6 changed files with 234 additions and 132 deletions
@ -0,0 +1,195 @@ |
|||
#!/bin/bash |
|||
|
|||
set -Eeuo pipefail |
|||
trap "exit" INT |
|||
|
|||
function init () { |
|||
local cluster_name="${1:-}" |
|||
|
|||
if [ -d "$cluster_name" ]; then |
|||
echo "Cluster '$cluster_name' already initialized !" |
|||
exit 1 |
|||
fi |
|||
|
|||
cluster_name="$1" |
|||
|
|||
mkdir -p "$cluster_name" |
|||
sed "s/__CLUSTER_NAME__/$cluster_name/" install-config.yaml > "$cluster_name/install-config.yaml" |
|||
sed "s/__CLUSTER_NAME__/$cluster_name/" terraform.tfvars > "$cluster_name/terraform.tfvars" |
|||
|
|||
echo "Cluster $cluster_name initialized successfully!" |
|||
echo |
|||
echo "Review and adjust the following files to your needs:" |
|||
echo "- $cluster_name/install-config.yaml" |
|||
echo "- $cluster_name/terraform.tfvars" |
|||
echo |
|||
exit 0 |
|||
} |
|||
|
|||
function destroy () { |
|||
local cluster_name="${1:-}" |
|||
|
|||
if [ ! -d "$cluster_name" ]; then |
|||
echo "Cluster '$cluster_name' does not exist!" |
|||
exit 1 |
|||
fi |
|||
|
|||
terraform destroy -var-file="$cluster_name/terraform.tfvars" -state="$cluster_name/terraform.tfstate" |
|||
sed -i.bak 's/^\s*bootstrap_nodes\s*=\s*.*$/bootstrap_nodes = 1/' "$cluster_name/terraform.tfvars" |
|||
} |
|||
|
|||
function apply () { |
|||
local cluster_name="${1:-}" |
|||
|
|||
if [ ! -d "$cluster_name" ]; then |
|||
echo "Cluster '$cluster_name' does not exist!" |
|||
exit 1 |
|||
fi |
|||
|
|||
# Create installation files |
|||
openshift-install create manifests --dir="$cluster_name" |
|||
openshift-install create ignition-configs --dir="$cluster_name" |
|||
|
|||
# Provision the infrastructure and wait for bootstrap to complete |
|||
terraform apply -var-file="$cluster_name/terraform.tfvars" -state="$cluster_name/terraform.tfstate" -auto-approve |
|||
openshift-install --dir="$cluster_name" wait-for bootstrap-complete --log-level=info |
|||
|
|||
# Destroy the bootstrap node |
|||
sed -i.bak 's/^\s*bootstrap_nodes\s*=\s*.*$/bootstrap_nodes = 0/' "$cluster_name/terraform.tfvars" |
|||
terraform apply -var-file="$cluster_name/terraform.tfvars" -state="$cluster_name/terraform.tfstate" -auto-approve |
|||
|
|||
# Auto-approve all pending CSRs |
|||
for i in {0..240}; do |
|||
oc --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" get csr --no-headers \ |
|||
| awk '/Pending/ {print $1}' \ |
|||
| xargs --no-run-if-empty oc --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" adm certificate approve |
|||
sleep 15 |
|||
done & |
|||
|
|||
# Wait for the installation to complete |
|||
openshift-install --dir="$cluster_name" wait-for install-complete |
|||
} |
|||
|
|||
function post_install_nfs () { |
|||
local cluster_name="${1:-}" |
|||
|
|||
oc apply --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" -f "$cluster_name/registry-pv.yaml" |
|||
oc patch --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" configs.imageregistry.operator.openshift.io cluster --type=json --patch-file=/dev/fd/0 <<EOF |
|||
[{"op": "remove", "path": "/spec/storage" },{"op": "add", "path": "/spec/storage", "value": {"pvc":{"claim": "registry-storage"}}}] |
|||
EOF |
|||
oc apply --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" -f "$cluster_name/nfs-provisioner.yaml" |
|||
oc patch --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" configs.imageregistry.operator.openshift.io cluster --type merge --patch-file=/dev/fd/0 <<EOF |
|||
{"spec":{"managementState": "Managed"}} |
|||
EOF |
|||
} |
|||
|
|||
function post_install_le () { |
|||
local cluster_name="${1:-}" |
|||
|
|||
# Generated by terraform |
|||
source "$cluster_name/dns.env" |
|||
|
|||
# Get a certificate from Let's Encrypt |
|||
lego -m "nmasse@redhat.com" -d "$LE_API_HOSTNAME" -d "$LE_ROUTER_HOSTNAME" -a --dns gandiv5 run --no-bundle |
|||
|
|||
# Deploy certificate to ingress |
|||
