docker/Keystone/scripts/start.sh

   1 #!/bin/bash
   2
   3 # Copyright 2018 Whitestack, LLC
   4 #
   5 # Licensed under the Apache License, Version 2.0 (the "License"); you may
   6 # not use this file except in compliance with the License. You may obtain
   7 # a copy of the License at
   8 #
   9 #         http://www.apache.org/licenses/LICENSE-2.0
  10 #
  11 # Unless required by applicable law or agreed to in writing, software
  12 # distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  13 # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
  14 # License for the specific language governing permissions and limitations
  15 # under the License.
  16 #
  17 # For those usages not covered by the Apache License, Version 2.0 please
  18 # contact: esousa@whitestack.com or glavado@whitestack.com
  19 ##
  20
  21 DB_EXISTS=""
  22 DB_NOT_EMPTY=""
  23
  24 max_attempts=120
  25 function wait_db(){
  26     db_host=$1
  27     db_port=$2
  28     attempt=0
  29     echo "Wait until $max_attempts seconds for MySQL mano Server ${db_host}:${db_port} "
  30     while ! mysqladmin ping -h"$db_host" -P"$db_port" --silent; do
  31         #wait 120 sec
  32         if [ $attempt -ge $max_attempts ]; then
  33             echo
  34             echo "Can not connect to database ${db_host}:${db_port} during $max_attempts sec"
  35             return 1
  36         fi
  37         attempt=$[$attempt+1]
  38         echo -n "."
  39         sleep 1
  40     done
  41     return 0
  42 }
  43
  44 function wait_keystone_host(){
  45     attempt=0
  46     timeout=2
  47     echo "Wait until Keystone hostname can be resolved "
  48     while ! nslookup $KEYSTONE_HOST; do
  49         #wait 120 sec
  50         if [ $attempt -ge $max_attempts ]; then
  51             echo
  52             echo "Can not resolve ${KEYSTONE_HOST} during $max_attempts sec"
  53             return 1
  54         fi
  55         attempt=$[$attempt+1]
  56         echo -n "."
  57         sleep 1
  58     done
  59     return 0
  60 }
  61
  62 function is_db_created() {
  63     db_host=$1
  64     db_port=$2
  65     db_user=$3
  66     db_pswd=$4
  67     db_name=$5
  68
  69     if mysqlshow -h"$db_host" -P"$db_port" -u"$db_user" -p"$db_pswd" | grep -v Wildcard | grep -q $db_name; then
  70         echo "DB $db_name exists"
  71         return 0
  72     else
  73         echo "DB $db_name does not exist"
  74         return 1
  75     fi
  76 }
  77
  78 wait_db "$DB_HOST" "$DB_PORT" || exit 1
  79
  80 is_db_created "$DB_HOST" "$DB_PORT" "$ROOT_DB_USER" "$ROOT_DB_PASSWORD" "keystone" && DB_EXISTS="Y"
  81
  82 if [ -z $DB_EXISTS ]; then
  83     mysql -h"$DB_HOST" -P"$DB_PORT" -u"$ROOT_DB_USER" -p"$ROOT_DB_PASSWORD" --default_character_set utf8 -e "CREATE DATABASE keystone"
  84     mysql -h"$DB_HOST" -P"$DB_PORT" -u"$ROOT_DB_USER" -p"$ROOT_DB_PASSWORD" --default_character_set utf8 -e "GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY '$KEYSTONE_DB_PASSWORD'"
  85     mysql -h"$DB_HOST" -P"$DB_PORT" -u"$ROOT_DB_USER" -p"$ROOT_DB_PASSWORD" --default_character_set utf8 -e "GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY '$KEYSTONE_DB_PASSWORD'"
  86 else
  87     if [ $(mysql -h"$DB_HOST" -P"$DB_PORT" -u"$ROOT_DB_USER" -p"$ROOT_DB_PASSWORD" --default_character_set utf8 -sse "SELECT COUNT(*) FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA = 'keystone';") -gt 0 ]; then
  88         echo "DB keystone is empty"
  89         DB_NOT_EMPTY="y"
  90     fi
  91 fi
  92
  93 # Setting Keystone database connection
