Freeze break Request: Add a cron job to delete dangling images from
our OpenShift nodes
by Clement Verna
Hi all,
I would like to apply the following patch to solve
https://pagure.io/fedora-infrastructure/issue/8147.
We start to quite often have build failing in OpenShift because the nodes
are lacking of disk space. This patch creates a cron job that runs every
weeks (on Monday) and deletes docker "dangling" images.
A dangling image for docker is an image that is not used or as not been
used by a container.
+1s ?
diff --git a/playbooks/groups/os-cluster.yml
b/playbooks/groups/os-cluster.yml
index 4b56286dc..52a4e2635 100644
@@ -248,3 +248,18 @@
- name: Enable wildcard routes
command: oc -n default set env dc/router
ROUTER_ALLOW_WILDCARD_ROUTES=true
changed_when: false
+
+
+- name: Add a cleanup cron job to the nodes
+ hosts: os_nodes_stg:os_nodes
+ tags:
+ - os-node-cleanup
+ tasks:
+ - name: Ensure a job that runs every Mondays to clean old docker images
from the nodes.
+ cron:
+ name: "remove docker dangling images"
+ weekday: 1 #Monday
+ minute: "0"
+ hour: "0"
+ job: "docker rmi $(docker images --filter dangling=true -q)"
+ sate: present
4 years, 7 months
prod -> staging fas db sync
by Kevin Fenzi
Greetings.
Just a heads up that I am going to do a prod->staging fas database sync
here soon (later this morning).
This means that your groups/password in prod will all be your
groups/password in staging with one exception: we can't sync the ipa
database, so if you never had a stg account or you had a different
password in staging you will need to go into the staging fas web
interface and change your password to sync with ipa. Note that you need
to do the normal password change, NOT the 'forgot my password' option.
Sorry for any troubles and if you have any questions, let me know.
kevin
4 years, 7 months
Subject: 'Meeting Agenda Item: Introduction T.C. Williams'
by T.C. Williams
Greetings Fedora Infrastructure Team,
My name is T.C. Williams and my IRC nick is austinpowered.
I'm a semi-retired life-long learner looking to give back and learn some
new skills. I know a little bit about a lot of things and I have a long
history of learning how to solve the problem at hand. I would consider
myself more of a sysadmin than a developer these days but that's mostly
because of my recent experiences.
In high school, I wrote my first program in BASIC to play blackjack on an
ASR-33 teletype. After studying digital hardware design in college I worked
for different companies writing software for automated test equipment. I
was working for a storage sub-system company when I was tasked with writing
a device driver to support our storage systems on the IBM PC and the
recently released MS-DOS 2.0.
After the first version was released, I wrote a custom BIOS for a SCSI host
adapter (ISA bus) and an updated device driver in assembly. With this
adapter and a custom disk partitioning utility (written in C), multiple
physical drives could be pooled to provide multiple logical volumes under
MS-DOS. This was 1985 and it would be many years before I got paid to write
code again.
The following years saw me move into sales where my technical background
helped me learn new technologies as they were introduced. Over the years I
have seen networking go from 10 Mb ethernet on coax to UTP at
ever-increasing speeds. Always in sales, I've worked with mostly networking
or network security vendors.
Around 2011, I was working in sales for a small company that was trying to
develop a custom security appliance. Seeing the need I stepped in to manage
the engineering team. After doing some research, I introduced git for
revision control, Jenkins for automated software build and test, PXE boot
and kickstart files for system builds and a Trac server to manage tickets
and milestones. The transition to agile development was in process when the
company was acquired. After managing the transition I became a pre-sale
engineer for an end-point security solution deployed as VM's on VMWare
using puppet. I left that company almost 4 years ago and have not looked
for a full-time position since.
While I have been using open-source for years, I'm looking to learn more
about how software and systems are deployed these days. It seems the Fedora
Infrastructure Apprentice group might be a good place for me to start but
I'm open to guidance.
My home lab is two SuperMicro servers running CentOS 7. Both my desktop and
laptop are running Fedora 31 with KDE. While I have done some work with
both puppet and chef, I have recently been trying to become more proficient
with Ansible. I have accounts with AWS, Digital Ocean and Linode.
I look forward to giving back to a project I have been using since before
it was called Fedora. Please let me know if you have any questions and I
will see you at the meeting tomorrow.
