blob: af3d0a2bd82f969e779c55dca6e1fa4b25371c2c (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
|
#!/bin/bash
#
# Deploy a node using automated recipes. See discussion at
#
# - http://current.workingdirectory.net/posts/2011/puppet-without-masters/
# - http://andrewbunday.co.uk/2012/12/04/masterless-puppet-wrapper/
# - http://semicomplete.com/presentations/puppet-at-loggly/puppet-at-loggly.pdf.html
# - https://github.com/jordansissel/puppet-examples/tree/master/masterless
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as
# published by the Free Software Foundation, either version 3 of the
# License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public
# License along with this program. If not, see
# <http://www.gnu.org/licenses/>.
# Load
source $APP_BASE/lib/hydra/functions || exit 1
hydra_config_load
# Command line arguments
NODES="$*"
# Build node list
if [ -z "$NODES" ]; then
NODES="`hydra $HYDRA nodes`"
else
# Check if first param is a node name, otherwise assume its a class
if [ -z "$2" ] && [ "$1" != "localhost" ]; then
NODEFILE="$(basename `find $HYDRA_FOLDER/puppet/config/node/ -name $1'.*' | head -n 1` .yaml)"
# Check for config/node name
if [ "$NODEFILE" == ".yaml" ]; then
NODES="`hydra $HYDRA nodes $1`"
fi
fi
fi
# Deploy requirements
hydra_install_package ansible rsync
# Banner
#echo '.__ .___ .___ .__ ._.'
#echo '| |__ ___.__. __| _/___________ __| _/____ ______ | | ____ ___.__.| |'
#echo '| | < | |/ __ |\_ __ \__ \ / __ |/ __ \\____ \| | / _ < | || |'
#echo '| Y \___ / /_/ | | | \// __ \_ / /_/ \ ___/| |_> > |_( <_> )___ | \|'
#echo '|___| / ____\____ | |__| (____ / \____ |\___ > __/|____/\____// ____| __'
#echo ' \/\/ \/ \/ \/ \/|__| \/ \/'
#echo ''
#
# Deploy iterating over each node
#
for node in $NODES; do
if [ -d "$node" ]; then
echo "Deploying to $node folder..."
# Setup deploy environment
FOLDER=$node
hydra_deploy_setup folder $FOLDER || continue
# Make sure keys exists for this node
hydra $HYDRA newkeys new $FQDN
# Ensure key availability
hydra $HYDRA eyaml $FQDN
if ! sudo -n true; then
echo "Please set passwordless sudo on localhost."
continue
fi
# Check if puppet is installed
if [ ! -e "$FOLDER/usr/bin/puppet" ]; then
echo "Installing dependencies..."
$DEPLOY_COMMAND apt-get update
$DEPLOY_COMMAND DEBIAN_FRONTEND=noninteractive apt-get install $DEPLOY_DEPENDENCIES -y
fi
# Create folders
hydra_deploy_mkdirs
# Ensure we have a compatible hydra suite
#hydra $HYDRA install $node
DESTDIR="$FOLDER" hydractl install
# Sync repository to server
echo "Syncing configuration..."
$DEPLOY_RSYNC "$RSYNC_PATH" $DEPLOY_OPTS
# Copy keys
hydra_deploy_copy_keys folder
# Copy config configuration
hydra_deploy_copy_secrets folder
# Run puppet, overriding FQDN
echo "Applying configuration..."
LC_ALL=C HOSTNAME=$FQDN FACTER_domain=$DOMAIN FACTER_hostname=$FQDN FACTER_fqdn=$HOSTNAME.$DOMAIN $DEPLOY_APPLY 2>&1 | \
tee $HYDRA_FOLDER/puppet/logs/$FQDN.`date +%Y%m%d%H%M`.log
# Check if keys should be imported
if ! $SUDO test -f $FOLDER/root/.ssh/id_rsa || \
! $SUDO test -f $FOLDER/root/.config/borg/hydra/key || \
! $SUDO gpg --homedir=$FOLDER/root --list-secret-keys root@$FQDN &> /dev/null; then
echo "No $FOLDER/root/.ssh/id_rsa found. Please import it and other keys when the system is online using import-keys action"
fi
elif [ "$node" == "localhost" ] || [ "$node" == "`facter fqdn`" ] || [ "$node" == "`facter hostname`" ]; then
echo "Deploying to localhost..."
if ! sudo -n true; then
echo "Please set passwordless sudo on localhost."
continue
fi
# Setup deploy environment
hydra_deploy_setup || continue
# Make sure keys exists for this node
hydra $HYDRA newkeys new $FQDN
# Ensure key availability
hydra $HYDRA eyaml $FQDN
# Check if puppet is installed
if [ ! -e "/usr/bin/puppet" ]; then
$SUDO apt-get update
$SUDO apt-get install $DEPLOY_DEPENDENCIES -y
fi
# Ensure we have a compatible hydra suite
#hydra $HYDRA install $node
hydractl install
# Collect facts
hydra_deploy_facts_setup local
hydra_deploy_facts_collect local
# Run puppet
echo "Applying configuration..."
$DEPLOY_APPLY 2>&1 | \
tee $HYDRA_FOLDER/puppet/logs/$FQDN.`date +%Y%m%d%H%M`.log
# Fix ssl folder ownership
$SUDO chown -R `whoami`. $HYDRA_FOLDER/puppet/ssl
# Import keys if needed
if ! $SUDO test -f /root/.ssh/id_rsa || \
! $SUDO test -f /root/.config/borg/hydra/key || \
! $SUDO gpg --homedir=/root/.gnupg --list-secret-keys root@$FQDN &> /dev/null; then
hydra $HYDRA import-keys $FQDN
fi
else
echo "Deploying to $node..."
