tools/salt-install/provision.sh

   1 #!/bin/bash -x
   2
   3 # Copyright (C) The Arvados Authors. All rights reserved.
   4 #
   5 # SPDX-License-Identifier: CC-BY-SA-3.0
   6
   7 # If you want to test arvados in a single host, you can run this script, which
   8 # will install it using salt masterless
   9 # This script is run by the Vagrant file when you run it with
  10 #
  11 # vagrant up
  12
  13 set -o pipefail
  14
  15 # capture the directory that the script is running from
  16 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
  17
  18 usage() {
  19   echo >&2
  20   echo >&2 "Usage: ${0} [-h] [-h]"
  21   echo >&2
  22   echo >&2 "${0} options:"
  23   echo >&2 "  -d, --debug                                 Run salt installation in debug mode"
  24   echo >&2 "  -p <N>, --ssl-port <N>                      SSL port to use for the web applications"
  25   echo >&2 "  -c <local.params>, --config <local.params>  Path to the local.params config file"
  26   echo >&2 "  -t, --test                                  Test installation running a CWL workflow"
  27   echo >&2 "  -r, --roles                                 List of Arvados roles to apply to the host, comma separated"
  28   echo >&2 "                                              Possible values are:"
  29   echo >&2 "                                                api"
  30   echo >&2 "                                                controller"
  31   echo >&2 "                                                keepstore"
  32   echo >&2 "                                                websocket"
  33   echo >&2 "                                                keepweb"
  34   echo >&2 "                                                workbench2"
  35   echo >&2 "                                                keepproxy"
  36   echo >&2 "                                                shell"
  37   echo >&2 "                                                workbench"
  38   echo >&2 "                                                dispatcher"
  39   echo >&2 "                                              Defaults to applying them all"
  40   echo >&2 "  -h, --help                                  Display this help and exit"
  41   echo >&2 "  -v, --vagrant                               Run in vagrant and use the /vagrant shared dir"
  42   echo >&2
  43 }
  44
  45 arguments() {
  46   # NOTE: This requires GNU getopt (part of the util-linux package on Debian-based distros).
  47   TEMP=$(getopt -o c:dhp:r:tv \
  48     --long config:,debug,help,ssl-port:,roles:,test,vagrant \
  49     -n "${0}" -- "${@}")
  50
  51   if [ ${?} != 0 ] ; then echo "GNU getopt missing? Use -h for help"; exit 1 ; fi
  52   # Note the quotes around `$TEMP': they are essential!
  53   eval set -- "$TEMP"
  54
  55   while [ ${#} -ge 1 ]; do
  56     case ${1} in
  57       -c | --config)
  58         CONFIG_FILE=${2}
  59         shift 2
