Migrate the Chef repo to Cinc Workstation #692

2026-11-01T14:42:38Z

raucao commented

2026-11-01 14:42:38 +00:00

Migrates the tooling and node management from Chef Workstation / Chef Infra Client to Cinc Workstation / Cinc Client.

Changes

Pin .ruby-version to cinc-workstation; move the repo knife config from .chef/ to .cinc/ (Cinc's USER_CONF_DIR); on-node config now lives in /etc/cinc. Drop the Gemfile/Gemfile.lock (knife-zero is installed with cinc gem install knife-zero).
Remove Vagrantfile and the two vagrant-based Test Kitchen suites (kosmos-bitcoin, tor-full).
Test Kitchen: provision Cinc Client (product_name: cinc); fix Berksfiles (kosmos_email was missing one, kosmos_garage lacked local path deps); bump the rskj pin to 9.0.4; document remaining suite work in doc/test-kitchen-open-tasks.md.
New scripts/knife/migrate_node_to_cinc.sh: one-shot, idempotent node migration. Installs Cinc Client, links /etc/cinc → /etc/chef, pre-seeds the allowed_* attribute lists, and removes the old chef package.
nodes: migrated drone-1 (Chef 18.7.10 → Cinc 19.2.12) and garage-11 (Chef 18.5.0 → Cinc 19.4.46).

Migration notes

Nodes still on Chef need Cinc Client installed before the first Cinc converge — migrate_node_to_cinc.sh does this. On EOL OSes only the last Cinc build is available (Ubuntu 20.04 → 19.2.12; 22.04/24.04 → 19.4.46).
Pre-seeding the allowlist is required: without it, the first converge filters normal attributes using the node's stale on-disk *_attribute_whitelist, which silently drops vm_host (and would break scripts/knife/converge_all.sh).

Open task (deferred)

The zerotier automatic attribute is no longer collected under Ohai 19. The vendored zerotier cookbook's Ohai plugin (cookbooks/zerotier/templates/default/zerotier_ohai.rb) yields no zerotier attribute on Cinc nodes. Repro on a Cinc node: ohai --directory /etc/cinc/ohai/plugins zerotier → I cannot find an attribute named zerotier!. It is currently unused by any cookbook, role or search, but the plugin should be updated for Ohai 19 (or the allowlist entry dropped). Affects all Cinc nodes.

Tested

drone-1 and garage-11 converged successfully with Cinc; vm_host preserved in both.
kosmos_rsk Test Kitchen suite passes 9/9 with product_name: cinc.

Migrates the tooling and node management from Chef Workstation / Chef Infra Client to Cinc Workstation / Cinc Client. ## Changes - Pin `.ruby-version` to `cinc-workstation`; move the repo knife config from `.chef/` to `.cinc/` (Cinc's `USER_CONF_DIR`); on-node config now lives in `/etc/cinc`. Drop the `Gemfile`/`Gemfile.lock` (knife-zero is installed with `cinc gem install knife-zero`). - Remove `Vagrantfile` and the two vagrant-based Test Kitchen suites (kosmos-bitcoin, tor-full). - Test Kitchen: provision Cinc Client (`product_name: cinc`); fix Berksfiles (`kosmos_email` was missing one, `kosmos_garage` lacked local path deps); bump the `rskj` pin to `9.0.4`; document remaining suite work in `doc/test-kitchen-open-tasks.md`. - New `scripts/knife/migrate_node_to_cinc.sh`: one-shot, idempotent node migration. Installs Cinc Client, links `/etc/cinc` → `/etc/chef`, pre-seeds the `allowed_*` attribute lists, and removes the old `chef` package. - `nodes`: migrated `drone-1` (Chef 18.7.10 → Cinc 19.2.12) and `garage-11` (Chef 18.5.0 → Cinc 19.4.46). ## Migration notes - Nodes still on Chef need Cinc Client installed before the first Cinc converge — `migrate_node_to_cinc.sh` does this. On EOL OSes only the last Cinc build is available (Ubuntu 20.04 → 19.2.12; 22.04/24.04 → 19.4.46). - Pre-seeding the allowlist is required: without it, the first converge filters normal attributes using the node's stale on-disk `*_attribute_whitelist`, which silently drops `vm_host` (and would break `scripts/knife/converge_all.sh`). ## Open task (deferred) - The `zerotier` automatic attribute is no longer collected under Ohai 19. The vendored `zerotier` cookbook's Ohai plugin (`cookbooks/zerotier/templates/default/zerotier_ohai.rb`) yields no `zerotier` attribute on Cinc nodes. Repro on a Cinc node: `ohai --directory /etc/cinc/ohai/plugins zerotier` → `I cannot find an attribute named zerotier!`. It is currently unused by any cookbook, role or search, but the plugin should be updated for Ohai 19 (or the allowlist entry dropped). Affects all Cinc nodes. ## Tested - `drone-1` and `garage-11` converged successfully with Cinc; `vm_host` preserved in both. - `kosmos_rsk` Test Kitchen suite passes 9/9 with `product_name: cinc`.

raucao added 7 commits 2026-11-01 14:42:38 +00:00

Migrate the Chef repo to Cinc Workstation 470dcb82ee

Cinc Workstation replaces Chef Workstation for driving knife-zero and
Test Kitchen; nodes run (or are moving to) Cinc Client.

