diff --git a/README.md b/README.md index 5420e830..4acfd727 100644 --- a/README.md +++ b/README.md @@ -6,8 +6,6 @@ For new users, we recommend starting with the **[OpenCHAMI Tutorial](https://ope ## Contents -- [`quickstart/`](./quickstart/) – General quickstart for Docker Compose (**Deprecated** - use the [Tutorial](https://openchami.org/docs/tutorial/) instead) -- [`quickstart-pcs/`](./quickstart-pcs/) – Quickstart with PCS and Sushy-tools (**Deprecated** - use the [Tutorial](https://openchami.org/docs/tutorial/) instead) - [`dell/`](./dell/) – Dell-specific deployment recipes - [`lbnl/`](./lbnl/) – LBNL-specific deployment recipes diff --git a/quickstart-pcs/.gitignore b/quickstart-pcs/.gitignore deleted file mode 100644 index 8acf91df..00000000 --- a/quickstart-pcs/.gitignore +++ /dev/null @@ -1,4 +0,0 @@ -sushy-emulator -access_token -keys -policy.yml diff --git a/quickstart-pcs/Makefile b/quickstart-pcs/Makefile deleted file mode 100644 index 134037a1..00000000 --- a/quickstart-pcs/Makefile +++ /dev/null @@ -1,19 +0,0 @@ -re: clean run - -run: keys - bash run.sh - -keys: - bash create-keys.sh - -check: - bash check.sh - -test: - bash test-request-on-smd.sh - -clean: stop - bash clean.sh - -stop: - bash stop.sh diff --git a/quickstart-pcs/README.adoc b/quickstart-pcs/README.adoc deleted file mode 100644 index adcb7447..00000000 --- a/quickstart-pcs/README.adoc +++ /dev/null @@ -1,186 +0,0 @@ -= PCS with Sushy-tools -:toc: -:sectnums: - -== Introduction - -=== Glossary - -PCS:: Power control service -RFE:: Redfish endpoint -SMD:: State management database -https://libvirt.org/[Libvirt]:: is a toolkit to manage virtualization platforms - -=== Deployment diagram - -image:assets/deployment-openchami-testing-environment.svg[] - -(see link:assets/deployment-openchami-testing-environment.plantuml[diagram]) - -=== Sequence diagram - -image:assets/sequence-openchami-testing-environment.svg[] - -(see link:assets/sequence-openchami-testing-environment.plantuml[diagram]) - -=== https://docs.openstack.org/sushy-tools/latest/user/dynamic-emulator.html[Sushy-emulator] - -Sushy-emulator run from a docker and connect to the libvirt deamon running on the host machine to handle the virtual node. - -==== SSL - -Inspired by https://github.com/OpenCHAMI/csm-redfish-interface-emulator[CSM-RIE], we add SSL keys to switch `http` to `https`. - -==== SSH - -The connection to libvirtd is possible with `"qemu+ssh://user@machine/system"`. - -==== htpasswd - -https://httpd.apache.org/docs/current/programs/htpasswd.html[htpasswd] add an authentification system to the endpoint. - -==== Config - -The python configuration file add fake storage data on the virtual node. - -=== Vault - -Vault is required by SMD and PCS. - -==== Keystore - -SMD and PCS use a key/value store on the path `secret/hms-creds` to save redfish endpoint credentials. - -==== JWT auth - -JWT authentification is enabled because PCS use JWT (https://stackoverflow.com/a/39239395[RS256]). - -==== SMD to vault - -SMD authenticate to Vault directly with the root token. - -==== PCS to vault - -PCS use a token https://www.rfc-editor.org/rfc/rfc7515[JWS] generated by a private key, the public key is added to Vault as a known key. - -=== PCS - -==== ETCD - -PCS needs Etcd. - -== Steps - -. Deploy a debian 12 + -Recommended specs: -+ -[cols="1,1"] -|=== -| vCPU -| 4 - -| Memory -| 16 GB - -| nested virtualization -| enabled -|=== - -. Clone the repository -+ -[source, shell] ----- -sudo apt update -y -sudo apt install -y jq git -git clone --branch work-in-progress https://github.com/t-h2o/deployment-recipes -ln -s "${HOME}/deployment-recipes/quickstart/" "${HOME}" -cd quickstart -./generate-configs.sh ----- - -. Setup libvirt with -+ -[source, shell] ----- -bash libvirt/setup-libvirt.sh ----- - -. Create a virtual node with -+ -[source, shell] ----- -bash libvirt/virtual-node.sh ----- - -. Install docker with -+ -[source, shell] ----- -bash install-docker.sh ----- -+ -NOTE: `install-docker.sh` will add the current user in the docker group. + -To avoid permission error: + -Login to the current user (eg: `su $(whoami)`). - -. Create sushy-emulator folder -+ -[source, shell] ----- -bash rfe-sushy-emulator.sh ----- - -. Run openchami services -+ -[source, shell] ----- -make run ----- - -. Add ssh key to sushy-emulator -+ -[source, shell] ----- -docker exec x1000c0s0b0 bash -c "ssh-keyscan \"$(docker network inspect bridge -f '{{range .IPAM.Config}}{{.Gateway}}{{end}}')\" > /root/.ssh/known_hosts" ----- - -. Add sushy-emulator as RFE -+ -[source, shell] ----- -curl -X POST -d '{"RedfishEndpoints":[{ - "ID":"x1000c0s0b0", - "FQDN":"x1000c0s0b0", - "RediscoverOnUpdate":true, - "User":"root", - "Password":"root_password" -}]}' http://localhost:27779/hsm/v2/Inventory/RedfishEndpoints ----- - -. Switch state off -+ -[source, shell] ----- -bash transition.sh x1000c0s0b0n0 force-off -bash transition.sh x1000c0s0b0n0 on ----- - -== extra - -=== Get transition status - ----- -curl -s localhost:28007/transitions/${TRANSITION_ID} | jq ----- - -=== Get components list - ----- -curl --cacert cacert.pem -H "Authorization: Bearer $(MachinelibvirtdsshdDockerSushy-emulatorvaultPower control serviceSMDVirtual nodeusersslsshconfightpasswdkeystoreJWT authvault pathvault tokenvault pathvault token \ No newline at end of file diff --git a/quickstart-pcs/assets/sequence-openchami-testing-environment.plantuml b/quickstart-pcs/assets/sequence-openchami-testing-environment.plantuml deleted file mode 100644 index bb6ce0c4..00000000 --- a/quickstart-pcs/assets/sequence-openchami-testing-environment.plantuml +++ /dev/null @@ -1,53 +0,0 @@ -@startuml - -Box "Admin" #chartreuse -participant curl -participant run as "run.sh" -end box - -Box "OpenCHAMI" -participant smd as "SMD" -participant pcs as "PCS" -participant etcd as "ETCD" -participant vault as "Vault" -end box - -Box "Sushy-emulator" -participant sushy_emulator_rfe as "redfish endpoint" -participant sushy_emulator_ssh as "ssh" -end box - -Box "sshd" -participant user -end box - -Box "libvirtd" -participant virtual_node as "Node" -end box - -== setup == - -hnote over sushy_emulator_rfe : create\nssl -hnote over sushy_emulator_ssh : create\nssh - -hnote over run : create\nkeys -hnote over run : start\nservices - -run -> vault : create jwt auth -run -> vault : create keystore - -== populate smd == - -curl -> smd : /Inventory/RedfishEndpoints -smd -> vault : write password - -== switch the power status == - -curl -> pcs : /transitions -pcs <-> etcd : read/save data -pcs -> vault : read password -pcs -> sushy_emulator_rfe : command -sushy_emulator_ssh -> user : ssh+qemu -user -> virtual_node : command - -@enduml diff --git a/quickstart-pcs/assets/sequence-openchami-testing-environment.svg b/quickstart-pcs/assets/sequence-openchami-testing-environment.svg deleted file mode 100644 index 85192035..00000000 --- a/quickstart-pcs/assets/sequence-openchami-testing-environment.svg +++ /dev/null @@ -1 +0,0 @@ -AdminOpenCHAMISushy-emulatorsshdlibvirtdcurlrun.shSMDPCSETCDVaultredfish endpointsshuserNodecurlcurlrun.shrun.shSMDSMDPCSPCSETCDETCDVaultVaultredfish endpointredfish endpointsshsshuseruserNodeNodesetupcreatesslcreatesshcreatekeysstartservicescreate jwt authcreate keystorepopulate smd/Inventory/RedfishEndpointswrite passwordswitch the power status/transitionsread/save dataread passwordcommandssh+qemucommand \ No newline at end of file diff --git a/quickstart-pcs/autocert.yml b/quickstart-pcs/autocert.yml deleted file mode 100644 index 80f60519..00000000 --- a/quickstart-pcs/autocert.yml +++ /dev/null @@ -1,40 +0,0 @@ -volumes: - step-ca-db: - step-ca-home: - step-root-ca: - local-certs: - -networks: - cert-internal: - name: openchami-quickstart-cert-internal - -services: - # step-ca is a local CA that can be used to issue certificates. - # It supports the ACME standard for automatic certificate issuance and rotation. - # See https://github.com/smallstep/certificates for more information. - # Our container is based on wolfi and an entrypoint from the step-ca repository. - step-ca: - container_name: step-ca - hostname: step-ca - image: ghcr.io/openchami/local-ca:v0.2.2 - #ports: - # - "9000:9000" - networks: - - cert-internal - volumes: - - step-ca-home:/home/step - # Keeping the database in a volume improves performance. I don't understand