2018-09-12 11:32:42 -06:00
|
|
|
plugin: yamlgroup
|
2018-08-01 14:13:25 -05:00
|
|
|
groups:
|
2018-12-19 20:31:35 +00:00
|
|
|
adns: adns*.open*.org
|
2021-02-11 13:18:40 +11:00
|
|
|
afs-server-common:
|
|
|
|
- afs[0-9]*.openstack.org
|
|
|
|
- afsdb[0-9]*.openstack.org
|
|
|
|
afs-file-server:
|
|
|
|
- afs[0-9]*.openstack.org
|
|
|
|
afs-db-server:
|
|
|
|
- afsdb[0-9]*.openstack.org
|
2018-09-12 11:32:42 -06:00
|
|
|
afs-client:
|
2020-05-15 13:29:38 +10:00
|
|
|
- mirror[0-9]*.opendev.org
|
2019-06-27 14:20:02 +10:00
|
|
|
- mirror-update[0-9]*.opendev.org
|
2018-12-19 20:31:35 +00:00
|
|
|
- ze[0-9]*.open*.org
|
|
|
|
- afsdb*.open*.org
|
|
|
|
- afs[0-9]*.open*.org
|
2019-12-06 10:17:52 +11:00
|
|
|
- static[0-9]*.opendev.org
|
2020-10-12 16:30:46 +11:00
|
|
|
borg-backup:
|
2020-11-09 16:07:56 +11:00
|
|
|
- etherpad[0-9]*.opendev.org
|
|
|
|
- gitea01.opendev.org
|
2021-06-23 15:50:26 +10:00
|
|
|
- review02.opendev.org
|
2021-05-10 09:00:41 -07:00
|
|
|
- zuul[0-9]*.opendev.org
|
2021-02-11 13:56:34 +11:00
|
|
|
- refstack01.openstack.org
|
2021-03-11 13:48:15 +11:00
|
|
|
- kdc03.openstack.org
|
2021-06-23 10:48:38 +10:00
|
|
|
- eavesdrop01.opendev.org
|
2021-07-15 14:58:50 +10:00
|
|
|
- paste01.opendev.org
|
2021-10-12 09:26:44 -07:00
|
|
|
# These are test specific hosts that we add to the backup
|
|
|
|
# group to mimic as much as possible what their prod version
|
|
|
|
# end up doing.
|
|
|
|
- gitea99.opendev.org
|
|
|
|
- review99.opendev.org
|
2020-11-09 16:07:56 +11:00
|
|
|
# All these servers are "special-cased" in specifically
|
|
|
|
# as they are puppet and should be replaced "soon"
|
2020-10-12 16:30:46 +11:00
|
|
|
- ethercalc02.openstack.org
|
2020-11-09 16:07:56 +11:00
|
|
|
- lists.openstack.org
|
|
|
|
- storyboard01.opendev.org
|
|
|
|
- translate01.openstack.org
|
2020-10-08 10:18:55 +11:00
|
|
|
borg-backup-server:
|
|
|
|
- backup02.ca-ymq-1.vexxhost.opendev.org
|
2020-10-30 16:39:25 +11:00
|
|
|
- backup01.ord.rax.opendev.org
|
2018-12-19 20:31:35 +00:00
|
|
|
cacti: cacti[0-9]*.open*.org
|
Generate ssl check list directly from letsencrypt variables
This autogenerates the list of ssl domains for the ssl-cert-check tool
directly from the letsencrypt list.
The first step is the install-certcheck role that replaces the
puppet-ssl_cert_check module that does the same. The reason for this
is so that during gate testing we can test this on the test
bridge.openstack.org server, and avoid adding another node as a
requirement for this test.
letsencrypt-request-certs is updated to set a fact
letsencrypt_certcheck_domains for each host that is generating a
certificate. As described in the comments, this defaults to the first
host specified for the certificate and the listening port can be
indicated (if set, this new port value is stripped when generating
certs as is not necessary for certificate generation).
The new letsencrypt-config-certcheck role runs and iterates all
letsencrypt hosts to build the final list of domains that should be
checked. This is then extended with the
letsencrypt_certcheck_additional_domains value that covers any hosts
using certificates not provisioned by letsencrypt using this
mechanism.
