Arvados

Peter Amstutz wrote:

• Runs Ansible directly on Jenkins node ?

I can't tell whether this means ci.arvados.org or the new #22438 server.

One thing that might affect a decision: the installer will need to have access to the entire tordo config.yml, including the PostgreSQL password, system root token, etc. I'm not sure whether ci.arvados.org currently has analogous access. If it doesn't, I can definitely see an argument for not giving it that, provided we have a more secure alternative like a second limited-access Jenkins server.

• Needs to handle Let's Encrypt
• One-time migration playbook from Salt to Ansible

These are #22924 and #22923, respectively. They can be done independently and I think we should consider them both basically blockers for a "deploy to tordo via Ansible" Jenkins job.

I think what we want to do is have the end of the an arvados CI pipeline run somehow signal to the ansible jenkins that it is time to redeploy tordo. This will maintain separation of concerns.

As discussed the planning is done and the tickets are written.