initial commit
This commit is contained in:
Gianluca Arbezzano
commit
6ede8cb2e3
|
|
@ -0,0 +1 @@
|
|||
deploy/state
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
# These owners will be the default owners for everything in
|
||||
# the repo. Unless a later match takes precedence,
|
||||
# @global-owner1 and @global-owner2 will be requested for
|
||||
# review when someone opens a pull request.
|
||||
|
||||
* @gauravgahlot @gianarb
|
||||
|
|
@ -0,0 +1 @@
|
|||
state
|
||||
|
|
@ -0,0 +1,76 @@
|
|||
SET ROLE tinkerbell;
|
||||
|
||||
CREATE TABLE IF NOT EXISTS hardware (
|
||||
id UUID UNIQUE
|
||||
, inserted_at TIMESTAMPTZ
|
||||
, deleted_at TIMESTAMPTZ
|
||||
, data JSONB
|
||||
);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS idx_id ON hardware (id);
|
||||
CREATE INDEX IF NOT EXISTS idx_deleted_at ON hardware (deleted_at NULLS FIRST);
|
||||
CREATE INDEX IF NOT EXISTS idxgin_type ON hardware USING GIN (data JSONB_PATH_OPS);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS template (
|
||||
id UUID UNIQUE NOT NULL
|
||||
, name VARCHAR(200) NOT NULL
|
||||
, created_at TIMESTAMPTZ
|
||||
, updated_at TIMESTAMPTZ
|
||||
, deleted_at TIMESTAMPTZ
|
||||
, data BYTEA
|
||||
|
||||
CONSTRAINT CK_name CHECK (name ~ '^[a-zA-Z0-9_-]*$')
|
||||
);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS idx_tid ON template (id);
|
||||
CREATE INDEX IF NOT EXISTS idx_tdeleted_at ON template (deleted_at NULLS FIRST);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS workflow (
|
||||
id UUID UNIQUE NOT NULL
|
||||
, template UUID NOT NULL
|
||||
, devices JSONB NOT NULL
|
||||
, created_at TIMESTAMPTZ
|
||||
, updated_at TIMESTAMPTZ
|
||||
, deleted_at TIMESTAMPTZ
|
||||
);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS idx_wid ON workflow (id);
|
||||
CREATE INDEX IF NOT EXISTS idx_wdeleted_at ON workflow (deleted_at NULLS FIRST);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS workflow_state (
|
||||
workflow_id UUID UNIQUE NOT NULL
|
||||
, current_task_name VARCHAR(200)
|
||||
, current_action_name VARCHAR(200)
|
||||
, current_action_state SMALLINT
|
||||
, current_worker VARCHAR(200)
|
||||
, action_list JSONB
|
||||
, current_action_index int
|
||||
, total_number_of_actions INT
|
||||
);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS idx_wfid ON workflow_state (workflow_id);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS workflow_event (
|
||||
workflow_id UUID NOT NULL
|
||||
, worker_id UUID NOT NULL
|
||||
, task_name VARCHAR(200)
|
||||
, action_name VARCHAR(200)
|
||||
, execution_time int
|
||||
, message VARCHAR(200)
|
||||
, status SMALLINT
|
||||
, created_at TIMESTAMPTZ
|
||||
);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS idx_event ON workflow_event (created_at);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS workflow_worker_map (
|
||||
workflow_id UUID NOT NULL
|
||||
, worker_id UUID NOT NULL
|
||||
);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS workflow_data (
|
||||
workflow_id UUID NOT NULL
|
||||
, version INT
|
||||
, metadata JSONB
|
||||
, data JSONB
|
||||
);
|
||||
|
|
@ -0,0 +1,155 @@
|
|||
version: "2.1"
|
||||
services:
|
||||
tink-server:
|
||||
image: quay.io/tinkerbell/tink:sha-adb49da
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
FACILITY: ${FACILITY:-onprem}
|
||||
PACKET_ENV: ${PACKET_ENV:-testing}
|
||||
PACKET_VERSION: ${PACKET_VERSION:-ignored}
|
||||
ROLLBAR_TOKEN: ${ROLLBAR_TOKEN:-ignored}
|
||||
ROLLBAR_DISABLE: ${ROLLBAR_DISABLE:-1}
|
||||
PGDATABASE: tinkerbell
|
||||
PGHOST: db
|
||||
PGPASSWORD: tinkerbell
|
||||
PGPORT: 5432
|
||||
PGSSLMODE: disable
|
||||
PGUSER: tinkerbell
|
||||
TINKERBELL_GRPC_AUTHORITY: :42113
|
||||
TINKERBELL_HTTP_AUTHORITY: :42114
|
||||
TINK_AUTH_USERNAME: ${TINKERBELL_TINK_USERNAME}
|
||||
TINK_AUTH_PASSWORD: ${TINKERBELL_TINK_PASSWORD}
|
||||
depends_on:
|
||||
db:
|
||||
condition: service_healthy
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "wget -qO- 127.0.0.1:42114/cert"] # port needs to match TINKERBELL_HTTP_AUTHORITY
|
||||
interval: 5s
|
||||
timeout: 2s
|
||||
retries: 30
|
||||
volumes:
|
||||
- ./state/certs:/certs/${FACILITY:-onprem}
|
||||
ports:
|
||||
- 42113:42113/tcp
|
||||
- 42114:42114/tcp
|
||||
|
||||
db:
|
||||
image: postgres:10-alpine
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
POSTGRES_DB: tinkerbell
|
||||
POSTGRES_PASSWORD: tinkerbell
|
||||
POSTGRES_USER: tinkerbell
|
||||
volumes:
|
||||
- ./db/tinkerbell-init.sql:/docker-entrypoint-initdb.d/tinkerbell-init.sql:ro
|
||||
- postgres_data:/var/lib/postgresql/data:rw
|
||||
ports:
|
||||
- 5432:5432
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -U tinkerbell"]
|
||||
interval: 1s
|
||||
timeout: 1s
|
||||
retries: 30
|
||||
|
||||
tink-cli:
|
||||
image: quay.io/tinkerbell/tink-cli:sha-adb49da
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
TINKERBELL_GRPC_AUTHORITY: 127.0.0.1:42113
|
||||
TINKERBELL_CERT_URL: http://127.0.0.1:42114/cert
|
||||
depends_on:
|
||||
tink-server:
|
||||
condition: service_healthy
|
||||
db:
|
||||
condition: service_healthy
|
||||
network_mode: host
|
||||
|
||||
registry:
|
||||
build:
|
||||
context: registry
|
||||
args:
|
||||
REGISTRY_USERNAME: $TINKERBELL_REGISTRY_USERNAME
|
||||
REGISTRY_PASSWORD: $TINKERBELL_REGISTRY_PASSWORD
|
||||
restart: unless-stopped
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "curl --cacert /certs/ca.pem https://127.0.0.1"]
|
||||
