3 # Copyright 2018 Whitestack, LLC
5 # Licensed under the Apache License, Version 2.0 (the "License"); you may
6 # not use this file except in compliance with the License. You may obtain
7 # a copy of the License at
9 # http://www.apache.org/licenses/LICENSE-2.0
11 # Unless required by applicable law or agreed to in writing, software
12 # distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
13 # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
14 # License for the specific language governing permissions and limitations
17 # For those usages not covered by the Apache License, Version 2.0 please
18 # contact: esousa@whitestack.com or glavado@whitestack.com
30 echo "Wait until $max_attempts seconds for MySQL mano Server ${db_host}:${db_port} "
31 while ! mysqladmin
ping -h"$db_host" -P"$db_port" --silent; do
33 if [ $attempt -ge $max_attempts ]; then
35 echo "Can not connect to database ${db_host}:${db_port} during $max_attempts sec"
45 function wait_keystone_host
(){
48 echo "Wait until Keystone hostname can be resolved "
49 while ! nslookup $KEYSTONE_HOST; do
51 if [ $attempt -ge $max_attempts ]; then
53 echo "Can not resolve ${KEYSTONE_HOST} during $max_attempts sec"
63 function is_db_created
() {
70 if mysqlshow
-h"$db_host" -P"$db_port" -u"$db_user" -p"$db_pswd" |
grep -v Wildcard |
grep -q $db_name; then
71 echo "DB $db_name exists"
74 echo "DB $db_name does not exist"
79 function is_user_db_created
() {
86 user_count
=$
(mysql
-h"$db_host" -P"$db_port" -u"$db_user" -p"$db_pswd" --default_character_set utf8
-sse "SELECT COUNT(*) FROM mysql.user WHERE user='$db_user_to_check' AND host='%';")
88 if [ $user_count -gt 0 ]; then
89 echo "DB User $db_name exists"
92 echo "DB User $db_name does not exist"
97 wait_db
"$DB_HOST" "$DB_PORT" ||
exit 1
99 is_db_created
"$DB_HOST" "$DB_PORT" "$ROOT_DB_USER" "$ROOT_DB_PASSWORD" "keystone" && DB_EXISTS
="Y"
100 is_user_db_created
"$DB_HOST" "$DB_PORT" "$ROOT_DB_USER" "$ROOT_DB_PASSWORD" "keystone" && USER_DB_EXISTS
="Y"
102 if [ -z $DB_EXISTS ]; then
103 mysql
-h"$DB_HOST" -P"$DB_PORT" -u"$ROOT_DB_USER" -p"$ROOT_DB_PASSWORD" --default_character_set utf8
-e "CREATE DATABASE keystone"
105 if [ $
(mysql
-h"$DB_HOST" -P"$DB_PORT" -u"$ROOT_DB_USER" -p"$ROOT_DB_PASSWORD" --default_character_set utf8
-sse "SELECT COUNT(*) FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA = 'keystone';") -gt 0 ]; then
106 echo "DB keystone is empty"
111 if [ -z $USER_DB_EXISTS ]; then
112 mysql
-h"$DB_HOST" -P"$DB_PORT" -u"$ROOT_DB_USER" -p"$ROOT_DB_PASSWORD" --default_character_set utf8
-e "CREATE USER 'keystone'@'localhost' IDENTIFIED BY '$KEYSTONE_DB_PASSWORD'"
113 mysql
-h"$DB_HOST" -P"$DB_PORT" -u"$ROOT_DB_USER" -p"$ROOT_DB_PASSWORD" --default_character_set utf8
-e "GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost'"
114 mysql
-h"$DB_HOST" -P"$DB_PORT" -u"$ROOT_DB_USER" -p"$ROOT_DB_PASSWORD" --default_character_set utf8
-e "CREATE USER 'keystone'@'%' IDENTIFIED BY '$KEYSTONE_DB_PASSWORD'"
115 mysql
-h"$DB_HOST" -P"$DB_PORT" -u"$ROOT_DB_USER" -p"$ROOT_DB_PASSWORD" --default_character_set utf8
-e "GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%'"
118 # Setting Keystone database connection
119 sed -i '/^\[database\]$/,/^\[/ s/^connection = .*/connection = mysql+pymysql:\/\/keystone:'$KEYSTONE_DB_PASSWORD'@'$DB_HOST':'$DB_PORT'\/keystone/' /etc
/keystone
/keystone.conf
121 # Setting Keystone tokens
122 sed -i '/^\[token\]$/,/^\[/ s/^.*provider = .*/provider = fernet/' /etc
/keystone
/keystone.conf
125 # Use LDAP authentication for Identity
126 if [ $LDAP_AUTHENTICATION_DOMAIN_NAME ]; then
127 # Enable Keyston domains
128 sed -i "s%.*domain_specific_drivers_enabled =.*%domain_specific_drivers_enabled = true%" /etc
/keystone
/keystone.conf
129 sed -i "s%.*domain_config_dir =.*%domain_config_dir = /etc/keystone/domains%" /etc
/keystone
/keystone.conf
130 mkdir
-p /etc
/keystone
/domains
131 # Configure domain for LDAP authentication
132 cat << EOF > /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
137 user_allow_create=false
138 user_allow_update=false
139 user_allow_delete=false
140 group_allow_create=false
141 group_allow_update=false
142 group_allow_delete=false
145 if [ "$LDAP_BIND_USER" ]; then
146 echo "user = $LDAP_BIND_USER" >> /etc
/keystone
/domains
/keystone.
