Merge pull request #14974 from rocky-linux/develop

Sigul and Koji Changes
This commit is contained in:
Louis Abel 2021-01-19 22:22:36 -07:00 committed by GitHub
commit 738aac8ec8
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
14 changed files with 287 additions and 0 deletions

View File

@ -67,3 +67,13 @@ mqtt.boxbuild.rockylinux.org ansible_host=10.100.1.213
rabbitmq01.rockylinux.org ansible_host=10.100.1.214 rabbitmq01.rockylinux.org ansible_host=10.100.1.214
rabbitmq02.rockylinux.org ansible_host=10.100.1.215 rabbitmq02.rockylinux.org ansible_host=10.100.1.215
rabbitmq03.rockylinux.org ansible_host=10.100.1.216 rabbitmq03.rockylinux.org ansible_host=10.100.1.216
[sigul:children]
sigulbridge
sigulserver
[sigulbridge]
sigul-bridge.rockylinux.org ansible_host=10.100.1.217
[sigulserver]
sigul-server.rockylinux.org ansible_host=10.100.1.218

View File

@ -20,9 +20,12 @@
owner: "{{ getcert_owner|default(omit) }}" owner: "{{ getcert_owner|default(omit) }}"
key_location: "{{ getcert_key|default(omit) }}" key_location: "{{ getcert_key|default(omit) }}"
cert_location: "{{ getcert_cert|default(omit) }}" cert_location: "{{ getcert_cert|default(omit) }}"
nss_db_dir: "{{ getcert_nss_db_dir|default(omit) }}"
nss_nickname: "{{ getcert_nss_nickname|default(ansible_fqdn) }}"
postcmd: "{{ getcert_postcmd|default(omit) }}" postcmd: "{{ getcert_postcmd|default(omit) }}"
ipa_getcert_chain: "{{ getcert_chain|default(omit) }}" ipa_getcert_chain: "{{ getcert_chain|default(omit) }}"
ipa_getcert_chain_location: "{{ getcert_chain_location|default(omit) }}" ipa_getcert_chain_location: "{{ getcert_chain_location|default(omit) }}"
ipa_getcert_nss: "{{ getcert_nss|default(false) }}"
roles: roles:
- role: rockylinux.ipagetcert - role: rockylinux.ipagetcert

View File

@ -32,3 +32,8 @@
command: gitlab-ctl reconfigure command: gitlab-ctl reconfigure
register: gitlab_restart register: gitlab_restart
failed_when: gitlab_restart_handler_failed_when | bool failed_when: gitlab_restart_handler_failed_when | bool
- name: restart_noggin
service:
name: noggin
state: restarted

View File

@ -0,0 +1,40 @@
---
# (Re)deploys the noggin theme
- name: Deploy Noggin Theme
hosts: "idp"
become: true
handers:
- import_tasks: handlers/main.yml
pre_tasks:
- name: Check if ansible cannot be run here
stat:
path: /etc/no-ansible
register: no_ansible
- name: Verify if we can run ansible
assert:
that:
- "not no_ansible.stat.exists"
success_msg: "We are not able to run on this node"
fail_msg: "/etc/no-ansible exists - skipping run on this node"
tasks:
- name: Deploy Rocky Noggin Theme
git:
repo: https://github.com/rocky-linux/noggin-theme.git
dest: /opt/noggin/noggin/noggin/themes/rocky
update: true
version: main
become_user: noggin
notify: restart_noggin
post_tasks:
- name: Touching run file that ansible has ran here
file:
path: /var/log/ansible.run
state: touch
mode: '0644'
owner: root
group: root

View File

@ -5,6 +5,7 @@
become: true become: true
vars_files: vars_files:
- vars/vaults/encpass.yml - vars/vaults/encpass.yml
- vars/common.yml
- vars/kojid.yml - vars/kojid.yml
# This is to try to avoid the handler issue in pre/post tasks # This is to try to avoid the handler issue in pre/post tasks

View File

@ -5,6 +5,7 @@
become: true become: true
vars_files: vars_files:
- vars/vaults/encpass.yml - vars/vaults/encpass.yml
- vars/common.yml
- vars/kojihub.yml - vars/kojihub.yml
# This is to try to avoid the handler issue in pre/post tasks # This is to try to avoid the handler issue in pre/post tasks

