Initial pass at global opendev base job set
This adds needed roles, playbooks and secrets for our global base jobs. Change-Id: I466bc1b8b33ea806f0ec39aa9aca32b91e28e7f1
This commit is contained in:
Clark Boylan
parent
5134a051bb
commit
3ecfa1968d
|
|
@ -0,0 +1,202 @@
|
|||
|
||||
Apache License
|
||||
Version 2.0, January 2004
|
||||
http://www.apache.org/licenses/
|
||||
|
||||
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||
|
||||
1. Definitions.
|
||||
|
||||
"License" shall mean the terms and conditions for use, reproduction,
|
||||
and distribution as defined by Sections 1 through 9 of this document.
|
||||
|
||||
"Licensor" shall mean the copyright owner or entity authorized by
|
||||
the copyright owner that is granting the License.
|
||||
|
||||
"Legal Entity" shall mean the union of the acting entity and all
|
||||
other entities that control, are controlled by, or are under common
|
||||
control with that entity. For the purposes of this definition,
|
||||
"control" means (i) the power, direct or indirect, to cause the
|
||||
direction or management of such entity, whether by contract or
|
||||
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
||||
outstanding shares, or (iii) beneficial ownership of such entity.
|
||||
|
||||
"You" (or "Your") shall mean an individual or Legal Entity
|
||||
exercising permissions granted by this License.
|
||||
|
||||
"Source" form shall mean the preferred form for making modifications,
|
||||
including but not limited to software source code, documentation
|
||||
source, and configuration files.
|
||||
|
||||
"Object" form shall mean any form resulting from mechanical
|
||||
transformation or translation of a Source form, including but
|
||||
not limited to compiled object code, generated documentation,
|
||||
and conversions to other media types.
|
||||
|
||||
"Work" shall mean the work of authorship, whether in Source or
|
||||
Object form, made available under the License, as indicated by a
|
||||
copyright notice that is included in or attached to the work
|
||||
(an example is provided in the Appendix below).
|
||||
|
||||
"Derivative Works" shall mean any work, whether in Source or Object
|
||||
form, that is based on (or derived from) the Work and for which the
|
||||
editorial revisions, annotations, elaborations, or other modifications
|
||||
represent, as a whole, an original work of authorship. For the purposes
|
||||
of this License, Derivative Works shall not include works that remain
|
||||
separable from, or merely link (or bind by name) to the interfaces of,
|
||||
the Work and Derivative Works thereof.
|
||||
|
||||
"Contribution" shall mean any work of authorship, including
|
||||
the original version of the Work and any modifications or additions
|
||||
to that Work or Derivative Works thereof, that is intentionally
|
||||
submitted to Licensor for inclusion in the Work by the copyright owner
|
||||
or by an individual or Legal Entity authorized to submit on behalf of
|
||||
the copyright owner. For the purposes of this definition, "submitted"
|
||||
means any form of electronic, verbal, or written communication sent
|
||||
to the Licensor or its representatives, including but not limited to
|
||||
communication on electronic mailing lists, source code control systems,
|
||||
and issue tracking systems that are managed by, or on behalf of, the
|
||||
Licensor for the purpose of discussing and improving the Work, but
|
||||
excluding communication that is conspicuously marked or otherwise
|
||||
designated in writing by the copyright owner as "Not a Contribution."
|
||||
|
||||
"Contributor" shall mean Licensor and any individual or Legal Entity
|
||||
on behalf of whom a Contribution has been received by Licensor and
|
||||
subsequently incorporated within the Work.
|
||||
|
||||
2. Grant of Copyright License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
copyright license to reproduce, prepare Derivative Works of,
|
||||
publicly display, publicly perform, sublicense, and distribute the
|
||||
Work and such Derivative Works in Source or Object form.
|
||||
|
||||
3. Grant of Patent License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
(except as stated in this section) patent license to make, have made,
|
||||
use, offer to sell, sell, import, and otherwise transfer the Work,
|
||||
where such license applies only to those patent claims licensable
|
||||
by such Contributor that are necessarily infringed by their
|
||||
Contribution(s) alone or by combination of their Contribution(s)
|
||||
with the Work to which such Contribution(s) was submitted. If You
|
||||
institute patent litigation against any entity (including a
|
||||
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
||||
or a Contribution incorporated within the Work constitutes direct
|
||||
or contributory patent infringement, then any patent licenses
|
||||
granted to You under this License for that Work shall terminate
|
||||
as of the date such litigation is filed.
|
||||
|
||||
4. Redistribution. You may reproduce and distribute copies of the
|
||||
Work or Derivative Works thereof in any medium, with or without
|
||||
modifications, and in Source or Object form, provided that You
|
||||
meet the following conditions:
|
||||
|
||||
(a) You must give any other recipients of the Work or
|
||||
Derivative Works a copy of this License; and
|
||||
|
||||
(b) You must cause any modified files to carry prominent notices
|
||||
stating that You changed the files; and
|
||||
|
||||
(c) You must retain, in the Source form of any Derivative Works
|
||||
that You distribute, all copyright, patent, trademark, and
|
||||
attribution notices from the Source form of the Work,
|
||||
excluding those notices that do not pertain to any part of
|
||||
the Derivative Works; and
|
||||
|
||||
(d) If the Work includes a "NOTICE" text file as part of its
|
||||
distribution, then any Derivative Works that You distribute must
|
||||
include a readable copy of the attribution notices contained
|
||||
within such NOTICE file, excluding those notices that do not
|
||||
pertain to any part of the Derivative Works, in at least one
|
||||
of the following places: within a NOTICE text file distributed
|
||||
as part of the Derivative Works; within the Source form or
|
||||
documentation, if provided along with the Derivative Works; or,
|
||||
within a display generated by the Derivative Works, if and
|
||||
wherever such third-party notices normally appear. The contents
|
||||
of the NOTICE file are for informational purposes only and
|
||||
do not modify the License. You may add Your own attribution
|
||||
notices within Derivative Works that You distribute, alongside
|
||||
or as an addendum to the NOTICE text from the Work, provided
|
||||
that such additional attribution notices cannot be construed
|
||||
as modifying the License.
