c2fc3cd018
Since our infrastructure signing key includes a unique comment field in its name which changes with the key each cycle when it's rotated, we need to explicitly let Git know how to identify the key (it doesn't automatically rely on the default secret key in the keychain and instead expects that any optional comment be part of the name). Use an E-mail address to identify the signing key to Git since this will remain the same through rotation, and since the jenkins::jenkinsuser module completely replaces the keyring files we can simply insure our process only ever sets one key for that address in the provided keyring contents (which is how we document doing it already). Change-Id: I78fe7fa331ae9b51ff0fbf91c0c2f8961b09eb88 Depends-On: Id577c4479abd2f443f73c630a12e94d3ebe63660
55 lines
1.4 KiB
Puppet
55 lines
1.4 KiB
Puppet
# == Class: openstack_project::slave
|
|
#
|
|
class openstack_project::slave (
|
|
$thin = false,
|
|
$certname = $::fqdn,
|
|
$ssh_key = '',
|
|
$sysadmins = [],
|
|
$jenkins_gitfullname = 'OpenStack Jenkins',
|
|
$jenkins_gitemail = 'jenkins@openstack.org',
|
|
$jenkins_gitpgpkey = 'jenkins@openstack.org',
|
|
$jenkins_gerrituser = 'jenkins',
|
|
$jenkins_gerritkey = undef,
|
|
$project_config_repo = 'https://git.openstack.org/openstack-infra/project-config',
|
|
$afs = false,
|
|
) {
|
|
|
|
include openstack_project
|
|
include openstack_project::tmpcleanup
|
|
|
|
class { 'openstack_project::server':
|
|
iptables_public_tcp_ports => [19885],
|
|
iptables_public_udp_ports => [],
|
|
certname => $certname,
|
|
sysadmins => $sysadmins,
|
|
afs => $afs
|
|
}
|
|
|
|
class { 'jenkins::slave':
|
|
ssh_key => $ssh_key,
|
|
gitfullname => $jenkins_gitfullname,
|
|
gitemail => $jenkins_gitemail,
|
|
gitpgpkey => $jenkins_gitpgpkey,
|
|
gerrituser => $jenkins_gerrituser,
|
|
gerritkey => $jenkins_gerritkey,
|
|
}
|
|
|
|
include jenkins::cgroups
|
|
include ulimit
|
|
ulimit::conf { 'limit_jenkins_procs':
|
|
limit_domain => 'jenkins',
|
|
limit_type => 'hard',
|
|
limit_item => 'nproc',
|
|
limit_value => '256'
|
|
}
|
|
|
|
class { 'openstack_project::slave_common':
|
|
project_config_repo => $project_config_repo,
|
|
}
|
|
|
|
if (! $thin) {
|
|
include openstack_project::thick_slave
|
|
}
|
|
|
|
}
|