From 32086f62131e1b813e2f3d97bc2c78f66c6a3154 Mon Sep 17 00:00:00 2001 From: Carlos Konstanski Date: Wed, 13 Dec 2017 18:54:21 -0700 Subject: adding files --- files/cloud.sh | 85 ++++++++++++++++++++++++++++++++++++++++++++ files/dns.sh | 48 +++++++++++++++++++++++++ files/flavor.sh | 17 +++++++++ files/image.sh | 17 +++++++++ files/instance.sh | 94 +++++++++++++++++++++++++++++++++++++++++++++++++ files/keypair.sh | 35 ++++++++++++++++++ files/logrotate_tomcat7 | 8 +++++ files/network.sh | 69 ++++++++++++++++++++++++++++++++++++ files/securitygroup.sh | 74 ++++++++++++++++++++++++++++++++++++++ 9 files changed, 447 insertions(+) create mode 100755 files/cloud.sh create mode 100755 files/dns.sh create mode 100755 files/flavor.sh create mode 100755 files/image.sh create mode 100755 files/instance.sh create mode 100755 files/keypair.sh create mode 100644 files/logrotate_tomcat7 create mode 100755 files/network.sh create mode 100755 files/securitygroup.sh (limited to 'files') diff --git a/files/cloud.sh b/files/cloud.sh new file mode 100755 index 0000000..a188204 --- /dev/null +++ b/files/cloud.sh @@ -0,0 +1,85 @@ +#!/bin/bash + +keypair_user="${1}" +pubkey_path="${2}" +dns_servers="${3}" + +if [ "${keypair_user}" == "" ]; then + echo "No keypair user was supplied." >&2 + exit 1 +elif [ "${pubkey_path}" == "" ]; then + echo "No pubkey path was supplied." >&2 + exit 1 +elif [ "${dns_servers}" == "" ]; then + echo "No dns servers supplied." >&2 + exit 1 +fi + +nameservers=$(for i in ${dns_servers}; do echo -n "'${i}',"; done) +nameservers="${nameservers::-1}" + +cat > "data/etc/cloud/cloud.cfg" <&2 + exit 1 +elif [ "${floating_ip}" == "" ]; then + echo "No floating IP supplied." >&2 + exit 1 +fi + +domain_id=$(designate domain-list 2>/dev/null | grep -F "cloud.twc.net" | awk '{print $2;}') +if [ "${domain_id}" == "" ]; then + echo -n "Could not find the domain. It must be created in Horizon " >&2 + echo -n "prior to running this playbook so that the project will " >&2 + echo "get correctly wired up to infoblox." >&2 + exit 1 +else + domain_name=$(designate domain-list 2>/dev/null | grep -F "cloud.twc.net" | awk '{print $4;}') + fqdn="${instance_name}.${domain_name}" +fi + +record_id=$(designate record-list ${domain_id} 2>/dev/null | grep -F "${fqdn}" | grep -F ' A ' | awk '{print $2;}') +if [ "${record_id}" == "" ]; then + designate record-create ${domain_id} --type A --name "${fqdn}" --data ${floating_ip} >/dev/null 2>&1 + record_id=$(designate record-list ${domain_id} 2>/dev/null | grep -F "${fqdn}" | grep -F ' A ' | awk '{print $2;}') + if [ "${record_id}" == "" ]; then + echo "No existing A record. Cannot create A record." >&2 + exit 1 + fi +else + target_ip=$(designate record-list ${domain_id} 2>/dev/null | grep -F "${fqdn}" | grep -F ' A ' | awk '{print $8;}') + if [ "${target_ip}" != "${floating_ip}" ]; then + designate record-delete ${domain_id} ${record_id} >/dev/null 2>&1 + designate record-create ${domain_id} --type A --name "${fqdn}" --data ${floating_ip} >/dev/null 2>&1 + record_id=$(designate record-list ${domain_id} 2>/dev/null |grep -F "${fqdn}" | grep -F ' A ' | awk '{print $2;}') + if [ "${record_id}" == "" ]; then + echo "Existing A record had wrong IP. Cannot create A record." >&2 + exit 1 + fi + fi +fi + +echo "${fqdn::-1}" + +exit 0 diff --git a/files/flavor.sh b/files/flavor.sh new file mode 100755 index 0000000..c391b18 --- /dev/null +++ b/files/flavor.sh @@ -0,0 +1,17 @@ +#!/bin/bash + +flavor_name="${1}" + +if [ "${flavor_name}" == "" ]; then + echo "No flavor name supplied." >&2 + exit 1 +fi + +flavor_id=$(nova flavor-list | grep -F "${flavor_name}" | awk '{print $2;}') +if [ "${flavor_id}" == "" ]; then + echo -n "Cannot retrieve a flavor ID corresponding to the name: " >&2 + echo "${flavor_name}" >&2 + exit 1 +fi + +exit 0 diff --git a/files/image.sh b/files/image.sh new file mode 100755 index 0000000..fd694cd --- /dev/null +++ b/files/image.sh @@ -0,0 +1,17 @@ +#!