fedora-infrastructure

#7568 Allow "module" type ODCS composes for any user in "packager" group.
Closed: Fixed by jkaluza. Opened by jkaluza.

Closed: Fixed
Reopen Issue
  • Describe what you need us to do:

I'm seeking for +1 to allow any Fedora packager (member of "packager" group) to be able to create ODCS "module" type composes. This is follow-up of https://pagure.io/fedora-infrastructure/issue/6672, where we allowed "modularity-wg" to generate "module" composes.

The ODCS uses openidc auth and /mnt/koji in read-only mode, so there should not be any security risk with this change. ODCS does not have any write-access to any other service. In the worst case, the ODCS can only break itself.

Historically, only "modularity-wg" members were allowed to build modules, but this has changed year ago (https://pagure.io/fesco/issue/1763) and all the packagers are allowed to build modules. It therefore makes sense to update also ODCS configuration like that.

I've received few requests asking me how to test just-built module from people which are not in modularity-wg. I would also like to start propagating ODCS little bit more in official modularity documentation and I cannot do that if packagers cannot use it.

It could also be used to generate composes in situations like described in https://pagure.io/releng/issue/5967.

  • When do you need this? (YYYY/MM/DD)

No hard deadline, but I want to have a talk about this on Flock 2019, so ideally before the call of papers, because without this the talk does not have a sense...

  • If we cannot complete your request, what is the impact?

It would be great if Bodhi would actually generate modular composes for modular updates.

@puiterwijk, I'm CCing you here, because you did the initial ODCS audit and also gave +1 to request to enable ODCS to "modularity-wg".

@ignatenkobrain, +1, your issue is worth some more systematic solution, but if all fails, you can still use ODCS to achieve what you need without generating repo locally. Still better to have this option than nothing :).

+1

Mikolaj is member of sysadmin-main, sysadmin-veteran, ... and other reliable FAS groups, so I'm going to proceed with this request in the beginning of next week.

If you want to stop me doing so, please write in this ticket :).
Edited by jkaluza

Metadata Update from @mizdebsk:
- Issue assigned to jkaluza
- Issue priority set to: Waiting on Assignee (was: Needs Review)
- Issue tagged with: odcs

I think this is fine to do now, but if people start making lots of large composes and start consuming too many resources, we reserve the right to revisit this.

Are composes garbage collected?

Anyhow, I don't know that we need to keep this open, you can go ahead with the change.

@kevin, the key thing in ODCS is that compose lives just for 24 hours and then it is removed. They are also stored in our limited storage, so in case we are out of space, it does not affect any shared NFS storage outside of ODCS. Note that composes are only metadata with symlinks to /mnt/koji, so they are generally quite small.

excellent.

Feel free to close this, or we can leave it open to track this work, whichever you prefer.

I've just updated ODCS to latest version in both staging and prod and also enabled "packager" to generate "module" composes.

Metadata Update from @jkaluza:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)
Metadata

odcs

None
None
Normal
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.