Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 unkinben
|
5e8cff921c |
@@ -409,45 +409,6 @@ profiles::ceph::client::mons:
|
||||
- 10.18.15.2
|
||||
- 10.18.15.3
|
||||
|
||||
# de96a98f cluster topology (prodnxsr0001-0019) - single source of truth for
|
||||
# /etc/ceph/ceph.conf rendered by profiles::ceph::client on the k8s (osd) and
|
||||
# incus (mon/mgr/mds) roles. fsid/mons are overridden per-role in the role hiera.
|
||||
# public_network is the /32 of every ceph host's ceph-public loopback.
|
||||
profiles::ceph::client::cluster_public_ips:
|
||||
- 198.18.23.1
|
||||
- 198.18.23.2
|
||||
- 198.18.23.3
|
||||
- 198.18.23.4
|
||||
- 198.18.23.5
|
||||
- 198.18.23.6
|
||||
- 198.18.23.7
|
||||
- 198.18.23.8
|
||||
- 198.18.23.9
|
||||
- 198.18.23.10
|
||||
- 198.18.23.11
|
||||
- 198.18.23.12
|
||||
- 198.18.23.13
|
||||
- 198.18.23.14
|
||||
- 198.18.23.15
|
||||
- 198.18.23.16
|
||||
- 198.18.23.17
|
||||
- 198.18.23.18
|
||||
- 198.18.23.19
|
||||
profiles::ceph::client::mon_initial_members:
|
||||
- prodnxsr0009
|
||||
- prodnxsr0010
|
||||
- prodnxsr0011
|
||||
- prodnxsr0012
|
||||
- prodnxsr0013
|
||||
# two mds daemon instances per mon/mgr/mds host (rendered only where
|
||||
# render_mds_config is true, i.e. the incus node role).
|
||||
profiles::ceph::client::mds_instances:
|
||||
prodnxsr0009: 2
|
||||
prodnxsr0010: 2
|
||||
prodnxsr0011: 2
|
||||
prodnxsr0012: 2
|
||||
prodnxsr0013: 2
|
||||
|
||||
profiles::ceph::conf::config:
|
||||
global:
|
||||
auth_client_required: 'cephx'
|
||||
|
||||
@@ -1,13 +0,0 @@
|
||||
---
|
||||
networking_loopback0_ip: 198.18.19.21 # management loopback
|
||||
networking_loopback1_ip: 198.18.22.14 # ceph-cluster loopback
|
||||
networking_loopback2_ip: 198.18.23.14 # ceph-public loopback
|
||||
networking_1000_ip: 198.18.15.14 # 1gbe network
|
||||
networking_2500_ip: 198.18.21.14 # 2.5gbe network
|
||||
networking_1000_iface: enp1s0
|
||||
networking_2500_iface: enp2s0
|
||||
networking::interfaces:
|
||||
"%{hiera('networking_1000_iface')}":
|
||||
mac: a4:bb:6d:a4:e5:c1
|
||||
"%{hiera('networking_2500_iface')}":
|
||||
mac: c4:62:37:0d:50:03
|
||||
@@ -1,13 +0,0 @@
|
||||
---
|
||||
networking_loopback0_ip: 198.18.19.22 # management loopback
|
||||
networking_loopback1_ip: 198.18.22.15 # ceph-cluster loopback
|
||||
networking_loopback2_ip: 198.18.23.15 # ceph-public loopback
|
||||
networking_1000_ip: 198.18.15.15 # 1gbe network
|
||||
networking_2500_ip: 198.18.21.15 # 2.5gbe network
|
||||
networking_1000_iface: enp1s0
|
||||
networking_2500_iface: enp2s0
|
||||
networking::interfaces:
|
||||
"%{hiera('networking_1000_iface')}":
|
||||
mac: a4:bb:6d:a6:30:c4
|
||||
"%{hiera('networking_2500_iface')}":
|
||||
mac: c4:62:37:0d:4f:f4
|
||||
@@ -1,13 +0,0 @@
|
||||
---
|
||||
networking_loopback0_ip: 198.18.19.23 # management loopback
|
||||
networking_loopback1_ip: 198.18.22.16 # ceph-cluster loopback
|
||||
networking_loopback2_ip: 198.18.23.16 # ceph-public loopback
|
||||
networking_1000_ip: 198.18.15.16 # 1gbe network
|
||||
networking_2500_ip: 198.18.21.16 # 2.5gbe network
|
||||
networking_1000_iface: enp1s0
|
||||
networking_2500_iface: enp2s0
|
||||
networking::interfaces:
|
||||
"%{hiera('networking_1000_iface')}":
|
||||
mac: a4:bb:6d:9f:22:13
|
||||
"%{hiera('networking_2500_iface')}":
|
||||
mac: c4:62:37:0d:50:0c
|
||||
@@ -1,13 +0,0 @@
|
||||
---
|
||||
networking_loopback0_ip: 198.18.19.24 # management loopback
|
||||
networking_loopback1_ip: 198.18.22.17 # ceph-cluster loopback
|
||||
networking_loopback2_ip: 198.18.23.17 # ceph-public loopback
|
||||
networking_1000_ip: 198.18.15.17 # 1gbe network
|
||||
networking_2500_ip: 198.18.21.17 # 2.5gbe network
|
||||
networking_1000_iface: enp1s0
|
||||
networking_2500_iface: enp2s0
|
||||
networking::interfaces:
|
||||
"%{hiera('networking_1000_iface')}":
|
||||
mac: 8c:04:ba:9c:b6:08
|
||||
"%{hiera('networking_2500_iface')}":
|
||||
mac: c4:62:37:0d:50:12
|
||||
@@ -1,13 +0,0 @@
|
||||
---
|
||||
networking_loopback0_ip: 198.18.19.25 # management loopback
|
||||
networking_loopback1_ip: 198.18.22.18 # ceph-cluster loopback
|
||||
networking_loopback2_ip: 198.18.23.18 # ceph-public loopback
|
||||
networking_1000_ip: 198.18.15.18 # 1gbe network
|
||||
networking_2500_ip: 198.18.21.18 # 2.5gbe network
|
||||
networking_1000_iface: enp1s0
|