/bin/bash + +image_name="${1}" + +if [ "${image_name}" == "" ]; then + echo "No image name supplied." >&2 + exit 1 +fi + +image_id=$(openstack image list --limit 1000 --public 2>/dev/null | grep -F " ${image_name} " | awk '{print $2;}') +if [ "${image_id}" == "" ]; then + echo -n "Cannot retrieve an image ID corresponding to the name: " >&2 + echo "${image_name}" >&2 + exit 1 +fi + +exit 0 diff --git a/files/instance.sh b/files/instance.sh new file mode 100755 index 0000000..6526ded --- /dev/null +++ b/files/instance.sh @@ -0,0 +1,94 @@ +#!/bin/bash + +flavor_name="${1}" +image_name="${2}" +network_id="${3}" +keypair_name="${4}" +instance_name="${5}" +ext_network_name="${6}" + +if [ "${flavor_name}" == "" ]; then + echo "No flavor name supplied." >&2 + exit 1 +elif [ "${image_name}" == "" ]; then + echo "No image name supplied." >&2 + exit 1 +elif [ "${network_id}" == "" ]; then + echo "No network ID supplied." >&2 + exit 1 +elif [ "${keypair_name}" == "" ]; then + echo "No keypair name supplied." >&2 + exit 1 +elif [ "${instance_name}" == "" ]; then + echo "No instance name supplied." >&2 + exit 1 +elif [ "${ext_network_name}" == "" ]; then + echo "No ext network name supplied." >&2 + exit 1 +fi + +associate_floating_ip () { + for line in $(openstack floating ip list | grep -F 'None' | sed -e 's/ //g'); do + floating_ip_id=$(echo ${line} | awk -F\| '{print $2;}') + floating_ip=$(echo ${line} | awk -F\| '{print $3;}') + floating_ip_port=$(echo ${line} | awk -F\| '{print $5;}') + if [ "${floating_ip_port}" == "None" ]; then + nova floating-ip-associate "${1}" "${floating_ip}" >/dev/null 2>&1 + echo "${floating_ip}" + return 0 + fi + done + return 1 +} + +image_id=$(openstack image list --limit 1000 --public 2>/dev/null | grep -F " ${image_name} " | awk '{print $2;}') +if [ "${image_id}" == "" ]; then + echo "Could not find id for image ${image_name}" >&2 + exit 1 +fi + +instance_number=1 +for num in $(openstack server list --limit 1000 2>/dev/null | grep -F "${instance_name}" | awk '{print $4;}' | awk -F- '{print $4;}' | sort); do + if (( "${num}" == ${instance_number} )); then + instance_number=$(expr ${instance_number} + 1) + fi +done + +# TODO: rewrite with openstack server create +instance_id=$(nova boot \ + --flavor "${flavor_name}" \ + --block-device source=image,id=${image_id},dest=volume,size=20,shutdown=preserve,bootindex=0 \ + --nic net-id="${network_id}" \ + --security-groups "default-grp,dns,galera,vertx,web" \ + --key-name "${keypair_name}" \ + --user-data "data/etc/cloud/cloud.cfg" \ + --poll \ + "${instance_name}-${instance_number}" \ + | grep -F ' id ' | awk '{print $4;}') + +if [ "${instance_id}" == "" ]; then + echo "Instance creation did not return an ID." >&2 + exit 1 +fi + +floating_ip_assigned=$(associate_floating_ip ${instance_id}) +if (( ${?} == 1 )); then + openstack floating ip create ${ext_network_name} >/dev/null 2>&1 + if (( ${?} == 0 )); then + floating_ip_assigned=$(associate_floating_ip ${instance_id}) + if (( ${?} == 1 )); then + echo "Could not associate floating IP." >&2 + exit 1 + fi + fi +fi + +# TODO: rewrite with openstackclient command +for sec in default-grp dns galera vertx web; do + nova add-secgroup ${instance_id} ${sec} >/dev/null 2>&1 +done + +echo "${floating_ip_assigned}" +echo "${instance_name}-${instance_number}" + +exit 0 diff --git a/files/keypair.sh b/files/keypair.sh new file mode 100755 index 0000000..0e8374d --- /dev/null +++ b/files/keypair.sh @@ -0,0 +1,35 @@ +#!