#10374 Create service account/bot for osbuild
Closed: Fixed with Explanation 2 years ago by ochosi. Opened 2 years ago by ochosi.

  • Describe the issue

We already use packit-as-a-service to update osbuild/osbuild-composer from upstream, but in order to schedule/run Koji builds and update Bodhi we would like to have a dedicated service/bot account.
I have already implemented the automation part on our side, but currently we're using my credentials which is not great mid-term.

  • When do you need this? (YYYY/MM/DD)

This is not super-urgent as we're not blocked, but the earlier I can take out my credentials from the protected VARS of the private GitlabCI pipeline the happier I am :)

  • When is this no longer needed or useful? (YYYY/MM/DD)

We'll probably need this as long as we release the project to Fedora (or when packit supports these steps).

  • If we cannot complete your request, what is the impact?

Well, we'd probably be continuing to use some real-person account, which isn't great/sustainable.

I can of course give you a list of contact people / responsibles for all actions of the bot.
This would include myself and Lars (https://pagure.io/user/larsu). If you need >2 I'm happy to provide more contacts.


See also https://pagure.io/fesco/issue/2624

AGREED: Bot accounts are allowed, but MUST create a wiki page with
contact information for the human(s) running the bot and what it
does. If the bot causes immediate problems, ask releng to disable
it. If longer term problems, bring to fesco like for any maintainer.

Example: https://fedoraproject.org/wiki/User:Rhcontainerbot

Metadata Update from @mohanboddu:
- Issue assigned to kevin
- Issue tagged with: medium-gain, medium-trouble, ops

2 years ago

@churchyard Thanks a bunch!
Just one question - do I just go ahead and create the bot account myself or do you have to do that and I only create the wiki page?

I don't know what approach is preferred. I'll let @kevin answer that.

Sorry for the delay in answering here. Things have been crazy. :)

First one sort of higher level question: If a number of packagers are going to want packit to do builds and updates, should we look at making a more generic bot account for that?
Or is it better to have lots of smaller seperate accounts that only have perms to a small group of packages? I guess thats a question for packit developers?

Anyhow, I think what we want to do here is create a document so we can point people to it to setup everything, so I think everything can in fact be self service.
Here's a rough stab at it you can use now and I can take your feedback and make the document from it hopefully.

  1. You create an account in the account system. I would prefer if it had 'bot' in the name, but I suppose there might be cases where you don't want that.
  2. You create a wiki page ( https://fedoraproject.org/wiki/User:Yourboxaccountname ). This has contact info for the people who can manage the bot, what the bot does, etc.
  3. If your bot account needs privs, ask us, or go via the normal methods (ie, your bot probibly needs packager? )
  4. For koji you should be able to get a keytab via method at:
    https://pagure.io/fedora-infrastructure/issue/9544#comment-706949
  5. For pushing to src.fedoraproject.org you probibly want to look at using https pushing and a token (use fedpkg clone -a and fedpkg push and it will setup the token for you, look in ~/.git)

Probibly some things I have forgotten, but hopefully we can find them. :)

Hi Kevin - thanks for your comprehensive response!

So re:packit: We already use it (we're first used it for some months to open PRs but now we are pushing directly to dist-git) and the bot I'm implementing is solely to close some gaps of packit's current feature set. I have already spoken to the packit team and they do want to implement scheduling of builds and updating of Bodhi, so I consider the bot a workaround until then and am more than happy to drop it all in favor of the general solution (which seems to be packit).
I have reached out to the packit team again to see if there's something we can do so you don't get a lot of individual requests (which could also make the transition to packit slower).

I'll follow your guide now and provide feedback so you at least have a complete howto at the end of this! :)

PS: 5. is covered by packit already.

Hi @kevin,

it took me a bit to get back to this but I've finally managed to create the account and the accompanying wiki-page:
https://fedoraproject.org/wiki/User:Imagebuilder-bot

You mentioned that for 3. (packager rights) I could ask you here? Or would you prefer if I create a ticket somewhere?

Thanks again! :)

PS: I tested kinit and that already works, so it's just a matter of getting the packager rights \o/

I have added them to packager.

Thanks a lot for your help - it's all working now!

I was able to move our bot code to github.com as a result and also added a link to the repository on the wiki page I linked to above.

Metadata Update from @ochosi:
- Issue close_status updated to: Fixed with Explanation
- Issue status updated to: Closed (was: Open)

2 years ago

Login to comment on this ticket.

Metadata
Boards 1
Ops Status: Backlog