||||
networking_2500_iface: enp2s0
|
||||
networking::interfaces:
|
||||
"%{hiera('networking_1000_iface')}":
|
||||
mac: a4:bb:6d:a4:db:94
|
||||
"%{hiera('networking_2500_iface')}":
|
||||
mac: c4:62:37:0d:4f:fa
|
||||
@@ -1,13 +0,0 @@
|
||||
---
|
||||
networking_loopback0_ip: 198.18.19.26 # management loopback
|
||||
networking_loopback1_ip: 198.18.22.19 # ceph-cluster loopback
|
||||
networking_loopback2_ip: 198.18.23.19 # ceph-public loopback
|
||||
networking_1000_ip: 198.18.15.19 # 1gbe network
|
||||
networking_2500_ip: 198.18.21.19 # 2.5gbe network
|
||||
networking_1000_iface: enp1s0
|
||||
networking_2500_iface: enp2s0
|
||||
networking::interfaces:
|
||||
"%{hiera('networking_1000_iface')}":
|
||||
mac: a4:bb:6d:a4:56:11
|
||||
"%{hiera('networking_2500_iface')}":
|
||||
mac: c4:62:37:0d:50:00
|
||||
@@ -203,9 +203,7 @@ profiles::accounts::sysadmin::extra_groups:
|
||||
- incus-admin
|
||||
|
||||
# manage cephfs mounts
|
||||
profiles::ceph::client::manage_ceph_conf: true
|
||||
# mon/mgr/mds host: render the [mds] + [mds.*] sections
|
||||
profiles::ceph::client::render_mds_config: true
|
||||
profiles::ceph::client::manage_ceph_conf: false
|
||||
profiles::ceph::client::manage_ceph_package: false
|
||||
profiles::ceph::client::manage_ceph_paths: false
|
||||
profiles::ceph::client::fsid: 'de96a98f-3d23-465a-a899-86d3d67edab8'
|
||||
|
||||
@@ -11,8 +11,6 @@ hiera_include:
|
||||
# manage rke2
|
||||
rke2::bootstrap_node: prodnxsr0001.main.unkin.net
|
||||
rke2::join_url: https://join-k8s.service.consul:9345
|
||||
# pull the airgap image bundle via artifactapi (host-reachable pre-CNI), not github directly
|
||||
rke2::container_archive_source: 'https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/rancher/rke2/releases/download'
|
||||
rke2::manage_registries: true
|
||||
rke2::registries:
|
||||
docker.io:
|
||||
@@ -92,7 +90,7 @@ profiles::packages::include:
|
||||
|
||||
profiles::selinux::setenforce::mode: disabled
|
||||
|
||||
profiles::ceph::client::manage_ceph_conf: true
|
||||
profiles::ceph::client::manage_ceph_conf: false
|
||||
profiles::ceph::client::manage_ceph_package: false
|
||||
profiles::ceph::client::manage_ceph_paths: false
|
||||
profiles::ceph::client::fsid: 'de96a98f-3d23-465a-a899-86d3d67edab8'
|
||||
|
||||
@@ -30,9 +30,6 @@ rke2::config_hash:
|
||||
- '--node-monitor-period=4s'
|
||||
protect-kernel-defaults: true
|
||||
disable-kube-proxy: false
|
||||
# taint the control-plane/etcd nodes so only tolerating workloads schedule here
|
||||
node-taint:
|
||||
- "node-role.kubernetes.io/control-plane=true:NoSchedule"
|
||||
|
||||
# configure consul service
|
||||
consul::services:
|
||||
|
||||
@@ -33,7 +33,7 @@ profiles::packages::include:
|
||||
|
||||
profiles::selinux::setenforce::mode: disabled
|
||||
|
||||
profiles::ceph::client::manage_ceph_conf: true
|
||||
profiles::ceph::client::manage_ceph_conf: false
|
||||
profiles::ceph::client::manage_ceph_package: false
|
||||
profiles::ceph::client::manage_ceph_paths: false
|
||||
profiles::ceph::client::fsid: 'de96a98f-3d23-465a-a899-86d3d67edab8'
|
||||
|
||||
@@ -47,18 +47,12 @@ profiles::helpers::certmanager::vault_config:
|
||||
|
||||
profiles::helpers::sshsignhost::vault_config:
|
||||
addr: 'https://vault.service.consul:8200'
|
||||
mount_point: 'sshca'
|
||||
mount_point: 'ssh-host-signer'
|
||||
approle_path: 'approle'
|
||||
role_name: 'signhost'
|
||||
role_name: 'hostrole'
|
||||
output_path: '/tmp/sshsignhost'
|
||||
role_id: "%{lookup('sshsignhost::role_id')}"
|
||||
|
||||
# Vault signing helpers, delivered as RPMs from the rpm-internal repo.
|
||||
profiles::packages::include:
|
||||
certmanager:
|
||||
ensure: '0.2.0'
|
||||
sshsignhost:
|
||||
ensure: '0.1.0'
|
||||
|
||||
profiles::puppet::server::agent_server: 'puppet.query.consul'
|
||||
profiles::puppet::server::report_server: 'puppet.query.consul'
|
||||
profiles::puppet::server::ca_server: 'puppetca.query.consul'
|
||||
|
||||
@@ -40,11 +40,3 @@ profiles::packages::include:
|
||||
ensure: '0.1.1'
|
||||
openbao-plugin-secrets-gitea:
|
||||
ensure: '0.1.0'
|
||||
openbao-plugin-secrets-apptoken:
|
||||
ensure: '0.1.0'
|
||||
openbao-plugin-secrets-netbox:
|
||||
ensure: '0.1.0'
|
||||
openbao-plugin-secrets-ghp:
|
||||
ensure: '0.1.0'
|
||||
openbao-plugin-secrets-arrstack:
|
||||
ensure: '0.2.0'