/bin/bash + +keypair_name="${1}" +pubkey_path="${2}" + +if [ "${keypair_name}" == "" ]; then + echo "No keypair name was supplied." >&2 + exit 1 +elif [ "${pubkey_path}" == "" ]; then + echo "No pubkey path was supplied." >&2 + exit 1 +fi + +keypair_fingerprint=$(openstack keypair list | grep -F "${keypair_name}" | awk '{print $4;}') +if [ "${keypair_fingerprint}" == "" ]; then + if [ "${pubkey_path}" == "" ]; then + echo -n "Need to create an SSH keypair, but no path to a pubkey " >&2 + echo "was supplied." >&2 + exit 1 + elif [ ! -f "${pubkey_path}" ]; then + echo -n "Need to create an SSH keypair, but the supplied path " >&2 + echo "to the pubkey is invalid:" >&2 + echo "${pubkey_path}" >&2 + exit 1 + fi + + openstack keypair create --public-key "${pubkey_path}" "${keypair_name}" + keypair_fingerprint=$(openstack keypair list | grep -F "${keypair_name}" | awk '{print $4;}') + if [ "${keypair_fingerprint}" == "" ]; then + echo "Could not retrieve keypair after creation." >&2 + exit 1 + fi +fi + +exit 0 diff --git a/files/logrotate_tomcat7 b/files/logrotate_tomcat7 new file mode 100644 index 0000000..6f1c36b --- /dev/null +++ b/files/logrotate_tomcat7 @@ -0,0 +1,8 @@ +/var/log/tomcat7/*.log /var/log/tomcat7/*.txt /var/log/tomcat7/catalina.out { + copytruncate + weekly + rotate 4 + compress + missingok + create 640 tomcat7 adm +} diff --git a/files/network.sh b/files/network.sh new file mode 100755 index 0000000..22b0623 --- /dev/null +++ b/files/network.sh @@ -0,0 +1,69 @@ +#!/bin/bash + +router_name="${1}" +private_network_name="${2}" +private_network_cidr="${3}" +ext_network_name="${4}" +dns_servers="${5}" + +if [ "${router_name}" == "" ]; then + echo "No router name supplied." >&2 + exit 1 +elif [ "${private_network_name}" == "" ]; then + echo "No private network name supplied." >&2 + exit 1 +elif [ "${private_network_cidr}" == "" ]; then + echo "No private network CIDR supplied." >&2 + exit 1 +elif [ "${ext_network_name}" == "" ]; then + echo "No external network name supplied." >&2 + exit 1 +elif [ "${dns_servers}" == "" ]; then + echo "No dns servers supplied." >&2 + exit 1 +fi + +ext_network_id=$(openstack network show -f shell -c id "${ext_network_name}" 2>/dev/null | awk -F= '{print $2;}' | sed -e 's/\"//g') +if [ "${ext_network_id}" == "" ]; then + echo "No ${ext_network_name} network exists." >&2 + exit 1 +fi + +private_network_id=$(openstack network show -f shell -c id "${private_network_name}" 2>/dev/null | awk -F= '{print $2;}' |sed -e 's/\"//g') +if [ "${private_network_id}" == "" ]; then + openstack network create "${private_network_name}" >/dev/null + openstack subnet create \ + "${private_network_name}" \ + --network "${private_network_name}" \ + --subnet-range "${private_network_cidr}" \ + --dns-nameserver $(echo ${dns_servers} | awk '{print $1;}') \ + --dns-nameserver $(echo ${dns_servers} | awk '{print $2;}') \ + --dns-nameserver $(echo ${dns_servers} | awk '{print $3;}') \ + >/dev/null + private_network_id=$(openstack network show -f shell -c id "${private_network_name}" 2>/dev/null | awk -F= '{print $2;}' |sed -e 's/\"//g') + if [ "${private_network_id}" == "" ]; then + echo "Cannot retrieve private network ID after creation." >&2 + exit 1 + fi +fi + +router_id=$(openstack router show -f shell -c id "${router_name}" 2>/dev/null | awk -F= '{print $2;}' | sed -e 's/\"//g') +if [ "${router_id}" == "" ]; then + openstack router create "${router_name}" >/dev/null + router_id=$(openstack router show -f shell -c id "${router_name}" 2>/dev/null | awk -F= '{print $2;}' | sed -e 's/\"//g') + if [ "${router_id}" == "" ]; then + echo "Cannot retrieve router ID after creation." >&2 + exit 1 + fi +fi + +gateway_info=$(openstack router show -f shell -c external_gateway_info "${router_name}" 2>/dev/null | grep -F 'external_fixed_ips') +if [ "${gateway_info}" == "" ]; then + openstack router set "${router_id}" --external-gateway "${ext_network_id}" >/dev/null +fi + +openstack router add subnet "${router_id}" "${private_network_name}" >/dev/null 2>&1 || true + +echo -n "${private_network_id}" + +exit 0 diff --git a/files/securitygroup.sh b/files/securitygroup.sh new file mode 100755 index 0000000..a7c2ad1 --- /dev/null +++ b/files/securitygroup.sh @@ -0,0 +1,74 @@ +#!