6 changed files with 234 additions and 132 deletions
@ -0,0 +1,195 @@ |
|||||
|
#!/bin/bash |
||||
|
|
||||
|
set -Eeuo pipefail |
||||
|
trap "exit" INT |
||||
|
|
||||
|
function init () { |
||||
|
local cluster_name="${1:-}" |
||||
|
|
||||
|
if [ -d "$cluster_name" ]; then |
||||
|
echo "Cluster '$cluster_name' already initialized !" |
||||
|
exit 1 |
||||
|
fi |
||||
|
|
||||
|
cluster_name="$1" |
||||
|
|
||||
|
mkdir -p "$cluster_name" |
||||
|
sed "s/__CLUSTER_NAME__/$cluster_name/" install-config.yaml > "$cluster_name/install-config.yaml" |
||||
|
sed "s/__CLUSTER_NAME__/$cluster_name/" terraform.tfvars > "$cluster_name/terraform.tfvars" |
||||
|
|
||||
|
echo "Cluster $cluster_name initialized successfully!" |
||||
|
echo |
||||
|
echo "Review and adjust the following files to your needs:" |
||||
|
echo "- $cluster_name/install-config.yaml" |
||||
|
echo "- $cluster_name/terraform.tfvars" |
||||
|
echo |
||||
|
exit 0 |
||||
|
} |
||||
|
|
||||
|
function destroy () { |
||||
|
local cluster_name="${1:-}" |
||||
|
|
||||
|
if [ ! -d "$cluster_name" ]; then |
||||
|
echo "Cluster '$cluster_name' does not exist!" |
||||
|
exit 1 |
||||
|
fi |
||||
|
|
||||
|
terraform destroy -var-file="$cluster_name/terraform.tfvars" -state="$cluster_name/terraform.tfstate" |
||||
|
sed -i.bak 's/^\s*bootstrap_nodes\s*=\s*.*$/bootstrap_nodes = 1/' "$cluster_name/terraform.tfvars" |
||||
|
} |
||||
|
|
||||
|
function apply () { |
||||
|
local cluster_name="${1:-}" |
||||
|
|
||||
|
if [ ! -d "$cluster_name" ]; then |
||||
|
echo "Cluster '$cluster_name' does not exist!" |
||||
|
exit 1 |
||||
|
fi |
||||
|
|
||||
|
# Create installation files |
||||
|
openshift-install create manifests --dir="$cluster_name" |
||||
|
openshift-install create ignition-configs --dir="$cluster_name" |
||||
|
|
||||
|
# Provision the infrastructure and wait for bootstrap to complete |
||||
|
terraform apply -var-file="$cluster_name/terraform.tfvars" -state="$cluster_name/terraform.tfstate" -auto-approve |
||||
|
openshift-install --dir="$cluster_name" wait-for bootstrap-complete --log-level=info |
||||
|
|
||||
|
# Destroy the bootstrap node |
||||
|
sed -i.bak 's/^\s*bootstrap_nodes\s*=\s*.*$/bootstrap_nodes = 0/' "$cluster_name/terraform.tfvars" |
||||
|
terraform apply -var-file="$cluster_name/terraform.tfvars" -state="$cluster_name/terraform.tfstate" -auto-approve |
||||
|
|
||||
|
# Auto-approve all pending CSRs |
||||
|
for i in {0..240}; do |
||||
|
oc --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" get csr --no-headers \ |
||||
|
| awk '/Pending/ {print $1}' \ |
||||
|
| xargs --no-run-if-empty oc --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" adm certificate approve |
||||
|
sleep 15 |
||||
|
done & |
||||
|
|
||||
|
# Wait for the installation to complete |
||||
|
openshift-install --dir="$cluster_name" wait-for install-complete |
||||
|
} |
||||
|
|
||||
|
function post_install_nfs () { |
||||
|
local cluster_name="${1:-}" |
||||
|
|
||||
|
oc apply --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" -f "$cluster_name/registry-pv.yaml" |
||||
|
oc patch --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" configs.imageregistry.operator.openshift.io cluster --type=json --patch-file=/dev/fd/0 <<EOF |
||||
|
[{"op": "remove", "path": "/spec/storage" },{"op": "add", "path": "/spec/storage", "value": {"pvc":{"claim": "registry-storage"}}}] |
||||
|
EOF |
||||
|
oc apply --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" -f "$cluster_name/nfs-provisioner.yaml" |
||||
|
oc patch --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" configs.imageregistry.operator.openshift.io cluster --type merge --patch-file=/dev/fd/0 <<EOF |
||||
|
{"spec":{"managementState": "Managed"}} |
||||
|
EOF |
||||
|
} |
||||
|
|
||||
|
function post_install_le () { |
||||
|
local cluster_name="${1:-}" |
||||
|
|
||||
|
# Generated by terraform |
||||
|
source "$cluster_name/dns.env" |
||||
|
|
||||
|
# Get a certificate from Let's Encrypt |
||||
|
lego -m "nmasse@redhat.com" -d "$LE_API_HOSTNAME" -d "$LE_ROUTER_HOSTNAME" -a --dns gandiv5 run --no-bundle |
||||
|
|
||||
|
# Deploy certificate to ingress |
||||
|
