls-certs.md b/docs/deployment/tls-certs.md index 09b59b2..03c18ac 100644 --- a/docs/deployment/tls-certs.md +++ b/docs/deployment/tls-certs.md @@ -58,7 +58,7 @@ Or use the combo of nixpkg + devenv.sh. Run certbot: - $ certbot certonly --config-dir ~/.certbot --work-dir ~/.certbot --logs-dir ~/.certbot --manual --preferred-challenges dns --email hello@packit.dev -d prod.packit.dev -d stg.packit.dev -d dashboard.packit.dev -d dashboard.stg.packit.dev -d workers.packit.dev -d workers.stg.packit.dev + $ certbot certonly --config-dir ~/.certbot --work-dir ~/.certbot --logs-dir ~/.certbot --manual --preferred-challenges dns --email hello@packit.dev -d \*.packit.dev -d \*.stg.packit.dev -d \*.prod.packit.dev -d \*.internal.packit.dev You will be asked to set TXT record for every domain requested: From f7707768658fd4907f25eef6e244d4b4e4154663 Mon Sep 17 00:00:00 2001 From: Matej Focko Date: Mon, 5 Oct 2026 18:02:17 +0200 Subject: [PATCH 02/10] chore(devenv): update devenv.lock and remove .envrc MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit • Bump the devenv environment • Drop the ‹.envrc› in favour of the built-in devenv hook Signed-off-by: Matej Focko --- .envrc | 9 --------- devenv.lock | 12 ++++++------ 2 files changed, 6 insertions(+), 15 deletions(-) delete mode 100644 .envrc diff --git a/.envrc b/.envrc deleted file mode 100644 index 044ee00..0000000 --- a/.envrc +++ /dev/null @@ -1,9 +0,0 @@ -# shellcheck disable=all - -export DIRENV_WARN_TIMEOUT=20s - -eval "$(devenv direnvrc)" - -# The use_devenv function supports passing flags to the devenv command -# For example: use devenv --impure --option services.postgres.enable:bool true -use devenv diff --git a/devenv.lock b/devenv.lock index 365f7a5..8f3ff4d 100644 --- a/devenv.lock +++ b/devenv.lock @@ -3,11 +3,11 @@ "devenv": { "locked": { "dir": "src/modules", - "lastModified": 1777454881, - "narHash": "sha256-AkVmSToNoYX/f1U1mHijwv4Kmyh3NRshR6JSjBwHggc=", + "lastModified": 1790701375, + "narHash": "sha256-0FpLHIRDYiyo3EMTnMQSobZQknZaa3JuWo6vmMCK76o=", "owner": "cachix", "repo": "devenv", - "rev": "2bc51f06128611db5f778e3c95296399354aed85", + "rev": "fe20b5cba7ab5e93ae73f956a8d3efc50e1753f4", "type": "github" }, "original": { @@ -19,11 +19,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1777268161, - "narHash": "sha256-bxrdOn8SCOv8tN4JbTF/TXq7kjo9ag4M+C8yzzIRYbE=", + "lastModified": 1791048980, + "narHash": "sha256-KgItSKML8Xvte0B7/uGnBDsYzSnnKHcOaiUbgWBXLXw=", "owner": "nixos", "repo": "nixpkgs", - "rev": "1c3fe55ad329cbcb28471bb30f05c9827f724c76", + "rev": "a7868a727837f3c09cee2ce0ca671c76b1589fed", "type": "github" }, "original": { From 94edcff1bd185f3e1bf2df3e2d53d1d2f53e8773 Mon Sep 17 00:00:00 2001 From: Matej Focko Date: Tue, 6 Oct 2026 09:33:51 +0200 Subject: [PATCH 03/10] feat(internal): adjust gitignore and add vars template Related to PACKIT-5358 Signed-off-by: Matej Focko --- .gitignore | 1 + vars/packit/internal_template.yml | 78 +++++++++++++++++++++++++++++++ 2 files changed, 79 insertions(+) create mode 100644 vars/packit/internal_template.yml diff --git a/.gitignore b/.gitignore index 9ccd8d3..a8eff45 100644 --- a/.gitignore +++ b/.gitignore @@ -6,6 +6,7 @@ vars/**/*.yml secrets/packit/prod/* secrets/packit/stg/* +secrets/packit/internal/* secrets/stream/prod/* secrets/stream/stg/* secrets/fedora-source-git/prod/* diff --git a/vars/packit/internal_template.yml b/vars/packit/internal_template.yml new file mode 100644 index 0000000..63b7073 --- /dev/null +++ b/vars/packit/internal_template.yml @@ -0,0 +1,78 @@ +# Copyright Contributors to the Packit project. +# SPDX-License-Identifier: MIT + +# ------------------------------------------------------------------- +# Variables needed by Ansible playbooks in playbooks/ +# ------------------------------------------------------------------- + +# Openshift project/namespace name +# [WARNING] Be careful when changing this value as it is explicitly checked in +# the Packit Service (API) and postgresql deployments +tenant: packit-internal +project: packit-internal--prod + +# Openshift cluster url +# For the URL of the MP+ API endpoint, see Bitwarden Secure note +host: ‹TODO› + +# oc login , oc whoami -t +# OR via Openshift web GUI: click on your login in top right corner, 'Copy Login Command', take the part after --token= +api_key: "" + +# validate_certs: true + +# Check that the deployment resources are up-to-date +# check_up_to_date: true + +# Check that the current vars file us up to date with the template +# check_vars_template_diff: true + +with_tokman: false +with_fedmsg: false +with_sandbox: false + +# kv_database options: redis redict valkey +# Current default on both deployments: valkey +kv_database: valkey +# with_kv_database: true + +# with_redis_commander: false + +with_flower: true + +# with_beat: true + +# with_dashboard: true + +# with_pushgateway: true + +# with_repository_cache: true +# repository_cache_storage: 4Gi + +with_fluentd_sidecar: false + +image: quay.io/packit/packit-service:prod +image_worker: quay.io/packit/packit-worker:prod +# [TODO] will probably need to be adjusted +image_dashboard: quay.io/packit/dashboard:prod + +# Path to secrets (in case you don't have it in the root of this project) +# path_to_secrets: ../secrets + +# Used in dev/Zuul deployment to tag & push images to cluster. +# It's set to "/usr/bin/podman" if there's podman installed, or to 'docker' otherwise. +# If you still want to use docker even when podman is installed, set: +# container_engine: docker + +# We're using 15 on MP+ +postgres_version: 15 + +# Celery retry parameters +# celery_retry_limit: 2 +# celery_retry_backoff: 3 + +# Number of worker pods to be deployed to serve the queues +workers_all_tasks: 0 +workers_short_running: 1 +workers_long_running: 1 +# pushgateway_address: http://pushgateway From 03e9d4d26033aec4bebdf1f882c5c06f733f4978 Mon Sep 17 00:00:00 2001 From: Matej Focko Date: Tue, 6 Oct 2026 09:34:51 +0200 Subject: [PATCH 04/10] fix(internal): correctly set firewall shards and hosts MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit For internal deployment we’re running behind firewall, therefore: • “shard” is ‹internal› to disallow any connections from the internet • hosts were only able to distinguish between stage and production Related to PACKIT-5358 Signed-off-by: Matej Focko --- openshift/dashboard.yml.j2 | 8 ++++++-- openshift/nginx.yml.j2 | 9 +++++++-- openshift/packit-service.yml.j2 | 2 +- 3 files changed, 14 insertions(+), 5 deletions(-) diff --git a/openshift/dashboard.yml.j2 b/openshift/dashboard.yml.j2 index b9846f0..c3e2225 100644 --- a/openshift/dashboard.yml.j2 +++ b/openshift/dashboard.yml.j2 @@ -80,10 +80,14 @@ metadata: {% if managed_platform %} labels: paas.redhat.com/appcode: {{ appcode }} - shard: external + shard: {{ 'internal' if deployment == 'internal' else 'external' }} {% endif %} spec: - host: "{{ 'dashboard.stg.packit.dev' if deployment == 'stg' else 'dashboard.packit.dev' if deployment == 'prod'}}" +{% if deployment == 'prod' %} + host: dashboard.packit.dev +{% else %} + host: "dashboard.