devel

devel@lists.centos.org

5 participants
4641 discussions

auth switch status update : git.centos.org is using new auth source
by Fabian Arrotin 06 Apr '21

06 Apr '21

Just a quick mail to mention that https://git.centos.org was also switched to new auth system and there was just a httpd service restart to reload pagure with new settings. Cheers, -- Fabian Arrotin The CentOS Project | https://www.centos.org gpg key: 17F3B7A1 | twitter: @arrfab

1 0

auth switch status update : cbs.centos.org is back online
by Fabian Arrotin 06 Apr '21

06 Apr '21

Hi all, As announced, we started today the centos infra switch to new authentication source (merged with Fedora) So https://accounts.centos.org is now live and using same auth backend (IPA) than https://accounts.fedoraproject.org This morning at 6:00am utc, I kicked the ansible roles to reflect new TLS/CA for https://cbs.centos.org koji systems and took it offline for sanity tests. - kojihub/web were converted - tested authentication with new TLS cert - tested remote authentication with personal TLS cert - tested to submit koji tasks - verified that all builders were back on the hub and enabled - tested a tag-build/untag-build to test the signing process - tested the new sync script to fetch users/groups from IPA (through https://fasjson.fedoraproject.org , IPA API endpoint using kerberos auth) As all was working, https://cbs.centos.org was then back online around 6:30am UTC What do you need to do : Get your new TLS cert that will be used for cert authentication (new TLS cert as new CA, coming from IPA backend) The SIGGuide (https://wiki.centos.org/SIGGuide) was updated to reflect the new way to retrieve your cert (anchor link : https://wiki.centos.org/SIGGuide#SIGGuide.2FSIGProcess.Community_Buildsystem) PS : worth knowing that if you just had your account imported in new IPA backend, you have *first* to reset your own password (password salt/hash from ACO isn't compatible with the one from IPA, so just reset your password on portal https://accounts.centos.org) PS2: as some users were skipped during import process , it can be that you're in a situation where you either don't exist, or your group membership wasn't reflected (and so you currently don't have build rights anymore in koji/cbs). If that's the case, just ask your SIG chair to get in touch Now moving to other services to be converted -- Fabian Arrotin The CentOS Project | https://www.centos.org gpg key: 17F3B7A1 | twitter: @arrfab

1 0

Hyperscale SIG Quarterly Report for 2021Q1
by Davide Cavalca 05 Apr '21

05 Apr '21

Hello! I just posted our first activity report for the Hyperscale SIG on the CentOS blog: https://blog.centos.org/2021/04/centos-hyperscale-sig-quarterly-report/ One thing I'll signal boost: we have released a systemd 247 backport in the SIG repository. This backport includes experimental SELinux support via an overlay module; if you use SELinux in your deployments and would like to provide feedback, that would be much appreciated. Cheers Davide

1 0

Fedora/CentOS authentication merge : April 1st status
by Fabian Arrotin 01 Apr '21

01 Apr '21

Let me start this email by saying that it's *not* a joke (despite April 1st date) :-) As announced, we turned today https://accounts.centos.org into Read-Only mode , so that we were sure that nothing would change (frozen state) wrt users status and group membership, while all services continued to be usable (including for example https://cbs.centos.org) Mark O'Brien and myself then kicked the fas2ipa script, to ensure that it would have enough time to parse the CentOS accounts and groups as first sanity check. Number of users: 1097 Number of groups: 31 But we found a particular case for people who were registered in both FAS and ACO , with different nickname *but* same email address, so the script failed to import these users (81 accounts) The taken action was to send a mail to concerned users so that they can decide which solution they want to adopt : Basically, either consolidating centos group membership on their FAS account (and so using their FAS account for both projects) *or* update their email address so that the fas2ipa script would be able to import them (but that would mean two different accounts in same auth platform) . We'll take action on case-by-case through email feedback for these users. All in all it seems that it went ok for the sanity check tests and that means that it's green light for the real infra switch on Tuesday April 6th. PS : quite some users were in SKIPPED state, as they never took action for the "email address match for same nickname" situation, explained in previous email (https://lists.centos.org/pipermail/centos-devel/2021-March/076690.html) Kind Regards, -- Fabian Arrotin The CentOS Project | https://www.centos.org gpg key: 17F3B7A1 | twitter: @arrfab

1 0

Infrastructure SIG Bi-Weekly Meeting Report: 2021-03-29
by Aoife Moloney 31 Mar '21