/bin/bash + +private_network_cidr="${1}" +public_network_cidrs="${2}" + +for name in default-grp; do + openstack security group show ${name} || openstack security group create --description "${name} ports" ${name} >/dev/null 2>&1 + for protocol in tcp udp; do + if [ "openstack security group show default -f shell -c rules | grep -F 'ingress' | grep -F \"port_range_min='1'\" | grep -F \"port_range_max='65535'\" | grep -F \"${protocol}\" | grep -F 'IPv4'" == "" ]; then + openstack security group rule create --egress --protocol ${protocol} --remote-ip 0.0.0.0/0 --dst-port 1:65535 --ethertype IPv4 ${name} >/dev/null 2>&1 + fi + if [ "openstack security group show default -f shell -c rules | grep -F 'ingress' | grep -F \"port_range_min='1'\" | grep -F \"port_range_max='65535'\" | grep -F \"${protocol}\" | grep -F 'IPv6'" == "" ]; then + openstack security group rule create --egress --protocol ${protocol} --remote-ip ::/0 --dst-port 1:65535 --ethertype IPv6 ${name} >/dev/null 2>&1 + fi + done + for cidr in ${private_network_cidr} ${public_network_cidrs}; do + if [ "$(openstack security group show ${name} -f shell -c rules | grep -F \"icmp\" | grep -F \"remote_ip_prefix='${cidr}'\")" == "" ]; then + openstack security group rule create --ingress --protocol icmp --remote-ip ${cidr} ${name} >/dev/null 2>&1 + fi + done + for port in 22; do + for cidr in ${private_network_cidr} ${public_network_cidrs}; do + if [ "$(openstack security group show ${name} -f shell -c rules | grep -F \"port_range_min='${port}'\" | grep -F \"remote_ip_prefix='${cidr}'\")" == "" ]; then + openstack security group rule create --ingress --protocol tcp --dst-port ${port} --remote-ip ${cidr} ${name} >/dev/null 2>&1 + fi + done + done +done + +for name in dns; do + openstack security group show ${name} || openstack security group create --description "${name} ports" ${name} >/dev/null 2>&1 + for port in 53; do + for cidr in ${private_network_cidr} ${public_network_cidrs}; do + if [ "$(openstack security group show ${name} -f shell -c rules | grep -F \"port_range_min='${port}'\" | grep -F \"remote_ip_prefix='${cidr}'\")" == "" ]; then + openstack security group rule create --ingress --protocol udp --dst-port ${port} --remote-ip ${cidr} ${name} >/dev/null 2>&1 + fi + done + done +done + +for name in vertx; do + openstack security group show ${name} || openstack security group create --description "${name} ports" ${name} >/dev/null 2>&1 + for port in 5701:5710; do + for cidr in ${private_network_cidr}; do + if [ "$(openstack security group show ${name} -f shell -c rules | grep -F \"port_range_min='${port}'\" | grep -F \"remote_ip_prefix='${cidr}'\")" == "" ]; then + openstack security group rule create --ingress --protocol tcp --dst-port ${port} --remote-ip ${cidr} ${name} >/dev/null 2>&1 + fi + done + done +done + +for name in web; do + openstack security group show ${name} || openstack security group create --description "${name} ports" ${name} >/dev/null 2>&1 + for port in 8080:8083; do + for cidr in ${private_network_cidr} ${public_network_cidrs}; do + if [ "$(openstack security group show ${name} -f shell -c rules | grep -F \"port_range_min='${port}'\" | grep -F \"remote_ip_prefix='${cidr}'\")" == "" ]; then + openstack security group rule create --ingress --protocol tcp --dst-port ${port} --remote-ip ${cidr} ${name} >/dev/null 2>&1 + fi + done + done +done + +for name in galera; do + openstack security group show ${name} || openstack security group create --description "${name} ports" ${name} >/dev/null 2>&1 + for port in 3306 4444 4567 9200; do + for cidr in ${private_network_cidr} ${public_network_cidrs}; do + if [ "$(openstack security group show ${name} -f shell -c rules | grep -F \"port_range_min='${port}'\" | grep -F \"remote_ip_prefix='${cidr}'\")" == "" ]; then + openstack security group rule create --ingress --protocol tcp --dst-port ${port} --remote-ip ${cidr} ${name} >/dev/null 2>&1 + fi + done + done +done + +exit 0 -- cgit v1.3