You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@couchdb.apache.org by va...@apache.org on 2026/10/11 19:49:30 UTC
(couchdb-infra-cm) 01/01: Bump OS on CI workers to Ubuntu Resolute
This is an automated email from the ASF dual-hosted git repository.
nickva pushed a commit to branch roll-ubuntu-resolute
in repository https://gitbox.apache.org/repos/asf/couchdb-infra-cm.git
commit 1171a8a559f9660d1fddbce994a68005baadae3d
Author: Nick Vatamaniuc <va...@apache.org>
AuthorDate: Sun Oct 11 15:48:29 2026 -0400
Bump OS on CI workers to Ubuntu Resolute
---
README.md | 8 +++++++
roles/ci_agent/files/kill-old-docker.sh | 1 +
roles/ci_agent/tasks/main.yml | 26 +++++++++++---------
roles/common/files/sshd-couchdb-ci.conf | 9 +++++++
roles/common/handlers/main.yml | 2 +-
roles/common/tasks/main.yml | 42 +++++++--------------------------
6 files changed, 42 insertions(+), 46 deletions(-)
diff --git a/README.md b/README.md
index 6c47299..4f9f957 100644
--- a/README.md
+++ b/README.md
@@ -117,6 +117,10 @@ Running Ansible Playbooks
$ ansible-playbook bastions.yml
$ ansible-playbook ci_agents.yml
+After upgrading ubuntu (`do-release-upgrade`) re-run `ansible-playbook
+ci_agents.yml`. Upgrade disable third party apt sources like docker so
+we need to re-create them.
+
Running Ad Hoc Commands
---
@@ -124,6 +128,10 @@ Running Ad Hoc Commands
% ansible -v -i production ci_agents -a "sudo apt list --upgradable"
% ansible -v -i production ci_agents -a "sudo unattended-upgrade -v"
+Run on some workers only
+---
+
+ % ansible-playbook ci_agents.yml --limit 'couchdb-worker-x86-64-ubuntu-dal-1-01,ubuntu-nc-arm64-12'
Useful Commands:
---
diff --git a/roles/ci_agent/files/kill-old-docker.sh b/roles/ci_agent/files/kill-old-docker.sh
index 25d8eb0..448b115 100644
--- a/roles/ci_agent/files/kill-old-docker.sh
+++ b/roles/ci_agent/files/kill-old-docker.sh
@@ -1,3 +1,4 @@
+#!/bin/sh
THRESHOLD=$(date --date "1 day ago" +%s)
docker ps --format "{{.ID}} {{.CreatedAt}}" | while read LINE; do
diff --git a/roles/ci_agent/tasks/main.yml b/roles/ci_agent/tasks/main.yml
index 4f3eb40..c3fedca 100644
--- a/roles/ci_agent/tasks/main.yml
+++ b/roles/ci_agent/tasks/main.yml
@@ -20,6 +20,17 @@
packages:
- openjdk-21-jre-headless
+- name: Install service supervision and cron
+ become: yes
+ apt:
+ name: "{{ packages }}"
+ state: latest
+ vars:
+ packages:
+ - cron
+ - runit
+ - runit-run
+
- name: Setup Docker APT repository
become: yes
ansible.builtin.deb822_repository:
@@ -29,7 +40,7 @@
uris: "https://download.docker.com/linux/{{ ansible_facts['distribution']|lower }}"
suites: ["{{ ansible_facts['distribution_release']|lower }}"]
components: [stable]
- signed_by: "https://download.docker.com/linux/debian/gpg"
+ signed_by: "https://download.docker.com/linux/{{ ansible_facts['distribution']|lower }}/gpg"
enabled: yes
- name: Install Docker Packages
@@ -40,14 +51,9 @@
vars:
packages:
- docker-ce
+ - docker-ce-cli
- docker-buildx-plugin
-- name: Install Docker CLI Package on Debian or Ubuntu
- become: yes
- apt:
- name: docker-ce-cli
- when: ansible_facts['distribution'] == 'Debian' or ansible_facts['distribution'] == 'Ubuntu'
-
- name: Install multi-architecture support for Docker
become: yes
apt:
@@ -55,9 +61,8 @@
state: latest
vars:
packages:
- - binfmt-support
- - qemu-utils
- - qemu-user-static
+ - qemu-user
+ - qemu-user-binfmt
- name: Install kill-old-docker.sh
become: yes
@@ -175,4 +180,3 @@
owner: jenkins
group: jenkins
mode: u=rwX,g=rX,o=rX
-
diff --git a/roles/common/files/sshd-couchdb-ci.conf b/roles/common/files/sshd-couchdb-ci.conf
new file mode 100644
index 0000000..c1d919d
--- /dev/null
+++ b/roles/common/files/sshd-couchdb-ci.conf
@@ -0,0 +1,9 @@
+# Handled by ansible (couchdb-infra-cm, roles/common)
+#
+# sshd uses the first value it sees for options
+# etc/ssh/sshd_config includes sshd_config.d/*.conf
+# the cloud-init / cloud image drop-ins (50-*.conf)
+PermitRootLogin prohibit-password
+PasswordAuthentication no
+PermitEmptyPasswords no
+KbdInteractiveAuthentication no
diff --git a/roles/common/handlers/main.yml b/roles/common/handlers/main.yml
index a297578..0b3a4c1 100644
--- a/roles/common/handlers/main.yml
+++ b/roles/common/handlers/main.yml
@@ -1,5 +1,5 @@
- name: restart sshd
become: yes
service:
- name: "{{ 'ssh' if ansible_facts['distribution'] in ['Debian', 'Ubuntu'] else 'sshd' }}"
+ name: ssh
state: restarted
diff --git a/roles/common/tasks/main.yml b/roles/common/tasks/main.yml
index 60a17af..d42a14e 100644
--- a/roles/common/tasks/main.yml
+++ b/roles/common/tasks/main.yml
@@ -17,38 +17,15 @@
name: root
password_lock: true
-- name: Disable root login with a password
+- name: Disable password logins and root password logins over SSH
become: yes
- lineinfile:
- dest: /etc/ssh/sshd_config
- regexp: '^(#\s*)?#PermitRootLogin'
- line: "PermitRootLogin prohibit-password"
- state: present
- notify: restart sshd
-
-- name: Disable password authentication
- become: yes
- lineinfile:
- dest: /etc/ssh/sshd_config
- regexp: '^(#\s*)?PasswordAuthentication'
- line: "PasswordAuthentication no"
- state: present
- notify: restart sshd
-
-- name: Disable empty password login
- become: yes
- lineinfile:
- dest: /etc/ssh/sshd_config
- regexp: '^(#\s*)?PermitEmptyPasswords'
- line: 'PermitEmptyPasswords no'
- notify: restart sshd
-
-- name: Disable challenge response authentication
- become: yes
- lineinfile:
- dest: /etc/ssh/sshd_config
- regexp: '^(#\s*)?ChallengeResponseAuthentication'
- line: 'ChallengeResponseAuthentication no'
+ copy:
+ src: sshd-couchdb-ci.conf
+ dest: /etc/ssh/sshd_config.d/00-couchdb-ci.conf
+ owner: root
+ group: root
+ mode: 0644
+ validate: /usr/sbin/sshd -t -f %s
notify: restart sshd
- name: Install basic ubiquitous packages
@@ -60,16 +37,13 @@
cache_valid_time: 3600
vars:
packages:
- - apt-transport-https
- ca-certificates
- curl
- git
- - gnupg2
- mtr-tiny
- nload
- chrony
- python3
- - runit
- screen
- strace
- sudo