-
Notifications
You must be signed in to change notification settings - Fork 46
/
setup_first_he_host.sh
executable file
·190 lines (168 loc) · 5.39 KB
/
setup_first_he_host.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
#!/bin/bash -x
HOSTEDENGINE="$1"
shift
HE_MAC_ADDRESS="$1"
shift
HEADDR="$1"
shift
DOMAIN=$(dnsdomainname)
HE_SETUP_HOOKS_DIR="/usr/share/ansible/collections/ansible_collections/ovirt/ovirt/roles/hosted_engine_setup/hooks"
# This is needed in case we're using prebuilt ost-images.
# In this scenario ssh keys are baked in to the qcows (so lago
# doesn't inject its own ssh keys), but HE VM is built from scratch.
copy_ssh_key() {
cat << EOF > ${HE_SETUP_HOOKS_DIR}/enginevm_before_engine_setup/copy_ssh_key.yml
---
- name: Copy ssh key for root to HE VM
authorized_key:
user: root
key: "{{ lookup('file', '/root/.ssh/authorized_keys') }}"
EOF
}
# Use repositories from the host-0 so that we can actually update HE to the same custom repos
dnf_update() {
FWD_PARAM="-D 1234" # when host-0 can access IPv4
ip -4 -o addr show dev eth0 scope global | grep -q eth0 || FWD_PARAM="-L1234:localhost:1234" # when we need to tunnel further to the SOCKS proxy on OST executor
cat << EOF > ${HE_SETUP_HOOKS_DIR}/enginevm_before_engine_setup/replace_repos.yml
---
- name: Create systemd service for IPv6 to IPv4 proxy
lineinfile:
path: /etc/systemd/system/socks-proxy.service
create: yes
mode: 0644
line: |
[Unit]
Description=socks proxy
After=network-online.target
Wants=network-online.target
[Service]
ExecStart=sshpass -p 123456 ssh ${FWD_PARAM} -N -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null $(hostname -f)
[Install]
WantedBy=multi-user.target
- name: Start IPv6 to IPv4 proxy
systemd:
name: socks-proxy
daemon_reload: yes
enabled: yes
state: started
- name: Configure DNF to use the proxy
lineinfile:
path: /etc/dnf/dnf.conf
line: |
proxy=socks5://localhost:1234
ip_resolve=4
- name: Downgrade java-11-openjdk-headless to workaround keycloak setup issue
shell: dnf downgrade -y java-11-openjdk-headless-11.0.15.0.10-3.el8 || true
- name: Remove all repositories
file:
path: /etc/yum.repos.d
state: absent
- name: Copy host-0 repositories
copy:
src: /etc/yum.repos.d
dest: /etc
- name: DNF update the system. TODO remove RHV's repos once RHV appliance is regularly up to date.
shell: dnf update -y --disableplugin versionlock --repo rhel*,rhv* || dnf update -y --disableplugin versionlock
EOF
}
copy_dependencies() {
cat << EOF > ${HE_SETUP_HOOKS_DIR}/enginevm_before_engine_setup/copy_dependencies.yml
---
- name: Copy cirros image to HE VM
copy:
src: /var/tmp/cirros.img
dest: /var/tmp/cirros.img
- name: Copy sysstat rpm package to HE VM
copy:
src: "{{ item }}"
dest: /var/tmp/sysstat.rpm
with_fileglob:
- "/var/tmp/sysstat-*"
- name: Copy sysstat dependencies to HE VM
copy:
src: "{{ item }}"
dest: /var/tmp/lm_sensors.rpm
with_fileglob:
- "/var/tmp/lm_sensors-*"
- name: Copy OpenSCAP profile name
copy:
src: /root/ost_images_openscap_profile
dest: /root/ost_images_openscap_profile
- name: Stat ost_images_openscap_profile
stat:
path: /root/ost_images_openscap_profile
register: profile_stat
- block:
- name: Copy RHEL8 OpenSCAP data
copy:
src: /root/security-data-oval-com.redhat.rhsa-RHEL8.xml
dest: /root
- name: Copy updated RHEL8 OpenSCAP datastream
copy:
src: /root/ssg-rhel8-ds.xml
dest: /root
when: profile_stat.stat.exists and profile_stat.stat.size > 0
EOF
}
add_he_to_hosts() {
echo "${HEADDR} ${HOSTEDENGINE}.${DOMAIN} ${HOSTEDENGINE}" >> /etc/hosts
}
# prioritize IPv6 resolving in java and imageio since IPv4 routes are missing in dual and ipv6-only modes
fix_ipv6() {
cat << EOF > ${HE_SETUP_HOOKS_DIR}/enginevm_before_engine_setup/fix_routes.yml
---
- name: Resolve IPv6 in engine
lineinfile:
path: /etc/ovirt-engine/engine.conf.d/99-ipv6-pref.conf
create: yes
mode: 0644
line: ENGINE_PROPERTIES="\${ENGINE_PROPERTIES} java.net.preferIPv6Addresses=true"
- name: Resolve IPv6 in imageio
lineinfile:
path: /etc/ovirt-imageio/conf.d/01-ipv6-pref.conf
create: yes
mode: 0644
line: |
[control]
prefer_ipv4 = False
EOF
}
# prioritize IPv6 resolving in java and imageio since IPv4 routes are missing in dual and ipv6-only modes
debug_grub() {
cat << EOF > ${HE_SETUP_HOOKS_DIR}/enginevm_before_engine_setup/debug_grub.yml
---
- name: Add grub2-mkconfig conf file for debugging
lineinfile:
path: /etc/grub.d/00_ost
create: yes
mode: 0755
line: |
#!/bin/sh
echo "insmod progress"
echo "set pager=0"
# echo "set debug=all"
# echo "set debug=linux,file,disk,partition,fs,xfs,relocator"
echo "set debug=linux"
- name: Run grub2-mkconfig
shell: grub2-mkconfig -o /boot/grub2/grub.cfg
EOF
}
copy_ssh_key
dnf_update
copy_dependencies
add_he_to_hosts
ip -6 -o addr show dev eth0 scope global | grep -q eth0 && fix_ipv6
debug_grub
# need to block updating appliance. excludepkgs doesn't help since HE code does "dnf install ovirt-engine-appliance"
# and if the package is excluded it fails, we need to convince DNF that current version is good enough.
dnf config-manager --setopt=best=False --save
fstrim -va
rm -rf /var/cache/yum/*
hosted-engine --deploy --config-append=/root/hosted-engine-deploy-answers-file.conf
RET_CODE=$?
if [ ${RET_CODE} -ne 0 ]; then
echo "hosted-engine deploy on ${HOSTNAME} failed with status ${RET_CODE}."
exit ${RET_CODE}
fi
rm -rf /var/cache/yum/*
fstrim -va