{{ deployment }}.packit.dev" +{% endif %} port: targetPort: packit-dashboard-https to: diff --git a/openshift/nginx.yml.j2 b/openshift/nginx.yml.j2 index 390bd9c..c8ed949 100644 --- a/openshift/nginx.yml.j2 +++ b/openshift/nginx.yml.j2 @@ -133,10 +133,15 @@ metadata: labels: paas.redhat.com/appcode: {{ appcode }} # used by internal Grafana - shard: external + shard: {{ 'internal' if deployment == 'internal' else 'external' }} {% endif %} + spec: - host: "{{ 'workers.stg.packit.dev' if deployment == 'stg' else 'workers.packit.dev' if deployment == 'prod'}}" +{% if deployment == 'prod' %} + host: workers.packit.dev +{% else %} + host: "workers.{{ deployment }}.packit.dev" +{% endif %} port: targetPort: nginx-https to: diff --git a/openshift/packit-service.yml.j2 b/openshift/packit-service.yml.j2 index ca6fc67..8b14d02 100644 --- a/openshift/packit-service.yml.j2 +++ b/openshift/packit-service.yml.j2 @@ -170,7 +170,7 @@ metadata: {% if managed_platform %} labels: paas.redhat.com/appcode: {{ appcode }} - shard: external + shard: {{ 'internal' if deployment == 'internal' else 'external' }} {% endif %} spec: # for local deployment (dev) creates default route for testing. From d243e478e22eeeccacb70eb5d89fb4f483d58a66 Mon Sep 17 00:00:00 2001 From: Matej Focko Date: Tue, 6 Oct 2026 09:36:16 +0200 Subject: [PATCH 05/10] =?UTF-8?q?fix(internal):=20adjust=20=E2=80=B9servic?= =?UTF-8?q?ephase=E2=80=BA?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Internal deployment is technically a production too. Related to PACKIT-5358 Signed-off-by: Matej Focko --- tasks/set-facts.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tasks/set-facts.yml b/tasks/set-facts.yml index ce95b97..d9203c1 100644 --- a/tasks/set-facts.yml +++ b/tasks/set-facts.yml @@ -40,7 +40,7 @@ - name: Set servicephase for production ansible.builtin.set_fact: servicephase: prod - when: deployment == "prod" + when: 'deployment in ("prod", "internal")' - name: Set Redis-like hostname tags: From d059cf0f7e9531fa80f1598c0c5de17e7cbe9450 Mon Sep 17 00:00:00 2001 From: Matej Focko Date: Tue, 6 Oct 2026 13:41:54 +0200 Subject: [PATCH 06/10] feat: add templates for internal deployment secrets Related to PACKIT-5358 Signed-off-by: Matej Focko --- secrets/packit/internal/centpkg-sig.conf.j2 | 34 ++++++++ secrets/packit/internal/fedora.toml.j2 | 87 +++++++++++++++++++ .../packit/internal/packit-service.yaml.j2 | 84 ++++++++++++++++++ secrets/packit/internal/ssh_config | 6 ++ 4 files changed, 211 insertions(+) create mode 100644 secrets/packit/internal/centpkg-sig.conf.j2 create mode 100644 secrets/packit/internal/fedora.toml.j2 create mode 100644 secrets/packit/internal/packit-service.yaml.j2 create mode 100644 secrets/packit/internal/ssh_config diff --git a/secrets/packit/internal/centpkg-sig.conf.j2 b/secrets/packit/internal/centpkg-sig.conf.j2 new file mode 100644 index 0000000..b3051aa --- /dev/null +++ b/secrets/packit/internal/centpkg-sig.conf.j2 @@ -0,0 +1,34 @@ +[centpkg-sig] +lookaside = https://git.centos.org/sources +lookasidehash = sha512 +lookaside_cgi = https://git.centos.org/sources/upload_sig.cgi +# lookaside_cgi = https://git.centos.org/sources/upload.cgi +distgit_namespaced = True +distgit_namespaces = rpms +gitbaseurl = git+ssh://git@gitlab.com/CentOS/%(repo)s.git +anongiturl = https://gitlab.com/CentOS/%(repo)s.git +branchre = c\d+s?-sig-.