deploy/metal3-vm/02_configure_host.sh

   1 #!/usr/bin/env bash
   2 set -eux -o pipefail
   3
   4 # shellcheck disable=SC1091
   5 source lib/logging.sh
   6 # shellcheck disable=SC1091
   7 source lib/common.sh
   8
   9 # Generate user ssh key
  10 if [ ! -f "$HOME/.ssh/id_rsa.pub" ]; then
  11     ssh-keygen -f ~/.ssh/id_rsa -P ""
  12 fi
  13
  14 # root needs a private key to talk to libvirt
  15 # See tripleo-quickstart-config/roles/virtbmc/tasks/configure-vbmc.yml
  16 if sudo [ ! -f /root/.ssh/id_rsa_virt_power ]; then
  17   sudo ssh-keygen -f /root/.ssh/id_rsa_virt_power -P ""
  18   sudo cat /root/.ssh/id_rsa_virt_power.pub | sudo tee -a /root/.ssh/authorized_keys
  19 fi
  20
  21 ANSIBLE_FORCE_COLOR=true ansible-playbook \
  22     -e "working_dir=$WORKING_DIR" \
  23     -e "num_masters=$NUM_MASTERS" \
  24     -e "num_workers=$NUM_WORKERS" \
  25     -e "extradisks=$VM_EXTRADISKS" \
  26     -e "virthost=$HOSTNAME" \
  27     -e "platform=$NODES_PLATFORM" \
  28     -e "manage_baremetal=$MANAGE_BR_BRIDGE" \
  29     -i vm-setup/inventory.ini \
  30     -b -vvv vm-setup/setup-playbook.yml
  31
  32 # Allow local non-root-user access to libvirt
  33 # Restart libvirtd service to get the new group membership loaded
  34 if ! id "$USER" | grep -q libvirt; then
  35   sudo usermod -a -G "libvirt" "$USER"
  36   sudo systemctl restart libvirtd
  37 fi
  38 # Usually virt-manager/virt-install creates this: https://www.redhat.com/archives/libvir-list/2008-August/msg00179.html
  39 if ! virsh pool-uuid default > /dev/null 2>&1 ; then
  40     virsh pool-define /dev/stdin <<EOF
  41 <pool type='dir'>
  42   <name>default</name>
  43   <target>
  44     <path>/var/lib/libvirt/images</path>
  45   </target>
  46 </pool>
  47 EOF
  48     virsh pool-start default
  49     virsh pool-autostart default
  50 fi
  51
  52 if [[ $OS == ubuntu ]]; then
  53   # source ubuntu_bridge_network_configuration.sh
  54   # shellcheck disable=SC1091
  55   source ubuntu_bridge_network_configuration.sh
  56   # shellcheck disable=SC1091
  57   source disable_apparmor_driver_libvirtd.sh
  58 else
  59   if [ "$MANAGE_PRO_BRIDGE" == "y" ]; then
  60       # Adding an IP address in the libvirt definition for this network results in
  61       # dnsmasq being run, we don't want that as we have our own dnsmasq, so set
  62       # the IP address here
  63       if [ ! -e /etc/sysconfig/network-scripts/ifcfg-provisioning ] ; then
  64           echo -e "DEVICE=provisioning\nTYPE=Bridge\nONBOOT=yes\nNM_CONTROLLED=no\nBOOTPROTO=static\nIPADDR=172.22.0.1\nNETMASK=255.255.255.0" | sudo dd of=/etc/sysconfig/network-scripts/ifcfg-provisioning
  65       fi
  66       sudo ifdown provisioning || true
  67       sudo ifup provisioning
  68
  69       # Need to pass the provision interface for bare metal
  70       if [ "$PRO_IF" ]; then
  71           echo -e "DEVICE=$PRO_IF\nTYPE=Ethernet\nONBOOT=yes\nNM_CONTROLLED=no\nBRIDGE=provisioning" | sudo dd of="/etc/sysconfig/network-scripts/ifcfg-$PRO_IF"
  72           sudo ifdown "$PRO_IF" || true
  73           sudo ifup "$PRO_IF"
  74       fi
  75   fi
  76
  77   if [ "$MANAGE_INT_BRIDGE" == "y" ]; then
  78       # Create the baremetal bridge
  79       if [ ! -e /etc/sysconfig/network-scripts/ifcfg-baremetal ] ; then
  80           echo -e "DEVICE=baremetal\nTYPE=Bridge\nONBOOT=yes\nNM_CONTROLLED=no" | sudo dd of=/etc/sysconfig/network-scripts/ifcfg-baremetal
  81       fi
  82       sudo ifdown baremetal || true
  83       sudo ifup baremetal
  84
  85       # Add the internal interface to it if requests, this may also be the interface providing
  86       # external access so we need to make sure we maintain dhcp config if its available
  87       if [ "$INT_IF" ]; then
  88           echo -e "DEVICE=$INT_IF\nTYPE=Ethernet\nONBOOT=yes\nNM_CONTROLLED=no\nBRIDGE=baremetal" | sudo dd of="/etc/sysconfig/network-scripts/ifcfg-$INT_IF"
  89           if sudo nmap --script broadcast-dhcp-discover -e "$INT_IF" | grep "IP Offered" ; then
  90               echo -e "\nBOOTPROTO=dhcp\n" | sudo tee -a /etc/sysconfig/network-scripts/ifcfg-baremetal
  91               sudo systemctl restart network
  92           else
  93              sudo systemctl restart network
  94           fi
  95       fi
  96   fi
  97
  98   # restart the libvirt network so it applies an ip to the bridge
  99   if [ "$MANAGE_BR_BRIDGE" == "y" ] ; then
 100       sudo virsh net-destroy baremetal
 101       sudo virsh net-start baremetal
 102       if [ "$INT_IF" ]; then #Need to bring UP the NIC after destroying the libvirt network
 103           sudo ifup "$INT_IF"
 104       fi
 105   fi
 106 fi
 107
 108 # Add firewall rules to ensure the IPA ramdisk can reach httpd, Ironic and the Inspector API on the host
 109 for port in 80 5050 6385 ; do
 110     if ! sudo iptables -C INPUT -i provisioning -p tcp -m tcp --dport $port -j ACCEPT > /dev/null 2>&1; then
 111         sudo iptables -I INPUT -i provisioning -p tcp -m tcp --dport $port -j ACCEPT
 112     fi
 113 done
 114
 115 # Allow ipmi to the virtual bmc processes that we just started
 116 if ! sudo iptables -C INPUT -i baremetal -p udp -m udp --dport 6230:6235 -j ACCEPT 2>/dev/null ; then
 117     sudo iptables -I INPUT -i baremetal -p udp -m udp --dport 6230:6235 -j ACCEPT
 118 fi
 119
 120 #Allow access to dhcp and tftp server for pxeboot
 121 for port in 67 69 ; do
 122     if ! sudo iptables -C INPUT -i provisioning -p udp --dport $port -j ACCEPT 2>/dev/null ; then
 123         sudo iptables -I INPUT -i provisioning -p udp --dport $port -j ACCEPT
 124     fi
 125 done
 126
 127 # Need to route traffic from the provisioning host.
 128 if [ "$EXT_IF" ]; then
 129   sudo iptables -t nat -A POSTROUTING --out-interface "$EXT_IF" -j MASQUERADE
 130   sudo iptables -A FORWARD --in-interface baremetal -j ACCEPT
 131 fi
 132
 133 # Switch NetworkManager to internal DNS
 134
 135 if [[ "$MANAGE_BR_BRIDGE" == "y" && $OS == "centos" ]] ; then
 136   sudo mkdir -p /etc/NetworkManager/conf.d/
 137   sudo crudini --set /etc/NetworkManager/conf.d/dnsmasq.conf main dns dnsmasq
 138   if [ "$ADDN_DNS" ] ; then
 139     echo "server=$ADDN_DNS" | sudo tee /etc/NetworkManager/dnsmasq.d/upstream.conf
 140   fi
 141   if systemctl is-active --quiet NetworkManager; then
 142     sudo systemctl reload NetworkManager
 143   else
 144     sudo systemctl restart NetworkManager
 145   fi
 146 fi
 147
 148 for name in ironic ironic-inspector dnsmasq httpd mariadb ipa-downloader; do
 149     sudo "${CONTAINER_RUNTIME}" ps | grep -w "$name$" && sudo "${CONTAINER_RUNTIME}" kill $name
 150     sudo "${CONTAINER_RUNTIME}" ps --all | grep -w "$name$" && sudo "${CONTAINER_RUNTIME}" rm $name -f
 151 done
 152 rm -rf "$IRONIC_DATA_DIR"
 153
 154 mkdir -p "$IRONIC_DATA_DIR/html/images"
 155 pushd "$IRONIC_DATA_DIR/html/images"
 156 BM_IMAGE=${BM_IMAGE:-"bionic-server-cloudimg-amd64.img"}
 157 BM_IMAGE_URL=${BM_IMAGE_URL:-"https://cloud-images.ubuntu.com/bionic/current/bionic-server-cloudimg-amd64.img"}
 158 if [ ! -f ${BM_IMAGE} ] ; then
 159     curl -o ${BM_IMAGE} --insecure --compressed -O -L ${BM_IMAGE_URL}
 160     md5sum ${BM_IMAGE} | awk '{print $1}' > ${BM_IMAGE}.md5sum
 161 fi
 162 popd
 163
 164 for IMAGE_VAR in IRONIC_IMAGE IRONIC_INSPECTOR_IMAGE IPA_DOWNLOADER_IMAGE; do
 165     IMAGE=${!IMAGE_VAR}
 166     sudo "${CONTAINER_RUNTIME}" pull "$IMAGE"
 167 done
 168
 169 # set password for mariadb
 170 mariadb_password="$(echo "$(date;hostname)"|sha256sum |cut -c-20)"
 171
 172 if [[ "${CONTAINER_RUNTIME}" == "podman" ]]; then
 173   # Remove existing pod
 174   if  sudo "${CONTAINER_RUNTIME}" pod exists ironic-pod ; then
 175       sudo "${CONTAINER_RUNTIME}" pod rm ironic-pod -f
 176   fi
 177   # Create pod
 178   sudo "${CONTAINER_RUNTIME}" pod create -n ironic-pod
 179   POD_NAME="--pod ironic-pod"
 180 else
 181   POD_NAME=""
 182 fi
 183
 184 cat <<EOF > ${PWD}/ironic.env
 185 PROVISIONING_INTERFACE=provisioning
 186 DHCP_RANGE=172.22.0.10,172.22.0.100
 187 IPA_BASEURI=https://images.rdoproject.org/train/rdo_trunk/current-tripleo
 188 DEPLOY_KERNEL_URL=http://172.22.0.1/images/ironic-python-agent.kernel
 189 DEPLOY_RAMDISK_URL=http://172.22.0.1/images/ironic-python-agent.initramfs
 190 IRONIC_ENDPOINT=http://172.22.0.1:6385/v1/
 191 IRONIC_INSPECTOR_ENDPOINT=http://172.22.0.1:5050/v1/
 192 CACHEURL=http://172.22.0.1/images
 193 IRONIC_FAST_TRACK=false
 194 EOF
 195
 196 # Start image downloader container
 197 sudo "${CONTAINER_RUNTIME}" run -d --net host --privileged --name ipa-downloader \
 198     --env-file "${PWD}/ironic.env" \
 199     -v "$IRONIC_DATA_DIR:/shared" "${IPA_DOWNLOADER_IMAGE}" /usr/local/bin/get-resource.sh
 200
 201 sudo "${CONTAINER_RUNTIME}" wait ipa-downloader
 202
 203 if [ ! -e "$IRONIC_DATA_DIR/html/images/ironic-python-agent.kernel" ] ||
 204    [ ! -e "$IRONIC_DATA_DIR/html/images/ironic-python-agent.initramfs" ]; then
 205     echo "Failed to get ironic-python-agent"
 206     exit 1
 207 fi
 208
 209 # Start dnsmasq, http, mariadb, and ironic containers using same image
 210 # See this file for env vars you can set, like IP, DHCP_RANGE, INTERFACE
 211 sudo "${CONTAINER_RUNTIME}" run -d --net host --privileged --name dnsmasq \
 212     --env-file "${PWD}/ironic.env" \
 213     -v "$IRONIC_DATA_DIR:/shared" --entrypoint /bin/rundnsmasq "${IRONIC_IMAGE}"
 214
 215 # For available env vars, see:
 216 sudo "${CONTAINER_RUNTIME}" run -d --net host --privileged --name httpd \
 217     --env-file "${PWD}/ironic.env" \
 218     -v "$IRONIC_DATA_DIR:/shared" --entrypoint /bin/runhttpd "${IRONIC_IMAGE}"
 219
 220 # https://github.com/metal3-io/ironic/blob/master/runmariadb.sh
 221 sudo "${CONTAINER_RUNTIME}" run -d --net host --privileged --name mariadb \
 222     --env-file "${PWD}/ironic.env" \
 223     -v "$IRONIC_DATA_DIR:/shared" --entrypoint /bin/runmariadb \
 224     --env "MARIADB_PASSWORD=$mariadb_password" "${IRONIC_IMAGE}"
 225
 226 # See this file for additional env vars you may want to pass, like IP and INTERFACE
 227 sudo "${CONTAINER_RUNTIME}" run -d --net host --privileged --name ironic \
 228     --env-file "${PWD}/ironic.env" \
 229     --env "MARIADB_PASSWORD=$mariadb_password" \
 230     -v "$IRONIC_DATA_DIR:/shared" "${IRONIC_IMAGE}"
 231
 232 # Start Ironic Inspector
 233 sudo "${CONTAINER_RUNTIME}" run -d --net host --privileged --name ironic-inspector \
 234     --env-file "${PWD}/ironic.env" \
 235     -v "$IRONIC_DATA_DIR:/shared" "${IRONIC_INSPECTOR_IMAGE}"