This change brings in one patch the changes of 3.8

Depends-On: https://softwarefactory-project.io/r/c/software-factory/sf-ci/+/31675
Depends-On: https://softwarefactory-project.io/r/c/software-factory/sf-ci/+/31690

Here are the stashed commits from the common 3.8.3 tag.

git format-patch -N  20d7af3..origin/3.8
git am *.patch

There was some conflicts that have been fixed manually.

Remove Opensearch Dashboards autologin feature

After moving to Keycloak, such feature is not required.

Fixes - After d/s upgrade

- logprocessing clean of old components
- opensearch-dashboard and opensearch use CA chain ca-trust
- add sf_purgelogs_additional_params vars (mount addtional volume)

Set host network binding for some services and contenerized tools

Almost all containers that we are starting in Software Factory
are using host binding.

Render zuul_api_url as python list

The logscraper tool gets zuul_api_url parameter as a list and
there can be multiple values provided.

Change url path for Opensearch Dashboards

The new URL will not use autologin feature.

Add condition to verify that stdout item exists

The item might not exists when infrastructure is updated
each time when Software Factory is released.

sf-keycloak: quote passwords in parameters

Passwords may include special characters that break command lines.

Add option gerrit_use_truststore

Enable increase innodb_log_file_size and innodb_buffer_pool_size

After increasing parameters, some queries performed by Zuul are working
faster.
This change is mostly helpful for those Zuul deployments, where
some scripts are making a complicated query with many job_name variables
to Zuul web to receive latest build results and the SQL "inner join"
takes long time.

Ensure backup dir exists; change backup host

After changing service name from Kibana to Opensearch Dashboards,
when the arch.yaml file was not updated to new values, the backup
directory for opensearch-dashboards service might not be available
on the host.

Use new mysql container version

Depends-on: https://softwarefactory-project.io/r/c/containers/+/27429

Adding conditional for zuul-web check on grafana postconfig stage

Add debug flag for purgelogs; remove :Z flag for log dir in purgelogs

The log directory might have a lot of files, so restarting the purgelogs
script might take ages until the SELinux labeling is done.
Also added debug flag parameter into the purgelogs service to see
removal progress logs.

Logserver trailing slash fix

This change fixes the trailing slash problem raised by OSP CI team.
The issue is due to requests not working when made to logserver without an ending trailing
slash.

Mount MariaDB cache dir

Without mounting the cache dir, the container delta overlay dir
might be very big.

Change retention policy in influxdb; increase buffer

This commit fixes various issues related to the telegraf and influxdb errors:

    Metric buffer overflow; 831 metrics have been dropped

Also changed retention policy to wipe data after 4 weeks.

Update purgelogs container image

The new purgelogs container image will provide log messages about its
progress.

config-repo: Pull centos image from quay rather than registry.centos.org

registry.centos.org seems down, investigation pending. This breaks
config-update jobs, which rebuild containers defined in the config repo.
In the meantime, switch to quay.io for pulling.

zuul-web: mount /var/lib/zuul/

When a connection requires a SSH key, it is stored in
/var/lib/zuul/.ssh - which isn't exposed to zuul-web, resulting in
errors when the configuration is loaded.

Use zuul-executor-ubi-sf38 to benefit last managesf release

See https://softwarefactory-project.io/cgit/containers/commit/images-sf/3.8?id=87dea1ceae4719e48193e85a8bc7fdfd5553216f

Set log_size_max size for podman logs

The service logs after a while can be really huge.
This change is limiting log file size to 1GB.
The feature has been added into the podman containers.conf file in
podman 2.2.0 release [1], but on Centos 7, version is below 2.2.0.
According to the libpod.conf man [2], that option should be also
available in podman 1.6.4, but it is located in libpod.conf file.
More info [3].

[1] https://github.com/containers/podman/releases/tag/v2.2.0
[2] https://manpages.debian.org/unstable/podman/libpod.conf.5.en.html
[3] unifi-utilities/unifios-utilities#100

Depends-On: https://softwarefactory-project.io/r/c/software-factory/sf-ci/+/28529

Use managesf-sf38 last container image; drop encoding parameter in managesf

The "encoding" parameter is raising an error on starting managesf
service.