+|master$ +kojiprofile = cbs +build_client = cbs +lookaside_namespaced = True +git_excludes = + i386/ + i686/ + x86_64/ + ppc/ + ppc64/ + ia64/ + mips/ + arm/ + noarch/ + /*.src.rpm + /build*.log + /.build-*.log + results_*/ + clog + +[centpkg-sig.distgit] +apibaseurl = https://gitlab.com +{% set gitlab_forge = git_forges | selectattr('name', 'equalto', 'gitlab.com') | first %} +{% set gitlab_fields = gitlab_forge['fields'] | items2dict(key_name='name') %} +token = {{ gitlab_fields['token:key'] }} diff --git a/secrets/packit/internal/fedora.toml.j2 b/secrets/packit/internal/fedora.toml.j2 new file mode 100644 index 0000000..fc0db67 --- /dev/null +++ b/secrets/packit/internal/fedora.toml.j2 @@ -0,0 +1,87 @@ +# A basic configuration for Fedora's message broker, using the example callback +# which simply prints messages to standard output. +# +# This file is in the TOML format. +amqp_url = "amqps://fedora:@rabbitmq.fedoraproject.org/%2Fpublic_pubsub" + +[tls] +ca_cert = "/etc/fedora-messaging/cacert.pem" +keyfile = "/etc/fedora-messaging/fedora-key.pem" +certfile = "/etc/fedora-messaging/fedora-cert.pem" + +[client_properties] +app = "Packit" +# Some suggested extra fields: +# URL of the project that provides this consumer +app_url = "https://github.com/packit/packit-service-fedmsg" +# Contact emails for the maintainer(s) of the consumer - in case the +# broker admin needs to contact them, for e.g. +app_contacts_email = ["hello@packit.dev"] + +[exchanges."amq.topic"] +type = "topic" +durable = true +auto_delete = false +arguments = {} + +# Queue names *must* be in the normal UUID format: run "uuidgen" and use the +# output as your queue name. If you don't define a queue here, the server will +# generate a queue name for you. This queue will be non-durable, auto-deleted and +# exclusive. +# If your queue is not exclusive, anyone can connect and consume from it, causing +# you to miss messages, so do not share your queue name. Any queues that are not +# auto-deleted on disconnect are garbage-collected after approximately one hour. +# +# If you require a stronger guarantee about delivery, please talk to Fedora's +# Infrastructure team. +[queues.{{ vault.fedora_messaging.queue }}] +# Keep messages on broker restart +durable = true +# Delete the queue when the client terminates +auto_delete = true +# Refuse multiple simultaneous consumers +exclusive = true +arguments = {} + +[[bindings]] +queue = "{{ vault.fedora_messaging.queue }}" +exchange = "amq.topic" +routing_keys = [] + +[log_config] +version = 1 +disable_existing_loggers = true + +[log_config.formatters.simple] +format = "[%(asctime)s %(levelname)s %(name)s] %(message)s" + +[log_config.handlers.console] +class = "logging.StreamHandler" +formatter = "simple" +stream = "ext://sys.stdout" + +[log_config.loggers.fedora_messaging] +level = "INFO" +propagate = false +handlers = ["console"] + +[log_config.loggers.twisted] +level = "INFO" +propagate = false +handlers = ["console"] + +[log_config.loggers.pika] +level = "WARNING" +propagate = false +handlers = ["console"] + +# If your consumer sets up a logger, you must add a configuration for it +# here in order for the messages to show up. +[log_config.loggers.packit_service_fedmsg] +level = "DEBUG" +propagate = false +handlers = ["console"] + +[log_config.root] +level = "ERROR" +handlers = ["console"] diff --git a/secrets/packit/internal/packit-service.yaml.j2 b/secrets/packit/internal/packit-service.yaml.j2 new file mode 100644 index 0000000..08fb175 --- /dev/null +++ b/secrets/packit/internal/packit-service.yaml.j2 @@ -0,0 +1,84 @@ +--- +deployment: prod +debug: true +fas_user: packit +keytab_path: /secrets/fedora.keytab +validate_webhooks: true + +# {{ ansible_managed }} +# Please adjust the values in the respective logins in the Bitwarden Vault +authentication: +{% for forge in git_forges %} +{% set fields = forge['fields'] | items2dict(key_name='name') %} + {{ forge['name'] }}: + instance_url: {{ forge['login']['uris'][0].uri }} + # Login: {{ forge['login']['username'] }} + # Token name: {{ fields.get('token:name') }} + # Scope: {{ fields.get('token:permissions') }} + # Expiration: {{ fields.get('token:expiration') }} + token: {{ fields.get('token:key') }} +{% if 'type' in fields and 'github_app' in fields['type'] %} + # GitHub App set up + github_app_id: '{{ fields.get('app_id') }}' + github_app_private_key_path: {{ fields.get('app_private_key_path') }} +{% endif %} +{% if 'token:type' in fields %} + type: {{ fields.get('token:type') }} +{% endif %} + +{% endfor %} + +{{ vault.packit_service | to_nice_yaml }} + +testing_farm_api_url: https://api.testing-farm.io/v0.1/ +enabled_projects_for_internal_tf: [] + +repository_cache: /repository-cache +# The maintenance of the cache (adding, updating) is done externally, +# not in the packit/packit-service code. +add_repositories_to_repository_cache: false + +# [TODO]: Adjust, if needed, during migration of prod to MP+ +appcode: PCKT-002 + +admins: # GitHub usernames + - jpopelka + - lachmanfrantisek + - lbarcziova + - TomasTomecek + - thrix # Miro Vadkerti + - psss # Petr Splichal + - csomh + - mfocko + - majamassarini + - nforro + +server_name: internal.packit.dev +dashboard_url: https://dashboard.internal.packit.dev + +default_parse_time_macros: + fedora: 0 + +rate_limit_threshold: 200 + +# Ignored & disabled + +command_handler: sandcastle +command_handler_work_dir: /tmp/sandcastle +command_handler_image_reference: quay.io/packit/sandcastle:prod +command_handler_k8s_namespace: packit-internal--prod-sandbox +command_handler_pvc_volume_specs: + - path: /repository-cache + pvc_from_env: SANDCASTLE_REPOSITORY_CACHE_VOLUME + read_only: true +command_handler_storage_class: aws-ebs + +projects_to_sync: [] + +fedora_ci_run_by_default: false +fedora_ci: + disabled_projects: [] + disabled_projects_for_eln: [] + disabled_projects_for_logdetective: [] + +logdetective_enabled: false diff --git a/secrets/packit/internal/ssh_config b/secrets/packit/internal/ssh_config new file mode 100644 index 0000000..ec9a19c --- /dev/null +++ b/secrets/packit/internal/ssh_config @@ -0,0 +1,6 @@ +Host gitlab.cee.redhat.com + User git + Hostname gitlab.cee.redhat.com + + IdentitiesOnly yes + IdentityFile /home/packit/.ssh/id_ed25519 From df6ab986bfdbc35c21dcc9a19708aa64c5d13552 Mon Sep 17 00:00:00 2001 From: Matej Focko Date: Wed, 7 Oct 2026 09:26:59 +0200 Subject: [PATCH 07/10] docs: adjust docs for internal instance MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Suggested-by: Alžběta Kučerová Signed-off-by: Matej Focko --- docs/deployment/tls-certs.md | 4 +++- docs/deployment/vars.md | 2 +- playbooks/cleanup.yml | 2 +- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/docs/deployment/tls-certs.md b/docs/deployment/tls-certs.md index 03c18ac..32fc9bf 100644 --- a/docs/deployment/tls-certs.md +++ b/docs/deployment/tls-certs.md @@ -13,6 +13,8 @@ We are using multi-domain wildcard certificates for the following domains: - `*.packit.dev` - `*.stg.packit.dev` +- `*.prod.packit.dev` +- `*.internal.packit.dev` In case the procedure bellow does not work, [previously used http challenge](https://github.com/packit/deployment/blob/008f5eaad69a620c54784f1fc19c7c775af9ec7d/README.md#obtaining-a-lets-encrypt-cert-using-certbot) @@ -113,7 +115,7 @@ to `secrets-tls-certs` item in our shared `Packit` collection in Bitwarden vault for cert in fullchain privkey; do scripts/update_oc_secret.sh packit-secrets ~/.certbot/live/prod.packit.dev/${cert}.pem; done -or update `api_key` in `vars/{packit|stream|fedora-source-git}/{prod|stg}.yml` and run: +or update `api_key` in `vars/{packit|stream|fedora-source-git}/{prod|stg|internal}.yml` and run: `SERVICE=‹service› DEPLOYMENT=‹deployment› make deploy TAGS=secrets` diff --git a/docs/deployment/vars.md b/docs/deployment/vars.md index 