These additional domains are pre-populated from the openstack.org
domains in the extant check file, minus those openstack.org domain
certificates we are generating via letsencrypt (see
letsencrypt-create-certs/handlers/main.yaml). Additionally, we
update some of the certificate variables in host_vars that are
listening on port !443.
As mentioned, bridge.openstack.org is placed in the new certcheck
group for gate testing, so the tool and config file will be deployed
to it. For production, cacti is added to the group, which is where
the tool currently runs. The extant puppet installation is disabled,
pending removal in a follow-on change.
Change-Id: Idbe084f13f3684021e8efd9ac69b63fe31484606
2020-05-18 14:43:16 +10:00
|
|
|
certcheck:
|
|
|
|
- cacti[0-9]*.open*.org
|
Use zuul checkouts of ansible roles from other repos
We have two standalone roles, puppet and cloud-launcher, but we
currently install them with galaxy so depends-on patches don't
work. We also install them every time we run anything, even if
we don't need them for the playbook in question.
Add two roles, one to install a set of ansible roles needed by
the host in question, and the other to encapsulate the sequence
of running puppet, which now includes installing the puppet
role, installing puppet, disabling the puppet agent and then
running puppet.
As a followup, we'll do the same thing with the puppet modules,
so that we arent' cloning and rsyncing ALL of the puppet modules
all the time no matter what.
Change-Id: I69a2e99e869ee39a3da573af421b18ad93056d5b
2020-04-30 09:33:21 -05:00
|
|
|
cloud-launcher:
|
|
|
|
- bridge.openstack.org
|
2020-04-19 13:55:13 -05:00
|
|
|
codesearch:
|
2020-11-17 17:13:46 +11:00
|
|
|
- codesearch[0-9]*.opendev.org
|
2019-02-28 12:10:49 +00:00
|
|
|
control-plane-clouds:
|
|
|
|
- bridge.openstack.org
|
2022-02-14 21:20:06 +00:00
|
|
|
disabled: []
|
2018-10-31 16:13:33 -07:00
|
|
|
dns:
|
|
|
|
- adns*.opendev.org
|
|
|
|
- ns*.opendev.org
|
2021-06-07 11:06:18 +10:00
|
|
|
eavesdrop: eavesdrop[0-9]*.opendev.org
|
2018-12-19 20:31:35 +00:00
|
|
|
elasticsearch: elasticsearch[0-9]*.open*.org
|
|
|
|
ethercalc: ethercalc*.open*.org
|
|
|
|
etherpad: etherpad[0-9]*.open*.org
|
2019-02-15 15:18:15 -08:00
|
|
|
gitea:
|
|
|
|
- gitea[0-9]*.opendev.org
|
2019-02-19 14:41:54 -08:00
|
|
|
gitea-lb:
|
|
|
|
- gitea-lb[0-9]*.opendev.org
|
2018-09-12 11:32:42 -06:00
|
|
|
grafana:
|
2020-06-23 11:41:27 +10:00
|
|
|
- grafana[0-9]*.opendev.org
|
2018-09-12 11:32:42 -06:00