interval: 5s
|
||||
timeout: 1s
|
||||
retries: 5
|
||||
environment:
|
||||
REGISTRY_HTTP_ADDR: 0.0.0.0:443
|
||||
REGISTRY_HTTP_TLS_CERTIFICATE: /certs/server.pem
|
||||
REGISTRY_HTTP_TLS_KEY: /certs/server-key.pem
|
||||
REGISTRY_AUTH: htpasswd
|
||||
REGISTRY_AUTH_HTPASSWD_REALM: "Registry Realm"
|
||||
REGISTRY_AUTH_HTPASSWD_PATH: /auth/htpasswd
|
||||
volumes:
|
||||
- ./state/certs:/certs
|
||||
- ./state/registry:/var/lib/registry
|
||||
network_mode: host
|
||||
|
||||
boots:
|
||||
image: quay.io/tinkerbell/boots:327-58ab49913b5498908b16e2607d265a61a05f73b6
|
||||
restart: unless-stopped
|
||||
network_mode: host
|
||||
command: -dhcp-addr 0.0.0.0:67 -tftp-addr $TINKERBELL_HOST_IP:69 -http-addr $TINKERBELL_HOST_IP:80 -log-level DEBUG
|
||||
environment:
|
||||
API_AUTH_TOKEN: ${PACKET_API_AUTH_TOKEN:-ignored}
|
||||
API_CONSUMER_TOKEN: ${PACKET_CONSUMER_TOKEN:-ignored}
|
||||
FACILITY_CODE: ${FACILITY:-onprem}
|
||||
PACKET_ENV: ${PACKET_ENV:-testing}
|
||||
PACKET_VERSION: ${PACKET_VERSION:-ignored}
|
||||
ROLLBAR_TOKEN: ${ROLLBAR_TOKEN:-ignored}
|
||||
ROLLBAR_DISABLE: ${ROLLBAR_DISABLE:-1}
|
||||
MIRROR_HOST: ${TINKERBELL_NGINX_IP:-127.0.0.1}
|
||||
DNS_SERVERS: 8.8.8.8
|
||||
PUBLIC_IP: $TINKERBELL_HOST_IP
|
||||
BOOTP_BIND: $TINKERBELL_HOST_IP:67
|
||||
HTTP_BIND: $TINKERBELL_HOST_IP:80
|
||||
SYSLOG_BIND: $TINKERBELL_HOST_IP:514
|
||||
TFTP_BIND: $TINKERBELL_HOST_IP:69
|
||||
DOCKER_REGISTRY: $TINKERBELL_HOST_IP
|
||||
REGISTRY_USERNAME: $TINKERBELL_REGISTRY_USERNAME
|
||||
REGISTRY_PASSWORD: $TINKERBELL_REGISTRY_PASSWORD
|
||||
TINKERBELL_GRPC_AUTHORITY: $TINKERBELL_HOST_IP:42113
|
||||
TINKERBELL_CERT_URL: http://$TINKERBELL_HOST_IP:42114/cert
|
||||
ELASTIC_SEARCH_URL: $TINKERBELL_HOST_IP:9200
|
||||
DATA_MODEL_VERSION: 1
|
||||
depends_on:
|
||||
db:
|
||||
condition: service_healthy
|
||||
ports:
|
||||
- $TINKERBELL_HOST_IP:80:80/tcp
|
||||
- 67:67/udp
|
||||
- 69:69/udp
|
||||
|
||||
nginx:
|
||||
image: nginx:alpine
|
||||
restart: unless-stopped
|
||||
tty: true
|
||||
ports:
|
||||
- $TINKERBELL_NGINX_IP:80:80/tcp
|
||||
volumes:
|
||||
- ./state/webroot:/usr/share/nginx/html/
|
||||
|
||||
hegel:
|
||||
image: quay.io/tinkerbell/hegel:196-fa897aa020769db8becb9be29adaeb6be92a7fc7
|
||||
restart: unless-stopped
|
||||
network_mode: host
|
||||
environment:
|
||||
ROLLBAR_TOKEN: ${ROLLBAR_TOKEN-ignored}
|
||||
ROLLBAR_DISABLE: 1
|
||||
PACKET_ENV: testing
|
||||
PACKET_VERSION: ${PACKET_VERSION:-ignored}
|
||||
GRPC_PORT: 42115
|
||||
HEGEL_FACILITY: ${FACILITY:-onprem}
|
||||
HEGEL_USE_TLS: 0
|
||||
TINKERBELL_GRPC_AUTHORITY: 127.0.0.1:42113
|
||||
TINKERBELL_CERT_URL: http://127.0.0.1:42114/cert
|
||||
DATA_MODEL_VERSION: 1
|
||||
depends_on:
|
||||
db:
|
||||
condition: service_healthy
|
||||
|
||||
volumes:
|
||||
postgres_data:
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
FROM registry:2.7.1
|
||||
RUN apk add --no-cache --update curl apache2-utils
|
||||
ARG REGISTRY_USERNAME
|
||||
ARG REGISTRY_PASSWORD
|
||||
RUN mkdir -p /certs /auth
|
||||
RUN htpasswd -Bbn ${REGISTRY_USERNAME} ${REGISTRY_PASSWORD} > /auth/htpasswd
|
||||
EXPOSE 443
|
||||
|
|
@ -0,0 +1 @@
|
|||
https://tinkerbell.org/docs/setup/packet-with-terraform/
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
variable "packet_api_token" {
|
||||
description = "Packet user api token"
|
||||
}
|
||||
|
||||
variable "project_id" {
|
||||
description = "Project ID"
|
||||
}
|
||||
|
||||
variable "facility" {
|
||||
description = "Packet facility to provision in"
|
||||
default = "sjc1"
|
||||
}
|
||||
|
||||
variable "device_type" {
|
||||
description = "Type of device to provision"
|
||||
default = "c3.small.x86"
|
||||
}
|
||||
|
|
@ -0,0 +1,66 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
YUM="yum"
|
||||
APT="apt"
|
||||
PIP3="pip3"
|
||||
YUM_CONFIG_MGR="yum-config-manager"
|
||||
WHICH_YUM=$(command -v $YUM)
|
||||
WHICH_APT=$(command -v $APT)
|
||||
YUM_INSTALL="$YUM install"
|
||||
APT_INSTALL="$APT install"
|
||||
PIP3_INSTALL="$PIP3 install"
|
||||
declare -a YUM_LIST=("https://download.docker.com/linux/centos/7/x86_64/stable/Packages/containerd.io-1.2.6-3.3.el7.x86_64.rpm"
|
||||
"docker-ce"
|
||||
"docker-ce-cli"
|
||||
"epel-release"
|
||||
"python3")
|
||||
declare -a APT_LIST=("docker"
|
||||
"docker-compose")
|
||||
|
||||
add_yum_repo() (
|
||||
$YUM_CONFIG_MGR --add-repo https://download.docker.com/linux/centos/docker-ce.repo
|
||||
)
|
||||
|
||||
update_yum() (
|
||||
$YUM_INSTALL -y yum-utils
|
||||
add_yum_repo
|
||||
)
|
||||
|
||||
update_apt() (
|
||||
$APT update
|
||||
DEBIAN_FRONTEND=noninteractive $APT --yes --force-yes -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" upgrade
|
||||
)
|
||||
|
||||
restart_docker_service() (
|
||||
service docker restart
|
||||
)
|
||||
|
||||
install_yum_packages() (
|
||||
$YUM_INSTALL "${YUM_LIST[@]}" -y
|
||||
)
|
||||
|
||||
install_pip3_packages() (
|
||||
$PIP3_INSTALL docker-compose
|
||||
)
|
||||
|
||||
install_apt_packages() (
|
||||
$APT_INSTALL "${APT_LIST[@]}" -y
|
||||
)
|
||||
|
||||
main() (
|
||||
if [[ -n $WHICH_YUM ]]; then
|
||||
update_yum
|
||||
install_yum_packages
|
||||
install_pip3_packages
|
||||
restart_docker_service
|
||||
elif [[ -n $WHICH_APT ]]; then
|
||||
update_apt
|
||||
install_apt_packages
|
||||
restart_docker_service
|
||||
else
|
||||
echo "Unknown platform. Error while installing the required packages"
|
||||
exit 1
|
||||
fi
|
||||
)
