ansible-koji/roles/koji_bootstrap/tasks/main.yaml
Rénich Bon Ćirić 89d6f66be8
feat: Integración de Siguldry PKCS#11 y spooler de firmas
* Implementación del rol de Ansible 'siguldry' para CentOS Stream 10
* Migración del plugin de firmas de Koji Hub a un spooler asíncrono
* Modificación de roles para utilizar empaquetamiento RPM nativo de siguldry-pkcs11
* Documentación de decisiones (ADRs) y roadmap en docs/technical/
* Limpieza de binarios locales pesados de PKCS#11 en Ansible

Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
2026-06-16 10:06:44 -06:00

259 lines
11 KiB
YAML

---
- name: Add kojira user
ansible.builtin.command: "sudo -u {{ koji_admin_user }} koji --config={{ koji_hub_admin_user_koji_dir }}/config add-user kojira"
register: koji_bootstrap_add_user_result
changed_when: "'User added' in koji_bootstrap_add_user_result.stdout"
failed_when: "koji_bootstrap_add_user_result.rc != 0 and 'already exists' not in koji_bootstrap_add_user_result.stderr"
- name: Grant repo permission to kojira user
ansible.builtin.command: >
sudo -u {{ koji_admin_user }} koji
--config={{ koji_hub_admin_user_koji_dir }}/config
grant-permission repo kojira
register: koji_bootstrap_grant_permission_result
changed_when: "'Permission granted' in koji_bootstrap_grant_permission_result.stdout"
failed_when: "koji_bootstrap_grant_permission_result.rc != 0 and 'already has permission' not in koji_bootstrap_grant_permission_result.stderr"
- name: Create main build tag
ansible.builtin.command: >
sudo -u {{ koji_admin_user }} koji
--config={{ koji_hub_admin_user_koji_dir }}/config
add-tag --arches x86_64 {{ koji_build_tag }}
register: koji_bootstrap_add_tag_result
changed_when: "'Tag created' in koji_bootstrap_add_tag_result.stdout"
failed_when: "koji_bootstrap_add_tag_result.rc != 0 and 'already exists' not in koji_bootstrap_add_tag_result.stderr"
- name: Create x86_64 build tag
ansible.builtin.command: >
sudo -u {{ koji_admin_user }} koji
--config={{ koji_hub_admin_user_koji_dir }}/config
add-tag --parent {{ koji_build_tag }} --arches x86_64 {{ koji_build_tag }}-build
register: koji_bootstrap_add_arch_tag_result
changed_when: "'Tag created' in koji_bootstrap_add_arch_tag_result.stdout"
failed_when: "koji_bootstrap_add_arch_tag_result.rc != 0 and 'already exists' not in koji_bootstrap_add_arch_tag_result.stderr"
- name: Enable automatic build NVR bumping
ansible.builtin.command: >
sudo -u {{ koji_admin_user }} koji
--config={{ koji_hub_admin_user_koji_dir }}/config
edit-tag --extra autorelease=1 {{ koji_build_tag }}-build
register: koji_bootstrap_edit_tag_result
changed_when: "'Tag updated' in koji_bootstrap_edit_tag_result.stdout"
failed_when: "koji_bootstrap_edit_tag_result.rc != 0 and 'tag not found' not in koji_bootstrap_edit_tag_result.stderr"
- name: Create build target
ansible.builtin.command: >
sudo -u {{ koji_admin_user }} koji
--config={{ koji_hub_admin_user_koji_dir }}/config
add-target {{ koji_build_tag }} {{ koji_build_tag }}-build
register: koji_bootstrap_add_target_result
changed_when: "'Target created' in koji_bootstrap_add_target_result.stdout"
failed_when: "koji_bootstrap_add_target_result.rc != 0 and 'already exists' not in koji_bootstrap_add_target_result.stderr"
- name: Add CentOS Stream 10 BaseOS external repository
ansible.builtin.command: >
sudo -u {{ koji_admin_user }} koji
--config={{ koji_hub_admin_user_koji_dir }}/config
add-external-repo -t {{ koji_build_tag }}-build centos-stream-10-baseos
https://mirror.stream.centos.org/10-stream/BaseOS/x86_64/os/
register: koji_bootstrap_add_baseos_repo_result
changed_when: "'External repository created' in koji_bootstrap_add_baseos_repo_result.stdout"