|
|
|
graphite:
|
2020-09-30 11:08:47 +10:00
|
|
|
- graphite*.opendev.org
|
2018-09-12 11:32:42 -06:00
|
|
|
health:
|
2019-02-27 10:32:02 -08:00
|
|
|
- health[0-9]*.openstack.org
|
2020-05-18 12:28:51 -07:00
|
|
|
jvb:
|
|
|
|
- jvb[0-9]*.opendev.org
|
2021-03-18 09:59:46 +11:00
|
|
|
kerberos-client:
|
|
|
|
- afs[0-9]*.open*.org
|
|
|
|
- afsdb*.open*.org
|
|
|
|
- kdc[0-9]*.openstack.org
|
|
|
|
- mirror[0-9]*.opendev.org
|
|
|
|
- mirror-update[0-9]*.opendev.org
|
|
|
|
- static[0-9]*.opendev.org
|
|
|
|
- ze[0-9]*.open*.org
|
2021-03-11 13:32:03 +11:00
|
|
|
kerberos-kdc:
|
|
|
|
- kdc03.openstack.org
|
|
|
|
- kdc04.openstack.org
|
|
|
|
kerberos-kdc-primary:
|
|
|
|
- kdc03.openstack.org
|
|
|
|
kerberos-kdc-replica:
|
|
|
|
- kdc04.openstack.org
|
2021-11-30 13:03:12 -08:00
|
|
|
keycloak: keycloak[0-9]*.opendev.org
|
2019-03-28 09:43:31 +11:00
|
|
|
letsencrypt:
|
2020-11-17 17:13:46 +11:00
|
|
|
- codesearch[0-9]*.opendev.org
|
2021-05-31 14:47:07 +10:00
|
|
|
- eavesdrop[0-9]*.opendev.org
|
2020-03-31 16:33:26 -05:00
|
|
|
- etherpad[0-9]*.opendev.org
|
2021-05-21 16:03:06 -07:00
|
|
|
- ethercalc[0-9]*.open*.org
|
2020-03-06 12:08:09 +11:00
|
|
|
- gitea[0-9]*.opendev.org
|
2020-06-23 11:41:27 +10:00
|
|
|
- grafana[0-9]*.opendev.org
|
2021-05-27 14:47:54 -07:00
|
|
|
- graphite[0-9]*.opendev.org
|
2020-01-10 14:10:25 -08:00
|
|
|
- insecure-ci-registry[0-9]*.opendev.org
|
2021-11-30 13:03:12 -08:00
|
|
|
- keycloak[0-9]*.opendev.org
|
2021-12-17 19:00:09 +00:00
|
|
|
- lists.katacontainers.io
|
|
|
|
- lists.openstack.org
|
2020-03-20 16:30:31 -07:00
|
|
|
- meetpad[0-9]*.opendev.org
|
2019-05-10 17:17:49 +10:00
|
|
|
- mirror[0-9]*.opendev.org
|
2020-03-06 12:08:09 +11:00
|
|
|
- nb[0-9]*.opendev.org
|
2021-06-29 11:57:10 +10:00
|
|
|
- paste[0-9]*.opendev.org
|
2021-05-27 14:47:54 -07:00
|
|
|
- refstack[0-9]*.openstack.org
|
2021-06-23 15:45:17 +10:00
|
|
|
- review[0-9]*.opendev.org
|
2019-12-06 10:17:52 +11:00
|
|
|
- static[0-9]*.opendev.org
|
2021-05-24 12:35:09 -07:00
|
|
|
- storyboard[0-9]*.opendev.org
|
2021-05-24 12:45:15 -07:00
|
|
|
- translate[0-9]*.open*.org
|
2021-05-10 09:00:41 -07:00
|
|
|
- zuul[0-9]*.opendev.org
|
2018-09-12 11:32:42 -06:00
|
|
|
logstash:
|
2018-12-19 20:31:35 +00:00
|
|
|
- logstash[0-9]*.open*.org
|
2018-09-12 11:32:42 -06:00
|
|
|
logstash-worker:
|
2018-12-19 20:31:35 +00:00
|
|
|
- logstash-worker[0-9]*.open*.org
|
2018-09-12 11:32:42 -06:00
|
|
|
mailman:
|
2018-12-19 20:31:35 +00:00
|
|
