devel

devel@lists.centos.org

1 participants
4605 discussions

AAA/Auth switch / forwarding message from AAA team
by Fabian Arrotin 08 Feb '21

08 Feb '21

Hi all, As announced, there is initiative going on for the Fedora/CentOS auth backend merge (see https://lists.centos.org/pipermail/centos-devel/2021-January/076334.html as reminder) Let me forward what was discussed at the Fedora side this morning (and only impacting the "staging" setup, in case you'd be testing it in the next hours) : <forwarded message> Hey folks! The AAA team would like to test a re-import of the accounts in staging. We have learnt of a way to speed up the import significantly (20 times) and we'd like to test it. For that we'll need to remove all existing accounts and start from scratch. It means that if you're currently testing your application in staging, your account will disappear for something between hours to a couple days. We're going to start the process in 4-5 hours. Please shout if you're in the middle of something and you'd prefer us to wait for tomorrow. Thanks! Aurélien </forwarded message> -- Fabian Arrotin The CentOS Project | https://www.centos.org gpg key: 17F3B7A1 | twitter: @arrfab

1 0

CPE Report: 2021-02-05
by Aoife Moloney 05 Feb '21

05 Feb '21

Hi Everyone, If you would like to see this report and toggle to the section you are most interested in, I would suggest visiting this link https://hackmd.io/8iV7PilARSG68Tqv8CzKOQ?view and use the header bar on your left to skip to where you want to go! ## Initiative FYI Links Initiatives repo here: https://pagure.io/cpe/initiatives-proposal 2021 Quarterly Planning timetable here: https://docs.fedoraproject.org/en-US/cpe/time_tables/ so you know when I need it in by to review it. Details on initiative requesting/how to work with us on new projects here: https://docs.fedoraproject.org/en-US/cpe/initiatives/ ### Misc #### Conferences! * CentOS Dojo @ FOSDEM is on right now! Links to talks from Thursday are on the CentOS youtube channel and Rich is playing a blinder getting all the content uploaded in record time https://www.youtube.com/TheCentOSProject * NOTE: 'playing a blinder' means doing an excellent job for anyone unfamiliar with the term :) * Fedora has a booth as well @ FOSDEM this weekend! Make sure you stop by and say hi to all those great Fedorans who will be manning it this weekend https://chat.fosdem.org/#/room/#fedora-stand:fosdem.org ## Project Updates *The below updates are pulled directly from our CPE team call we have every week.* ## CentOS Updates ### CentOS * CI team members are migrating Fedora-Infra and Fedora-apps namespace whcih is one of the last few before we shut down legacy cluster * There is also an investigation spike on Zabbix upgrade to current LTS version which will then be rolled-out on the CentOS Infra once complete ### CentOS Stream * Python39 built and ready to compose * Dist-git repos are regularly up to date * Repos are populated in the CentOS Stream GitLab instance and will be publically viewable in the coming weeks * Very detailed talks on CentOS Stream given by Brian Stinson & Brian 'Bex' Exelbierd are watchable now on the CentOS YouTube channel - check them out! ### Fedora * Infra team are assisting with the testing of ipa/noggin for otp/other cases in stg * Their also doing a cleanup of a bunch of broken links on koji volume * Mass rebuild of rpms is done, modules are underway * FTBFS for the mass rebuild are filled ### CPE ARC TEAM (Community Platform Engineering Advanced Reconnaissance Team....Team) We have a new sub team in our team, led by Pingou, who are running advance investigations on some of the tech debt and bigger initiatives that the CPE team have in our backlog and they have been tackling Datanomer/Datagrepper tech debt first. The team have been partitioning the ‘messages’ table of datagrepper's DB, & hope to be able to test this setup next week * prod like in openshift https://datagrepper-monitor-dashboard.app.os.fedoraproject.org * prod like with a default delta of 3 days http://datagrepper.arc.fedorainfracloud.org/datagrepper/ * partitioned table + default delta of 3 days http://datagrepper-test.arc.fedorainfracloud.org/datagrepper/ * using the timescale postgresql plugin [not implemented yet] http://datagrepper-timescale.arc.fedorainfracloud.org ### Noggin/AAA * We faced some issues with IPA limits and tuning, and 2FA & still trying to figure out the best way to enforce 2FA with sudo. * We are getting closer to migrating from stg to prod and once the Fedora migration is complete, the CentOS accounts will be then imported. * NOTE: If you have an account in both CentOS & Fedora and have different email addresses associated with each, please update your preferred email address in your profile and look out for an email next week on your options. * The work tracker for this project can be found here https://github.com/orgs/fedora-infra/projects/6 ### Fedora Messaging Schemas * Elections pr reviewed https://pagure.io/elections/pull-request/90 * Next is Greenwave & waiverdb * Board the issues are tracked on are here https://github.com/orgs/fedora-infra/projects/7 ## Team Info ### Background: The Community Platform Engineering group, or CPE for short, is the Red Hat team combining IT and release engineering from Fedora and CentOS. Our goal is to keep core servers and services running and maintained, build releases, and other strategic tasks that need more dedicated time than volunteers can give. See our wiki page here for more information:https://docs.fedoraproject.org/en-US/cpe/ As always, feedback is welcome, and we will continue to look at ways to improve the delivery and readability of this weekly report. Have a great weekend! Aoife Source: https://hackmd.io/8iV7PilARSG68Tqv8CzKOQ?view -- Aoife Moloney Product Owner Community Platform Engineering Team Red Hat EMEA Communications House Cork Road Waterford