why. - - step-ca-db:/home/step/db - # Keeping the root CA in a volume allows us to back it up and restore it. - - step-root-ca:/root_ca/ - environment: - # To initialize your CA, modify these environment variables - - STEPPATH=/home/step - - DOCKER_STEPCA_INIT_NAME=OpenCHAMI - - DOCKER_STEPCA_INIT_DNS_NAMES=localhost,step-ca - - DOCKER_STEPCA_INIT_ACME=true - healthcheck: - test: ["CMD", "step", "ca", "health"] - interval: 10s - timeout: 10s - retries: 5 diff --git a/quickstart-pcs/base.yml b/quickstart-pcs/base.yml deleted file mode 100644 index e8ee641a..00000000 --- a/quickstart-pcs/base.yml +++ /dev/null @@ -1,8 +0,0 @@ -networks: - internal: - name: openchami-quickstart-internal - jwt-internal: - name: openchami-quickstart-jwt-internal - external: - name: openchami-quickstart-external - driver: bridge diff --git a/quickstart-pcs/bash_functions.sh b/quickstart-pcs/bash_functions.sh deleted file mode 100644 index bd1a69f3..00000000 --- a/quickstart-pcs/bash_functions.sh +++ /dev/null @@ -1,55 +0,0 @@ -# Several functions that have been useful to me in developing and testing the quickstart. -# They aren't necessary. Just educational. - -CURL_CONTAINER=cgr.dev/chainguard/curl -CURL_TAG=latest - -get_eth0_ipv4() { - local ipv4 - ipv4=$(ip -o -4 addr show eth0 | awk '{print $4}') - echo "${ipv4%/*}" -} - -get_ca_cert() { - local ca_cert - ${CONTAINER_CMD:-docker} exec step-ca step ca root - echo "${ca_cert}" -} - -container_curl() { - local url=$1 - ${CONTAINER_CMD:-docker} run --rm "${CURL_CONTAINER}:${CURL_TAG}" -s $url -} - -create_client_credentials() { - ${CONTAINER_CMD:-docker} exec hydra hydra create client \ - --endpoint http://hydra:4445/ \ - --format json \ - --grant-type client_credentials \ - --scope openid \ - --scope smd.read -} - -# CLIENT_CREDENTIALS=$(create_client_credentials) -# $(echo $CLIENT_CREDENTIALS | jq -r '"\(.client_id):\(.client_secret)"') - -retrieve_access_token() { - local CLIENT_ID=$1 - local CLIENT_SECRET=$2 - - ${CONTAINER_CMD:-docker} run --rm --network openchami-quickstart-jwt-internal "${CURL_CONTAINER}:${CURL_TAG}" -s -u "$CLIENT_ID:$CLIENT_SECRET" \ - -d grant_type=client_credentials \ - -d scope=openid+smd.read \ - http://hydra:4444/oauth2/token -} - -# ACCESS_TOKEN=$(retrieve_access_token $CLIENT_ID $CLIENT_SECRET | jq -r .access_token) - -gen_access_token() { - local CLIENT_CREDENTIALS - CLIENT_CREDENTIALS=$(create_client_credentials) - local CLIENT_ID=`echo $CLIENT_CREDENTIALS | jq -r '.client_id'` - local CLIENT_SECRET=`echo $CLIENT_CREDENTIALS | jq -r '.client_secret'` - local ACCESS_TOKEN=$(retrieve_access_token $CLIENT_ID $CLIENT_SECRET | jq -r .access_token) - echo $ACCESS_TOKEN -} diff --git a/quickstart-pcs/clean.sh b/quickstart-pcs/clean.sh deleted file mode 100644 index 89ffac90..00000000 --- a/quickstart-pcs/clean.sh +++ /dev/null @@ -1,7 +0,0 @@ -#!/bin/bash - -rm -rf keys - -VOLUME=($(docker volume ls --format "{{.Name}}" --filter "name=quickstart")) - -if [ -n "${VOLUME}" ]; then docker volume rm "${VOLUME[@]}"; fi diff --git a/quickstart-pcs/configs/.gitignore b/quickstart-pcs/configs/.gitignore deleted file mode 100644 index 00468f4c..00000000 --- a/quickstart-pcs/configs/.gitignore +++ /dev/null @@ -1,2 +0,0 @@ -opaal.yaml -coredhcp.yaml diff --git a/quickstart-pcs/configs/configurator.yaml b/quickstart-pcs/configs/configurator.yaml deleted file mode 100644 index 8c2044bd..00000000 --- a/quickstart-pcs/configs/configurator.yaml +++ /dev/null @@ -1,27 +0,0 @@ -# Server-related parameters when using as service -server: - host: 0.0.0.0:3334 - # Set the JWKS uri to protect /generate route - jwks: - uri: "" - retries: 5 -# SMD-related parameters -smd: - host: http://smd:27779 -# targets to call with --target flag with CLI or "target" query param -targets: - coredhcp: - templates: - - templates/coredhcp.jinja - syslog: - templates: - - templates/syslog.jinja - ansible: - templates: - - templates/ansible.jinja - powerman: - templates: - - templates/powerman.jinja - conman: - templates: - - templates/conman.jinja diff --git a/quickstart-pcs/configs/coredhcp-template.yaml b/quickstart-pcs/configs/coredhcp-template.yaml deleted file mode 100644 index 9801763a..00000000 --- a/quickstart-pcs/configs/coredhcp-template.yaml +++ /dev/null @@ -1,27 +0,0 @@ -server4: - plugins: - # - # Base CoreDHCP config - # - - - server_id: 192.168.0.254 - - dns: 1.1.1.1 8.8.8.8 - - router: 172.16.0.254 - - netmask: 255.255.255.0 - - # - # CoreSMD config - # - - # Args: ochami_base_url boot_script_base_url ca_cert_path cache_update_interval long_lease_time single_port_mode - - coresmd: http://192.168.0.254:8081 /root_ca/root_ca.crt 30s 1h true - - # Optionally include the file plugin here if it matters which IPs get assigned to which - # MACs. Otherwise, unknown MACs get passed to the bootloop "catch-all" plugin below. - # Note that lease_time is used to set the short lease time for the file plugin. - # - #- lease_time: 10m - #- file /etc/coredhcp/hostsfile - - # Args: storage_path boot_script_file short_lease_time ip_pool_start ip_pool_end - - bootloop: /tmp/coredhcp.db default 5m 192.168.0.150 192.168.0.253 diff --git a/quickstart-pcs/configs/haproxy.cfg b/quickstart-pcs/configs/haproxy.cfg deleted file mode 100644 index 32981191..00000000 --- a/quickstart-pcs/configs/haproxy.cfg +++ /dev/null @@ -1,86 +0,0 @@ -global - stats socket /var/run/api.sock user haproxy group haproxy mode 660 level admin expose-fd listeners - log stdout local0 info - fd-hard-limit 50000 - ssl-default-bind-options ssl-min-ver TLSv1.3 no-tls-tickets - -defaults - mode http - option httplog - timeout client 10s - timeout connect 5s - timeout server 10s - timeout http-request 10s - log global - -frontend stats - bind *:8404 - stats enable - stats uri / - stats refresh 10s - -frontend openchami - bind :80 - bind :443 ssl crt /etc/haproxy/certs/ strict-sni - option forwardfor - - acl PATH_smd path_beg -i /hsm/v2 - - acl PATH_bss path_beg -i /boot/v1 - acl PATH_bss path_beg -i /apis/bss/ - - acl PATH_opaal path_beg -i /token - acl PATH_opaal path_beg -i /login - acl PATH_opaal path_beg -i /oidc/callback - - acl PATH_opaal-idp path_beg -i /.well-known/openid-configuration - acl PATH_opaal-idp path_beg -i /.well-known/jwks.json - acl PATH_opaal-idp path_beg -i /browser/login - acl PATH_opaal-idp path_beg -i /api/login - acl PATH_opaal-idp path_beg -i /oauth2/authorize - acl PATH_opaal-idp path_beg -i /oauth2/token - - acl PATH_cloud-init path_beg -i /cloud-init - acl PATH_cloud-init path_beg -i /cloud-init-secure - - acl PATH_configurator path_beg -i /generate - acl PATH_configurator path_beg -i /configurator - - acl PATH_pcs path_beg -i /power-control/v1 - # acl PATH_pcs path_beg -i /transitions - # acl PATH_pcs path_beg -i /power-status - # acl PATH_pcs path_beg -i /power-cap - # acl PATH_pcs path_beg -i /liveness - # acl PATH_pcs path_beg -i /readiness - # acl PATH_pcs path_beg -i /health - - use_backend opaal if PATH_opaal - use_backend opaal-idp if PATH_opaal-idp - use_backend smd if PATH_smd - use_backend bss if PATH_bss - use_backend cloud-init if PATH_cloud-init - use_backend configurator if PATH_configurator - use_backend pcs if PATH_pcs - -backend pcs - server pcs pcs:28007 - http-request replace-path ^/power-control/(.*) /\1 - -backend opaal - server opaal opaal:3333 - -backend opaal-idp - server opaal-idp opaal-idp:3332 - -backend smd - server smd smd:27779 - -backend bss - server bss bss:27778 - http-request replace-path ^/apis/bss/(.