|
- lists*.katacontainers.io
|
|
|
|
- lists*.open*.org
|
2020-03-20 16:30:31 -07:00
|
|
|
meetpad:
|
|
|
|
- meetpad[0-9]*.opendev.org
|
2018-09-12 11:32:42 -06:00
|
|
|
mirror:
|
2019-05-10 17:17:49 +10:00
|
|
|
- mirror[0-9]*.opendev.org
|
2019-06-27 14:20:02 +10:00
|
|
|
mirror-update:
|
|
|
|
- mirror-update[0-9]*.opendev.org
|
2018-09-12 11:32:42 -06:00
|
|
|
nodepool:
|
2020-09-03 16:25:37 -07:00
|
|
|
- nb[0-9]*.opendev.org
|
2018-12-19 20:31:35 +00:00
|
|
|
- nl[0-9]*.open*.org
|
2018-09-12 11:32:42 -06:00
|
|
|
nodepool-builder:
|
2020-03-03 10:48:34 +11:00
|
|
|
- nb[0-9]*.opendev.org
|
2018-09-12 11:32:42 -06:00
|
|
|
nodepool-launcher:
|
2020-04-16 10:18:51 -05:00
|
|
|
- nl[0-9]*.open*.org
|
2018-09-12 11:32:42 -06:00
|
|
|
ns:
|
2018-12-19 20:31:35 +00:00
|
|
|
- ns[0-9]*.open*.org
|
2018-09-12 11:32:42 -06:00
|
|
|
paste:
|
2021-07-15 14:43:05 +10:00
|
|
|
- paste[0-9]*.opendev.org
|
2018-09-12 11:32:42 -06:00
|
|
|
puppet:
|
2018-12-19 20:31:35 +00:00
|
|
|
- cacti[0-9]*.open*.org
|
|
|
|
- elasticsearch[0-9]*.open*.org
|
|
|
|
- ethercalc[0-9]*.open*.org
|
2019-02-27 10:32:02 -08:00
|
|
|
- health[0-9]*.openstack.org
|
2018-12-19 20:31:35 +00:00
|
|
|
- logstash-worker[0-9]*.open*.org
|
|
|
|
- logstash[0-9]*.open*.org
|
|
|
|
- status*.open*.org
|
2019-02-16 18:00:10 +00:00
|
|
|
- storyboard-dev[0-9]*.opendev.org
|
|
|
|
- storyboard[0-9]*.opendev.org
|
2018-12-19 20:31:35 +00:00
|
|
|
- subunit-worker[0-9]*.open*.org
|
|
|
|
- translate-dev[0-9]*.open*.org
|
|
|
|
- translate[0-9]*.open*.org
|
2019-01-09 22:40:12 +01:00
|
|
|
puppet4:
|
2019-02-04 16:51:25 +01:00
|
|
|
- cacti[0-9]*.open*.org
|
|
|
|
- elasticsearch[0-9]*.open*.org
|
|
|
|
- ethercalc[0-9]*.open*.org
|
2019-03-16 21:09:37 +01:00
|
|
|
- health[0-9]*.openstack.org
|
2019-03-21 14:44:06 -07:00
|
|
|
- logstash-worker[0-9]*.open*.org
|
|
|
|
- logstash[0-9]*.open*.org
|
2019-03-21 14:41:15 -07:00
|
|
|
- status*.open*.org
|
2019-03-16 21:11:35 +01:00
|
|
|
- storyboard[0-9]*.opendev.org
|
2019-01-11 22:05:53 +01:00
|
|
|
- storyboard-dev[0-9]*.opendev.org
|
2019-03-16 21:11:35 +01:00
|
|
|
- subunit-worker[0-9]*.open*.org
|
|
|
|
- translate[0-9]*.open*.org
|
2019-01-11 22:05:53 +01:00
|
|
|
- translate-dev[0-9]*.open*.org
|
2018-09-12 11:32:42 -06:00
|
|
|
refstack:
|
2020-01-31 09:27:34 -08:00
|
|
|
- refstack[0-9]*.openstack.org
|
2019-01-31 09:59:26 -08:00
|
|
|
registry:
|
|
|
|
- insecure-ci-registry[0-9]*.opendev.org
|
2018-09-12 11:32:42 -06:00
|
|
|
review:
|
2021-06-23 15:45:17 +10:00
|
|
|
- review[0-9]*.opendev.org
|
2021-03-16 14:44:28 +11:00
|
|
|
# This group disables operations like project-managment and
|
|
|
|
# replication. It is intended for staging new production servers.
|
2021-07-21 13:11:19 +10:00
|
|
|
#review-staging:
|
2018-09-12 11:32:42 -06:00
|
|
|
static:
|
2019-12-06 10:17:52 +11:00
|
|
|
- static[0-9]*.opendev.org
|
2018-09-12 11:32:42 -06:00
|
|
|
status:
|
2018-12-19 20:31:35 +00:00
|
|
|
- status*.open*.org
|
2018-09-12 11:32:42 -06:00
|
|
|
storyboard:
|
2019-02-16 18:00:10 +00:00
|
|
|
- storyboard[0-9]*.opendev.org
|
2018-09-12 11:32:42 -06:00
|
|
|
storyboard-dev:
|
2019-01-27 17:04:56 +00:00
|
|
|
- storyboard-dev[0-9]*.opendev.org
|
2018-09-12 11:32:42 -06:00
|
|
|
subunit-worker:
|
2018-12-19 20:31:35 +00:00
|
|
|
- subunit-worker[0-9]*.open*.org
|
2018-09-12 11:32:42 -06:00
|
|
|
translate-dev:
|
2018-12-19 20:31:35 +00:00
|
|
|
- translate-dev[0-9]*.open*.org
|
2018-09-12 11:32:42 -06:00
|
|
|
translate:
|
2018-12-19 20:31:35 +00:00
|
|
|
- translate[0-9]*.open*.org
|
2018-09-12 11:32:42 -06:00
|
|
|
webservers:
|
2018-12-19 20:31:35 +00:00
|
|
|
- cacti[0-9]*.open*.org
|
2020-11-17 17:13:46 +11:00
|
|
|
- codesearch[0-9]*.opendev.org
|
2021-08-11 07:27:55 -07:00
|
|
|
# eavesdrop has its own group with custom ports
|
2018-12-19 20:31:35 +00:00
|
|
|
- ethercalc[0-9]*.open*.org
|
|
|
|
- etherpad[0-9]*.open*.org
|
2020-11-05 11:35:57 +11:00
|
|
|
- grafana[0-9]*.opendev.org
|
2020-09-30 11:08:47 +10:00
|
|
|
- graphite*.opendev.org
|
2019-02-27 10:32:02 -08:00
|
|
|
- health[0-9]*.openstack.org
|
2021-11-30 13:03:12 -08:00
|
|
|
- keycloak[0-9]*.opendev.org
|
2020-09-03 16:25:37 -07:00
|
|
|
- nb[0-9]*.opendev.org
|
2018-12-19 20:31:35 +00:00
|
|
|
- nl[0-9]*.open*.org
|
2021-07-15 14:43:05 +10:00
|
|
|
- paste[0-9]*.opendev.org
|
2021-03-12 13:48:38 +11:00
|
|
|
- refstack[0-9]*.openstack.org
|
2020-03-31 12:18:48 +11:00
|
|
|
- static[0-9]*.opendev.org
|
2018-12-19 20:31:35 +00:00
|
|
|
- status*.open*.org
|
2019-02-16 18:00:10 +00:00
|
|
|
- storyboard-dev[0-9]*.opendev.org
|
|
|
|
- storyboard[0-9]*.opendev.org
|
2018-12-19 20:31:35 +00:00
|
|
|
- translate-dev[0-9]*.open*.org
|
|
|
|
- translate[0-9]*.open*.org
|
2018-09-12 11:32:42 -06:00
|
|
|
zookeeper:
|
2018-12-19 20:31:35 +00:00
|
|
|
- zk[0-9]*.open*.org
|
2022-02-10 09:28:46 -08:00
|
|
|
zuul-lb:
|
|
|
|
- zuul-lb[0-9]*.opendev.org
|
2020-04-05 09:25:28 -05:00
|
|
|
zuul:
|
2021-05-10 09:00:41 -07:00
|
|
|
- ze[0-9]*.opendev.org
|
|
|
|
- zm[0-9]*.opendev.org
|
|
|
|
- zuul[0-9]*.opendev.org
|
2018-09-12 11:32:42 -06:00
|
|
|
zuul-executor:
|
2021-05-10 09:00:41 -07:00
|
|
|
- ze[0-9]*.opendev.org
|
2018-09-12 11:32:42 -06:00
|
|
|
zuul-merger:
|
2021-05-10 09:00:41 -07:00
|
|
|
- zm[0-9]*.opendev.org
|
2019-02-18 17:20:35 -08:00
|
|
|
zuul-preview:
|
2021-05-10 09:00:41 -07:00
|
|
|
- zp[0-9]*.opendev.org
|
2018-09-12 11:32:42 -06:00
|
|
|
zuul-scheduler:
|
2021-05-10 09:00:41 -07:00
|
|
|
- zuul[0-9]*.opendev.org
|
2020-04-05 09:25:28 -05:00
|
|
|
zuul-web:
|
2021-05-10 09:00:41 -07:00
|
|
|
- zuul[0-9]*.opendev.org
|