|
||||
|
||||
@@ -1,8 +1,3 @@
|
||||
---
|
||||
# physical hosts only (facts.virtual == 'physical'); merged 'unique' with the
|
||||
# common hiera_include in profiles::base.
|
||||
hiera_include:
|
||||
- profiles::lldpd
|
||||
|
||||
profiles::packages::include:
|
||||
"%{hiera('lm-sensors::package')}": {}
|
||||
|
||||
@@ -1,104 +0,0 @@
|
||||
# frozen_string_literal: true
|
||||
|
||||
require 'facter'
|
||||
require 'json'
|
||||
|
||||
# Exposes LLDP neighbour topology (switch/port each interface is cabled to) as
|
||||
# the structured `lldp` fact, keyed by local interface. This is the only source
|
||||
# of physical switch/port topology in the estate and feeds NetBox. Uses
|
||||
# `lldpctl -f json0`: json0 wraps every node in an array regardless of
|
||||
# cardinality, so one neighbour and many neighbours parse identically (plain
|
||||
# `keyvalue` folds the neighbour's sysname into the key path, and plain `json`
|
||||
# collapses single-element arrays into objects). Never raises: any error or a
|
||||
# down daemon yields an empty hash so a puppet run can never break.
|
||||
module LldpFact
|
||||
SOCKETS = ['/run/lldpd.socket', '/var/run/lldpd.socket'].freeze
|
||||
|
||||
module_function
|
||||
|
||||
# First element of a json0 node (everything is array-wrapped), or the value
|
||||
# itself if it is not an array; nil when absent.
|
||||
def first(node)
|
||||
node.is_a?(Array) ? node[0] : node
|
||||
end
|
||||
|
||||
# Array form of a json0 node whatever its cardinality.
|
||||
def list(node)
|
||||
node.is_a?(Array) ? node : [node].compact
|
||||
end
|
||||
|
||||
# Value string of a json0 leaf like [{ 'value' => 'x' }].
|
||||
def leaf(node)
|
||||
entry = first(node)
|
||||
entry.is_a?(Hash) ? entry['value'] : entry
|
||||
end
|
||||
|
||||
# Chassis MAC from its id list, preferring the entry typed 'mac'.
|
||||
def chassis_mac(chassis)
|
||||
ids = list(chassis['id'])
|
||||
mac = ids.find { |id| id.is_a?(Hash) && id['type'] == 'mac' } || ids.first
|
||||
mac.is_a?(Hash) ? mac['value'] : nil
|
||||
end
|
||||
|
||||
# Topology record for one local interface, or nil when it has no neighbour.
|
||||
def neighbour(iface)
|
||||
chassis = first(iface['chassis'])
|
||||
port = first(iface['port'])
|
||||
return nil unless chassis && port
|
||||
|
||||
chassis_fields(chassis).merge(port_fields(port, first(iface['vlan'])))
|
||||
end
|
||||
|
||||
def chassis_fields(chassis)
|
||||
{
|
||||
'neighbor_chassis_name' => leaf(chassis['name']),
|
||||
'neighbor_chassis_mac' => chassis_mac(chassis),
|
||||
'neighbor_chassis_descr' => leaf(chassis['descr'])
|
||||
}
|
||||
end
|
||||
|
||||
def port_fields(port, vlan)
|
||||
port_id = first(port['id'])
|
||||
vlan_h = vlan.is_a?(Hash) ? vlan : {}
|
||||
{
|
||||
'neighbor_port_id' => port_id.is_a?(Hash) ? port_id['value'] : port_id,
|
||||
'neighbor_port_descr' => leaf(port['descr']),
|
||||
'vlan_id' => vlan_h['vlan-id'],
|
||||
'vlan_name' => vlan_h['value']
|
||||
}
|
||||
end
|
||||
|
||||
def interfaces(output)
|
||||
lldp = first(JSON.parse(output)['lldp']) || {}
|
||||
list(lldp['interface'])
|
||||
end
|
||||
|
||||
# Map of local interface => topology record, skipping interfaces with no
|
||||
# neighbour.
|
||||
def collect(ifaces)
|
||||
ifaces.each_with_object({}) do |iface, acc|
|
||||
next unless iface.is_a?(Hash)
|
||||
|
||||
name = iface['name']
|
||||
data = neighbour(iface)
|
||||
acc[name] = data if name && data
|
||||
end
|
||||
end
|
||||
|
||||
def resolve
|
||||
output = Facter::Core::Execution.execute('lldpctl -f json0 2>/dev/null', on_fail: nil)
|
||||
return {} if output.to_s.empty?