|
||||
|
||||
You may add Your own copyright statement to Your modifications and
|
||||
may provide additional or different license terms and conditions
|
||||
for use, reproduction, or distribution of Your modifications, or
|
||||
for any such Derivative Works as a whole, provided Your use,
|
||||
reproduction, and distribution of the Work otherwise complies with
|
||||
the conditions stated in this License.
|
||||
|
||||
5. Submission of Contributions. Unless You explicitly state otherwise,
|
||||
any Contribution intentionally submitted for inclusion in the Work
|
||||
by You to the Licensor shall be under the terms and conditions of
|
||||
this License, without any additional terms or conditions.
|
||||
Notwithstanding the above, nothing herein shall supersede or modify
|
||||
the terms of any separate license agreement you may have executed
|
||||
with Licensor regarding such Contributions.
|
||||
|
||||
6. Trademarks. This License does not grant permission to use the trade
|
||||
names, trademarks, service marks, or product names of the Licensor,
|
||||
except as required for reasonable and customary use in describing the
|
||||
origin of the Work and reproducing the content of the NOTICE file.
|
||||
|
||||
7. Disclaimer of Warranty. Unless required by applicable law or
|
||||
agreed to in writing, Licensor provides the Work (and each
|
||||
Contributor provides its Contributions) on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||
implied, including, without limitation, any warranties or conditions
|
||||
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
||||
PARTICULAR PURPOSE. You are solely responsible for determining the
|
||||
appropriateness of using or redistributing the Work and assume any
|
||||
risks associated with Your exercise of permissions under this License.
|
||||
|
||||
8. Limitation of Liability. In no event and under no legal theory,
|
||||
whether in tort (including negligence), contract, or otherwise,
|
||||
unless required by applicable law (such as deliberate and grossly
|
||||
negligent acts) or agreed to in writing, shall any Contributor be
|
||||
liable to You for damages, including any direct, indirect, special,
|
||||
incidental, or consequential damages of any character arising as a
|
||||
result of this License or out of the use or inability to use the
|
||||
Work (including but not limited to damages for loss of goodwill,
|
||||
work stoppage, computer failure or malfunction, or any and all
|
||||
other commercial damages or losses), even if such Contributor
|
||||
has been advised of the possibility of such damages.
|
||||
|
||||
9. Accepting Warranty or Additional Liability. While redistributing
|
||||
the Work or Derivative Works thereof, You may choose to offer,
|
||||
and charge a fee for, acceptance of support, warranty, indemnity,
|
||||
or other liability obligations and/or rights consistent with this
|
||||
License. However, in accepting such obligations, You may act only
|
||||
on Your own behalf and on Your sole responsibility, not on behalf
|
||||
of any other Contributor, and only if You agree to indemnify,
|
||||
defend, and hold each Contributor harmless for any liability
|
||||
incurred by, or claims asserted against, such Contributor by reason
|
||||
of your accepting any such warranty or additional liability.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
APPENDIX: How to apply the Apache License to your work.
|
||||
|
||||
To apply the Apache License to your work, attach the following
|
||||
boilerplate notice, with the fields enclosed by brackets "[]"
|
||||
replaced with your own identifying information. (Don't include
|
||||
the brackets!) The text should be enclosed in the appropriate
|
||||
comment syntax for the file format. We also recommend that a
|
||||
file or class name and description of purpose be included on the
|
||||
same "printed page" as the copyright notice for easier
|
||||
identification within third-party archives.
|
||||
|
||||
Copyright [yyyy] [name of copyright owner]
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
- hosts: localhost
|
||||
roles:
|
||||
- role: add-fileserver
|
||||
fileserver: "{{ site_logs }}"
|
||||
- role: ara-report
|
||||
|
||||
- hosts: "{{ site_logs.fqdn }}"
|
||||
gather_facts: False
|
||||
roles:
|
||||
- role: test-upload-logs
|
||||
zuul_log_url: "http://logs.openstack.org"
|
||||
|
||||
- hosts: localhost
|
||||
# NOTE(pabelanger): We ignore_errors for the following tasks as not to fail
|
||||
# successful jobs.
|
||||
ignore_errors: yes
|
||||
roles:
|
||||
- submit-logstash-jobs
|
||||
- submit-subunit-jobs
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
- hosts: all
|
||||
roles:
|
||||
- fetch-output
|
||||
- merge-output-to-logs
|
||||
|
||||
- hosts: all
|
||||
# NOTE(pabelanger): We ignore_errors for the following tasks as not to fail
|
||||
# successful jobs.
|
||||
ignore_errors: yes
|
||||
roles:
|
||||
- remove-build-sshkey
|
||||
|
|
@ -0,0 +1,45 @@
|
|||
- hosts: localhost
|
||||
roles:
|
||||
- role: emit-job-header
|
||||
zuul_log_url: "http://logs.openstack.org"
|
||||
|
||||
- hosts: all
|
||||
pre_tasks:
|
||||
# NOTE(pabelanger): Until we hit the validate-host role, we have a minimal
|
||||
# set of ansible variables collected by zuul-executor. This doesn't include
|
||||
# network variables (ansible_default_ipv4 / ansible_default_ipv6) so gather
|
||||
# these variables as they are important to the configure-unbound role.
|
||||
- name: Gather network facts
|
||||
setup:
|
||||
gather_subset: 'network'
|
||||
|
||||
roles:
|
||||
- add-build-sshkey
|
||||
- start-zuul-console
|
||||
- ensure-output-dirs
|
||||
- log-inventory
|
||||
|
||||
- hosts: all
|
||||
roles:
|
||||
# NOTE(pabelanger): We run this role in its own play to ensure unbound is
|
||||
# restarted before proceeding with any other role. This is because we use
|
||||
# notify / handler to restart the unbound service. With ansible notify
|
||||
# actions are triggered at the end of each block of tasks in a play.
|
||||
- configure-unbound
|
||||
|
||||
- hosts: all
|
||||
roles:
|
||||
- validate-host
|
||||
- use-cached-repos
|
||||
- test-mirror-workspace-git-repos
|
||||
- mirror-info
|
||||
- role: configure-mirrors
|
||||
set_apt_mirrors_trusted: True
|
||||
- role: fetch-zuul-cloner
|
||||
destination: "/usr/zuul-env/bin/zuul-cloner"
|
||||
repo_src_dir: "/home/zuul/src/git.openstack.org"
|
||||
|
||||
pre_tasks:
|
||||
- name: Check that regional mirror is online
|
||||
uri:
|
||||
url: "http://{{ zuul_site_mirror_fqdn }}"
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
- hosts: localhost
|
||||
roles:
|
||||
- role: add-fileserver
|
||||
fileserver: "{{ site_logs }}"
|
||||
- role: ara-report
|
||||
|
||||
- hosts: "{{ site_logs.fqdn }}"
|
||||
gather_facts: False
|
||||
roles:
|
||||
- role: upload-logs
|
||||
zuul_log_url: "http://logs.openstack.org"
|
||||
|
||||
- hosts: localhost
|
||||
# NOTE(pabelanger): We ignore_errors for the following tasks as not to fail
|
||||
# successful jobs.
|
||||
ignore_errors: yes
|
||||
roles:
|
||||
# TODO do we want to assume subunit on opendev or should this move
|
||||
# into tenant config
|
||||
- submit-logstash-jobs
|
||||
- submit-subunit-jobs
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
- hosts: all
|
||||
roles:
|
||||
- fetch-output
|
||||
- merge-output-to-logs
|
||||
|
||||
- hosts: all
|
||||
# NOTE(pabelanger): We ignore_errors for the following tasks as not to fail
|
||||
# successful jobs.
|
||||
ignore_errors: yes
|
||||
roles:
|
||||
- remove-build-sshkey
|
||||
|
|
@ -0,0 +1,40 @@
|
|||
- hosts: localhost
|
||||
roles:
|
||||
- role: emit-job-header
|
||||
zuul_log_url: "http://logs.openstack.org"
|
||||
|
||||
- hosts: all
|
||||
pre_tasks:
|
||||
# NOTE(pabelanger): Until we hit the validate-host role, we have a minimal
|
||||
# set of ansible variables collected by zuul-executor. This doesn't include
|
||||
# network variables (ansible_default_ipv4 / ansible_default_ipv6) so gather
|
||||
# these variables as they are important to the configure-unbound role.
|
||||
- name: Gather network facts
|
||||
setup:
|
||||
gather_subset: 'network'
|
||||
|
||||
roles:
|
||||
- add-build-sshkey
|
||||
- start-zuul-console
|
||||
- ensure-output-dirs
|
||||
- log-inventory
|
||||
|
||||
- hosts: all
|
||||
roles:
|
||||
# NOTE(pabelanger): We run this role in its own play to ensure unbound is
|
||||
# restarted before proceeding with any other role. This is because we use
|
||||
# notify / handler to restart the unbound service. With ansible notify
|
||||
# actions are triggered at the end of each block of tasks in a play.
|
||||
- configure-unbound
|
||||
|
||||
- hosts: all
|
||||
roles:
|
||||
- validate-host
|
||||
- use-cached-repos
|
||||
- mirror-workspace-git-repos
|
||||
- mirror-info
|
||||
- role: configure-mirrors
|
||||
set_apt_mirrors_trusted: True
|
||||
- role: fetch-zuul-cloner
|
||||
destination: "/usr/zuul-env/bin/zuul-cloner"
|
||||
repo_src_dir: "/home/zuul/src/git.openstack.org"
|
||||
|
|
@ -0,0 +1,48 @@
|
|||
An ansible role to dynamically configure DNS forwarders for the
|
||||
``unbound`` caching service. IPv6 will be preferred when there is a
|
||||
usable IPv6 default route, otherwise IPv4.
