The script creates and sets up of user K8S profile
* Allow users the ability to connect K8S cluster remotely * Authenthicate to UCP Keystone * Then able remotely execute into containers * Install all required software components Change-Id: I1062ab14d1c643e1161b6fcfb870eaee55f5e64b
This commit is contained in:
Trung Thai
parent
4b71275e37
commit
5f3ce78d7f
165
jmphost/README.md
Normal file
165
jmphost/README.md
Normal file
@ -0,0 +1,165 @@
|
|||||||
|
# Jump host installation
|
||||||
|
|
||||||
|
The install will Kubernetes client and the corresponding dependencies in order
|
||||||
|
to able to connect to K8S cluster remotely. It will also create a generic
|
||||||
|
kubectl configuration file with appropriate attributes required.
|
||||||
|
|
||||||
|
This revision covers the implementation as described. [k8s-keystone-auth](
|
||||||
|
https://github.com/kubernetes/cloud-provider-openstack/blob/master/docs/using-keystone-webhook-authenticator-and-authorizer.md#new-kubectl-clients-from-v1110-and-later)
|
||||||
|
|
||||||
|
## 1. Pre-requisites
|
||||||
|
|
||||||
|
* Ubuntu OS version 14.x or higher
|
||||||
|
* Connectivity to the Internet
|
||||||
|
* The installer has sudo ability without prompting for password
|
||||||
|
* Installer's Git profile setup accordingly
|
||||||
|
|
||||||
|
## 2. Installation
|
||||||
|
|
||||||
|
### 2.1 Clone Porthole main project
|
||||||
|
|
||||||
|
$git clone https://review.opendev.org/airship/porthole
|
||||||
|
|
||||||
|
Cloning into 'porthole'...
|
||||||
|
remote: Counting objects: 362, done
|
||||||
|
remote: Finding sources: 100% (362/362)
|
||||||
|
remote: Total 362 (delta 185), reused 311 (delta 185)
|
||||||
|
Receiving objects: 100% (362/362), 98.30 KiB | 0 bytes/s, done.
|
||||||
|
Resolving deltas: 100% (185/185), done.
|
||||||
|
Checking connectivity... done.
|
||||||
|
|
||||||
|
### 2.2 Pull PatchSet (optional)
|
||||||
|
|
||||||
|
$cd porthole
|
||||||
|
$git pull https://review.opendev.org/airship/porthole refs/changes/92/674892/[latest change set]
|
||||||
|
|
||||||
|
remote: Counting objects: 10, done
|
||||||
|
remote: Finding sources: 100% (8/8)
|
||||||
|
remote: Total 8 (delta 2), reused 7 (delta 2)
|
||||||
|
Unpacking objects: 100% (8/8), done.
|
||||||
|
From https://review.opendev.org/airship/porthole
|
||||||
|
branch refs/changes/92/674892/9 -> FETCH_HEAD
|
||||||
|
Merge made by the 'recursive' strategy.
|
||||||
|
jmphost/README.md | 130 ++++++++++++++++++++++++++++++++++++++++
|
||||||
|
jmphost/funs_uc.sh | 57 ++++++++++++++++++++++++++++++++++++++++
|
||||||
|
jmphost/setup-access.sh | 132 ++++++++++++++++++++++++++++++++++++++++
|
||||||
|
zuul.d/jmphost-utility.yaml | 35 ++++++++++++++++++++++++++++++++++++++++
|
||||||
|
|
||||||
|
4 files changed, 354 insertions(+)
|
||||||
|
create mode 100644 jmphost/README.md
|
||||||
|
create mode 100755 jmphost/funs_uc.sh
|
||||||
|
create mode 100755 jmphost/setup-access.sh
|
||||||
|
create mode 100644 zuul.d/jmphost-utility.yaml
|
||||||
|
|
||||||
|
### 2.3 Run Setup
|
||||||
|
|
||||||
|
$sudo -s
|
||||||
|
$cd jmphost
|
||||||
|
$./setup-access.sh "site" "userid" "namespace"
|
||||||
|
|
||||||
|
[Kubectl binary] is not found on this system..