*) /\1 - -backend cloud-init - server cloud-init-server cloud-init:27777 - -backend configurator - server configurator configurator:3334 diff --git a/quickstart-pcs/configs/hydra.yml b/quickstart-pcs/configs/hydra.yml deleted file mode 100644 index 4a3f29b6..00000000 --- a/quickstart-pcs/configs/hydra.yml +++ /dev/null @@ -1,20 +0,0 @@ -serve: - cookies: - same_site_mode: Lax - -oidc: - dynamic_client_registration: - enabled: true - subject_identifiers: - supported_types: - - public - -oauth2: - grant: - jwt: - jti_optional: true - iat_optional: true - max_ttl: 24h - -strategies: - access_token: jwt diff --git a/quickstart-pcs/configs/namespace b/quickstart-pcs/configs/namespace deleted file mode 100644 index f6907897..00000000 --- a/quickstart-pcs/configs/namespace +++ /dev/null @@ -1 +0,0 @@ -namespace diff --git a/quickstart-pcs/configs/opaal-template.yaml b/quickstart-pcs/configs/opaal-template.yaml deleted file mode 100644 index 5787c884..00000000 --- a/quickstart-pcs/configs/opaal-template.yaml +++ /dev/null @@ -1,68 +0,0 @@ -version: "0.0.1" -server: - host: "opaal" - port: 3333 - callback: "/oidc/callback" - issuer: # Opaal-idp only uses this section of the config - host: "opaal-idp" - port: 3332 - endpoints: - authorization: "https://./oauth2/authorize" - clients: - - id: openchami - secret: openchami - name: openchami - redirect-uris: - - "https://./oidc/callback" - -authentication: - state: "" - test-all: false - clients: - - id: "openchami" - secret: "openchami" - name: "openchami" - provider: - issuer: "http://opaal-idp:3332" - redirect-uris: - - "https://./oidc/callback" - - id: "" - secret: "" - name: "gitlab" - provider: - issuer: "" - scope: - - "openid" - - "profile" - - "email" - redirect-uris: - - "https://./oidc/callback" - -authorization: - token: - forwarding: false - refresh: false - duration: 16h - scope: - - smd.read - audience: - - https://./oauth2/token - key-path: ./keys - endpoints: - issuer: http://hydra:4444 - config: http://hydra:4444/.well-known/openid-configuration - jwks: http://hydra:4444/.well-known/jwks.json - trusted-issuers: http://hydra:4445/admin/trust/grants/jwt-bearer/issuers - login: http://hydra:4433/self-service/login/api - clients: http://hydra:4445/admin/clients - authorize: http://hydra:4444/oauth2/auth - register: http://hydra:4444/oauth2/register - token: http://hydra:4444/oauth2/token - - -options: - run-once: true - open-browser: false - flow: authorization_code - cache-only: false - verbose: true diff --git a/quickstart-pcs/configs/token b/quickstart-pcs/configs/token deleted file mode 100644 index 8d865be6..00000000 --- a/quickstart-pcs/configs/token +++ /dev/null @@ -1 +0,0 @@ -token diff --git a/quickstart-pcs/configurator.yml b/quickstart-pcs/configurator.yml deleted file mode 100644 index daacc1de..00000000 --- a/quickstart-pcs/configurator.yml +++ /dev/null @@ -1,25 +0,0 @@ -services: - configurator: - image: ghcr.io/openchami/configurator:latest - container_name: configurator - hostname: configurator - command: - - '/configurator/configurator' - - 'serve' - - '--config' - - '/configurator/config.yaml' - - '--verbose' - volumes: - - ./configs/configurator.yaml:/configurator/config.yaml - networks: - - internal - ports: - - 3334:3334 - depends_on: - smd: - condition: service_healthy - healthcheck: - test: ["CMD", "curl", "--fail", "--silent", "http://localhost:3334/configurator/status"] - interval: 5s - timeout: 10s - retries: 60 diff --git a/quickstart-pcs/coredhcp.yml b/quickstart-pcs/coredhcp.yml deleted file mode 100644 index 4563ec74..00000000 --- a/quickstart-pcs/coredhcp.yml +++ /dev/null @@ -1,23 +0,0 @@ -services: - coredhcp: - image: ghcr.io/openchami/coredhcp:v0.3.0 - container_name: coredhcp - hostname: coredhcp - network_mode: host - cap_add: - - NET_ADMIN - volumes: - - ./configs/coredhcp.yaml:/etc/coredhcp/config.yaml:ro - - step-root-ca:/root_ca/:ro - command: - - "/coredhcp" - - "-L" - - "debug" - healthcheck: - test: pgrep coredhcp - interval: 5s - timeout: 10s - retries: 60 - depends_on: - smd: - condition: service_healthy diff --git a/quickstart-pcs/create-keys.sh b/quickstart-pcs/create-keys.sh deleted file mode 100644 index 58b25800..00000000 --- a/quickstart-pcs/create-keys.sh +++ /dev/null @@ -1,71 +0,0 @@ -#!/bin/sh - -KEYS_PATH="keys" - -create_keys() { - ( - cd "${KEYS_PATH}" - openssl genrsa -out private_key.pem 2048 - openssl rsa -in private_key.pem -outform PEM -pubout -out public_key.pem - ) -} - -create_token() { - ( - cd "${KEYS_PATH}" - cipher="RS256" - pub_key="private_key.pem" - - header="$(cat <<-EOF - { - "alg": "$cipher", - "typ": "JWT", - "kid": "$kid" - } - EOF - )" - - payload="$(cat <<-EOF - { - "aud": "test", - "name": "John Doe", - "iat" : $(date +%s), - "exp": $(date +%s --date tomorrow), - "sub": "sub" - } - EOF - )" - - header=$(jq -c -r . <<< "$header") - - header=$(echo -n "$header" | \ - openssl enc -base64 \ - | tr -d '=' | tr '/+' '_-' | tr -d '\n' ) - - payload=$(jq -c -r . <<< "$payload" 2>&1); - - payload=$(echo -n "$payload" | \ - openssl enc -base64 | \ - tr -d '=' | tr '/+' '_-' | tr -d '\n' ) - - signature="$(echo -n "${header}.${payload}" | \ - openssl dgst -sha256 -binary -sign ${pub_key} | \ - openssl enc -base64 | \ - tr -d '=' | tr '/+' '_-' | tr -d '\n' )" - - echo "${header}.${payload}.$signature" > token - ) -} - -create_role() { - echo "test-role" > "${KEYS_PATH}"/role -} - -main() { - mkdir -p "${KEYS_PATH}" - create_keys - create_token - create_role -} - -main diff --git a/quickstart-pcs/etcd.yml b/quickstart-pcs/etcd.yml deleted file mode 100644 index 7dc5bf8f..00000000 --- a/quickstart-pcs/etcd.yml +++ /dev/null @@ -1,12 +0,0 @@ -services: - etcd: - container_name: etcd - image: quay.io/coreos/etcd:v3.5.17 - environment: - - ETCD_UNSUPPORTED_ARCH=arm64 - - ALLOW_NONE_AUTHENTICATION=yes - - ETCD_ADVERTISE_CLIENT_URLS=http://etcd:2379 - - ETCD_LISTEN_CLIENT_URLS=http://0.0.0.0:2379 - networks: - - internal - - jwt-internal diff --git a/quickstart-pcs/exploration-integrate-pcs.adoc b/quickstart-pcs/exploration-integrate-pcs.adoc deleted file mode 100644 index cbcef6e6..00000000 --- a/quickstart-pcs/exploration-integrate-pcs.adoc +++ /dev/null @@ -1,317 +0,0 @@ -= PCS integration in quickstart -:toc: -:sectnums: - -== Step - -. Deploy sushy-emulator -. Create a virtual node -. Do a `make run` that will -** generate keys folder -** start openchami services -** create access token to openchami service -** configure vault for jwt authentification -** populate vault with virtual node url - -. with manta: -.. Add a redfish-endpoint -.. Add a node in a group - -== Interact with PCS through cURL - -From this docker compose https://github.com/OpenCHAMI/power-control/blob/main/docker-compose.test.ct.yaml[docker-compose.test.ct.yaml] - -A list of differents tests. - -[source, shell] ----- -docker exec power-control-smd-1 curl -s power-control-power-control-1:28007/v1/ -Moved Permanently. ----- - -[source, shell] ----- -docker exec power-control-smd-1 curl -s power-control-power-control-1:28007/ -hms-power-control ----- - -[source, shell] ----- -docker exec power-control-smd-1 curl -s power-control-power-control-1:28007/liveness ----- - -[source, shell] ----- -docker exec power-control-smd-1 curl -s power-control-power-control-1:28007/notfound -404 page not found ----- - -From `./internal/hsm/state_manager.go` of `power-control` repository: - -[source, go] ----- -hsmLivenessPath = "/hsm/v2/service/liveness" -hsmStateComponentsPath = "/hsm/v2/State/Components" -hsmStateComponentsQueryPath = "/hsm/v2/State/Components/Query" -hsmInventoryComponentEndpointPath = "/hsm/v2/Inventory/ComponentEndpoints" -hsmReservationCheckPath = "/hsm/v2/locks/service/reservations/check" -hsmReservationPath = "/hsm/v2/locks/service/reservations" -hsmReservationReleasePath = "/hsm/v2/locks/service/reservations/release" -hsmPowerMapPath = "/hsm/v2/sysinfo/powermaps" ----- - -I cannot use these routes. - -== Interact with PCS through Manta cli and cURL - -From this quickstart folder. - -Manta cli - ----- -manta power off nodes --assume-yes x1000c0s0b1 -ERROR - Could not power off node/s '[]'. Reason: -ERROR - Message: ERROR - MESA:

503 Service Unavailable

-No server is available to handle this request. - ----- - -curl - ----- -docker exec smd curl -s http://pcs:28007/health | jq -{ - "KvStore": "connected, responsive", - "DistLocking": "connected, responsive", - "StateManager": "connected, responsive", - "Vault": "connected, responsive", - "TaskRunner": "connected, responsive, local mode" -} ----- - -ochami - ----- -ochami pcs status -2025-03-31T15:54:32+02:00 FTL pcs-status.go:55 > PCS status (readiness) request yielded unsuccessful HTTP response error="GetReadiness(): error getting PCS liveness: unsuccessful HTTP status: HTTP/1.1 503 Service Unavailable:

503 Service Unavailable

\nNo server is available to handle this request.\n\n" ----- - -== Edit the HAProxy and retry - -retry - -* ochami works -+ ----- -ochami pcs status -{"pcs":"ready"} ----- - -* manta cli still not working -+ ----- -ERROR - Message: ERROR - MESA:

503 Service Unavailable