|
||||
|
||||
main
|
||||
|
|
@ -0,0 +1,65 @@
|
|||
# Configure the Packet Provider.
|
||||
provider "packet" {
|
||||
auth_token = var.packet_api_token
|
||||
version = "~> 2.9"
|
||||
}
|
||||
|
||||
# Create a new VLAN in datacenter "ewr1"
|
||||
resource "packet_vlan" "provisioning-vlan" {
|
||||
description = "provisioning-vlan"
|
||||
facility = var.facility
|
||||
project_id = var.project_id
|
||||
}
|
||||
|
||||
# Create a device and add it to tf_project_1
|
||||
resource "packet_device" "tink-provisioner" {
|
||||
hostname = "tink-provisioner"
|
||||
plan = var.device_type
|
||||
facilities = [var.facility]
|
||||
operating_system = "ubuntu_18_04"
|
||||
billing_cycle = "hourly"
|
||||
project_id = var.project_id
|
||||
network_type = "hybrid"
|
||||
user_data = "${file("install_package.sh")}"
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
# Create a device and add it to tf_project_1
|
||||
resource "packet_device" "tink-worker" {
|
||||
hostname = "tink-worker"
|
||||
plan = var.device_type
|
||||
facilities = [var.facility]
|
||||
operating_system = "custom_ipxe"
|
||||
ipxe_script_url = "https://boot.netboot.xyz"
|
||||
always_pxe = "true"
|
||||
billing_cycle = "hourly"
|
||||
project_id = var.project_id
|
||||
network_type = "layer2-individual"
|
||||
}
|
||||
|
||||
# Attach VLAN to provisioner
|
||||
resource "packet_port_vlan_attachment" "provisioner" {
|
||||
device_id = packet_device.tink-provisioner.id
|
||||
port_name = "eth1"
|
||||
vlan_vnid = packet_vlan.provisioning-vlan.vxlan
|
||||
}
|
||||
|
||||
# Attach VLAN to worker
|
||||
resource "packet_port_vlan_attachment" "worker" {
|
||||
device_id = packet_device.tink-worker.id
|
||||
port_name = "eth0"
|
||||
vlan_vnid = packet_vlan.provisioning-vlan.vxlan
|
||||
}
|
||||
|
||||
output "provisioner_dns_name" {
|
||||
value = "${split("-", packet_device.tink-provisioner.id)[0]}.packethost.net"
|
||||
}
|
||||
|
||||
output "provisioner_ip" {
|
||||
value = "${packet_device.tink-provisioner.network[0].address}"
|
||||
}
|
||||
|
||||
output "worker_mac_addr" {
|
||||
value = "${packet_device.tink-worker.ports[1].mac}"
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
*/
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
FROM alpine:3.11
|
||||
ENTRYPOINT [ "/entrypoint.sh" ]
|
||||
|
||||
RUN apk add --no-cache --update --upgrade ca-certificates postgresql-client
|
||||
RUN apk add --no-cache --update --upgrade --repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing cfssl
|
||||
|
||||
COPY . .
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
{
|
||||
"signing": {
|
||||
"default": {
|
||||
"expiry": "168h"
|
||||
},
|
||||
"profiles": {
|
||||
"server": {
|
||||
"expiry": "8760h",
|
||||
"usages": ["signing", "key encipherment", "server auth"]
|
||||
},
|
||||
"signing": {
|
||||
"expiry": "8760h",
|
||||
"usages": ["signing", "key encipherment"]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
{
|
||||
"CN": "Autogenerated CA",
|
||||
"key": {
|
||||
"algo": "rsa",
|
||||
"size": 2048
|
||||
},
|
||||
"names": [
|
||||
{
|
||||
"L": "@FACILITY@"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
#!/usr/bin/env sh
|
||||
|
||||
# set -o errexit -o nounset -o pipefail
|
||||
|
||||
if [ -z "${TINKERBELL_TLS_CERT:-}" ]; then
|
||||
(
|
||||
echo "creating directory"
|
||||
mkdir -p "certs"
|
||||
./gencerts.sh
|
||||
)
|
||||
fi
|
||||
|
||||
"$@"
|
||||
|
|
@ -0,0 +1,30 @@
|
|||
#!/usr/bin/env sh
|
||||
|
||||
set -eux
|
||||
|
||||
cd /certs
|
||||
|
||||
if [ ! -f ca-key.pem ]; then
|
||||
cfssl gencert \
|
||||
-initca ca.json | cfssljson -bare ca
|
||||
fi
|
||||
|
||||
if [ ! -f server.pem ]; then
|
||||
cfssl gencert \
|
||||
-ca=ca.pem \
|
||||
-ca-key=ca-key.pem \
|
||||
-config=/ca-config.json \
|
||||
-profile=server \
|
||||
server-csr.json |
|
||||
cfssljson -bare server
|
||||
fi
|
||||
|
||||
cat server.pem ca.pem >bundle.pem.tmp
|
||||
|
||||
# only "modify" the file if truly necessary since workflow will serve it with
|
||||
# modtime info for client caching purposes
|
||||
if ! cmp -s bundle.pem.tmp bundle.pem; then
|
||||
mv bundle.pem.tmp bundle.pem
|
||||
else
|
||||
rm bundle.pem.tmp
|
||||
fi
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
{
|
||||
"CN": "tinkerbell",
|
||||
"hosts": [
|
||||
"tinkerbell.registry",
|
||||
"tinkerbell.tinkerbell",
|
||||
"tinkerbell",
|
||||
"localhost",
|
||||
"127.0.0.1"
|
||||
],
|
||||
"key": {
|
||||
"algo": "rsa",
|
||||
"size": 2048
|
||||
},
|
||||
"names": [
|
||||
{
|
||||
"L": "@FACILITY@"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
.vagrant
|
||||
|
|
@ -0,0 +1 @@
|
|||
https://tinkerbell.org/docs/setup/local-with-vagrant/
|
||||
|
|
@ -0,0 +1,71 @@
|
|||
ENV['VAGRANT_NO_PARALLEL'] = 'yes'
|
||||
|
||||
# Returns true if `GUI` environment variable is set to a non-empty value.
|
||||
# Defaults to false
|
||||
def worker_gui_enabled?