|
||||||
|
Checking user[johnSmith] sudo ability
|
||||||
|
Looking good. You [johnSmith] are root now
|
||||||
|
deb https://apt.kubernetes.io/ kubernetes-xenial main
|
||||||
|
OK
|
||||||
|
........................
|
||||||
|
........................
|
||||||
|
........................
|
||||||
|
........................
|
||||||
|
Installing [kubectl] dependency required...
|
||||||
|
Reading package lists... Done
|
||||||
|
Building dependency tree
|
||||||
|
Reading state information... Done
|
||||||
|
The following package was automatically installed and is no longer required:
|
||||||
|
libclamav6
|
||||||
|
Use 'apt-get autoremove' to remove it.
|
||||||
|
The following NEW packages will be installed:
|
||||||
|
kubectl
|
||||||
|
0 upgraded, 1 newly installed, 0 to remove and 104 not upgraded.
|
||||||
|
Need to get 9,231 kB of archives.
|
||||||
|
After this operation, 46.7 MB of additional disk space will be used.
|
||||||
|
Fetched 9,231 kB in 12s (732 kB/s)
|
||||||
|
Selecting previously unselected package kubectl.
|
||||||
|
(Reading database ... 114982 files and directories currently installed.)
|
||||||
|
Preparing to unpack .../kubectl_1.16.0-00_amd64.deb ...
|
||||||
|
Unpacking kubectl (1.16.0-00) ...
|
||||||
|
Setting up kubectl (1.16.0-00) ...
|
||||||
|
........................
|
||||||
|
........................
|
||||||
|
W: Duplicate sources.list entry https://apt.kubernetes.io/ kubernetes-xenial/main amd64 Packages (/var/lib/apt/lists/apt.kubernetes.io_dists_kubernetes-xenial_main_binary-amd64_Packages)
|
||||||
|
W: Duplicate sources.list entry https://apt.kubernetes.io/ kubernetes-xenial/main i386 Packages (/var/lib/apt/lists/apt.kubernetes.io_dists_kubernetes-xenial_main_binary-i386_Packages)
|
||||||
|
........................
|
||||||
|
W: You may want to run apt-get update to correct these problems
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
namespace: utility
|
||||||
|
Authentication via API WebHook Ingress service endpoint
|
||||||
|
clusters:
|
||||||
|
- cluster:
|
||||||
|
server: https://<FQDN-WEBHOOK-APISERVER>
|
||||||
|
name: <CLUSTER_NAME>
|
||||||
|
contexts:
|
||||||
|
- context:
|
||||||
|
cluster: <CLUSTER_NAME>
|
||||||
|
user: <USERID>
|
||||||
|
name: <USERID>@<CLUSTER_NAME>
|
||||||
|
current-context: <USERID>@<CLUSTER_NAME>
|
||||||
|
kind: Config
|
||||||
|
preferences: {}
|
||||||
|
users:
|
||||||
|
- name: <USERID>
|
||||||
|
user:
|
||||||
|
exec:
|
||||||
|
command: "/usr/local/uc/bin/client-keystone-auth"
|
||||||
|
apiVersion: "client.authentication.k8s.io/v1beta1"
|
||||||
|
env:
|
||||||
|
- name: "OS_DOMAIN_NAME"
|
||||||
|
value: default
|
||||||
|
- name: "OS_INTERFACE"
|
||||||
|
value: public
|
||||||
|
- name: "OS_USERNAME"
|
||||||
|
value: <USER_ID>
|
||||||
|
- name: "OS_PASSWORD"
|
||||||
|
value: "<USER-PASSWORD>"
|
||||||
|
- name: "OS_PROJECT_NAME"
|
||||||
|
value: <admin-project>
|
||||||
|
- name: "OS_REGION_NAME"
|
||||||
|
value: <SITE>
|
||||||
|
- name: "OS_IDENTITY_API_VERSION"
|
||||||
|
value: "3"
|
||||||
|
args:
|
||||||
|
- "--keystone-url=https://<FQDN TO UCP KEYSTONE>/v3"
|
||||||
|
|
||||||
|
## Validation
|
||||||
|
|
||||||
|
- Now log out and log back in as the user.
|
||||||
|
- Update the configuration file with user corresponding credentials.