31 Mar '21

Hi All, Please find below Infrastructure SIG report & meeting minutes from our bi-weekly meeting on Monday 29th March. Meeting minutes https://www.centos.org/minutes/2021/March/centos-meeting.2021-03-29-14.00.t… Attendees: amoloney (chair), bstinson, arrfab, bowen, mobrien Discussion: grant carlwgeorge access to mirror.centos.org Decision: approved Reason: continues the progression of being able to build test and push content out Action: arrfab to add carlwgeorge to appropriate setup Discussion: Add another person into IPA for CentOS to expand coverage for maintenance and support Decision: approved pending account migration completion and peerson(s) to be added to be discussed at next meeting on 12th April Reason: this will allow us time to review what level of support CentOS needs in IPA for Fedora once the migration is completed so we can add the correct number of people at the correct levels for better coverage and support Discussion: Should we be reviewing CentOS Board tracker in these meetings? Decision: No Reason: if there is something needing infra assignment at the board level, the corresponding need should be expressed either through another tracker and/or through discussion Our next meeting is on Monday 12th April @ 1400 UTC +1 on IRC channel #centos-meeting. We look forward to seeing you there if you would like to get involved in the discussions. On behalf of the Infrastructure SIG, Aoife -- Aoife Moloney Product Owner Community Platform Engineering Team Red Hat EMEA Communications House Cork Road Waterford

1 0

CPE Weekly: 2021-03-31
by Aoife Moloney 31 Mar '21

31 Mar '21

Hi Everyone, Sorry for the two week gap since my last report, we had a busy time in the CPE team with the new fedora accounts deployment, our quarterly planning cycle started for Q2 and Ireland had a bank holiday mid week which *seemed* like a great idea at the time. Until no-one knew what day it was for about a week! So here I am, right at the end of Q1 with the CPE teams final weekly report for January, February and March... two days early :) If you would like to see this report and toggle to the section you are most interested in, I would suggest visiting this link https://hackmd.io/8iV7PilARSG68Tqv8CzKOQ?view and use the header bar on your left to skip to where you want to go! ## Initiative FYI Links CPE had our quarterly planning call last Thursday 26th March to prioritize our project work going into Q2 (quarter 2, which is April, May & June). Our initiative repo quarterly boards have been updated https://pagure.io/cpe/initiatives-proposal/boards/2021Q2 and our repo can be accessed here: https://pagure.io/cpe/initiatives-proposal Our 2021 Quarterly Planning timetable can also be viewed here if you are curious on when our next quarterly planning session is: https://docs.fedoraproject.org/en-US/cpe/time_tables/ And finally, details on initiative requesting/how to work with us on new projects here: https://docs.fedoraproject.org/en-US/cpe/initiatives/ Going into Q2, the CPE team will work on rpmautospec https://pagure.io/cpe/initiatives-proposal/issue/11 and aim to deliver this project within the months of April, May & June. We are starting this project on Monday 12th April and will keep you posted on where the team will track work and what IRC channel they will use for comms. You can also expect a Q1 blog post from us in the next week or two highlighting the work that the team delivered over the last quarter too. ### Misc * CentOS Dojo for May 13th & 14th CFP closes on Monday 5th April so please submit your talks asap! https://wiki.centos.org/Events/Dojo/May2021 ## Project Updates *The below updates are pulled directly from our CPE team call we have every week.* ## CentOS Updates ### CentOS * Account Migration is scheduled for next Tuesday 6th April * Please read this important email from Fabian Arrotin on verifying/updating your CentOS and Fedora email address https://lists.centos.org/pipermail/centos-devel/2021-March/076690.html * CentOS CI is also updating ocp.stg to 4.7.3 & will roll out to production by the end of the week if all goes well ### CentOS Stream * Centpkg is build and available in Fedora and EPEL! * MBS is being deployed * ODCS is deployed * Scripts for mass rebuild are ready * CVE Dashboard for CentOS 8 Stream is up * In short, lots of good things coming! ### Fedora * F34 beta is out! * Mass reboot is scheduled for tomorrow, April 1st so please expect some issues due to this required outage * Final Freeze is due to start on Tuesday April 6th @ 1400 UTC - F34 schedule can be viewed here https://fedorapeople.org/groups/schedule/f-34/f-34-key-tasks.html ### Noggin/AAA * Fedora Accounts is out!!!!!!!!!!!!!!!! * There are still some corner case issues being worked through but users should be able to access fedora services as normal. **NOTE** you will need to reset your password if you have not already done so if you receive an Unable to call ID or some note like that. Please request a password reset and wait for the mail to land. Then follow the link and reset your password. * For any issues, please open a ticket on https://pagure.io/fedora-infrastructure/issues * The team can be found on #fedora-aaa for discussions on IRC * And please report any issues you find relating to the Noggin application in the repo https://github.com/fedora-infra/noggin **ANOTHER NOTE** Thank you so so so much to all of the members of the fedora community and wider open source communities who assisted our team last week when we were deploying the new system. Your help did not go unnoticed and unappreciated and we could not have done this work without any of you. You know who you are, and you have my and the wider teams sincerest thanks and gratitude :) ## Team Info ### Background: The Community Platform Engineering group, or CPE for short, is the Red Hat team combining IT and release engineering from Fedora and CentOS. Our goal is to keep core servers and services running and maintained, build releases, and other strategic tasks that need more dedicated time than volunteers can give. See our wiki page here for more information:https://docs.fedoraproject.org/en-US/cpe/ As always, feedback is welcome, and we will continue to look at ways to improve the delivery and readability of this weekly report. Have a great weekend! Aoife Source: https://hackmd.io/8iV7PilARSG68Tqv8CzKOQ?view -- Aoife Moloney Product Owner Community Platform Engineering Team Red Hat EMEA Communications House Cork Road Waterford

