Merge "Remove fragments of docker files"
This commit is contained in:
Jenkins
Gerrit Code Review
commit
4d713a1092
@ -1,281 +0,0 @@
|
||||
FROM {{ base_image }}:{{ base_distro_tag }}
|
||||
MAINTAINER {{ maintainer }}
|
||||
|
||||
LABEL kolla_version="{{ kolla_version }}"
|
||||
|
||||
{% import "macros.j2" as macros with context %}
|
||||
{% block base_header %}{% endblock %}
|
||||
{{ include_header }}
|
||||
|
||||
ENV KOLLA_BASE_DISTRO {{ base_distro }}
|
||||
ENV KOLLA_INSTALL_TYPE {{ install_type }}
|
||||
ENV KOLLA_INSTALL_METATYPE {{ install_metatype }}
|
||||
|
||||
#### Customize PS1 to be used with bash shell
|
||||
COPY kolla_bashrc /tmp/
|
||||
RUN cat /tmp/kolla_bashrc >> /etc/skel/.bashrc \
|
||||
&& cat /tmp/kolla_bashrc >> /root/.bashrc
|
||||
|
||||
# PS1 var when used /bin/sh shell
|
||||
ENV PS1="$(tput bold)($(printenv KOLLA_SERVICE_NAME))$(tput sgr0)[$(id -un)@$(hostname -s) $(pwd)]$ "
|
||||
|
||||
# For RPM Variants, enable the correct repositories - this should all be done
|
||||
# in the base image so repos are consistent throughout the system. This also
|
||||
# enables to provide repo overrides at a later date in a simple fashion if we
|
||||
# desire such functionality. I think we will :)
|
||||
|
||||
{% if base_distro in ['centos', 'oraclelinux', 'rhel'] %}
|
||||
|
||||
RUN if [ $(awk '{match($0, /[0-9]+/,version)}END{print version[0]}' /etc/system-release) != "{{ supported_distro_release }}" ]; then \
|
||||
echo "Only supported {{ supported_distro_release }} release on {{ base_distro }}"; false; \
|
||||
fi \
|
||||
&& cat /tmp/kolla_bashrc >> /etc/bashrc \
|
||||
&& sed -i 's|^\(override_install_langs=.*\)|# \1|' /etc/yum.conf
|
||||
|
||||
#### BEGIN REPO ENABLEMENT
|
||||
# Turns on Elasticsearch repos
|
||||
{% set base_yum_repo_files = [
|
||||
'elasticsearch.repo',
|
||||
'kibana.yum.repo',
|
||||
'MariaDB.repo',
|
||||
'influxdb.repo',
|
||||
'grafana.repo'
|
||||
] %}
|
||||
{% for repo_file in base_yum_repo_files | customizable('yum_repo_files') %}
|
||||
COPY {{ repo_file }} /etc/yum.repos.d/{{ repo_file }}
|
||||
{% endfor %}
|
||||
|
||||
{% set base_yum_url_packages = [
|
||||
'http://repo.percona.com/release/7/RPMS/x86_64/percona-release-0.1-3.noarch.rpm'
|
||||
] %}
|
||||
{{ macros.install_packages(base_yum_url_packages | customizable("yum_url_packages")) }}
|
||||
{% set base_yum_repo_keys = [
|
||||
'http://yum.mariadb.org/RPM-GPG-KEY-MariaDB',
|
||||
'/etc/pki/rpm-gpg/RPM-GPG-KEY-Percona ',
|
||||
'https://packages.elastic.co/GPG-KEY-elasticsearch',
|
||||
'https://repos.influxdata.com/influxdb.key',
|
||||
'https://packagecloud.io/gpg.key',
|
||||
'https://grafanarel.s3.amazonaws.com/RPM-GPG-KEY-grafana'
|
||||
] %}
|
||||
|
||||
RUN true {% for key in base_yum_repo_keys | customizable('yum_repo_keys') %}&& rpm --import {{ key }} {% endfor %}
|
||||
{% if install_metatype in ['rdo', 'mixed'] %}
|
||||
|
||||
{% for cmd in rpm_setup %}
|
||||
{{ cmd }}
|
||||
{% endfor %}
|
||||
|
||||
{% endif %}
|
||||
{# endif for repo setup for all RHEL except RHEL OSP #}
|
||||
|
||||
{% if install_metatype == 'rhos' %}
|
||||
|
||||
# Turn on the RHOS 7.0 repo for RHOS
|
||||
RUN yum-config-manager --enable rhel-7-server-rpms \
|
||||
&& yum-config-manager --enable rhel-7-server-openstack-7.0-rpms
|
||||
|
||||
{% endif %}
|
||||
|
||||
{% if base_distro == 'centos' %}
|
||||
|
||||
RUN rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7
|
||||
|
||||
{% set base_centos_yum_repo_keys = [
|
||||
'/etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-Storage',
|
||||
'/etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-Virtualization'
|
||||
] %}
|
||||
|
||||
{% set base_centos_yum_repo_packages = [
|
||||
'epel-release ',
|
||||
'yum-plugin-priorities',
|
||||
'centos-release-ceph-jewel',
|
||||
'centos-release-qemu-ev'
|
||||
] %}
|
||||
|
||||
{{ macros.install_packages(base_centos_yum_repo_packages | customizable("yum_centos_repo_packages")) }}
|
||||
RUN true \
|
||||
{% for key in base_centos_yum_repo_keys | customizable('yum_centos_repo_keys') %} && rpm --import {{ key }}{% endfor %} && yum clean all
|
||||
|
||||