  60         ;;
  61       -d | --debug)
  62         LOG_LEVEL="debug"
  63         shift
  64         ;;
  65       -p | --ssl-port)
  66         CONTROLLER_EXT_SSL_PORT=${2}
  67         shift 2
  68         ;;
  69       -r | --roles)
  70         for i in ${2//,/ }
  71           do
  72             # Verify the role exists
  73             if [[ ! "database,api,controller,keepstore,websocket,keepweb,workbench2,keepproxy,shell,workbench,dispatcher" == *"$i"* ]]; then
  74               echo "The role '${i}' is not a valid role"
  75               usage
  76               exit 1
  77             fi
  78             ROLES="${ROLES} ${i}"
  79           done
  80           shift 2
  81         ;;
  82       -t | --test)
  83         TEST="yes"
  84         shift
  85         ;;
  86       -v | --vagrant)
  87         VAGRANT="yes"
  88         shift
  89         ;;
  90       --)
  91         shift
  92         break
  93         ;;
  94       *)
  95         usage
  96         exit 1
  97         ;;
  98     esac
  99   done
 100 }
 101
 102 CONFIG="${SCRIPT_DIR}/local.params"
 103 CONFIG_DIR="config_examples/single_host/multiple_hostnames"
 104 LOG_LEVEL="info"
 105 CONTROLLER_EXT_SSL_PORT=443
 106 TESTS_DIR="tests"
 107
 108 CLUSTER=""
 109 DOMAIN=""
 110 HOSTNAME_EXT=""
 111 HOSTNAME_INT="127.0.1.1"
 112 INITIAL_USER=""
 113 INITIAL_USER_EMAIL=""
 114 INITIAL_USER_PASSWORD=""
 115
 116 CONTROLLER_EXT_SSL_PORT=8000
 117 KEEP_EXT_SSL_PORT=25101
 118 # Both for collections and downloads
 119 KEEPWEB_EXT_SSL_PORT=9002
 120 WEBSHELL_EXT_SSL_PORT=4202
 121 WEBSOCKET_EXT_SSL_PORT=8002
 122 WORKBENCH1_EXT_SSL_PORT=443
 123 WORKBENCH2_EXT_SSL_PORT=3001
 124
 125 RELEASE="production"
 126 VERSION="latest"
 127 ARVADOS_TAG="v1.1.4"
 128 POSTGRES_TAG="v0.41.3"
 129 NGINX_TAG="v2.4.0"
 130 DOCKER_TAG="v1.0.0"
 131 LOCALE_TAG="v0.3.4"
 132
 133 # Salt's dir
 134 ## states
 135 S_DIR="/srv/salt"
 136 ## formulas
 137 F_DIR="/srv/formulas"
 138 ##pillars
 139 P_DIR="/srv/pillars"
 140
 141 arguments ${@}
 142
 143 if [ -s ${CONFIG_FILE} ]; then
 144   source ${CONFIG_FILE}
 145 else
 146   echo >&2 "Please create a '${CONFIG_FILE}' file with initial values, as described in FIXME_URL_TO_DESCR"
 147   exit 1
 148 fi
 149
 150 if ! grep -E '^[[:alnum:]]{5}$' <<<${CLUSTER} ; then
 151   echo >&2 "ERROR: <CLUSTER> must be exactly 5 alphanumeric characters long"
 152   echo >&2 "Fix the cluster name in the 'local.params' file and re-run the provision script"
 153   exit 1
 154 fi
 155
 156 apt-get update
 157 apt-get install -y curl git jq
 158
 159 dpkg -l |grep salt-minion
 160 if [ ${?} -eq 0 ]; then
 161   echo "Salt already installed"
 162 else
 163   curl -L https://bootstrap.saltstack.com -o /tmp/bootstrap_salt.sh
 164   sh /tmp/bootstrap_salt.sh -XdfP -x python3
 165   /bin/systemctl disable salt-minion.service
 166 fi
 167
 168 # Set salt to masterless mode
 169 cat > /etc/salt/minion << EOFSM