oc --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" create secret tls router-certs-$(date "+%Y-%m-%d") --cert=.lego/certificates/$LE_API_HOSTNAME.crt --key=.lego/certificates/$LE_API_HOSTNAME.key -n openshift-ingress --dry-run -o yaml > "$cluster_name/router-certs.yaml" |
||||
|
oc --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" apply -f "$cluster_name/router-certs.yaml" -n openshift-ingress |
||||
|
oc --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" patch ingresscontroller default -n openshift-ingress-operator --type=merge --patch-file=/dev/fd/0 <<EOF |
||||
|
{"spec": { "defaultCertificate": { "name": "router-certs-$(date "+%Y-%m-%d")" }}} |
||||
|
EOF |
||||
|
|
||||
|
# Deploy certificate to api |
||||
|
oc --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" create secret tls api-certs-$(date "+%Y-%m-%d") --cert=.lego/certificates/$LE_API_HOSTNAME.crt --key=.lego/certificates/$LE_API_HOSTNAME.key -n openshift-config --dry-run -o yaml > "$cluster_name/api-certs.yaml" |
||||
|
oc --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" apply -f "$cluster_name/router-certs.yaml" -n openshift-ingress |
||||
|
oc --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" patch apiserver cluster --type=merge --patch-file=/dev/fd/0 <<EOF |
||||
|
{"spec":{"servingCerts":{"namedCertificates":[{"names":["$LE_API_HOSTNAME"],"servingCertificate":{"name": "api-certs-$(date "+%Y-%m-%d")"}}]}}} |
||||
|
EOF |
||||
|
} |
||||
|
|
||||
|
function post_install_sso () { |
||||
|
local cluster_name="${1:-}" |
||||
|
|
||||
|
oc --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" create secret generic redhat-sso-client-secret -n openshift-config --from-literal="clientSecret=$GOOGLE_CLIENT_SECRET" --dry-run -o yaml > "$cluster_name/sso-secret.yaml" |
||||
|
oc --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" apply -f "$cluster_name/sso-secret.yaml" |
||||
|
oc --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" apply -f - <<EOF |
||||
|
apiVersion: config.openshift.io/v1 |
||||
|
kind: OAuth |
||||
|
metadata: |
||||
|
name: cluster |
||||
|
spec: |
||||
|
identityProviders: |
||||
|
- google: |
||||
|
clientID: "$GOOGLE_CLIENT_ID" |
||||
|
clientSecret: |
||||
|
name: redhat-sso-client-secret |
||||
|
hostedDomain: redhat.com |
||||
|
mappingMethod: claim |
||||
|
name: RedHatSSO |
||||
|
type: Google |
||||
|
EOF |
||||
|
} |
||||
|
|
||||
|
function post_install () { |
||||
|
local cluster_name="${1:-}" |
||||
|
shift |
||||
|
|
||||
|
if [ ! -d "$cluster_name" ]; then |
||||
|
echo "Cluster '$cluster_name' does not exist!" |
||||
|
exit 1 |
||||
|
fi |
||||
|
|
||||
|
if [ $# -eq 0 ]; then |
||||
|
set nfs sso le |
||||
|
fi |
||||
|
|
||||
|
for i; do |
||||
|
post_install_$i "$cluster_name" |
||||
|
done |
||||
|
} |
||||
|
|
||||
|
if [ ! -e "local.env" ]; then |
||||
|
echo "Please create local.env first!" |
||||
|
exit 1 |
||||
|
fi |
||||
|
|
||||
|
source local.env |
||||
|
|
||||
|
case "${1:-}" in |
||||
|
init) |
||||
|
if [ -z "${2:-}" ]; then |
||||
|
echo "Usage: $0 init cluster-name" |
||||
|
exit 1 |
||||
|
fi |
||||
|
shift |
||||
|
bootstrap "$@" |
||||
|
;; |
||||
|
apply) |
||||
|
if [ -z "${2:-}" ]; then |
||||
|
echo "Usage: $0 apply cluster-name" |
||||
|
exit 1 |
||||
|
fi |
||||
|
shift |
||||
|
apply "$@" |
||||
|
;; |
||||
|
destroy) |
||||
|
if [ -z "${2:-}" ]; then |
||||
|
echo "Usage: $0 destroy cluster-name" |
||||
|
exit 1 |
||||
|
fi |
||||
|
shift |
||||
|
destroy "$@" |
||||
|
;; |
||||
|
post-install) |
||||
|
if [ -z "${2:-}" ]; then |
||||
|
echo "Usage: $0 post-install cluster-name" |
||||
|
exit 1 |
||||
|
fi |
||||
|
shift |
||||
|
post_install "$@" |
||||
|
;; |
||||
|
*) |
||||
|
echo "Usage: $0 {init|apply|post-install|destroy} cluster-name" |
||||
|
exit 1 |
||||
|
;; |
||||
|
esac |
||||
@ -0,0 +1,6 @@ |
|||||
|
export BASTION=user@bastion.host |
||||
|
export GANDI_KEY="123...456" |
||||
|
export GANDIV5_API_KEY="123...456" |
||||
|
export GOOGLE_CLIENT_ID="client_id" |
||||
|
export GOOGLE_CLIENT_SECRET="client_secret" |
||||
|
export LE_EMAIL="user@redhat.com" |
||||
@ -0,0 +1,5 @@ |
|||||
|
base_domain = "ocp.lab" |
||||
|
external_mac_address = "02:00:00:00:00:04" |
||||
|
public_cluster_ip = "1.2.3.4" |
||||
|
cluster_name = "__CLUSTER_NAME__" |
||||
|
bootstrap_nodes = 1 |
||||
Loading…
Reference in new issue