View File

@ -0,0 +1,91 @@
---
# Stands up an ipsilon instance for simple SSO
- name: Configure Sigul Bridge
hosts: sigulbridge
become: true
vars_files:
- vars/vaults/encpass.yml
- vars/common.yml
- vars/sigul_bridge.yml
# This is to try to avoid the handler issue in pre/post tasks
handlers:
- import_tasks: handlers/main.yml
pre_tasks:
- name: Check if ansible cannot be run here
stat:
path: /etc/no-ansible
register: no_ansible
- name: Verify if we can run ansible
assert:
that:
- "not no_ansible.stat.exists"
success_msg: "We are able to run on this node"
fail_msg: "/etc/no-ansible exists - skipping run on this node"
- name: Check for keytabs - sigul
stat:
path: /etc/sigul.keytab
register: sigul_keytab
changed_when: "1 != 1"
- name: Verify keytab
assert:
that:
- "sigul_keytab.stat.exists"
success_msg: "It is likely we have all keytabs"
fail_msg: "There are no keytabs. Please build the keytabs."
# EPEL and PowerTools are required for ipsilon to function
# I also couldn't find an ansible built-in to do this
- name: Enable the PowerTools repository
ini_file:
dest: /etc/yum.repos.d/CentOS-Linux-PowerTools.repo
section: powertools
option: enabled
value: 1
owner: root
group: root
mode: '0644'
# The CentOS extras repos has epel-release provided
- name: Enable the EPEL repository
yum:
name: epel-release
state: present
tags:
- packages
- name: Install rocky-tools copr
yum_repository:
name: copr:copr.fedorainfracloud.org:nalika:rockylinux-tool
description: Copr repo for rockylinux-tools owned by nalika
file: copr_repos
baseurl: https://download.copr.fedorainfracloud.org/results/nalika/rockylinux-tools/epel-8-$basearch/
gpgcheck: true
gpgkey: https://download.copr.fedorainfracloud.org/results/nalika/rockylinux-tools/pubkey.gpg
enabled: true
roles:
- role: rockylinux.sigul
state: present
- role: rockylinux.ipagetcert
state: present
post_tasks:
- name: Enable the sigul bridge
systemd:
name: sigul_bridge
state: running
enabled: true
- name: Touching run file that ansible has ran here
file:
path: /var/log/ansible.run
state: touch
mode: '0644'
owner: root
group: root

View File

@ -0,0 +1,78 @@
---
# Stands up an ipsilon instance for simple SSO
- name: Configure Sigul Server
hosts: sigulserver
become: true
vars_files:
- vars/vaults/encpass.yml
- vars/common.yml
- vars/sigul_server.yml
# This is to try to avoid the handler issue in pre/post tasks
handlers:
- import_tasks: handlers/main.yml
pre_tasks:
- name: Check if ansible cannot be run here
stat:
path: /etc/no-ansible
register: no_ansible
- name: Verify if we can run ansible
assert:
that:
- "not no_ansible.stat.exists"
success_msg: "We are able to run on this node"
fail_msg: "/etc/no-ansible exists - skipping run on this node"
# EPEL and PowerTools are required for ipsilon to function
# I also couldn't find an ansible built-in to do this
- name: Enable the PowerTools repository
ini_file:
dest: /etc/yum.repos.d/CentOS-Linux-PowerTools.repo
section: powertools
option: enabled
value: 1
owner: root
group: root
mode: '0644'
# The CentOS extras repos has epel-release provided
- name: Enable the EPEL repository
yum:
name: epel-release
state: present
tags:
- packages
- name: Install rocky-tools copr
yum_repository:
name: copr:copr.fedorainfracloud.org:nalika:rockylinux-tool
description: Copr repo for rockylinux-tools owned by nalika
file: copr_repos
baseurl: https://download.copr.fedorainfracloud.org/results/nalika/rockylinux-tools/epel-8-$basearch/
gpgcheck: true
gpgkey: https://download.copr.fedorainfracloud.org/results/nalika/rockylinux-tools/pubkey.gpg
enabled: true
roles:
- role: rockylinux.sigul
state: present
- role: rockylinux.ipagetcert
state: present
post_tasks:
- name: Enable the sigul server
systemd:
name: sigul_server
state: running
enabled: true
- name: Touching run file that ansible has ran here
file:
path: /var/log/ansible.run
state: touch
mode: '0644'
owner: root
group: root

