-
Notifications
You must be signed in to change notification settings - Fork 5
Update release with new fabrica-based services; remove old services #50
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Draft
travisbcotton
wants to merge
60
commits into
main
Choose a base branch
from
trcotton/tokensmith-container
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Draft
Changes from all commits
Commits
Show all changes
60 commits
Select commit
Hold shift + click to select a range
270ec55
added tokensmith basic config file; update env file
travisbcotton 5783d19
added tokensmith bootstrap token script
travisbcotton d12a8d4
removed old services; added new ones
travisbcotton f279c32
updating some container files
travisbcotton 99b50cd
renamed .service files to .container
travisbcotton 3cd7c47
actually remove the .service files
travisbcotton 68808ad
update boot-service description
travisbcotton 932494f
remove hydra dependency
travisbcotton a073bd5
update SMD env vars
travisbcotton 44af324
update where tokesmith config file is mounted from
travisbcotton 9e0b719
updated spec file to include tokensmith bootstrap script
travisbcotton b6d70e5
update spec again and renamed script to remove .sh ending
travisbcotton dfb6146
update spec to hopefully fix rpm not building
travisbcotton aa62bca
update spec yet again to add tokensmith_bootstrap_token to the config…
travisbcotton 72b8fc7
update ExecStartPre to use renamed tokensmith bootstrap script
travisbcotton 2ef8224
added boostrap secret to metadata-service
travisbcotton 8851776
updated openchami.target with new services; removed old ones
travisbcotton 300ee61
updated tokensmith_bootstrap_token script to match updated tokensmith…
travisbcotton 59341ce
use v0.4.0 for tokensmith
travisbcotton e0e806d
update tokensmith container
travisbcotton 2c82988
update bootstrap_token to read the container env for token directory
travisbcotton 91e6546
make boot-service require tokensmith
travisbcotton 37c44c0
add persistent volume for tokensmith data
travisbcotton d441581
updated tokensmith Exec, boot-service exec, some dependencies
travisbcotton 0eaa23f
remove opaal stuff from bootstrap_openchami.sh
travisbcotton 4f988fe
update tokensmith container to mount the correct config file path
travisbcotton 1a4b9b8
update tokensmith container to mount the correct config file path for…
travisbcotton 7076d10
ok now set the correct path for mounting inside the tokensmith contai…
travisbcotton 968c3ff
try to fix volume mount BS
travisbcotton 23dad02
use correct path for tokensmith bootstrap script in boot-service and …
travisbcotton 0edff23
use pr-7 for metadata
travisbcotton 0b3bad1
update haproxy config
travisbcotton 51314c9
haproxy.cfg needs a newline at the end of the file? removed commented…
travisbcotton d0666f6
work on making bootstrap token scrit better
travisbcotton 81bc22c
minor updates to container files
travisbcotton 79b08c5
update haproxy.cfg
travisbcotton 71da3e3
update openchami.target
travisbcotton b7a00b7
updated haproxy.cfg, removed more references to opaal
travisbcotton f83176e
update some quadlet dependencies
travisbcotton 155e6b5
change target service from hsm to smd
travisbcotton 4d70f65
update boot-service container to use v0.1.5
travisbcotton 9de9f74
remove hydra stuff from bootstrap+openchami.sh
travisbcotton ee54c40
remove cloud-init vars, revisit when metadata-service is in a better …
travisbcotton fdf1a18
set metadata-service to use port 8080 in haproxy since it's the default
travisbcotton 49b8cc8
remove the tokensmith flag for now, use pr-8 for the image
travisbcotton 3625bcc
rename cloud-init-data volume to metadata-data, set metadata-service.…
travisbcotton f6ad8b2
fix volume name for metadata
travisbcotton 5d5abb2
bump tokensmith version and update Exec in container file
travisbcotton 267ff45
added SMD_URL=http://smd:27779 back since metadata-service seems to u…
travisbcotton 49b143d
bump smd container version to v2.20.0
travisbcotton b3317c1
removed opaal refernce from openchami-certificate-update
travisbcotton d8cccdd
added comment about OIDC provider in openchami.env file
travisbcotton 048a116
added usage to tokensmith_bootstrap_token, will print when missing cl…
travisbcotton ea6663a
set metadata-service container image version to v0.1.0
travisbcotton f343423
update coredhcp.yaml to match CoreSMD rules in v0.6.*
synackd 3c0a545
bump coresmd to v0.6.1
synackd db6e546
use xname for bmc hostname pattern
synackd a29d7f6
bump smd to v2.20.3
synackd 4370985
remove unused secrets
synackd 2379e95
remove extra newline in coredhcp.yaml
synackd File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
davidallendj marked this conversation as resolved.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| #!/bin/bash | ||
| usage() { | ||
| echo "usage: $0 CLIENT" | ||
| echo | ||
| echo 'CLIENT: name of client service to generate token for' | ||
| } | ||
|
|
||
| CLIENT="${1}" | ||
|
travisbcotton marked this conversation as resolved.
