action #159060: Rollback/switch to officially installed velociraptor-client repo and server size:S - QA - openSUSE Project Management Tool

Custom queries

may-sprint
new immediate tickets
openQA Infrastructure Project
openqa-review - Closed tickets last updated by openqa-review, last 30 days
QA roadmap long-term
QA SLE functional
QA SLE Functional - closed in last 14 days
QA SLE Functional - High, need to be refined
QA SLE Functional - over cycle time median
QA SLE u
QA SLE y
QA tools (tag not necessary in openQA and subprojects)
QA tools tag (tag not necessary in openQA and subprojects; excluding tickets in "Ready" version as they are already on the backlog)
QAC - Backlog
QE tools team - backlog (dev)
QE tools team - backlog (ready issues)
QE tools team - backlog SLA high
QE tools team - backlog SLA immediate
QE tools team - backlog SLA no immediate/urgent in feedback/blocked
QE tools team - backlog SLA normal
QE tools team - backlog SLA urgent
QE tools team - backlog SLO high
QE tools team - backlog SLO normal
QE tools team - backlog SLO urgent
QE tools team - backlog, high-level view (epics and higher)
QE tools team - backlog, non-reactive work, needs parent
QE tools team - backlog, top-level view (all sagas)
QE tools team - closed within last 14 days
QE tools team - closed within last 60 days
QE tools team - closed yesterday
QE Tools Team - Collaborative Session
QE tools team - due date forecast
QE tools team - exceeding due-date
QE tools team - infrastructure backlog
QE tools team - next - sorted by update time
QE tools team - next issues
QE tools team - non-estimated (unblocked) issues (dev)
QE tools team - non-estimated (unblocked) issues (infra)
QE tools team - ready issues - Workable
QE tools team - ready, not assigned/blocked/low
QE tools team - SLO high forecast
QE tools team - triage: untriaged issues
QE tools team - update forecast
QE tools team - updated by priority
QE tools team - what members of the team are working on - Feedback (not-low)
QE Tools Team Backlog By Assignee
Tools Team Retrospective
Tools Team Retrospective (not estimated or assigned)

Actions

Copy link

action #159060

open

coordination #155182: [epic] Participate in alpha-testing of new version of velociraptor-client

Rollback/switch to officially installed velociraptor-client repo and server size:S

Added by okurz 7 months ago. Updated 8 days ago.

Status:

Blocked

Priority:

Low

Assignee:

okurz

Target version:

future

Start date:

2024-02-08

Due date:

% Done:

Estimated time:

Tags:

infra

Description

Motivation¶

#155179 is done. Crosscheck with the velociraptor-client development team and rollback our salt managed machines to use official packages and the non-development server again

Acceptance Criteria¶

AC1: salt-controlled machines use the stable velociraptor repo

## Suggestions

Look at https://gitlab.suse.de/openqa/salt-pillars-openqa/-/merge_requests/736 for previous changes
Clarify which repo to use, see https://suse.slack.com/archives/C02NJAA1PEC/p1713696437484159
- https://download.suse.de/ibs/SUSE:/Velociraptor/15.5/ only offers x86_64. I thought we should use that repo unconditionally but what about aarch64, s390x, ppc64le? Until we found a better place to install aarch64/ppc64le/s390x Leap 15.5 packages from I will revert to the official Leap repository content. Soon we will upgrade to Leap 15.6 anyway
- Check that we use the correct endpoint

Related issues 1 (0 open — 1 closed)

Copied from QA - action #155179: Participate in alpha-testing of new version of velociraptor-client

Resolved

okurz

2024-02-08

Actions

Issue # Delay: days Cancel

History
Notes
Property changes

Actions

Copy link

Updated by okurz 7 months ago

Copied from action #155179: Participate in alpha-testing of new version of velociraptor-client added

Actions

Copy link

Updated by okurz 7 months ago

Subject changed from Participate in alpha-testing of new version of velociraptor-client to Rollback to officially installed velociraptor-client repo and server
Status changed from New to Feedback
Target version changed from Tools - Next to future

https://suse.slack.com/archives/C02NJAA1PEC/p1713272166072159

(Oliver Kurz) Hi, can we switch the LSG QE machines back from https://download.opensuse.org/repositories/security:/sensor/15.5/ to official Leap packages and the server target URL accordingly?
(Marcela Mašláňová) All machines will need to install from IBS. We are just waiting for the official announcement
(Oliver Kurz) that sounds like a different problem but I will wait for such announcement then