View File

@ -1,4 +1,5 @@
--- ---
rocky_ipa_realm: "ROCKYLINUX.ORG"
rocky_ldap_bind_dn: "uid=binder,cn=sysaccounts,cn=etc,dc=rockylinux,dc=org" rocky_ldap_bind_dn: "uid=binder,cn=sysaccounts,cn=etc,dc=rockylinux,dc=org"
rocky_ldap_user_basedn: "cn=users,cn=accounts,dc=rockylinux,dc=org" rocky_ldap_user_basedn: "cn=users,cn=accounts,dc=rockylinux,dc=org"
rocky_ldap_group_basedn: "cn=groups,cn=accounts,dc=rockylinux,dc=org" rocky_ldap_group_basedn: "cn=groups,cn=accounts,dc=rockylinux,dc=org"

View File

@ -20,10 +20,36 @@ koji_hub_url: "https://{{ koji_url_name }}/kojihub"
koji_files_url: "https://{{ koji_url_name }}/kojifiles" koji_files_url: "https://{{ koji_url_name }}/kojifiles"
# The IPA internal CA is combined with the others # The IPA internal CA is combined with the others
# Change before deployment or store in vault
koji_hub_secret: cK5XCuzMSXJfgA7yFvXkGwFu
koji_web_cacert: /etc/pki/tls/certs/ca-bundle.crt koji_web_cacert: /etc/pki/tls/certs/ca-bundle.crt
koji_web_tls_cert: "/etc/pki/tls/certs/{{ ansible_fqdn }}.crt" koji_web_tls_cert: "/etc/pki/tls/certs/{{ ansible_fqdn }}.crt"
koji_web_tls_key: "/etc/pki/tls/private/{{ ansible_fqdn }}.key" koji_web_tls_key: "/etc/pki/tls/private/{{ ansible_fqdn }}.key"
# Kojira
koji_kojira: true
koji_kojira_user: kojira
koji_kojira_user_kerb: kojira/koji.rockylinux.org
koji_kojira_principal: kojira/koji.rockylinux.org@ROCKYLINUX.ORG
koji_kojira_keytab: /etc/keytabs/kojira.keytab
# MBS
koji_mbs: true
koji_mbs_user: mbs
koji_mbs_user_kerb: mbs/mbs.rockylinux.org
koji_mbs_principal: mbs/mbs.rockylinux.org@ROCKYLINUX.ORG
koji_mbs_keytab: /etc/keytabs/mbs.keytab
# GC
koji_gc_keytab: /etc/keytabs/koji-gc.keytab
koji_gc_principal: koji-gc/koji.rockylinux.org@ROCKYLINUX.ORG
# Sigul
koji_sigul: true
koji_sigul_user: sigul
koji_sigul_user_kerb: sigul/sigul.rockylinux.org
koji_sigul_principal: sigul/sigul.rockylinux.org@ROCKYLINUX.ORG
# NFS? We need a place. # NFS? We need a place.
koji_nfs: false koji_nfs: false
koji_mount: /mnt/koji koji_mount: /mnt/koji

View File

@ -0,0 +1,15 @@
---
# Sigul Bridge Variables
sigul_type: bridge
sigul_ipa_realm: "ROCKYLINUX.ORG"
sigul_bridge_cert_nickname: "sigul-bridge"
sigul_principal: "sigul/{{ inventory_hostname }}@{{ sigul_ipa_realm }}"
sigul_keytab: /etc/sigul.keytab
sigul_nss_dir: /etc/pki/tls/sigul
# ipa-getcert variables
getcert_name: "{{ ansible_fqdn }}"
getcert_owner: sigul
getcert_nss_db_dir: "{{ sigul_nss_dir }}"
getcert_nss_nickname: "{{ sigul_bridge_cert_nickname }}"
getcert_nss: true

View File

@ -0,0 +1,13 @@
---
# Sigul Server Variables
sigul_type: server
sigul_server_cert_nickname: "sigul-server"
sigul_nss_dir: /etc/pki/tls/sigul
sigul_bridge_name: "sigul-bridge.rockylinux.org"
# ipa-getcert variables
getcert_name: "{{ ansible_fqdn }}"
getcert_owner: sigul
getcert_nss_db_dir: "{{ sigul_nss_dir }}"
getcert_nss_nickname: "{{ sigul_bridge_cert_nickname }}"
getcert_nss: true

View File

@ -24,6 +24,9 @@ roles:
- name: rockylinux.rabbitmq - name: rockylinux.rabbitmq
src: https://github.com/rocky-linux/ansible-role-rabbitmq src: https://github.com/rocky-linux/ansible-role-rabbitmq
version: main version: main
- name: rockylinux.sigul
src: https://github.com/rocky-linux/ansible-role-sigul
version: main
collections: collections:
# freeipa # freeipa