|
||
| SERVICE="smd" | ||
|
|
||
| if [[ -z "$CLIENT" ]] | ||
| then | ||
| echo "Empty client" | ||
| usage >&2 | ||
| exit 1 | ||
| fi | ||
|
travisbcotton marked this conversation as resolved.
|
||
|
|
||
| echo "Generating bootstrap token for service client ${CLIENT}" | ||
| TOKENSMITH_BOOTSTRAP_TOKEN=$(podman exec -e SERVICE=$SERVICE -e CLIENT=$CLIENT tokensmith /bin/sh -c "\ | ||
| /usr/local/bin/tokensmith bootstrap-token create \ | ||
| --bootstrap-store \${TOKENSMITH_RFC8693_BOOTSTRAP_STORE} \ | ||
| --subject \${CLIENT} \ | ||
| --audience \${SERVICE} \ | ||
| --scopes "read" \ | ||
| --output-format json | jq -r '.bootstrap_token' | ||
| ") | ||
|
|
||
| SECRET_NAME="${CLIENT}-bootstrap-token" | ||
| echo "Creating secret ${CLIENT}-bootstrap-token" | ||
| printf '%s' "$TOKENSMITH_BOOTSTRAP_TOKEN" | podman secret rm -i ${SECRET_NAME} 2>/dev/null || true | ||
| printf '%s' "$TOKENSMITH_BOOTSTRAP_TOKEN" | podman secret create ${SECRET_NAME} - | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,18 +1,95 @@ | ||
| # Based on https://github.com/coredhcp/coredhcp/blob/master/cmds/coredhcp/config.yml.example | ||
| # See there for more extensive CoreDHCP configuration documentation. | ||
|
|
||
| server4: | ||
| # You can configure the specific interfaces that you want OpenCHAMI to listen on by | ||
| # uncommenting the lines below and setting the interface | ||
| # listen: | ||
| # - "%virbr-openchami" | ||
| # Optionally define how CoreDHCP binds to an interface or address. If unset, | ||
| # the server will bind to all interfaces (0.0.0.0). | ||
| # | ||
| #listen: | ||
| # - "%virbr-openchami" | ||
| plugins: | ||
| # You are able to set the IP address of the system in server_id as the place to look for a DHCP server | ||
| # DNS is able to be set to whatever you want but it is much easier if you keep it set to the server IP | ||
| # Router is also able to be set to whatever you network router address is | ||
| # - server_id: 172.16.0.254 | ||
| # - dns: 172.16.0.254 | ||
| # - router: 172.16.0.254 | ||
| # Set DHCP Server Identifier to help resolve situations when there are | ||
| # multiple DHCP servers on a network. | ||
| #- server_id: 172.16.0.254 | ||
|
|
||
| # Advertise list of DNS resolvers to use for hosts on network. | ||
| #- dns: 172.16.0.254 | ||
|
|
||
| # REQUIRED: Advertise address of default router on network. | ||
| #- router: 172.16.0.254 | ||
|
|
||
| # Advertise network mask of assigned IPs on network. | ||
| - netmask: 255.255.255.0 | ||
| # The lines below define where the system should assign ip addresses for systems that do not have | ||
| # mac addresses stored in SMD | ||
| # - coresmd: https://demo.openchami.cluster:8443 http://172.16.0.254:8081 /root_ca/root_ca.crt 30s 1h false | ||
| # - bootloop: /tmp/coredhcp.db default 5m 172.16.0.200 172.16.0.250 | ||
|
|
||
| # | ||
| # OpenCHAMI CONFIGURATION | ||
