394 lines
14 KiB
Bash
394 lines
14 KiB
Bash
#!/bin/bash
|
|
#
|
|
# lib/magnum
|
|
# Functions to control the configuration and operation of the **magnum** service
|
|
|
|
# Dependencies:
|
|
#
|
|
# - ``functions`` file
|
|
# - ``DEST``, ``DATA_DIR``, ``STACK_USER`` must be defined
|
|
# - ``SERVICE_{TENANT_NAME|PASSWORD}`` must be defined
|
|
|
|
# ``stack.sh`` calls the entry points in this order:
|
|
#
|
|
# - install_magnum
|
|
# - configure_magnum
|
|
# - create_magnum_conf
|
|
# - init_magnum
|
|
# - magnum_register_image
|
|
# - magnum_configure_flavor
|
|
# - start_magnum
|
|
# - configure_iptables_magnum
|
|
# - configure_apache_magnum
|
|
# - stop_magnum
|
|
# - cleanup_magnum
|
|
|
|
# Save trace setting
|
|
XTRACE=$(set +o | grep xtrace)
|
|
set +o xtrace
|
|
|
|
|
|
# Defaults
|
|
# --------
|
|
|
|
# Set up default directories
|
|
MAGNUM_REPO=${MAGNUM_REPO:-${GIT_BASE}/openstack/magnum.git}
|
|
MAGNUM_BRANCH=${MAGNUM_BRANCH:-master}
|
|
MAGNUM_DIR=$DEST/magnum
|
|
|
|
GITREPO["python-magnumclient"]=${MAGNUMCLIENT_REPO:-${GIT_BASE}/openstack/python-magnumclient.git}
|
|
GITBRANCH["python-magnumclient"]=${MAGNUMCLIENT_BRANCH:-master}
|
|
GITDIR["python-magnumclient"]=$DEST/python-magnumclient
|
|
|
|
MAGNUM_STATE_PATH=${MAGNUM_STATE_PATH:=$DATA_DIR/magnum}
|
|
MAGNUM_AUTH_CACHE_DIR=${MAGNUM_AUTH_CACHE_DIR:-/var/cache/magnum}
|
|
MAGNUM_CERTIFICATE_CACHE_DIR=${MAGNUM_CERTIFICATE_CACHE_DIR:-/var/lib/magnum/certificate-cache}
|
|
|
|
MAGNUM_CONF_DIR=/etc/magnum
|
|
MAGNUM_CONF=$MAGNUM_CONF_DIR/magnum.conf
|
|
MAGNUM_API_PASTE=$MAGNUM_CONF_DIR/api-paste.ini
|
|
MAGNUM_K8S_KEYSTONE_AUTH_DEFAULT_POLICY=$MAGNUM_CONF_DIR/k8s_keystone_auth_default_policy.json
|
|
MAGNUM_POLICY=$MAGNUM_CONF_DIR/policy.yaml
|
|
|
|
if is_ssl_enabled_service "magnum" || is_service_enabled tls-proxy; then
|
|
MAGNUM_SERVICE_PROTOCOL="https"
|
|
fi
|
|
|
|
# Public facing bits
|
|
MAGNUM_SERVICE_HOST=${MAGNUM_SERVICE_HOST:-$HOST_IP}
|
|
MAGNUM_SERVICE_PORT=${MAGNUM_SERVICE_PORT:-9511}
|
|
MAGNUM_SERVICE_PORT_INT=${MAGNUM_SERVICE_PORT_INT:-19511}
|
|
MAGNUM_SERVICE_PROTOCOL=${MAGNUM_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
|
|
|
|
MAGNUM_TRUSTEE_DOMAIN_ADMIN_PASSWORD=${MAGNUM_TRUSTEE_DOMAIN_ADMIN_PASSWORD:-secret}
|
|
|
|
MAGNUM_SWIFT_REGISTRY_CONTAINER=${MAGNUM_SWIFT_REGISTRY_CONTAINER:-docker_registry}
|
|
|
|
# Support entry points installation of console scripts
|
|
if [[ -d $MAGNUM_DIR/bin ]]; then
|
|
MAGNUM_BIN_DIR=$MAGNUM_DIR/bin
|
|
else
|
|
MAGNUM_BIN_DIR=$(get_python_exec_prefix)
|
|
fi
|
|
|
|