|
||||
ENV.fetch('VAGRANT_WORKER_GUI', '').empty?
|
||||
end
|
||||
|
||||
Vagrant.configure('2') do |config|
|
||||
|
||||
config.vm.define :provisioner do |provisioner|
|
||||
provisioner.vm.box = 'generic/ubuntu1804'
|
||||
provisioner.vm.hostname = 'provisioner'
|
||||
provisioner.vm.synced_folder './../../', '/vagrant'
|
||||
provisioner.vm.provision :shell, path: './scripts/tinkerbell.sh'
|
||||
|
||||
provisioner.vm.network :private_network,
|
||||
virtualbox__intnet: "tink_network",
|
||||
libvirt__dhcp_enabled: false,
|
||||
libvirt__forward_mode: 'none',
|
||||
auto_config: false
|
||||
|
||||
provisioner.vm.network "forwarded_port", guest: 42113, host: 42113
|
||||
provisioner.vm.network "forwarded_port", guest: 42114, host: 42114
|
||||
|
||||
|
||||
provisioner.vm.provider :libvirt do |lv, override|
|
||||
lv.memory = 2*1024
|
||||
lv.cpus = 2
|
||||
lv.cpu_mode = 'host-passthrough'
|
||||
end
|
||||
|
||||
provisioner.vm.provider :virtualbox do |vb, override|
|
||||
vb.memory = 2*1024
|
||||
vb.cpus = 2
|
||||
end
|
||||
end
|
||||
|
||||
config.vm.define "worker" do |worker|
|
||||
worker.vm.box = nil
|
||||
worker.vm.network :private_network,
|
||||
mac: "080027000001",
|
||||
virtualbox__intnet: "tink_network",
|
||||
libvirt__dhcp_enabled: false,
|
||||
libvirt__forward_mode: 'none',
|
||||
auto_config: false
|
||||
|
||||
worker.vm.provider :libvirt do |lv|
|
||||
lv.memory = 4*1024
|
||||
lv.cpus = 1
|
||||
lv.boot 'network'
|
||||
lv.mgmt_attach = false
|
||||
end
|
||||
|
||||
worker.vm.provider :virtualbox do |vb, worker|
|
||||
worker.vm.box = 'generic/alpine38'
|
||||
vb.memory = 4*1024
|
||||
vb.cpus = 1
|
||||
vb.gui = worker_gui_enabled?
|
||||
vb.customize [
|
||||
'modifyvm', :id,
|
||||
'--nic1', 'none',
|
||||
'--boot1', 'net',
|
||||
'--boot2', 'none',
|
||||
'--boot3', 'none',
|
||||
'--boot4', 'none',
|
||||
'--macaddress1', '080027000001'
|
||||
]
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
@ -0,0 +1,100 @@
|
|||
#!/bin/bash
|
||||
|
||||
# abort this script on errors
|
||||
set -euxo pipefail
|
||||
|
||||
whoami
|
||||
|
||||
cd /vagrant
|
||||
|
||||
setup_docker() (
|
||||
# steps from https://docs.docker.com/engine/install/ubuntu/
|
||||
sudo apt-get install -y \
|
||||
apt-transport-https \
|
||||
ca-certificates \
|
||||
curl \
|
||||
gnupg-agent \
|
||||
software-properties-common
|
||||
|
||||
curl -fsSL https://download.docker.com/linux/ubuntu/gpg |
|
||||
sudo apt-key add -
|
||||
|
||||
local repo
|
||||
repo=$(
|
||||
printf "deb [arch=amd64] https://download.docker.com/linux/ubuntu %s stable" \
|
||||
"$(lsb_release -cs)"
|
||||
)
|
||||
sudo add-apt-repository "$repo"
|
||||
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y docker-ce docker-ce-cli containerd.io
|
||||
)
|
||||
|
||||
setup_docker_compose() (
|
||||
# from https://docs.docker.com/compose/install/
|
||||
sudo curl -L \
|
||||
"https://github.com/docker/compose/releases/download/1.26.0/docker-compose-$(uname -s)-$(uname -m)" \
|
||||
-o /usr/local/bin/docker-compose
|
||||
|
||||
sudo chmod +x /usr/local/bin/docker-compose
|
||||
)
|
||||
|
||||
make_certs_writable() (
|
||||
local certdir="/etc/docker/certs.d/$TINKERBELL_HOST_IP"
|
||||
sudo mkdir -p "$certdir"
|
||||
sudo chown -R "$USER" "$certdir"
|
||||
)
|
||||
|
||||
secure_certs() (
|
||||
local certdir="/etc/docker/certs.d/$TINKERBELL_HOST_IP"
|
||||
sudo chown "root" "$certdir"
|
||||
)
|
||||
|
||||
command_exists() (
|
||||
command -v "$@" >/dev/null 2>&1
|
||||
)
|
||||
|
||||
configure_vagrant_user() (
|
||||
sudo usermod -aG docker vagrant
|
||||
|
||||
echo -n "$TINKERBELL_REGISTRY_PASSWORD" |
|
||||
sudo -iu vagrant docker login \
|
||||
--username="$TINKERBELL_REGISTRY_USERNAME" \
|
||||
--password-stdin "$TINKERBELL_HOST_IP"
|
||||
)
|
||||
|
||||
main() (
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
|
||||
apt-get update
|
||||
|
||||
if ! command_exists docker; then
|
||||
setup_docker
|
||||
fi
|
||||
|
||||
if ! command_exists docker-compose; then
|
||||
setup_docker_compose
|
||||
fi
|
||||
|
||||
if ! command_exists jq; then
|
||||
sudo apt-get install -y jq
|
||||
fi
|
||||
|
||||
if [ ! -f ./envrc ]; then
|
||||
./generate-envrc.sh eth1 >envrc
|
||||
fi
|
||||
|
||||
# shellcheck disable=SC1091
|
||||
. ./envrc
|
||||
|
||||
make_certs_writable
|
||||
|
||||
./setup.sh
|
||||
|
||||
secure_certs
|
||||
|
||||
configure_vagrant_user
|
||||
|
||||
)
|
||||
|
||||
main
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
# Network interface for Tinkerbell's network
|
||||
export TINKERBELL_NETWORK_INTERFACE="eth1"
|
||||
|
||||
# Decide on a subnet for provisioning. Tinkerbell should "own" this
|
||||
# network space. Its subnet should be just large enough to be able
|
||||
# to provision your hardware.
|
||||
export TINKERBELL_CIDR=29
|
||||
|
||||
# Host IP is used by provisioner to expose different services such as
|
||||
# tink, boots, etc.
|
||||
#
|
||||
# The host IP should the first IP in the range, and the Nginx IP
|
||||
# should be the second address.
|
||||
export TINKERBELL_HOST_IP=192.168.1.1
|
||||
|
||||
# NGINX IP is used by provisioner to serve files required for iPXE boot
|
||||
export TINKERBELL_NGINX_IP=192.168.1.2
|
||||
|
||||
# Tink server username and password
|
||||
export TINKERBELL_TINK_USERNAME=admin
|
||||
export TINKERBELL_TINK_PASSWORD="ef53a532afe700a521b4aee97dc55c402a71dce5566dc3c7ef89bea7ffd6c8ea"
|
||||
|
||||
# Docker Registry's username and password
|
||||
export TINKERBELL_REGISTRY_USERNAME=admin
|
||||
export TINKERBELL_REGISTRY_PASSWORD="9ca5d519f54b5345fb0451a3dda58506c3a7a7f8c2ce8eb234b82018c82c0a2c"
|
||||
|
||||
# Legacy options, to be deleted:
|
||||
export FACILITY=onprem
|
||||
export ROLLBAR_TOKEN=ignored
|
||||
export ROLLBAR_DISABLE=1
|
||||
|
||||
export OSIE_DOWNLOAD_LINK=https://tinkerbell-oss.s3.amazonaws.com/osie-uploads/osie-v0-n=252,c=bc454bc,b=master.tar.gz
|
||||
|
|
@ -0,0 +1,99 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
# stops the execution if a command or pipeline has an error
|
||||
set -eu
|
||||
|
||||
if command -v tput >/dev/null && tput setaf 1 >/dev/null 2>&1; then
|
||||
# color codes
|
||||
RED="$(tput setaf 1)"
|
||||
RESET="$(tput sgr0)"
|
||||
fi
|
||||
|
||||
ERR="${RED:-}ERROR:${RESET:-}"
|
||||
|
||||
err() (
|
||||
if [ -z "${1:-}" ]; then
|
||||
cat >&2
|
||||
else
|
||||
echo "$ERR " "$@" >&2
|
||||
fi
|
||||
)
|
||||
|
||||
candidate_interfaces() (
|
||||
ip -o link show |
|
||||
awk -F': ' '{print $2}' |
|
||||
sed 's/[ \t].*//;/^\(lo\|bond0\|\|\)$/d' |
|
||||
sort
|
||||
)
|
||||
|
||||
validate_tinkerbell_network_interface() (
|
||||
local tink_interface=$1
|
||||
|
||||
if ! candidate_interfaces | grep -q "^$tink_interface$"; then
|
||||
err "Invalid interface ($tink_interface) selected, must be one of:"
|
||||
candidate_interfaces | err
|
||||
return 1
|
||||
else
|
||||
return 0
|
||||
fi
|
||||
)
|
||||
|
||||
generate_password() (
|
||||
head -c 12 /dev/urandom | sha256sum | cut -d' ' -f1
|
||||
)
|
||||
|
||||
generate_envrc() (
|
||||
local tink_interface=$1
|
||||
|
||||
validate_tinkerbell_network_interface "$tink_interface"
|
||||
|
||||
local tink_password
|
||||
tink_password=$(generate_password)
|
||||
local registry_password
|
||||
registry_password=$(generate_password)
|
||||
cat <<EOF
|
||||
# Network interface for Tinkerbell's network
|
||||
export TINKERBELL_NETWORK_INTERFACE="$tink_interface"
|
||||
|
||||
# Decide on a subnet for provisioning. Tinkerbell should "own" this
|
||||
# network space. Its subnet should be just large enough to be able
|
||||
# to provision your hardware.
|
||||
export TINKERBELL_CIDR=29
|
||||
|
||||
# Host IP is used by provisioner to expose different services such as
|
||||
# tink, boots, etc.
|
||||
#
|
||||
# The host IP should the first IP in the range, and the Nginx IP
|
||||
# should be the second address.
|
||||
export TINKERBELL_HOST_IP=192.168.1.1
|
||||
|
||||
# NGINX IP is used by provisioner to serve files required for iPXE boot
|
||||
export TINKERBELL_NGINX_IP=192.168.1.2
|
||||
|
||||
# Tink server username and password
|
||||
export TINKERBELL_TINK_USERNAME=admin
|
||||
export TINKERBELL_TINK_PASSWORD="$tink_password"
|
||||
|
||||
# Docker Registry's username and password
|
||||
export TINKERBELL_REGISTRY_USERNAME=admin
|
||||
export TINKERBELL_REGISTRY_PASSWORD="$registry_password"
|
||||
|
||||
# Legacy options, to be deleted:
|
||||
export FACILITY=onprem
|
||||
export ROLLBAR_TOKEN=ignored
|
||||
export ROLLBAR_DISABLE=1
|
||||
|
||||
export OSIE_DOWNLOAD_LINK=https://tinkerbell-oss.s3.amazonaws.com/osie-uploads/osie-v0-n=252,c=bc454bc,b=master.tar.gz
|
||||
EOF
|
||||
)
|
||||
|
||||
main() (
|
||||
if [ -z "${1:-}" ]; then
|
||||
err "Usage: $0 network-interface-name > envrc"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
generate_envrc "$1"
|
||||
)
|
||||
|
||||
main "$@"
|
||||
|
|
@ -0,0 +1,518 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
# stops the execution if a command or pipeline has an error
|
||||
set -eu
|
||||
|
||||
# Tinkerbell stack Linux setup script
|
||||
#
|
||||
# See https://tinkerbell.org/setup for the installation steps.
|
||||
|
||||
# file to hold all environment variables
|
||||
ENV_FILE=envrc
|
||||
|
||||
SCRATCH=$(mktemp -d -t tmp.XXXXXXXXXX)
|
||||
readonly SCRATCH
|
||||
function finish() (
|
||||
rm -rf "$SCRATCH"
|
||||
)
|
||||
trap finish EXIT
|
||||
|
||||
DEPLOYDIR=$(pwd)/deploy
|
||||
readonly DEPLOYDIR
|
||||
readonly STATEDIR=$DEPLOYDIR/state
|
||||
|
||||
if command -v tput >/dev/null && tput setaf 1 >/dev/null 2>&1; then
|
||||
# color codes
|
||||
RED="$(tput setaf 1)"
|
||||
GREEN="$(tput setaf 2)"
|
||||
YELLOW="$(tput setaf 3)"
|
||||
RESET="$(tput sgr0)"
|
||||
fi
|
||||
|
||||
INFO="${GREEN:-}INFO:${RESET:-}"
|
||||
ERR="${RED:-}ERROR:${RESET:-}"
|
||||
WARN="${YELLOW:-}WARNING:${RESET:-}"
|
||||
BLANK=" "
|
||||
NEXT="${GREEN:-}NEXT:${RESET:-}"
|
||||
|
||||
get_distribution() (
|
||||
local lsb_dist=""
|
||||
# Every system that we officially support has /etc/os-release
|
||||
if [ -r /etc/os-release ]; then
|
||||
# shellcheck disable=SC1091
|
||||
lsb_dist="$(. /etc/os-release && echo "$ID")"
|
||||
fi
|
||||
# Returning an empty string here should be alright since the
|
||||
# case statements don't act unless you provide an actual value
|
||||
echo "$lsb_dist" | tr '[:upper:]' '[:lower:]'
|
||||
)
|
||||
|
||||
get_distro_version() (
|
||||
local lsb_version="0"
|
||||
# Every system that we officially support has /etc/os-release
|
||||
if [ -r /etc/os-release ]; then
|
||||
# shellcheck disable=SC1091
|
||||
lsb_version="$(. /etc/os-release && echo "$VERSION_ID")"
|
||||
fi
|
||||
|
||||
echo "$lsb_version"
|
||||
)
|
||||
|
||||
is_network_configured() (
|
||||
# Require the provisioner interface have both the host and nginx IP
|
||||
if ! ip addr show "$TINKERBELL_NETWORK_INTERFACE" |
|
||||
grep -q "$TINKERBELL_HOST_IP"; then
|
||||
return 1
|
||||
fi
|
||||
|
||||
if ! ip addr show "$TINKERBELL_NETWORK_INTERFACE" |
|
||||
grep -q "$TINKERBELL_NGINX_IP"; then
|
||||
return 1
|
||||
fi
|
||||
|
||||
return 0
|
||||
)
|
||||
|
||||
identify_network_strategy() (
|
||||
local distro=$1
|
||||
local version=$2
|
||||
|
||||
case "$distro" in
|
||||
ubuntu)
|
||||
if jq -n --exit-status '$distro_version >= 17.10' --argjson distro_version "$version" >/dev/null 2>&1; then
|
||||
echo "setup_networking_netplan"
|
||||
else
|
||||
echo "setup_networking_ubuntu_legacy"
|
||||
fi
|
||||
;;
|
||||
centos)
|
||||
echo "setup_networking_centos"
|
||||
;;
|
||||
*)
|
||||
echo "setup_networking_manually"
|
||||
;;
|
||||
esac
|
||||
)
|
||||
|
||||
setup_networking() (
|
||||
local distro=$1
|
||||
local version=$2
|
||||
|
||||
setup_network_forwarding
|
||||
|
||||
if is_network_configured; then
|
||||
echo "$INFO tinkerbell network interface is already configured"
|
||||
return 0
|
||||
fi
|
||||
|
||||
local strategy
|
||||
strategy=$(identify_network_strategy "$distro" "$version")
|
||||
|
||||
"${strategy}" "$distro" "$version" # execute the strategy
|
||||
|
||||
if is_network_configured; then
|
||||
echo "$INFO tinkerbell network interface configured successfully"
|
||||
else
|
||||
echo "$ERR tinkerbell network interface configuration failed"
|
||||
fi
|
||||
)
|
||||
|
||||
setup_networking_manually() (
|
||||
local distro=$1
|
||||
local version=$2
|
||||
|
||||
echo "$ERR this setup script cannot configure $distro ($version)"
|
||||
echo "$BLANK please read this script's source and configure it manually."
|
||||
exit 1
|
||||
)
|
||||
|
||||
setup_network_forwarding() (
|
||||
# enable IP forwarding for docker
|
||||
if [ "$(sysctl -n net.ipv4.ip_forward)" != "1" ]; then
|
||||
if [ -d /etc/sysctl.d ]; then
|
||||
echo "net.ipv4.ip_forward=1" >/etc/sysctl.d/99-tinkerbell.conf
|
||||
elif [ -f /etc/sysctl.conf ]; then
|
||||
echo "net.ipv4.ip_forward=1" >>/etc/sysctl.conf
|
||||
fi
|
||||
|
||||
sysctl net.ipv4.ip_forward=1
|
||||
fi
|
||||
)
|
||||
|
||||
setup_networking_netplan() (
|
||||
jq -n \
|
||||
--arg interface "$TINKERBELL_NETWORK_INTERFACE" \
|
||||
--arg cidr "$TINKERBELL_CIDR" \
|
||||
--arg host_ip "$TINKERBELL_HOST_IP" \
|
||||
--arg nginx_ip "$TINKERBELL_NGINX_IP" \
|
||||
'{
|
||||
network: {
|
||||
renderer: "networkd",
|
||||
ethernets: {
|
||||
($interface): {
|
||||
addresses: [
|
||||
"\($host_ip)/\($cidr)",
|
||||
"\($nginx_ip)/\($cidr)"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}' >"/etc/netplan/${TINKERBELL_NETWORK_INTERFACE}.yaml"
|
||||
|
||||
ip link set "$TINKERBELL_NETWORK_INTERFACE" nomaster
|
||||
netplan apply
|
||||
echo "$INFO waiting for the network configuration to be applied by systemd-networkd"
|
||||
sleep 3
|
||||
)
|
||||
|
||||
setup_networking_ubuntu_legacy() (
|
||||
if [ ! -f /etc/network/interfaces ]; then
|
||||
echo "$ERR file /etc/network/interfaces not found"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if grep -q "$TINKERBELL_NETWORK_INTERFACE" /etc/network/interfaces; then
|
||||
echo "$ERR /etc/network/interfaces already has an entry for $TINKERBELL_NETWORK_INTERFACE."
