diff --git a/confluent_osdeploy/diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh b/confluent_osdeploy/diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh index a37e704b..8d690658 100644 --- a/confluent_osdeploy/diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh +++ b/confluent_osdeploy/diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh @@ -188,83 +188,6 @@ for addr in $(grep ^MANAGER: /etc/confluent/confluent.info|awk '{print $2}'|sed fi done confluent_mgr=$(grep ^deploy_server: /etc/confluent/confluent.deploycfg| awk '{print $2}') -confluent_urls="$confluent_urls https://$confluent_mgr/confluent-public/os/$confluent_profile/rootimg.sfs" -mkdir -p /mnt/remoteimg /mnt/remote /mnt/overlay -# if untethered -# offer alternative to urlmount here, download and mount it if the -# user wants to expend ram to be untethered, proc/cmdline to configure -# else -/opt/confluent/bin/urlmount $confluent_urls /mnt/remoteimg -mount -o loop,ro /mnt/remoteimg/*.sfs /mnt/remote -#mount -t tmpfs overlay /mnt/overlay -modprobe zram -echo 16G > /sys/block/zram0/disksize -mkfs.xfs /dev/zram0 -mount /dev/zram0 /mnt/overlay -mkdir -p /mnt/overlay/upper /mnt/overlay/work -mount -t overlay -o upperdir=/mnt/overlay/upper,workdir=/mnt/overlay/work,lowerdir=/mnt/remote disklessroot /sysroot -mkdir -p /sysroot/etc/ssh -mkdir -p /sysroot/etc/confluent -mkdir -p /sysroot/root/.ssh -cp /root/.ssh/* /sysroot/root/.ssh -chmod 700 /sysroot/root/.ssh -cp /etc/confluent/* /sysroot/etc/confluent/ -cp /etc/ssh/*key* /sysroot/etc/ssh/ -for pubkey in /etc/ssh/ssh_host*key.pub; do - certfile=${pubkey/.pub/-cert.pub} - privfile=${pubkey%.pub} - if [ -s $certfile ]; then - echo HostCertificate $certfile >> /sysroot/etc/ssh/sshd_config - fi - echo HostKey $privfile >> /sysroot/etc/ssh/sshd_config -done - -mkdir -p /sysroot/dev /sysroot/sys /sysroot/proc /sysroot/run -if [ ! -z "$autocons" ]; then - autocons=${autocons%,*} - mkdir -p /run/systemd/generator/getty.target.wants - ln -s /usr/lib/systemd/system/serial-getty@.service /run/systemd/generator/getty.target.wants/serial-getty@${autocons}.service -fi -while [ ! -e /sysroot/sbin/init ]; do - echo "Failed to access root filesystem or it is missing /sbin/init" - echo "System should be accessible through ssh at port 2222 with the appropriate key" - while [ ! -e /sysroot/sbin/init ]; do - sleep 1 - done -done -rootpassword=$(grep ^rootpassword: /etc/confluent/confluent.deploycfg) -rootpassword=${rootpassword#rootpassword: } -if [ "$rootpassword" = "null" ]; then - rootpassword="" -fi - -if [ ! -z "$rootpassword" ]; then - sed -i "s@root:[^:]*:@root:$rootpassword:@" /sysroot/etc/shadow -fi -for i in /ssh/*.ca; do - echo '@cert-authority *' $(cat $i) >> /sysroot/etc/ssh/ssh_known_hosts -done -echo HostbasedAuthentication yes >> /sysroot/etc/ssh/sshd_config -echo HostbasedUsesNameFromPacketOnly yes >> /sysroot/etc/ssh/sshd_config -echo IgnoreRhosts no >> /sysroot/etc/ssh/sshd_config -sshconf=/sysroot/etc/ssh/ssh_config -if [ -d /sysroot/etc/ssh/ssh_config.d/ ]; then - sshconf=/sysroot/etc/ssh/ssh_config.d/01-confluent.conf -fi -echo 'Host *' >> $sshconf -echo ' HostbasedAuthentication yes' >> $sshconf -echo ' EnableSSHKeysign yes' >> $sshconf -echo ' HostbasedKeyTypes *ed25519*' >> $sshconf -curl -sf -H "CONFLUENT_NODENAME: $nodename" -H "CONFLUENT_APIKEY: $(cat /etc/confluent/confluent.apikey)" https://$confluent_mgr/confluent-api/self/nodelist > /sysroot/etc/ssh/shosts.equiv -cp /sysroot/etc/ssh/shosts.equiv /sysroot/root/.shosts -chmod 640 /sysroot/etc/ssh/*_key -chroot /sysroot chgrp ssh_keys /etc/ssh/*_key -chroot /sysroot cat /etc/confluent/ca.pem >> /etc/pki/tls/certs/ca-bundle.crt -curl -sf https://$confluent_mgr/confluent-public/os/$confluent_profile/scripts/onboot.service > /sysroot/etc/systemd/system/onboot.service -mkdir -p /sysroot/opt/confluent/bin -curl -sf https://$confluent_mgr/confluent-public/os/$confluent_profile/scripts/onboot.sh > /sysroot/opt/confluent/bin/onboot.sh -chmod +x /sysroot/opt/confluent/bin/onboot.sh -ln -s /etc/systemd/system/onboot.service /sysroot/etc/systemd/system/multi-user.target.wants/onboot.service -curl -sf https://$confluent_mgr/confluent-public/os/$confluent_profile/scripts/functions > /sysroot/etc/confluent/functions -exec /opt/confluent/bin/start_root - +mkdir -p /etc/confluent +curl -sf https://$confluent_mgr/confluent-public/os/$confluent_profile/scripts/functions > /etc/confluent/functions +source_remote imageboot.sh diff --git a/confluent_osdeploy/diskless/profile/common/scripts/imageboot.sh b/confluent_osdeploy/diskless/profile/common/scripts/imageboot.sh new file mode 100644 index 00000000..1e094e88 --- /dev/null +++ b/confluent_osdeploy/diskless/profile/common/scripts/imageboot.sh @@ -0,0 +1,83 @@ +. /lib/dracut-lib.sh +mkdir -p /mnt/remoteimg /mnt/remote /mnt/overlay +if [ "unethered" = $(getarg confluent_imagemethod) ]; then + mount -t tmpfs untethered /mnt/remoteimg + curl https://$confluent_mgr/confluent-public/os/$confluent_profile/rootimg.sfs -O /mnt/remoteimg/rootimg.sfs +else + confluent_urls="$confluent_urls https://$confluent_mgr/confluent-public/os/$confluent_profile/rootimg.sfs" + /opt/confluent/bin/urlmount $confluent_urls /mnt/remoteimg +fi +mount -o loop,ro /mnt/remoteimg/*.sfs /mnt/remote +#mount -t tmpfs overlay /mnt/overlay +modprobe zram +memtot=$(grep ^MemTotal: /proc/meminfo|awk '{print $2}') +memtot=$((memtot/2))$(grep ^MemTotal: /proc/meminfo | awk '{print $3'}) +echo $memtot > /sys/block/zram0/disksize +mkfs.xfs /dev/zram0 +mount /dev/zram0 /mnt/overlay +mkdir -p /mnt/overlay/upper /mnt/overlay/work +mount -t overlay -o upperdir=/mnt/overlay/upper,workdir=/mnt/overlay/work,lowerdir=/mnt/remote disklessroot /sysroot +mkdir -p /sysroot/etc/ssh +mkdir -p /sysroot/etc/confluent +mkdir -p /sysroot/root/.ssh +cp /root/.ssh/* /sysroot/root/.ssh +chmod 700 /sysroot/root/.ssh +cp /etc/confluent/* /sysroot/etc/confluent/ +cp /etc/ssh/*key* /sysroot/etc/ssh/ +for pubkey in /etc/ssh/ssh_host*key.pub; do + certfile=${pubkey/.pub/-cert.pub} + privfile=${pubkey%.pub} + if [ -s $certfile ]; then + echo HostCertificate $certfile >> /sysroot/etc/ssh/sshd_config + fi + echo HostKey $privfile >> /sysroot/etc/ssh/sshd_config +done + +mkdir -p /sysroot/dev /sysroot/sys /sysroot/proc /sysroot/run +if [ ! -z "$autocons" ]; then + autocons=${autocons%,*} + mkdir -p /run/systemd/generator/getty.target.wants + ln -s /usr/lib/systemd/system/serial-getty@.service /run/systemd/generator/getty.target.wants/serial-getty@${autocons}.service +fi +while [ ! -e /sysroot/sbin/init ]; do + echo "Failed to access root filesystem or it is missing /sbin/init" + echo "System should be accessible through ssh at port 2222 with the appropriate key" + while [ ! -e /sysroot/sbin/init ]; do + sleep 1 + done +done +rootpassword=$(grep ^rootpassword: /etc/confluent/confluent.deploycfg) +rootpassword=${rootpassword#rootpassword: } +if [ "$rootpassword" = "null" ]; then + rootpassword="" +fi + +if [ ! -z "$rootpassword" ]; then + sed -i "s@root:[^:]*:@root:$rootpassword:@" /sysroot/etc/shadow +fi +for i in /ssh/*.ca; do + echo '@cert-authority *' $(cat $i) >> /sysroot/etc/ssh/ssh_known_hosts +done +echo HostbasedAuthentication yes >> /sysroot/etc/ssh/sshd_config +echo HostbasedUsesNameFromPacketOnly yes >> /sysroot/etc/ssh/sshd_config +echo IgnoreRhosts no >> /sysroot/etc/ssh/sshd_config +sshconf=/sysroot/etc/ssh/ssh_config +if [ -d /sysroot/etc/ssh/ssh_config.d/ ]; then + sshconf=/sysroot/etc/ssh/ssh_config.d/01-confluent.conf +fi +echo 'Host *' >> $sshconf +echo ' HostbasedAuthentication yes' >> $sshconf +echo ' EnableSSHKeysign yes' >> $sshconf +echo ' HostbasedKeyTypes *ed25519*' >> $sshconf +curl -sf -H "CONFLUENT_NODENAME: $nodename" -H "CONFLUENT_APIKEY: $(cat /etc/confluent/confluent.apikey)" https://$confluent_mgr/confluent-api/self/nodelist > /sysroot/etc/ssh/shosts.equiv +cp /sysroot/etc/ssh/shosts.equiv /sysroot/root/.shosts +chmod 640 /sysroot/etc/ssh/*_key +chroot /sysroot chgrp ssh_keys /etc/ssh/*_key +chroot /sysroot cat /etc/confluent/ca.pem >> /etc/pki/tls/certs/ca-bundle.crt +curl -sf https://$confluent_mgr/confluent-public/os/$confluent_profile/scripts/onboot.service > /sysroot/etc/systemd/system/onboot.service +mkdir -p /sysroot/opt/confluent/bin +curl -sf https://$confluent_mgr/confluent-public/os/$confluent_profile/scripts/onboot.sh > /sysroot/opt/confluent/bin/onboot.sh +chmod +x /sysroot/opt/confluent/bin/onboot.sh +ln -s /etc/systemd/system/onboot.service /sysroot/etc/systemd/system/multi-user.target.wants/onboot.service +cp /etc/confluennt/functions /sysroot/etc/confluent/functions +exec /opt/confluent/bin/start_root