|
||||
|
||||
collect(interfaces(output))
|
||||
rescue StandardError
|
||||
{}
|
||||
end
|
||||
end
|
||||
|
||||
Facter.add(:lldp) do
|
||||
confine kernel: 'Linux'
|
||||
confine { Facter.value(:is_virtual) == false }
|
||||
confine { Facter::Core::Execution.which('lldpctl') }
|
||||
confine { LldpFact::SOCKETS.any? { |path| File.exist?(path) } }
|
||||
setcode { LldpFact.resolve }
|
||||
end
|
||||
@@ -6,17 +6,10 @@ class rke2::install (
|
||||
Stdlib::HTTPUrl $container_archive_source = $rke2::container_archive_source,
|
||||
){
|
||||
|
||||
# versionlock rke2 before install so the lock exists before any upgrade is attempted
|
||||
# versionlock rke2
|
||||
yum::versionlock{"rke2-${node_type}":
|
||||
ensure => present,
|
||||
version => "${rke2_version}~${rke2_release}",
|
||||
before => Package["rke2-${node_type}"],
|
||||
}
|
||||
|
||||
# lock rke2-common (a strict = version dep) so the rolling latest channel can't drift it ahead of the pinned server/agent
|
||||
yum::versionlock{'rke2-common':
|
||||
ensure => present,
|
||||
version => "${rke2_version}~${rke2_release}",
|
||||
}
|
||||
|
||||
# install rke2
|
||||
@@ -34,10 +27,10 @@ class rke2::install (
|
||||
before => Service["rke2-${node_type}"],
|
||||
}
|
||||
|
||||
# preload the airgap bundle (has the default canal CNI images) so canal starts from disk, not the mirror VIP that needs flannel first
|
||||
# download required archive of containers
|
||||
archive { '/var/lib/rancher/rke2/agent/images/rke2-images.linux-amd64.tar.zst':
|
||||
ensure => present,
|
||||
source => "${container_archive_source}/v${rke2_version}%2B${rke2_release}/rke2-images.linux-amd64.tar.zst",
|
||||
source => "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/rancher/rke2/releases/download/v${rke2_version}%2B${rke2_release}/rke2-images.linux-amd64.tar.zst",
|
||||
require => [
|
||||
Package["rke2-${node_type}"],
|
||||
File['/var/lib/rancher/rke2/agent/images'],
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
# rke2 params
|
||||
class rke2::params (
|
||||
Enum['server', 'agent'] $node_type = 'agent',
|
||||
String $rke2_version = '1.33.13',
|
||||
String $rke2_release = 'rke2r2',
|
||||
String $rke2_version = '1.33.4',
|
||||
String $rke2_release = 'rke2r1',
|
||||
Stdlib::Absolutepath $config_file = '/etc/rancher/rke2/config.yaml',
|
||||
Hash $config_hash = {},
|
||||
Stdlib::HTTPSUrl $join_url = 'https://127.0.0.1:9345',
|
||||
|
||||
@@ -2,9 +2,6 @@
|
||||
class profiles::ceph::client (
|
||||
String $fsid,
|
||||
Array[Stdlib::Host] $mons,
|
||||
# cluster topology (single source of truth: hieradata/common.yaml)
|
||||
Array[Stdlib::Host] $cluster_public_ips,
|
||||
Array[Stdlib::Host] $mon_initial_members,
|
||||
Stdlib::Absolutepath $config_file = '/etc/ceph/ceph.conf',
|
||||
Boolean $manage_ceph_conf = true,
|
||||
Boolean $manage_ceph_package = true,
|
||||
@@ -13,24 +10,6 @@ class profiles::ceph::client (
|
||||
String $group = 'ceph',
|
||||
Stdlib::Filemode $mode = '0644',
|
||||
Hash $keyrings = {},
|
||||
# [global] tunables (defaults match the live hand-maintained ceph.conf)
|
||||
String $auth_client_required = 'cephx',
|
||||
String $auth_cluster_required = 'cephx',
|
||||
String $auth_service_required = 'cephx',
|
||||
Boolean $mon_allow_pool_delete = true,
|
||||
Boolean $ms_bind_ipv4 = true,
|
||||
Boolean $ms_bind_ipv6 = false,
|
||||
Integer $osd_crush_chooseleaf_type = 1,
|
||||
Integer $osd_pool_default_min_size = 2,
|
||||
Integer $osd_pool_default_size = 3,
|
||||
Integer $osd_pool_default_pg_num = 128,
|
||||
# mds config sections; only rendered on mon/mgr/mds hosts (render_mds_config)
|
||||
Boolean $render_mds_config = false,
|
||||
Hash[String, Integer] $mds_instances = {},
|
||||
Hash $mds_common = {
|
||||
'keyring' => '/var/lib/ceph/mds/ceph-$id/keyring',
|
||||
'mds_standby_replay' => true,
|
||||
},
|
||||
) {
|
||||
|
||||
# dont run this on proxmox nodes
|
||||
@@ -43,13 +22,6 @@ class profiles::ceph::client (
|
||||
}
|
||||
}
|
||||
|
||||
# only depend on the package when this class manages it; on the ceph
|
||||
# hosts the package is delivered by cephadm / profiles::packages instead.
|
||||
$config_require = $manage_ceph_package ? {
|
||||
true => Package['ceph-common'],
|
||||
default => undef,
|
||||
}
|
||||
|
||||
# manage the ceph directory
|
||||
if $manage_ceph_paths {
|
||||
file { '/etc/ceph':
|
||||
@@ -57,11 +29,11 @@ class profiles::ceph::client (
|
||||
owner => $owner,
|
||||
group => $group,
|
||||
mode => $mode,
|
||||
require => $config_require,
|
||||
require => Package['ceph-common'],
|
||||
}
|
||||
}
|
||||
|
||||
# render /etc/ceph/ceph.conf from cluster topology in hiera
|
||||
# create a basic client config
|
||||
if $manage_ceph_conf {
|
||||
file { $config_file:
|
||||
ensure => file,
|
||||
