3 # Copyright (C) The Arvados Authors. All rights reserved.
5 # SPDX-License-Identifier: CC-BY-SA-3.0
10 # Helps manage the configuration in a git repository, and then deploy
11 # nodes by pushing a copy of the git repository to each node and
12 # running the provision script to do the actual installation and
20 declare CONFIG_FILE=local.params
22 # The salt template directory
23 declare CONFIG_DIR=local_config_dir
25 # The 5-character Arvados cluster id
26 # This will be populated by loadconfig()
29 # The parent domain (not including the cluster id)
30 # This will be populated by loadconfig()
33 # A bash associative array listing each node and mapping to the roles
34 # that should be provisioned on those nodes.
35 # This will be populated by loadconfig()
38 # A bash associative array listing each role and mapping to the nodes
39 # that should be provisioned with this role.
40 # This will be populated by loadconfig()
43 # The ssh user we'll use
44 # This will be populated by loadconfig()
47 # The git repository that we'll push to on all the nodes
48 # This will be populated by loadconfig()
51 # The public host used as an SSH jump host
52 # This will be populated by loadconfig()
53 declare USE_SSH_JUMPHOST
55 # The temp file that will get used to disable envvar forwarding to avoid locale
56 # issues in Debian distros.
57 # This will be populated by loadconfig()
67 if [[ -n "$MISSING" ]] ; then
68 echo "Some tools are missing, please make sure you have the 'git' and 'iproute2' packages installed"
75 local SSH=`ssh_cmd "$NODE"`
76 # Delete the old repository
77 $SSH $DEPLOY_USER@$NODE rm -rf ${GITTARGET}.git ${GITTARGET}
84 # Synchronizes the configuration by creating a git repository on
85 # each node, pushing our branch, and updating the checkout.
87 if [[ "$NODE" != localhost ]] ; then
89 GIT="eval `git_cmd $NODE`"
93 # Update the git remote for the remote repository.
94 if ! $GIT remote add $NODE $DEPLOY_USER@$NODE:${GITTARGET}.git ; then
95 $GIT remote set-url $NODE $DEPLOY_USER@$NODE:${GITTARGET}.git
98 # Initialize the git repository. We're
99 # actually going to make two repositories here because git
100 # will complain if you try to push to a repository with a
101 # checkout. So we're going to create a "bare" repository
102 # and then clone a regular repository (with a checkout)
105 $SSH $DEPLOY_USER@$NODE git init --bare --shared=0600 ${GITTARGET}.git
106 $GIT push $NODE $BRANCH
107 $SSH $DEPLOY_USER@$NODE "umask 0077 && git clone -s ${GITTARGET}.git ${GITTARGET} && git -C ${GITTARGET} checkout ${BRANCH}"
116 # Deploy a node. This runs the provision script on the node, with
117 # the appropriate roles.
121 if [[ -z "$ROLES" ]] ; then
122 echo "No roles specified for $NODE, will deploy all roles"
124 ROLES="--roles ${ROLES}"
127 logfile=deploy-${NODE}-$(date -Iseconds).log
128 SSH=`ssh_cmd "$NODE"`
130 if [[ "$NODE" = localhost ]] ; then
132 if [[ $(whoami) != 'root' ]] ; then
135 $SUDO ./provision.sh --config ${CONFIG_FILE} ${ROLES} 2>&1 | tee $logfile
137 $SSH $DEPLOY_USER@$NODE "cd ${GITTARGET} && git log -n1 HEAD && DISABLED_CONTROLLER=\"$DISABLED_CONTROLLER\" sudo --preserve-env=DISABLED_CONTROLLER ./provision.sh --config ${CONFIG_FILE} ${ROLES}" 2>&1 | tee $logfile
143 if ! [[ -s ${CONFIG_FILE} && -s ${CONFIG_FILE}.secrets ]]; then
144 echo "Must be run from initialized setup dir, maybe you need to 'initialize' first?"
147 GITTARGET=arvados-deploy-config-${CLUSTER}
149 # Set up SSH so that it doesn't forward any environment variable. This is to avoid
150 # getting "setlocale" errors on the first run, depending on the distro being used
151 # to run the installer (like Debian).