 170 file_client: local
 171 file_roots:
 172   base:
 173     - ${S_DIR}
 174     - ${F_DIR}/*
 175
 176 pillar_roots:
 177   base:
 178     - ${P_DIR}
 179 EOFSM
 180
 181 mkdir -p ${S_DIR} ${F_DIR} ${P_DIR}
 182
 183 # Get the formula and dependencies
 184 cd ${F_DIR} || exit 1
 185 git clone --branch "${ARVADOS_TAG}" https://github.com/arvados/arvados-formula.git
 186 git clone --branch "${DOCKER_TAG}" https://github.com/saltstack-formulas/docker-formula.git
 187 git clone --branch "${LOCALE_TAG}" https://github.com/saltstack-formulas/locale-formula.git
 188 git clone --branch "${NGINX_TAG}" https://github.com/saltstack-formulas/nginx-formula.git
 189 git clone --branch "${POSTGRES_TAG}" https://github.com/saltstack-formulas/postgres-formula.git
 190
 191 if [ "x${BRANCH}" != "x" ]; then
 192   cd ${F_DIR}/arvados-formula || exit 1
 193   git checkout -t origin/"${BRANCH}"
 194   cd -
 195 fi
 196
 197 if [ "x${VAGRANT}" = "xyes" ]; then
 198   SOURCE_PILLARS_DIR="/vagrant/${CONFIG_DIR}/pillars"
 199   TESTS_DIR="/vagrant/${TESTS_DIR}"
 200 else
 201   SOURCE_PILLARS_DIR="${SCRIPT_DIR}/${CONFIG_DIR}/pillars"
 202   TESTS_DIR="${SCRIPT_DIR}/${TESTS_DIR}"
 203 fi
 204
 205 SOURCE_STATES_DIR="${EXTRA_STATES_DIR}"
 206
 207 # Replace variables (cluster,  domain, etc) in the pillars, states and tests
 208 # to ease deployment for newcomers
 209 for f in "${SOURCE_PILLARS_DIR}"/*; do
 210   sed "s/__ANONYMOUS_USER_TOKEN__/${ANONYMOUS_USER_TOKEN}/g;
 211        s/__BLOB_SIGNING_KEY__/${BLOB_SIGNING_KEY}/g;
 212        s/__CONTROLLER_EXT_SSL_PORT__/${CONTROLLER_EXT_SSL_PORT}/g;
 213        s/__CLUSTER__/${CLUSTER}/g;
 214        s/__DOMAIN__/${DOMAIN}/g;
 215        s/__HOSTNAME_EXT__/${HOSTNAME_EXT}/g;
 216        s/__HOSTNAME_INT__/${HOSTNAME_INT}/g;
 217        s/__INITIAL_USER_EMAIL__/${INITIAL_USER_EMAIL}/g;
 218        s/__INITIAL_USER_PASSWORD__/${INITIAL_USER_PASSWORD}/g;
 219        s/__INITIAL_USER__/${INITIAL_USER}/g;
 220        s/__KEEPWEB_EXT_SSL_PORT__/${KEEPWEB_EXT_SSL_PORT}/g;
 221        s/__KEEP_EXT_SSL_PORT__/${KEEP_EXT_SSL_PORT}/g;
 222        s/__MANAGEMENT_TOKEN__/${MANAGEMENT_TOKEN}/g;
 223        s/__RAILS_SECRET_TOKEN__/${RAILS_SECRET_TOKEN}/g;
 224        s/__RELEASE__/${RELEASE}/g;
 225        s/__SYSTEM_ROOT_TOKEN__/${SYSTEM_ROOT_TOKEN}/g;
 226        s/__VERSION__/${VERSION}/g;
 227        s/__WEBSHELL_EXT_SSL_PORT__/${WEBSHELL_EXT_SSL_PORT}/g;
 228        s/__WEBSOCKET_EXT_SSL_PORT__/${WEBSOCKET_EXT_SSL_PORT}/g;
 229        s/__WORKBENCH1_EXT_SSL_PORT__/${WORKBENCH1_EXT_SSL_PORT}/g;
 230        s/__WORKBENCH2_EXT_SSL_PORT__/${WORKBENCH2_EXT_SSL_PORT}/g;
 231        s/__WORKBENCH_SECRET_KEY__/${WORKBENCH_SECRET_KEY}/g" \
 232   "${f}" > "${P_DIR}"/$(basename "${f}")
 233 done
 234
 235 mkdir -p /tmp/cluster_tests
 236 # Replace cluster and domain name in the test files
 237 for f in "${TESTS_DIR}"/*; do
 238   sed "s/__CLUSTER__/${CLUSTER}/g;