MAGNUM_CONFIGURE_IPTABLES=${MAGNUM_CONFIGURE_IPTABLES:-True}
|
|
|
|
# Functions
|
|
# ---------
|
|
|
|
# Test if any magnum services are enabled
|
|
# is_magnum_enabled
|
|
function is_magnum_enabled {
|
|
[[ ,${ENABLED_SERVICES} =~ ,"magnum-" ]] && return 0
|
|
return 1
|
|
}
|
|
# cleanup_magnum() - Remove residual data files, anything left over from previous
|
|
# runs that a clean run would need to clean up
|
|
function cleanup_magnum {
|
|
echo noop
|
|
}
|
|
|
|
# configure_magnum() - Set config files, create data dirs, etc
|
|
function configure_magnum {
|
|
# Put config files in ``/etc/magnum`` for everyone to find
|
|
if [[ ! -d $MAGNUM_CONF_DIR ]]; then
|
|
sudo mkdir -p $MAGNUM_CONF_DIR
|
|
sudo chown $STACK_USER $MAGNUM_CONF_DIR
|
|
fi
|
|
|
|
# Rebuild the config file from scratch
|
|
create_magnum_conf
|
|
|
|
create_api_paste_conf
|
|
|
|
create_k8s_keystone_auth_default_poliy
|
|
}
|
|
|
|
# create_magnum_accounts() - Set up common required magnum accounts
|
|
#
|
|
# Project User Roles
|
|
# ------------------------------------------------------------------
|
|
# SERVICE_PROJECT_NAME magnum service
|
|
function create_magnum_accounts {
|
|
echo noop
|
|
}
|
|
|
|
# create_magnum_conf() - Create a new magnum.conf file
|
|
function create_magnum_conf {
|
|
|
|
# (Re)create ``magnum.conf``
|
|
rm -f $MAGNUM_CONF
|
|
HOSTNAME=`hostname`
|
|
iniset $MAGNUM_CONF DEFAULT debug "$ENABLE_DEBUG_LOG_LEVEL"
|
|
|
|
# Get rabbitmq password
|
|
MAGNUM_RABBITMQ_PASSWORD=$(get_data_from_secret magnum-rabbitmq openstack password)
|
|
MAGNUM_RABBITMQ_USERNAME=$(get_data_from_secret magnum-rabbitmq openstack username)
|
|
|
|
iniset $MAGNUM_CONF DEFAULT transport_url "rabbit://$MAGNUM_RABBITMQ_USERNAME:$MAGNUM_RABBITMQ_PASSWORD@rabbitmq-magnum:5672/"
|
|
iniset $MAGNUM_CONF DEFAULT host "$HOSTNAME"
|
|
|
|
# Get mysql password
|
|
MAGNUM_DATABASE_USER=$(get_data_from_secret magnum-mysql openstack USER)
|
|
MAGNUM_DATABASE_PASSWORD=$(get_data_from_secret magnum-mysql openstack PASSWORD)
|
|
MAGNUM_DATABASE_NAME=$(get_data_from_secret magnum-mysql openstack DATABASE)
|
|
iniset $MAGNUM_CONF database connection "mysql+pymysql://$MAGNUM_DATABASE_USER:$MAGNUM_DATABASE_PASSWORD@magnum-mysql/$MAGNUM_DATABASE_NAME?charset=utf8"
|
|
|
|
iniset $MAGNUM_CONF api host "$MAGNUM_SERVICE_HOST"
|
|
if is_service_enabled tls-proxy; then
|
|
iniset $MAGNUM_CONF api port "$MAGNUM_SERVICE_PORT_INT"
|
|
iniset $MAGNUM_CONF drivers verify_ca true
|
|
iniset $MAGNUM_CONF drivers openstack_ca_file $SSL_BUNDLE_FILE
|
|
else
|
|
iniset $MAGNUM_CONF api port "$MAGNUM_SERVICE_PORT"
