diff options
Diffstat (limited to 'cm-container')
| -rw-r--r-- | cm-container/Changelog.md | 17 | ||||
| -rw-r--r-- | cm-container/Dockerfile-template | 21 | ||||
| -rw-r--r-- | cm-container/README.md | 22 | ||||
| -rw-r--r-- | cm-container/pom.xml | 3 | ||||
| -rw-r--r-- | cm-container/reset_admin.py | 54 | ||||
| -rw-r--r-- | cm-container/scripts/configure-tls.sh | 31 | ||||
| -rwxr-xr-x | cm-container/scripts/get-plugins.sh | 16 | ||||
| -rw-r--r-- | cm-container/scripts/init-cloudify.sh | 1 | ||||
| -rwxr-xr-x | cm-container/scripts/load-plugins.sh | 5 | ||||
| -rwxr-xr-x | cm-container/scripts/set-admin-password.sh | 43 | ||||
| -rwxr-xr-x | cm-container/scripts/start-persistent.sh | 13 |
11 files changed, 74 insertions, 152 deletions
diff --git a/cm-container/Changelog.md b/cm-container/Changelog.md new file mode 100644 index 0000000..99025f2 --- /dev/null +++ b/cm-container/Changelog.md @@ -0,0 +1,17 @@ +# Change Log +All notable changes to this project will be documented in this file. + +The format is based on [Keep a Changelog](http://keepachangelog.com/) +and this project adheres to [Semantic Versioning](http://semver.org/). + +## [4.4.0] - 26/02/2021 +* Upgrade k8s-plugin to 3.6.0 (Add integration with cert-manager. Enable creation of certificate custom resource + instead cert-service-client container, when flag "CMPv2CertManagerIntegration" is enabled) + +## [4.3.1] - 18/02/2021 +* Upgrade k8s-plugin to 3.5.3 (Fix bug with default mode format in ConfigMapVolumeSource) + +## [4.3.0] - 12/02/2021 +* Upgrade k8s-plugin to 3.5.2 + +## [4.2.0] - 05/02/2021 diff --git a/cm-container/Dockerfile-template b/cm-container/Dockerfile-template index b5ce5ab..84d0e49 100644 --- a/cm-container/Dockerfile-template +++ b/cm-container/Dockerfile-template @@ -1,6 +1,6 @@ # ============LICENSE_START======================================================= # Copyright (c) 2018-2020 AT&T Intellectual Property. All rights reserved. -# Copyright (c) 2020 J. F. Lucas. All rights reserved. +# Copyright (c) 2020-2021 J. F. Lucas. All rights reserved. # ================================================================================ # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -14,23 +14,20 @@ # See the License for the specific language governing permissions and # limitations under the License. # ============LICENSE_END========================================================= -FROM cloudifyplatform/community-cloudify-manager-aio:20.03.03 +FROM cloudifyplatform/community-cloudify-manager-aio:5.1.2 ENV PLUGIN_REPO {{ ONAPTEMPLATE_RAWREPOURL_org_onap_dcaegen2_platform_plugins_releases }} -# Store plugin files locally +# Install openssh-clients to ssh-keygen, used by the sshkeyshare plugin +RUN yum install -y openssh-clients + RUN mkdir scripts COPY scripts/* scripts/ -COPY reset_admin.py /opt/manager/ -# Load plugins, set up TLS configuration, load Cloudify type file -RUN chmod +x /opt/manager/reset_admin.py \ - && chmod +x scripts/*.sh \ - && scripts/get-plugins.sh ${PLUGIN_REPO} \ - && /scripts/configure-tls.sh \ - && mkdir /opt/manager/resources/spec/cloudify/4.5.5 \ - && curl -Ss -L -f https://www.getcloudify.org/spec/cloudify/4.5.5/types.yaml > /opt/manager/resources/spec/cloudify/4.5.5/types.yaml \ - && chown -R cfyuser:cfyuser /opt/manager/resources/spec/cloudify/4.5.5 +# Load plugins and set up TLS configuration + RUN chmod +x scripts/*.sh \ + && scripts/get-plugins.sh ${PLUGIN_REPO} \ + && /scripts/configure-tls.sh # Create mount point for CM config file RUN mkdir -p /opt/onap && chown cfyuser:cfyuser /opt/onap diff --git a/cm-container/README.md b/cm-container/README.md index 03b9634..b929e21 100644 --- a/cm-container/README.md +++ b/cm-container/README.md @@ -1,13 +1,17 @@ -# Cloudify Manager Container Builder +# Cloudify Manager Image Builder ## Purpose The artifacts in this directory build a Docker image based on the -public image from Cloudify (`cloudifyplatform/community`). The -image has the Cloudify Manager software from the base image -and adds our types files. It configures -the import resolver to use our local type files instead -of fetching them over the Internet. It sets up the `/opt/onap` mount point -for our config files. It also sets up the certificate, key and other -configuration for using TLS. +public image from Cloudify (`cloudifyplatform/community`). The image +build process, driven by the Dockerfile: + - retrieves the Cloudify plugins and type files needed to deploy DCAE components. + - edits the Cloudify configuration file (`/etc/cloudify/config.yaml`) to +set up Cloudify Manager to use TLS on its HTTP interfaces. + - sets up the `/opt/onap` mount point for configuration file. + - installs scripts that run when the container is started. These scripts: + - set up persistent storage for the container + - make the credentials for accessing the Kubernetes API available to Cloudify Manager + - set the administrative password to a value generated during the Helm deployment process + - upload the plugins and type files to the Cloudify Manager once it is running ## Running the Container The container is intended to be launched via a Helm chart as part @@ -60,8 +64,6 @@ which then brings up the many other processes needed for a working instance of C ## The `setup-secret.sh` script When Kubernetes starts a container, it mounts a directory containing the credentials that the container needs to access the Kubernetes API on the local Kubernetes cluster. The mountpoint is `/var/run/secrets/kubernetes.io/serviceaccount`. Something about the way that Cloudify Manager is started (possibly because `/sbin/init` is run) causes this mountpoint to be hidden. `setup-secret.sh` will recreate the directory if it's not present and symbolically link it to a copy of the credentials mounted at `/secret` in the container file system. This gives Cloudify Manager the credentials that the Kubernetes plugin needs to deploy Kubernetes-based DCAE components. -`setup-secret.sh` needs to run after '/sbin/init'. The Dockerfile installs it in the `rc.local` script that runs at startup. - ## Cleaning up Kubernetes components deployed by Cloudify Manager Using the `helm undeploy` (or `helm delete`) command will destroy the Kubernetes components deployed via helm. In an ONAP deployment driven by OOM, this includes destroying Cloudify Manager. helm will *not* delete Kubernetes components deployed by Cloudify Manager. diff --git a/cm-container/pom.xml b/cm-container/pom.xml index 3cb3ff4..30dbfff 100644 --- a/cm-container/pom.xml +++ b/cm-container/pom.xml @@ -2,6 +2,7 @@ <!-- ================================================================================ Copyright (c) 2018-2020 AT&T Intellectual Property. All rights reserved. +Copyright (c) 2021 J. F. Lucas. All rights reserved. ================================================================================ Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. @@ -27,7 +28,7 @@ limitations under the License. <groupId>org.onap.dcaegen2.deployments</groupId> <artifactId>cm-container</artifactId> <name>dcaegen2-deployments-cm-container</name> - <version>3.4.0</version> + <version>4.4.1</version> <url>http://maven.apache.org</url> <properties> <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding> diff --git a/cm-container/reset_admin.py b/cm-container/reset_admin.py deleted file mode 100644 index 2253341..0000000 --- a/cm-container/reset_admin.py +++ /dev/null @@ -1,54 +0,0 @@ -######## -# Copyright (c) 2018 Cloudify Platform Ltd. All rights reserved -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# * See the License for the specific language governing permissions and -# * limitations under the License. - -#!