-No server is available to handle this request. - ----- - -== retry - ----- -ochami pcs status -{"pcs":"ready"} -manta power off nodes --assume-yes x1000c0s0b1 -INFO | Create PCS transition 'force-off' on [] -ERROR - Could not power off node/s '[]'. Reason: -ERROR - Message: ERROR - MESA:

503 Service Unavailable

-No server is available to handle this request. - - -manta --version -manta 1.54.1-beta.100 ----- - -== Manta CLI can talk to PCS - -=== Update Manta CLI - -. In `eth-cscs/manta`: Switch to local ochami-rs -+ -[source, patch] ----- ---- a/Cargo.toml -+++ b/Cargo.toml -@@ -32,13 +32,13 @@ publish = false # cargo - # PROD - - backend-dispatcher = "0.1.42" --ochami-rs = "0.1.44" -+# ochami-rs = "0.1.44" - mesa = "0.42.3-beta.75" - - # DEV - - # backend-dispatcher = { path = "../backend-dispatcher" } # Only for development purposes --# ochami-rs = { path = "../ochami-rs" } # Only for development purposes -+ochami-rs = { path = "../ochami-rs" } # Only for development purposes - # mesa = { path = "../mesa" } # Only for development purposes - - # --- END MANTA DEPENDENCIES --- ----- - -. In `OpenCHAMI/ochami-rs`: remove the URL prefix -+ -[source, patch] ----- -Subject: [PATCH] remove power-control - -sed -i 's|power-control/v1/||' $(find . -name "*.rs") ---- - src/pcs/power_cap/http_client.rs | 8 ++++---- - src/pcs/power_status/http_client.rs | 4 ++-- - src/pcs/transitions/http_client.rs | 6 +++--- - 3 files changed, 9 insertions(+), 9 deletions(-) - -diff --git a/src/pcs/power_cap/http_client.rs b/src/pcs/power_cap/http_client.rs -index a9646af..1aff215 100644 ---- a/src/pcs/power_cap/http_client.rs -+++ b/src/pcs/power_cap/http_client.rs -@@ -26,7 +26,7 @@ pub async fn get( - client = client_builder.build()?; - } - -- let api_url = format!("{}/power-control/v1/power-cap", shasta_base_url); -+ let api_url = format!("{}/power-cap", shasta_base_url); - - let response = client - .get(api_url) -@@ -73,7 +73,7 @@ pub async fn get_task_id( - client = client_builder.build()?; - } - -- let api_url = format!("{}/power-control/v1/power-cap/{}", shasta_base_url, task_id); -+ let api_url = format!("{}/power-cap/{}", shasta_base_url, task_id); - - let response = client - .get(api_url) -@@ -121,7 +121,7 @@ pub async fn post_snapshot( - client_builder.build()? - }; - -- let api_url = shasta_base_url.to_owned() + "/power-control/v1/power-cap/snapshot"; -+ let api_url = shasta_base_url.to_owned() + "/power-cap/snapshot"; - - let response = client - .put(api_url) -@@ -169,7 +169,7 @@ pub async fn patch( - client_builder.build()? - }; - -- let api_url = shasta_base_url.to_owned() + "/power-control/v1/power-cap/snapshot"; -+ let api_url = shasta_base_url.to_owned() + "/power-cap/snapshot"; - - let response = client - .put(api_url) -diff --git a/src/pcs/power_status/http_client.rs b/src/pcs/power_status/http_client.rs -index 98db214..4151aa2 100644 ---- a/src/pcs/power_status/http_client.rs -+++ b/src/pcs/power_status/http_client.rs -@@ -29,7 +29,7 @@ pub async fn get( - client = client_builder.build()?; - } - -- let api_url = format!("{}/power-control/v1/power-status", shasta_base_url); -+ let api_url = format!("{}/power-status", shasta_base_url); - - let xname_vec_str_opt: Option = xname_vec_opt.map(|xname_vec| xname_vec.join(",")); - -@@ -90,7 +90,7 @@ pub async fn post( - client_builder.build()? - }; - -- let api_url = shasta_base_url.to_owned() + "/power-control/v1/power-status"; -+ let api_url = shasta_base_url.to_owned() + "/power-status"; - - let response = client - .put(api_url) -diff --git a/src/pcs/transitions/http_client.rs b/src/pcs/transitions/http_client.rs -index ca54d3e..e83590f 100644 ---- a/src/pcs/transitions/http_client.rs -+++ b/src/pcs/transitions/http_client.rs -@@ -31,7 +31,7 @@ pub async fn get( - client = client_builder.build()?; - } - -- let api_url = format!("{}/power-control/v1/transitions", shasta_base_url); -+ let api_url = format!("{}/transitions", shasta_base_url); - - log::debug!("PCS transition URL: {}", api_url); - -@@ -83,7 +83,7 @@ pub async fn get_by_id( - client = client_builder.build()?; - } - -- let api_url = format!("{}/power-control/v1/transitions/{}", shasta_base_url, id); -+ let api_url = format!("{}/transitions/{}", shasta_base_url, id); - - let response = client - .get(api_url) -@@ -156,7 +156,7 @@ pub async fn post( - client_builder.build()? - }; - -- let api_url = shasta_base_url.to_owned() + "/power-control/v1/transitions"; -+ let api_url = shasta_base_url.to_owned() + "/transitions"; - - // Submit call to http api - let response = client ----- - -=== Retry to power off - ----- -target/debug/manta power off nodes --assume-yes x1000c0s0b1 -INFO | Create PCS transition 'force-off' on [] -INFO | PCS transition ID: 04ba747f-8f6c-4df5-80c2-9318251024fe -Ok( - Object { - "automaticExpirationTime": String("2025-04-04T09:05:07.41614002Z"), - "createTime": String("2025-04-03T09:05:07.416139953Z"), - "operation": String("Force-Off"), - "taskCounts": Object { - "failed": Number(0), - "in-progress": Number(0), - "new": Number(0), - "succeeded": Number(0), - "total": Number(0), - "un-supported": Number(0), - }, - "transitionID": String("04ba747f-8f6c-4df5-80c2-9318251024fe"), - "transitionStatus": String("completed"), - }, -) -Ok( - Object { - "automaticExpirationTime": String("2025-04-04T09:05:07.41614002Z"), - "createTime": String("2025-04-03T09:05:07.416139953Z"), - "operation": String("Force-Off"), - "taskCounts": Object { - "failed": Number(0), - "in-progress": Number(0), - "new": Number(0), - "succeeded": Number(0), - "total": Number(0), - "un-supported": Number(0), - }, - "transitionID": String("04ba747f-8f6c-4df5-80c2-9318251024fe"), - "transitionStatus": String("completed"), - }, -) -Power 'Force-Off' summary - status: completed, failed: 0, in-progress: 0, succeeded: 0, total: 0. Attempt 1 of 300 ----- - -== Next - -Manta is now able to communicate with PCS. - -But I did not test if PCS communicate well with a redfish endpoint diff --git a/quickstart-pcs/generate-configs.sh b/quickstart-pcs/generate-configs.sh deleted file mode 100755 index 791b0fd5..00000000 --- a/quickstart-pcs/generate-configs.sh +++ /dev/null @@ -1,104 +0,0 @@ -#!/bin/bash -l - -set -euo pipefail - -usage() { - echo "Usage: [options] $0" - echo "" - echo "Generate configuration for OpenCHAMI quickstart using example" - echo "parameters." - echo "" - echo "OPTIONS:" - echo " -h Print this usage message to stdout." - echo " -f Force overwriting config files." -} - -while getopts "fh" opt; do - case "${opt}" in - f) - FORCE_OVERWRITE=true - ;; - h) - usage - exit - ;; - *) - usage >&2 - exit - ;; - esac -done -shift $((OPTIND - 1)) - -if [ -f .env ] && [ -z "${FORCE_OVERWRITE+x}" ]; then - echo "A config file (.env) exists. Delete to generate a new one or -f to overwrite." - file_exists=true -fi - -if [ -f configs/opaal.yaml ] && [ -z "${FORCE_OVERWRITE+x}" ]; then - echo "An OPAAL config (configs/opaal.yaml) exists. Delete to generate a new one or -f to overwrite." - file_exists=true -fi - -if [ -f configs/coredhcp.yaml ] && [ -z "${FORCE_OVERWRITE+x}" ]; then - echo "A CoreDHCP config (configs/coredhcp.yaml) exists. Delete to generate a new one or -f to overwrite." - file_exists=true -fi - -if [ -n "${file_exists+x}" ]; then exit 1; fi - -SYSNAME=foobar -SYSDOMAIN="openchami.cluster" - -# Check for required commands -if [[ ! -x $(command -v jq) ]]; then - echo "Command \"jq\" not found" - exit 1 -fi -if [[ ! -x $(command -v sed) ]]; then - echo "Command \"sed\" not found" - exit 1 -fi - -generate_random_alphanumeric() { - local num_chars=${1:-32} - dd bs=512 if=/dev/urandom count=1 2>/dev/null | tr -dc '[:alnum:]' | fold -w "${num_chars}" | head -n 1 -} - -# Generate OPAAL config from configs/opaal-template.yaml. This will populate the -# system name and domain of the config with the values set for SYSTEM_NAME and -# SYSTEM_DOMAIN in this script. -# TODO: Populate GitLab information in OPAAL config. -sed \ - -e "s//${SYSNAME}/g" \ - -e "s//${SYSDOMAIN}/g" \ - configs/opaal-template.yaml >configs/opaal.yaml - -# Generate CoreDHCP configuration from configs/coredhcp-template.yaml. -sed \ - -e "s||https://${SYSNAME}.