{% endif %}
|
||||
{# Endif for base_distro centos #}
|
||||
|
||||
{% if base_distro == 'rhel' %}
|
||||
|
||||
{% block base_rhel_package_installation %}
|
||||
# Enable couple required repositories for all RHEL builds
|
||||
# Turn on EPEL throughout the build
|
||||
RUN yum -y install \
|
||||
http://mirror.centos.org/centos-7/7/extras/x86_64/Packages/epel-release-7-6.noarch.rpm \
|
||||
&& rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7 \
|
||||
&& yum -y install \
|
||||
yum-plugin-priorities \
|
||||
&& yum clean all \
|
||||
&& yum-config-manager --enable rhel-7-server-optional-rpms \
|
||||
&& yum-config-manager --enable rhel-7-server-extras-rpms
|
||||
{% endblock %}
|
||||
|
||||
{% endif %}
|
||||
{# Endif for base_distro RHEL #}
|
||||
|
||||
{% if base_distro == 'oraclelinux' %}
|
||||
|
||||
{% block base_oraclelinux_package_installation %}
|
||||
COPY oraclelinux-extras.repo /etc/yum.repos.d/oraclelinux-extras.repo
|
||||
RUN yum -y install \
|
||||
tar \
|
||||
yum-utils \
|
||||
http://mirror.centos.org/centos-7/7/extras/x86_64/Packages/epel-release-7-6.noarch.rpm \
|
||||
&& rpm -Uvh --nodeps \
|
||||
http://buildlogs.centos.org/centos/7/cloud/x86_64/openstack-mitaka/centos-release-openstack-mitaka-1-3.el7.noarch.rpm \
|
||||
http://mirror.centos.org/centos-7/7/extras/x86_64/Packages/centos-release-ceph-jewel-1.0-1.el7.centos.noarch.rpm \
|
||||
http://mirror.centos.org/centos-7/7/extras/x86_64/Packages/centos-release-qemu-ev-1.0-1.el7.noarch.rpm \
|
||||
http://mirror.centos.org/centos-7/7/extras/x86_64/Packages/centos-release-virt-common-1-1.el7.centos.noarch.rpm \
|
||||
http://mirror.centos.org/centos-7/7/extras/x86_64/Packages/centos-release-storage-common-1-2.el7.centos.noarch.rpm \
|
||||
&& sed -i 's/\$releasever/7/g' /etc/yum.repos.d/CentOS-*.repo \
|
||||
&& rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7 \
|
||||
&& rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-Storage \
|
||||
&& rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-Virtualization \
|
||||
&& yum-config-manager --enable ol7_optional_latest ol7_addons \
|
||||
&& yum -y install \
|
||||
yum-plugin-priorities \
|
||||
&& yum clean all
|
||||
{% endblock %}
|
||||
|
||||
{% endif %}
|
||||
{# Endif for base_distro oraclelinux #}
|
||||
|
||||
#### END REPO ENABLEMENT
|
||||
|
||||
{# We are back to the basic if conditional here which is:
|
||||
if base_distro in ['centos', 'oraclelinux', 'rhel'] #}
|
||||
{% block base_redhat_binary_versionlock %}{% endblock %}
|
||||
{% if install_type == 'binary' %}
|
||||
{% set base_centos_binary_packages = [
|
||||
'sudo',
|
||||
'which',
|
||||
'python',
|
||||
'lvm2',
|
||||
'scsi-target-utils',
|
||||
'iproute',
|
||||
'iscsi-initiator-utils'
|
||||
] %}
|
||||
# Install base packages
|
||||
{{ macros.install_packages( base_centos_binary_packages | customizable("centos_binary_packages")) }}
|
||||
{% endif %}
|
||||
{# Endif for install_type binary #}
|
||||
|
||||
{% if install_type == 'source' %}
|
||||
|
||||
{% set base_centos_source_packages = [
|
||||
'curl',
|
||||
'sudo',
|
||||
'tar',
|
||||
'which',
|
||||
'lvm2',
|
||||
'scsi-target-utils',
|
||||
'iproute',
|
||||
'iscsi-initiator-utils'
|
||||
] %}
|
||||
# Update packages
|
||||
{{ macros.install_packages( base_centos_source_packages | customizable("centos_source_packages")) }}
|
||||
|
||||
{% endif %}
|
||||
{# endif for install type is source for RPM based distros #}
|
||||
{# endif for base_distro centos,oraclelinux,rhel #}
|
||||
{% elif base_distro in ['ubuntu', 'debian'] %}
|
||||
|
||||
RUN if [ $(awk -F '=' '/DISTRIB_RELEASE/{print $2}' /etc/lsb-release) != "{{ supported_distro_release }}" ]; then \
|
||||
echo "Only supported {{ supported_distro_release }} release on {{ base_distro }}"; false; fi
|
||||
|
||||
# Customize PS1 bash shell
|
||||
RUN cat /tmp/kolla_bashrc >> /etc/bash.bashrc
|
||||
|
||||
# This will prevent questions from being asked during the install
|
||||
ENV DEBIAN_FRONTEND noninteractive
|
||||
|
||||
# Reducing disk footprint
|
||||
COPY dpkg_reducing_disk_footprint /etc/dpkg/dpkg.cfg.d/dpkg_reducing_disk_footprint