011435e..d5d30c9 100644 --- a/docs/deployment/vars.md +++ b/docs/deployment/vars.md @@ -8,7 +8,7 @@ There are also `{service}/{deployment}_template.yml` files, where - `{service}` is either `packit` or `stream` -- `{deployment}` is one of `prod`, `stg` or `dev` +- `{deployment}` is one of `prod`, `stg`, `internal`, or `dev` You have to copy `{service}/{deployment}_template.yml` to `{service}/{deployment}.yml` depending on what service and environment you want to deploy to diff --git a/playbooks/cleanup.yml b/playbooks/cleanup.yml index 19cec28..599e082 100644 --- a/playbooks/cleanup.yml +++ b/playbooks/cleanup.yml @@ -23,6 +23,6 @@ - name: Delete all ansible.builtin.command: oc delete all,cm,pvc --all - when: deployment != "prod" + when: 'deployment not in ("prod", "internal")' # on stage this always changes something changed_when: true From 50b309274483b246fb96355612335b70bee4c295 Mon Sep 17 00:00:00 2001 From: Matej Focko Date: Wed, 7 Oct 2026 09:40:18 +0200 Subject: [PATCH 08/10] =?UTF-8?q?fix:=20set=20=E2=80=B9with=5Fsandbox?= =?UTF-8?q?=E2=80=BA=20only=20if=20it=E2=80=99s=20not=20defined?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Noticed this during the deployment of the internal instance, also it has been pointed out during the review by @betulependule. Signed-off-by: Matej Focko --- roles/deploy/tasks/main.yml | 4 ++-- tasks/set-facts.yml | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/roles/deploy/tasks/main.yml b/roles/deploy/tasks/main.yml index 16bbe08..6991461 100644 --- a/roles/deploy/tasks/main.yml +++ b/roles/deploy/tasks/main.yml @@ -178,7 +178,7 @@ loop: "{{ range(0, workers_all_tasks) | list }}" tags: - packit-worker - when: workers_all_tasks > 0 and with_repository_cache + when: workers_all_tasks > 0 and with_repository_cache and with_sandbox - name: Deploy packit-worker to serve all queues vars: @@ -226,7 +226,7 @@ loop: "{{ range(0, workers_long_running) | list }}" tags: - packit-worker - when: workers_long_running > 0 and with_repository_cache + when: workers_long_running > 0 and with_repository_cache and with_sandbox - name: Deploy packit-worker to serve long-running and rate-limited queue vars: diff --git a/tasks/set-facts.yml b/tasks/set-facts.yml index d9203c1..ba30206 100644 --- a/tasks/set-facts.yml +++ b/tasks/set-facts.yml @@ -11,6 +11,7 @@ - name: Set with_sandbox ansible.builtin.set_fact: with_sandbox: "{{ service == 'packit' }}" + when: with_sandbox is undefined tags: - always From b36664297856e8fc5bca862f8777afff8746006b Mon Sep 17 00:00:00 2001 From: Matej Focko Date: Wed, 7 Oct 2026 11:39:12 +0200 Subject: [PATCH 09/10] =?UTF-8?q?style:=20use=20lists=20for=20=E2=80=B9and?= =?UTF-8?q?=E2=80=BA-combined=20conditions?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit For details see https://docs.ansible.com/projects/ansible/latest/playbook_guide/playbooks_conditionals.html#:~:text=You%20can%20use%20logical%20operators%20to%20combine%20conditions.%20When%20you%20have%20multiple%20conditions%20that%20all%20need%20to%20be%20true%20(that%20is%2C%20a%20logical%20and)%2C%20you%20can%20specify%20them%20as%20a%20list%3A Signed-off-by: Matej Focko --- playbooks/oc-cluster-run.yml | 4 +++- playbooks/zuul-deploy.yml | 4 +++- roles/deploy/tasks/main.yml | 14 +++++++++++--- tasks/check-up-to-date.yml | 4 +++- 4 files changed, 20 insertions(+), 6 deletions(-) diff --git a/playbooks/oc-cluster-run.yml b/playbooks/oc-cluster-run.yml index 4df3c67..b9f0d5c 100644 --- a/playbooks/oc-cluster-run.yml +++ b/playbooks/oc-cluster-run.yml @@ -26,7 +26,9 @@ - name: Rebuild pull_secret from its parts ansible.builtin.set_fact: pull_secret: "{{ pull_secret_part_1 }}{{ pull_secret_part_2 }}{{ pull_secret_part_3 }}{{ pull_secret_part_4 }}{{ pull_secret_part_5 }}{{ pull_secret_part_6 }}{{ pull_secret_part_7 }}" - when: pull_secret == "" and pull_secret_part_1 != "" + when: + - pull_secret == "" + - pull_secret_part_1 != "" - name: Check pull secret is not empty ansible.builtin.fail: diff --git a/playbooks/zuul-deploy.yml b/playbooks/zuul-deploy.yml index 96dfb6d..0f5be47 100644 --- a/playbooks/zuul-deploy.yml +++ b/playbooks/zuul-deploy.yml @@ -21,7 +21,9 @@ ansible.builtin.pip: name: Jinja2==2.8.1 become: true - when: (ansible_facts['distribution'] == "CentOS" and ansible_facts['distribution_major_version'] == "7") + when: + - ansible_facts['distribution'] == "CentOS" + - ansible_facts['distribution_major_version'] == "7" - name: Get token ansible.builtin.command: oc whoami -t diff --git a/roles/deploy/tasks/main.yml b/roles/deploy/tasks/main.yml index 6991461..d2a76d0 100644 --- a/roles/deploy/tasks/main.yml +++ b/roles/deploy/tasks/main.yml @@ -178,7 +178,10 @@ loop: "{{ range(0, workers_all_tasks) | list }}" tags: - packit-worker - when: workers_all_tasks > 0 and with_repository_cache and with_sandbox + when: + - workers_all_tasks > 0 + - with_repository_cache + - with_sandbox - name: Deploy packit-worker to serve all queues vars: @@ -226,7 +229,10 @@ loop: "{{ range(0, workers_long_running) | list }}" tags: - packit-worker - when: workers_long_running > 0 and with_repository_cache and with_sandbox + when: + - workers_long_running > 0 + - with_repository_cache + - with_sandbox - name: Deploy packit-worker to serve long-running and rate-limited queue vars: @@ -368,7 +374,9 @@ tags: - pushgateway register: nginx - when: with_pushgateway and with_flower + when: + - with_pushgateway + - with_flower - name: Wait for worker-0 to be running vars: diff --git a/tasks/check-up-to-date.yml b/tasks/check-up-to-date.yml index 84fd990..8a99861 100644 --- a/tasks/check-up-to-date.yml +++ b/tasks/check-up-to-date.yml @@ -3,7 +3,9 @@ --- - name: Check that the deployment resources are up-to-date - when: zuul is not defined and check_up_to_date + when: + - zuul is not defined + - check_up_to_date block: - name: Get HEAD from the remote # noqa: command-instead-of-module ansible.builtin.command: From 1c15891620d4bafb3bdabfa3bbfb46234c9c3c9f Mon Sep 17 00:00:00 2001 From: Matej Focko Date: Wed, 7 Oct 2026 12:49:14 +0200 Subject: [PATCH 10/10] docs: adjust paths to the generated TLS certs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Suggested-by: Alžběta Kučerová Signed-off-by: Matej Focko --- docs/deployment/tls-certs.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/deployment/tls-certs.md b/docs/deployment/tls-certs.md index 32fc9bf..a5ac109 100644 --- a/docs/deployment/tls-certs.md +++ b/docs/deployment/tls-certs.md @@ -106,14 +106,14 @@ the last one and once you have the correct answer, hit Enter ) ## Update secrets in the vault [Upload](https://bitwarden.com/help/attachments/#upload-a-file) -`fullchain.pem` and `privkey.pem` from `~/.certbot/live/prod.packit.dev/` +`fullchain.pem` and `privkey.pem` from `~/.certbot/live/packit.dev/` to `secrets-tls-certs` item in our shared `Packit` collection in Bitwarden vault. ## Re-deploy secrets for all services and environments `oc login ‹cluster›; oc project ‹project›` and - for cert in fullchain privkey; do scripts/update_oc_secret.sh packit-secrets ~/.certbot/live/prod.packit.dev/${cert}.pem; done + for cert in fullchain privkey; do scripts/update_oc_secret.sh packit-secrets ~/.certbot/live/packit.dev/${cert}.pem; done or update `api_key` in `vars/{packit|stream|fedora-source-git}/{prod|stg|internal}.yml` and run: