FIX: More security hardening
[ta/infra-ansible.git] / infra-ansible.spec
1 # Copyright 2019 Nokia
2 #
3 # Licensed under the Apache License, Version 2.0 (the "License");
4 # you may not use this file except in compliance with the License.
5 # You may obtain a copy of the License at
6 #
7 #     http://www.apache.org/licenses/LICENSE-2.0
8 #
9 # Unless required by applicable law or agreed to in writing, software
10 # distributed under the License is distributed on an "AS IS" BASIS,
11 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 # See the License for the specific language governing permissions and
13 # limitations under the License.
14 #
15
16 Name:           infra-ansible
17 Version:        %{_version}
18 Release:        13%{?dist}
19 Summary:        Contains ansible playbook and roles for Akraino rec blueprint
20 License:        %{_platform_licence}
21 Source0:        %{name}-%{version}.tar.gz
22 Vendor:         %{_platform_vendor}
23
24 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
25
26 BuildArch:      noarch
27
28 %description
29 This RPM contains Contains ansible playbook and roles for Akraino rec blueprint
30
31 %prep
32 %autosetup
33
34 %install
35 mkdir -p %{buildroot}/root/dev_tools
36 cp dev_tools/* %{buildroot}/root/dev_tools
37
38 mkdir -p %{buildroot}%{_playbooks_path}
39 cp playbooks/* %{buildroot}%{_playbooks_path}
40
41 # mkdir -p %{buildroot}%{_inventory_path}
42 # cp -rf inventory/* %{buildroot}%{_inventory_path}
43
44 mkdir -p %{buildroot}%{_roles_path}
45 cp -rf roles/* %{buildroot}%{_roles_path}
46
47 mkdir -p %{buildroot}/%{_finalize_path}
48 ln -sf %{_playbooks_path}/removevips.yml                              %{buildroot}/%{_finalize_path}
49 ln -sf %{_playbooks_path}/monitoring.yml                              %{buildroot}/%{_finalize_path}
50 ln -sf %{_playbooks_path}/redissync.yml                               %{buildroot}/%{_finalize_path}
51 ln -sf %{_playbooks_path}/ansiblesync.yml                             %{buildroot}/%{_finalize_path}
52 ln -sf %{_playbooks_path}/redisconfig.yml                             %{buildroot}/%{_finalize_path}
53 ln -sf %{_playbooks_path}/cmserverconfig.yml                          %{buildroot}/%{_finalize_path}
54
55 mkdir -p %{buildroot}/%{_secrets_path}
56 cp secrets/* %{buildroot}/%{_secrets_path}
57
58 # Create links for the bootstrapping phase
59 mkdir -p %{buildroot}/%{_bootstrapping_path}
60 ln -sf %{_playbooks_path}/initial_poweroff_hosts.yml         %{buildroot}/%{_bootstrapping_path}
61 ln -sf %{_playbooks_path}/partfs_rootdisk_inst_cont.yml      %{buildroot}/%{_bootstrapping_path}
62 ln -sf %{_playbooks_path}/ntp-config.yml                     %{buildroot}/%{_bootstrapping_path}
63
64 # Create links for the provisioning phase
65 mkdir -p %{buildroot}/%{_provisioning_path}
66 ln -sf %{_playbooks_path}/baremetal-install.yml              %{buildroot}/%{_provisioning_path}
67 ln -sf %{_playbooks_path}/partfs_rootdisk.yml                %{buildroot}/%{_provisioning_path}
68 ln -sf %{_playbooks_path}/allocate-cpu-cores.yml             %{buildroot}/%{_provisioning_path}
69 ln -sf %{_playbooks_path}/sriov_nodes.yaml                   %{buildroot}/%{_provisioning_path}
70 ln -sf %{_playbooks_path}/sriovdp_config.yaml                %{buildroot}/%{_provisioning_path}
71 ln -sf %{_playbooks_path}/performance-kernel-cmdline-set.yml %{buildroot}/%{_provisioning_path}
72 ln -sf %{_playbooks_path}/performance_nodes.yaml             %{buildroot}/%{_provisioning_path}
73 ln -sf %{_playbooks_path}/baremetal-interface-config.yml     %{buildroot}/%{_provisioning_path}
74 ln -sf %{_playbooks_path}/ntp-config.yml                     %{buildroot}/%{_provisioning_path}
75 ln -sf %{_playbooks_path}/rpm-database.yml                   %{buildroot}/%{_provisioning_path}
76 ln -sf %{_playbooks_path}/single_node_storage.yml            %{buildroot}/%{_provisioning_path}
77 ln -sf %{_playbooks_path}/ceph-deploy.yml                    %{buildroot}/%{_provisioning_path}
78 ln -sf %{_playbooks_path}/baremetal-interface-config.yml     %{buildroot}/%{_provisioning_path}
79 ln -sf %{_playbooks_path}/ntp-check.yml                      %{buildroot}/%{_provisioning_path}
80
81 # Create links for the postconfig phase
82 mkdir -p %{buildroot}/%{_postconfig_path}
83 ln -sf %{_playbooks_path}/synchonize_ssh_keys.yml                     %{buildroot}/%{_postconfig_path}
84 ln -sf %{_playbooks_path}/distributed-state-server-file-plugin.yml    %{buildroot}/%{_postconfig_path}
85 ln -sf %{_playbooks_path}/distributed-state-server-etcd-plugin.yml    %{buildroot}/%{_postconfig_path}
86 ln -sf %{_playbooks_path}/distributed-state-server.yml                %{buildroot}/%{_postconfig_path}
87 ln -sf %{_playbooks_path}/etcdansible.yml                             %{buildroot}/%{_postconfig_path}
88 ln -sf %{_playbooks_path}/core-handling.yml                           %{buildroot}/%{_postconfig_path}
89 ln -sf %{_playbooks_path}/dbwatchdog.yml                              %{buildroot}/%{_postconfig_path}
90 ln -sf %{_playbooks_path}/access-management.yml                       %{buildroot}/%{_postconfig_path}
91 ln -sf %{_playbooks_path}/accounts.yml                                %{buildroot}/%{_postconfig_path}
92 ln -sf %{_playbooks_path}/adminuserfile.yml                           %{buildroot}/%{_postconfig_path}
93 ln -sf %{_playbooks_path}/ansibleldconfig.yml                         %{buildroot}/%{_postconfig_path}
94 ln -sf %{_playbooks_path}/bare_lvm_backend.yml                        %{buildroot}/%{_postconfig_path}
95 ln -sf %{_playbooks_path}/baremetal-interface-config-post.yml         %{buildroot}/%{_postconfig_path}
96 ln -sf %{_playbooks_path}/certificate_update.yml                      %{buildroot}/%{_postconfig_path}
97 ln -sf %{_playbooks_path}/core-handling.yml                           %{buildroot}/%{_postconfig_path}
98 ln -sf %{_playbooks_path}/create-bash-command-auth-conf.yml           %{buildroot}/%{_postconfig_path}
99 # keepalive ln -sf %{_playbooks_path}/dbwatchdog.yml                              %{buildroot}/%{_postconfig_path}
100 ln -sf %{_playbooks_path}/disable-old-node-rsyslog.yml                %{buildroot}/%{_postconfig_path}
101 ln -sf %{_playbooks_path}/enablecmagent.yml                           %{buildroot}/%{_postconfig_path}
102 ln -sf %{_playbooks_path}/haproxy-install.yml                         %{buildroot}/%{_postconfig_path}
103 ln -sf %{_playbooks_path}/ipv6-config.yml                             %{buildroot}/%{_postconfig_path}
104 ln -sf %{_playbooks_path}/motd.yml                                    %{buildroot}/%{_postconfig_path}
105 ln -sf %{_playbooks_path}/hostcli.yml                                 %{buildroot}/%{_postconfig_path}
106 ln -sf %{_playbooks_path}/oom.yml                                     %{buildroot}/%{_postconfig_path}
107 ln -sf %{_playbooks_path}/openssh_server_conf_hardening.yml           %{buildroot}/%{_postconfig_path}
108 ln -sf %{_playbooks_path}/openstack-ansible-log-dir.yml               %{buildroot}/%{_postconfig_path}
109 ln -sf %{_playbooks_path}/operation_system_hardening.yml              %{buildroot}/%{_postconfig_path}
110 ln -sf %{_playbooks_path}/restful.yml                                 %{buildroot}/%{_postconfig_path}
111 ln -sf %{_playbooks_path}/root-openstack-admin-credentials.yml        %{buildroot}/%{_postconfig_path}
112 ln -sf %{_playbooks_path}/service-profiles.yml                        %{buildroot}/%{_postconfig_path}
113 ln -sf %{_playbooks_path}/setup_audit.yml                             %{buildroot}/%{_postconfig_path}
114 ln -sf %{_playbooks_path}/setup_in_host_traffic_filtering.yml         %{buildroot}/%{_postconfig_path}
115 ln -sf %{_playbooks_path}/synchonize_ssh_keys.yml                     %{buildroot}/%{_postconfig_path}
116 ln -sf %{_playbooks_path}/systemd_services.yml                        %{buildroot}/%{_postconfig_path}
117 ln -sf %{_playbooks_path}/userskeyssync.yml                           %{buildroot}/%{_postconfig_path}
118 ln -sf %{_playbooks_path}/baremetal-interface-config-post.yml         %{buildroot}/%{_postconfig_path}
119
120 ln -sf %{_roles_path}/baremetal_interface_config/templates/os_net_config.j2 %{buildroot}%{_roles_path}/bootstrap-host/templates/os_net_config.j2
121 ln -sf /opt/config-encoder-macros %{buildroot}%{_roles_path}/access-management/templates/encoder
122
123 mkdir -p %{buildroot}/usr/lib/systemd/system/
124 cp systemd/finalize-bootstrap.service %{buildroot}/usr/lib/systemd/system/
125 cp systemd/sriov.service %{buildroot}/usr/lib/systemd/system
126 cp systemd/report-installation-success.service %{buildroot}/usr/lib/systemd/system
127
128 mkdir -p %{buildroot}/opt/ansible-change_kernel_cmdline/
129 cp systemd/finalize-bootstrap.sh %{buildroot}/opt/ansible-change_kernel_cmdline/
130
131 mkdir -p %{buildroot}/opt/sriov
132 cp systemd/sriov.sh %{buildroot}/opt/sriov
133
134 %files
135 %attr(0755,root,root) %{_playbooks_path}/report-installation-progress
136 %attr(0755,root,root) %{_playbooks_path}/report-installation-success.sh
137 %defattr(0644,root,root,0755)
138 /root/dev_tools
139 %{_playbooks_path}/*
140 # %{_inventory_path}/*
141 %{_roles_path}/*
142 %{_bootstrapping_path}/*
143 %{_provisioning_path}/*
144 %{_postconfig_path}/*
145 %{_finalize_path}/*
146 %{_secrets_path}/*
147 %attr(0755,root,root) /usr/lib/systemd/system/*
148 %attr(0755,root,root) /opt/ansible-change_kernel_cmdline/finalize-bootstrap.sh
149 %attr(0755,root,root) /opt/sriov/sriov.sh
150
151 %post
152 for role in /usr/share/ceph-ansible/roles/*; do
153   ln -sf $role /etc/ansible/roles/
154 done
155 mkdir -p /etc/ansible/roles/plugins/library
156 for module in /usr/share/ceph-ansible/library/*.py*; do
157   ln -sf $module /etc/ansible/roles/plugins/library
158 done
159 systemctl enable sriov
160
161 %preun
162
163 %postun
164
165 %clean
166 rm -rf ${buildroot}