Ensure nodepool services are restarted when config files is updated

Nodepool services must be restarted when labels are added

zuul/nodepool: bump to the latest version (10.0.0)

This change sets the ansible_root zuul.conf variable to
avoid ansible installation on startup.

Also bump MariaDB version 10.5 because of the renaming index
feature (needed for Zuul DB Migration) not available in 10.3.

Depends-On: https://softwarefactory-project.io/r/c/containers/+/31361
Depends-On: https://softwarefactory-project.io/r/c/software-factory/sf-ci/+/31362
Depends-On: https://softwarefactory-project.io/r/c/containers/+/31412

Provided fixes to enable mariadb upgrade from 10.3 to 10.5

Running the sfconfig --upgrade is then required.

Depends-On: https://softwarefactory-project.io/r/c/software-factory/sf-ci/+/31390

arch allinone - add missing zuul-merger component

Update sf-gerrit to latest build

3.7.8-2 was built somewhat recently[1] and addresses a couple of CVEs.

[1] https://quay.io/repository/software-factory/gerrit-sf38?tab=tags

Add --golden-tests feature to validate generated playbooks

This change enables testing the deployment playbooks without
installing sf-config. Run with:

  PYTHONPATH=$(pwd) python3 ./sfconfig/cmd.py        \
    --golden-tests ./refarch-golden-tests/           \
    --arch ./refarch/softwarefactory-project.io.yaml \
    --config ./defaults/sfconfig.yaml --share $(pwd)

Remove unused host_public_url facts

This change remove a fact that is no longer used.

Sort the /etc/hosts alias to avoid random update

This change ensures the /etc/hosts is defiened in a fixed order

Combine zuul-executor and zuul-merger hosts in the generated deployment playbook

This change improves the deployment process by combining the common host into a
single target so that the roles can be applied in parallel

Setup user_namespaces before the restore tasks

When restoring a backup on a fresh instance, make sure that the
userns is configured to ensure the container can be created correctly.

Do not use the zuul_wrapper for restore tasks

When restoring a backup on a fresh instance, the zuul_wrapper command
does not exist.

Restore zookeeper lib ownership after a restore

This change ensure the zookeeper setup is correct after restore.

Revert "Combine zuul-executor and zuul-merger hosts in the generated deployment playbook"

Change-Id: I1742905336af06de3d35814413932f7558317036

ansible/roles/sf-base/defaults/main.yml

@@ -30,3 +30,6 @@ gpg_keys_url:
   - https://softwarefactory-project.io/cgit/software-factory/sf-release/plain/RPM-GPG-KEY-SOFTWARE-FACTORY
   - https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Cloud
   - https://www.centos.org/keys/RPM-GPG-KEY-CentOS-Official
+
+# set 1000MB in bytes
+log_size_max: 1048576000

ansible/roles/sf-base/tasks/setup.yml

@@ -131,3 +131,11 @@
 - name: Trust crt
   shell: update-ca-trust
   when: new_crt is changed
+
+- name: Set max log limit in libpod configuration file
+  become: true
+  lineinfile:
+    path: /etc/containers/libpod.conf
+    regexp: "^max_log_size"
+    line: "max_log_size={{ log_size_max }}"
+    create: true

ansible/roles/sf-container/templates/creation.j2

@@ -8,7 +8,7 @@ if [ "$1" ]; then
   {% else %}
     {% set module = 'unknown' %}
   {% endif %}
-  container_exec_path=$(podman run --rm {{ item.image }} python3 -c "import {{ module }}, os.path; print(os.path.dirname({{ module }}.__file__) + '/')")
+  container_exec_path=$(podman run --network host --rm {{ item.image }} python3 -c "import {{ module }}, os.path; print(os.path.dirname({{ module }}.__file__) + '/')")
   patched_volume=" --volume $1:$container_exec_path:z "
 fi
 podman create --name {{ item.service }} {{ item.params }} {{ self_signed_certs }} $patched_volume {{ item.image }} {{ item.run | default(None) }}

ansible/roles/sf-gateway/defaults/main.yml

@@ -2,7 +2,6 @@
 role_actions:
   - install
   - setup
-  - postconf
   - get_logs
   - disable
   - backup