|
||||
|
||||
# Need apt-transport-https BEFORE we replace sources.list or apt-get update wont work!
|
||||
RUN apt-get update \
|
||||
&& apt-get -y install --no-install-recommends apt-transport-https ca-certificates \
|
||||
&& apt-get clean
|
||||
|
||||
COPY sources.list.{{ base_distro }} /etc/apt/sources.list
|
||||
COPY apt_preferences.{{ base_distro }} /etc/apt/preferences
|
||||
|
||||
{% set base_apt_packages = [
|
||||
'apt-utils',
|
||||
'curl',
|
||||
'gawk',
|
||||
'iproute2',
|
||||
'kmod',
|
||||
'lvm2',
|
||||
'open-iscsi',
|
||||
'python',
|
||||
'sudo',
|
||||
'tgt']
|
||||
%}
|
||||
|
||||
{% if base_distro == 'ubuntu' %}
|
||||
{% set base_apt_keys = [
|
||||
'0xF1656F24C74CD1D8',
|
||||
'0x9334a25f8507efa5',
|
||||
'391A9AA2147192839E9DB0315EDB1B62EC4926EA',
|
||||
'430BDF5C56E7C94E848EE60C1C4CBDCDCD2EFD2A',
|
||||
'46095ACC8548582C1A2699A9D27D666CD88E42B4',
|
||||
'58118E89F3A912897C070ADBF76221572C52609D',
|
||||
'05CE15085FC09D18E99EFB22684A14CF2582E0C5',
|
||||
'418A7F2FB0E1E6E7EABF6FE8C2E73424D59097AB',
|
||||
] %}
|
||||
{% elif base_distro == 'debian' %}
|
||||
{% set base_apt_keys = [
|
||||
'58118E89F3A912897C070ADBF76221572C52609D',
|
||||
'0xcbcb082a1bb943db',
|
||||
'D27D666CD88E42B4',
|
||||
'05CE15085FC09D18E99EFB22684A14CF2582E0C5',
|
||||
'418A7F2FB0E1E6E7EABF6FE8C2E73424D59097AB',
|
||||
] %}
|
||||
{% set base_apt_packages = base_apt_packages +
|
||||
['sudo',]
|
||||
%}
|
||||
{% endif %}
|
||||
|
||||
{% block base_ubuntu_package_installation %}
|
||||
RUN true \
|
||||
{% for key in base_apt_keys | customizable('apt_keys') %}
|
||||
&& apt-key adv --recv-keys --keyserver hkp://keyserver.ubuntu.com:80 {{ key }} \
|
||||
{% endfor %}
|
||||
&& apt-get update \
|
||||
&& apt-get -y upgrade \
|
||||
&& apt-get -y dist-upgrade \
|
||||
&& apt-get -y install --no-install-recommends {% for package in base_apt_packages | customizable('apt_packages') %}{{ package }} {% endfor %} \
|
||||
&& apt-get clean
|
||||
{% endblock %}
|
||||
|
||||
{% if base_distro == 'ubuntu' %}
|
||||
RUN sed -i "s|'purelib': '\$base/local/lib/python\$py_version_short/dist-packages',|'purelib': '\$base/lib/python\$py_version_short/dist-packages',|;s|'platlib': '\$platbase/local/lib/python\$py_version_short/dist-packages',|'platlib': '\$platbase/lib/python\$py_version_short/dist-packages',|;s|'headers': '\$base/local/include/python\$py_version_short/\$dist_name',|'headers': '\$base/include/python\$py_version_short/\$dist_name',|;s|'scripts': '\$base/local/bin',|'scripts': '\$base/bin',|;s|'data' : '\$base/local',|'data' : '\$base',|" /usr/lib/python2.7/distutils/command/install.py \
|
||||
&& rm -rf /usr/lib/python2.7/site-packages \
|
||||
&& ln -s dist-packages /usr/lib/python2.7/site-packages
|
||||
{% endif %}
|
||||
|
||||
{# endif for base_distro ubuntu, debian #}
|
||||
{% endif %}
|
||||
|
||||
COPY set_configs.py /usr/local/bin/kolla_set_configs
|
||||
COPY start.sh /usr/local/bin/kolla_start
|
||||
COPY sudoers /etc/sudoers
|
||||
COPY curlrc /root/.curlrc
|
||||
RUN touch /usr/local/bin/kolla_extend_start \
|
||||
&& chmod 755 /usr/local/bin/kolla_start /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_set_configs \
|
||||
&& chmod 440 /etc/sudoers \
|
||||