${SYSDOMAIN}:8443|g" \ - configs/coredhcp-template.yaml >configs/coredhcp.yaml - -# Set the system name -cat >.env </dev/null - - sudo apt-get update - sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin - - sudo usermod -aG docker "$(whoami)" -} - -main() { - install_last_docker_version_debian -} - -main diff --git a/quickstart-pcs/jwt-security.yml b/quickstart-pcs/jwt-security.yml deleted file mode 100644 index c7e1ad44..00000000 --- a/quickstart-pcs/jwt-security.yml +++ /dev/null @@ -1,91 +0,0 @@ -services: - opaal-idp: - image: ghcr.io/openchami/opaal:v0.3.8 - container_name: opaal-idp - hostname: opaal-idp - command: - - '/opaal/opaal' - - 'serve' - - '--config' - - '/opaal/config/opaal.yaml' - volumes: - - ./configs:/opaal/config/ - networks: - - jwt-internal - #ports: - # - 3332:3332 - healthcheck: - test: ["CMD", "curl", "--fail", "--silent", "http://opaal-idp:3332/.well-known/jwks.json"] - interval: 5s - timeout: 10s - retries: 60 - opaal: - image: ghcr.io/openchami/opaal:v0.3.8 - container_name: opaal - hostname: opaal - command: - - '/opaal/opaal' - - 'login' - - '--config' - - '/opaal/config/opaal.yaml' - volumes: - - ./configs:/opaal/config/ - networks: - - internal - - jwt-internal - extra_hosts: - - "${SYSTEM_NAME}.${SYSTEM_DOMAIN}:${LOCAL_IP}" - - healthcheck: - test: ["CMD", "curl", "--fail", "--silent", "http://opaal:3333/keys"] - interval: 5s - timeout: 10s - retries: 60 - depends_on: - hydra: - condition: service_healthy - opaal-idp: - condition: service_healthy - hydra: - image: docker.io/oryd/hydra:v2.2.0-rc.3 - container_name: hydra - hostname: hydra - healthcheck: - test: ["CMD", "wget", "--spider", "-q", "http://hydra:4444/health/alive"] - interval: 10s - timeout: 10s - retries: 10 - #ports: - # - "4444:4444" # Public port - # - "4445:4445" # Admin port - # - "5555:5555" # Port for hydra token user - command: serve -c /etc/config/hydra/hydra.yml all --sqa-opt-out - volumes: - - ./configs/:/etc/config/hydra - environment: - - SECRETS_SYSTEM=${HYDRA_SYSTEM_SECRET} # set in .env - - URLS_SELF_ISSUER=https://${SYSTEM_NAME}.${SYSTEM_DOMAIN}/ - - URLS_SELF_PUBLIC=https://${SYSTEM_NAME}.${SYSTEM_DOMAIN}/ - - URLS_LOGIN=https://${SYSTEM_NAME}.${SYSTEM_DOMAIN}/login - - URLS_CONSENT=https://${SYSTEM_NAME}.${SYSTEM_DOMAIN}/consent - - URLS_LOGOUT=https://${SYSTEM_NAME}.${SYSTEM_DOMAIN}/logout - - DSN=postgres://hydra-user:${HYDRA_POSTGRES_PASSWORD}@postgres:5432/hydradb?sslmode=disable&max_conns=20&max_idle_conns=4 - restart: unless-stopped - depends_on: - hydra-migrate: - condition: service_completed_successfully - networks: - - jwt-internal - hydra-migrate: - image: docker.io/oryd/hydra:v2.2.0-rc.3 - container_name: hydra-migrate - hostname: hydra-migrate - environment: - - SECRETS_SYSTEM=${HYDRA_SYSTEM_SECRET} # set in .env - - DSN=postgres://hydra-user:${HYDRA_POSTGRES_PASSWORD}@postgres:5432/hydradb?sslmode=disable&max_conns=20&max_idle_conns=4 - command: migrate -c /etc/config/hydra/hydra.yml sql -e --yes - volumes: - - ./configs/:/etc/config/hydra - restart: on-failure - networks: - - internal diff --git a/quickstart-pcs/libvirt/setup-libvirt.sh b/quickstart-pcs/libvirt/setup-libvirt.sh deleted file mode 100644 index c7d27373..00000000 --- a/quickstart-pcs/libvirt/setup-libvirt.sh +++ /dev/null @@ -1,26 +0,0 @@ -#!/bin/sh - -set -e - -install_packages() { - sudo apt update -y - sudo apt install -y \ - libvirt-daemon \ - libvirt-daemon-system \ - qemu-system \ - pkg-config \ - build-essential \ - libssl-dev \ - libffi-dev -} - -add_user_to_libvirt() { - sudo usermod -aG libvirt "$(whoami)" -} - -main() { - install_packages - add_user_to_libvirt -} - -main diff --git a/quickstart-pcs/libvirt/virtual-node.sh b/quickstart-pcs/libvirt/virtual-node.sh deleted file mode 100644 index 9eabd437..00000000 --- a/quickstart-pcs/libvirt/virtual-node.sh +++ /dev/null @@ -1,66 +0,0 @@ -#!/bin/sh - -set -e - -VBMC_DOMAIN_NAME="virtual-node" - -install_packages() { - sudo apt update -y - sudo apt install -y virtinst -} - -sushy_create_disk() { - sudo virsh pool-define-as testPool dir - - - - "/testPool" - sudo virsh pool-build testPool - sudo virsh pool-start testPool - sudo virsh pool-autostart testPool - sudo virsh vol-create-as testPool testVol 1G - sudo cp /var/www/html/file.qcow2 /testPool -} - -sushy_create_domain() { - tmpfile=$(mktemp /tmp/sushy-domain.XXXXXX) - sudo virt-install \ - --name "${VBMC_DOMAIN_NAME}" \ - --ram 1024 \ - --disk path=${HOME}/file.qcow2,size=4,format=qcow2 \ - --vcpus 2 \ - --os-variant fedora28 \ - --graphics vnc \ - --network network=vbmc \ - --print-xml >$tmpfile - sudo virsh define --file $tmpfile - rm $tmpfile -} - -sushy_create_network() { - tmpfile=$(mktemp /tmp/sushy-domain.XXXXXX) - cat >"${tmpfile}" <<-XML - - vbmc - - - - - - - XML - sudo virsh net-create "${tmpfile}" - rm "${tmpfile}" -} - -sushy_clean_domain() { - sudo virsh shutdown "${VBMC_DOMAIN_NAME}" || true - sudo virsh destroy "${VBMC_DOMAIN_NAME}" || true - sudo virsh undefine "${VBMC_DOMAIN_NAME}" || true -} - -main() { - install_packages - touch file.qcow2 - sushy_create_network - sushy_create_domain - sudo virsh start "${VBMC_DOMAIN_NAME}" -} - -main diff --git a/quickstart-pcs/openchami-svcs.yml b/quickstart-pcs/openchami-svcs.yml deleted file mode 100644 index f9057c4c..00000000 --- a/quickstart-pcs/openchami-svcs.yml +++ /dev/null @@ -1,146 +0,0 @@ -services: -### -# SMD Init and Server Containers -### - # sets up postgres for SMD data - smd-init: - image: ghcr.io/openchami/smd:v2.17.7 - container_name: smd-init - hostname: smd-init - environment: - - SMD_DBHOST=postgres - - SMD_DBPORT=5432 - - SMD_DBNAME=hmsds - - SMD_DBUSER=smd-user - - SMD_DBPASS=${SMD_POSTGRES_PASSWORD} # Set in .env file - - SMD_DBOPTS=sslmode=disable - depends_on: - postgres: - condition: service_healthy - networks: - - internal - entrypoint: - - /smd-init - # SMD - smd: - image: ghcr.io/openchami/smd:v2.17.7 - container_name: smd - hostname: smd - environment: - - SMD_DBHOST=postgres - - SMD_DBPORT=5432 - - SMD_DBNAME=hmsds - - SMD_DBUSER=smd-user - - SMD_DBPASS=${SMD_POSTGRES_PASSWORD} # Set in .env file - - SMD_DBOPTS=sslmode=disable - # - SMD_JWKS_URL=http://opaal:3333/keys - - SMD_JWKS_URL= # To help PCS querying hardware from SMD/HSM hardware inventory without authentication - - VAULT_ADDR=http://vault:8200 - - VAULT_TOKEN=hms - - CRAY_VAULT_AUTH_PATH=auth/token/create - - CRAY_VAULT_ROLE_FILE=configs/namespace - - CRAY_VAULT_JWT_FILE=configs/token - - SMD_WVAULT=true - - SMD_RVAULT=true - volumes: - - ./configs/namespace:/configs/namespace - - ./configs/token:/configs/token - depends_on: - postgres: - condition: service_healthy - smd-init: - condition: service_completed_successfully - opaal: - condition: service_healthy - ports: - - "27779:27779" - healthcheck: - test: ["CMD", "curl", "--fail", "--silent", "http://localhost:27779/hsm/v2/service/ready"] - interval: 5s - retries: 60 - start_period: 20s - timeout: 10s - networks: - - internal -### -# BSS Init and Server Containers -### -# sets up postgres for BSS data - bss-init: - image: ghcr.io/openchami/bss:v1.32.0 - container_name: bss-init - hostname: bss-init - environment: - - BSS_USESQL=true - - BSS_INSECURE=true - - BSS_DBHOST=postgres - - BSS_DBPORT=5432 - - BSS_DBNAME=bssdb - - BSS_DBUSER=bss-user - - BSS_DBPASS=${BSS_POSTGRES_PASSWORD} # Set in .env file - depends_on: - postgres: - condition: service_healthy - networks: - - internal - entrypoint: - - /usr/local/bin/bss-init - # boot-script-service - bss: - image: ghcr.io/openchami/bss:v1.32.0 - container_name: bss - hostname: bss - environment: - - BSS_USESQL=true - - BSS_INSECURE=true - - BSS_DEBUG=true - - BSS_DBHOST=postgres - - BSS_DBPORT=5432 - - BSS_DBNAME=bssdb - - BSS_DBUSER=bss-user - - BSS_DBPASS=${BSS_POSTGRES_PASSWORD} # Set in .env file - - BSS_JWKS_URL=http://opaal:3333/keys - - BSS_OAUTH2_ADMIN_BASE_URL=http://opaal:3333 - - BSS_OAUTH2_PUBLIC_BASE_URL=http://opaal:3333 - - BSS_IPXE_SERVER=${SYSTEM_NAME}.