Infrastructure Apprentice

Infrastructure Apprentice

The 'fi-apprentice' group in the Fedora Account System is one with a lot of read-only access to various Fedora infrastructure machines. This group is used for new folks to look around at the infrastructure setup, check machines and processes and see where they might like to contribute moving forward. This also allows apprentices to examine and gather info on problems, then propose solutions.

Access to many infrastructure machines

Members of the fi-apprentice group have ssh/shell access to many machines, but no sudo rights or ability to commit to ansible (but they do have read-only access). Apprentice can, however, contribute to the infrastructure documentation by sending pull requests to the infra-docs-fpo repository. Access is via the bastion.fedoraproject.org machine and from there to each machine. See the SSH Access Infrastructure SOP for more info. You can see a list of hosts that allow apprentice access by using: ./scripts/hosts_with_var_set -i inventory/ -o ipa_client_shell_groups=fi-apprentice from an ansible repo checkout (see below).

Nagios alerts

This group does NOT get Nagios alerts. If you would like to see them you can join the #fedora-noc channel, adjust your | FMN notifications settings or watch the Nagios web interface at: https://admin.fedoraproject.org/nagios/ and https://nagios-external.fedoraproject.org/nagios/

Nagios access is now controlled by kerberos, so you will need to do a command with “kinit your_fas_name@@FEDORAPROJECT.ORG”. On the use of the kerberos, you can view the page https://fedoraproject.org/wiki/Infrastructure/Kerberos

Regular checkins

On the first of each month a mentor will mail all the folks in the group. This email will ask what tasks they are working on or interested in, what they are using their access for and if they intend to be active in infrastructure. Please look for and answer these emails as they come to you. If you fail to answer you will be removed from the group. Don't worry though, it's easy to be re-added later when you have more time.

Length of membership

This group will be pruned often of inactive folks who miss checkins. Members who have not logged into any machine and/or are not active will be removed. There's nothing personal in this, and you're welcome to re-join later when you have more time, we just want to make sure the group only has active members.

Longer term quests

There's a few items we need help with ongoing and apprentices are encouraged to work on these items and provide patches and ask questions, etc. The current list:

• Update group variables in ansible for CSI standards for machines that don't have any listed. See: https://docs.fedoraproject.org/en-US/Community_Services_Infrastructure/1/html/Security_Policy/index.html for information on CSI, and look at the ansible repo under inventory/group_vars/ for groups without CSI information. Patches adding this information for groups can be sent to the infrastructure list to be reviewed and applied. Please refer to standards for documenting CSI variables before submitting patches for ansible.

• Our docs aren't all using the same template. See the /git/infra-docs repo and propose patches to update documents to use the same templates as the rest.

• Look over our logs on log01.iad2.fedoraproject.org in /var/log/merged/ and track down issues and propose solutions to them. Be sure to discuss in meeting or in a issue whatever you find.

Apprentice Workdays

Apprentices can work together or separately with guidance from masters on various apprentice tasks. Participation is not mandatory, and is open to anyone active in the fi-apprentice group (or any other Fedora Infrastructure team for that matter.) If you have been hesitant or unsure where to get started, this will be a great opportunity to roll your sleeves up and get going. We will focus on updating ansible group variables for CSI standards, infrastructure documentation, and easyfix tickets. The workday planning page has information to help prepare for our next workday, To Be Scheduled after F24 Release.

easyfix tickets

There are tickets marked with the 'easyfix' keyword that may be suitable for apprentices to learn how things are setup, and also contribute a fix. See the | pagure.io easyfix report

Working on a ticket workflow

• Pick a ticket

Look in https://pagure.io/fedora-infrastructure/issues for a ticket that looks interesting to you. If the ticket is already assigned, but hasn't had any action in a while, feel free to ask on the ticket if it's still being worked on, and if there is no reply in a week or so, take it over. Some tickets can be worked on by several people, so feel free to ask in ticket if this is one of those kinds of tasks and what part you can work on. If a ticket seems really old and like it may no longer be needed, please add it to the agenda of the next meeting and we will discuss it there and close it or rework it as needed. You can add to the next meeting agenda in Gobby.

• Make patch for fix from git ansible repo

Most any task will require changes to ansible. You can check this out on batcave01.iad2.fedoraproject.org (just "git clone /git/ansible" there) and make edits to your local copy. Apprentices don't have commit privleges, only checkout, so you will need to make your fix, get a patch of it and attach it to the ticket for someone to apply once it's been reviewed. Then 'git diff' should provide a patch for you against the current version in git.

• Attach your patch to ticket

Attach your patch to the ticket and add a comment asking someone to review the patch and apply it if it looks good. Note that trac doesn't send notification on just adding an attachement, you need to add a comment about your attachement as well so notification goes out to people watching the ticket to review your patch.

IRC Tips

One of the primary ways the infrastructure team communicates is via IRC. Here's a few tips to best communicate with the rest of the team:

• Feel free to ask questions when you think of them/run into them, but don't expect everyone to drop what they are doing and answer right then. Please be patient.

• Try to avoid private messages to specific team members. Instead ask your questions in #fedora-admin or #fedora-noc if at all possible. This allows anyone to help you out and also other folks to see the answer and peer review the answers you get.

• Try and assume best intentions on past decisions. There is often a reason for something being setup the way it is or there's some history behind it. "Have we considered switching from foo to bar?" is great, "Why are you using foo! bar is better, we should switch to it right now" is not.

• Keep in mind many of the infrastructure folks are busy, so do try and avoid 'pinging' them unless there's a specific need or you know they are active in channel. Many people have a IRC 'trigger' that notifies them when someone mentions their nick.

• Being active in IRC and asking questions is a great way to find out how things are setup and gain more trust.

• Watching discussion in IRC can often lead to some topic or area you might be interested in helping out with. If so, please feel free to chime in in channel that you would be interested in helping out and ask how you could do so.

Further information

For further information on this group, please ask in #fedora-admin on irc.libera.chat and/or the fedora infrastructure mailing list.

Ansible documentation is available at http://docs.ansible.com/