1 0

Which bug tracker should I use to report things to CentOS ? (recap)
by Fabian Arrotin 05 Feb '21

05 Feb '21

With some moving parts within the CentOS Project, some people are now confused about where to report things, as https://bugs.centos.org isn't the only bugs/tickets tracker, so let's just have a quick recap so that people aren't confused anymore ? :) # CentOS Stream (all kind of tickets) see https://wiki.centos.org/FAQ/CentOSStream#Where_do_I_report_bugs.3F So basically https://bugzilla.redhat.com/enter_bug.cgi?product=Red%20Hat%20Enterprise%20… # CentOS Infra, CBS, SIGs, mirror, CI, etc see previous mail : https://lists.centos.org/pipermail/centos-devel/2020-August/055980.html # All the rest (CentOS Linux pkgs, etc) https://bugs.centos.org Hope that it helps , as we have people asking on irc the status of a ticket that was filed in wrong tracker (and so also not correct category as for example infra categories were removed/archived on https://bugs.centos.org) and not reviewed. -- Fabian Arrotin The CentOS Project | https://www.centos.org gpg key: 17F3B7A1 | twitter: @arrfab

2 3

CBS default maven module for virt8-ovirt-44-el8
by Sandro Bonazzola 05 Feb '21

05 Feb '21

Hi, I'm seeing the following error: Executing: xmvn --batch-mode --offline -Dmaven.test.skip=true -Dworkspace.root.dir=/builddir/build/BUILD/apache-sshd-2.6.0 package org.fedoraproject.xmvn:xmvn-mojo:install org.fedoraproject.xmvn:xmvn-mojo:javadoc org.fedoraproject.xmvn:xmvn-mojo:builddep ['xmvn', '--batch-mode', '--offline', '-Dmaven.test.skip=true', '-Dworkspace.root.dir=/builddir/build/BUILD/apache-sshd-2.6.0', 'package', 'org.fedoraproject.xmvn:xmvn-mojo:install', 'org.fedoraproject.xmvn:xmvn-mojo:javadoc', 'org.fedoraproject.xmvn:xmvn-mojo:builddep'] /usr/share/maven/bin/mvn: line 36: /etc/java/maven.conf: No such file or directory error: Bad exit status from /var/tmp/rpm-tmp.QeIPBF (%build) Bad exit status from /var/tmp/rpm-tmp.QeIPBF (%build) RPM build errors: which is a known bug of maven 3.6 shipped in RHEL 8.3 ( https://bugzilla.redhat.com/show_bug.cgi?id=1897375) There's a build in koji ( https://koji.mbox.centos.org/koji/taskinfo?taskID=207396) which should have the fix for this issue. Can we get that build in CBS build root? If not, can we get maven:3.5 module enabled instead of maven:3.6? thanks, -- Sandro Bonazzola MANAGER, SOFTWARE ENGINEERING, EMEA R&D RHV Red Hat EMEA <https://www.redhat.com/> sbonazzo(a)redhat.com <https://www.redhat.com/> *Red Hat respects your work life balance. Therefore there is no need to answer this email out of your office hours.*

2 3

First round of RHEL programs announced
by Mike McGrath 04 Feb '21

04 Feb '21

Hi all, I know this was a hot topic on the list so I thought I'd share today's blog post which covers no-cost RHEL for small production workloads and no-cost RHEL for customer development teams. Keep in mind there are other programs coming, these just got done first. https://www.redhat.com/en/blog/new-year-new-red-hat-enterprise-linux-progra… Bullet Points: - Self-Support RHEL for no-cost in production use cases of up to 16 systems. - No-cost RHEL for customer development teams (larger number of systems for non-production cases). - Available no later than February 1 - Single Sign-on via a Red Hat account, or Github, Twitter, Facebook or other accounts (You'll soon not need to provide all kinds of personal information like you used to). -- Mike McGrath Linux Engineering - Chicago Red Hat mmcgrath(a)redhat.com T: (312)-660-3547

36 141

CentOS/Fedora authentication system merge (Please Read)
by Fabian Arrotin 03 Feb '21