152 SSH_CONFFILE=$(mktemp)
153 echo "Include config SendEnv -*" > ${SSH_CONFFILE}
158 if [ -z "${USE_SSH_JUMPHOST}" -o "${NODE}" == "${USE_SSH_JUMPHOST}" -o "${NODE}" == "localhost" ]; then
159 echo "ssh -F ${SSH_CONFFILE}"
161 echo "ssh -F ${SSH_CONFFILE} -J ${DEPLOY_USER}@${USE_SSH_JUMPHOST}"
167 echo "GIT_SSH_COMMAND=\"`ssh_cmd ${NODE}`\" git"
174 if [[ -n "$subcmd" ]] ; then
179 if [[ ! -f provision.sh ]] ; then
180 echo "Must be run from arvados/tools/salt-install"
194 if [[ -z "$PARAMS" || ! -f local.params.example.$PARAMS ]] ; then
195 echo "Not found: local.params.example.$PARAMS"
196 echo "Expected one of multiple_hosts, single_host_multiple_hostnames, single_host_single_hostname"
200 if [[ -z "$SLS" || ! -d config_examples/$SLS ]] ; then
201 echo "Not found: config_examples/$SLS"
202 echo "Expected one of multi_host/aws, single_host/multiple_hostnames, single_host/single_hostname"
206 if [[ -z "$SETUPDIR" || -z "$PARAMS" || -z "$SLS" ]]; then
207 echo "installer.sh <setup dir to initialize> <params template> <config template>"
211 if [[ -n "$err" ]] ; then
215 echo "Initializing $SETUPDIR"
216 git init --shared=0600 $SETUPDIR
217 cp -r *.sh tests $SETUPDIR
219 cp local.params.example.$PARAMS $SETUPDIR/${CONFIG_FILE}
220 cp local.params.secrets.example $SETUPDIR/${CONFIG_FILE}.secrets
221 cp -r config_examples/$SLS $SETUPDIR/${CONFIG_DIR}
223 if [[ -n "$TERRAFORM" ]] ; then
224 mkdir $SETUPDIR/terraform
225 cp -r $TERRAFORM/* $SETUPDIR/terraform/
229 echo '*.log' > .gitignore
230 echo '**/.terraform' >> .gitignore
231 echo '**/.infracost' >> .gitignore
233 if [[ -n "$TERRAFORM" ]] ; then
237 git add *.sh ${CONFIG_FILE} ${CONFIG_FILE}.secrets ${CONFIG_DIR} tests .gitignore
238 git commit -m"initial commit"
241 echo "Setup directory $SETUPDIR initialized."
242 if [[ -n "$TERRAFORM" ]] ; then
243 (cd $SETUPDIR/terraform/vpc && terraform init)
244 (cd $SETUPDIR/terraform/data-storage && terraform init)
245 (cd $SETUPDIR/terraform/services && terraform init)
246 echo "Now go to $SETUPDIR, customize 'terraform/vpc/terraform.tfvars' as needed, then run 'installer.sh terraform'"
248 echo "Now go to $SETUPDIR, customize '${CONFIG_FILE}', '${CONFIG_FILE}.secrets' and '${CONFIG_DIR}' as needed, then run 'installer.sh deploy'"
253 logfile=terraform-$(date -Iseconds).log
254 (cd terraform/vpc && terraform apply -auto-approve) 2>&1 | tee -a $logfile
255 (cd terraform/data-storage && terraform apply -auto-approve) 2>&1 | tee -a $logfile
256 (cd terraform/services && terraform apply -auto-approve) 2>&1 | grep -v letsencrypt_iam_secret_access_key | tee -a $logfile
257 (cd terraform/services && echo -n 'letsencrypt_iam_secret_access_key = ' && terraform output letsencrypt_iam_secret_access_key) 2>&1 | tee -a $logfile
261 logfile=terraform-$(date -Iseconds).log
262 (cd terraform/services && terraform destroy) 2>&1 | tee -a $logfile
263 (cd terraform/data-storage && terraform destroy) 2>&1 | tee -a $logfile
264 (cd terraform/vpc && terraform destroy) 2>&1 | tee -a $logfile
268 for i in BLOB_SIGNING_KEY MANAGEMENT_TOKEN SYSTEM_ROOT_TOKEN ANONYMOUS_USER_TOKEN WORKBENCH_SECRET_KEY DATABASE_PASSWORD; do
269 echo ${i}=$(tr -dc A-Za-z0-9 </dev/urandom | head -c 32 ; echo '')
282 if grep -rni 'fixme' ${CONFIG_FILE} ${CONFIG_FILE}.secrets ${CONFIG_DIR} ; then
284 echo "Some parameters still need to be updated. Please fix them and then re-run deploy."