/usr/bin/env python - -import subprocess -import json -import argparse -from flask_security.utils import encrypt_password -from manager_rest.flask_utils import setup_flask_app - - -def db_update_password(password): - password = encrypt_new_password(password) - password = password.replace('$', '\$') - sql_command = "\"update users set password='" + password + "' where username='admin'\"" - cmd = "sudo -u postgres psql cloudify_db -c " + sql_command - subprocess.Popen(cmd, stdout=subprocess.PIPE, shell=True) - - -def get_salt(): - with open('/opt/manager/rest-security.conf') as f: - rest_security = json.load(f) - - return rest_security['hash_salt'] - - -def encrypt_new_password(password): - app = setup_flask_app(hash_salt=get_salt()) - with app.app_context(): - password = encrypt_password(password) - return password - - -if __name__ == '__main__': - - parser = argparse.ArgumentParser(description=('Reset admin password in DB according to rest-security.conf')) - parser.add_argument('-p', '--password', required=True, help='New admin password') - args = parser.parse_args() - - db_update_password(args.password) - print 'Password updated in DB!\n' diff --git a/cm-container/scripts/configure-tls.sh b/cm-container/scripts/configure-tls.sh index a4b817b..d7c9cc8 100644 --- a/cm-container/scripts/configure-tls.sh +++ b/cm-container/scripts/configure-tls.sh @@ -3,6 +3,7 @@ # org.onap.dcae # ================================================================================ # Copyright (c) 2019 AT&T Intellectual Property. All rights reserved. +# Copyright (c) 2020-2021 J. F. Lucas. All rights reserved. # ================================================================================ # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -17,26 +18,14 @@ # limitations under the License. # ============LICENSE_END========================================================= # -# Set up configuration files so that CM uses TLS on its external API -# Change the nginx configuration -- this is what actually makes it work -SSLCONFPATTERN="^include \"/etc/nginx/conf.d/http-external-rest-server.cloudify\"" -SSLCONFREPLACE="include \"/etc/nginx/conf.d/https-external-rest-server.cloudify\"" -sed -i -e "s#${SSLCONFPATTERN}#${SSLCONFREPLACE}#" /etc/nginx/conf.d/cloudify.conf - -# Set certificate and key locations -sed -i -e "s# ssl_certificate .*;# ssl_certificate /opt/onap/certs/cert.pem;#" /etc/nginx/conf.d/https-external-rest-server.cloudify -sed -i -e "s# ssl_certificate_key .*;# ssl_certificate_key /opt/onap/certs/key.pem;#" /etc/nginx/conf.d/https-external-rest-server.cloudify - -# Change the cloudify config file, just to be safe -# Someone might run cfy_manager configure on the CM container for some reason -# and we don't want them to overwrite the TLS configuration -# (Running cfy_manager configure is a bad idea, though, because it often fails.) +# Set tls to "enabled" sed -i -e "s#^ ssl_enabled: false# ssl_enabled: true#" /etc/cloudify/config.yaml - -# The Cloudify command line tool ('cfy') needs to be configured for TLS as well -# (The readiness check script uses 'cfy status') -sed -i -e "s#^rest_port: 80#rest_port: 443#" /root/.cloudify/profiles/localhost/context -sed -i -e "s/^rest_protocol: http$/rest_protocol: https/" /root/.cloudify/profiles/localhost/context -sed -i -e "s#^rest_certificate: !!python/unicode '/etc/cloudify/ssl/cloudify_external_cert.pem'#rest_certificate: !!python/unicode '/opt/onap/certs/cacert.pem'#" /root/.cloudify/profiles/localhost/context -sed -i -e "s#^manager_ip: !!python/unicode 'localhost'#manager_ip: !!python/unicode 'dcae-cloudify-manager'#" /root/.cloudify/profiles/localhost/context +# Set up paths for our certificates +sed -i -e "s|external_cert_path: .*$|external_cert_path: '/opt/onap/certs/cert.pem'|" /etc/cloudify/config.yaml +sed -i -e "s|external_key_path: .*$|external_key_path: '/opt/onap/certs/key.pem'|" /etc/cloudify/config.yaml +sed -i -e "s|external_ca_cert_path: .*$|external_ca_cert_path: '/opt/onap/certs/cacert.pem'|" /etc/cloudify/config.yaml +# Set the host name for the local profile +# Otherwise, the CM startup process will use 'localhost' and will fail +# because the TLS certificate does not have 'localhost' as a CN or SAN +sed -i -e 's/ cli_local_profile_host_name: .*$/ cli_local_profile_host_name: dcae-cloudify-manager/' /etc/cloudify/config.yaml diff --git a/cm-container/scripts/get-plugins.sh b/cm-container/scripts/get-plugins.sh index 999341f..367d0b7 100755 --- a/cm-container/scripts/get-plugins.sh +++ b/cm-container/scripts/get-plugins.sh @@ -1,6 +1,7 @@ #!/bin/bash # ============LICENSE_START======================================================= # Copyright (c) 2018-2020 AT&T Intellectual Property. All rights reserved. +# Copyright (d) 2020-2021 J. F. Lucas. All rights reserved. # ================================================================================ # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -29,14 +30,13 @@ DEST=${DEST:-/opt/plugins} # /path/to/plugin/wagon|/path/to/type/file PLUGINS=\ "\ -/dcaepolicyplugin/2.4.0/dcaepolicyplugin-2.4.0-py27-none-linux_x86_64.wgn|/dcaepolicyplugin/2.4.0/dcaepolicyplugin_types.yaml \ -/relationshipplugin/1.1.0/relationshipplugin-1.1.0-py27-none-linux_x86_64.wgn|/relationshipplugin/1.1.0/relationshipplugin_types.yaml \ -/k8splugin/3.4.2/k8splugin-3.4.2-py27-none-linux_x86_64.wgn|/k8splugin/3.4.2/k8splugin_types.yaml \ -/clamppolicyplugin/1.1.0/clamppolicyplugin-1.1.0-py27-none-linux_x86_64.wgn|/clamppolicyplugin/1.1.0/clamppolicyplugin_types.yaml \ -/dmaap/1.5.0/dmaap-1.5.0-py27-none-linux_x86_64.wgn|/dmaap/1.5.0/dmaap_types.yaml \ -/helm/4.2.0/helm-4.2.0-py27-none-linux_x86_64.wgn|/helm/4.2.0/helm_types.yaml \ -/pgaas/1.3.0/pgaas-1.3.0-py27-none-linux_x86_64.wgn|/pgaas/1.3.0/pgaas_types.yaml \ -/sshkeyshare/1.2.0/sshkeyshare-1.2.0-py27-none-linux_x86_64.wgn|/sshkeyshare/1.2.0/sshkeyshare_types.yaml +/dcaepolicyplugin/2.4.0/dcaepolicyplugin-2.4.0-py36-none-linux_x86_64.wgn|/dcaepolicyplugin/2.4.0/dcaepolicyplugin_types.yaml \ +/relationshipplugin/1.1.0/relationshipplugin-1.1.0-py36-none-linux_x86_64.wgn|/relationshipplugin/1.1.0/relationshipplugin_types.yaml \ +/k8splugin/3.7.0/k8splugin-3.7.0-py36-none-linux_x86_64.wgn|/k8splugin/3.7.0/k8splugin_types.yaml \ +/clamppolicyplugin/1.1.0/clamppolicyplugin-1.1.0-py36-none-linux_x86_64.wgn|/clamppolicyplugin/1.1.0/clamppolicyplugin_types.yaml \ +/dmaap/1.5.0/dmaap-1.5.0-py36-none-linux_x86_64.wgn|/dmaap/1.5.0/dmaap_types.yaml \ +/pgaas/1.3.0/pgaas-1.3.0-py36-none-linux_x86_64.wgn|/pgaas/1.3.0/pgaas_types.yaml \ +/sshkeyshare/1.2.0/sshkeyshare-1.2.0-py36-none-linux_x86_64.wgn|/sshkeyshare/1.2.0/sshkeyshare_types.yaml " mkdir -p ${DEST} diff --git a/cm-container/scripts/init-cloudify.sh b/cm-container/scripts/init-cloudify.sh index 8e74c8a..e2e4d0a 100644 --- a/cm-container/scripts/init-cloudify.sh +++ b/cm-container/scripts/init-cloudify.sh @@ -20,7 +20,6 @@ set -ex /scripts/setup-secret.sh -/scripts/set-admin-password.sh /scripts/load-plugins.sh set +x diff --git a/cm-container/scripts/load-plugins.sh b/cm-container/scripts/load-plugins.sh index c93f3d9..4ac3c6d 100755 --- a/cm-container/scripts/load-plugins.sh +++ b/cm-container/scripts/load-plugins.sh @@ -1,6 +1,7 @@ #!