On Mon, Jul 23, 2018 at 11:22:13AM -0400, Paul Belanger wrote: > Greetings, > > A few weeks ago, I sent an email to the zuul-discuss[1] ML talking about the > idea of splitting a base job in project-config into trusted / untrusted parts. > Since then we've actually implemented the idea in rdoproject.org zuul and > seems > to be working very well. > > Basically, I'd like to do the same here with our base job but first wanted to > give a heads up. Here is the basic idea: > > > project-config (trusted) > - job: > name: base-minimal > parent: null > description: top-level job > > - job: > name: base-minimal-test > parent: null > description: top-level job for testing base-minimal > > openstack-zuul-jobs (untrusted) > - job: > name: base > parent: base-minimal > > This then allows us to start moving tasks / roles like configure-mirrors from > trusted into untrusted, since it doesn't really need trusted context on the > executor. > > In rdoproject, our base-minimal job is much smaller then openstack-infra > today, > but really has just become used for handling secrets (post-run playbooks) and > zuul_stream (pre). Everything else has been moved into untrusted. > > Here, we likely need to have a little more discussion around what we move into > untrusted from trusted, but once we've done the dance to place base into > openstack-zuul-jobs and parent to base-minimal in project-config, we can start > testing. > > We'd still need to do the base-minimal / base-minimal-test dance for trusted > context, but it should be much smaller the things we need to test. As a > working > example, the recent changes to pypi mirrors I believe would have been much > easier to test in this setup. > > - Paul > > [1] http://lists.zuul-ci.org/pipermail/zuul-discuss/2018-July/000508.html
I've gone ahead an pushed up a stack of changes at topic:base-minimal-jobs[2]. We need to rename the current base-minimal job to base-ozj first, then depending on how minimal the new base-minimal is, we might be able to remove base-ozj once everything is finished. - Paul [2] https://review.openstack.org/#/q/topic:base-minimal-jobs _______________________________________________ OpenStack-Infra mailing list [email protected] http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-infra
