docker/Keystone/scripts/start.sh

   1 #!/bin/bash
   2
   3 # Copyright 2018 Whitestack, LLC
   4 #
   5 # Licensed under the Apache License, Version 2.0 (the "License"); you may
   6 # not use this file except in compliance with the License. You may obtain
   7 # a copy of the License at
   8 #
   9 #         http://www.apache.org/licenses/LICENSE-2.0
  10 #
  11 # Unless required by applicable law or agreed to in writing, software
  12 # distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  13 # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
  14 # License for the specific language governing permissions and limitations
  15 # under the License.
  16 #
  17 # For those usages not covered by the Apache License, Version 2.0 please
  18 # contact: esousa@whitestack.com or glavado@whitestack.com
  19 ##
  20
  21 DB_EXISTS=""
  22 USER_DB_EXISTS=""
  23 DB_NOT_EMPTY=""
  24
  25 max_attempts=120
  26 function wait_db(){
  27     db_host=$1
  28     db_port=$2
  29     attempt=0
  30     echo "Wait until $max_attempts seconds for MySQL mano Server ${db_host}:${db_port} "
  31     while ! mysqladmin ping -h"$db_host" -P"$db_port" --silent; do
  32         #wait 120 sec
  33         if [ $attempt -ge $max_attempts ]; then
  34             echo
  35             echo "Can not connect to database ${db_host}:${db_port} during $max_attempts sec"
  36             return 1
  37         fi
  38         attempt=$[$attempt+1]
  39         echo -n "."
  40         sleep 1
  41     done
  42     return 0
  43 }
  44
  45 function wait_keystone_host(){
  46     attempt=0
  47     timeout=2
  48     echo "Wait until Keystone hostname can be resolved "
  49     while ! nslookup $KEYSTONE_HOST; do
  50         #wait 120 sec
  51         if [ $attempt -ge $max_attempts ]; then
  52             echo
  53             echo "Can not resolve ${KEYSTONE_HOST} during $max_attempts sec"
  54             return 1
  55         fi
  56         attempt=$[$attempt+1]
  57         echo -n "."
  58         sleep 1
  59     done
  60     return 0
  61 }
  62
  63 function is_db_created() {
  64     db_host=$1
  65     db_port=$2
  66     db_user=$3
  67     db_pswd=$4
  68     db_name=$5
  69
  70     if mysqlshow -h"$db_host" -P"$db_port" -u"$db_user" -p"$db_pswd" | grep -v Wildcard | grep -q $db_name; then
  71         echo "DB $db_name exists"
  72         return 0
  73     else
  74         echo "DB $db_name does not exist"
  75         return 1
  76     fi
  77 }
  78
  79 function is_user_db_created() {
  80     db_host=$1
  81     db_port=$2
  82     db_user=$3
  83     db_pswd=$4
  84     db_user_to_check=$5
  85
  86     user_count=$(mysql -h"$db_host" -P"$db_port" -u"$db_user" -p"$db_pswd" --default_character_set utf8 -sse "SELECT COUNT(*) FROM mysql.user WHERE user='$db_user_to_check' AND host='%';")
  87
  88     if [ $user_count -gt 0 ]; then
  89         echo "DB User $db_name exists"
  90         return 0
  91     else
  92         echo "DB User $db_name does not exist"
  93         return 1
  94     fi
  95 }
  96
  97 wait_db "$DB_HOST" "$DB_PORT" || exit 1
  98
  99 is_db_created "$DB_HOST" "$DB_PORT" "$ROOT_DB_USER" "$ROOT_DB_PASSWORD" "keystone" && DB_EXISTS="Y"
 100 is_user_db_created "$DB_HOST" "$DB_PORT" "$ROOT_DB_USER" "$ROOT_DB_PASSWORD" "keystone" && USER_DB_EXISTS="Y"
 101
 102 if [ -z $DB_EXISTS ]; then
 103     mysql -h"$DB_HOST" -P"$DB_PORT" -u"$ROOT_DB_USER" -p"$ROOT_DB_PASSWORD" --default_character_set utf8 -e "CREATE DATABASE keystone"
 104 else
 105     if [ $(mysql -h"$DB_HOST" -P"$DB_PORT" -u"$ROOT_DB_USER" -p"$ROOT_DB_PASSWORD" --default_character_set utf8 -sse "SELECT COUNT(*) FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA = 'keystone';") -gt 0 ]; then
 106         echo "DB keystone is empty"
 107         DB_NOT_EMPTY="y"
 108     fi
 109 fi
 110
 111 if [ -z $USER_DB_EXISTS ]; then
 112     mysql -h"$DB_HOST" -P"$DB_PORT" -u"$ROOT_DB_USER" -p"$ROOT_DB_PASSWORD" --default_character_set utf8 -e "CREATE USER 'keystone'@'localhost' IDENTIFIED BY '$KEYSTONE_DB_PASSWORD'"
