mirror of
https://github.com/xcat2/confluent.git
synced 2026-09-05 04:27:56 +00:00
Jarrod Johnson
0746b843d2
Consistent with changes for EL, seal PCRs on firstboot to extend the usefulness of some sealing.
44 lines
1.8 KiB
Bash
Executable File
44 lines
1.8 KiB
Bash
Executable File
#!/bin/bash
|
|
echo "Confluent first boot is running"
|
|
HOME=$(getent passwd $(whoami)|cut -d: -f 6)
|
|
export HOME
|
|
(
|
|
exec >> /var/log/confluent/confluent-firstboot.log
|
|
exec 2>> /var/log/confluent/confluent-firstboot.log
|
|
chmod 600 /var/log/confluent/confluent-firstboot.log
|
|
cp -a /etc/confluent/ssh/* /etc/ssh/
|
|
systemctl restart ssh
|
|
rootpw=$(grep ^rootpassword: /etc/confluent/confluent.deploycfg |awk '{print $2}')
|
|
if [ ! -z "$rootpw" -a "$rootpw" != "null" ]; then
|
|
echo root:$rootpw | chpasswd -e
|
|
fi
|
|
nodename=$(grep ^NODENAME: /etc/confluent/confluent.info | awk '{print $2}')
|
|
confluent_apikey=$(cat /etc/confluent/confluent.apikey)
|
|
confluent_mgr=$(grep ^deploy_server: /etc/confluent/confluent.deploycfg |awk '{print $2}')
|
|
while ! ping -c 1 $confluent_mgr >& /dev/null; do
|
|
sleep 1
|
|
done
|
|
hostnamectl set-hostname $(grep ^NODENAME: /etc/confluent/confluent.info | awk '{print $2}')
|
|
touch /etc/cloud/cloud-init.disabled
|
|
source /etc/confluent/functions
|
|
confluent_profile=$(grep ^profile: /etc/confluent/confluent.deploycfg|awk '{print $2}')
|
|
if [ -e /etc/confluent/luks.key ]; then
|
|
tpm2pcrs=""
|
|
encryptboot=$(grep ^encryptboot: /target/etc/confluent/confluent.deploycfg | sed -e 's/^encryptboot://' -e 's/ //g')
|
|
case "$encryptboot" in
|
|
*pcrs=*)
|
|
tpm2pcrs=$(echo "$encryptboot" | sed -e 's/.*pcrs=//' -e 's/:.*//')
|
|
;;
|
|
esac
|
|
if [ -n "$tpm2pcrs" ]; then
|
|
run_remote tpm_luks_reseal.sh
|
|
fi
|
|
fi
|
|
export confluent_mgr confluent_profile
|
|
run_remote_python confignet
|
|
run_remote_parts firstboot.d
|
|
run_remote_config firstboot.d
|
|
curl --capath /etc/confluent/tls -f -H "CONFLUENT_NODENAME: $nodename" -H "CONFLUENT_APIKEY: $confluent_apikey" -X POST -d "status: complete" https://$confluent_mgr/confluent-api/self/updatestatus
|
|
) &
|
|
tail --pid $! -n 0 -F /var/log/confluent/confluent-post.log > /dev/console
|