1169259 - Puppetize signing workers

Status: RESOLVED FIXED

(Release Engineering :: General, defect)

Comment 1

[Rail Aliiev [:rail]]

Attachment: signingworker-puppet.diff

Not tested yet (the inventory is closed for new entries until Wed 6:00)

Comment 2

[Dustin J. Mitchell [:dustin] (he/him)]

Comment on attachment 8613661 [details] [diff] [review]
signingworker-puppet.diff

Review of attachment 8613661 [details] [diff] [review]:
-----------------------------------------------------------------

::: manifests/moco-nodes.pp
@@ +938,5 @@
> +# Signing workers
> +node /signingworker-.*\.srv\.releng\..*\.mozilla\.com/ {
> +    # TODO: remove temp pin
> +    $pin_puppet_server = "releng-puppet2.srv.releng.scl3.mozilla.com"
> +    $pin_puppet_env = "raliiev"

Don't forget :)

::: modules/signingworker/templates/passwords.json.erb
@@ +1,2 @@
> +{
> +    "signig:cert:nightly-signing": [

typo

@@ +7,5 @@
> +        ["mac-signing3.srv.releng.scl3.mozilla.com:9100", "<%= scope.function_secret[["signing_server_username"]] %>", "<%= scope.function_secret[["signing_server_nightly_password"]] %>", ["dmg"]],
> +        ["mac-v2-signing1.srv.releng.scl3.mozilla.com:9100", "<%= scope.function_secret[["signing_server_username"]] %>", "<%= scope.function_secret[["signing_server_nightly_password"]] %>", ["dmgv2"]],
> +        ["mac-v2-signing2.srv.releng.scl3.mozilla.com:9100", "<%= scope.function_secret[["signing_server_username"]] %>", "<%= scope.function_secret[["signing_server_nightly_password"]] %>", ["dmgv2"]],
> +        ["mac-v2-signing3.srv.releng.scl3.mozilla.com:9100", "<%= scope.function_secret[["signing_server_username"]] %>", "<%= scope.function_secret[["signing_server_nightly_password"]] %>", ["dmgv2"]],
> +        ["mac-v2-signing4.srv.releng.scl3.mozilla.com:9100", "<%= scope.function_secret[["signing_server_username"]] %>", "<%= scope.function_secret[["signing_server_nightly_password"]] %>", ["dmgv2"]]

It'd be better to generate these with a loop in the template over a list of signing servers.  Then that list can go in moco-config.pp.

Comment 3

[Rail Aliiev [:rail]]

Attachment: signingworker2-puppet.diff

(In reply to Dustin J. Mitchell [:dustin] from comment #2)
> Comment on attachment 8613661 [details] [diff] [review]
> signingworker-puppet.diff
> 
> Review of attachment 8613661 [details] [diff] [review]:
> -----------------------------------------------------------------
> 
> ::: manifests/moco-nodes.pp
> @@ +938,5 @@
> > +# Signing workers
> > +node /signingworker-.*\.srv\.releng\..*\.mozilla\.com/ {
> > +    # TODO: remove temp pin
> > +    $pin_puppet_server = "releng-puppet2.srv.releng.scl3.mozilla.com"
> > +    $pin_puppet_env = "raliiev"
> 
> Don't forget :)

Deleted.

> ::: modules/signingworker/templates/passwords.json.erb
> @@ +1,2 @@
> > +{
> > +    "signig:cert:nightly-signing": [
> 
> typo

Oops. Fixed.
 
> @@ +7,5 @@
> > +        ["mac-signing3.srv.releng.scl3.mozilla.com:9100", "<%= scope.function_secret[["signing_server_username"]] %>", "<%= scope.function_secret[["signing_server_nightly_password"]] %>", ["dmg"]],
> > +        ["mac-v2-signing1.srv.releng.scl3.mozilla.com:9100", "<%= scope.function_secret[["signing_server_username"]] %>", "<%= scope.function_secret[["signing_server_nightly_password"]] %>", ["dmgv2"]],
> > +        ["mac-v2-signing2.srv.releng.scl3.mozilla.com:9100", "<%= scope.function_secret[["signing_server_username"]] %>", "<%= scope.function_secret[["signing_server_nightly_password"]] %>", ["dmgv2"]],
> > +        ["mac-v2-signing3.srv.releng.scl3.mozilla.com:9100", "<%= scope.function_secret[["signing_server_username"]] %>", "<%= scope.function_secret[["signing_server_nightly_password"]] %>", ["dmgv2"]],
> > +        ["mac-v2-signing4.srv.releng.scl3.mozilla.com:9100", "<%= scope.function_secret[["signing_server_username"]] %>", "<%= scope.function_secret[["signing_server_nightly_password"]] %>", ["dmgv2"]]
> 
> It'd be better to generate these with a loop in the template over a list of
> signing servers.  Then that list can go in moco-config.pp.

I'm going to file a separate bug to address this and assign it to myself, so I'm not blocked by yaks. :)

This version has nothing new, just 2 syntax fixes and proper command line for the worker script. See interdiff: https://gist.github.com/rail/bc7ac827ba67cbde34ec (need.to.use.mozreview.)

Tested and worked fine.

Comment 4

[Rail Aliiev [:rail]]

Comment on attachment 8615045 [details] [diff] [review]
signingworker2-puppet.diff

remote:   https://hg.mozilla.org/build/puppet/rev/dc5558873e41
remote:   https://hg.mozilla.org/build/puppet/rev/e6959d86421c

Comment 5

[Rail Aliiev [:rail]]

typo:

remote:   https://hg.mozilla.org/build/puppet/rev/5a2f3ea1a1fd
remote:   https://hg.mozilla.org/build/puppet/rev/28a8db9443fd