1014465 - Create Linux VM for hosting Eideticker-CI Jenkins master node

Status: RESOLVED FIXED

(Infrastructure & Operations :: Virtualization, task)

Description

[Dave Hunt [:davehunt] [he/him] ⌚BST]

We have two Jenkins master nodes in London for Eideticker, which is not particularly scalable. We're also considering additional Eideticker nodes in Toronto. We would like to have a single Jenkins master ideally hosted in a datacenter, that can communicate with the boxes in the offices over SSH. This will allow the nodes in the offices to run as Jenkins slaves.

The master will be responsible for downloading B2G builds from pvtbuilds, but will send the actual test jobs to an available slave node. I'm not concerned with the Linux distro chosen for the new master. I will just need to put a few things like Java, git, curl, and Jenkins on there. The existing nodes, which will be used as slaved, are running Ubuntu 14.04 LTS. We'll probably want at least 250GB for storage.

The Jenkins dashboard runs on port 8080, so we'd need that open when connected to the VPN. We will probably want access to be limited to select users, however we can also lock that down within Jenkins itself if needed.

For hostname, could we use eideticker-ci. I'm not sure of the best vlan for this, is there already an ateam one? or perhaps qa?

Comment 1

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Given that those machines would be maintained by the ateam, their own vlan would be good - if there exists one.

Comment 2

[Chris Knowles [:cknowles]]

OK, Before we can spin up a VM, I'm going to need some questions answered - I've filled in my guesses - please update with your needs.

Name: eideticker-ci.ateam.scl3.mozilla.com
OS: RHEL Preffered - but if ubuntu is needed we can probably make that happen (14.04 we don't have templates yet - working on that, but RHEL we can work with a little more)
CPU: 2??
Memory: 4G RAM ??
HDD: 40G / - do you want the rest of the requested space in / or in another place, like '/data'? 

As for network flows, you'll need to open tickets with netops once the IP address has been allocated so that you can access over VPN, and get the inbound ports open that you need.

CJK

Comment 3

[Dave Hunt [:davehunt] [he/him] ⌚BST]

(In reply to Chris Knowles [:cknowles] from comment #2)
> OK, Before we can spin up a VM, I'm going to need some questions answered -
> I've filled in my guesses - please update with your needs.
> 
> Name: eideticker-ci.ateam.scl3.mozilla.com
> OS: RHEL Preffered - but if ubuntu is needed we can probably make that
> happen (14.04 we don't have templates yet - working on that, but RHEL we can
> work with a little more)

I'm sure RHEL will be fine.

> CPU: 2??
> Memory: 4G RAM ??
> HDD: 40G / - do you want the rest of the requested space in / or in another
> place, like '/data'?

That all sounds good. Using /data sounds like a good idea to me too.

> As for network flows, you'll need to open tickets with netops once the IP
> address has been allocated so that you can access over VPN, and get the
> inbound ports open that you need.

Okay, thanks!

Comment 4

[Rob Tucker [:rtucker]]

There was some slightly incorrect information regarding the source host. It will actually be in phx1 with the rest of the ateam virtual machines and the hostname should be adjusted slightly to match the established standards.

I've created the VM with all of the specifications as outlined except the hostname has become:
eideticker-ci1.ateam.phx1.mozilla.com

Please note the 1 at the end of the system name. It's a standard to help if there ever needs to be more than one type of this system. Also not that the location designation is phx1.

I'll update this bug once the VM is completed.

Comment 5

[Rob Tucker [:rtucker]]

The virtual machine has been created. The disks have been confirmed as being aligned correctly. The host has been added to nagios with the generic checks for virtual machines. The host has been registered with RHN as well as successfully puppetized.

Connection Information:
Hostname: eideticker-ci1.ateam.phx1.mozilla.com
IP Address: 10.8.120.133

Please feel free to open further bugs for additional monitoring needs if necessary.

Comment 6

[Dave Hunt [:davehunt] [he/him] ⌚BST]

Thanks, I can ping the host but I get permission denied when I try to connect via SSH. Do you need my public key to grant me access?

Comment 7

[Chris Knowles [:cknowles]]

So, to recap irc conversation and my research - he doesn't appear to be in any of the ateam vpn groups, and being that that's not my bailiwick and I'm likely to mess something up, I asked him to generate a new bug so that he can VPN and we can define him as a user for the ateam nodes.  

I've reopened this bug for that work to be done.  I'm adding a node definition for this VM, and adding wlachance and jgriffin to it, and look forward to when I can add dhunt to it.  

revision 87901
puppet/trunk/manifests/nodes/ateam.pp
+node 'eideticker-ci1.ateam.phx1.mozilla.com' {
+    include ldap_users::groups::vpn::vpn_ateam
+    
+    class { 'sudoers::users':
+        users => [
+            'jgriffin',
+            'wlachance',
+        ];
+    }
+}

However, when looking at eideticker-ci1 - there seems to be a problem with it's puppetization - We'll be looking into that as well.  (if puppet isn't working, all the rest of these changes are for naught.)

CJK

Comment 8

[Chris Knowles [:cknowles]]

After we got the puppet straightened out, added dhunt to the list... who has tested and confirms that all is well.

Let me know if you need anything else.