|
||||
echo "$BLANK To prevent breaking your network, please edit /etc/network/interfaces"
|
||||
echo "$BLANK and configure $TINKERBELL_NETWORK_INTERFACE as follows:"
|
||||
generate_iface_config
|
||||
echo ""
|
||||
echo "$BLANK Then run the following commands:"
|
||||
echo "$BLANK ip link set $TINKERBELL_NETWORK_INTERFACE nomaster"
|
||||
echo "$BLANK ifdown $TINKERBELL_NETWORK_INTERFACE:0"
|
||||
echo "$BLANK ifdown $TINKERBELL_NETWORK_INTERFACE:1"
|
||||
echo "$BLANK ifup $TINKERBELL_NETWORK_INTERFACE:0"
|
||||
echo "$BLANK ifup $TINKERBELL_NETWORK_INTERFACE:1"
|
||||
exit 1
|
||||
else
|
||||
generate_iface_config >>/etc/network/interfaces
|
||||
ip link set "$TINKERBELL_NETWORK_INTERFACE" nomaster
|
||||
ifdown "$TINKERBELL_NETWORK_INTERFACE:0"
|
||||
ifdown "$TINKERBELL_NETWORK_INTERFACE:1"
|
||||
ifup "$TINKERBELL_NETWORK_INTERFACE:0"
|
||||
ifup "$TINKERBELL_NETWORK_INTERFACE:1"
|
||||
fi
|
||||
)
|
||||
|
||||
generate_iface_config() (
|
||||
cat <<EOF
|
||||
|
||||
auto $TINKERBELL_NETWORK_INTERFACE:0
|
||||
iface $TINKERBELL_NETWORK_INTERFACE:0 inet static
|
||||
address $TINKERBELL_HOST_IP/$TINKERBELL_CIDR
|
||||
pre-up sleep 4
|
||||
|
||||
auto $TINKERBELL_NETWORK_INTERFACE:1
|
||||
iface $TINKERBELL_NETWORK_INTERFACE:1 inet static
|
||||
address $TINKERBELL_NGINX_IP/$TINKERBELL_CIDR
|
||||
pre-up sleep 4
|
||||
EOF
|
||||
)
|
||||
|
||||
setup_networking_centos() (
|
||||
local HWADDRESS
|
||||
local content
|
||||
|
||||
HWADDRESS=$(ip addr show "$TINKERBELL_NETWORK_INTERFACE" | grep ether | awk -F 'ether' '{print $2}' | cut -d" " -f2)
|
||||
content=$(
|
||||
cat <<EOF
|
||||
DEVICE=$TINKERBELL_NETWORK_INTERFACE
|
||||
ONBOOT=yes
|
||||
HWADDR=$HWADDRESS
|
||||
BOOTPROTO=static
|
||||
|
||||
IPADDR0=$TINKERBELL_HOST_IP
|
||||
PREFIX0=$TINKERBELL_CIDR
|
||||
IPADDR1=$TINKERBELL_NGINX_IP
|
||||
PREFIX1=$TINKERBELL_CIDR
|
||||
EOF
|
||||
)
|
||||
|
||||
local cfgfile="/etc/sysconfig/network-scripts/ifcfg-$TINKERBELL_NETWORK_INTERFACE"
|
||||
|
||||
if [ -f "$cfgfile" ]; then
|
||||
echo "$ERR network config already exists: $cfgfile"
|
||||
echo "$BLANK Please update it to match this configuration:"
|
||||
echo "$content"
|
||||
echo ""
|
||||
echo "$BLANK Then, run the following commands:"
|
||||
echo "ip link set $TINKERBELL_NETWORK_INTERFACE nomaster"
|
||||
echo "ifup $TINKERBELL_NETWORK_INTERFACE"
|
||||
fi
|
||||
|
||||
echo "$content" >"$cfgfile"
|
||||
|
||||
ip link set "$TINKERBELL_NETWORK_INTERFACE" nomaster
|
||||
ifup "$TINKERBELL_NETWORK_INTERFACE"
|
||||
)
|
||||
|
||||
setup_osie() (
|
||||
mkdir -p "$STATEDIR/webroot"
|
||||
|
||||
local osie_current=$STATEDIR/webroot/misc/osie/current
|
||||
local tink_workflow=$STATEDIR/webroot/workflow/
|
||||
if [ ! -d "$osie_current" ] || [ ! -d "$tink_workflow" ]; then
|
||||
mkdir -p "$osie_current"
|
||||
mkdir -p "$tink_workflow"
|
||||
pushd "$SCRATCH"
|
||||
|
||||
if [ -z "${TB_OSIE_TAR:-}" ]; then
|
||||
curl "${OSIE_DOWNLOAD_LINK}" -o ./osie.tar.gz
|
||||
tar -zxf osie.tar.gz
|
||||
else
|
||||
tar -zxf "$TB_OSIE_TAR"
|
||||
fi
|
||||
|
||||
if pushd osie*/; then
|
||||
if mv workflow-helper.sh workflow-helper-rc "$tink_workflow"; then
|
||||
cp -r ./* "$osie_current"
|
||||
else
|
||||
echo "$ERR failed to move 'workflow-helper.sh' and 'workflow-helper-rc'"
|
||||
exit 1
|
||||
fi
|
||||
popd
|
||||
fi
|
||||
else
|
||||
echo "$INFO found existing osie files, skipping osie setup"
|
||||
fi
|
||||
)
|
||||
|
||||
check_container_status() (
|
||||
local container_name="$1"
|
||||
local container_id
|
||||
container_id=$(docker-compose -f "$DEPLOYDIR/docker-compose.yml" ps -q "$container_name")
|
||||
|
||||
local start_moment
|
||||
local current_status
|
||||
start_moment=$(docker inspect "${container_id}" --format '{{ .State.StartedAt }}')
|
||||
current_status=$(docker inspect "${container_id}" --format '{{ .State.Health.Status }}')
|
||||
|
||||
case "$current_status" in
|
||||
starting)
|
||||
: # move on to the events check
|
||||
;;
|
||||
healthy)
|
||||
return 0
|
||||
;;
|
||||
unhealthy)
|
||||
echo "$ERR $container_name is already running but not healthy. status: $current_status"
|
||||
exit 1
|
||||
;;
|
||||
*)
|
||||
echo "$ERR $container_name is already running but its state is a mystery. status: $current_status"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
local status
|
||||
read -r status < <(docker events \
|
||||
--since "$start_moment" \
|
||||
--filter "container=$container_id" \
|
||||
--filter "event=health_status" \
|
||||
--format '{{.Status}}')
|
||||
|
||||
if [ "$status" != "health_status: healthy" ]; then
|
||||
echo "$ERR $container_name is not healthy. status: $status"
|
||||
exit 1
|
||||
fi
|
||||
)
|
||||
|
||||
generate_certificates() (
|
||||
mkdir -p "$STATEDIR/certs"
|
||||
|
||||
if [ ! -f "$STATEDIR/certs/ca.json" ]; then
|
||||
jq \
|
||||
'.
|
||||
| .names[0].L = $facility
|
||||
' \
|
||||
"$DEPLOYDIR/tls/ca.in.json" \
|
||||
--arg ip "$TINKERBELL_HOST_IP" \
|
||||
--arg facility "$FACILITY" \
|
||||
>"$STATEDIR/certs/ca.json"
|
||||
fi
|
||||
|
||||
if [ ! -f "$STATEDIR/certs/server-csr.json" ]; then
|
||||
jq \
|
||||
'.
