mirror of
https://github.com/xcat2/confluent.git
synced 2026-09-02 15:36:05 +00:00
Jarrod Johnson
730f645dc0
If someone wants to seal to a PCR explicitly to prevent booting rescue, the PCR is likely to extend differently during install. Leave the volume sealed to the tpm without any PCRs until first boot. Then wipe the bindings without PCR specified, and seal according to user preferred values.
73 lines
2.7 KiB
Bash
73 lines
2.7 KiB
Bash
#!/bin/sh
|
|
HOME=$(getent passwd $(whoami)|cut -d: -f 6)
|
|
export HOME
|
|
|
|
# This script is executed on the first boot after install has
|
|
# completed. It is best to edit the middle of the file as
|
|
# noted below so custom commands are executed before
|
|
# the script notifies confluent that install is fully complete.
|
|
|
|
nodename=$(grep ^NODENAME /etc/confluent/confluent.info|awk '{print $2}')
|
|
confluent_apikey=$(cat /etc/confluent/confluent.apikey)
|
|
v4cfg=$(grep ^ipv4_method: /etc/confluent/confluent.deploycfg)
|
|
v4cfg=${v4cfg#ipv4_method: }
|
|
if [ "$v4cfg" = "static" ] || [ "$v4cfg" = "dhcp" ]; then
|
|
confluent_mgr=$(grep ^deploy_server: /etc/confluent/confluent.deploycfg)
|
|
confluent_mgr=${confluent_mgr#deploy_server: }
|
|
confluent_pingtarget=$confluent_mgr
|
|
fi
|
|
if [ -z "$confluent_mgr" ]; then
|
|
confluent_mgr=$(grep ^deploy_server_v6: /etc/confluent/confluent.deploycfg)
|
|
confluent_mgr=${confluent_mgr#deploy_server_v6: }
|
|
if [ -z "$confluent_mgr" ]; then
|
|
confluent_mgr=$(grep ^deploy_server: /etc/confluent/confluent.deploycfg)
|
|
confluent_mgr=${confluent_mgr#deploy_server: }
|
|
confluent_pingtarget=$confluent_mgr
|
|
else
|
|
confluent_pingtarget=$confluent_mgr
|
|
confluent_mgr="[$confluent_mgr]"
|
|
fi
|
|
fi
|
|
confluent_profile=$(grep ^profile: /etc/confluent/confluent.deploycfg|awk '{print $2}')
|
|
export nodename confluent_mgr confluent_profile
|
|
. /etc/confluent/functions
|
|
(
|
|
exec >> /var/log/confluent/confluent-firstboot.log
|
|
exec 2>> /var/log/confluent/confluent-firstboot.log
|
|
chmod 600 /var/log/confluent/confluent-firstboot.log
|
|
if [ ! -f /etc/confluent/firstboot.ran ]; then
|
|
cat /etc/confluent/tls/*.pem >> /etc/pki/tls/certs/ca-bundle.crt
|
|
confluentpython /root/confignet
|
|
rm /root/confignet
|
|
fi
|
|
|
|
|
|
while ! ping -c 1 $confluent_pingtarget >& /dev/null; do
|
|
sleep 1
|
|
done
|
|
|
|
if [ -e /etc/confluent/luks.key ]; then
|
|
pcrs=$(sed -n -e 's/.*tpm2:pcrs=\([0-9,]*\).*/\1/p' /tmp/cryptboot)
|
|
if [ -n "$pcrs" ]; then
|
|
run_remote tpm_luks_reseal.sh
|
|
fi
|
|
fi
|
|
|
|
if [ ! -f /etc/confluent/firstboot.ran ]; then
|
|
touch /etc/confluent/firstboot.ran
|
|
|
|
run_remote firstboot.custom
|
|
# Firstboot scripts may be placed into firstboot.d, e.g. firstboot.d/01-firstaction.sh, firstboot.d/02-secondaction.sh
|
|
run_remote_parts firstboot.d
|
|
|
|
# Induce execution of remote configuration, e.g. ansible plays in ansible/firstboot.d/
|
|
run_remote_config firstboot.d
|
|
fi
|
|
|
|
curl -X POST -d 'status: complete' -H "CONFLUENT_NODENAME: $nodename" -H "CONFLUENT_APIKEY: $confluent_apikey" https://$confluent_mgr/confluent-api/self/updatestatus
|
|
systemctl disable firstboot
|
|
rm /etc/systemd/system/firstboot.service
|
|
rm /etc/confluent/firstboot.ran
|
|
) &
|
|
tail --pid $! -n 0 -F /var/log/confluent/confluent-firstboot.log > /dev/console
|