&& groupadd kolla \
|
||||
&& mkdir -p /var/log/kolla \
|
||||
&& chown :kolla /var/log/kolla \
|
||||
&& chmod 2775 /var/log/kolla \
|
||||
&& rm -f /tmp/kolla_bashrc \
|
||||
&& curl -sSL https://github.com/Yelp/dumb-init/releases/download/v1.1.3/dumb-init_1.1.3_amd64 -o /usr/local/bin/dumb-init \
|
||||
&& chmod +x /usr/local/bin/dumb-init
|
||||
|
||||
{% block base_footer %}{% endblock %}
|
||||
CMD ["kolla_start"]
|
||||
@ -1,5 +0,0 @@
|
||||
[mariadb]
|
||||
name = MariaDB
|
||||
baseurl = http://yum.mariadb.org/10.0/centos7-amd64
|
||||
gpgkey = http://yum.mariadb.org/RPM-GPG-KEY-MariaDB
|
||||
gpgcheck = 1
|
||||
@ -1,19 +0,0 @@
|
||||
Package: *
|
||||
Pin: origin "nyc2.mirrors.digitalocean.com"
|
||||
Pin-Priority: 500
|
||||
|
||||
Package: python-rtslib
|
||||
Pin: release o=Debian,a=testing,n=stretch,l=Debian
|
||||
Pin-Priority: 500
|
||||
|
||||
Package: targetcli
|
||||
Pin: release o=Debian,a=testing,n=stretch,l=Debian
|
||||
Pin-Priority: 500
|
||||
|
||||
Package: python-configshell
|
||||
Pin: release o=Debian,a=testing,n=stretch,l=Debian
|
||||
Pin-Priority: 500
|
||||
|
||||
Package: *
|
||||
Pin: release o=Debian,a=testing,n=stretch,l=Debian
|
||||
Pin-Priority: -1
|
||||
@ -1,4 +0,0 @@
|
||||
# curl default options
|
||||
--silent
|
||||
--show-error
|
||||
--write-out "curl (%{url_effective}): response: %{http_code}, time: %{time_total}, size: %{size_download}\n"
|
||||
@ -1,9 +0,0 @@
|
||||
path-exclude /usr/share/doc/*
|
||||
path-include /usr/share/doc/*/copyright
|
||||
path-exclude /usr/share/man/*
|
||||
path-exclude /usr/share/groff/*
|
||||
path-exclude /usr/share/info/*
|
||||
path-exclude /usr/share/lintian/*
|
||||
path-exclude /usr/share/linda/*
|
||||
path-exclude /usr/share/locale/*
|
||||
path-include /usr/share/locale/en*
|
||||
@ -1,6 +0,0 @@
|
||||
[elasticsearch-2.x]
|
||||
name=Elasticsearch repository for 2.x packages
|
||||
baseurl=http://packages.elastic.co/elasticsearch/2.x/centos
|
||||
gpgcheck=1
|
||||
gpgkey=http://packages.elastic.co/GPG-KEY-elasticsearch
|
||||
enabled=1
|
||||
@ -1,7 +0,0 @@
|
||||
[grafana]
|
||||
name=grafana
|
||||
baseurl=https://packagecloud.io/grafana/stable/el/7/$basearch
|
||||
repo_gpgcheck=1
|
||||
enabled=1
|
||||
gpgcheck=1
|
||||
gpgkey=https://packagecloud.io/gpg.key https://grafanarel.s3.amazonaws.com/RPM-GPG-KEY-grafana
|
||||
@ -1,6 +0,0 @@
|
||||
[influxdb]
|
||||
name = InfluxDB Repository - RHEL $releasever
|
||||
baseurl = https://repos.influxdata.com/rhel/$releasever/$basearch/stable
|
||||
enabled = 1
|
||||
gpgcheck = 1
|
||||
gpgkey = https://repos.influxdata.com/influxdb.key
|
||||
@ -1,6 +0,0 @@
|
||||
[kibana-4.6]
|
||||
name=Kibana repository for 4.6.x packages
|
||||
baseurl=http://packages.elastic.co/kibana/4.6/centos
|
||||
gpgcheck=1
|
||||
gpgkey=http://packages.elastic.co/GPG-KEY-elasticsearch
|
||||
enabled=1
|
||||
@ -1,5 +0,0 @@
|
||||
#### Custom data added by Kolla
|
||||
_KBOLD="\[$(tput bold)\]"
|
||||
_KRESET="\[$(tput sgr0)\]"
|
||||
|
||||
PS1="${_KBOLD}(${KOLLA_SERVICE_NAME})${_KRESET}[\u@\h \W]\\$ "
|
||||
@ -1,6 +0,0 @@
|
||||
[extras]
|
||||
name=CentOS-$releasever - Extras
|
||||
mirrorlist=http://mirrorlist.centos.org/?release=7&arch=$basearch&repo=extras&infra=$infra
