mirror of
https://github.com/xcat2/confluent.git
synced 2026-09-09 22:46:45 +00:00
Markus Hilger
398211a6ed
Ported from suse15-diskless, with the differences 16 forces: - dracut symlinks /lib/dracut/hooks to /var/lib/dracut/hooks, so a hook shipped at the old path replaces the symlink with a directory - there is no netconfig or /etc/sysconfig/network to hand the running address to, so the initramfs writes a NetworkManager keyfile instead. Without it NetworkManager claims the interface on its own terms and the tethered root filesystem goes away with the old address, and confignet never gets the chance to refine anything - the discovery loop retries without a delay, so a link that takes a moment to come up can exhaust all 30 tries before the first packet can go anywhere. Keep asking, as the el9 hook already does
135 lines
6.4 KiB
Bash
135 lines
6.4 KiB
Bash
. /lib/dracut-lib.sh
|
|
mkdir -p /mnt/remoteimg /mnt/remote /mnt/overlay
|
|
if [ "untethered" = "$(getarg confluent_imagemethod)" ]; then
|
|
mount -t tmpfs untethered /mnt/remoteimg
|
|
curl https://$confluent_mgr/confluent-public/os/$confluent_profile/rootimg.sfs -o /mnt/remoteimg/rootimg.sfs
|
|
else
|
|
confluent_urls="$confluent_urls https://$confluent_mgr/confluent-public/os/$confluent_profile/rootimg.sfs"
|
|
/opt/confluent/bin/urlmount $confluent_urls /mnt/remoteimg
|
|
fi
|
|
/opt/confluent/bin/confluent_imginfo /mnt/remoteimg/rootimg.sfs > /tmp/rootimg.info
|
|
loopdev=$(losetup -f)
|
|
export mountsrc=$loopdev
|
|
losetup -r $loopdev /mnt/remoteimg/rootimg.sfs
|
|
if grep '^Format: confluent_crypted' /tmp/rootimg.info > /dev/null; then
|
|
curl -sf -H "CONFLUENT_NODENAME: $nodename" -H "CONFLUENT_APIKEY: $(cat /etc/confluent/confluent.apikey)" https://$confluent_mgr/confluent-api/self/profileprivate/pending/rootimg.key > /tmp/rootimg.key
|
|
cipher=$(head -n 1 /tmp/rootimg.key)
|
|
key=$(tail -n 1 /tmp/rootimg.key)
|
|
len=$(wc -c /mnt/remoteimg/rootimg.sfs | awk '{print $1}')
|
|
len=$(((len-4096)/512))
|
|
dmsetup create cryptimg --table "0 $len crypt $cipher $key 0 $loopdev 8"
|
|
/opt/confluent/bin/confluent_imginfo /dev/mapper/cryptimg > /tmp/rootimg.info
|
|
mountsrc=/dev/mapper/cryptimg
|
|
fi
|
|
if grep '^Format: squashfs' /tmp/rootimg.info > /dev/null; then
|
|
mount -o ro $mountsrc /mnt/remote
|
|
elif grep '^Format: confluent_multisquash' /tmp/rootimg.info; then
|
|
tail -n +3 /tmp/rootimg.info | awk '{gsub("/", "_"); print "echo 0 " $4 " linear '$mountsrc' " $3 " | dmsetup create mproot" $7}' > /tmp/setupmount.sh
|
|
. /tmp/setupmount.sh
|
|
cat /tmp/setupmount.sh |awk '{printf "mount /dev/mapper/"$NF" "; sub("mproot", ""); gsub("_", "/"); print "/mnt/remote"$NF}' > /tmp/mountparts.sh
|
|
. /tmp/mountparts.sh
|
|
fi
|
|
|
|
#mount -t tmpfs overlay /mnt/overlay
|
|
modprobe zram
|
|
memtot=$(grep ^MemTotal: /proc/meminfo|awk '{print $2}')
|
|
memtot=$((memtot/2))$(grep ^MemTotal: /proc/meminfo | awk '{print $3'})
|
|
echo $memtot > /sys/block/zram0/disksize
|
|
mkfs.xfs /dev/zram0 > /dev/null
|
|
mount -o discard /dev/zram0 /mnt/overlay
|
|
if [ ! -f /tmp/mountparts.sh ]; then
|
|
mkdir -p /mnt/overlay/upper /mnt/overlay/work
|
|
mount -t overlay -o upperdir=/mnt/overlay/upper,workdir=/mnt/overlay/work,lowerdir=/mnt/remote disklessroot /sysroot
|
|
else
|
|
for srcmount in $(cat /tmp/mountparts.sh | awk '{print $3}'); do
|
|
mkdir -p /mnt/overlay${srcmount}/upper /mnt/overlay${srcmount}/work
|
|
mount -t overlay -o upperdir=/mnt/overlay${srcmount}/upper,workdir=/mnt/overlay${srcmount}/work,lowerdir=${srcmount} disklesspart /sysroot${srcmount#/mnt/remote}
|
|
done
|
|
fi
|
|
mkdir -p /sysroot/etc/ssh
|
|
mkdir -p /sysroot/etc/confluent
|
|
mkdir -p /sysroot/root/.ssh
|
|
cp /root/.ssh/* /sysroot/root/.ssh
|
|
chmod 700 /sysroot/root/.ssh
|
|
cp /etc/confluent/* /sysroot/etc/confluent/
|
|
cp /etc/ssh/*key* /sysroot/etc/ssh/
|
|
for pubkey in /etc/ssh/ssh_host*key.pub; do
|
|
certfile=${pubkey/.pub/-cert.pub}
|
|
privfile=${pubkey%.pub}
|
|
if [ -s $certfile ]; then
|
|
echo HostCertificate $certfile >> /sysroot/etc/ssh/sshd_config
|
|
fi
|
|
echo HostKey $privfile >> /sysroot/etc/ssh/sshd_config
|
|
done
|
|
|
|
mkdir -p /sysroot/dev /sysroot/sys /sysroot/proc /sysroot/run
|
|
if [ ! -z "$autocons" ]; then
|
|
autocons=${autocons%,*}
|
|
mkdir -p /run/systemd/generator/getty.target.wants
|
|
ln -s /usr/lib/systemd/system/serial-getty@.service /run/systemd/generator/getty.target.wants/serial-getty@${autocons}.service
|
|
fi
|
|
while [ ! -e /sysroot/sbin/init ]; do
|
|
echo "Failed to access root filesystem or it is missing /sbin/init"
|
|
echo "System should be accessible through ssh at port 2222 with the appropriate key"
|
|
while [ ! -e /sysroot/sbin/init ]; do
|
|
sleep 1
|
|
done
|
|
done
|
|
rootpassword=$(grep ^rootpassword: /etc/confluent/confluent.deploycfg)
|
|
rootpassword=${rootpassword#rootpassword: }
|
|
if [ "$rootpassword" = "null" ]; then
|
|
rootpassword=""
|
|
fi
|
|
|
|
if [ ! -z "$rootpassword" ]; then
|
|
sed -i "s@root:[^:]*:@root:$rootpassword:@" /sysroot/etc/shadow
|
|
fi
|
|
for i in /ssh/*.ca; do
|
|
echo '@cert-authority *' $(cat $i) >> /sysroot/etc/ssh/ssh_known_hosts
|
|
done
|
|
echo HostbasedAuthentication yes >> /sysroot/etc/ssh/sshd_config
|
|
echo HostbasedUsesNameFromPacketOnly yes >> /sysroot/etc/ssh/sshd_config
|
|
echo IgnoreRhosts no >> /sysroot/etc/ssh/sshd_config
|
|
sshconf=/sysroot/etc/ssh/ssh_config
|
|
if [ -d /sysroot/etc/ssh/ssh_config.d/ ]; then
|
|
sshconf=/sysroot/etc/ssh/ssh_config.d/01-confluent.conf
|
|
fi
|
|
echo 'Host *' >> $sshconf
|
|
echo ' HostbasedAuthentication yes' >> $sshconf
|
|
echo ' EnableSSHKeysign yes' >> $sshconf
|
|
echo ' HostbasedKeyTypes *ed25519*' >> $sshconf
|
|
curl -sf -H "CONFLUENT_NODENAME: $nodename" -H "CONFLUENT_APIKEY: $(cat /etc/confluent/confluent.apikey)" https://$confluent_mgr/confluent-api/self/nodelist > /sysroot/etc/ssh/shosts.equiv
|
|
cp /sysroot/etc/ssh/shosts.equiv /sysroot/root/.shosts
|
|
chmod 600 /sysroot/etc/ssh/*_key
|
|
chroot /sysroot cat /etc/confluent/ca.pem >> /sysroot/var/lib/ca-certificates/ca-bundle.pem
|
|
curl -sf https://$confluent_mgr/confluent-public/os/$confluent_profile/scripts/onboot.service > /sysroot/etc/systemd/system/onboot.service
|
|
mkdir -p /sysroot/opt/confluent/bin
|
|
curl -sf https://$confluent_mgr/confluent-public/os/$confluent_profile/scripts/onboot.sh > /sysroot/opt/confluent/bin/onboot.sh
|
|
chmod +x /sysroot/opt/confluent/bin/onboot.sh
|
|
cp /opt/confluent/bin/apiclient /sysroot/opt/confluent/bin
|
|
ln -s /etc/systemd/system/onboot.service /sysroot/etc/systemd/system/multi-user.target.wants/onboot.service
|
|
cp /etc/confluent/functions /sysroot/etc/confluent/functions
|
|
|
|
# Hand NetworkManager the connection the initramfs is already using. Without
|
|
# this it claims the interface on its own terms and the tethered root
|
|
# filesystem goes away with the old address. confignet refines it at onboot.
|
|
mkdir -p /sysroot/etc/NetworkManager/system-connections
|
|
for nmcfg in /run/confluent/*.nmconnection; do
|
|
[ -e "$nmcfg" ] || continue
|
|
cp $nmcfg /sysroot/etc/NetworkManager/system-connections/
|
|
chmod 600 /sysroot/etc/NetworkManager/system-connections/$(basename $nmcfg)
|
|
done
|
|
if grep installtodisk /proc/cmdline > /dev/null; then
|
|
. /etc/confluent/functions
|
|
run_remote installimage
|
|
exec reboot -f
|
|
fi
|
|
mv /lib/modules/$(uname -r) /lib/modules/$(uname -r)-ramfs
|
|
ln -s /sysroot/lib/modules/$(uname -r) /lib/modules/
|
|
if [ -d /lib/firmware ]; then
|
|
mv /lib/firmware /lib/firmware-ramfs
|
|
fi
|
|
ln -s /sysroot/lib/firmware /lib/firmware
|
|
chroot /sysroot chkstat --system --set --noheader > /dev/null
|
|
exec /opt/confluent/bin/start_root
|