|
||||||
|
|
||||||
|
For testing purposes:
|
||||||
|
- Replacing **"OS_USERNAME"** and **"OS_PASSWORD"** with UCP Keystone credentials
|
||||||
|
- Set the **"OS_PROJECT_NAME"** value accordingly
|
||||||
|
|
||||||
|
### List pods
|
||||||
|
|
||||||
|
$kubectl get pods -n utility
|
||||||
|
|
||||||
|
NAME READY STATUS RESTARTS AGE
|
||||||
|
clcp-calicoctl-utility-6457864fc8-zpfxk 1/1 Running 0 4h27m
|
||||||
|
clcp-ncct-utility-6588ff5566-8mqsb 1/1 Running 0 4h27m
|
||||||
|
clcp-tenant-ceph-utility-7b8f6d45f8-5q4ts 1/1 Running 0 99m
|
||||||
|
clcp-tenant-ceph-utility-config-ceph-ns-key-generator-hd9rb 0/1 Completed 0 99m
|
||||||
|
clcp-ucp-ceph-utility-6f4bbd4569-vrm7c 1/1 Running 0 4h11m
|
||||||
|
clcp-ucp-ceph-utility-config-ceph-ns-key-generator-pvfcl 0/1 Completed 0 4h12m
|
||||||
|
clcp-ucp-ceph-utility-config-test 0/1 Completed 0 4h12m
|
||||||
|
|
||||||
|
### Execute into the pod
|
||||||
|
|
||||||
|
$kubectl exec -it [pod-name] -n utility /bin/bash
|
||||||
|
|
||||||
|
rpc error: code = 2 desc = oci runtime error: exec failed: container_linux.go:247: starting container process caused "exec: \"/bin/\": permission denied"
|
||||||
|
|
||||||
|
command terminated with exit code 126
|
||||||
|
|
||||||
|
Because the user id entered in the configuration file is not a member in UCP keystone
|
||||||
|
RBAC to execute into the pod, it's expecting to see "permission denied".
|
||||||
57
jmphost/funs_uc.sh
Executable file
57
jmphost/funs_uc.sh
Executable file
@ -0,0 +1,57 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
#
|
||||||
|
# Author: Trung Thai, tt2189@att.com
|
||||||
|
#
|
||||||
|
# Purpose: Common shared functions defined and used on jumphost server.
|
||||||
|
#
|
||||||
|
|
||||||
|
# Author Krishna Venkata, kv988c@att.com
|
||||||
|
#
|
||||||
|
# Purpose - kubectl wrapper providing some of overwriting behavior from Kubectl
|
||||||
|
# when users to exectute into utility container.
|
||||||
|
|
||||||
|
declare -frx kubectl
|
||||||
|
|
||||||
|
function kubectl() {
|
||||||
|
if [[ $* == *"exec"* ]] && [[ $* == *"bash"* ]]; then
|
||||||
|
aft_bash=$(echo "$*" | awk -F'bash' '{print $2}')
|
||||||
|
bef_bash=$(echo "$*" | awk -F'bash' '{print $1}')
|
||||||
|
if [[ -z $aft_bash ]]; then
|
||||||
|
if [[ $* == *"--"* ]]; then
|
||||||
|
$(which kubectl) $bef_bash bash -c "export AUSER=$USER;bash;"
|
||||||
|
else
|
||||||
|
$(which kubectl) $bef_bash -- bash -c "export AUSER=$USER;bash;"
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
command=$(echo $aft_bash | cut -d' ' -f2-)
|
||||||
|
$(which kubectl) $bef_bash bash -c "export AUSER=$USER;$command;"
|
||||||