failed_when: "koji_bootstrap_add_baseos_repo_result.rc != 0 and 'already exists' not in koji_bootstrap_add_baseos_repo_result.stderr"
- name: Add CentOS Stream 10 AppStream external repository
ansible.builtin.command: >
sudo -u {{ koji_admin_user }} koji
--config={{ koji_hub_admin_user_koji_dir }}/config
add-external-repo -t {{ koji_build_tag }}-build centos-stream-10-appstream
https://mirror.stream.centos.org/10-stream/AppStream/x86_64/os/
register: koji_bootstrap_add_appstream_repo_result
changed_when: "'External repository created' in koji_bootstrap_add_appstream_repo_result.stdout"
failed_when: "koji_bootstrap_add_appstream_repo_result.rc != 0 and 'already exists' not in koji_bootstrap_add_appstream_repo_result.stderr"
- name: Add CentOS Stream 10 EPEL external repository
ansible.builtin.command: >
sudo -u {{ koji_admin_user }} koji
--config={{ koji_hub_admin_user_koji_dir }}/config
add-external-repo -t {{ koji_build_tag }}-build centos-stream-10-epel
https://mirror.facebook.net/fedora/epel/10/Everything/x86_64/
register: koji_bootstrap_add_epel_repo_result
changed_when: "'External repository created' in koji_bootstrap_add_epel_repo_result.stdout"
failed_when: "koji_bootstrap_add_epel_repo_result.rc != 0 and 'already exists' not in koji_bootstrap_add_epel_repo_result.stderr"
- name: Add CentOS Stream 10 CRB external repository
ansible.builtin.command: >
sudo -u {{ koji_admin_user }} koji
--config={{ koji_hub_admin_user_koji_dir }}/config
add-external-repo -t {{ koji_build_tag }}-build centos-stream-10-crb
https://mirror.stream.centos.org/10-stream/CRB/x86_64/os/
register: koji_bootstrap_add_crb_repo_result
changed_when: "'External repository created' in koji_bootstrap_add_crb_repo_result.stdout"
failed_when: "koji_bootstrap_add_crb_repo_result.rc != 0 and 'already exists' not in koji_bootstrap_add_crb_repo_result.stderr"
- name: Download repomd.xml from CentOS Stream 10 build repo
ansible.builtin.get_url:
url: https://kojihub.stream.centos.org/kojifiles/repos/c10s-build/latest/x86_64/repodata/repomd.xml
dest: /tmp/c10s-repomd.xml
- name: Install zstd for decompression of comps
ansible.builtin.dnf:
name: zstd
state: present
- name: Extract comps.xml path
ansible.builtin.shell: grep 'comps.xml' /tmp/c10s-repomd.xml | head -n 1 | sed -e 's/.*href="//' -e 's/".*//'
register: comps_path
changed_when: false
- name: Download comps.xml
ansible.builtin.get_url:
url: "https://kojihub.stream.centos.org/kojifiles/repos/c10s-build/latest/x86_64/{{ comps_path.stdout }}"
dest: /tmp/c10s-comps-raw
- name: Decompress comps.xml if needed
ansible.builtin.shell: |
set -e
file_type=$(file -b --mime-type /tmp/c10s-comps-raw)
if [[ "$file_type" == "application/zstd" ]]; then
unzstd -f -o /tmp/c10s-comps.xml /tmp/c10s-comps-raw
elif [[ "$file_type" == "application/gzip" || "$file_type" == "application/x-gzip" ]]; then
gunzip -c /tmp/c10s-comps-raw > /tmp/c10s-comps.xml
else
cp -f /tmp/c10s-comps-raw /tmp/c10s-comps.xml
fi
changed_when: true
- name: Import comps groups
ansible.builtin.command: >
sudo -u {{ koji_admin_user }} koji
--config={{ koji_hub_admin_user_koji_dir }}/config
import-comps /tmp/c10s-comps.xml {{ koji_build_tag }}-build
register: koji_bootstrap_import_comps_result
changed_when: "'Groups imported' in koji_bootstrap_import_comps_result.stdout"
- name: Create build group on tag
ansible.builtin.command: >
sudo -u {{ koji_admin_user }} koji
--config={{ koji_hub_admin_user_koji_dir }}/config
add-group {{ koji_build_tag }}-build build
register: koji_add_group_build_result
changed_when: "'Group added' in koji_add_group_build_result.stdout"
failed_when: "koji_add_group_build_result.rc != 0 and 'already exists' not in koji_add_group_build_result.stderr"