$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
148 if [ "$LDAP_BIND_PASSWORD" ]; then
149 echo "password = $LDAP_BIND_PASSWORD" >> /etc
/keystone
/domains
/keystone.
$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
151 if [ "$LDAP_CHASE_REFERRALS" ]; then
152 echo "chase_referrals = $LDAP_CHASE_REFERRALS" >> /etc
/keystone
/domains
/keystone.
$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
154 if [ "$LDAP_PAGE_SIZE" ]; then
155 echo "page_size = $LDAP_PAGE_SIZE" >> /etc
/keystone
/domains
/keystone.
$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
157 if [ "$LDAP_USER_TREE_DN" ]; then
158 echo "user_tree_dn = $LDAP_USER_TREE_DN" >> /etc
/keystone
/domains
/keystone.
$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
160 if [ "$LDAP_USER_OBJECTCLASS" ]; then
161 echo "user_objectclass = $LDAP_USER_OBJECTCLASS" >> /etc
/keystone
/domains
/keystone.
$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
163 if [ "$LDAP_USER_ID_ATTRIBUTE" ]; then
164 echo "user_id_attribute = $LDAP_USER_ID_ATTRIBUTE" >> /etc
/keystone
/domains
/keystone.
$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
166 if [ "$LDAP_USER_NAME_ATTRIBUTE" ]; then
167 echo "user_name_attribute = $LDAP_USER_NAME_ATTRIBUTE" >> /etc
/keystone
/domains
/keystone.
$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
169 if [ "$LDAP_USER_PASS_ATTRIBUTE" ]; then
170 echo "user_pass_attribute = $LDAP_USER_PASS_ATTRIBUTE" >> /etc
/keystone
/domains
/keystone.
$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
172 if [ "$LDAP_USER_FILTER" ]; then
173 echo "user_filter = $LDAP_USER_FILTER" >> /etc
/keystone
/domains
/keystone.
$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
175 if [ "$LDAP_USER_ENABLED_ATTRIBUTE" ]; then
176 echo "user_enabled_attribute = $LDAP_USER_ENABLED_ATTRIBUTE" >> /etc
/keystone
/domains
/keystone.
$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
178 if [ "$LDAP_USER_ENABLED_MASK" ]; then
179 echo "user_enabled_mask = $LDAP_USER_ENABLED_MASK" >> /etc
/keystone
/domains
/keystone.
$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
181 if [ "$LDAP_USER_ENABLED_DEFAULT" ]; then
182 echo "user_enabled_default = $LDAP_USER_ENABLED_DEFAULT" >> /etc
/keystone
/domains
/keystone.
$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
184 if [ "$LDAP_USER_ENABLED_INVERT" ]; then
185 echo "user_enabled_invert = $LDAP_USER_ENABLED_INVERT" >> /etc
/keystone
/domains
/keystone.
$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
187 if [ "$LDAP_GROUP_OBJECTCLASS" ]; then
188 echo "group_objectclass = $LDAP_GROUP_OBJECTCLASS" >> /etc
/keystone
/domains
/keystone.
$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
190 if [ "$LDAP_GROUP_TREE_DN" ]; then
191 echo "group_tree_dn = $LDAP_GROUP_TREE_DN" >> /etc
/keystone
/domains
/keystone.