@@ -69,7 +41,7 @@ class profiles::ceph::client (
|
||||
group => $group,
|
||||
mode => $mode,
|
||||
content => template('profiles/ceph/client.conf.erb'),
|
||||
require => $config_require,
|
||||
require => Package['ceph-common'],
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -2,9 +2,6 @@ class profiles::ceph::osd (
|
||||
Boolean $ensure_running = true,
|
||||
) {
|
||||
|
||||
# tune the I/O scheduler on the disks backing ceph OSDs
|
||||
include profiles::ceph::osd_scheduler
|
||||
|
||||
if $ensure_running and $facts['is_ceph_osd'] {
|
||||
$facts['ceph_services']['osd'].each |String $svc| {
|
||||
service { $svc:
|
||||
|
||||
@@ -1,32 +0,0 @@
|
||||
class profiles::ceph::osd_scheduler (
|
||||
String[1] $scheduler = 'none',
|
||||
) {
|
||||
|
||||
$devices = $facts['ceph_osd_devices']
|
||||
|
||||
# no-op where the fact is absent/empty (VMs, non-OSD hosts have no ceph PVs)
|
||||
if $devices =~ Array[String[1], 1] {
|
||||
|
||||
# strip /dev/ so the rule matches the udev KERNEL sysname (e.g. sda)
|
||||
$kernel_names = $devices.map |$dev| { regsubst($dev, '^.*/', '') }
|
||||
$sysname_matches = $kernel_names.map |$name| { "--sysname-match=${name}" }
|
||||
|
||||
file { '/etc/udev/rules.d/60-ceph-osd-scheduler.rules':
|
||||
ensure => file,
|
||||
owner => 'root',
|
||||
group => 'root',
|
||||
mode => '0644',
|
||||
content => template('profiles/ceph/osd-scheduler.rules.erb'),
|
||||
notify => Exec['ceph-osd-scheduler-reload'],
|
||||
}
|
||||
|
||||
# apply immediately; udev re-applies on reboot and device re-add
|
||||
$trigger = "udevadm trigger --subsystem-match=block --action=change ${join($sysname_matches, ' ')}"
|
||||
|
||||
exec { 'ceph-osd-scheduler-reload':
|
||||
command => "udevadm control --reload-rules && ${trigger}",
|
||||
path => ['/usr/bin', '/bin', '/usr/sbin', '/sbin'],
|
||||
refreshonly => true,
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,28 +1,77 @@
|
||||
# profiles::helpers::certmanager
|
||||
#
|
||||
# renders the config.yaml read by the certmanager binary (RPM-installed)
|
||||
# wrapper class for python, pip and venv
|
||||
class profiles::helpers::certmanager (
|
||||
String $script_name = 'certmanager',
|
||||
Stdlib::AbsolutePath $base_path = "/opt/${script_name}",
|
||||
Stdlib::AbsolutePath $venv_path = "${base_path}/venv",
|
||||
Stdlib::AbsolutePath $config_path = "${base_path}/config.yaml",
|
||||
Hash $vault_config = {},
|
||||
String $owner = 'root',
|
||||
String $group = 'root',
|
||||
Boolean $systempkgs = false,
|
||||
String $version = 'system',
|
||||
Array[String[1]] $packages = ['requests', 'pyyaml'],
|
||||
){
|
||||
|
||||
file { $base_path:
|
||||
ensure => directory,
|
||||
mode => '0755',
|
||||
owner => $owner,
|
||||
group => $group,
|
||||
}
|
||||
if $::facts['python3_version'] {
|
||||
|
||||
file { $config_path:
|
||||
ensure => file,
|
||||
mode => '0660',
|
||||
owner => 'puppet',
|
||||
group => 'root',
|
||||
content => Sensitive(template("profiles/helpers/${script_name}_config.yaml.erb")),
|
||||
require => File[$base_path],
|
||||
$python_version = $version ? {
|
||||
'system' => $::facts['python3_version'],
|
||||
default => $version,
|
||||
}
|
||||
|
||||
# ensure the base_path exists
|
||||
file { $base_path:
|
||||
ensure => directory,
|
||||
mode => '0755',
|
||||
owner => $owner,
|
||||
group => $group,
|
||||
}
|
||||
|
||||
# create a venv
|
||||
python::pyvenv { $venv_path :
|
||||
ensure => present,
|
||||
version => $python_version,
|
||||
systempkgs => $systempkgs,
|
||||
venv_dir => $venv_path,
|
||||
owner => $owner,
|
||||
group => $group,
|
||||
require => File[$base_path],
|
||||
}
|
||||
|
||||
# install the required pip packages
|
||||
$packages.each |String $package| {
|
||||
python::pip { "${venv_path}_${package}":
|
||||
ensure => present,
|
||||
pkgname => $package,
|
||||
virtualenv => $venv_path,
|
||||
}
|
||||
}
|
||||
|
||||
# create the script from a template
|
||||
file { "${base_path}/${script_name}":
|
||||
ensure => file,
|
||||
mode => '0755',
|
||||
content => template("profiles/helpers/${script_name}.erb"),
|
||||
require => Python::Pyvenv[$venv_path],
|
||||
}
|
||||
|
||||
# create the config from a template
|
||||
file { $config_path:
|
||||
ensure => file,
|
||||
mode => '0660',
|
||||
owner => 'puppet',
|
||||
group => 'root',
|
||||
content => Sensitive(template("profiles/helpers/${script_name}_config.yaml.erb")),
|
||||
require => Python::Pyvenv[$venv_path],
|
||||
}
|
||||
|
||||
# create symbolic link in $PATH
|
||||
file { "/usr/local/bin/${script_name}":
|
||||
ensure => 'link',
|
||||
target => "${base_path}/${script_name}",
|
||||
require => File["${base_path}/${script_name}"],
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,28 +1,77 @@
|
||||
# profiles::helpers::sshsignhost
|
||||
#
|
||||