- Pin .ruby-version to cinc-workstation
- Move knife config from .chef/ to .cinc/ (Cinc's USER_CONF_DIR) and
  update .gitignore, README, AGENTS and docs accordingly. On-node config
  now lives in /etc/cinc
- Drop the Gemfile/Gemfile.lock; install knife-zero into Cinc
  Workstation's user gem dir with `cinc gem install knife-zero`
- README: rewrite setup/usage for Cinc Workstation
- scripts/postgresql/switch_primary.sh: drop `bundle exec`

Remove Vagrant and the vagrant-based Test Kitchen suites b9e16876f9

The root Vagrantfile used the license-gated chef_zero provisioner, and
Vagrant's built-in chef provisioner cannot provision Cinc. The
kosmos-bitcoin suite converged nothing (no run_list) and tor-full
targeted long-EOL platforms, so drop both rather than port them.

test-kitchen: provision Cinc Client instead of Chef Infra Client f6b9d55c58

Set `product_name: cinc` on the dokken provisioner so kitchen-dokken
uses cincproject/cinc and skips the Chef license prompt, and pin
chef_version where it was missing.

test-kitchen: fix Berksfiles and the rskj pin; document open tasks fd21e09342

- kosmos_email: add the missing Berksfile so its declared dependencies
  (hostname/unbound/postfix) resolve
- kosmos_garage: add local path deps for the internal cookbooks so
  Berkshelf stops fetching them from Supermarket
- kosmos_rsk: bump rskj to 9.0.4~<codename> (current ppa:rsksmart/rskj
  build) and update the matching InSpec assertion; suite now passes 9/9
- document the remaining suite work in doc/test-kitchen-open-tasks.md

nodes: track drone-1 after the Cinc Client migration f2b4834112

Points the submodule at the re-converged drone-1 node object (Cinc
Client 19.2.12). The node's normal attributes (knife_zero, vm_host)
are unchanged.

scripts: add migrate_node_to_cinc.sh 87d4305c0d

One-shot, idempotent helper that prepares an existing (Chef) node for
Cinc Workstation management: installs Cinc Client, points /etc/cinc at
the existing /etc/chef config, drops the deprecated attribute lists, and
pre-seeds the allowed_* attribute lists so the first converge does not
filter node attributes (e.g. vm_host). The node can then be converged as
usual. Verified against drone-1.

nodes: track garage-11 after the Cinc Client migration 5f4c902e95

Points the submodule at the re-converged garage-11 node object (Cinc
Client 19.4.46). Normal attributes (knife_zero, vm_host) are unchanged.

raucao added the dev environment kredits-2 labels 2026-11-01 14:44:01 +00:00

raucao requested review from greg 2026-11-01 14:44:34 +00:00

raucao added 1 commit 2026-11-01 19:16:05 +00:00

nodes: track mail.kosmos.org after the Cinc Client migration 7de46b6115

raucao force-pushed chore/cinc from f0a98a148a to 7de46b6115

2026-11-01 19:57:43 +00:00

Compare

raucao added 1 commit 2026-11-02 07:38:23 +00:00

Cinc Client: install the current stable release, not a floating pin a96a49c633

The migration script installed Cinc with no version, which floated and
triggered omnitruck's "You are installing a package without a version pin"
warning. Pass -v latest so omnitruck resolves the current stable build for
the node's platform (20.04 -> 19.2.12, 22.04+/24.04/26.04 -> 19.4.46) and
the warning is suppressed. Document the behavior in the README.

Drop the stale chef_version: 18.2.7 pins from the Test Kitchen suites:
dokken defaults chef_version to "latest", so passing -v is what actually
tracks the current stable client.

Add the missing provisioner.product_name: cinc to the deno and strfry
submodule suites so they run Cinc instead of the license-gated Chef Infra
Client.

Submodule pointers:
  site-cookbooks/deno   3795c9e -> c78bc66
  site-cookbooks/strfry 9c04b39 -> 8107b1e

raucao added 1 commit 2026-11-02 08:05:47 +00:00

Update nodes 3883fbc3e5

raucao commented

2026-11-02 08:07:23 +00:00

@greg I think this one's good to go. I changed it to use pinned versions, always the latest stable for each distro version, and I ran it on a few machines.

raucao added 2 commits 2026-11-03 16:48:05 +00:00

Use an isolated network per Gitea Actions job 8a60ef2aea

Job containers were pinned to a single shared `gitea-actions` bridge
network, added with the Actions cache to give service containers DNS and a
fixed gateway for the built-in cache server. Because every job of every run
attached to that one network, concurrent jobs' service containers collided
on hostnames: two simultaneous jobs that both expose a `redis` service meant
either could resolve the other's container, causing intermittent cross-job
CI failures that vanished when runs did not overlap.

Set `container.network` back to empty so the runner auto-creates an isolated
user-defined network per job. Embedded DNS still works on each per-job
network, so service containers remain reachable by name, but jobs can no
longer resolve each other's containers.

`cache.host` is left empty for auto-detection; the runner here is a host
binary (systemd), not containerized, so the detected address is reachable
from job containers. The cache port stays fixed per runner. The cache
firewall rule now allows Docker's default address pool (172.16.0.0/12)
because per-job subnets are dynamic, and the now-unused `gitea-actions`
network is removed on converge once idle.

Merge pull request 'Use an isolated network per Gitea Actions job' (#694 ) from fix/gitea-actions-network into chore/cinc 11afecdff8

Reviewed-on: #694

raucao added 1 commit 2026-11-04 09:55:49 +00:00

Merge remote-tracking branch 'origin/master' into chore/cinc d256f7c865

# Conflicts:
#	AGENTS.md
#	site-cookbooks/kosmos_gitea/CHANGELOG.md

raucao merged commit 52e84dc86c into master

2026-11-04 10:00:08 +00:00

raucao deleted branch chore/cinc

2026-11-04 10:00:08 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: kosmos/chef#692