On 26/06/2025 15:13, Fabian Arrotin wrote:
As you're probably aware, Fedora announced some time ago (https:// communityblog.fedoraproject.org/fedora-datacenter-move-later-this- year-2025-version/) that they'd move to a new DC. CentOS will also migrate, but majority of our infra is located in a different DC, and so we'll just announce when we'll migrate our own infra there (this year but not this quarter).
The updated blog post version (https:// communityblog.fedoraproject.org/2025-fedora-datacenter-move-update/) was mentioning new Fedora plans and main ticket to track Fedora work is https://pagure.io/fedora-infrastructure/issue/12603
Fedora migration will happen next week, but let's list potential impacts on CentOS infra, the main one being probably/surely authentication. As you know, we use common authentication for Fedora and CentOS (so FAS accounts are also ACO accounts, same IPA cluster backend)
# Authentication We have our own idp instance (https://id.centos.org) that is already running from new DC (migrated today) but we still expect some authentication issues next week when the whole Fedora infra will move from one DC to the other.
That's true for things like :
- https://accounts.centos.org (an app running in Fedora openshift
cluster - that needs to be migrated, equivalent to https:// accounts.fedoraproject.org ) => impact: users not able to sponsor/remove other from groups while maintenance is over
- https://fasjson.fedoraproject.org (what permits to retrieve users/
groups for some services and also TLS certs used to auth against CBS) => impact: services using fasjson endpoint to retrieve users/group membership will fail to sync (like cbs.centos.org, openshift, etc)
All CentOS services will remain "up and running" but there will be some delays to reflect authentication changes.
So if you'll encounter beginning of next week some small authentication issues, that can explain why (id.centos.org will be up and running but we depend on Fedora infra backend to be itself up and running).
# mirrors and CentOS Stream / SIGs content Other potential impact for centos users : CentOS Stream is depending on Fedora mirrormanager to create needed metalinks used in .repo files. As mirrormanager main crawler will be down during the DC move, Fedora and CentOS users will just retrieve metalinks from "cached" information on Fedora proxies (outside of new DC). That means that operation involving dnf would sometimes fail to reflect new content being pushed out, as we don't know Fedora mirrormanager will be back online and with refreshed content set reflected by mirrors crawler.
# CBS For SIGs using epel, we expect also issue while waiting for dl.fedoraproject.org to be up and running again. Other SIGs only building for/against CentOS Stream and RHEL will not be impacted
status update : I got confirmation that IPA backend servers are operational in new DC and that some frontend apps not needed any DB (nor openshift PersistentVolume[s]) are already redeployed. That means that needed app for https://accounts.centos.org is working and so migrated public CNAME to point to new DC.
I'll post other status updates when other services will be fully migrated by Fedora infra team and verified for CentOS counter-parts