|
fi
|
||||||
|
elif [[ $* == *"exec"* ]] && [[ $* == *"sh"* ]]; then
|
||||||
|
aft_sh=$(echo "$*" | awk -F'sh' '{print $2}')
|
||||||
|
bef_sh=$(echo "$*" | awk -F'sh' '{print $1}')
|
||||||
|
if [[ -z $aft_sh ]]; then
|
||||||
|
if [[ $* == *"--"* ]]; then
|
||||||
|
$(which kubectl) $bef_sh sh -c "export AUSER=$USER;sh;"
|
||||||
|
else
|
||||||
|
$(which kubectl) $bef_sh -- sh -c "export AUSER=$USER;sh;"
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
command=$(echo $aft_sh | cut -d' ' -f2-)
|
||||||
|
`which kubectl` $bef_sh sh -c "export AUSER=$USER;$command;"
|
||||||
|
fi
|
||||||
|
elif [[ $* == *"exec"* ]] && [[ $* == *"utilscli"* ]]; then
|
||||||
|
aft_utilscli=$(echo "$*" | awk -F'utilscli' '{print $2}')
|
||||||
|
bef_utilscli=$(echo "$*" | awk -F'utilscli' '{print $1}')
|
||||||
|
if [[ -z $aft_utilscli ]]; then
|
||||||
|
echo "Invalid Command"
|
||||||
|
else
|
||||||
|
if [[ $* == *"--"* ]]; then
|
||||||
|
$(which kubectl) $bef_utilscli bash -c "export AUSER=$USER;utilscli $aft_utilscli;"
|
||||||
|
else
|
||||||
|
$(which kubectl) $bef_utilscli -- bash -c "export AUSER=$USER;utilscli $aft_utilscli;"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
$(which kubectl) $*
|
||||||
|
fi
|
||||||
|
}
|
||||||
136
jmphost/setup-access.sh
Executable file
136
jmphost/setup-access.sh
Executable file
@ -0,0 +1,136 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# Script installs Kubectl latest binary and K8S-Keystone-Auth provider.
|
||||||
|
# It will generate a default 'kubectl' configuration file for the user with the appropriate
|
||||||
|
# settings to remotely connect to K8S cluster through Keystone authentication mechanism.
|
||||||
|
|
||||||
|
|
||||||
|
if [[ ${#} -lt 2 ]] ; then
|
||||||
|
echo "Abort - Usage $0 <SITE NAME> <USER_ID> <NAMESPACE>"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
SITE_NAME=$1 ; LOGNAME=$2 ; NAMESPACE=$3
|
||||||
|
|
||||||
|
LOGNAME_GRP=$(grep ${LOGNAME} /etc/passwd |cut -d":" -f3)
|
||||||
|
|
||||||
|
# set default env variables
|
||||||
|
: ${USER_HOME:=$HOME}
|
||||||
|
: ${USER_KUBECFG:=$USER_HOME/.kube/config}
|
||||||
|
|
||||||
|
function _addSourceList() {
|
||||||
|
echo "deb https://apt.kubernetes.io/ kubernetes-xenial main" | \
|
||||||
|
tee -a /etc/apt/sources.list.d/kubernetes.list
|
||||||
|
curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key add -
|
||||||
|
apt-get update
|
||||||
|
}
|
||||||
|
|
||||||
|
# Install dependencies once
|
||||||
|
function _installDep () {
|
||||||
|
|
||||||
|
# kubectl
|
||||||
|
if [[ $1 == 'kubectl' ]] ; then
|
||||||
|
echo "Installing [${1}] dependency required..."