03 Feb '21

# Introduction and background As it was preannounced some time ago , the CentOS Board agreed to merge the CentOS accounts (https://accounts.centos.org) with the Fedora FAS (https://admin.fedoraproject.org/accounts/) As both projects were running their own instance of FAS (running on el6/CentOS 6, so coming to EOL, so that needed to be migrated to new solution/platform), but that there are a lot of contributors common to both projects, it made sense to "migrate and merge" both into one, and so having only one account that can be used for both. The AAA/Noggin team worked in the last months on the new authentication system that will be used as foundation. The core block will be (Free)IPA (https://www.freeipa.org , already available in the distribution) and the community portal feature will be provided by noggin (https://github.com/fedora-infra/noggin) If you want to know more about noggin, consider watching the presentation given at last Fedora Nest event (https://www.youtube.com/watch?v=x1SevUmkE60) # What does it mean for you, contributors and SIG members ? Fedora already had an IPA infra, but "hidden" behind FAS, so accounts were already created in IPA backend. For CentOS, we were just using plain FAS, so users in our own backend (fas db). The "Merge" operation will go like this : - Fedora will kick fas2ipa script (https://github.com/fedora-infra/fas2ipa) synchronizing FAS attributes back into IPA, including group memberships coming from FAS/Fedora - Then the same process will be ran but importing from ACO (https://accounts.centos.org) into the same IPA backend. That's where the "fun" begins: * If the same nick/account exists at both side, the script is considering FAS as authoritative (remember, the FAS user *already* exists there, and is only modified for group[s] membership and attributes) * What is used to consider same nick/account being the same person ? the email (validated when registering account) will be used as primary key. So that means that you should *now* verify/update your email address in FAS and ACO so that they match * in case of a email address mismatch, the ACO account isn't migrated (group membership) but put in a queue to be verified * in case of matching email address, existing account is added to imported ACO groups The "open" question is about what to do for same account but in fact being different people (question is debated between Fedora and CentOS through the AAA initiative) # What has been already done ? You can follow publicly the status through dedicated tracker ( https://github.com/orgs/fedora-infra/projects/6 ), but let me focus on the CentOS Side (sending this to centos-devel so centos contributors) In the last months, Fedora already deployed a staging (.stg.) IPA instance, as well as a noggin community portal. For CentOS, we deployed (to be able to test integration) the following components in front of the Fedora IPA: * https://accounts.stg.centos.org (using noggin, with a centos visual theme applied) * https://id.stg.centos.org (ipsilon, used for openid/openidc IdP) We then reached out to some "key users" to validate that some applications migrated to new authentication system were working fine. We tested with : * pagure (https://git.stg.centos.org) * koji * openshift/OCP * some other apps using openid In December 2020, there was a first ran of the fas2ipa script, so (consider this a snapshot) existing accounts in both FAS and ACO were merged. >From that import, there were 123 accounts that were duplicates ones, but as said, it can be that they are the same account but using different email addresses. # What do you have to do ? You can try to login through https://accounts.stg.centos.org and see if you can login. Important remark: if you *didn't* have a FAS account , your account was imported/created for the first time in IPA, so that means that you'll have to use the "Forgot Password ?" feature on portal to reset your account (mail will be sent to email address tied to your account) # When will the real migration happen ? We'll wait on AAA/noggin team to give us estimated date, and when they'll migrate Fedora first. Once that will be done, we'll migrate ACO to the new setup (probably fas2ipa script ran during a week-end, but to be announced) # How will that impact my workflow for CentOS as SIG member ? Worth knowing that all deployed services using ACO will have to be reconfigured for AAA. That currently means : * https://git.centos.org (and also the MQTT bus for git push notifications) * https://cbs.centos.org (and also non public signing service) * other small services using OpenID/OpenIDC for authentication (https://blog.centos.org, some jenkins instances used by QA team, etc) As said, we have already staged all changes to support new auth in our ansible roles. When we'll have rolled out these changes, your existing TLS certificate that you use to authenticate with for cbs.centos.org *will not* work anymore (important) That means that you'll have to retrieve a new TLS cert, signed by the IPA CA cert. How to do that ? I'll see about how porting this to know repository, but for now, there is a copr repo that you can use : https://copr.fedorainfracloud.org/coprs/arrfab/fasjson-client/ IMPORTANT : do *not* use this pkg now, or do this from another workstation/vm/account/whatever : the new 'centos-cert' util would replace your currently working TLS cert (from ACO) . (Well, as fasjson for prod *isn't* deployed yet, that would not work at all, but it would when deployed If you have questions, feel free to ask in this thread, or join #fedora-aaa on Freenode. -- Fabian Arrotin The CentOS Project | https://www.centos.org gpg key: 17F3B7A1 | twitter: @arrfab