# renders the config.yaml read by the sshsignhost binary (RPM-installed)
|
||||
# wrapper class for python, pip and venv
|
||||
class profiles::helpers::sshsignhost (
|
||||
String $script_name = 'sshsignhost',
|
||||
Stdlib::AbsolutePath $base_path = "/opt/${script_name}",
|
||||
Stdlib::AbsolutePath $venv_path = "${base_path}/venv",
|
||||
Stdlib::AbsolutePath $config_path = "${base_path}/config.yaml",
|
||||
Hash $vault_config = {},
|
||||
String $owner = 'root',
|
||||
String $group = 'root',
|
||||
Boolean $systempkgs = false,
|
||||
String $version = 'system',
|
||||
Array[String[1]] $packages = ['requests', 'pyyaml'],
|
||||
){
|
||||
|
||||
file { $base_path:
|
||||
ensure => directory,
|
||||
mode => '0755',
|
||||
owner => $owner,
|
||||
group => $group,
|
||||
}
|
||||
if $::facts['python3_version'] {
|
||||
|
||||
file { $config_path:
|
||||
ensure => file,
|
||||
mode => '0660',
|
||||
owner => 'puppet',
|
||||
group => 'root',
|
||||
content => Sensitive(template("profiles/helpers/${script_name}_config.yaml.erb")),
|
||||
require => File[$base_path],
|
||||
$python_version = $version ? {
|
||||
'system' => $::facts['python3_version'],
|
||||
default => $version,
|
||||
}
|
||||
|
||||
# ensure the base_path exists
|
||||
file { $base_path:
|
||||
ensure => directory,
|
||||
mode => '0755',
|
||||
owner => $owner,
|
||||
group => $group,
|
||||
}
|
||||
|
||||
# create a venv
|
||||
python::pyvenv { $venv_path :
|
||||
ensure => present,
|
||||
version => $python_version,
|
||||
systempkgs => $systempkgs,
|
||||
venv_dir => $venv_path,
|
||||
owner => $owner,
|
||||
group => $group,
|
||||
require => File[$base_path],
|
||||
}
|
||||
|
||||
# install the required pip packages
|
||||
$packages.each |String $package| {
|
||||
python::pip { "${venv_path}_${package}":
|
||||
ensure => present,
|
||||
pkgname => $package,
|
||||
virtualenv => $venv_path,
|
||||
}
|
||||
}
|
||||
|
||||
# create the script from a template
|
||||
file { "${base_path}/${script_name}":
|
||||
ensure => file,
|
||||
mode => '0755',
|
||||
content => template("profiles/helpers/${script_name}.erb"),
|
||||
require => Python::Pyvenv[$venv_path],
|
||||
}
|
||||
|
||||
# create the config from a template
|
||||
file { $config_path:
|
||||
ensure => file,
|
||||
mode => '0660',
|
||||
owner => 'puppet',
|
||||
group => 'root',
|
||||
content => Sensitive(template("profiles/helpers/${script_name}_config.yaml.erb")),
|
||||
require => Python::Pyvenv[$venv_path],
|
||||
}
|
||||
|
||||
# create symbolic link in $PATH
|
||||
file { "/usr/local/bin/${script_name}":
|
||||
ensure => 'link',
|
||||
target => "${base_path}/${script_name}",
|
||||
require => File["${base_path}/${script_name}"],
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,33 +0,0 @@
|
||||
# profiles::lldpd
|
||||
#
|
||||
# Runs lldpd on physical hosts so each machine learns its switch/port topology
|
||||
# via LLDP. The `lldp` fact exposes that neighbour data for NetBox. Assigned
|
||||
# via hiera_include from hieradata/virtual/physical.yaml (physicals only); the
|
||||
# lldpd.service ships disabled, so it is explicitly enabled and started here.
|
||||
class profiles::lldpd (
|
||||
Boolean $enabled = true,
|
||||
String $package = 'lldpd',
|
||||
String $service = 'lldpd',
|
||||
){
|
||||
|
||||
if $enabled {
|
||||
package { $package:
|
||||
ensure => installed,
|
||||
}
|
||||
|
||||
service { $service:
|
||||
ensure => running,
|
||||
enable => true,
|
||||
subscribe => Package[$package],
|
||||
}
|
||||
} else {
|
||||
service { $service:
|
||||
ensure => stopped,
|
||||
enable => false,
|
||||
}
|
||||
|
||||
package { $package:
|
||||
ensure => absent,
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -60,11 +60,10 @@ class profiles::puppet::agent (
|
||||
require => Yumrepo[$use_yumrepo],
|
||||
}
|
||||
|
||||
# versionlock puppet-agent before install so the lock exists before any upgrade is attempted
|
||||
# versionlock puppet-agent
|
||||
yum::versionlock{$use_package:
|
||||
ensure => $agent_versionlock_ensure,
|
||||
version => $agent_versionlock_version,
|
||||
before => Package[$use_package],
|
||||
}
|
||||
}
|
||||
'Debian': {
|
||||
|
||||
@@ -122,6 +122,15 @@ class profiles::vault::server (
|
||||
]
|
||||
}
|
||||
|
||||
# go-plugin creates each secrets plugin's control socket as /tmp/pluginNNN;
|
||||
# systemd-tmpfiles-clean reaps files aged past the /tmp policy, severing the
|
||||
# socket of a long-lived plugin and orphaning the still-running process
|
||||
# (every request then fails: rpc Unavailable, dial unix /tmp/pluginNNN: no
|
||||
# such file). Exclude the sockets from cleaning for all plugins.
|
||||
systemd::tmpfile { 'openbao-plugin-sockets.conf':
|
||||
content => "x /tmp/plugin*\n",
|
||||
}
|
||||
|
||||
# ensure the vault audit log exists
|
||||
file { $audit_log:
|
||||
ensure => 'file',
|
||||
@@ -130,20 +139,6 @@ class profiles::vault::server (
|
||||
mode => '0600',
|
||||
}
|
||||
|
||||
# go-plugin creates each secrets plugin's control socket under TMPDIR
|
||||
# (/tmp/pluginNNN by default); systemd-tmpfiles-clean reaps aged /tmp files
|
||||
# and severs the socket of a long-lived plugin, orphaning the process. Point
|
||||
# TMPDIR at a per-start RuntimeDirectory on /run (tmpfs, no age cleanup).
|
||||
systemd::manage_dropin { 'plugin-tmpdir.conf':
|
||||
unit => 'vault.service',
|
||||
service_entry => {
|
||||
'RuntimeDirectory' => 'vault-plugins',
|
||||
'RuntimeDirectoryMode' => '0700',
|
||||
'Environment' => 'TMPDIR=/run/vault-plugins',
|
||||
},
|
||||
notify => Service['vault'],
|
||||
}
|
||||
|
||||
service { 'vault':
|
||||
ensure => true,
|
||||
enable => true,
|
||||
|
||||
@@ -1,28 +1,3 @@
|
||||
[global]
|
||||
auth_client_required = <%= @auth_client_required %>
|
||||
auth_cluster_required = <%= @auth_cluster_required %>
|
||||
auth_service_required = <%= @auth_service_required %>
|
||||
fsid = <%= @fsid %>
|
||||
mon_allow_pool_delete = <%= @mon_allow_pool_delete %>
|
||||
mon_initial_members = <%= @mon_initial_members.join(',') %>
|
||||
mon_host = <%= @mons.join(',') %>
|
||||
ms_bind_ipv4 = <%= @ms_bind_ipv4 %>
|
||||
ms_bind_ipv6 = <%= @ms_bind_ipv6 %>
|
||||
osd_crush_chooseleaf_type = <%= @osd_crush_chooseleaf_type %>
|
||||
osd_pool_default_min_size = <%= @osd_pool_default_min_size %>
|
||||
osd_pool_default_size = <%= @osd_pool_default_size %>
|
||||
osd_pool_default_pg_num = <%= @osd_pool_default_pg_num %>
|
||||
public_network = <%= @cluster_public_ips.map { |ip| "#{ip}/32" }.join(',') %>
|
||||
<% if @render_mds_config -%>
|
||||
|
||||
[mds]
|
||||
keyring = <%= @mds_common['keyring'] %>
|
||||
mds_standby_replay = <%= @mds_common['mds_standby_replay'] %>
|
||||
<% @mds_instances.sort.each do |host, count| -%>
|
||||
<% (1..count).each do |instance| -%>
|
||||
|
||||
[mds.<%= host %>-<%= instance %>]
|
||||
host = <%= host %>
|
||||
<% end -%>
|
||||
<% end -%>
|
||||
<% end -%>
|
||||
fsid = <%= @fsid %>
|
||||
mon_host = <%= @mons.join(' ') %>
|
||||
|
||||
@@ -1,5 +0,0 @@
|
||||
# Managed by puppet (profiles::ceph::osd_scheduler).
|
||||
# Set the I/O scheduler to <%= @scheduler %> on ceph OSD block devices.
|
||||
<% @kernel_names.sort.each do |dev| -%>
|
||||
ACTION=="add|change", SUBSYSTEM=="block", KERNEL=="<%= dev %>", ATTR{queue/scheduler}="<%= @scheduler %>"
|
||||
<% end -%>
|
||||
@@ -0,0 +1,102 @@
|
||||
#!<%= @venv_path %>/bin/python
|
||||
|
||||
import argparse
|
||||
import requests
|
||||
import json
|
||||
import os
|
||||
import yaml
|
||||
from zipfile import ZipFile
|
||||
|
||||
# remove this after certs are generated everywhere
|
||||
requests.packages.urllib3.disable_warnings()
|
||||
|
||||
def load_config(config_path):
|
||||
with open(config_path, 'r') as file:
|
||||
config = yaml.safe_load(file)
|
||||
return config['vault']
|
||||
|
||||
def authenticate_approle(vault_config):
|
||||
url = f"{vault_config['addr']}/v1/auth/{vault_config['approle_path']}/login"
|
||||
payload = {
|
||||
"role_id": vault_config['role_id'],
|
||||
}
|
||||
response = requests.post(url, json=payload, verify=False)
|
||||
if response.status_code == 200:
|
||||
auth_response = response.json()
|
||||
return auth_response['auth']['client_token']
|
||||
else:
|
||||
print(f"Error authenticating with AppRole: {response.text}")
|
||||
return None
|
||||
|
||||
def request_certificate(common_name, alt_names, ip_sans, expiry_days, vault_config):
|
||||
# Authenticate using AppRole and get a token
|
||||
client_token = authenticate_approle(vault_config)
|
||||
if not client_token:
|
||||
print("Failed to authenticate with Vault using AppRole.")
|
||||
return None
|
||||
|
||||
url = f"{vault_config['addr']}/v1/{vault_config['mount_point']}/issue/{vault_config['role_name']}"
|
||||
headers = {'X-Vault-Token': client_token}
|
||||
payload = {
|
||||
"common_name": common_name,
|
||||
"alt_names": ",".join(alt_names),
|
||||
"ip_sans": ",".join(ip_sans),
|
||||
"ttl": f"{expiry_days}d"
|
||||
}
|
||||
response = requests.post(url, headers=headers, json=payload, verify=False)
|
||||
if response.status_code == 200:
|
||||
return response.json()
|
||||
else:
|
||||
print(f"Error requesting certificate: {response.text}")
|
||||
return None
|
||||
|
||||
def save_cert_files(certificate_response, common_name, compress, config, json_output):
|
||||
base_path = config.get('output_path', '.')
|
||||
cert_dir = os.path.join(base_path, common_name)
|
||||
if json_output:
|
||||
import json
|
||||
output = {
|
||||
'certificate': certificate_response['data']['certificate'],
|
||||
'private_key': certificate_response['data']['private_key'],
|
||||
'full_chain': certificate_response['data']['issuing_ca'] + "\n" + certificate_response['data']['certificate'],
|
||||
}
|
||||
print(json.dumps(output))
|
||||
elif not compress:
|
||||
os.makedirs(cert_dir, exist_ok=True)
|
||||
with open(os.path.join(cert_dir, "certificate.crt"), "w") as cert_file:
|
||||
cert_file.write(certificate_response['data']['certificate'])
|
||||
with open(os.path.join(cert_dir, "private.key"), "w") as key_file:
|
||||
key_file.write(certificate_response['data']['private_key'])
|
||||
with open(os.path.join(cert_dir, "full_chain.crt"), "w") as full_chain_file:
|
||||
full_chain_file.write(certificate_response['data']['issuing_ca'] + "\n" + certificate_response['data']['certificate'])
|
||||
else:
|
||||
zip_name = f"{os.path.join(base_path, common_name)}.zip"
|
||||
with ZipFile(zip_name, 'w') as zipf:
|
||||
zipf.writestr("certificate.crt", certificate_response['data']['certificate'])
|
||||
zipf.writestr("private.key", certificate_response['data']['private_key'])
|
||||
zipf.writestr("full_chain.crt", certificate_response['data']['issuing_ca'] + "\n" + certificate_response['data']['certificate'])
|
||||
|
||||
def main(config_file):
|
||||
config = load_config(config_file)
|
||||
parser = argparse.ArgumentParser(description='Request and retrieve a certificate from Vault.')