  94 sed -i '/^\[database\]$/,/^\[/ s/^connection = .*/connection = mysql+pymysql:\/\/keystone:'$KEYSTONE_DB_PASSWORD'@'$DB_HOST':'$DB_PORT'\/keystone/' /etc/keystone/keystone.conf
  95
  96 # Setting Keystone tokens
  97 sed -i '/^\[token\]$/,/^\[/ s/^.*provider = .*/provider = fernet/' /etc/keystone/keystone.conf
  98
  99
 100 # Use LDAP authentication for Identity
 101 if [ $LDAP_AUTHENTICATION_DOMAIN_NAME ]; then
 102     # Enable Keyston domains
 103     sed -i "s%.*domain_specific_drivers_enabled =.*%domain_specific_drivers_enabled = true%" /etc/keystone/keystone.conf
 104     sed -i "s%.*domain_config_dir =.*%domain_config_dir = /etc/keystone/domains%" /etc/keystone/keystone.conf
 105     mkdir -p /etc/keystone/domains
 106     # Configure domain for LDAP authentication
 107     cat << EOF > /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 108 [identity]
 109 driver = ldap
 110 [ldap]
 111 url = $LDAP_URL
 112 user_allow_create=false
 113 user_allow_update=false
 114 user_allow_delete=false
 115 group_allow_create=false
 116 group_allow_update=false
 117 group_allow_delete=false
 118 query_scope = sub
 119 EOF
 120     if [ $LDAP_BIND_USER ]; then
 121         echo "user = $LDAP_BIND_USER" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 122     fi
 123     if [ $LDAP_BIND_PASSWORD ]; then
 124         echo "password = $LDAP_BIND_PASSWORD" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 125     fi
 126     if [ $LDAP_CHASE_REFERRALS ]; then
 127         echo "chase_referrals = $LDAP_CHASE_REFERRALS" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 128     fi
 129     if [ $LDAP_PAGE_SIZE ]; then
 130         echo "page_size = $LDAP_PAGE_SIZE" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 131     fi
 132     if [ $LDAP_USER_TREE_DN ]; then
 133         echo "user_tree_dn = $LDAP_USER_TREE_DN" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 134     fi
 135     if [ $LDAP_USER_OBJECTCLASS ]; then
 136         echo "user_objectclass = $LDAP_USER_OBJECTCLASS" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 137     fi
 138     if [ $LDAP_USER_ID_ATTRIBUTE ]; then
 139         echo "user_id_attribute = $LDAP_USER_ID_ATTRIBUTE" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 140     fi
 141     if [ $LDAP_USER_NAME_ATTRIBUTE ]; then
 142         echo "user_name_attribute = $LDAP_USER_NAME_ATTRIBUTE" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 143     fi
 144     if [ $LDAP_USER_PASS_ATTRIBUTE ]; then
 145         echo "user_pass_attribute = $LDAP_USER_PASS_ATTRIBUTE" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 146     fi
 147     if [ $LDAP_USER_FILTER ]; then
 148         echo "user_filter = $LDAP_USER_FILTER" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 149     fi
 150     if [ $LDAP_USER_ENABLED_ATTRIBUTE ]; then
 151         echo "user_enabled_attribute = $LDAP_USER_ENABLED_ATTRIBUTE" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 152     fi
 153     if [ $LDAP_USER_ENABLED_MASK ]; then
 154         echo "user_enabled_mask = $LDAP_USER_ENABLED_MASK" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 155     fi
 156     if [ $LDAP_USER_ENABLED_DEFAULT ]; then
 157         echo "user_enabled_default = $LDAP_USER_ENABLED_DEFAULT" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 158     fi
 159     if [ $LDAP_USER_ENABLED_INVERT ]; then
 160         echo "user_enabled_invert = $LDAP_USER_ENABLED_INVERT" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 161     fi
 162     if [ $LDAP_GROUP_OBJECTCLASS ]; then
 163         echo "group_objectclass = $LDAP_GROUP_OBJECTCLASS" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 164     fi
 165     if [ $LDAP_GROUP_TREE_DN ]; then