- name: Create srpm-build group on tag
ansible.builtin.command: >
sudo -u {{ koji_admin_user }} koji
--config={{ koji_hub_admin_user_koji_dir }}/config
add-group {{ koji_build_tag }}-build srpm-build
register: koji_add_group_srpm_result
changed_when: "'Group added' in koji_add_group_srpm_result.stdout"
failed_when: "koji_add_group_srpm_result.rc != 0 and 'already exists' not in koji_add_group_srpm_result.stderr"
- name: Populate build group packages
ansible.builtin.command: >
sudo -u {{ koji_admin_user }} koji
--config={{ koji_hub_admin_user_koji_dir }}/config
add-group-pkg {{ koji_build_tag }}-build build {{ item }}
loop:
- bash
- bzip2
- coreutils
- cpio
- diffutils
- findutils
- gawk
- gcc
- gcc-c++
- grep
- gzip
- info
- make
- patch
- redhat-rpm-config
- rpm-build
- sed
- tar
- unzip
- util-linux
- which
- shadow-utils
register: koji_add_group_pkg_build_result
changed_when: "'Added package' in koji_add_group_pkg_build_result.stdout"
failed_when: "koji_add_group_pkg_build_result.rc != 0 and 'already in group' not in koji_add_group_pkg_build_result.stderr"
- name: Populate srpm-build group packages
ansible.builtin.command: >
sudo -u {{ koji_admin_user }} koji
--config={{ koji_hub_admin_user_koji_dir }}/config
add-group-pkg {{ koji_build_tag }}-build srpm-build {{ item }}
loop:
- bash
- gnupg2
- make
- redhat-rpm-config
- rpm-build
- shadow-utils
- tar
- unzip
- wget
- curl
register: koji_add_group_pkg_srpm_result
changed_when: "'Added package' in koji_add_group_pkg_srpm_result.stdout"
failed_when: "koji_add_group_pkg_srpm_result.rc != 0 and 'already in group' not in koji_add_group_pkg_srpm_result.stderr"
- name: Add Koji builder hosts
ansible.builtin.include_tasks: add_host.yaml
loop: "{{ groups['kojibuilders'] }}"
- name: Restart httpd on kojihub to apply Koji changes
ansible.builtin.service:
name: httpd
state: restarted
delegate_to: "{{ groups['kojihub'][0] }}"
run_once: true
- name: Add Koji builder hosts to createrepo channel
ansible.builtin.command: >
sudo -u {{ koji_admin_user }} koji
--config={{ koji_hub_admin_user_koji_dir }}/config
add-host-to-channel {{ item }} createrepo
loop: "{{ groups['kojibuilders'] }}"
register: koji_bootstrap_add_host_to_channel_result
changed_when: "'Host added to channel' in koji_bootstrap_add_host_to_channel_result.stdout"
failed_when: "koji_bootstrap_add_host_to_channel_result.rc != 0 and 'is already subscribed' not in koji_bootstrap_add_host_to_channel_result.stderr"
- name: Set Koji builder host capacity
ansible.builtin.command: >
sudo -u {{ koji_admin_user }} koji
--config={{ koji_hub_admin_user_koji_dir }}/config
edit-host --capacity={{ kojid_max_jobs }} {{ item }}
loop: "{{ groups['kojibuilders'] }}"
changed_when: true
- name: Regenerate repo
ansible.builtin.command: >
sudo -u {{ koji_admin_user }} koji
--config={{ koji_hub_admin_user_koji_dir }}/config
regen-repo {{ koji_build_tag }}
changed_when: false
- name: Create builder user
ansible.builtin.command: >
sudo -u {{ koji_admin_user }} koji
--config={{ koji_hub_admin_user_koji_dir }}/config
add-user builder
register: koji_bootstrap_add_builder_user_result
changed_when: "'User added' in koji_bootstrap_add_builder_user_result.stdout"
failed_when: "koji_bootstrap_add_builder_user_result.rc != 0 and 'already exists' not in koji_bootstrap_add_builder_user_result.stderr"
- name: Add default packages to main tag
ansible.builtin.command: >
sudo -u {{ koji_admin_user }} koji
--config={{ koji_hub_admin_user_koji_dir }}/config
add-pkg --owner {{ koji_admin_user }} {{ koji_build_tag }} {{ item }}
loop:
- bash
register: koji_add_pkg_result
changed_when: "'Adding 0 packages' not in koji_add_pkg_result.stdout"
failed_when: koji_add_pkg_result.rc != 0