|
||||
parser.add_argument('common_name', type=str, help='Common Name for the certificate')
|
||||
parser.add_argument('-a', '--alt-names', type=str, default='', help='Comma-separated alternative names for the certificate')
|
||||
parser.add_argument('-i', '--ip-sans', type=str, default='', help='Comma-separated IP Subject Alternative Names for the certificate')
|
||||
parser.add_argument('-e', '--expiry-days', type=int, default=365, help='Validity of the certificate in days (default: 365)')
|
||||
parser.add_argument('-c', '--compress', action='store_true', help='Compress the certificate, key, and full chain into a zip file')
|
||||
parser.add_argument('--json', action='store_true', help='Output results in JSON format')
|
||||
args = parser.parse_args()
|
||||
alt_names = [name.strip() for name in args.alt_names.split(',') if name]
|
||||
ip_sans = [ip.strip() for ip in args.ip_sans.split(',') if ip]
|
||||
certificate_response = request_certificate(args.common_name, alt_names, ip_sans, args.expiry_days, config)
|
||||
if certificate_response:
|
||||
if args.json:
|
||||
save_cert_files(certificate_response, args.common_name, args.compress, config, True)
|
||||
else:
|
||||
save_cert_files(certificate_response, args.common_name, args.compress, config, False)
|
||||
else:
|
||||
print("Failed to obtain certificate.")
|
||||
|
||||
if __name__ == "__main__":
|
||||
config_file = '<%= @config_path %>'
|
||||
main(config_file)
|
||||
@@ -4,4 +4,4 @@ vault:
|
||||
approle_path: '<%= @vault_config['approle_path'] %>'
|
||||
mount_point: '<%= @vault_config['mount_point'] %>'
|
||||
role_name: '<%= @vault_config['role_name'] %>'
|
||||
output_path: '<%= @vault_config['output_path'] %>'
|
||||
output_path: '<%= @vault_config['output_path'] %>'
|
||||
|
||||
@@ -0,0 +1,83 @@
|
||||
#!<%= @venv_path %>/bin/python
|
||||
import argparse
|
||||
import requests
|
||||
import json
|
||||
import yaml
|
||||
|
||||
# remove this after certs are generated everywhere
|
||||
requests.packages.urllib3.disable_warnings()
|
||||
|
||||
def load_config(config_path):
|
||||
with open(config_path, 'r') as file:
|
||||
config = yaml.safe_load(file)
|
||||
return config['vault']
|
||||
|
||||
def authenticate_approle(vault_config):
|
||||
url = f"{vault_config['addr']}/v1/auth/{vault_config['approle_path']}/login"
|
||||
payload = {
|
||||
"role_id": vault_config['role_id'],
|
||||
}
|
||||
response = requests.post(url, json=payload, verify=False)
|
||||
if response.status_code == 200:
|
||||
auth_response = response.json()
|
||||
return auth_response['auth']['client_token']
|
||||
else:
|
||||
print(f"Error authenticating with AppRole: {response.text}")
|
||||
return None
|
||||
|
||||
def sign_ssh_certificate(vault_config, public_key, valid_principals, ttl):
|
||||
# Authenticate using AppRole and get a token
|
||||
client_token = authenticate_approle(vault_config)
|
||||
if not client_token:
|
||||
print("Failed to authenticate with Vault using AppRole.")
|
||||
return None
|
||||
|
||||
# Prepare the SSH certificate signing request
|
||||
url = f"{vault_config['addr']}/v1/{vault_config['mount_point']}/sign/{vault_config['role_name']}"
|
||||
headers = {'X-Vault-Token': client_token}
|
||||
payload = {
|
||||
"cert_type": "host",
|
||||
"public_key": public_key,
|
||||
"valid_principals": valid_principals,
|
||||
"ttl": ttl
|
||||
}
|
||||
|
||||
# Request the SSH certificate signing
|
||||
response = requests.post(url, headers=headers, json=payload, verify=False)
|
||||
if response.status_code == 200:
|
||||
return response.json()
|
||||
else:
|
||||
print(f"Error requesting certificate: {response.text}")
|
||||
return None
|
||||
|
||||
def main(config_file):
|
||||
config = load_config(config_file)
|
||||
parser = argparse.ArgumentParser(description='Sign SSH host certificate using Vault.')
|
||||
parser.add_argument('--public_key', required=True, help='SSH public key as a string')
|
||||
parser.add_argument('--valid_principals', required=True, help='Comma-separated list of valid principals')
|
||||
parser.add_argument('--ttl', default='87600h', help='Time-to-live for the certificate (default: 87600h)')
|
||||
parser.add_argument('--json', action='store_true', help='Output the resulting certificate as JSON')
|
||||
|
||||
args = parser.parse_args()
|
||||
|
||||
# Load configuration
|
||||
config = load_config(config_file)
|
||||
|
||||
# Sign SSH certificate
|
||||
response = sign_ssh_certificate(config, args.public_key, args.valid_principals, args.ttl)
|
||||
|
||||
if response and 'data' in response and 'signed_key' in response['data']:
|
||||
if args.json:
|
||||
output = {
|
||||
'signed_key': response['data']['signed_key'],
|
||||
}
|
||||
print(json.dumps(output))
|
||||
else:
|
||||
print(response['data']['signed_key'])
|
||||
else:
|
||||
print("Error: The response does not contain the expected data.")
|
||||
exit(1)
|
||||
|
||||
if __name__ == "__main__":
|
||||
config_file = '<%= @config_path %>'
|
||||
main(config_file)
|
||||
@@ -4,3 +4,4 @@ vault:
|
||||
approle_path: '<%= @vault_config['approle_path'] %>'
|
||||
mount_point: '<%= @vault_config['mount_point'] %>'
|
||||
role_name: '<%= @vault_config['role_name'] %>'
|
||||
output_path: '<%= @vault_config['output_path'] %>'
|
||||
|
||||
Reference in New Issue
Block a user