ansible/roles/sf-gateway/meta/sfconfig.py

@@ -103,15 +103,3 @@ def configure(self, args, host):
 
         args.glue['external_opensearch_dashboards_host'] = \
             args.sfconfig.get('opensearch_dashboards', {}).get('host_url')
-
-        args.glue['readonly_user_autologin'] = \
-            args.sfconfig.get('opensearch_dashboards', {}).get(
-                'readonly_user_autologin', 'Basic')
-
-        if args.sfconfig.get('external_opensearch', {}).get('users', {}):
-            for user, creds in args.sfconfig.get('external_opensearch'
-                                                 ).get('users').items():
-                if creds.get('role') == 'readonly':
-                    args.glue['external_opensearch_readonly_user'] = user
-                    args.glue['external_opensearch_readonly_password'] = \
-                        creds.get('password')

ansible/roles/sf-gateway/tasks/setup.yml

@@ -115,13 +115,6 @@
   when: '"kibana" in roles or external_opensearch_dashboards_host is defined'
   notify: apache reload
 
-- name: Create autologin empty file
-  file:
-    path: /etc/httpd/conf.d/opensearch_dashboards_autologin.conf
-    state: touch
-    mode: '0444'
-  when: readonly_user_autologin is defined and readonly_user_autologin
-
 - name: Add server status configuration file
   template:
     src: server-status.conf.j2

ansible/roles/sf-gateway/tasks/upgrade.yml

@@ -19,11 +19,12 @@
     state: absent
   when: sf_previous_version < 3.7
 
-- name: Remove deprecated repoxplorer files
+- name: Remove deprecated config files
   file:
     path: "{{ item }}"
     state: absent
   loop:
     - /etc/httpd/conf.d/gateway-repoxplorer.conf
     - /var/www/static/repoxplorer.keycloak.json
+    - /etc/httpd/conf.d/opensearch_dashboards_autologin.conf
   notify: apache reload

ansible/roles/sf-gateway/templates/gateway.common.j2

@@ -176,6 +176,9 @@
 {% endif %}
 
 {% if 'logserver' in roles %}
+        RewriteCond %{REQUEST_URI} /logs/+[^\.]+$
+        RewriteRule ^/logs/(.+[^/])$ %{REQUEST_URI}/ [R=301,L]
+
         ProxyPass /logs/ http://{{ logserver_host }}:{{ logserver_http_port }}/logs/
         ProxyPassReverse /logs/ http://{{ logserver_host }}:{{ logserver_http_port }}/logs/
 

ansible/roles/sf-gerrit/defaults/main.yml

@@ -18,8 +18,8 @@ gerrit_conf_dir: "/etc/gerrit"
 gerrit_lib_dir: "/var/lib/gerrit"
 gerrit_log_dir: "/var/log/gerrit"
 
-gerrit_version: 3.7.4
-gerrit_container_version: "{{ gerrit_version }}-1"
+gerrit_version: 3.7.8
+gerrit_container_version: "{{ gerrit_version }}-5"
 
 gerrit_components:
   - service: "gerrit"

ansible/roles/sf-gerrit/templates/entrypoint.sh.j2

@@ -4,8 +4,10 @@
 JAVA_OPTIONS="-Djava.security.egd=file:/dev/./urandom"
 JAVA_OPTIONS="${JAVA_OPTIONS} -Djavax.net.ssl.keyStore=/var/gerrit/etc/keystore"
 JAVA_OPTIONS="${JAVA_OPTIONS} -Djavax.net.ssl.keyStorePassword={{ gerrit_keystore_password }}"
+{% if gerrit_use_truststore|default(True) %}
 JAVA_OPTIONS="${JAVA_OPTIONS} -Djavax.net.ssl.trustStore=/var/gerrit/etc/truststore"
 JAVA_OPTIONS="${JAVA_OPTIONS} -Djavax.net.ssl.trustStorePassword=changeit"
+{% endif %}
 
 configure_keystore () {
     keytool -importkeystore -srckeystore /var/gerrit/etc/{{ fqdn }}.pkcs12 \

ansible/roles/sf-install-server/defaults/main.yml

@@ -12,4 +12,4 @@ rdo_release_url: "https://rdoproject.org/repos/openstack-stein/rdo-release-stein
 role_package: sf-config
 
