blob: e699841f05c4df40a309d2ba22763cecdb9d1457 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
|
#!/bin/bash
#
# Used environment variables:
#
# - Hostname
# - FreeIPAIP
# - DirectoryManagerPassword
# - AdminPassword
# - UndercloudFQDN
# - HostsSecret
# - ProvisioningCIDR: If set, it adds the given CIDR to the provisioning
# interface (which is hardcoded to eth1)
# - UsingNovajoin: If unset, we pre-provision the service principals
# needed for the overcloud deploy. If set, we skip this,
# since novajoin will do it.
#
set -eux
if [ -f "~/freeipa-setup.env" ]; then
source ~/freeipa-setup.env
elif [ -f "/tmp/freeipa-setup.env" ]; then
source /tmp/freeipa-setup.env
fi
export Hostname=${Hostname:-""}
export FreeIPAIP=${FreeIPAIP:-""}
export DirectoryManagerPassword=${DirectoryManagerPassword:-""}
export AdminPassword=${AdminPassword:-""}
export UndercloudFQDN=${UndercloudFQDN:-""}
export HostsSecret=${HostsSecret:-""}
export ProvisioningCIDR=${ProvisioningCIDR:-""}
export UsingNovajoin=${UsingNovajoin:-""}
if [ -n "$ProvisioningCIDR" ]; then
# Add address to provisioning network interface
ip link set dev eth1 up
ip addr add $ProvisioningCIDR dev eth1
fi
# Set DNS servers
echo "nameserver 8.8.8.8" >> /etc/resolv.conf
echo "nameserver 8.8.4.4" >> /etc/resolv.conf
yum -q -y remove openstack-dashboard
# Install the needed packages
yum -q install -y ipa-server ipa-server-dns epel-release rng-tools mod_nss git
yum -q install -y haveged
# Prepare hostname
hostnamectl set-hostname --static $Hostname
echo $FreeIPAIP `hostname` | tee -a /etc/hosts
# Set iptables rules
cat << EOF > freeipa-iptables-rules.txt
# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
#TCP ports for FreeIPA
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 389 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 636 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 88 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 464 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 53 -j ACCEPT
#UDP ports for FreeIPA
-A INPUT -m state --state NEW -m udp -p udp --dport 88 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 464 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 123 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 53 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
EOF
iptables-restore < freeipa-iptables-rules.txt
# Entropy generation; otherwise, ipa-server-install will lag.
chkconfig haveged on
systemctl start haveged
# Remove conflicting httpd configuration
rm -f /etc/httpd/conf.d/ssl.conf
# Set up FreeIPA
ipa-server-install -U -r `hostname -d|tr "[a-z]" "[A-Z]"` \
-p $DirectoryManagerPassword -a $AdminPassword \
--hostname `hostname -f` \
--ip-address=$FreeIPAIP \
--setup-dns --auto-forwarders --auto-reverse
# Authenticate
echo $AdminPassword | kinit admin
# Verify we have TGT
klist
if [ "$?" = '1' ]; then
exit 1
fi
if [ -z "$UsingNovajoin" ]; then
# Create undercloud host
ipa host-add $UndercloudFQDN --password=$HostsSecret --force
# Create overcloud nodes and services
git clone https://github.com/JAORMX/freeipa-tripleo-incubator.git
cd freeipa-tripleo-incubator
python create_ipa_tripleo_host_setup.py -w $HostsSecret -d $(hostname -d) \
--controller-count 1 --compute-count 1
fi
|