1 0

Last call: Dojo CFP closes this weekend
by Rich Bowen 30 Mar '21

30 Mar '21

For those of you who like to leave things to the last minute - this is your final warning that the CFP (Call for presentations) for the May CentOS Dojo will close when I get to my desk on Monday morning - that is, approximately 12:00 UTC Monday April 4th. Details and CFP are here: https://wiki.centos.org/Events/Dojo/May2021 Note also that as of right now, we have enough submissions for a one-day event. We had initially scheduled 2 days, and that is still possible if I hear from more of you! --Rich

1 0

CentOS authentication switch : Last Call for you to verify/update your email address
by Fabian Arrotin 29 Mar '21

29 Mar '21

Hi all, We already announced multiple times the CentOS authentication merge with Fedora. That means that you'll use (starting next week) only *one* account for both projects. That also means that we asked *all* of you to have verified that if you registered an account on both sides before, you'd be updating your profile so that email addresses would match (as a primary key, used as filter for the import tool). As of today, we still have 175 CentOS user accounts in this conflicting situation :/ So this is the last call to ask you to verify and update your email addresses so that they match (if you are the same person that is). Important note from the script author : if you used your @fedoraproject.org email address to register your account on https://accounts.centos.org, the script will complain about "circular email address", as in new system, your @fedoraproject.org will be created *on*/*from* that new IPA based solution. So that means : update now on https://accounts.centos.org your email address to match the one from https://accounts.fedoraproject.org. If you think that you're late to the party, let me just say (after a very quick look) that it *also* concerns some CentOS Board/Core members :-) (subliminal message : update $now) As a reminder, every account *not* imported will lead to no group membership added, and so potentially no ACL applied to let you build on https://cbs.centos.org, or access any other service using new merged portal as authentication source. Kind Regards, -- Fabian Arrotin The CentOS Project | https://www.centos.org gpg key: 17F3B7A1 | twitter: @arrfab

1 0

Infrastructure SIG Meeting Agenda: 2021-03-29
by Aoife Moloney 28 Mar '21

28 Mar '21

Hi all, Please note the Infrastructure SIG will have a bi-weekly meeting tomorrow, 29th March @ 1500 UTC+1 on #centos-meeting. The agenda thus far is: - Review any open tickets relating to infrastructure on https://git.centos.org/centos/board/issues - Review and prioritize tickets from https://pagure.io/centos-infra/issues - AOB Please join IRC channel #centos-meeting if you would like to discuss anything with the SIG. Kindest regards, Aoife, on behalf of the CentOS Infra SIG -- Aoife Moloney Product Owner Community Platform Engineering Team Red Hat EMEA <https://www.redhat.com> Communications House Cork Road Waterford <https://www.redhat.com>

1 0

Fedora/CentOS authentication merge : please read
by Fabian Arrotin 27 Mar '21

27 Mar '21

Hi All ! As announced multiple times (including but not limited to https://lists.centos.org/pipermail/centos-devel/2021-February/076442.html) Fedora and CentOS will merge authentication soon. It was already merged for Staging environment, where SIGs contributors could test things and now it's time to really merge https://accounts.centos.org and https://admin.fedoraproject.org/accounts on the new system. Let me point you first to the mail sent to Fedora so please read it first to have a little bit of background/history : https://lists.fedoraproject.org/archives/list/announce@lists.fedoraproject.… As you can see, the Fedora migration will happen next week. Based on current timeline and agenda, we'll proceed like this for the CentOS migration : * Friday April 2nd : * We'll "freeze" https://accounts.centos.org in Read-only mode * Fedora infra team launches the fas2ipa script to import centos users/groups not existing (yet) in new IPA setup (if you had a fedora account matching your account in accounts.centos.org, you'll not be imported again, but rather be added to your imported centos groups - so merged -) * Monday April 5th * quick sanity check for the import script result and some internal checks, then * Real CentOS infra authentication switch : it's hard to give a timeline but we'll start with https://cbs.centos.org (I'll announce downtime in separate mail when we'll have full agenda) and then proceed with the other services. How will you be impacted ? If you use any kind of service authenticated by either TLS cert from https://accounts.centos.org (that's the case for cbs.centos.org, or mqtt notifications), you'll *have* to retrieve a new cert. (more information in the SIGGuide will appear on due time. Same for services using authentication tied to https://accounts.centos.org through https://id.centos.org (for openid/openidc, etc) So this mail doesn't contain all the information for how to retrieve new TLS cert, how to reset password, etc but more to give you the date when we'll have smallest possible downtime while reconfiguring system to switch to new authentication (FWIW, all changes were automated through ansible for our staging environment, so we'll just reapply same process for the production one) Have a nice week-end ! -- Fabian Arrotin (all excited to finally see this project arriving at deploy time) :) The CentOS Project | https://www.centos.org gpg key: 17F3B7A1 | twitter: @arrfab

1 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

devel