|
||||
#baseurl=http://mirror.centos.org/centos/7/extras/$basearch/
|
||||
gpgcheck=1
|
||||
gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-7
|
||||
@ -1,308 +0,0 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
import argparse
|
||||
import glob
|
||||
import grp
|
||||
import json
|
||||
import logging
|
||||
import os
|
||||
import pwd
|
||||
import shutil
|
||||
import sys
|
||||
|
||||
|
||||
# TODO(rhallisey): add docstring.
|
||||
logging.basicConfig()
|
||||
LOG = logging.getLogger(__name__)
|
||||
LOG.setLevel(logging.INFO)
|
||||
|
||||
|
||||
def validate_config(config):
|
||||
config_files_required_keys = {'source', 'dest', 'owner', 'perm'}
|
||||
permissions_required_keys = {'path', 'owner'}
|
||||
|
||||
if 'command' not in config:
|
||||
LOG.error('Config is missing required "command" key')
|
||||
sys.exit(1)
|
||||
|
||||
# Validate config sections
|
||||
for data in config.get('config_files', list()):
|
||||
# Verify required keys exist.
|
||||
if not data.viewkeys() >= config_files_required_keys:
|
||||
LOG.error("Config is missing required keys: %s", data)
|
||||
sys.exit(1)
|
||||
for data in config.get('permissions', list()):
|
||||
if not data.viewkeys() >= permissions_required_keys:
|
||||
LOG.error("Config is missing required keys: %s", data)
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
def validate_source(data):
|
||||
source = data.get('source')
|
||||
|
||||
# Only check existance if no wildcard found
|
||||
if '*' not in source:
|
||||
if not os.path.exists(source):
|
||||
if data.get('optional'):
|
||||
LOG.info("%s does not exist, but is not required", source)
|
||||
return False
|
||||
else:
|
||||
LOG.error("The source to copy does not exist: %s", source)
|
||||
sys.exit(1)
|
||||
|
||||
return True
|
||||
|
||||
|
||||
def copy_files(data):
|
||||
dest = data.get('dest')
|
||||
source = data.get('source')
|
||||
|
||||
if os.path.exists(dest):
|
||||
LOG.info("Removing existing destination: %s", dest)
|
||||
if os.path.isdir(dest):
|
||||
shutil.rmtree(dest)
|
||||
else:
|
||||
os.remove(dest)
|
||||
|
||||
if os.path.isdir(source):
|
||||
source_path = source
|
||||
dest_path = dest
|
||||
else:
|
||||
source_path = os.path.dirname(source)
|
||||
dest_path = os.path.dirname(dest)
|
||||
|
||||
if not os.path.exists(dest_path):
|
||||
LOG.info("Creating dest parent directory: %s", dest_path)
|
||||
os.makedirs(dest_path)
|
||||
|
||||
if source != source_path:
|
||||
# Source is file
|
||||
for file in glob.glob(source):
|
||||
LOG.info("Copying %s to %s", file, dest)
|
||||
shutil.copy(file, dest)
|
||||
else:
|
||||
# Source is a directory
|
||||
for src in os.listdir(source_path):
|
||||
LOG.info("Copying %s to %s",
|
||||
os.path.join(source_path, src), dest_path)
|
||||
|
||||
if os.path.isdir(os.path.join(source_path, src)):
|
||||
shutil.copytree(os.path.join(source_path, src), dest_path)
|
||||
else:
|
||||
shutil.copy(os.path.join(source_path, src), dest_path)
|
||||
|
||||
|
||||
def set_permissions(data):
|
||||
def set_perms(file_, uid, guid, perm):
|
||||
LOG.info("Setting permissions for %s", file_)
|
||||
# Give config file proper perms.
|
||||
try:
|
||||
os.chown(file_, uid, gid)
|
||||
os.chmod(file_, perm)
|
||||
except OSError as e:
|
||||
LOG.error("Error while setting permissions for %s: %r",
|
||||
file_, repr(e))
|
||||
sys.exit(1)
|
||||
|
||||
dest = data.get('dest')
|
||||
owner = data.get('owner')
|
||||
perm = int(data.get('perm'), 0)