 166         echo "group_tree_dn = $LDAP_GROUP_TREE_DN" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 167     fi
 168     if [ $LDAP_USE_STARTTLS ] && [ "$LDAP_USE_STARTTLS" == "true" ]; then
 169         echo "use_tls = true" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 170         mkdir -p /etc/keystone/ssl/certs/
 171         echo "-----BEGIN CERTIFICATE-----" > /etc/keystone/ssl/certs/ca.pem
 172         echo $LDAP_TLS_CACERT_BASE64 >> /etc/keystone/ssl/certs/ca.pem
 173         echo "-----END CERTIFICATE-----" >> /etc/keystone/ssl/certs/ca.pem
 174         echo "tls_cacertfile = /etc/keystone/ssl/certs/ca.pem" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 175         if [ $LDAP_TLS_REQ_CERT ]; then
 176             echo "tls_req_cert = $LDAP_TLS_REQ_CERT" >> /etc/keystone/domains/keystone.$LDAP_AUTHENTICATION_DOMAIN_NAME.conf
 177         fi
 178     fi
 179 fi
 180
 181 # Populate Keystone database
 182 if [ -z $DB_EXISTS ] || [ -z $DB_NOT_EMPTY ]; then
 183     su -s /bin/sh -c "keystone-manage db_sync" keystone
 184 fi
 185
 186 # Initialize Fernet key repositories
 187 keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
 188 keystone-manage credential_setup --keystone-user keystone --keystone-group keystone
 189
 190 wait_keystone_host
 191
 192 # Bootstrap Keystone service
 193 if [ -z $DB_EXISTS ] || [ -z $DB_NOT_EMPTY ]; then
 194     keystone-manage bootstrap \
 195         --bootstrap-username "$ADMIN_USERNAME" \
 196         --bootstrap-password "$ADMIN_PASSWORD" \
 197         --bootstrap-project "$ADMIN_PROJECT" \
 198         --bootstrap-admin-url "http://$KEYSTONE_HOST:5000/v3/" \
 199         --bootstrap-internal-url "http://$KEYSTONE_HOST:5000/v3/" \
 200         --bootstrap-public-url "http://$KEYSTONE_HOST:5000/v3/" \
 201         --bootstrap-region-id "$REGION_ID"
 202 fi
 203
 204 echo "ServerName $KEYSTONE_HOST" >> /etc/apache2/apache2.conf
 205 # Restart Apache Service
 206 service apache2 restart
 207
 208 cat << EOF >> setup_env
 209 export OS_PROJECT_DOMAIN_NAME=default
 210 export OS_USER_DOMAIN_NAME=default
 211 export OS_PROJECT_NAME=$ADMIN_PROJECT
 212 export OS_USERNAME=$ADMIN_USERNAME
 213 export OS_PASSWORD=$ADMIN_PASSWORD
 214 export OS_AUTH_URL=http://$KEYSTONE_HOST:5000/v3
 215 export OS_IDENTITY_API_VERSION=3
 216 export OS_IMAGE_API_VERSION=2
 217 EOF
 218
 219 source setup_env
 220
 221 # Create NBI User
 222 if [ -z $DB_EXISTS ] || [ -z $DB_NOT_EMPTY ]; then
 223     openstack user create --domain default --password "$SERVICE_PASSWORD" "$SERVICE_USERNAME"
 224     openstack project create --domain default --description "Service Project" "$SERVICE_PROJECT"
 225     openstack role add --project "$SERVICE_PROJECT" --user "$SERVICE_USERNAME" admin
 226 fi
 227
 228 if [ $LDAP_AUTHENTICATION_DOMAIN_NAME ]; then
 229     if !(openstack domain list | grep -q $LDAP_AUTHENTICATION_DOMAIN_NAME); then
 230         # Create domain in keystone for LDAP authentication
 231         openstack domain create $LDAP_AUTHENTICATION_DOMAIN_NAME
 232         # Restart Apache Service
 233         service apache2 restart
 234     fi
 235         # Check periodically LDAP for updates
 236         echo "0 1 * * * keystone-manage mapping_purge --domain-name $LDAP_AUTHENTICATION_DOMAIN_NAME; keystone-manage mapping_populate --domain-name $LDAP_AUTHENTICATION_DOMAIN_NAME" >> /var/spool/cron/crontabs/root
 237 fi
 238
 239 while ps -ef | grep -v grep | grep -q apache2
 240 do
 241     sleep 60
 242 done
 243
 244 # Only reaches this point if apache2 stops running
 245 # When this happens exits with error code
 246 exit 1