|
||||
|
||||
.. note:: This is not a standalone unbound configuration role. Base
|
||||
setup is done during image builds in
|
||||
``project-config:nodepool/elements/nodepool-base/finalise.d/89-unbound``;
|
||||
here we just do dynamic configuration of forwarders based on
|
||||
the interfaces available on the actual host.
|
||||
|
||||
**Role Variables**
|
||||
|
||||
.. zuul:rolevar:: unbound_primary_nameserver_v4
|
||||
:default: 208.67.222.222 (OpenDNS)
|
||||
|
||||
The primary IPv4 nameserver for fowarding requests
|
||||
|
||||
.. zuul:rolevar:: unbound_secondary_nameserver_v4
|
||||
:default: 8.8.8.8 (Google)
|
||||
|
||||
The secondary IPv4 nameserver for fowarding requests
|
||||
|
||||
.. zuul:rolevar:: unbound_primary_nameserver_v6
|
||||
:default: 2620:0:ccc::2 (OpenDNS)
|
||||
|
||||
The primary IPv6 nameserver for fowarding requests
|
||||
|
||||
.. zuul:rolevar:: unbound_secondary_nameserver_v6
|
||||
:default: 2001:4860:4860::8888 (Google)
|
||||
|
||||
The seconary IPv6 nameserver for fowarding requests
|
||||
|
||||
.. zuul:rolevar:: unbound_cache_max_ttl
|
||||
:default: 86400
|
||||
|
||||
Maximum TTL in seconds to keep successful queries cached for.
|
||||
|
||||
This TTL will have precedence if the DNS record TTL is higher.
|
||||
For example, a TTL of 90000 would be reduced to 86400.
|
||||
|
||||
.. zuul:rolevar:: unbound_cache_min_ttl
|
||||
:default: 0
|
||||
|
||||
Minimum TTL in seconds to keep queries cached for.
|
||||
Note that this is effective for both successful and failed queries.
|
||||
|
||||
This TTL will have precedence if the DNS record TTL is lower.
|
||||
For example, a TTL of 60 would be raised to 900.
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
# OpenDNS
|
||||
unbound_primary_nameserver_v6: "2620:0:ccc::2"
|
||||
unbound_primary_nameserver_v4: "208.67.222.222"
|
||||
|
||||
# Google
|
||||
unbound_secondary_nameserver_v6: "2001:4860:4860::8888"
|
||||
unbound_secondary_nameserver_v4: "8.8.8.8"
|
||||
|
||||
# Time to live maximum for RRsets and messages in the cache.
|
||||
# Default is 86400 seconds (1 day). If the maximum kicks in,
|
||||
# responses to clients still get decrementing TTLs based on the
|
||||
# original (larger) values. When the internal TTL expires, the
|
||||
# cache item has expired. Can be set lower to force the resolver
|
||||
# to query for data often, and not trust (very large) TTL values.
|
||||
unbound_cache_max_ttl: 86400
|
||||
|
||||
# Time to live minimum for RRsets and messages in the cache.
|
||||
# Default is 0. If the minimum kicks in, the data is cached for
|
||||
# longer than the domain owner intended, and thus less queries are
|
||||
# made to look up the data. Zero makes sure the data in the cache
|
||||
# is as the domain owner intended, higher values, especially more
|
||||
# than an hour or so, can lead to trouble as the data in the cache
|
||||
# does not match up with the actual data any more.
|
||||
unbound_cache_min_ttl: 0
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
- name: Restart unbound
|
||||
become: yes
|
||||
service:
|
||||
name: unbound
|
||||
state: restarted
|
||||
|
|
@ -0,0 +1,84 @@
|
|||
# This role assumes that Unbound is already installed, fail early if it isn't.
|
||||
- name: Check that Unbound is installed
|
||||
stat:
|
||||
path: /etc/unbound
|
||||
register: unbound_config
|
||||
|
||||
- name: Ensure that Unbound is installed
|
||||
assert:
|
||||
that:
|
||||
- unbound_config.stat.exists
|
||||
|
||||
# ansible_default_ipv6 can either be undefined (no ipv6) or blank (no
|
||||
# routable address). We only want to use ipv6 if it's available &
|
||||
# routable; combine these checks into this fact.
|
||||
- name: Check for IPv6
|
||||
when:
|
||||
- hostvars[inventory_hostname]['ansible_default_ipv6'] is defined
|
||||
- hostvars[inventory_hostname]['ansible_default_ipv6']['address'] is defined
|
||||
set_fact:
|
||||
unbound_use_ipv6: True
|
||||
|
||||
# Use *only* ipv6 resolvers if ipv6 is present and routable. This
|
||||
# avoids traversing potential NAT when using ipv4 which can be
|
||||
# unreliable.
|
||||
- name: Set IPv6 nameservers
|
||||
when:
|
||||
- unbound_use_ipv6 is defined
|
||||
set_fact:
|
||||
unbound_primary_nameserver: '{{ unbound_primary_nameserver_v6 }}'
|
||||
unbound_secondary_nameserver: '{{ unbound_secondary_nameserver_v6 }}'