 113     mysql -h"$DB_HOST" -P"$DB_PORT" -u"$ROOT_DB_USER" -p"$ROOT_DB_PASSWORD" --default_character_set utf8 -e "GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost'"
 114     mysql -h"$DB_HOST" -P"$DB_PORT" -u"$ROOT_DB_USER" -p"$ROOT_DB_PASSWORD" --default_character_set utf8 -e "CREATE USER 'keystone'@'%' IDENTIFIED BY '$KEYSTONE_DB_PASSWORD'"
 115     mysql -h"$DB_HOST" -P"$DB_PORT" -u"$ROOT_DB_USER" -p"$ROOT_DB_PASSWORD" --default_character_set utf8 -e "GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%'"
 116 fi
 117
 118 # Setting Keystone database connection
 119 sed -i '/^\[database\]$/,/^\[/ s/^connection = .*/connection = mysql+pymysql:\/\/keystone:'$KEYSTONE_DB_PASSWORD'@'$DB_HOST':'$DB_PORT'\/keystone/' /etc/keystone/keystone.conf
 120
 121 # Setting Keystone tokens
 122 sed -i '/^\[token\]$/,/^\[/ s/^.*provider = .*/provider = fernet/' /etc/keystone/keystone.conf
 123
 124
 125 # Use LDAP authentication for Identity
 126 if [ $LDAP_AUTHENTICATION_DOMAIN_NAME ]; then
 127     # Enable Keyston domains
 128     sed -i "s%.*domain_specific_drivers_enabled =.*%domain_specific_drivers_enabled = true%" /etc/keystone/keystone.conf
 129     sed -i "s%.*domain_config_dir =.*%domain_config_dir = /etc/keystone/domains%" /etc/keystone/keystone.conf
 130     mkdir -p /etc/keystone/domains
 131     # Configure domain for LDAP authentication
 132     cat << EOF > /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 133 [identity]
 134 driver = ldap
 135 [ldap]
 136 url = $LDAP_URL
 137 user_allow_create=false
 138 user_allow_update=false
 139 user_allow_delete=false
 140 group_allow_create=false
 141 group_allow_update=false
 142 group_allow_delete=false
 143 query_scope = sub
 144 EOF
 145     if [ "$LDAP_BIND_USER" ]; then
 146         echo "user = $LDAP_BIND_USER" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 147     fi
 148     if [ "$LDAP_BIND_PASSWORD" ]; then
 149         echo "password = $LDAP_BIND_PASSWORD" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 150     fi
 151     if [ "$LDAP_CHASE_REFERRALS" ]; then
 152         echo "chase_referrals = $LDAP_CHASE_REFERRALS" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 153     fi
 154     if [ "$LDAP_PAGE_SIZE" ]; then
 155         echo "page_size = $LDAP_PAGE_SIZE" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 156     fi
 157     if [ "$LDAP_USER_TREE_DN" ]; then
 158         echo "user_tree_dn = $LDAP_USER_TREE_DN" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 159     fi
 160     if [ "$LDAP_USER_OBJECTCLASS" ]; then
 161         echo "user_objectclass = $LDAP_USER_OBJECTCLASS" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 162     fi
 163     if [ "$LDAP_USER_ID_ATTRIBUTE" ]; then
 164         echo "user_id_attribute = $LDAP_USER_ID_ATTRIBUTE" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 165     fi
 166     if [ "$LDAP_USER_NAME_ATTRIBUTE" ]; then
 167         echo "user_name_attribute = $LDAP_USER_NAME_ATTRIBUTE" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 168     fi
 169     if [ "$LDAP_USER_PASS_ATTRIBUTE" ]; then
 170         echo "user_pass_attribute = $LDAP_USER_PASS_ATTRIBUTE" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 171     fi
 172     if [ "$LDAP_USER_FILTER" ]; then
 173         echo "user_filter = $LDAP_USER_FILTER" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 174     fi
 175     if [ "$LDAP_USER_ENABLED_ATTRIBUTE" ]; then
 176         echo "user_enabled_attribute = $LDAP_USER_ENABLED_ATTRIBUTE" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 177     fi
 178     if [ "$LDAP_USER_ENABLED_MASK" ]; then
 179         echo "user_enabled_mask = $LDAP_USER_ENABLED_MASK" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 180     fi
 181     if [ "$LDAP_USER_ENABLED_DEFAULT" ]; then
 182         echo "user_enabled_default = $LDAP_USER_ENABLED_DEFAULT" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 183     fi
 184     if [ "$LDAP_USER_ENABLED_INVERT" ]; then
 185         echo "user_enabled_invert = $LDAP_USER_ENABLED_INVERT" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 186     fi
 187     if [ "$LDAP_GROUP_OBJECTCLASS" ]; then