 239        s/__CONTROLLER_EXT_SSL_PORT__/${CONTROLLER_EXT_SSL_PORT}/g;
 240        s/__DOMAIN__/${DOMAIN}/g;
 241        s/__HOSTNAME_INT__/${HOSTNAME_INT}/g;
 242        s/__INITIAL_USER_EMAIL__/${INITIAL_USER_EMAIL}/g;
 243        s/__INITIAL_USER_PASSWORD__/${INITIAL_USER_PASSWORD}/g
 244        s/__INITIAL_USER__/${INITIAL_USER}/g;
 245        s/__SYSTEM_ROOT_TOKEN__/${SYSTEM_ROOT_TOKEN}/g" \
 246   "${f}" > "/tmp/cluster_tests"/$(basename "${f}")
 247 done
 248 chmod 755 /tmp/cluster_tests/run-test.sh
 249
 250 # Replace helper state files that differ from the formula's examples
 251 if [ -d "${SOURCE_STATES_DIR}" ]; then
 252   mkdir -p "${F_DIR}"/extra/extra
 253
 254   for f in "${SOURCE_STATES_DIR}"/*; do
 255     sed "s/__ANONYMOUS_USER_TOKEN__/${ANONYMOUS_USER_TOKEN}/g;
 256          s/__CLUSTER__/${CLUSTER}/g;
 257          s/__BLOB_SIGNING_KEY__/${BLOB_SIGNING_KEY}/g;
 258          s/__CONTROLLER_EXT_SSL_PORT__/${CONTROLLER_EXT_SSL_PORT}/g;
 259          s/__DOMAIN__/${DOMAIN}/g;
 260          s/__HOSTNAME_EXT__/${HOSTNAME_EXT}/g;
 261          s/__HOSTNAME_INT__/${HOSTNAME_INT}/g;
 262          s/__INITIAL_USER_EMAIL__/${INITIAL_USER_EMAIL}/g;
 263          s/__INITIAL_USER_PASSWORD__/${INITIAL_USER_PASSWORD}/g;
 264          s/__INITIAL_USER__/${INITIAL_USER}/g;
 265          s/__KEEPWEB_EXT_SSL_PORT__/${KEEPWEB_EXT_SSL_PORT}/g;
 266          s/__KEEP_EXT_SSL_PORT__/${KEEP_EXT_SSL_PORT}/g;
 267          s/__MANAGEMENT_TOKEN__/${MANAGEMENT_TOKEN}/g;
 268          s/__RAILS_SECRET_TOKEN__/${RAILS_SECRET_TOKEN}/g;
 269          s/__RELEASE__/${RELEASE}/g;
 270          s/__SYSTEM_ROOT_TOKEN__/${SYSTEM_ROOT_TOKEN}/g;
 271          s/__VERSION__/${VERSION}/g;
 272          s/__WEBSHELL_EXT_SSL_PORT__/${WEBSHELL_EXT_SSL_PORT}/g;
 273          s/__WEBSOCKET_EXT_SSL_PORT__/${WEBSOCKET_EXT_SSL_PORT}/g;
 274          s/__WORKBENCH1_EXT_SSL_PORT__/${WORKBENCH1_EXT_SSL_PORT}/g;
 275          s/__WORKBENCH2_EXT_SSL_PORT__/${WORKBENCH2_EXT_SSL_PORT}/g;
 276          s/__WORKBENCH_SECRET_KEY__/${WORKBENCH_SECRET_KEY}/g" \
 277     "${f}" > "${F_DIR}/extra/extra"/$(basename "${f}")
 278   done
 279 fi
 280
 281 # Now, we build the SALT states/pillars trees
 282 # States
 283 cat > ${S_DIR}/top.sls << EOFTSLS
 284 base:
 285   '*':
 286     - locale
 287 EOFTSLS
 288
 289 if [ -d "${SOURCE_STATES_DIR}" ]; then
 290   for f in "${F_DIR}"/extra/extra/*.sls; do
 291   echo "    - extra.$(basename ${f} | sed 's/.sls$//g')" >> ${S_DIR}/top.sls
 292   done
 293 fi
 294
 295 # If we want specific roles for a node, just add the desired states
 296 # and its dependencies
 297 if [ -z "${ROLES}" ]; then
 298   echo '    - nginx.passenger' >> ${S_DIR}/top.sls
 299   echo '    - postgres' >> ${S_DIR}/top.sls
 300   echo '    - docker' >> ${S_DIR}/top.sls
 301   echo '    - arvados' >> ${S_DIR}/top.sls
 302 else
 303   # If we add individual roles, make sure we add the repo first
 304   echo "    - arvados.repo" >> ${S_DIR}/top.sls