288 BRANCH=$(git rev-parse --abbrev-ref HEAD)
293 if ! git diff --cached --exit-code --quiet ; then
294 git commit -m"prepare for deploy"
297 # Used for rolling updates to disable individual nodes at the
299 export DISABLED_CONTROLLER=""
300 if [[ -z "$NODE" ]]; then
301 for NODE in "${!NODES[@]}"
303 # First, just confirm we can ssh to each node.
304 `ssh_cmd "$NODE"` $DEPLOY_USER@$NODE true
307 for NODE in "${!NODES[@]}"
309 # Do 'database' role first,
310 if [[ "${NODES[$NODE]}" =~ database ]] ; then
311 deploynode $NODE "${NODES[$NODE]}" $BRANCH
316 BALANCER=${ROLE2NODES['balancer']:-}
318 # Check if there are multiple controllers, they'll be comma-separated
320 if [[ ${ROLE2NODES['controller']} =~ , ]] ;
322 # If we have multiple controllers then there must be
323 # load balancer. We want to do a rolling update, take
324 # down each node at the load balancer before updating
327 for NODE in "${!NODES[@]}"
329 if [[ "${NODES[$NODE]}" =~ controller ]] ; then
330 export DISABLED_CONTROLLER=$NODE
332 # Update balancer that the node is disabled
333 deploynode $BALANCER "${NODES[$BALANCER]}" $BRANCH
335 # Now update the node itself
336 deploynode $NODE "${NODES[$NODE]}" $BRANCH
341 # Only one controller
342 NODE=${ROLE2NODES['controller']}
343 deploynode $NODE "${NODES[$NODE]}" $BRANCH
347 if [[ -n "$BALANCER" ]] ; then
348 # Deploy balancer. In the rolling update case, this
349 # will re-enable all the controllers at the balancer.
350 export DISABLED_CONTROLLER=""
351 deploynode $BALANCER "${NODES[$BALANCER]}" $BRANCH
352 unset NODES[$BALANCER]
355 for NODE in "${!NODES[@]}"
357 # Everything else (we removed the nodes that we
358 # already deployed from the list)
359 deploynode $NODE "${NODES[$NODE]}" $BRANCH
362 # Just deploy the node that was supplied on the command line.
363 deploynode $NODE "${NODES[$NODE]}" $BRANCH
368 echo "Completed deploy, run 'installer.sh diagnostics' to verify the install"
379 if ! which arvados-client ; then
380 echo "arvados-client not found, install 'arvados-client' package with 'apt-get' or 'yum'"
384 if [[ -z "$LOCATION" ]] ; then
385 echo "Need to provide '-internal-client' or '-external-client'"
387 echo "-internal-client You are running this on the same private network as the Arvados cluster (e.g. on one of the Arvados nodes)"
388 echo "-external-client You are running this outside the private network of the Arvados cluster (e.g. your workstation)"
392 export ARVADOS_API_HOST="${DOMAIN}:${CONTROLLER_EXT_SSL_PORT}"
393 export ARVADOS_API_TOKEN="$SYSTEM_ROOT_TOKEN"
395 arvados-client diagnostics $LOCATION
399 echo "Arvados installer"
401 echo "initialize initialize the setup directory for configuration"
402 echo "terraform create cloud resources using terraform"
403 echo "terraform-destroy destroy cloud resources created by terraform"
404 echo "generate-tokens generate random values for tokens"
405 echo "deploy deploy the configuration from the setup directory"
406 echo "diagnostics check your install using diagnostics"