 188         echo "group_objectclass = $LDAP_GROUP_OBJECTCLASS" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 189     fi
 190     if [ "$LDAP_GROUP_TREE_DN" ]; then
 191         echo "group_tree_dn = $LDAP_GROUP_TREE_DN" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 192     fi
 193     if [ "$LDAP_TLS_CACERT_BASE64" ]; then
 194         mkdir -p /etc/ssl/certs/
 195         echo "-----BEGIN CERTIFICATE-----" >> /etc/ssl/certs/ca-certificates.crt
 196         echo $LDAP_TLS_CACERT_BASE64 >> /etc/ssl/certs/ca-certificates.crt
 197         echo "-----END CERTIFICATE-----" >> /etc/ssl/certs/ca-certificates.crt
 198     fi
 199     if [ "$LDAP_USE_STARTTLS" ] && [ "$LDAP_USE_STARTTLS" == "true" ]; then
 200         echo "use_tls = true" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 201         mkdir -p /etc/keystone/ssl/certs/
 202         echo "-----BEGIN CERTIFICATE-----" > /etc/keystone/ssl/certs/ca.pem
 203         echo $LDAP_TLS_CACERT_BASE64 >> /etc/keystone/ssl/certs/ca.pem
 204         echo "-----END CERTIFICATE-----" >> /etc/keystone/ssl/certs/ca.pem
 205         echo "tls_cacertfile = /etc/keystone/ssl/certs/ca.pem" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 206         if [ "$LDAP_TLS_REQ_CERT" ]; then
 207             echo "tls_req_cert = $LDAP_TLS_REQ_CERT" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 208         fi
 209     fi
 210 fi
 211
 212 # Populate Keystone database
 213 if [ -z $DB_EXISTS ] || [ -z $DB_NOT_EMPTY ]; then
 214     keystone-manage db_sync
 215 fi
 216
 217 # Initialize Fernet key repositories
 218 keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
 219 keystone-manage credential_setup --keystone-user keystone --keystone-group keystone
 220
 221 wait_keystone_host
 222
 223 # Bootstrap Keystone service
 224 if [ -z $DB_EXISTS ] || [ -z $DB_NOT_EMPTY ]; then
 225     keystone-manage bootstrap \
 226         --bootstrap-username "$ADMIN_USERNAME" \
 227         --bootstrap-password "$ADMIN_PASSWORD" \
 228         --bootstrap-project "$ADMIN_PROJECT" \
 229         --bootstrap-admin-url "http://$KEYSTONE_HOST:5000/v3/" \
 230         --bootstrap-internal-url "http://$KEYSTONE_HOST:5000/v3/" \
 231         --bootstrap-public-url "http://$KEYSTONE_HOST:5000/v3/" \
 232         --bootstrap-region-id "$REGION_ID"
 233 fi
 234
 235 echo "ServerName $KEYSTONE_HOST" >> /etc/apache2/apache2.conf
 236
 237 # Restart Apache Service
 238 service apache2 restart
 239
 240 cat << EOF >> setup_env
 241 export OS_PROJECT_DOMAIN_NAME=default
 242 export OS_USER_DOMAIN_NAME=default
 243 export OS_PROJECT_NAME=$ADMIN_PROJECT
 244 export OS_USERNAME=$ADMIN_USERNAME
 245 export OS_PASSWORD=$ADMIN_PASSWORD
 246 export OS_AUTH_URL=http://$KEYSTONE_HOST:5000/v3
 247 export OS_IDENTITY_API_VERSION=3
 248 export OS_IMAGE_API_VERSION=2
 249 EOF
 250
 251 source setup_env
 252
 253 # Create NBI User
 254 if [ -z $DB_EXISTS ] || [ -z $DB_NOT_EMPTY ]; then
 255     openstack user create --domain default --password "$SERVICE_PASSWORD" "$SERVICE_USERNAME"
 256     openstack project create --domain default --description "Service Project" "$SERVICE_PROJECT"
 257     openstack role add --project "$SERVICE_PROJECT" --user "$SERVICE_USERNAME" admin
 258 fi
 259
 260 if [ $LDAP_AUTHENTICATION_DOMAIN_NAME ]; then
 261     if !(openstack domain list | grep -q $LDAP_AUTHENTICATION_DOMAIN_NAME); then
 262         # Create domain in keystone for LDAP authentication
 263         openstack domain create $LDAP_AUTHENTICATION_DOMAIN_NAME
 264         # Restart Apache Service
 265         service apache2 restart
 266     fi
 267         # Check periodically LDAP for updates
 268         echo "0 1 * * * keystone-manage mapping_purge --domain-name $LDAP_AUTHENTICATION_DOMAIN_NAME; keystone-manage mapping_populate --domain-name $LDAP_AUTHENTICATION_DOMAIN_NAME" >> /var/spool/cron/crontabs/root
 269 fi
 270
 271 while ps -ef | grep -v grep | grep -q apache2
 272 do
 273     sleep 60
 274 done
 275
 276 # Only reaches this point if apache2 stops running
 277 # When this happens exits with error code
 278 exit 1