Thanks,
T.C. Williams
IRC: austinpowered
4 years, 7 months
Freeze Break Request: also sign aarch64/ppc64le f31 silverblue
testing/updates
by Kevin Fenzi
We need to apply this and restart robosignatory to get the currently in
progress Fedora 31 uppdates-testing push to ever finish. (it's waiting
for signatires here).
+1s?
kevin
--
From f2935a8d91a8b0bfef5387fbe46263988727cebf Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin(a)scrye.com>
Date: Thu, 29 Aug 2019 00:09:26 +0000
Subject: [PATCH] robosignatory / silverblue: also sign aarch64 and
ppc64le f31
testing and updates.
Signed-off-by: Kevin Fenzi <kevin(a)scrye.com>
---
roles/robosignatory/files/robosignatory.production.py | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/roles/robosignatory/files/robosignatory.production.py
b/roles/robosignatory/files/robosignatory.
production.py
index 10a6950..2d7013b 100644
--- a/roles/robosignatory/files/robosignatory.production.py
+++ b/roles/robosignatory/files/robosignatory.production.py
@@ -376,6 +376,22 @@ config = {
'directory': '/mnt/fedora_koji/koji/compose/ostree/repo/',
'key': 'fedora-31'
},
+ 'fedora/31/aarch64/updates/silverblue': {
+ 'directory': '/mnt/fedora_koji/koji/compose/ostree/repo/',
+ 'key': 'fedora-31'
+ },
+ 'fedora/31/aarch64/testing/silverblue': {
+ 'directory': '/mnt/fedora_koji/koji/compose/ostree/repo/',
+ 'key': 'fedora-31'
+ },
+ 'fedora/31/ppc64le/updates/silverblue': {
+ 'directory': '/mnt/fedora_koji/koji/compose/ostree/repo/',
+ 'key': 'fedora-31'
+ },
+ 'fedora/31/ppc64le/testing/silverblue': {
+ 'directory': '/mnt/fedora_koji/koji/compose/ostree/repo/',
+ 'key': 'fedora-31'
+ },
'fedora/rawhide/aarch64/silverblue': {
'directory': '/mnt/fedora_koji/koji/compose/ostree/repo/',
'key': 'fedora-32'
--
1.8.3.1
4 years, 7 months
Freeze Break Request: Content security policy on src.fp.o
by Julen Landa Alustiza
Good morning all!
Due to pagure's new default content security policy src.fp.o users are
getting a csp-error since the ui is trying to fetch a js file from
apps.fp.o and the policy denies it.
We need a configuration change on src.fp.o to modify the csp policy on
src{.stg}.fp.o instances to allow clients to fetch js files from apps.fp.o
I opened an issue on the tracker[0], but since we are on freeze now here
goes the same patch for a FBR.
Regards,
[0]: https://pagure.io/fedora-infrastructure/issue/8121
--
Julen Landa Alustiza
4 years, 7 months
Put package name in RSS/ATOM feed for Fedora (security) updates from
bodhi
by Marcin Zajaczkowski
Hi. I'm subscribed to the feed with security updates for Fedora (to be aware what has to be upgraded and restarted on my server):
https://bodhi.fedoraproject.org/rss/updates/?releases=F30&status=testing&...
In general it works, but the thing I miss is a project/package name in the notification (in the feed in general). Sometimes you can figure out a project name from a description, but here I needed to click the link to get know it refers to graphite2 and python-slixmpp:
> <item>
> <title>FEDORA-2019-d0b1feb995</title>
> <link>https://bodhi.fedoraproject.org/updates/FEDORA-2019-d0b1feb995</link>
> <description>- New upstream 1.3.13 release
> - Move to python3 for tests
> - Fix CVE-2018-7999 (rhbz 1554383)</description>
> <pubDate>Sun, 25 Aug 2019 11:28:54 +0000</pubDate>
> </item>
> <item>
> <title>FEDORA-2019-5a947d8603</title>
> <link>https://bodhi.fedoraproject.org/updates/FEDORA-2019-5a947d8603</link>
> <description>Security fix for CVE-2019-1000021</description>
> <pubDate>Sun, 25 Aug 2019 14:37:32 +0000</pubDate>
> </item>
It would be great to have that information available in the feed directly, e.g. in a title: FEDORA-2019-d0b1feb995 for graphite2 or FEDORA-2019-d0b1feb995 - graphite2.
(as I see "security update in Fedora 29 for graphite2" on the webpage, that information should be available at the generation time)
Marcin
4 years, 7 months