|
||||
|
||||
# Fallback to default ipv4 if there is no ipv6 available as this
|
||||
# causes timeouts and failovers that are unnecesary.
|
||||
- name: Set IPv4 nameservers
|
||||
when:
|
||||
- unbound_use_ipv6 is not defined
|
||||
set_fact:
|
||||
unbound_primary_nameserver: '{{ unbound_primary_nameserver_v4 }}'
|
||||
unbound_secondary_nameserver: '{{ unbound_secondary_nameserver_v4 }}'
|
||||
|
||||
- name: Include OS-specific variables
|
||||
include_vars: "{{ item }}"
|
||||
with_first_found:
|
||||
- "{{ ansible_distribution }}.yaml"
|
||||
- "{{ ansible_os_family }}.yaml"
|
||||
- "default.yaml"
|
||||
|
||||
- name: Ensure Unbound conf.d directory exists
|
||||
become: yes
|
||||
file:
|
||||
path: "{{ unbound_confd }}"
|
||||
state: directory
|
||||
|
||||
# TODO: Move this to /etc/unbound/conf.d ?
|
||||
- name: Configure unbound forwarding
|
||||
become: yes
|
||||
template:
|
||||
dest: /etc/unbound/forwarding.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
src: forwarding.conf.j2
|
||||
register: forwarding_config
|
||||
notify:
|
||||
- Restart unbound
|
||||
|
||||
- name: Configure unbound TTL
|
||||
become: yes
|
||||
template:
|
||||
dest: "{{ unbound_confd }}/ttl.conf"
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
src: ttl.conf.j2
|
||||
register: ttl_config
|
||||
notify:
|
||||
- Restart unbound
|
||||
|
||||
- name: Start unbound
|
||||
become: yes
|
||||
service:
|
||||
name: unbound
|
||||
state: started
|
||||
enabled: yes
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
# {{ ansible_managed }}
|
||||
|
||||
forward-zone:
|
||||
name: "."
|
||||
forward-addr: {{ unbound_primary_nameserver }}
|
||||
forward-addr: {{ unbound_secondary_nameserver }}
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
# {{ ansible_managed }}
|
||||
|
||||
server:
|
||||
cache-min-ttl: {{ unbound_cache_min_ttl }}
|
||||
cache-max-ttl: {{ unbound_cache_max_ttl }}
|
||||
|
|
@ -0,0 +1 @@
|
|||
unbound_confd: /etc/unbound/unbound.conf.d
|
||||
|
|
@ -0,0 +1 @@
|
|||
unbound_confd: /etc/unbound/conf.d
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
An ansible role to configure the ``/etc/ci/mirror_info.sh`` script
|
||||
|
||||
**Role Variables**
|
||||
|
||||
.. zuul:rolevar:: mirror_fqdn
|
||||
|
||||
The base host for mirror servers.
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
- name: Create /etc/ci
|
||||
become: yes
|
||||
file:
|
||||
path: /etc/ci
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0755
|
||||
|
||||
- name: Install ci_mirror script
|
||||
become: yes
|
||||
template:
|
||||
dest: '/etc/ci/mirror_info.sh'
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
src: mirror_info.sh.j2
|
||||
|
|
@ -0,0 +1,74 @@
|
|||
#!/bin/bash -xe
|
||||
|
||||
# {{ ansible_managed }}
|
||||
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
# not use this file except in compliance with the License. You may obtain
|
||||
# a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
# License for the specific language governing permissions and limitations
|
||||
# under the License.
|
||||
|
||||
export NODEPOOL_MIRROR_HOST={{ mirror_fqdn }}
|
||||
|
||||
# This script generates a descriptor slug to use with AFS, composed of the
|
||||
# operating system, its version, and the processor architecture.
|
||||
|
||||
# Pull in the os release.
|
||||
# ID is 'fedora', 'centos', 'ubuntu'
|
||||
# VERSION_ID is '23', '7', '14.04'
|
||||
# Nothing else is useful and/or reliable across distros
|
||||
. /etc/os-release
|
||||
|
||||
################################################################################
|
||||
# Generate an OS Release Name
|
||||
OS_TYPE=$ID
|
||||
|
||||
################################################################################
|
||||
# Generate a version string.
|
||||
OS_VERSION=$VERSION_ID
|
||||
if [ "$OS_TYPE" != "ubuntu" ]; then
|
||||
OS_VERSION=$(echo $OS_VERSION | cut -d'.' -f1)
