6b841fee7c
Only 2 main Vagrant calls are now needed (`vagrant up` and `vagrant up machine1`). This PR only updates the Vagrant Virtualbox setup. The Vagrant Libvirt and Terraform still need to be updated. This uses docker-compose as the entry point for standing up the stack and makes the stand-up of the sandbox more portal. Vagrant and Terraform are only responsible for standing up infrastructure and then running docker-compose, not for running any glue scripts. The docker-compose calls out to single-shot services to do all the glue required to get the fully functional Tinkerbell stack up and running. All the single-shot services are idempotent. This increases portability and the development iteration loop. This also simplifies the required steps needed to get a fully functioning sandbox up and running. This is intended to help people looking to get started by getting them to a provisioned machine quicker and more easily. Signed-off-by: Jacob Weinstock <jakobweinstock@gmail.com>
48 lines
1.3 KiB
Bash
Executable File
48 lines
1.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
set -xo pipefail
|
|
|
|
# update_csr will add the sans_ip to the csr
|
|
update_csr() {
|
|
local sans_ip="$1"
|
|
local csr_file="$2"
|
|
sed -i "/\"hosts\".*/a \ \"${sans_ip}\"," "${csr_file}"
|
|
}
|
|
|
|
# cleanup will remove unneeded files
|
|
cleanup() {
|
|
rm -rf ca-key.pem ca.csr ca.pem server.csr server.pem
|
|
}
|
|
|
|
# gen will generate the key and bundle
|
|
gen() {
|
|
local bundle_destination="$1"
|
|
local key_destination="$2"
|
|
cfssl gencert -initca /code/tls/csr.json | cfssljson -bare ca -
|
|
cfssl gencert -config /code/tls/ca-config.json -ca ca.pem -ca-key ca-key.pem -profile server /code/tls/csr.json | cfssljson -bare server
|
|
cat server.pem ca.pem >"${bundle_destination}"
|
|
mv server-key.pem "${key_destination}"
|
|
}
|
|
|
|
# main orchestrates the process
|
|
main() {
|
|
local sans_ip="$1"
|
|
local csr_file="/code/tls/csr.json"
|
|
local bundle_file="/certs/${FACILITY:-onprem}/bundle.pem"
|
|
local server_key_file="/certs/${FACILITY:-onprem}/server-key.pem"
|
|
|
|
if ! grep -q "${sans_ip}" "${csr_file}"; then
|
|
update_csr "${sans_ip}" "${csr_file}"
|
|
else
|
|
echo "IP ${sans_ip} already in ${csr_file}"
|
|
fi
|
|
if [ ! -f "${bundle_file}" ] && [ ! -f "${server_key_file}" ]; then
|
|
gen "${bundle_file}" "${server_key_file}"
|
|
else
|
|
echo "Files [${bundle_file}, ${server_key_file}] already exist"
|
|
fi
|
|
cleanup
|
|
}
|
|
|
|
main "$1"
|