|
|
iniset $MAGNUM_CONF drivers verify_ca false
|
|
fi
|
|
|
|
iniset $MAGNUM_CONF cluster temp_cache_dir $MAGNUM_CERTIFICATE_CACHE_DIR
|
|
|
|
iniset $MAGNUM_CONF oslo_policy policy_file $MAGNUM_POLICY
|
|
|
|
# FIXME(pauloewerton): keystone_authtoken section is deprecated. Remove it
|
|
# after deprecation period.
|
|
kubernetes_ensure_resource secret/magnum-application-credential
|
|
MAGNUM_APPLICATION_CREDENTIAL_SECRET=$(get_data_from_secret magnum-application-credential openstack secret)
|
|
MAGNUM_APPLICATION_CREDENTIAL_ID=$(get_data_from_secret magnum-application-credential openstack id)
|
|
iniset $MAGNUM_CONF keystone_authtoken auth_url $KEYSTONE_SERVICE_URI
|
|
iniset $MAGNUM_CONF keystone_authtoken auth_type v3applicationcredential
|
|
iniset $MAGNUM_CONF keystone_authtoken application_credential_id $MAGNUM_APPLICATION_CREDENTIAL_ID
|
|
iniset $MAGNUM_CONF keystone_authtoken application_credential_secret $MAGNUM_APPLICATION_CREDENTIAL_SECRET
|
|
|
|
iniset $MAGNUM_CONF keystone_authtoken memcached_servers "mcrouter-memcached-magnum:11211"
|
|
if is_fedora || is_suse; then
|
|
# magnum defaults to /usr/local/bin, but fedora and suse pip like to
|
|
# install things in /usr/bin
|
|
iniset $MAGNUM_CONF DEFAULT bindir "/usr/bin"
|
|
fi
|
|
|
|
if [ -n "$MAGNUM_STATE_PATH" ]; then
|
|
iniset $MAGNUM_CONF DEFAULT state_path "$MAGNUM_STATE_PATH"
|
|
iniset $MAGNUM_CONF oslo_concurrency lock_path "$MAGNUM_STATE_PATH"
|
|
fi
|
|
|
|
if [ "$USE_SYSTEMD" != "False" ]; then
|
|
setup_systemd_logging $MAGNUM_CONF
|
|
fi
|
|
|
|
# Format logging
|
|
if [ "$LOG_COLOR" == "True" ] && [ "$USE_SYSTEMD" == "False" ]; then
|
|
setup_colorized_logging $MAGNUM_CONF DEFAULT
|
|
fi
|
|
|
|
# Register SSL certificates if provided
|
|
if is_ssl_enabled_service magnum; then
|
|
ensure_certificates MAGNUM
|
|
|
|
iniset $MAGNUM_CONF DEFAULT ssl_cert_file "$MAGNUM_SSL_CERT"
|
|
iniset $MAGNUM_CONF DEFAULT ssl_key_file "$MAGNUM_SSL_KEY"
|
|
|
|
iniset $MAGNUM_CONF DEFAULT enabled_ssl_apis "$MAGNUM_ENABLED_APIS"
|
|
fi
|
|
|
|
if is_service_enabled ceilometer; then
|
|
iniset $MAGNUM_CONF oslo_messaging_notifications driver "messaging"
|
|
fi
|
|
|
|
if is_service_enabled barbican; then
|
|
iniset $MAGNUM_CONF certificates cert_manager_type "barbican"
|
|
else
|
|
iniset $MAGNUM_CONF certificates cert_manager_type "x509keypair"
|
|
fi
|
|
|
|
trustee_domain_id=$(get_or_create_domain magnum 'Owns users and projects created by magnum')
|
|
trustee_domain_admin_id=$(get_or_create_user trustee_domain_admin $MAGNUM_TRUSTEE_DOMAIN_ADMIN_PASSWORD $trustee_domain_id)
|
|
openstack --os-auth-url $KEYSTONE_SERVICE_URI_V3 \
|
|
--os-identity-api-version 3 role add \
|
|
--user $trustee_domain_admin_id --domain $trustee_domain_id \
|
|
admin
|
|
iniset $MAGNUM_CONF trust cluster_user_trust True
|
|
iniset $MAGNUM_CONF trust trustee_domain_name magnum
|
|
iniset $MAGNUM_CONF trust trustee_domain_admin_name trustee_domain_admin
|
|
iniset $MAGNUM_CONF trust trustee_domain_admin_password $MAGNUM_TRUSTEE_DOMAIN_ADMIN_PASSWORD
|
|
iniset $MAGNUM_CONF trust trustee_keystone_interface public
|
|
iniset $MAGNUM_CONF cinder_client region_name $REGION_NAME
|
|
|
|
if is_service_enabled swift; then
|
|
iniset $MAGNUM_CONF docker_registry swift_region $REGION_NAME
|
|
iniset $MAGNUM_CONF docker_registry swift_registry_container $MAGNUM_SWIFT_REGISTRY_CONTAINER
|
|
fi
|
|
|
|
# Get the default volume type from cinder.conf and set the coresponding
|
|
# default in magnum.conf
|
|
default_volume_type=$(iniget /etc/cinder/cinder.conf DEFAULT default_volume_type)
|
|
iniset $MAGNUM_CONF cinder default_docker_volume_type $default_volume_type
|
|
iniset $MAGNUM_CONF drivers send_cluster_metrics False
|
|
|
|
iniset $MAGNUM_CONF kubernetes keystone_auth_default_policy $MAGNUM_K8S_KEYSTONE_AUTH_DEFAULT_POLICY
|
|
}
|
|
|
|
function create_api_paste_conf {
|
|
# copy api_paste.ini
|
|
cp $MAGNUM_DIR/etc/magnum/api-paste.ini $MAGNUM_API_PASTE
|
|
}
|
|
|
|
function create_k8s_keystone_auth_default_poliy {
|
|
cp $MAGNUM_DIR/etc/magnum/keystone_auth_default_policy.sample $MAGNUM_K8S_KEYSTONE_AUTH_DEFAULT_POLICY
|
|
}
|
|
|
|
# create_magnum_cache_dir() - Part of the init_magnum() process
|
|
function create_magnum_cache_dir {
|
|
# Create cache dir
|
|
sudo mkdir -p $1
|
|
sudo chown $STACK_USER $1
|
|
rm -f $1/*
|
|
}
|
|
|
|
|
|
# init_magnum()
|
|
function init_magnum {
|
|
kubectl create secret generic magnum-config --from-file=/etc/magnum/magnum.conf --from-file=/etc/magnum/api-paste.ini -n openstack
|
|
|
|
# NOTE: Permissions here are bad but it's temporary so we don't care as much.
|
|
sudo chmod -Rv 777 /etc/magnum
|
|
}
|
|
|
|
# magnum_register_image - Register heat image for magnum with property os_distro
|
|
function magnum_register_image {
|
|
local magnum_image_property="--property os_distro="
|
|
|
|
local atomic="$(echo $MAGNUM_GUEST_IMAGE_URL | grep -io 'atomic' || true;)"
|
|
if [ ! -z "$atomic" ]; then
|
|
magnum_image_property=$magnum_image_property"fedora-atomic --property hw_rng_model=virtio"
|
|
fi
|
|
local ubuntu="$(echo $MAGNUM_GUEST_IMAGE_URL | grep -io "ubuntu" || true;)"
|
|
if [ ! -z "$ubuntu" ]; then
|
|
magnum_image_property=$magnum_image_property"ubuntu"
|
|
fi
|
|
local coreos="$(echo $MAGNUM_GUEST_IMAGE_URL | grep -io "^coreos" || true;)"
|
|
if [ ! -z "$coreos" ]; then
|
|
magnum_image_property=$magnum_image_property"coreos"
|
|
fi
|
|
local fedora_coreos="$(echo $MAGNUM_GUEST_IMAGE_URL | grep -io "fedora-coreos" || true;)"
|
|
if [ ! -z "$fedora_coreos" ]; then
|
|
magnum_image_property=$magnum_image_property"fedora-coreos"
|
|
fi
|
|
# os_distro property for fedora ironic image
|
|
local fedora_ironic="$(echo $MAGNUM_GUEST_IMAGE_URL | grep -i "ironic" \
|
|
| grep -io "fedora" || true;)"
|
|
if [ ! -z "$fedora_ironic" ]; then
|
|
magnum_image_property=$magnum_image_property"fedora"
|
|
fi
|
|
|
|
# get the image name
|
|
local image_filename=$(basename "$MAGNUM_GUEST_IMAGE_URL")
|
|
local image_name=""
|
|
for extension in "tgz" "img" "qcow2" "iso" "vhd" "vhdx" "tar.gz" "img.gz" "img.bz2" "vhd.gz" "vhdx.gz" "qcow2.xz"
|
|
do
|
|
if [ $(expr match "${image_filename}" ".*\.${extension}$") -ne 0 ]; then
|
|
image_name=$(basename "$image_filename" ".${extension}")
|
|
break
|
|
fi
|
|
done
|
|
if [ -z ${image_name} ]; then
|
|
echo "Unknown image extension in $image_filename, supported extensions: tgz, img, qcow2, iso, vhd, vhdx, tar.gz, img.gz, img.bz2, vhd.gz, vhdx.gz, qcow2.xz"; false
|
|
fi
|
|
|
|
openstack image set $image_name $magnum_image_property
|
|
}
|
|
|
|
#magnum_configure_flavor - set hw_rng property for flavor to address the potential entropy issue
|
|
function magnum_configure_flavor {
|
|
local magnum_flavor_property="--property hw_rng:allowed=True --property hw_rng:rate_bytes=1024 --property hw_rng:rate_period=1"
|
|
|
|
local FLAVOR_LIST=$(openstack flavor list -c Name -f value)
|
|
for flavor in ${FLAVOR_LIST}; do
|
|
openstack flavor set $flavor $magnum_flavor_property
|
|
done
|
|
}
|
|
|
|
# install_magnumclient() - Collect source and prepare
|
|
function install_magnumclient {
|
|
pip_install "python-magnumclient"
|
|
}
|
|
|
|
# install_magnum() - Collect source and prepare
|
|
function install_magnum {
|
|
echo noop
|
|
}
|
|
|
|
# configure_iptables_magnum() - Configure the IP table rules for Magnum
|
|
function configure_iptables_magnum {
|
|
if [ "$MAGNUM_CONFIGURE_IPTABLES" != "False" ]; then
|
|
ROUTE_TO_INTERNET=$(ip route get 8.8.8.8)
|
|
OBOUND_DEV=$(echo ${ROUTE_TO_INTERNET#*dev} | awk '{print $1}')
|
|
sudo iptables -t nat -A POSTROUTING -o $OBOUND_DEV -j MASQUERADE
|
|
# bay nodes will access magnum-api (port $MAGNUM_SERVICE_PORT) to get CA certificate.
|
|
sudo iptables -I INPUT -d $HOST_IP -p tcp --dport $MAGNUM_SERVICE_PORT -j ACCEPT || true
|
|
# allow access to keystone etc (http and https)
|
|
sudo iptables -I INPUT -d $HOST_IP -p tcp --dport 80 -j ACCEPT || true
|
|
sudo iptables -I INPUT -d $HOST_IP -p tcp --dport 443 -j ACCEPT || true
|
|
fi
|
|
}
|
|
|
|
|
|
function configure_apache_magnum {
|
|
# Set redirection for kubernetes openstack cloud provider
|
|
# FIXME: When [1] is in kubernetes, we won't need the redirection anymore.
|
|
# [1] https://github.com/gophercloud/gophercloud/pull/423
|
|
HTACCESS_PATH=/var/www/html
|
|
if is_ubuntu; then
|
|
OVERRIDE_CONF_FILE=/etc/apache2/apache2.conf
|
|
elif is_fedora; then
|
|
OVERRIDE_CONF_FILE=/etc/httpd/conf/httpd.conf
|
|
fi
|
|
# If horizon is enabled then we need
|
|
if is_service_enabled horizon; then
|
|
HTACCESS_PATH=$DEST/horizon/.blackhole
|
|
sudo tee -a $APACHE_CONF_DIR/horizon.conf <<EOF
|
|
<Directory $HTACCESS_PATH>
|
|
Options Indexes FollowSymLinks
|
|
AllowOverride all
|
|
Require all granted
|
|
</Directory>
|
|
EOF
|
|
else
|
|
sudo tee -a $OVERRIDE_CONF_FILE <<EOF
|
|
<Directory $HTACCESS_PATH>
|
|
Options Indexes FollowSymLinks
|
|
AllowOverride all
|
|
Require all granted
|
|
</Directory>
|
|
EOF
|
|
fi
|
|
|
|
sudo mkdir -p $HTACCESS_PATH
|
|
sudo tee $HTACCESS_PATH/.htaccess <<EOF
|
|
RewriteEngine on
|
|
RewriteRule ^v2\.0(.*) /identity/v2.0\$1
|
|
RewriteRule ^v3(.*) /identity/v3\$1
|
|
EOF
|
|
enable_apache_mod rewrite
|
|
}
|
|
|
|
|
|
# start_magnum() - Start running processes, including screen
|
|
function start_magnum {
|
|
|
|
kubernetes_rollout_restart daemonset/magnum-api
|
|
kubernetes_rollout_restart daemonset/magnum-conductor
|
|
|
|
kubernetes_rollout_status daemonset/magnum-api
|
|
kubernetes_rollout_status daemonset/magnum-conductor
|
|
|
|
proxy_pass_to_kubernetes /magnum-api magnum-api magnum-api-wsgi
|
|
}
|
|
|
|
# stop_magnum() - Stop running processes (non-screen)
|
|
function stop_magnum {
|
|
echo noop
|
|
}
|
|
|
|
|
|
# Restore xtrace
|
|
$XTRACE
|