919725 - publish updates to balrog prod

Status: RESOLVED FIXED

(Release Engineering :: General, defect)

Description

[[e-mail] (:bhearsum)]

We should publish the production updates to balrog dev, stage, and prod (once all of those environments are up). We should probably stop publishing to dev at some point, and reserve that for actually development testing.

Comment 1

[[e-mail] (:bhearsum)]

Attachment: make it possible to submit to multiple balrog servers

Comment 2

[[e-mail] (:bhearsum)]

Attachment: use multiple balrog roots

Comment 3

[Nick Thomas [:nthomas] (UTC+12)]

Comment on attachment 808792 [details] [diff] [review]
make it possible to submit to multiple balrog servers

Waiting for updated patch.

Comment 4

[[e-mail] (:bhearsum)]

We decided that just prod is good enough for now.

Comment 5

[[e-mail] (:bhearsum)]

Attachment: point production builds at balrog production

Need Puppet changes too, but both the username and password are stored as secrets on the Puppet server. I'll update this bug when I've done that.

Comment 6

[[e-mail] (:bhearsum)]

18:04 < bhearsum> nthomas: ack, i just realized that the balrog submitter isn't going to work - it's going to fail to validate the certificate because 
                  aus4-admin.mozilla.org uses a Mozilla Root CA cert
18:05 < bhearsum> i'll need to think about adding that root to the cert bundle we verify against

Comment 7

[[e-mail] (:bhearsum)]

Attachment: add mozilla root ca certificate to bundle

I think this is OK to do, because we should trust our own internal services as much as things signed by another root, right?

Comment 8

[Rail Aliiev [:rail]]

Comment on attachment 810549 [details] [diff] [review]
add mozilla root ca certificate to bundle

r+ for misc/certs/ca-bundle.crt changes, lib/python/release/sanity.py is unrelated.

Comment 9

[[e-mail] (:bhearsum)]

in production - the overnight nightlies will report to balrog production \o/!

Comment 10

[[e-mail] (:bhearsum)]

This has been working fine for days.