Page MenuHomePhabricator

Add a zuul tenant config on the zuul scheduler host (zuul1001)
Closed, ResolvedPublic

Description

See tenant config docs.

The tenant config:

  • Lists projects zuul should operate on
  • Lists the projects from which zuul should fetch its configuration

The tenant config will need to change every time we add a project to zuul.

It's possible to specify a tenant_config_script that generates a valid tenant config on stdout, which may be an option.

The path to the tenant_config or tenant_config_script will need to be set in the [scheduler] section of zuul.conf, which is in puppet:modules/profile/templates/zuul/zuul.conf.erb. Currently this points to a non-existent file.

For this task, we'll need to:

  • Figure out the initial contents of the tenant config
  • Figure out how we will update the tenant config easily
  • Ensure that either the script to generate the tenant config, or the tenant config itself is known to puppet
  • Update the file path for the [scheduler] section of the zuul.conf in puppet

Event Timeline

Tagging in Release-Engineering-Team since it seems like this will require some deep-diving into our CI configuration to generate a proposal. After we have a proposal, we'll need feedback from collaboration-services about puppetization/ongoing management of this file.

@dduvall should be able to look at this after 2025-10-15.

dduvall triaged this task as Medium priority.

Change #1271948 had a related patch set uploaded (by Dduvall; author: Dduvall):

[operations/puppet@production] zuul: Configure environment variables for http(s) proxy

https://gerrit.wikimedia.org/r/1271948

Change #1271948 merged by Dzahn:

[operations/puppet@production] zuul: Configure environment variables for http(s) proxy

https://gerrit.wikimedia.org/r/1271948

[zuul1001:~] $ grep -i proxy /lib/systemd/system/zuul-*

/lib/systemd/system/zuul-nodepool.service:         --env HTTP_PROXY=http://webproxy.eqiad.wmnet:8080 \
/lib/systemd/system/zuul-nodepool.service:         --env HTTPS_PROXY=http://webproxy.eqiad.wmnet:8080 \
/lib/systemd/system/zuul-nodepool.service:         --env NO_PROXY=wikimediacloud.org,wmnet,127.0.0.1,::1 \
/lib/systemd/system/zuul-scheduler.service:         --env HTTP_PROXY=http://webproxy.eqiad.wmnet:8080 \
/lib/systemd/system/zuul-scheduler.service:         --env HTTPS_PROXY=http://webproxy.eqiad.wmnet:8080 \
/lib/systemd/system/zuul-scheduler.service:         --env NO_PROXY=wikimediacloud.org,wmnet,127.0.0.1,::1 \
[zuul1002:~] $ grep -i proxy /lib/systemd/system/zuul-*
         --env HTTP_PROXY=http://webproxy.eqiad.wmnet:8080 \
         --env HTTPS_PROXY=http://webproxy.eqiad.wmnet:8080 \
         --env NO_PROXY=wikimediacloud.org,wmnet,127.0.0.1,::1 \

Mentioned in SAL (#wikimedia-releng) [2026-04-16T20:49:55Z] <dduvall> creating integration/zuul-jobs repo to serve as a mirror of opendev.org/zuul/zuul-jobs (T406384)

Change #1272961 had a related patch set uploaded (by Dduvall; author: Dduvall):

[operations/puppet@production] zuul: Name service containers and remove them when stopped

https://gerrit.wikimedia.org/r/1272961

Change #1272970 had a related patch set uploaded (by Dduvall; author: Dduvall):

[operations/puppet@production] zuul: Provide tenant configuration

https://gerrit.wikimedia.org/r/1272970

Change #1272961 merged by Dzahn:

[operations/puppet@production] zuul: Name service containers and remove them when stopped

https://gerrit.wikimedia.org/r/1272961

Change #1272970 merged by Dzahn:

[operations/puppet@production] zuul: Provide tenant configuration

https://gerrit.wikimedia.org/r/1272970

The zuul-scheduler is now configured with a tenant config (see https://gerrit.wikimedia.org/r/c/operations/puppet/+/1272970). It's managed via puppet for now meaning that subsequent changes to the project list will require a puppet patch. We can revisit this requirement down the road via the tenant_config_script if this workflow is not flexible enough.

Communication between the zuul-scheduler and gerrit.wikimedia.org is now functioning as well but the scheduler is not yet configured to vote on changes. We'll save this configuration change for when the executor and builds are working.

While looking at the hosts I noticed old containers were still present.

puppet #1272961 - zuul: Name service containers and remove them when stopped recently changed the docker run command to pass --rm and thus have the containers deleted upon exiting.

I have cleared the old ones using sudo docker container prune --force. There were 2269 containers on zuul1001 / 53.71MB.