oc --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" create secret tls router-certs-$(date "+%Y-%m-%d") --cert=.lego/certificates/$LE_API_HOSTNAME.crt --key=.lego/certificates/$LE_API_HOSTNAME.key -n openshift-ingress --dry-run -o yaml > "$cluster_name/router-certs.yaml" |
|||
oc --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" apply -f "$cluster_name/router-certs.yaml" -n openshift-ingress |
|||
oc --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" patch ingresscontroller default -n openshift-ingress-operator --type=merge --patch-file=/dev/fd/0 <<EOF |
|||
{"spec": { "defaultCertificate": { "name": "router-certs-$(date "+%Y-%m-%d")" }}} |
|||
EOF |
|||
|
|||
# Deploy certificate to api |
|||
oc --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" create secret tls api-certs-$(date "+%Y-%m-%d") --cert=.lego/certificates/$LE_API_HOSTNAME.crt --key=.lego/certificates/$LE_API_HOSTNAME.key -n openshift-config --dry-run -o yaml > "$cluster_name/api-certs.yaml" |
|||
oc --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" apply -f "$cluster_name/router-certs.yaml" -n openshift-ingress |
|||
oc --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" patch apiserver cluster --type=merge --patch-file=/dev/fd/0 <<EOF |
|||
{"spec":{"servingCerts":{"namedCertificates":[{"names":["$LE_API_HOSTNAME"],"servingCertificate":{"name": "api-certs-$(date "+%Y-%m-%d")"}}]}}} |
|||
EOF |
|||
} |
|||
|
|||
function post_install_sso () { |
|||
local cluster_name="${1:-}" |
|||
|
|||
oc --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" create secret generic redhat-sso-client-secret -n openshift-config --from-literal="clientSecret=$GOOGLE_CLIENT_SECRET" --dry-run -o yaml > "$cluster_name/sso-secret.yaml" |
|||
oc --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" apply -f "$cluster_name/sso-secret.yaml" |
|||
oc --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" apply -f - <<EOF |
|||
apiVersion: config.openshift.io/v1 |
|||
kind: OAuth |
|||
metadata: |
|||
name: cluster |
|||
spec: |
|||
identityProviders: |
|||
- google: |
|||
clientID: "$GOOGLE_CLIENT_ID" |
|||
clientSecret: |
|||
name: redhat-sso-client-secret |
|||
hostedDomain: redhat.com |
|||
mappingMethod: claim |
|||
name: RedHatSSO |
|||
type: Google |
|||
EOF |
|||
} |
|||
|
|||
function post_install () { |
|||
local cluster_name="${1:-}" |
|||
shift |
|||
|
|||
if [ ! -d "$cluster_name" ]; then |
|||
echo "Cluster '$cluster_name' does not exist!" |
|||
exit 1 |
|||
fi |
|||
|
|||
if [ $# -eq 0 ]; then |
|||
set nfs sso le |
|||
fi |
|||
|
|||
for i; do |
|||
post_install_$i "$cluster_name" |
|||
done |
|||
} |
|||
|
|||
if [ ! -e "local.env" ]; then |
|||
echo "Please create local.env first!" |
|||
exit 1 |
|||
fi |
|||
|
|||
source local.env |
|||
|
|||
case "${1:-}" in |
|||
init) |
|||
if [ -z "${2:-}" ]; then |
|||
echo "Usage: $0 init cluster-name" |
|||
exit 1 |
|||
fi |
|||
shift |
|||
bootstrap "$@" |
|||
;; |
|||
apply) |
|||
if [ -z "${2:-}" ]; then |
|||
echo "Usage: $0 apply cluster-name" |
|||
exit 1 |
|||
fi |
|||
shift |
|||
apply "$@" |
|||
;; |
|||
destroy) |
|||
if [ -z "${2:-}" ]; then |
|||
echo "Usage: $0 destroy cluster-name" |
|||
exit 1 |
|||
fi |
|||
shift |
|||
destroy "$@" |
|||
;; |
|||
post-install) |
|||
if [ -z "${2:-}" ]; then |
|||
echo "Usage: $0 post-install cluster-name" |
|||
exit 1 |
|||
fi |
|||
shift |
|||
post_install "$@" |
|||
;; |
|||
*) |
|||
echo "Usage: $0 {init|apply|post-install|destroy} cluster-name" |
|||
exit 1 |
|||
;; |
|||
esac |
|||
@ -0,0 +1,6 @@ |
|||
export BASTION=user@bastion.host |
|||
export GANDI_KEY="123...456" |
|||
export GANDIV5_API_KEY="123...456" |
|||
export GOOGLE_CLIENT_ID="client_id" |
|||
export GOOGLE_CLIENT_SECRET="client_secret" |
|||
export LE_EMAIL="user@redhat.com" |
|||
@ -0,0 +1,5 @@ |
|||
base_domain = "ocp.lab" |
|||
external_mac_address = "02:00:00:00:00:04" |
|||
public_cluster_ip = "1.2.3.4" |
|||
cluster_name = "__CLUSTER_NAME__" |
|||
bootstrap_nodes = 1 |
|||
Loading…
Reference in new issue