${SYSTEM_DOMAIN} - - BSS_CHAIN_PROTO=https - - BSS_BOOTSCRIPT_NOTIFY_URL=http://tpm-manager:27780/Node - #ports: - # - '27778:27778' - depends_on: - postgres: - condition: service_healthy - smd: - condition: service_healthy - bss-init: - condition: service_completed_successfully - opaal: - condition: service_healthy - networks: - - internal - healthcheck: - test: ["CMD", "curl", "--fail", "--silent", "http://localhost:27778/boot/v1/service/status"] - interval: 5s - timeout: 10s - retries: 60 -### -# cloud-init Server Container -### - # cloud-init server, with the secure route disabled for now - cloud-init: - image: ghcr.io/openchami/cloud-init:v0.1.1 - container_name: cloud-init - hostname: cloud-init - environment: - - LISTEN_ADDR=:27777 - - SMD_URL=http://smd:27779 - - OPAAL_URL=http://opaal:3333 - ports: - - '27777:27777' - depends_on: - smd: - condition: service_healthy - opaal: - condition: service_healthy - networks: - - internal diff --git a/quickstart-pcs/pcs.yml b/quickstart-pcs/pcs.yml deleted file mode 100644 index 7042048d..00000000 --- a/quickstart-pcs/pcs.yml +++ /dev/null @@ -1,34 +0,0 @@ -services: - pcs: - image: ghcr.io/openchami/pcs - container_name: pcs - restart: always - networks: - - internal - - jwt-internal - environment: - SMS_SERVER: http://smd:27779 - VAULT_ENABLED: true - VAULT_ADDR: "http://vault:8200" - VAULT_KEYPATH: "secret/hms-creds" - API_URL: "http://localhost" - API_SERVER_PORT: ":28007" - API_BASE_PATH: "/v1" - CRAY_VAULT_ROLE_FILE: configs/namespace - CRAY_VAULT_JWT_FILE: configs/token - CRAY_VAULT_AUTH_PATH: auth/token/create - VAULT_TOKEN: hms - LOG_LEVEL: DEBUG - volumes: - - ./keys:/etc/keys - ports: - - 28007:28007 - - # TODO: try [depends_on][1] - # 1: https://github.com/OpenCHAMI/power-control/blob/46d7f18ccea0687da383d3ad02ee1b5a0581c34f/docker-compose.test.ct.yaml#L321 - # depends_on: - # - etcd # needed to bring up PCS - # - smd # needed to bring up PCS - # - vault-kv-enabler # needed for discovery of emulated hardware to succeed - # - emulator-loader # needed to bring up emulated hardware - # - wait-for-smd # needed to give PCS time for its initial hardware scan diff --git a/quickstart-pcs/pg-init/multi-psql-db.sh b/quickstart-pcs/pg-init/multi-psql-db.sh deleted file mode 100755 index 5474b9e0..00000000 --- a/quickstart-pcs/pg-init/multi-psql-db.sh +++ /dev/null @@ -1,31 +0,0 @@ -#!/bin/bash -# -# Adapted from: -# https://github.com/mrts/docker-postgresql-multiple-databases/blob/master/create-multiple-postgresql-databases.sh - -set -e -set -u - -function create_user_and_database() { - local database=$1 - local username=$2 - local password="'$3'" - echo " Creating user '$username' and database '$database'" - psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" <<-EOSQL - CREATE USER "$username" WITH PASSWORD $password; - CREATE DATABASE "$database"; - GRANT ALL PRIVILEGES ON DATABASE "$database" TO "$username"; -EOSQL -} - -if [ -n "$POSTGRES_MULTIPLE_DATABASES" ]; then - echo "Multiple database creation requested: $POSTGRES_MULTIPLE_DATABASES" - for dbstr in $(echo $POSTGRES_MULTIPLE_DATABASES | tr ',' ' '); do - dbname=$(echo $dbstr | cut -d: -f1) - username=$(echo $dbstr | cut -d: -f2) - password=$(echo $dbstr | cut -d: -f3) - echo "Creating: db=$dbname user=$username" - create_user_and_database $dbname $username $password - done - echo "Multiple databases created" -fi diff --git a/quickstart-pcs/postgres.yml b/quickstart-pcs/postgres.yml deleted file mode 100644 index e85260b7..00000000 --- a/quickstart-pcs/postgres.yml +++ /dev/null @@ -1,25 +0,0 @@ -volumes: - postgres-data: - -services: - postgres: # Postgres - image: docker.io/postgres:11.5-alpine - container_name: postgres - restart: always - environment: - POSTGRES_USER: ${POSTGRES_USER} - POSTGRES_PASSWORD: ${POSTGRES_PASSWORD} # Set in .env file for now. - POSTGRES_MULTIPLE_DATABASES: hmsds:smd-user:${SMD_POSTGRES_PASSWORD},bssdb:bss-user:${BSS_POSTGRES_PASSWORD},hydradb:hydra-user:${HYDRA_POSTGRES_PASSWORD} - volumes: - - postgres-data:/var/lib/postgresql/data - - ./pg-init:/docker-entrypoint-initdb.d - networks: - - internal - - jwt-internal - ports: - - 5432:5432 - healthcheck: - test: ["CMD", "pg_isready", "--username", "${POSTGRES_USER}"] - interval: 10s - timeout: 10s - retries: 5 diff --git a/quickstart-pcs/rfe-sushy-emulator.sh b/quickstart-pcs/rfe-sushy-emulator.sh deleted file mode 100644 index ea5c175f..00000000 --- a/quickstart-pcs/rfe-sushy-emulator.sh +++ /dev/null @@ -1,123 +0,0 @@ -#!/bin/sh - -SUSHY_EMULATOR_PATH="sushy-emulator" - -install_packages() { - if type htpasswd; then - return - fi - - sudo apt install -y apache2-utils # for htpasswd -} - -create_ssh() { - SSH_PATH="${SUSHY_EMULATOR_PATH}/ssh" - - mkdir -p "${SSH_PATH}" - - ssh-keygen -N '' -t ed25519 -f "${SSH_PATH}"/id_ed25519 - cat "${SSH_PATH}"/id_ed25519.pub >>~/.ssh/authorized_keys -} - -create_ssl() { - local SERVER_PATH="${SUSHY_EMULATOR_PATH}/ssl" - local SERVER_KEY="${SERVER_PATH}/sushy-emulator.key" - local SERVER_CSR="${SERVER_PATH}/sushy-emulator.csr" - local SERVER_CRT="${SERVER_PATH}/sushy-emulator.crt" - local EXTFILE="${SERVER_PATH}/cert_ext.cnf" - - mkdir -p "${SERVER_PATH}" - - cat >${EXTFILE} <<-eof - [req] - default_bit = 4096 - distinguished_name = req_distinguished_name - prompt = no - - [req_distinguished_name] - countryName = CH - stateOrProvinceName = Vaud - localityName = Lausanne - organizationName = EPFL - commonName = foobar - eof - - openssl genrsa -out ${SERVER_KEY} 4096 - openssl req -new -key ${SERVER_KEY} -out ${SERVER_CSR} -config ${EXTFILE} - openssl x509 -req -days 3650 -in ${SERVER_CSR} -signkey ${SERVER_KEY} -out ${SERVER_CRT} -} - -create_htpasswd() { - local HTPASSWD_PATH="${SUSHY_EMULATOR_PATH}/htpasswd" - mkdir -p "${HTPASSWD_PATH}" - htpasswd -cbB "${HTPASSWD_PATH}"/auth-file root root_password -} - -create_config() { - local CONFIG_PATH="${SUSHY_EMULATOR_PATH}/config" - mkdir -p "${CONFIG_PATH}" - NODE_UUID="$(sudo virsh dumpxml virtual-node | grep uuid | sed 's| \(....................................\)|\1|')" - cat >"${CONFIG_PATH}"/config.py <<-eof - SUSHY_EMULATOR_AUTH_FILE = "/htpasswd/auth-file" - SUSHY_EMULATOR_STORAGE = { - "${NODE_UUID}": [ - { - "Id": "1", - "Name": "Local Storage Controller", - "StorageControllers": [ - { - "MemberId": "0", - "Name": "Contoso Integrated RAID", - "SpeedGbps": 12 - } - ], - "Drives": [ - "32ADF365C6C1B7BD" - ] - } - ] - } - - SUSHY_EMULATOR_DRIVES = { - ("${NODE_UUID}", "1"): [ - { - "Id": "32ADF365C6C1B7BD", - "Name": "Drive Sample", - "CapacityBytes": 899527000000, - "Protocol": "SAS" - } - ] - } - - SUSHY_EMULATOR_VOLUMES = { - ('${NODE_UUID}', '1'): [ - { - "libvirtPoolName": "sushyPool", - "libvirtVolName": "testVol", - "Id": "1", - "Name": "Sample Volume 1", - "VolumeType": "Mirrored", - "CapacityBytes": 23748 - }, - { - "libvirtPoolName": "sushyPool", - "libvirtVolName": "testVol1", - "Id": "2", - "Name": "Sample Volume 2", - "VolumeType": "StripedWithParity", - "CapacityBytes": 48395 - } - ] - } - eof -} - -main() { - install_packages - create_ssh - create_ssl - create_config - create_htpasswd -} - -main diff --git a/quickstart-pcs/rfe.yml b/quickstart-pcs/rfe.yml deleted file mode 100644 index 9bf8f5f3..00000000 --- a/quickstart-pcs/rfe.yml +++ /dev/null @@ -1,15 +0,0 @@ -services: - rfemulator3: - hostname: x1000c0s0b1 - container_name: x1000c0s0b1 - image: ghcr.io/openchami/csm-rie:v1.6.7 - environment: - - MOCKUPFOLDER=EX425 - - MAC_SCHEMA=Mountain - - XNAME=x1000c0s0b1 - - PORT=443 - ports: - - 443:443 - networks: - - internal - - jwt-internal diff --git a/quickstart-pcs/run.sh b/quickstart-pcs/run.sh deleted file mode 100644 index c9314cc7..00000000 --- a/quickstart-pcs/run.sh +++ /dev/null @@ -1,97 +0,0 @@ -#!