|
||||
fi
|
||||
|
||||
################################################################################
|
||||
# Get the processor architecture.
|
||||
# x86_64, i386, armv7l, armv6l
|
||||
OS_ARCH=$(uname -m)
|
||||
|
||||
################################################################################
|
||||
# Build the name
|
||||
AFS_SLUG="$OS_TYPE-$OS_VERSION-$OS_ARCH"
|
||||
AFS_SLUG=$(echo "$AFS_SLUG" | tr '[:upper:]' '[:lower:]')
|
||||
|
||||
export AFS_SLUG
|
||||
export NODEPOOL_DEBIAN_MIRROR=${NODEPOOL_DEBIAN_MIRROR:-http://$NODEPOOL_MIRROR_HOST/debian}
|
||||
export NODEPOOL_PYPI_MIRROR=${NODEPOOL_PYPI_MIRROR:-http://$NODEPOOL_MIRROR_HOST/pypi/simple}
|
||||
export NODEPOOL_WHEEL_MIRROR=${NODEPOOL_WHEEL_MIRROR:-http://$NODEPOOL_MIRROR_HOST/wheel/$AFS_SLUG}
|
||||
export NODEPOOL_UBUNTU_MIRROR=${NODEPOOL_UBUNTU_MIRROR:-http://$NODEPOOL_MIRROR_HOST/ubuntu}
|
||||
export NODEPOOL_CENTOS_MIRROR=${NODEPOOL_CENTOS_MIRROR:-http://$NODEPOOL_MIRROR_HOST/centos}
|
||||
export NODEPOOL_DEBIAN_OPENSTACK_MIRROR=${NODEPOOL_DEBIAN_OPENSTACK_MIRROR:-http://$NODEPOOL_MIRROR_HOST/debian-openstack}
|
||||
export NODEPOOL_EPEL_MIRROR=${NODEPOOL_EPEL_MIRROR:-http://$NODEPOOL_MIRROR_HOST/epel}
|
||||
export NODEPOOL_FEDORA_MIRROR=${NODEPOOL_FEDORA_MIRROR:-http://$NODEPOOL_MIRROR_HOST/fedora}
|
||||
export NODEPOOL_OPENSUSE_MIRROR=${NODEPOOL_OPENSUSE_MIRROR:-http://$NODEPOOL_MIRROR_HOST/opensuse}
|
||||
export NODEPOOL_CEPH_MIRROR=${NODEPOOL_CEPH_MIRROR:-http://$NODEPOOL_MIRROR_HOST/ceph-deb-hammer}
|
||||
export NODEPOOL_UCA_MIRROR=${NODEPOOL_UCA_MIRROR:-http://$NODEPOOL_MIRROR_HOST/ubuntu-cloud-archive}
|
||||
# Reverse proxy servers
|
||||
export NODEPOOL_BUILDLOGS_CENTOS_PROXY=${NODEPOOL_BUILDLOGS_CENTOS_PROXY:-http://$NODEPOOL_MIRROR_HOST:8080/buildlogs.centos}
|
||||
export NODEPOOL_CBS_CENTOS_PROXY=${NODEPOOL_CBS_CENTOS_PROXY:-http://$NODEPOOL_MIRROR_HOST:8080/cbs.centos}
|
||||
export NODEPOOL_DOCKER_REGISTRY_PROXY=${NODEPOOL_DOCKER_REGISTRY_PROXY:-http://$NODEPOOL_MIRROR_HOST:8081/registry-1.docker/}
|
||||
export NODEPOOL_RDO_PROXY=${NODEPOOL_RDO_PROXY:-http://$NODEPOOL_MIRROR_HOST:8080/rdo}
|
||||
export NODEPOOL_RUGYGEMS_PROXY=${NODEPOOL_RUBYGEMS_PROXY:-http://$NODEPOOL_MIRROR_HOST:8080/rubygems/}
|
||||
export NODEPOOL_NPM_REGISTRY_PROXY=${NODEPOOL_NPM_REGISTRY_PROXY:-http://$NODEPOOL_MIRROR_HOST:8080/registry.npmjs}
|
||||
export NODEPOOL_TARBALLS_PROXY=${NODEPOOL_TARBALLS_PROXY:-http://$NODEPOOL_MIRROR_HOST:8080/tarballs}
|
||||
|
||||
# NOTE(mnaser): The following three proxies are consumed by OpenStack Ansible. They do not contain `http://` because we
|
||||
# can only override hosts, not the entire base URL.
|
||||
export NODEPOOL_LXC_IMAGE_PROXY=${NODEPOOL_LXC_IMAGE_PROXY:-$NODEPOOL_MIRROR_HOST:8080/images.linuxcontainers}