|
||||
|
||||
# Check for user and group id in the environment.
|
||||
try:
|
||||
user = pwd.getpwnam(owner)
|
||||
except KeyError:
|
||||
LOG.error("The specified user does not exist: %s", owner)
|
||||
sys.exit(1)
|
||||
|
||||
uid = user.pw_uid
|
||||
gid = user.pw_gid
|
||||
|
||||
# Set permissions on the top level dir or file
|
||||
set_perms(dest, uid, gid, perm)
|
||||
if os.path.isdir(dest):
|
||||
# Recursively set permissions
|
||||
for root, dirs, files in os.walk(dest):
|
||||
for dir_ in dirs:
|
||||
set_perms(os.path.join(root, dir_), uid, gid, perm)
|
||||
for file_ in files:
|
||||
set_perms(os.path.join(root, file_), uid, gid, perm)
|
||||
|
||||
|
||||
def load_config():
|
||||
def load_from_env():
|
||||
config_raw = os.environ.get("KOLLA_CONFIG")
|
||||
if config_raw is None:
|
||||
return None
|
||||
|
||||
# Attempt to read config
|
||||
try:
|
||||
return json.loads(config_raw)
|
||||
except ValueError:
|
||||
LOG.error('Invalid json for Kolla config')
|
||||
sys.exit(1)
|
||||
|
||||
def load_from_file():
|
||||
config_file = '/var/lib/kolla/config_files/config.json'
|
||||
LOG.info("Loading config file at %s", config_file)
|
||||
|
||||
# Attempt to read config file
|
||||
with open(config_file) as f:
|
||||
try:
|
||||
return json.load(f)
|
||||
except ValueError:
|
||||
LOG.error("Invalid json file found at %s", config_file)
|
||||
sys.exit(1)
|
||||
except IOError as e:
|
||||
LOG.error("Could not read file %s: %r", config_file, e)
|
||||
sys.exit(1)
|
||||
|
||||
config = load_from_env()
|
||||
if config is None:
|
||||
config = load_from_file()
|
||||
|
||||
LOG.info('Validating config file')
|
||||
validate_config(config)
|
||||
return config
|
||||
|
||||
|
||||
def copy_config(config):
|
||||
if 'config_files' in config:
|
||||
LOG.info('Copying service configuration files')
|
||||
for data in config['config_files']:
|
||||
if validate_source(data):
|
||||
copy_files(data)
|
||||
set_permissions(data)
|
||||
else:
|
||||
LOG.debug('No files to copy found in config')
|
||||
|
||||
LOG.info('Writing out command to execute')
|
||||
LOG.debug("Command is: %s", config['command'])
|
||||
# The value from the 'command' key will be written to '/run_command'
|
||||
with open('/run_command', 'w+') as f:
|
||||
f.write(config['command'])
|
||||
|
||||
|
||||
def handle_permissions(config):
|
||||
for permission in config.get('permissions', list()):
|
||||
path = permission.get('path')
|
||||
owner = permission.get('owner')
|
||||
recurse = permission.get('recurse', False)
|
||||
|
||||
if ':' in owner:
|
||||
user, group = owner.split(':', 1)
|
||||
if not group:
|
||||
group = user
|
||||
else:
|
||||
user, group = owner, owner
|
||||
|
||||
uid = pwd.getpwnam(user).pw_uid
|
||||
gid = grp.getgrnam(group).gr_gid
|
||||
|
||||
def set_perms(path, uid, gid):
|
||||
LOG.info('Setting permission for %s', path)
|
||||
os.chown(path, uid, gid)
|
||||
|
||||
for dest in glob.glob(path):
|
||||
set_perms(dest, uid, gid)
|
||||
if recurse and os.path.isdir(dest):
|
||||
for root, dirs, files in os.walk(dest):
|
||||
for dir_ in dirs:
|
||||
set_perms(os.path.join(root, dir_), uid, gid)
|
||||
for file_ in files:
|
||||
set_perms(os.path.join(root, file_), uid, gid)
|
||||
|
||||
|
||||
def execute_config_strategy():
|
||||
config_strategy = os.environ.get("KOLLA_CONFIG_STRATEGY")
|
||||
LOG.info("Kolla config strategy set to: %s", config_strategy)
|
||||
config = load_config()
|
||||
|
||||
if config_strategy == "COPY_ALWAYS":
|
||||
copy_config(config)
|
||||
handle_permissions(config)
|
||||
elif config_strategy == "COPY_ONCE":
|
||||
if os.path.exists('/configured'):
|
||||
LOG.info("The config strategy prevents copying new configs")
|
||||
sys.exit(0)
|
||||
else:
|
||||