/bin/sh - -export VAULT_ADDR=http://127.0.0.1:8200 -export VAULT_TOKEN=hms -export SUSHY_URL="http://localhost:8000" - -XNAME=x1000c0s0b1 - -KEYS_PATH="keys" - -start_service() { - until docker compose \ - -f base.yml \ - -f postgres.yml \ - -f jwt-security.yml \ - -f haproxy-api-gateway.yml \ - -f openchami-svcs.yml \ - -f autocert.yml \ - -f coredhcp.yml \ - -f pcs.yml \ - -f vault.yml \ - -f etcd.yml \ - -f rfe.yml \ - -f sushy.yml \ - -f configurator.yml up -d - do - docker compose \ - -f base.yml \ - -f postgres.yml \ - -f jwt-security.yml \ - -f haproxy-api-gateway.yml \ - -f openchami-svcs.yml \ - -f autocert.yml \ - -f coredhcp.yml \ - -f pcs.yml \ - -f vault.yml \ - -f etcd.yml \ - -f rfe.yml \ - -f sushy.yml \ - -f configurator.yml down - done -} - -generate_file() { - source bash_functions.sh - gen_access_token > access_token - get_ca_cert > cacert.pem -} - -vault_configure_jwt() { - if docker exec -e VAULT_TOKEN=$VAULT_TOKEN vault vault auth list --format json | jq -e 'has("jwt/")' - then - return - fi - - docker exec -e VAULT_TOKEN=$VAULT_TOKEN vault vault auth enable -path=jwt jwt - docker exec -e VAULT_TOKEN=$VAULT_TOKEN vault vault write auth/jwt/role/test-role policies="metrics" user_claim="sub" role_type="jwt" bound_audiences="test" - cat > policy.yml <<-\EOF - path "secret/hms-creds" { - capabilities = ["read", "list"] - } - EOF - docker cp policy.yml vault:/policy.yml - docker exec -e VAULT_TOKEN=hms vault vault policy write metrics /policy.yml - docker cp $KEYS_PATH/public_key.pem vault:/public_key.pem - docker exec -e VAULT_TOKEN=hms vault vault write auth/jwt/config jwt_supported_algs=RS256 jwt_validation_pubkeys=@/public_key.pem -} - -vault_create_keystore() { - docker exec -e VAULT_TOKEN=$VAULT_TOKEN vault vault secrets disable secret - docker exec -e VAULT_TOKEN=$VAULT_TOKEN vault vault secrets enable \ - -path "secret/hms-creds" \ - -version=1 kv -} - -smd_populate() { - # populate like this [docker compose][1] do - # 1: https://github.com/OpenCHAMI/power-control/blob/main/docker-compose.test.ct.yaml#L108 - - curl -X POST -d '{"RedfishEndpoints":[{ - "ID":"x1000c0s0b1", - "FQDN":"x1000c0s0b1", - "RediscoverOnUpdate":true, - "User":"root", - "Password":"root_password" - }]}' http://localhost:27779/hsm/v2/Inventory/RedfishEndpoints -} - -main() { - start_service - generate_file - vault_configure_jwt - vault_create_keystore - smd_populate -} - -main diff --git a/quickstart-pcs/stop.sh b/quickstart-pcs/stop.sh deleted file mode 100644 index 89faf6df..00000000 --- a/quickstart-pcs/stop.sh +++ /dev/null @@ -1,14 +0,0 @@ -docker compose \ - -f base.yml \ - -f postgres.yml \ - -f jwt-security.yml \ - -f haproxy-api-gateway.yml \ - -f openchami-svcs.yml \ - -f autocert.yml \ - -f coredhcp.yml \ - -f pcs.yml \ - -f vault.yml \ - -f etcd.yml \ - -f rfe.yml \ - -f sushy.yml \ - -f configurator.yml down diff --git a/quickstart-pcs/sushy.yml b/quickstart-pcs/sushy.yml deleted file mode 100644 index a9e313f5..00000000 --- a/quickstart-pcs/sushy.yml +++ /dev/null @@ -1,17 +0,0 @@ -services: - sushy: - image: tgrivel/sushy-emulator:0.0.3 - hostname: x1000c0s0b0 - container_name: x1000c0s0b0 - restart: always - networks: - - internal - - jwt-internal - volumes: - - ./sushy-emulator/ssl:/ssl - - ./sushy-emulator/ssh:/root/.ssh - - ./sushy-emulator/config:/config - - ./sushy-emulator/htpasswd:/htpasswd - ports: - - 8000:443 - command: /env/bin/sushy-emulator --port 443 --config /config/config.py --interface 0.0.0.0 --ssl-certificate /ssl/sushy-emulator.crt --ssl-key /ssl/sushy-emulator.key --libvirt-uri "qemu+ssh://cloud-user@172.17.0.1/system" diff --git a/quickstart-pcs/tpm-manager.yml b/quickstart-pcs/tpm-manager.yml deleted file mode 100644 index 76889879..00000000 --- a/quickstart-pcs/tpm-manager.yml +++ /dev/null @@ -1,32 +0,0 @@ -services: - ### - # TPM-manager container, pushes cloud-init tokens into nodes' TPM storage - ### - tpm-manager: - image: ghcr.io/openchami/tpm-manager:v0.2.2 - container_name: tpm-manager - hostname: tpm-manager - command: ["-port", "27780", "-batch-size", "100", "-interval", "30s"] - environment: - - OPAAL_URL=http://opaal:3333 - - HSM_URL=http://smd:27779 - - ANSIBLE_HOST_KEY_CHECKING=False - volumes: - - type: bind - source: /root/.ssh - target: /root/.ssh - depends_on: - opaal: - condition: service_healthy - smd: - condition: service_healthy - networks: - - internal - ### - # cloud-init server container, provides secured config access via JWT authorization - # NOTE: This merges with the default cloud-init config specified in openchami-svcs.yml - ### - cloud-init: - environment: - # This enables the server's secure route - - JWKS_URL=http://opaal:3333/keys diff --git a/quickstart-pcs/transition.sh b/quickstart-pcs/transition.sh deleted file mode 100644 index 95fabd9c..00000000 --- a/quickstart-pcs/transition.sh +++ /dev/null @@ -1,40 +0,0 @@ -transition() { - echo "${1}" | jq - - TRANSITION_OUTPUT="$(curl \ - -s \ - -d "${1}" \ - localhost:28007/transitions)" - - TRANSITION_ID="$(echo "${TRANSITION_OUTPUT}" | jq -r .transitionID)" - echo "${TRANSITION_OUTPUT}" | jq - echo "---- TRANSITION STATUS ----" - curl -s "localhost:28007/transitions/${TRANSITION_ID}" | jq -} - -print_operation_list() { - echo "on" - echo "off" - echo "soft-restart" - echo "hard-restart" - echo "init" - echo "force-off" - echo "soft-off" -} - -#1 xname -#2 operation -main() { - transition \ - "$(echo '{"operation": "${OPERATION}", "location": [{"xname": "${XNAME}"}]}' | - XNAME="${1}" OPERATION="${2}" envsubst)" -} - -if [ $# -eq 0 ]; then - echo "error: missing argument" - echo "example:" - echo "${0} x1000c0s0b1n0 force-off" - exit 1 -fi - -main "${@}" diff --git a/quickstart-pcs/vault.yml b/quickstart-pcs/vault.yml deleted file mode 100644 index c56479aa..00000000 --- a/quickstart-pcs/vault.yml +++ /dev/null @@ -1,16 +0,0 @@ -services: - vault: - hostname: vault - container_name: vault - image: docker.io/library/vault:1.5.5 - environment: - - VAULT_DEV_ROOT_TOKEN_ID=hms - - VAULT_DEV_LISTEN_ADDRESS=0.0.0.0:8200 - - VAULT_ADDR=http://vault:8200 - ports: - - "8200:8200" - cap_add: - - IPC_LOCK - networks: - - internal - - jwt-internal diff --git a/quickstart/DHCP.md b/quickstart/DHCP.md deleted file mode 100644 index ed954580..00000000 --- a/quickstart/DHCP.md +++ /dev/null @@ -1,238 +0,0 @@ -# Deploying CoreDHCP on a "Real" System - - - - -The quickstart rather hastily sets up CoreDHCP with assumed network parameters, -but it would be useful to know how to configure it for an actual system. This -document serves to walk through how to configure CoreDHCP with the -[coresmd](https://github.com/OpenCHAMI/coresmd) plugins. - -## Purpose - -SMD is meant to be the source of truth for nodes/BMCs in the cluster, so the -goal of CoreDHCP + coresmd is to match MAC addresses requesting an IP address to -interfaces stored in SMD and serve the matching IP address. However, for -unknown MAC addresses to become known to SMD, they need to be added, for -example, by network discovery tools like -[Magellan](https://github.com/OpenCHAMI/magellan). To be discoverable at the -network layer, coresmd provides functionality for providing unknown MAC -addresses with temporary IP addresses so they can be discovered. Once they are -discovered and added to SMD, they can get a more "permanent" IP address from -coresmd. - -## Methodology - -Coresmd differentiates between *known* MAC addresses (handled by the `coresmd` -plugin itself) and *unknown* MAC addresses (handled by the `bootloop` plugin or -by CoreDHCP's `file` plugin depending on if IP-MAC mapping is necessary). The -general flow for a device getting a long-term IP address from scratch is as -follows: - -1. Unknown MAC gets assigned an IP with a short lease. - - This can be an available IP from a pool (`bootloop` plugin) or a fixed IP - (`file` plugin). - - If left unknown, device will continually request a new IP and get a - short-lived one until the MAC becomes known. -1. MAC with short-leased IP gets added to SMD. - - This happens outside the scope of DHCP. - - How this happens can depend on the device type: - - **BMC:** Using Magellan. **NOTE:** Modern versions of Magellan add node - interfaces to SMD if discovered via Redfish. - - **Node:** POSTing to SMD using `curl` or the Ochami CLI tool. -1. Known MAC gets assigned the IP assigned to it in SMD once the short-leased IP - address expires, but with a longer lease time. - - This happens via the `coresmd` plugin itself. - -The first step in the above can be handled by either coresmd's `bootloop` plugin -or CoreDHCP's `file` plugin, or via a combination of both. The next two sections -describe the uses for these plugins and how they work while the section after -describes how the `coresmd` plugin itself works. - -### Unknown MAC Addresses: The `file` Plugin - -This plugin is used when it *does* matter which MAC address gets which IP -address. It is paired with CoreDHCP's `lease_time` directive to set how long the -temporary IPs should last. This plugin is maintained by CoreDHCP. - -The `file` plugin is pretty simple: it hands out the IP address assigned to the -MAC address sending the DHCPDISCOVER and renews this IP once it expires. - -### Unknown MAC Addresses: The `bootloop` Plugin - -This plugin is used when it does not matter which MAC address gets which IP -address. Often, this is as a catch-all for MAC addresses not in an assignment -list, e.g. MAC addresses not caught by the `file` plugin above. - -As stated, the `bootloop` plugin is designed to assign available IPs from a pool -to unknown MAC