3 3

ConfigManagement SIG : removal of old/unmaintained ansible versions
by Fabian Arrotin 02 Feb '21

02 Feb '21

Notification: So far, the ConfigManagement SIG rebuilt and shipped some Ansible versions through different repos (per "branch") over the last months/years , so we currently still have on mirror.centos.org (and so external mirrors) the following repositories : For CentOS 7: - ansible 2.6 - ansible 2.7 - ansible 2.8 - ansible 2.9 For CentOS 8 (also working on 8-stream) : - ansible 2.9 Per Ansible EOL policy (see https://docs.ansible.com/ansible/devel/reference_appendices/release_and_mai…) we'll continue to maintain 2.8 (security fixes if they appear) and 2.9 but we'll remove previous versions/repositories. Worth knowing that they'd still be available through vault.centos.org though, but not available directly through a centos-release-ansible*.rpm (configuring yum/dnf repositories on systems) So far I never had a chance/time to look at ansible 2.10, as there is a split between ansible-base and ansible-core and then collections. My goal would be to discuss with EPEL/Fedora maintainer (Kevin Fenzi) about the best way to have it working and then we can start (re)building through configmanagement tags on https://cbs.centos.org Kind Regards, -- Fabian Arrotin The CentOS Project | https://www.centos.org gpg key: 17F3B7A1 | twitter: @arrfab

4 3

Reminder: CentOS Dojo this week. FOSDEM this weekend
by Rich Bowen 02 Feb '21

02 Feb '21

TL;DR: https://wiki.centos.org/Events/Dojo/FOSDEM2021 <-- Dojo Thursday and Friday https://fosdem.org/2021/ <-- FOSDEM Saturday and Sunday The full schedule of talks for the Dojo is available at the above URL, and includes a roundtable discussion with (some of) the Board. Registration is free, and all talks will be recorded for later viewing on our YouTube channel. But of course if you want to participate in the Q&A aspect of the event, you'll need to be there. Hoping to see you Thursday, --Rich

1 0

[Storage-SIG] Meeting minutes of the CentOS Storage SIG - 2021 - Feb - 02
by Francesco Pantano 02 Feb '21

02 Feb '21

=====================================*#centos-meeting2: Monthly Storage SIG* ===================================== Meeting started by ndevos at 10:03:03 UTC. The full logs are available at https://www.centos.org/minutes/2021/February/centos-meeting2.2021-02-02-10.… *Meeting summary ---------------* * *Roll Call* (ndevos, 10:03:12) * *Agenda* (ndevos, 10:05:18) * LINK: https://hackmd.io/Epc35JIESaeotoGzwu5R5w (ndevos, 10:05:25) * *per sig ML and review on the Storage sig page* (fmount, 10:08:29) * AGREED: use *[Storage-SIG]* in subjects to centos-devel, so that it is easy to filter, and others automatically see our updates/discussions too (ndevos, 10:13:56) * *ceph dist-git usage* (fmount, 10:17:44) * AGREED: fix calendar and wiki with meeting irc chan name (gfidente, 10:17:48) * ACTION: fmount to request a cephadm distgit repo in git.centos.org (fmount, 10:51:28) * Open Floor (ndevos, 11:02:39) Meeting ended at 11:03:39 UTC. *Action Items* - fmount to request a cephadm distgit repo in git.centos.org - fmount to learn about the dist-git ceph process and reach kkeithley for any additional info -- Francesco Pantano GPG KEY: F41BD75C

1 0

CentOS Stream 8 kernel
by Gena Makhomed 01 Feb '21

01 Feb '21

Hello All, I found regression in the CentOS Stream 8 kernels, and create bug report https://bugzilla.redhat.com/show_bug.cgi?id=1913806 After reading https://wiki.centos.org/Contribute/CentOSStream I try to download kernel sources and look for root cause of bug, but dist-git and source-git repos does not contain kernel sources, even if I try to execute %prep phase. For this reason I can't even try to find root cause of this bug by myself. This bug is critical for me, because currently I try to use systemd-nspawn for containers virtualization in production. If future CentOS 8.4 will contain this bug - it will be disaster. What else I can do (as user or developer) for fixing this bug? P.S. https://centos.org/distro-faq/ Q5: Does this mean that CentOS Stream is the RHEL BETA test platform now? A: No. CentOS Stream will be getting fixes and features ahead of RHEL. Generally speaking we expect CentOS Stream to have fewer bugs and more runtime features as it moves forward in time but always giving direct indication of what is going into a RHEL release ================================== But currently I hit the bug, which is absent in CentOS 8.3 but present in CentOS Stream 8. Looks like CentOS Stream 8 is really the beta version for future RHEL minor release, despite the CentOS FAQ. Sorry, but this is true. -- Best regards, Gena

9 13

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

devel