copy_config(config)
|
||||
handle_permissions(config)
|
||||
os.mknod('/configured')
|
||||
else:
|
||||
LOG.error('KOLLA_CONFIG_STRATEGY is not set properly')
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
def execute_config_check():
|
||||
config = load_config()
|
||||
for config_file in config.get('config_files', {}):
|
||||
source = config_file.get('source')
|
||||
dest = config_file.get('dest')
|
||||
perm = config_file.get('perm')
|
||||
owner = config_file.get('owner')
|
||||
optional = config_file.get('optional', False)
|
||||
if not os.path.exists(dest):
|
||||
if optional:
|
||||
LOG.info('Dest file does not exist, but is optional: %s',
|
||||
dest)
|
||||
return
|
||||
else:
|
||||
LOG.error('Dest file does not exist and is: %s', dest)
|
||||
sys.exit(1)
|
||||
# check content
|
||||
with open(source) as fp1, open(dest) as fp2:
|
||||
if fp1.read() != fp2.read():
|
||||
LOG.error('The content of source file(%s) and'
|
||||
' dest file(%s) are not equal.', source, dest)
|
||||
sys.exit(1)
|
||||
# check perm
|
||||
file_stat = os.stat(dest)
|
||||
actual_perm = oct(file_stat.st_mode)[-4:]
|
||||
if perm != actual_perm:
|
||||
LOG.error('Dest file does not have expected perm: %s, actual: %s',
|
||||
perm, actual_perm)
|
||||
sys.exit(1)
|
||||
# check owner
|
||||
actual_user = pwd.getpwuid(file_stat.st_uid)
|
||||
if actual_user.pw_name != owner:
|
||||
LOG.error('Dest file does not have expected user: %s, actual: %s ',
|
||||
owner, actual_user.pw_name)
|
||||
sys.exit(1)
|
||||
LOG.info('The config files are in the expected state')
|
||||
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument('--check',
|
||||
action='store_true',
|
||||
required=False,
|
||||
help='Check whether the configs changed')
|
||||
conf = parser.parse_args()
|
||||
|
||||
if conf.check:
|
||||
execute_config_check()
|
||||
else:
|
||||
execute_config_strategy()
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
try:
|
||||
exit_code = main()
|
||||
except Exception:
|
||||
exit_code = 1
|
||||
LOG.exception('Unexpected error:')
|
||||
sys.exit(exit_code)
|
||||
@ -1,32 +0,0 @@
|
||||
# Default repos
|
||||
deb http://httpredir.debian.org/debian jessie main
|
||||
|
||||
# jessie-backports
|
||||
deb http://httpredir.debian.org/debian jessie-backports main contrib
|
||||
|
||||
# jessie-updates, previously known as 'volatile'
|
||||
deb http://httpredir.debian.org/debian jessie-updates main
|
||||
|
||||
# debian security updates
|
||||
deb http://security.debian.org jessie/updates main
|
||||
|
||||
# need some packages from testing not available in stable
|
||||
deb http://httpredir.debian.org/debian stretch main
|
||||
|
||||
# Ceph repo
|
||||
deb http://download.ceph.com/debian-jewel/ jessie main
|
||||
|
||||
# Maria DB repo
|
||||
deb [arch=amd64,i386] http://nyc2.mirrors.digitalocean.com/mariadb/repo/10.0/debian jessie main
|
||||
|
||||
# Kibana repo
|
||||
deb http://packages.elastic.co/kibana/4.6/debian stable main
|
||||
|
||||
# docker
|
||||
deb http://apt.dockerproject.org/repo debian-jessie main
|
||||
|
||||
# InfluxDB repo
|
||||
deb https://repos.influxdata.com/debian jessie stable
|
||||
|
||||
# Grafana repo
|
||||
deb https://packagecloud.io/grafana/stable/debian/ jessie main
|
||||
@ -1,32 +0,0 @@
|
||||
# Default repos
|
||||
deb http://archive.ubuntu.com/ubuntu/ xenial main restricted universe multiverse
|
||||
deb http://archive.ubuntu.com/ubuntu/ xenial-updates main restricted universe multiverse
|
||||
deb http://archive.ubuntu.com/ubuntu/ xenial-security main restricted universe multiverse
|
||||
|
||||
# Backports have a lower priority and must be explicitly installed to be used
|
||||
deb http://archive.ubuntu.com/ubuntu/ xenial-backports main restricted universe multiverse