|
||||||
|
apt-get install -y kubectl
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Create kubeconfig skelton file
|
||||||
|
function _createConfig() {
|
||||||
|
tee ${USER_KUBECFG} <<EOF
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
namespace: ${NAMESPACE}
|
||||||
|
|
||||||
|
# Authentication via API WebHook Ingress service endpoint
|
||||||
|
clusters:
|
||||||
|
- cluster:
|
||||||
|
server: https://<WEBHOOK-API-INGRESS-FQDN>
|
||||||
|
name: kubernetes
|
||||||
|
contexts:
|
||||||
|
- context:
|
||||||
|
cluster: kubernetes
|
||||||
|
user: ${LOGNAME}
|
||||||
|
name: ${LOGNAME}@kubernetes
|
||||||
|
current-context: ${LOGNAME}@kubernetes
|
||||||
|
kind: Config
|
||||||
|
preferences: {}
|
||||||
|
users:
|
||||||
|
- name: ${LOGNAME}
|
||||||
|
user:
|
||||||
|
exec:
|
||||||
|
command: "/usr/local/uc/bin/client-keystone-auth"
|
||||||
|
apiVersion: "client.authentication.k8s.io/v1beta1"
|
||||||
|
|
||||||
|
env:
|
||||||
|
- name: "OS_DOMAIN_NAME"
|
||||||
|
value: default
|
||||||
|
- name: "OS_INTERFACE"
|
||||||
|
value: public
|
||||||
|
- name: "OS_USERNAME"
|
||||||
|
value: ${LOGNAME}
|
||||||
|
- name: "OS_PASSWORD"
|
||||||
|
value: "<USER-PASSWORD>"
|
||||||
|
- name: "OS_PROJECT_NAME"
|
||||||
|
value: admin
|
||||||
|
- name: "OS_REGION_NAME"
|
||||||
|
value: ${SITE_NAME}
|
||||||
|
- name: "OS_IDENTITY_API_VERSION"
|
||||||
|
value: "3"
|
||||||
|
|
||||||
|
args:
|
||||||
|
- "--keystone-url=<UCP-KEYSTONE-INGRESS-FQDN>/v3"
|
||||||
|
|
||||||
|
EOF
|
||||||
|
}
|
||||||
|
|
||||||
|
# checking and installing 'kubectl'
|
||||||
|
if [[ ! -x /usr/bin/kubectl ]] ; then
|
||||||
|
echo "[Kubectl binary] is not found on this system.."
|
||||||
|
echo "Checking user[${LOGNAME}] sudo ability"
|
||||||
|
let num=$(id -u)
|
||||||
|
if [ $num -ne '0' ]; then
|
||||||
|
echo "Abort dependencies installation. You [$LOGNAME] are not root yet"
|
||||||
|
exit 1
|
||||||
|
else
|
||||||
|
echo "Looking good. You [$LOGNAME] are root now"
|
||||||
|
_addSourceList
|
||||||
|
_installDep "kubectl"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ ! -d ${USER_HOME}/.kube ]]; then
|
||||||
|
mkdir ${USER_HOME}/.kube
|
||||||
|
chown -R ${LOGNAME}:${LOGNAME_GRP} ${USER_HOME}/.kube
|
||||||
|
fi
|
||||||
|
|
||||||
|
# create config if it does not exit
|
||||||
|
if [[ ! -f ${USER_KUBECFG} ]]; then
|
||||||
|
_createConfig
|
||||||
|
chown ${LOGNAME}:${LOGNAME_GRP} ${USER_HOME}/.kube/config
|
||||||
|
fi
|
||||||
|
|
||||||
|
# staging uc functions to a common area
|
||||||
|
if [[ ! -d /usr/local/uc/bin/ ]]; then
|
||||||
|
mkdir -p /usr/local/uc/bin/
|
||||||
|
cp -p funs_uc.sh /usr/local/uc/bin/
|
||||||
|
echo "Installing [k8s-keystone-authentication] component"
|
||||||
|
curl -SL# https://api.nz-por-1.catalystcloud.io:8443/v1/AUTH_b23a5e41d1af4c20974bf58b4dff8e5a/lingxian-public/client-keystone-auth \
|
||||||
|
-o /usr/local/uc/bin/client-keystone-auth
|
||||||
|
chmod 755 -R /usr/local/uc
|
||||||
|
chown root:root -R /usr/local/uc
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Update user bash rc script to include uc funcions
|
||||||
|
if [[ -f ${HOME}/.bashrc ]]; then
|
||||||
|
cp -p ${HOME}/.bashrc ${HOME}/.bashrc.jmp.bck.$(date +%s)
|
||||||
|
egrep funs_uc ${HOME}/.bashrc
|
||||||
|
if [[ $? -eq '1' ]] ; then
|
||||||
|
tee -a ${HOME}/.bashrc <<EOF
|
||||||
|
# Utility container common functions
|
||||||
|
if [[ -f /usr/local/uc/bin/funs_uc.sh ]]; then
|
||||||
|
. /usr/local/uc/bin/funs_uc.sh
|
||||||
|
fi
|
||||||
|
EOF
|
||||||
|
fi
|
||||||
|
fi
|
||||||
Loading…
Reference in New Issue
Block a user