|
||||
export NODEPOOL_PERCONA_PROXY=${NODEPOOL_PERCONA_PROXY:-$NODEPOOL_MIRROR_HOST:8080/percona}
|
||||
export NODEPOOL_MARIADB_PROXY=${NODEPOOL_MARIADB_PROXY:-$NODEPOOL_MIRROR_HOST:8080/MariaDB}
|
||||
|
|
@ -0,0 +1,144 @@
|
|||
# Shared zuul config common to all opendev tenants.
|
||||
# Contains definitions of trusted jobs
|
||||
|
||||
|
||||
# Changes to this job require a special procedure, because they can
|
||||
# not be tested before landing, and if they are faulty, they will
|
||||
# break all jobs, meaning subsequent corrections will not be able to
|
||||
# land. To make a change:
|
||||
#
|
||||
# 1) Ensure that base-test and its playbooks are identical to base.
|
||||
# 2) Make the change to base-test and/or its playbooks.
|
||||
# 3) Merge the change from step 2. No jobs normally use base-test, so
|
||||
# this is safe.
|
||||
# 4) Propose a change to a job to reparent it to base-test. Choose a
|
||||
# job which will exercise whatever you are changing. The
|
||||
# "unittests" job in zuul-jobs is a good choice. Use [DNM] in the
|
||||
# commit subject so that people know not to merge the change. Set
|
||||
# it to "Work in progress" so people don't review it.
|
||||
# 5) Once test results arrive for the change in step 2, make a change
|
||||
# which copies the job and/or playbooks of base-test to base. In
|
||||
# the commit message, link to (without using Depends-On:) the
|
||||
# change from step 4 so reviewers can see the test results.
|
||||
# 6) Once the change in step 5 merges, abandon the change from step 4.
|
||||
|
||||
- secret:
|
||||
name: site_logs
|
||||
data:
|
||||
fqdn: logs.openstack.org
|
||||
path: /srv/static/logs
|
||||
ssh_known_hosts: |
|
||||
logs.openstack.org,23.253.108.137,2001:4800:7817:104:be76:4eff:fe05:dbee ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDDcvLuGLagUAZfc0BThLus8ufSPCrIhDtG0BdXvhblJjvIbkuELD3dRWRZVSYZAdzGZRY3t6vTAcguTrkbQg5ngXfdfF+OKPkaH8DiZwAX/1g/iRXhInkZTGBVqHo9pLAMeNNwviSy2JjpTqdD6fLEkHwW+uw4E2YZhYivctTSbOepMkzAtFV0w5cpyBzjAT/Hax2x5un6es8R0Iw3AAnUmtapn5e5NCrg2rPNpd0nve84wUavvbC2DeGDOZQdnIahwo60Sder5ZE/x6cG39bkSDdgFQArAzrNrH6BHmNGjfFPpnGmfc7P8gQwDPtMf02HvKapqATXpIxdbSGimWLL
|
||||
ssh_username: jenkins
|
||||
ssh_private_key: !encrypted/pkcs1-oaep
|
||||
- t9SCvfU4po36HYV0yCxivgaDF+L6BQVUGramqW3dgARxP+Mdl51h1+K/8EdNke0wzfDWX
|
||||
tdVL6Vsh4D5/evfLuBgeILjXT/pzozfhDksjz78TiWBnFQyiC3FHwVB6tZ9903fIiltw5
|
||||
aXg9AB3iYxSE/XQUKU3ThCt7zDJ0FoTrASVlKWaGeeMUiLBSaXaNrRTEFWyUJn7OU3nrj
|
||||
646ac7QJnkZ5j/kQbKDdWF73tCrL69fOoHHZtc0QbnizbBRjdVyECktVy3jvYfIAEdsKW
|
||||
Apg1HCQBJETe64PQR1OKv18sC6MdfSVP//8mpOAMdVeJzfNqkk83V1IBWHWTQgIAAyt/4
|
||||
wB0aXUjX2rwMkInJfO6g2b+tMUajqEntib6IRKKXMb7/kS7ZcXwDkMj6bxBmnKgMLSx89
|
||||
+fhBnYLoaNv9keBlDLtGc62glO3B9TxcxNzOFuBp0mLPR28v6DXBn0uXJwzdqXf1WAUsQ
|
||||
m6BKVE34J99vuzHFDn7J0ov/biZtJLAsD6q0enBm0nJQPuXfrW0c/jcUO4D+SjStBo/t+
|
||||
ZLMzzJvoygXTBFkiDX+6icIzLJMbpS8rBrGj+NbE+k1Lzni9Gq9Wo2xgDnGPwWDD97eup
|
||||
H3cCIfhcFCP9m9YINLxxsJzpK8+Xss7LNqN8NbEbLPAbDH7b+rqIjoBPEAfVPM=
|
||||
- C/Oz2r1fTYChvAbFpOdCF7+ZmEzSDYphP7fY/ENTOlvhq98QS3fGxRqj+oNEEppnM1oS1
|
||||
Cc/bR3kzSqgMK629H0qVVqJhR0ffNT6ip6CIP2BkAaqT/6yUY5tp0BjZyC+O7tV6QtWkq
|
||||
gj6k/cJcgT7JKMLSN4zjdO1A9qeLpjc9y98lArIeYXFvJHpXC9J8Vj8Fd+ODhH/YUUEkQ
|
||||
nqCXcBTd2k1RFEWvCVRN7tKkiuAa4HPPmj+In9TKw3j2grn3LMmkUrQn5G7bWyuzQGp2u
|
||||
2pVwvYNSEKxJiMMA0pTNLDMKaA5kvCQsQdt61FVN3AYZyCEbXq/6Is+JKoiZjBeyfUurB
|
||||
btEoPNpjVmPQysCrvakSfbMi+Pn3jrZToxRNC30r1LWdHfKo0ovVRN0CEfce3suRu7uP8
|
||||
BXH7Ow4sYKF5FLjzwzCO6VuoDg+SrfjbBwnzoySIsB3CXXieMUj+0ytfG1FBmKg2IiLQ7
|
||||
Eaz+G4gCMe+1dMG87cKmizz7vC21ZFyeF3C2jBmXMMRvFgLCphHZOPfUOcy2yCPPFYmsg
|
||||
2DBxx2VrvcPljTW6woVbb4Kxrd7+2TRbT9mzWDQDDdKGveIqUnEURGacJ+WRc8ZlBpFwN
|
||||