# Setup deploy environment
hydra_deploy_setup remote $node || continue
# Make sure keys exists for this node
hydra $HYDRA newkeys new $FQDN
# Ensure key availability
hydra $HYDRA eyaml $FQDN
# Check for passwordless connections
# http://stackoverflow.com/questions/3830508/check-if-passwordless-access-has-been-setup#3830680
if ! $HYDRA_CONNECT -o NumberOfPasswordPrompts=0 -o BatchMode=yes $FQDN true; then
echo "Unable to connect to $FQDN via SSH without a password."
echo "Check network connection to machine or set a passwordless login for your user at $FQDN using public key auth."
continue
fi
# Ensure we have a compatible hydra suite
hydra $HYDRA install $node
# Check remote environment
$HYDRA_CONNECT $FQDN <<EOF
##### BEGIN REMOTE SCRIPT #####
# Check for passwordless sudo
# See references like https://raymii.org/s/articles/Check_if_passwordless_sudo_can_be_used_in_a_bash_script_or_nagios_check.html
if ! sudo -n true; then
echo "Please set passwordless sudo on $FQDN."
echo "You can do that by adding the following line on /etc/sudoers.d/local:"
echo ""
echo "%sudo ALL=NOPASSWD: ALL"
echo ""
echo "And make sure your user is included in the 'sudo' group."
exit 1
fi
if [ "\$(hostname)" != "$FQDN" ]; then
echo "FQDN does not match:"
echo "Remote presents itself as \$(hostname) instead of $FQDN"
exit 1
fi
if ! which puppet &> /dev/null; then
echo "Installing dependencies..."
sudo apt-get update
sudo apt-get install $DEPLOY_DEPENDENCIES -y
fi
##### END REMOTE SCRIPT #######
EOF
# Check connection
if [ "$?" != "0" ]; then
echo "Error connecting or setting up $FQDN."
continue
fi
# Create folders
hydra_deploy_mkdirs
# Collect facts
hydra_deploy_facts_setup remote || continue
hydra_deploy_facts_collect remote || continue
# Sync repository to server
echo "Syncing configuration..."
$DEPLOY_RSYNC "$RSYNC_PATH" $DEPLOY_OPTS
# Check connection
if [ "$?" != "0" ]; then
echo "Error syncing to $FQDN."
continue
fi
# Copy keys
hydra_deploy_copy_keys remote || continue
# Copy configuration
hydra_deploy_copy_secrets remote || continue
# Run puppet
echo "Applying configuration..."
$DEPLOY_APPLY 2>&1 | \
tee $HYDRA_FOLDER/puppet/logs/$FQDN.`date +%Y%m%d%H%M`.log
# Import keys if needed
if ! $HYDRA_CONNECT $FQDN sudo test -f /root/.ssh/id_rsa || \
! $HYDRA_CONNECT $FQDN sudo test -f /root/.config/borg/hydra/key || \
! $HYDRA_CONNECT $FQDN sudo gpg --homedir=/root/.gnupg --list-secret-keys root@$FQDN &> /dev/null; then
hydra $HYDRA import-keys $FQDN
fi
fi
done
#
# Deploy using ansible's own iterator
#
if [ -e "$HYDRA_FOLDER/ansible/ansible.cfg" ]; then
# Command line arguments
NODES="$*"
# Build node list
#if [ -z "$NODES" ]; then
# #NODES="`BACKEND=ansible hydra $HYDRA nodes | xargs | sed -e "s/^/'~(/" -e "s/ /|/g" -e "s/$/)'/`"
# NODES="all"
#else
if [ ! -z "$NODES" ]; then
# Check if first param is a node name, otherwise assume its a class
if [ -z "$2" ] && [ "$1" != "localhost" ]; then
NODES="`BACKEND=ansible hydra $HYDRA nodes $1`"
if [ -z "$NODES" ]; then
NODES="`BACKEND=ansible hydra $HYDRA nodes $1'*'`"
fi
# It's a class
if [ ! -z "$NODES" ] && [ "`echo $NODES | wc -w`" != "1" ]; then
#NODES="`echo $NODES | xargs | sed -e "s/^/'~(/" -e "s/ /|/g" -e "s/$/)'/"`"
NODES="$*"
fi
# This can be handled directly by the ansible hosts file
# http://ansible.pickle.io/post/86598332429/running-ansible-playbook-in-localhost
#elif [ "$NODES" == "localhost" ]; then
# NODES="`cat /etc/hostname`"
fi
else
NODES="all"
fi
# Build ansible args
if [ ! -z "$SSH_USER" ]; then
# Avoid ESTABLISH SSH CONNECTION FOR USER: None (use -vvvv to check if you get this message)
# See https://stackoverflow.com/questions/35024576/establish-ssh-connection-for-user-none-when-specify-a-single-host-on-the-comman#40610316
ANSIBLE_ARGS="-e ansible_user=$SSH_USER"
else
ANSIBLE_ARGS="-e ansible_user=`whoami`"
fi
if [ ! -z "$NODES" ]; then
if [ "$NODES" == "all" ]; then
hydra $HYDRA ansible-playbook site.yml $ANSIBLE_ARGS
else
hydra $HYDRA ansible-playbook site.yml $ANSIBLE_ARGS --limit $NODES
fi
fi
fi
|