Actions

Copy link

Updated by okurz 7 months ago

Subject changed from Rollback to officially installed velociraptor-client repo and server to Rollback/switch to officially installed velociraptor-client repo and server
Target version changed from future to Ready

announcement was sent by Jeff Mahoney in https://suse.slack.com/archives/C02NJAA1PEC/p1713535789090039 pointing to https://confluence.suse.com/display/CS/Sensor+-+Linux+Endpoint+Protection+Agent with deployment instructions on https://gitlab.suse.de/linux-security-sensor/suse-client-deployment and https://confluence.suse.com/display/CS/Deploying+the+Sensor+Client

https://suse.slack.com/archives/C02NJAA1PEC/p1713537499171589

(Oliver Kurz) @Jeff Mahoney 1. "It includes virtual machines and systems that are subject to frequent redeployment, like those in […] test systems." So do the 1..10k automated openQA tests need to install velociraptor-client and report to the server during openQA test runs? […] 3. "any Linux servers maintained by BCL" and "must switch to the IBS release" is not possible for the openqa.opensuse.org infrastructure. I don't know how to fulfill such requirements

Actions

Copy link

Updated by okurz 7 months ago

I checked the config mentioned on the documentation pages and could confirm that we are just expected to go back to https://sec-velociraptor.prg.suse.com:8000 so created https://gitlab.suse.de/openqa/salt-pillars-openqa/-/merge_requests/783 (merged)

Unfortunately we need to switch to an internal repo but ok:

https://gitlab.suse.de/openqa/salt-states-openqa/-/merge_requests/1160

Actions

Copy link

Updated by livdywan 7 months ago

https://gitlab.suse.de/openqa/salt-states-openqa/-/jobs/2513164

          ID: security-sensor.repo
    Function: pkgrepo.managed
      Result: False
     Comment: Failed to configure repo 'security-sensor.repo': refresh_db() got multiple values for keyword argument 'root'
     Started: 18:31:20.487570
    Duration: 1268.534 ms
     Changes:

Actions

Copy link

Updated by okurz 7 months ago

https://suse.slack.com/archives/C02NJAA1PEC/p1713696437484159

(Oliver Kurz) https://download.suse.de/ibs/SUSE:/Velociraptor/15.5/ only offers x86_64. I thought we should use that repo unconditionally but what about aarch64, s390x, ppc64le? Until we found a better place to install aarch64/ppc64le/s390x Leap 15.5 packages from I will revert to the official Leap repository content. Soon we will upgrade to Leap 15.6 anyway

Actions

Copy link

Updated by okurz 7 months ago

Due date set to 2024-05-05

Actions

Copy link

Updated by livdywan 7 months ago

Subject changed from Rollback/switch to officially installed velociraptor-client repo and server to Rollback/switch to officially installed velociraptor-client repo and server size:S
Description updated (diff)

Actions

Copy link

#10

Updated by okurz 7 months ago

Due date changed from 2024-05-05 to 2024-05-12

Asked in https://suse.slack.com/archives/C02NJAA1PEC/p1714397276453239 now again

Actions

Copy link

#11

Updated by okurz 7 months ago

Due date deleted (~~2024-05-12~~)
Status changed from Feedback to Blocked
Target version changed from Ready to future

https://jira.suse.com/browse/SENS-111

Actions

Copy link

#13

Updated by okurz 8 days ago

This is related to #169546 now.

In
https://suse.slack.com/archives/C02NJAA1PEC/p1731488334523429
I asked

Hi, https://jira.suse.com/browse/SENS-111 is unresolved since about 7 months and now we come to more problems due to the common criteria related network changes. With that machines which are not in a CC-compliant location can not access repositories on download.suse.de anymore. Can we switch to an official repository like Leap update channel again? Or second best an OBS repository

Actions

Copy link

Also available in: Atom PDF

Project

General

Profile

QA

Tags

Custom queries

action #159060

Rollback/switch to officially installed velociraptor-client repo and server size:S

Motivation¶

Acceptance Criteria¶

Updated by okurz 7 months ago

Updated by okurz 7 months ago

Updated by okurz 7 months ago

Updated by okurz 7 months ago

Updated by livdywan 7 months ago

Updated by okurz 7 months ago

Updated by okurz 7 months ago

Updated by livdywan 7 months ago

Updated by okurz 7 months ago

Updated by okurz 7 months ago

Updated by okurz 8 days ago