coordination #121720: [saga][epic] Migration to QE setup in PRG2+NUE3 while ensuring availability
coordination #116623: [epic] Migration of SUSE Nbg based openQA+QA+QAM systems to new security zones
Added by okurz over 1 year ago. Updated 6 months ago.
0%
Asked apappas and hrommel in https://suse.slack.com/archives/C02CANHLANP/p1663317032423209?thread_ts=1663252311.052159&cid=C02CANHLANP
regarding the above topic, has anyone addressed you regarding QAM machines? If not then we should coordinate this so that QAM machines are also covered by security zone migration plans
Negative response, i.e. we will need to plan and execute a security zone migration for the qam domain as well.
According to apappas DHCP/DNS is provided by SUSE-IT EngInfra no a VM davinci.suse.de, managed within https://gitlab.suse.de/OPS-Service/salt/. Example change https://gitlab.suse.de/OPS-Service/salt/-/merge_requests/2531/diffs to edit entries.
The VM is managed by SUSE-IT EngInfra with a salt config hosted, same with qam.suse.cz on another VM.
So likely the best approach is to create a new security zone of each QA as well as QAM and use a DHCP/DNS service provided by SUSE-IT infrastructure following the model of the existing QAM network.
Discussed in weekly QE sync 2022-09-28 and we agreed including hrommel1 in particular that we can aim for eventually having a joint QE network security zone but for now we should plan a QAM zone replacing the current one as needed and when needed by SUSE-IT Cybersecurity.
For now I will block this ticket on #117043 because I would like to sort out how we can maintain DHCP/DNS more easily before we apply any changes.
#117043 first, will take some time
#117043 completed, work can be continued
With NUE1 decommissioned all active systems are in new security zones and I guess machines that are brought (back) into production will also end up in new security zones