 305   for R in ${ROLES}; do
 306     case "${R}" in
 307       "database")
 308         echo "    - postgres" >> ${S_DIR}/top.sls
 309       ;;
 310       "api","workbench","workbench2","keepweb","keepproxy")
 311         grep -q "nginx.passenger" ${S_DIR}/top.sls || echo "    - nginx.passenger" >> ${S_DIR}/top.sls
 312         echo "    - arvados.${R}" >> ${S_DIR}/top.sls
 313       ;;
 314       "shell","dispatcher")
 315         grep -q "docker" ${S_DIR}/top.sls || echo "    - docker" >> ${S_DIR}/top.sls
 316         echo "    - arvados.${R}" >> ${S_DIR}/top.sls
 317       ;;
 318       *)
 319         echo "    - arvados.${R}" >> ${S_DIR}/top.sls
 320       ;;
 321     esac
 322   done
 323 fi
 324
 325 # Pillars
 326 cat > ${P_DIR}/top.sls << EOFPSLS
 327 base:
 328   '*':
 329     - arvados
 330     - docker
 331     - locale
 332     - nginx_api_configuration
 333     - nginx_controller_configuration
 334     - nginx_keepproxy_configuration
 335     - nginx_keepweb_configuration
 336     - nginx_passenger
 337     - nginx_websocket_configuration
 338     - nginx_webshell_configuration
 339     - nginx_workbench2_configuration
 340     - nginx_workbench_configuration
 341     - postgresql
 342 EOFPSLS
 343
 344 # FIXME! #16992 Temporary fix for psql call in arvados-api-server
 345 if [ -e /root/.psqlrc ]; then
 346   if ! ( grep 'pset pager off' /root/.psqlrc ); then
 347     RESTORE_PSQL="yes"
 348     cp /root/.psqlrc /root/.psqlrc.provision.backup
 349   fi
 350 else
 351   DELETE_PSQL="yes"
 352 fi
 353
 354 echo '\pset pager off' >> /root/.psqlrc
 355 # END FIXME! #16992 Temporary fix for psql call in arvados-api-server
 356
 357 # Now run the install
 358 salt-call --local state.apply -l ${LOG_LEVEL}
 359
 360 # FIXME! #16992 Temporary fix for psql call in arvados-api-server
 361 if [ "x${DELETE_PSQL}" = "xyes" ]; then
 362   echo "Removing .psql file"
 363   rm /root/.psqlrc
 364 fi
 365
 366 if [ "x${RESTORE_PSQL}" = "xyes" ]; then
 367   echo "Restoring .psql file"
 368   mv -v /root/.psqlrc.provision.backup /root/.psqlrc
 369 fi
 370 # END FIXME! #16992 Temporary fix for psql call in arvados-api-server
 371
 372 # Leave a copy of the Arvados CA so the user can copy it where it's required
 373 echo "Copying the Arvados CA certificate to the installer dir, so you can import it"
 374 # If running in a vagrant VM, also add default user to docker group
 375 if [ "x${VAGRANT}" = "xyes" ]; then
 376   cp /etc/ssl/certs/arvados-snakeoil-ca.pem /vagrant/${CLUSTER}.${DOMAIN}-arvados-snakeoil-ca.pem
 377
 378   echo "Adding the vagrant user to the docker group"
 379   usermod -a -G docker vagrant
 380 else
 381   cp /etc/ssl/certs/arvados-snakeoil-ca.pem ${SCRIPT_DIR}/${CLUSTER}.${DOMAIN}-arvados-snakeoil-ca.pem
 382 fi
 383
 384 # Test that the installation finished correctly
 385 if [ "x${TEST}" = "xyes" ]; then
 386   cd /tmp/cluster_tests
 387   ./run-test.sh
 388 fi