QA » openQA Project » openQA Infrastructure

Motivation¶

This is a follow-up of #20270 for the remaining systems (as #20270 only covered machines in SRV1), also see parent #116623

The remaining hosts (as of the creation of this ticket are):

1. Hosts used for bare-metal testing: sp.openqaw5-xen.qa.suse.de
2. Prague located: openqaworker14-ipmi.qa.suse.cz, openqaworker15-ipmi.qa.suse.cz, openqaworker16-ipmi.qa.suse.cz, openqaworker17-ipmi.qa.suse.cz, openqaworker18-ipmi.qa.suse.cz
3. PowerPC machines: qa-power8-4.qa.suse.de, qa-power8-5.qa.suse.de, fsp1-powerqaworker-qam.qa.suse.de, malbec.arch.suse.de
4. ARM machines: openqaworker-arm-1-ipmi.suse.de, openqaworker-arm-2-ipmi.suse.de, openqaworker-arm-4-ipmi.suse.de, openqaworker-arm-4-ipmi.suse.de, openqaworker-arm-5-ipmi.suse.de

Technically, also the following hosts are remaining -however, they are not used anymore anyways or are broken: openqaworker1, imagetester, power8
So those hosts should supposedly be excluded.

Acceptance criteria¶

• AC1: All IPMI interfaces of openQA machines listed in workerconf.sls are in new security zones
• AC2: All IPMI interfaces of openQA machines listed in workerconf.sls are fully usable in production
• AC3: All documentation referencing O3+OSD ipmi interfaces are up-to-date
• AC4: Our automated tools using O3+OSD ipmi interfaces are up-to-date e.g. GitLab pipelines and salt states

Suggestions¶

• Create an SD ticket similar to https://sd.suse.com/servicedesk/customer/portal/1/SD-109299 (which has been created for #20270)
• Monitor Slack #discuss-qe-new-security-zones
• Ensure access over the new way is possible
• Document changes in our infrastructure documentation, e.g. progress.opensuse.org/projects/openqav3/wiki/, https://wiki.suse.net/index.php/OpenQA, https://gitlab.suse.de/openqa/salt-pillars-openqa/-/blob/master/openqa/workerconf.sls
• Ensure https://gitlab.suse.de/openqa/salt-pillars-openqa#get-ipmi-definition-aliases works the new way
• Update https://gitlab.suse.de/openqa/grafana-webhook-actions

Open points¶

1. Where is the documentation by SUSE-IT?
2. Where is the git repo handling ssh keys?
3. Fix the multi-second login time over ssh (workaround: use ssh -4)