/bin/bash # ============LICENSE_START======================================================= # Copyright (c) 2019-2020 AT&T Intellectual Property. All rights reserved. +# Copyright (c) 2020-2021 J. F. Lucas. All rights reserved. # ================================================================================ # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -77,7 +78,6 @@ function install_plugin { set -ex - # Wait for Cloudify Manager to come up while ! /scripts/cloudify-ready.sh do @@ -85,6 +85,9 @@ do sleep 15 done +# Set nullglob to handle the case of an empty plugin directory +shopt -s nullglob + if [[ ! -f ${PLUGINS_LOADED} ]] then diff --git a/cm-container/scripts/set-admin-password.sh b/cm-container/scripts/set-admin-password.sh deleted file mode 100755 index d8c4121..0000000 --- a/cm-container/scripts/set-admin-password.sh +++ /dev/null @@ -1,43 +0,0 @@ -#!/bin/bash -# ============LICENSE_START======================================================= -# Copyright (c) 2020 AT&T Intellectual Property. All rights reserved. -# ================================================================================ -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# ============LICENSE_END========================================================= -# Runs at deployment time to set cloudify's admin password - -set -x - -# Wait for Cloudify Manager to come up -while ! /scripts/cloudify-ready.sh -do - echo "Waiting for CM to come up" - sleep 15 -done - -set +x - -# Expect Cloudify password to be in file mounted from Kubernetes secret, -# but allow overriding by CMPASS environment variable, -# and if not provided, use the default -CMPASS=${CMPASS:-$(cat /opt/onap/cm-secrets/password 2>/dev/null)} -CMPASS=${CMPASS:-admin} - -echo "Set Cloudify's admin password" -cd /opt/manager -cfy_manager --reset_admin_password $CMPASS || ./env/bin/python reset_admin.py -p $CMPASS - -echo "Set the password used by the cfy client" -cfy profile set -p $CMPASS - -echo "Cloudify password set" diff --git a/cm-container/scripts/start-persistent.sh b/cm-container/scripts/start-persistent.sh index 354d634..4eed79c 100755 --- a/cm-container/scripts/start-persistent.sh +++ b/cm-container/scripts/start-persistent.sh @@ -1,6 +1,7 @@ #!/bin/bash # ================================================================================ # Copyright (c) 2018 AT&T Intellectual Property. All rights reserved. +# Copyright (c) 2021 J. F. Lucas. All rights reserved. # ================================================================================ # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -16,7 +17,8 @@ # ============LICENSE_END========================================================= # Set up persistent storage for Cloudify Manager's state data -PDIRS="/var/lib/pgsql/9.5/data /opt/manager/resources /opt/mgmtworker/env/plugins /opt/mgmtworker/work/deployments" +#PDIRS="/var/lib/pgsql/9.5/data /opt/manager/resources /opt/mgmtworker/env/plugins /opt/mgmtworker/work/deployments" +PDIRS="/var/lib /etc/cloudify /opt/cfy /opt/cloudify /opt/cloudify-stage /opt/manager /opt/mgmtworker /opt/restservice" PSTORE="/cfy-persist" set -ex @@ -27,6 +29,15 @@ then if [ -z "$(ls -A $PSTORE)" ] then # there's nothing in the persistent store yet + + # edit the CM config file to set the admin password + # to our generated value; expect it to be in file + # mounted from Kubernetes secret, but allow overriding by + # CMPASS environment variable, and if not provided, use the default + CMPASS=${CMPASS:-$(cat /opt/onap/cm-secrets/password 2>/dev/null)} + CMPASS=${CMPASS:-admin} + sed -i -e "s|admin_password: .*$|admin_password: ${CMPASS}|" /etc/cloudify/config.yaml + # copy in the data from the container file system for d in $PDIRS do |