|
||||
|
||||
# We need to add the Newton repo for the updated packages they provide. The main
|
||||
# ones are qemu, libvirt, and openvswitch.
|
||||
deb http://ubuntu-cloud.archive.canonical.com/ubuntu xenial-updates/newton main
|
||||
|
||||
# MariaDB 10.0 repo
|
||||
deb http://nyc2.mirrors.digitalocean.com/mariadb/repo/10.0/ubuntu xenial main
|
||||
|
||||
# Percona repo (for xtrabackup)
|
||||
deb http://repo.percona.com/apt xenial main
|
||||
|
||||
# Elastic repo
|
||||
deb http://packages.elastic.co/elasticsearch/2.x/debian stable main
|
||||
|
||||
# Kibana repo
|
||||
deb http://packages.elastic.co/kibana/4.6/debian stable main
|
||||
|
||||
# Docker repo
|
||||
deb http://apt.dockerproject.org/repo ubuntu-xenial main
|
||||
|
||||
# InfluxDB repo
|
||||
deb https://repos.influxdata.com/ubuntu xenial stable
|
||||
|
||||
# Grafana repo
|
||||
deb https://packagecloud.io/grafana/stable/debian/ jessie main
|
||||
@ -1,24 +0,0 @@
|
||||
#!/usr/local/bin/dumb-init /bin/bash
|
||||
set -o errexit
|
||||
|
||||
# Wait for the log socket
|
||||
if [[ ! "${!SKIP_LOG_SETUP[@]}" && -e /var/lib/kolla/heka ]]; then
|
||||
while [[ ! -S /var/lib/kolla/heka/log ]]; do
|
||||
sleep 1
|
||||
done
|
||||
fi
|
||||
|
||||
# Processing /var/lib/kolla/config_files/config.json as root. This is necessary
|
||||
# to permit certain files to be controlled by the root user which should
|
||||
# not be writable by the dropped-privileged user, especially /run_command
|
||||
sudo -E kolla_set_configs
|
||||
CMD=$(cat /run_command)
|
||||
ARGS=""
|
||||
|
||||
if [[ ! "${!KOLLA_SKIP_EXTEND_START[@]}" ]]; then
|
||||
# Run additional commands if present
|
||||
. kolla_extend_start
|
||||
fi
|
||||
|
||||
echo "Running command: '${CMD}${ARGS:+ $ARGS}'"
|
||||
exec ${CMD} ${ARGS}
|
||||
@ -1,18 +0,0 @@
|
||||
# The idea here is a container service adds their UID to the kolla group
|
||||
# via usermod -a -G kolla <uid>. Then the kolla_start may run
|
||||
# kolla_set_configs via sudo as the root user which is necessary to protect
|
||||
# the immutability of the container
|
||||
|
||||
# anyone in the kolla group may sudo -E (set the environment)
|
||||
Defaults: %kolla setenv
|
||||
|
||||
# root may run any commands via sudo as the network seervice user. This is
|
||||
# neededfor database migrations of existing services which have not been
|
||||
# converted to run as a non-root user, but instead do that via sudo -E glance
|
||||
root ALL=(ALL) ALL
|
||||
|
||||
# anyone in the kolla group may run /usr/local/bin/kolla_set_configs as the
|
||||
# root user via sudo without password confirmation
|
||||
%kolla ALL=(root) NOPASSWD: /usr/local/bin/kolla_set_configs, /usr/bin/install
|
||||
|
||||
#includedir /etc/sudoers.d
|
||||
@ -1,66 +0,0 @@
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
import imp
|
||||
import json
|
||||
import mock
|
||||
import os.path
|
||||
import sys
|
||||
|
||||
from oslotest import base
|
||||
|
||||
# nasty: to import set_config (not a part of the kolla package)
|
||||
this_dir = os.path.dirname(sys.modules[__name__].__file__)
|
||||
set_configs_file = os.path.abspath(
|
||||
os.path.join(this_dir, '..',
|
||||
'docker', 'base', 'set_configs.py'))
|
||||
|
||||
set_configs = imp.load_source('set_configs', set_configs_file)
|
||||
|
||||
|
||||
class LoadFromFile(base.BaseTestCase):
|
||||
|
||||
def test_load_ok(self):
|
||||
in_config = json.dumps({'command': '/bin/true',
|
||||
'config_files': {}})
|
||||
|
||||
mo = mock.mock_open(read_data=in_config)
|
||||
with mock.patch.object(set_configs, 'open', mo):
|
||||
config = set_configs.load_config()
|
||||
set_configs.copy_config(config)
|
||||
self.assertEqual([
|
||||
mock.call('/var/lib/kolla/config_files/config.json'),
|
||||
mock.call().__enter__(),
|
||||
mock.call().read(),
|
||||
mock.call().__exit__(None, None, None),
|
||||
mock.call('/run_command', 'w+'),
|
||||
mock.call().__enter__(),
|
||||
mock.call().write(u'/bin/true'),
|
||||
mock.call().__exit__(None, None, None)], mo.mock_calls)
|
||||
|
||||
|
||||
class LoadFromEnv(base.BaseTestCase):
|
||||
|
||||
def test_load_ok(self):
|
||||
in_config = json.dumps({'command': '/bin/true',
|
||||
'config_files': {}})
|
||||
|
||||
mo = mock.mock_open()
|
||||
with mock.patch.object(set_configs, 'open', mo):
|
||||
with mock.patch.dict('os.environ', {'KOLLA_CONFIG': in_config}):
|
||||
config = set_configs.load_config()
|
||||
set_configs.copy_config(config)
|
||||
self.assertEqual([mock.call('/run_command', 'w+'),
|
||||
mock.call().__enter__(),
|
||||
mock.call().write(u'/bin/true'),
|
||||
mock.call().__exit__(None, None, None)],
|
||||
mo.mock_calls)
|
||||
Loading…
Reference in New Issue
Block a user