diff options
Diffstat (limited to 'xci')
| -rwxr-xr-x | xci/infra/bifrost/scripts/bifrost-provision.sh | 6 | ||||
| -rw-r--r-- | xci/installer/osa/playbooks/configure-opnfvhost.yml | 77 | ||||
| -rw-r--r-- | xci/installer/osa/playbooks/configure-targethosts.yml | 32 | ||||
| -rw-r--r-- | xci/playbooks/configure-localhost.yml | 36 | ||||
| -rw-r--r-- | xci/playbooks/manage-ssh-keys.yml | 47 |
5 files changed, 85 insertions, 113 deletions
diff --git a/xci/infra/bifrost/scripts/bifrost-provision.sh b/xci/infra/bifrost/scripts/bifrost-provision.sh index 2b849e34..95854e90 100755 --- a/xci/infra/bifrost/scripts/bifrost-provision.sh +++ b/xci/infra/bifrost/scripts/bifrost-provision.sh @@ -100,8 +100,10 @@ if [[ -e ${XCI_PATH}/deployment_image.qcow2 ]]; then sudo mv ${XCI_PATH}/deployment_image.qcow2* /httpboot/ fi -# Install missing dependencies -pip install -q --upgrade -r "$(dirname $0)/../requirements.txt" +# Install missing dependencies. Use sudo since for bifrost jobs +# the venv is not ready yet. +[[ -n ${VIRTUAL_ENV} ]] && _sudo="" || sudo="sudo -H -E" +${_sudo} pip install -q --upgrade -r "$(dirname $0)/../requirements.txt" # Change working directory cd $BIFROST_HOME/playbooks diff --git a/xci/installer/osa/playbooks/configure-opnfvhost.yml b/xci/installer/osa/playbooks/configure-opnfvhost.yml index a1e22a7d..35b17e55 100644 --- a/xci/installer/osa/playbooks/configure-opnfvhost.yml +++ b/xci/installer/osa/playbooks/configure-opnfvhost.yml @@ -43,15 +43,6 @@ proxy_settings_no_proxy: "{{ lookup('env','no_proxy') }}" tasks: - - name: Configure SSH key for root user - user: - name: root - generate_ssh_key: yes - ssh_key_bits: 2048 - ssh_key_comment: xci - ssh_key_type: rsa - state: present - - name: Copy releng-xci to remote host synchronize: src: "{{ xci_path }}/" @@ -136,6 +127,7 @@ - pyyaml - python-neutronclient - python-openstackclient + - pyOpenSSL - name: Install ARA callback plugin in OSA virtualenv pip: name: ara @@ -161,30 +153,26 @@ args: chdir: "{{openstack_osa_path}}/scripts" changed_when: True - - name: check if certificate directory /etc/ssl/certs exists already - stat: path=/etc/ssl/certs - register: check_etc_ssl_certs - - name: create certificate directory /etc/ssl/certs - file: - path: "/etc/ssl/certs" - state: directory - when: check_etc_ssl_certs.stat.exists == false - - name: create key directory /etc/ssl/private - file: - path: "/etc/ssl/private" - state: directory - - name: copy certificate to /etc/ssl/certs - copy: - src: "/etc/ssl/certs/xci.crt" - dest: "/etc/ssl/certs/" - - name: read remote key from /etc/ssl/private - set_fact: - xci_ssl_key: "{{ lookup('pipe', 'sudo cat /etc/ssl/private/xci.key' ) }}" - - name: copy key to /etc/ssl/private - copy: - content: "{{ xci_ssl_key }}" - dest: "/etc/ssl/private/xci.key" - become: true + + - name: Generate XCI private key + openssl_privatekey: + path: /etc/ssl/private/xci.key + size: 2048 + + - name: Generate XCI certificate request + openssl_csr: + privatekey_path: /etc/ssl/private/xci.key + path: /etc/ssl/private/xci.csr + common_name: "{{ xci_ssl_subject }}" + + - name: Generate XCI self signed certificate + openssl_certificate: + path: /etc/ssl/certs/xci.crt + privatekey_path: /etc/ssl/private/xci.key + csr_path: /etc/ssl/private/xci.csr + provider: selfsigned + selfsigned_not_after: 20800101000000Z + - name: fetch xci environment copy: src: "{{ xci_path }}/.cache/xci.env" @@ -210,24 +198,5 @@ dest: "{{ xci_path }}/.cache/openrc" flat: true - - name: Determine local user - become: no - local_action: command whoami - changed_when: False - register: _ansible_user - - - name: Fetch local SSH key - delegate_to: localhost - become: no - slurp: - src: "/home/{{ _ansible_user.stdout }}/.ssh/id_rsa.pub" - register: _local_ssh_key - - - name: Configure OPNFV authorized_keys file - authorized_key: - exclusive: yes - user: root - state: present - manage_dir: yes - comment: "{{ _ansible_user.stdout }} key" - key: "{{ _local_ssh_key['content'] | b64decode }}" + - name: Manage SSH keys + include_tasks: "{{ xci_path }}/xci/playbooks/manage-ssh-keys.yml" diff --git a/xci/installer/osa/playbooks/configure-targethosts.yml b/xci/installer/osa/playbooks/configure-targethosts.yml index b76a5950..cb817cfc 100644 --- a/xci/installer/osa/playbooks/configure-targethosts.yml +++ b/xci/installer/osa/playbooks/configure-targethosts.yml @@ -33,33 +33,5 @@ - xci_ceph_enabled == "true" - "'compute' in group_names" tasks: - - name: Determine local user - become: no - local_action: command whoami - changed_when: False - register: _ansible_user - - - name: Fetch local SSH key - delegate_to: localhost - become: no - slurp: - src: "/home/{{ _ansible_user.stdout }}/.ssh/id_rsa.pub" - register: _local_ssh_key - - - name: Fetch OPNFV SSH key - delegate_to: opnfv - slurp: - src: "{{ ansible_env.HOME }}/.ssh/id_rsa.pub" - register: _opnfv_ssh_key - - - name: "Configure {{ inventory_hostname }} authorized_keys file" - authorized_key: - exclusive: "{{ item.exclusive }}" - user: root - state: present - manage_dir: yes - key: "{{ item.key }}" - comment: "{{ item.comment }}" - with_items: - - { key: "{{ _local_ssh_key['content'] | b64decode }}", comment: "{{ _ansible_user.stdout }} key", exclusive: yes } - - { key: "{{ _opnfv_ssh_key['content'] | b64decode }}", comment: "opnfv host key", exclusive: no } + - name: Manage SSH keys + include_tasks: "{{ xci_path }}/xci/playbooks/manage-ssh-keys.yml" diff --git a/xci/playbooks/configure-localhost.yml b/xci/playbooks/configure-localhost.yml index 1f010528..5f091c92 100644 --- a/xci/playbooks/configure-localhost.yml +++ b/xci/playbooks/configure-localhost.yml @@ -69,34 +69,16 @@ path: "{{log_path}}" state: directory recurse: no - - block: - - name: check if certificate directory /etc/ssl/certs exists already - stat: path=/etc/ssl/certs - register: check_etc_ssl_certs - - name: create certificate directory /etc/ssl/certs - become: true - file: - path: "/etc/ssl/certs" - state: directory - when: check_etc_ssl_certs.stat.exists == false - - name: create key directory /etc/ssl/private - become: true - file: - path: "/etc/ssl/private" - state: directory - - name: generate self signed certificate - command: openssl req -new -nodes -x509 -subj "{{ xci_ssl_subject }}" -days 3650 -keyout "/etc/ssl/private/xci.key" -out "/etc/ssl/certs/xci.crt" -extensions v3_ca - become: true - - name: Synchronize local development OSA repository to XCI paths - # command module is much faster than the copy module - synchronize: - src: "{{ openstack_osa_dev_path }}" - dest: "{{ xci_cache }}/repos/openstack-ansible" - recursive: yes - delete: yes - when: - - openstack_osa_dev_path != "" + + - name: Synchronize local development OSA repository to XCI paths + # command module is much faster than the copy module + synchronize: + src: "{{ openstack_osa_dev_path }}" + dest: "{{ xci_cache }}/repos/openstack-ansible" + recursive: yes + delete: yes when: + - openstack_osa_dev_path != "" - installer_type == "osa" - name: Configure SSH key for local user diff --git a/xci/playbooks/manage-ssh-keys.yml b/xci/playbooks/manage-ssh-keys.yml new file mode 100644 index 00000000..ff797aad --- /dev/null +++ b/xci/playbooks/manage-ssh-keys.yml @@ -0,0 +1,47 @@ +# SPDX-license-identifier: Apache-2.0 +############################################################################## +# Copyright (c) 2018 SUSE Linux GmbH and others. +# All rights reserved. This program and the accompanying materials +# are made available under the terms of the Apache License, Version 2.0 +# which accompanies this distribution, and is available at +# http://www.apache.org/licenses/LICENSE-2.0 +############################################################################## +- name: Configure SSH key for root user + user: + name: root + generate_ssh_key: yes + ssh_key_bits: 2048 + ssh_key_comment: xci + ssh_key_type: rsa + state: present + +- name: Determine local user + become: no + local_action: command whoami + changed_when: False + register: _ansible_user + +- name: Fetch local SSH key + delegate_to: localhost + become: no + slurp: + src: "/home/{{ _ansible_user.stdout }}/.ssh/id_rsa.pub" + register: _local_ssh_key + +- name: Fetch OPNFV SSH key + delegate_to: opnfv + slurp: + src: "{{ ansible_env.HOME }}/.ssh/id_rsa.pub" + register: _opnfv_ssh_key + +- name: "Configure {{ inventory_hostname }} authorized_keys file" + authorized_key: + exclusive: "{{ item.exclusive }}" + user: root + state: present + manage_dir: yes + key: "{{ item.key }}" + comment: "{{ item.comment }}" + with_items: + - { key: "{{ _local_ssh_key['content'] | b64decode }}", comment: "{{ _ansible_user.stdout }} key", exclusive: yes } + - { key: "{{ _opnfv_ssh_key['content'] | b64decode }}", comment: "opnfv host key", exclusive: no } |