cmwbJal3VSo0sB/X25ZNnF7Y7JHrXI6a3s/ck2ppid+2h1sk1oE6br/DRjYCN4=
|
||||
- k8yssVEnQr58u8krETfjnByeO6UmQL7+JfXSYHI79z9n3Fp3nIRrFoH177d47iHtcYxyP
|
||||
8IsQD2HMIGuRhyKZk5ruYwod/yeXZBwBcs7YSsof0U5gJ4gh6gw+bLQamKEaI4smq+xQA
|
||||
UxxoHDw5m96+VUBeLdnXDFkq0qXiWOMmrCnVGgnDeuPZfyDbu8ILZi6c4WUFwj5o0oqRZ
|
||||
pWEls8IfULjBEDMfbWhMrUh7zKurUwDXycmTAv4PriUdMdoMacqz/brxZZKC07+mzFiMj
|
||||
iJvwV6STxATXy78+wWrM7MReoGownI0M0DKh07w/DEG000NTQnRz42DbwGbQQb8ugj4ee
|
||||
1sB3+pz3udnwffREtht2uf2C48dHFqMOKeGNV3MJv8Z93H6rpgdpuySZwXC3iL2ga8m4I
|
||||
U8ypFoCXXR5rHRqAL8xmuUVoavYC4XLPN1QvKueZnQW5XntZxXH/lSe9OnEo6SVya4v8p
|
||||
CEQ6+XIWQCKIFPXxFM+KCoh7c8FASmJ7Tw1WLw+DNdSKL8kewk0Z2FvkR6bTzzcKT3RCf
|
||||
/xM/+N674GhkYRFCMsQxrT9e6cfB2FRbBrxR1GJQQrS9KHPGn7dgKNN4/0snbtypekhjl
|
||||
7oDENP6sbflXAo3Zeuq/XlvW0uobBqdI6bbkdMISAd779hVT5eQWvftwozrjHI=
|
||||
- VjHYrglFpBi8Apnb64NYiblBANVDC0tXgAOzC7/NhcZ9Vc4rI7oRPfc48hrxjFlC+Uvtg
|
||||
yI9cwu9y4FDDgGQ6qLovzP/Dvcwoga0YOZ7RYxdsT7N0/okRlWPRyj2h/7nlhrIxwK8bN
|
||||
xRi7t/JniQkMrWiDckgw0YflLboMYQg8ShtCy1bZL1m0ISuBbodeswOLTiKFk2IG3R58h
|
||||
Xylmgi2iM1md5ZeM9PhyLd8DrhuuJiKvhIiszdQNJN5Gg2CymYBveMfglE9r/10qgOM21
|
||||
3UC37hSArn7WTu9Rwbo9bdNVePNik/x2O3fgMGND6ySX9vG8npPjOaomTGpds/z7DUn6F
|
||||
0B4RWDoYDD57BHviUSYDDEbfpNS6dk/K4RpArjpS7ZZcUIok5sXSV18zSI8Gaa32SKU59
|
||||
MdHuBtGW6p6kUTnuMSNCVsKGNOvjHsfnWFomUddEwhNFJW+tangCSkNaTQq/Yaf394lw8
|
||||
nOsautk56uoiZPhSzdBpR9s8z0z1z0eGzdeBWyV+IFF/UJCftDiOSu0zA28RgDIwIg690
|
||||
jVFWkZZRprDU6/5zgZPTLHOfz00IoMbGBKWSfvuOhF5l6VpSC3JVvcRd6/bivUq/1XkzP
|
||||
uMv41vSFc4Kac1KmgAi96zglyRkzQgYVtLVNYyKbuLhVfx4U34mal/05sU3/MI=
|
||||
|
||||
- job:
|
||||
name: base
|
||||
parent: null
|
||||
abstract: true
|
||||
description: |
|
||||
The base job for OpenDev's installation of Zuul.
|
||||
|
||||
All jobs ultimately inherit from this. It runs a pre-playbook
|
||||
which copies all of the job's prepared git repos on to all of
|
||||
the nodes in the nodeset. It runs a post-playbook which copies
|
||||
all of the files in the logs/ subdirectory of the executor
|
||||
work directory to the logserver.
|
||||
|
||||
It also sets default timeout and nodeset values (which may be
|
||||
overidden).
|
||||
|
||||
Responds to these variables:
|
||||
|
||||
.. zuul:jobvar:: base_serial
|
||||
:default: Omitted
|
||||
|
||||
This sets the serial keyword in the pre and post playbooks
|
||||
which can be an integer or percentage.
|
||||
|
||||
See ansible documentation for more information:
|
||||
http://docs.ansible.com/ansible/latest/playbooks_delegation.html
|
||||
|
||||
pre-run: playbooks/base/pre.yaml
|
||||
post-run:
|
||||
- playbooks/base/post.yaml
|
||||
- playbooks/base/post-logs.yaml
|
||||
roles:
|
||||
- zuul: openstack-infra/zuul-jobs
|
||||
vars:
|
||||
ara_report_type: database
|
||||
ara_report_path: ara-report
|
||||
timeout: 1800
|
||||
post-timeout: 1800
|
||||
nodeset:
|
||||
nodes:
|
||||
- name: ubuntu-xenial
|
||||
label: ubuntu-xenial
|
||||
secrets:
|
||||
- site_logs
|
||||
|
||||
# See the procedure described above "base" before making changes to
|
||||
# this job.
|
||||
- job:
|
||||
name: base-test
|
||||
parent: null
|
||||
description: |
|
||||
A job to test changes to the base job without disturbing the
|
||||
main job in production. Not for general use.
|
||||
pre-run: playbooks/base-test/pre.yaml
|
||||
post-run:
|
||||
- playbooks/base-test/post.yaml
|
||||
- playbooks/base-test/post-logs.yaml
|
||||
roles:
|
||||
- zuul: openstack-infra/zuul-jobs
|
||||
timeout: 1800
|
||||
post-timeout: 1800
|
||||
vars:
|
||||
ara_report_type: database
|
||||
ara_report_path: ara-report
|
||||
nodeset:
|
||||
nodes:
|
||||
- name: ubuntu-xenial
|
||||
label: ubuntu-xenial
|
||||
secrets:
|
||||
- site_logs
|
||||
Loading…
Reference in New Issue