$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
193 if [ "$LDAP_TLS_CACERT_BASE64" ]; then
194 mkdir
-p /etc
/ssl
/certs
/
195 echo "-----BEGIN CERTIFICATE-----" >> /etc
/ssl
/certs
/ca-certificates.crt
196 echo $LDAP_TLS_CACERT_BASE64 >> /etc
/ssl
/certs
/ca-certificates.crt
197 echo "-----END CERTIFICATE-----" >> /etc
/ssl
/certs
/ca-certificates.crt
199 if [ "$LDAP_USE_STARTTLS" ] && [ "$LDAP_USE_STARTTLS" == "true" ]; then
200 echo "use_tls = true" >> /etc
/keystone
/domains
/keystone.
$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
201 mkdir
-p /etc
/keystone
/ssl
/certs
/
202 echo "-----BEGIN CERTIFICATE-----" > /etc
/keystone
/ssl
/certs
/ca.pem
203 echo $LDAP_TLS_CACERT_BASE64 >> /etc
/keystone
/ssl
/certs
/ca.pem
204 echo "-----END CERTIFICATE-----" >> /etc
/keystone
/ssl
/certs
/ca.pem
205 echo "tls_cacertfile = /etc/keystone/ssl/certs/ca.pem" >> /etc
/keystone
/domains
/keystone.
$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
206 if [ "$LDAP_TLS_REQ_CERT" ]; then
207 echo "tls_req_cert = $LDAP_TLS_REQ_CERT" >> /etc
/keystone
/domains
/keystone.
$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
212 # Populate Keystone database
213 if [ -z $DB_EXISTS ] ||
[ -z $DB_NOT_EMPTY ]; then
214 keystone-manage db_sync
217 # Initialize Fernet key repositories
218 keystone-manage fernet_setup
--keystone-user keystone
--keystone-group keystone
219 keystone-manage credential_setup
--keystone-user keystone
--keystone-group keystone
223 # Bootstrap Keystone service
224 if [ -z $DB_EXISTS ] ||
[ -z $DB_NOT_EMPTY ]; then
225 keystone-manage bootstrap \
226 --bootstrap-username "$ADMIN_USERNAME" \
227 --bootstrap-password "$ADMIN_PASSWORD" \
228 --bootstrap-project "$ADMIN_PROJECT" \
229 --bootstrap-admin-url "http://$KEYSTONE_HOST:5000/v3/" \
230 --bootstrap-internal-url "http://$KEYSTONE_HOST:5000/v3/" \
231 --bootstrap-public-url "http://$KEYSTONE_HOST:5000/v3/" \
232 --bootstrap-region-id "$REGION_ID"
235 echo "ServerName $KEYSTONE_HOST" >> /etc
/apache
2/apache2.conf
237 # Restart Apache Service
238 service apache2 restart
240 cat << EOF >> setup_env
241 export OS_PROJECT_DOMAIN_NAME=default
242 export OS_USER_DOMAIN_NAME=default
243 export OS_PROJECT_NAME=$ADMIN_PROJECT
244 export OS_USERNAME=$ADMIN_USERNAME
245 export OS_PASSWORD=$ADMIN_PASSWORD
246 export OS_AUTH_URL=http://$KEYSTONE_HOST:5000/v3
247 export OS_IDENTITY_API_VERSION=3
248 export OS_IMAGE_API_VERSION=2
254 if [ -z $DB_EXISTS ] ||
[ -z $DB_NOT_EMPTY ]; then
255 openstack user create
--domain default
--password "$SERVICE_PASSWORD" "$SERVICE_USERNAME"
256 openstack project create
--domain default
--description "Service Project" "$SERVICE_PROJECT"
257 openstack role add
--project "$SERVICE_PROJECT" --user "$SERVICE_USERNAME" admin
260 if [ $LDAP_AUTHENTICATION_DOMAIN_NAME ]; then
261 if !(openstack domain list |
grep -q $LDAP_AUTHENTICATION_DOMAIN_NAME); then
262 # Create domain in keystone for LDAP authentication
263 openstack domain create
$LDAP_AUTHENTICATION_DOMAIN_NAME
264 # Restart Apache Service
265 service apache2 restart
267 # Check periodically LDAP for updates
268 echo "0 1 * * * keystone-manage mapping_purge --domain-name $LDAP_AUTHENTICATION_DOMAIN_NAME; keystone-manage mapping_populate --domain-name $LDAP_AUTHENTICATION_DOMAIN_NAME" >> /var
/spool
/cron
/crontabs
/root
271 while ps
-ef |
grep -v grep |
grep -q apache2
276 # Only reaches this point if apache2 stops running
277 # When this happens exits with error code