|
||||
| .hosts += [ $ip, "tinkerbell.\($facility).packet.net" ]
|
||||
| .names[0].L = $facility
|
||||
| .hosts = (.hosts | sort | unique)
|
||||
' \
|
||||
"$DEPLOYDIR/tls/server-csr.in.json" \
|
||||
--arg ip "$TINKERBELL_HOST_IP" \
|
||||
--arg facility "$FACILITY" \
|
||||
>"$STATEDIR/certs/server-csr.json"
|
||||
fi
|
||||
|
||||
docker build --tag "tinkerbell-certs" "$DEPLOYDIR/tls"
|
||||
docker run --rm \
|
||||
--volume "$STATEDIR/certs:/certs" \
|
||||
--user "$UID:$(id -g)" \
|
||||
tinkerbell-certs
|
||||
|
||||
local certs_dir="/etc/docker/certs.d/$TINKERBELL_HOST_IP"
|
||||
|
||||
# copy public key to NGINX for workers
|
||||
if ! cmp --quiet "$STATEDIR"/certs/ca.pem "$STATEDIR/webroot/workflow/ca.pem"; then
|
||||
cp "$STATEDIR"/certs/ca.pem "$STATEDIR/webroot/workflow/ca.pem"
|
||||
fi
|
||||
|
||||
# update host to trust registry certificate
|
||||
if ! cmp --quiet "$STATEDIR/certs/ca.pem" "$certs_dir/tinkerbell.crt"; then
|
||||
if [ ! -d "$certs_dir/tinkerbell.crt" ]; then
|
||||
# The user will be told to create the directory
|
||||
# in the next block, if copying the certs there
|
||||
# fails.
|
||||
mkdir -p "$certs_dir" || true >/dev/null 2>&1
|
||||
fi
|
||||
if ! cp "$STATEDIR/certs/ca.pem" "$certs_dir/tinkerbell.crt"; then
|
||||
echo "$ERR please copy $STATEDIR/certs/ca.pem to $certs_dir/tinkerbell.crt"
|
||||
echo "$BLANK and run $0 again:"
|
||||
|
||||
if [ ! -d "$certs_dir" ]; then
|
||||
echo "sudo mkdir -p '$certs_dir'"
|
||||
fi
|
||||
echo "sudo cp '$STATEDIR/certs/ca.pem' '$certs_dir/tinkerbell.crt'"
|
||||
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
)
|
||||
|
||||
docker_login() (
|
||||
echo -n "$TINKERBELL_REGISTRY_PASSWORD" | docker login -u="$TINKERBELL_REGISTRY_USERNAME" --password-stdin "$TINKERBELL_HOST_IP"
|
||||
)
|
||||
|
||||
# This function takes an image specified as first parameter and it tags and
|
||||
# push it using the second one. useful to proxy images from a repository to
|
||||
# another.
|
||||
docker_mirror_image() (
|
||||
local from=$1
|
||||
local to=$2
|
||||
|
||||
docker pull "$from"
|
||||
docker tag "$from" "$to"
|
||||
docker push "$to"
|
||||
)
|
||||
|
||||
start_registry() (
|
||||
docker-compose -f "$DEPLOYDIR/docker-compose.yml" up --build -d registry
|
||||
check_container_status "registry"
|
||||
)
|
||||
|
||||
# This function supposes that the registry is up and running.
|
||||
# It configures with the required dependencies.
|
||||
bootstrap_docker_registry() (
|
||||
docker_login
|
||||
|
||||
# osie looks for tink-worker:latest, so we have to play with it a bit
|
||||
# https://github.com/tinkerbell/osie/blob/master/apps/workflow-helper.sh#L66
|
||||
docker_mirror_image "quay.io/tinkerbell/tink-worker:sha-adb49da" "${TINKERBELL_HOST_IP}/tink-worker:latest"
|
||||
)
|
||||
|
||||
setup_docker_registry() (
|
||||
local registry_images="$STATEDIR/registry"
|
||||
if [ ! -d "$registry_images" ]; then
|
||||
mkdir -p "$registry_images"
|
||||
fi
|
||||
start_registry
|
||||
bootstrap_docker_registry
|
||||
)
|
||||
|
||||
start_components() (
|
||||
local components=(db hegel tink-server boots tink-cli nginx)
|
||||
for comp in "${components[@]}"; do
|
||||
docker-compose -f "$DEPLOYDIR/docker-compose.yml" up --build -d "$comp"
|
||||
sleep 3
|
||||
check_container_status "$comp"
|
||||
done
|
||||
)
|
||||
|
||||
command_exists() (
|
||||
command -v "$@" >/dev/null 2>&1
|
||||
)
|
||||
|
||||
check_command() (
|
||||
if command_exists "$1"; then
|
||||
echo "$BLANK Found prerequisite: $1"
|
||||
return 0
|
||||
else
|
||||
echo "$ERR Prerequisite command not installed: $1"
|
||||
return 1
|
||||
fi
|
||||
)
|
||||
|
||||
check_prerequisites() (
|
||||
distro=$1
|
||||
version=$2
|
||||
|
||||
echo "$INFO verifying prerequisites for $distro ($version)"
|
||||
failed=0
|
||||
check_command docker || failed=1
|
||||
check_command docker-compose || failed=1
|
||||
check_command ip || failed=1
|
||||
check_command jq || failed=1
|
||||
|
||||
strategy=$(identify_network_strategy "$distro" "$version")
|
||||
case "$strategy" in
|
||||
"setup_networking_netplan")
|
||||
check_command netplan || failed=1
|
||||
;;
|
||||
"setup_networking_ubuntu_legacy")
|
||||
check_command ifdown || failed=1
|
||||
check_command ifup || failed=1
|
||||
;;
|
||||
"setup_networking_centos")
|
||||
check_command ifdown || failed=1
|
||||
check_command ifup || failed=1
|
||||
;;
|
||||
"setup_networking_manually")
|
||||
echo "$WARN this script cannot automatically configure your network."
|
||||
;;
|
||||
*)
|
||||
echo "$ERR bug: unhandled network strategy: $strategy"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
if [ $failed -eq 1 ]; then
|
||||
echo "$ERR Prerequisites not met. Please install the missing commands and re-run $0."
|
||||
exit 1
|
||||
fi
|
||||
)
|
||||
|
||||
whats_next() (
|
||||
echo "$NEXT 1. Enter /vagrant/deploy and run: source ../envrc; docker-compose up -d"
|
||||
echo "$BLANK 2. Try executing your fist workflow."
|
||||
echo "$BLANK Follow the steps described in https://tinkerbell.org/examples/hello-world/ to say 'Hello World!' with a workflow."
|
||||
)
|
||||
|
||||
do_setup() (
|
||||
# perform some very rudimentary platform detection
|
||||
lsb_dist=$(get_distribution)
|
||||
lsb_version=$(get_distro_version)
|
||||
|
||||
echo "$INFO starting tinkerbell stack setup"
|
||||
check_prerequisites "$lsb_dist" "$lsb_version"
|
||||
|
||||
if [ ! -f "$ENV_FILE" ]; then
|
||||
echo "$ERR Run './generate-envrc.sh network-interface > \"$ENV_FILE\"' before continuing."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# shellcheck disable=SC1090
|
||||
source "$ENV_FILE"
|
||||
|
||||
setup_networking "$lsb_dist" "$lsb_version"
|
||||
|
||||
setup_osie
|
||||
generate_certificates
|
||||
setup_docker_registry
|
||||
|
||||
echo "$INFO tinkerbell stack setup completed successfully on $lsb_dist server"
|
||||
whats_next
|
||||
)
|
||||
|
||||
# wrapped up in a function so that we have some protection against only getting
|
||||
# half the file during "curl | sh"
|
||||
do_setup
|
||||
Loading…
Reference in New Issue