 mysql_config_dir: /etc/mysql
-mysql_var_run_dir: /var/run/mysqld
+mysql_var_lib: /var/lib/mysql

ansible/roles/sf-install-server/meta/sfconfig.py

@@ -102,7 +102,7 @@ def get_links(_type):
             + status_link
             + service("nodepool", "/nodepool")
             + service("keycloak", "/auth/realms/SF/account/")
-            + service("opensearch-dashboards", "/analytics_autologin")
+            + service("opensearch-dashboards", "/analytics")
             + service("grafana", "/grafana")
             + service("etherpad", "/etherpad")
             + service("lodgeit", "/paste")

ansible/roles/sf-install-server/tasks/setup.yml

@@ -100,7 +100,7 @@
         priv: 'zuul.*:ALL'
         state: present
         config_file: "{{ mysql_config_dir }}/.my.cnf"
-        login_unix_socket: "{{ mysql_var_run_dir }}/mysqld.sock"
+        login_unix_socket: "{{ mysql_var_lib }}/mysql.sock"
       delegate_to: "{{ mysql_host }}"
       no_log: true
 

ansible/roles/sf-keycloak/defaults/main.yml

@@ -27,7 +27,7 @@ keycloak_container_release: 4
 gsku_container_version: 0.0.4
 gsku_container_release: 1
 
-events_listener_config: "{% if 'firehose' in roles %} --spi-events-listener-mqtt-server-uri=\"tcp://{{ firehose_host }}:1883\" --spi-events-listener-mqtt-username=SF_SERVICE_USER --spi-events-listener-mqtt-password={{ sf_service_user_password }} --spi-events-listener-mqtt-topic=keycloak {% else %} {% endif %}"
+events_listener_config: "{% if 'firehose' in roles %} --spi-events-listener-mqtt-server-uri=\"tcp://{{ firehose_host }}:1883\" --spi-events-listener-mqtt-username=SF_SERVICE_USER --spi-events-listener-mqtt-password=\"{{ sf_service_user_password }}\" --spi-events-listener-mqtt-topic=keycloak {% else %} {% endif %}"
 
 keycloak_components:
   - service: "keycloak"
@@ -42,7 +42,7 @@ keycloak_components:
       --db-url-database=keycloak
       --db-url-host={{ mysql_host }}
       --db-username=keycloak
-      --db-password={{ keycloak_mysql_password }}
+      --db-password="{{ keycloak_mysql_password }}"
       --health-enabled=true
       --metrics-enabled=true
       --hostname={{ fqdn }}
@@ -54,7 +54,7 @@ keycloak_components:
       --volume {{ keycloak_certs_dir }}:/etc/x509/https:Z
       -p {{ keycloak_http_port }}:{{ keycloak_http_port }}
       --env KEYCLOAK_ADMIN=admin
-      --env KEYCLOAK_ADMIN_PASSWORD={{ authentication.admin_password }}
+      --env KEYCLOAK_ADMIN_PASSWORD="{{ authentication.admin_password }}"
       {% if sf_keycloak_additional_params is defined %}
       {{ sf_keycloak_additional_params }}
       {% endif %}
@@ -73,7 +73,7 @@ keycloak_components:
 
 kcadm_options: |
     --no-config
-    --password {{ authentication.admin_password }}
+    --password "{{ authentication.admin_password }}"
     --realm master
     --server http://localhost:{{ keycloak_http_port }}/auth
     --user admin

ansible/roles/sf-log-processing/defaults/main.yml

@@ -5,6 +5,8 @@ role_actions:
   - get_logs
   - disable
 
+role_package: "log-processing"
+
 owner: logscraper
 group: logscraper
 container_gid: 1000
@@ -15,7 +17,8 @@ opensearch_host: opensearch.example.com
 
 opensearch_logstash_password: "CHANGE_ME"
 
-zuul_api_url: https://{{ fqdn }}/zuul/api/tenant/{{ tenant_name }}
+zuul_api_url:
+  - "https://{{ fqdn }}/zuul/api/tenant/{{ tenant_name }}"
 insecure: false
 download: true
 logscraper_dir: /var/lib/logscraper