| # | ||
|
|
||
| # Assign IP addresses to devices known to OpenCHAMI based on MAC address. | ||
| #- coresmd: | | ||
| # /* Base URI for contacting SMD */ | ||
| # svc_base_uri=https://demo.openchami.cluster:8443 | ||
| # | ||
| # /* Base URI for contacting boot-service for boot scripts */ | ||
| # ipxe_base_uri=http://172.16.0.254:8081 | ||
| # | ||
| # /* | ||
| # * Path to root CA certificate in container to use for TLS | ||
| # * verification for communication with SMD | ||
| # */ | ||
| # ca_cert=/root_ca/root_ca.crt | ||
| # | ||
| # /* Refresh interval for CoreSMD's component cache */ | ||
| # cache_valid=30s | ||
| # | ||
| # /* Duration DHCP leases should be valid */ | ||
| # lease_time=1h | ||
| # | ||
| # /* Toggle TFTP single-port mode */ | ||
| # single_port=false | ||
| # | ||
| # /* | ||
| # * RICH RULES | ||
| # * | ||
| # * These are used to set DHCP options based on certain selectors. | ||
| # * See: https://github.com/OpenCHAMI/coresmd/blob/main/examples/coredhcp/rules.md | ||
| # */ | ||
| # | ||
| # /* Domain to append to set hostnames (able to be overridden) | ||
| # domain=openchami.cluster | ||
| # | ||
| # /* | ||
| # * Log level for rules. | ||
| # * | ||
| # * none: do not log | ||
| # * info: log rule matches | ||
| # * debug: log rule matches and non-matches | ||
| # */ | ||
| # rule_log=info | ||
| # | ||
| # /* Set hostname based on type (node or BMC, respectively) */ | ||
| # rule=type:Node,hostname:n{02d} | ||
| # rule=type:NodeBMC,hostname:{id} | ||
|
|
||
| # Optional catch-all for extra devices. This plugin is meant to assign | ||
| # temporary IPs via a very short lease to devices not tracked in SMD, e.g. | ||
| # for BMCs to be discoverable via Redfish so they _can_ be added to SMD. | ||
| # Non-BMC devices are served an iPXE script that instructs them to reboot | ||
| # (by default, this is customizable, hence the name 'bootloop') so that | ||
| # they will constantly try to get a new lease. The idea is that once they | ||
| # are added to SMD, CoreSMD above will catch it. | ||
| #- bootloop: | | ||
| # /* Where to store leases (sqlite) | ||
| # lease_file=/tmp/coredhcp.db | ||
| # | ||
| # /* iPXE script to use ('default' reboots) | ||
| # script_path=default | ||
| # | ||
| # /* Duration of short-lived lease */ | ||
| # lease_time=5m | ||
| # | ||
| # /* Beginning IP of assignable IPv4 addresses */ | ||
| # ipv4_start=172.16.0.200 | ||
| # | ||
| # /* Ending IP of assignable IPv4 addresses */ | ||
| # ipv4_end=172.16.0.250 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| { | ||
| "groupScopes": { | ||
| "admin": [ | ||
| "admin", | ||
| "write", | ||
| "read" | ||
| ], | ||
| "operator": [ | ||
| "write", | ||
| "read" | ||
| ], | ||
| "user": [ | ||
| "read" | ||
| ], | ||
| "viewer": [ | ||
| "read" | ||
| ] | ||
| } | ||
| } |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.