addresses without the guarantee that specific IP addresses get -assigned to certain MAC addresses. While this plugin works with any device that -speaks DHCP, important behavioral differences are present between devices that -are able to network boot (e.g. ethernet interfaces on a node) and devices that -are not able to network boot (e.g. BMCs). The difference is how requests to -renew IP addresses are handled. When devices that can boot try to renew their -IP address, they are served an iPXE script that reboots them so they are forced -to renew their IP address. When devices that cannot boot try to renew their IP -address, their request is responded to with a DHCPNAK, which, according to [RFC -2131](https://datatracker.ietf.org/doc/html/rfc2131#section-3.2), causes the -device to reinitiate the entire DHCP handshake. - -Technically, all DHCPDISCOVERs from MAC addresses that haven't been assigned an -IP address are responded to with a DHCPOFFER with the temporary IP address and -the rebooting iPXE script. Devices that can boot execute this iPXE script while -devices that cannot do not. So, when a non-booting device tries to renew this IP -address with a DHCPREQUEST, the response is a DHCPNAK so that it will send a -DHCPDISCOVER. - -### Known MAC Addresses: The `coresmd` Plugin - -This plugin is used to assign IP addresses based on data in SMD. - -A cache in memory is maintained containing SMD Component and EthernetInterface -data which is refreshed at a configured interval. This refreshment occurs via a -separate thread (goroutine). - -When a DHCP request reaches the plugin, it checks the cache if 1) the MAC -address exists as an EthernetInterface, 2) if there is an IP address for this -interface, and 3) if there is a corresponding Component for this interface. If -all three exist, the IP address corresponding to the EthernetInterface structure -is assigned to the device. This could be a node NIC or a BMC. - -## Preparation - -### (REQUIRED) TFTP - -Since CoreDHCP does not include a TFTP server or plugin (as far as is known at -this writing), one is required that contains the following files at the TFTP -root: - -- **ipxe.efi** --- UEFI iPXE bootloader for amd64 systems -- **undionly.kpxe** --- Legacy bootloader for x86-based systems -- **reboot.ipxe** --- The reboot iPXE script which contains: - ```ipxe - #!ipxe - reboot - ``` - -### (OPTIONAL) File for `file` Plugin - -If using the `file` plugin, you will need a plaintext file that contains the -MAC-to-IP mapping. For example: - -``` -de:ca:fc:0f:fe:ee 172.16.0.101 -de:ad:be:ee:ee:ef 172.16.0.102 -``` - -## Writing a Configuration File - -The configuration file is YAML-formatted. The general format is: - -```yaml -server4: - plugins: - - plugin1: arg1 arg2 - - plugin2: arg1 arg2 - ... -``` - -... where `plugin1` and `plugin2` are plugin names in the plugin list, each -followed by space-separated arguments. - -### Part 1: Server Configuration - -The first part of this file should be plugins that configure basic server -settings, such as the IP of the DHCP server and optional DNS servers. These -settings should be configured *before* the coresmd configuration, since CoreDHCP -sends DHCP packets to be processed sequentially, *in order*, through these -plugins. - -Let's look at an example server configuration: - -```yaml -server4: - plugins: - - server_id: 172.16.0.253 - - dns: 1.1.1.1,8.8.8.8 - - router: 172.16.0.254 - - netmask: 255.255.255.0 -``` - -- **server_id:** (*REQUIRED*) This is the "identity" of the DHCP server to - distinguish it from any other servers that might be listening on the same - network. Usually this is just the IP address the server is listening on. -- **dns:** (*OPTIONAL*) A comma-separated list of DNS servers to use for names - and domains. -- **router:** (*REQUIRED*) The IP address of the network gateway for routing - packets. This can be the same as the IP address CoreDHCP is listening on if - that machine acts as a gateway. -- **netmask:** (*OPTIONAL*) The network mask used with IP addresses served by - the `file` and `bootloop` plugins, if used. This is not needed if one is - *only* using the `coresmd` plugin. - -### Part 2: CoreSMD Configuration - -The next part of the configuration file corresponds to the place where any of -the coresmd/file/bootloop plugins are configured. These need to be *below* the -server config above. - -```yaml -server4: - plugins: - ... - - coresmd: https://foobar.openchami.cluster http://172.16.0.253:8081 /root_ca/root_ca.crt 30s 1h - - lease_time: 10m - - file: /etc/coredhcp/hostsfile - - bootloop: /tmp/coredhcp.db 5m 172.16.0.156 172.16.0.200 -``` - -- **coresmd:** (*REQUIRED*) Check if MAC address in request matches any - component in SMD. Pass request through if not. - - Arguments: - - **SMD Base URI:** (*https://foobar.openchami.cluster*) Base URI for where - SMD is listening (usually behind API proxy), usually with TLS enabled. - - **Boot Script Base URI:** (*http://172.16.0.253:8081*) Base URI for where - BSS is listening to fetch boot scripts from, usually *without* TLS. This is - a separate argument because chances are that the CA certificate is not baked - into the iPXE bootloader and thus cannot perform proper certificate - validation. - - **Path to CA Certifacate:** (*/root_ca/root_ca.crt*) Path to certificate - authority certificate for validation of connections to SMD. - - **Cache Update Interval:** (*30s*) Amount of time in between cache - refreshes.[^intervals] - - **Known Device Lease Duration:** (*1h*) Amount of time a *known* device's IP - is valid for.[^intervals] -- **lease_time:** (*OPTIONAL*) Assign lease time for *unknown* nodes. This is - *required* if using the `file` or `bootloop` plugins. - - Arguments: - - **Unknown Device Lease Duration:** (*10m*) Amount of time an *unknown* - device's IP is valid for.[^intervals] -- **file:** (*OPTIONAL*) Assign specific IP addresses to specific MAC addresses - based on mapping in file. Typically, this comes right after `coresmd` since - some MACs that are unknown to SMD need to be assigned a specific IP address. - If the MAC isn't in the list, it gets passed to the "catch-all" `bootloop` - plugin below. - - Arguments: - - **Map File Path:** (*/etc/coredhcp/hostsfile*) Path to text file that maps - MAC addresses to IP addresses. -- **bootloop:** (*OPTIONAL*) Assign available IP addresses from a pool to - unknown MAC addresses. This is normally the last plugin in the file because it - is usually used as a catch-all: the MAC was not known by SMD and was not - listed in the map file. - - Arguments: - - **Storage DB Path:** (*/tmp/coredhcp.db*) Path to sqlite3 file used for - storing IP addresses that have been assigned. This file need not exist and - will be created by the plugin upon initialization (assuming permissions are - correct!). - - **Pool Start IP:** (*172.16.0.156*) Starting IP address (inclusive) of the - pool of available IP addresses to hand out. - - **Pool End IP:** (*172.16.0.200*) Ending IP address (inclusive) of the pool - of available IP addresses to hand out. - -[^intervals]: Interval strings are parsed via Go's - [time.ParseDuration](https://pkg.go.dev/time#ParseDuration) function. Check - there for valid strings. diff --git a/quickstart/README.md b/quickstart/README.md deleted file mode 100644 index e7be8bff..00000000 --- a/quickstart/README.md +++ /dev/null @@ -1,156 +0,0 @@ -# OpenCHAMI Quickstart - -## Dependencies - -The OpenCHAMI services themselves are all containerized and tested running under `docker compose`. It should be possible to run OpenCHAMI services on any system with docker installed. - -This quickstart makes a few assumptions about the target operating system and is only tested on Rocky Linux 9.3 running on x86 processors. Feel free to file bugs about other configurations, but we will prioritize support for systems that we can directly test at LANL. - -### Assumptions - -* Linux - The quickstart automation makes several assumptions about the behavior Unix tools and their operation under bash from Rocky Linux 9.3 -* x86_64 - Some of the containers involved are built and tested for alternative operating systems and architectures, but the solution as a whole is only tested with x86 containers -* Dedicated System - The docker compose setup assumes that it can take control of several TCP ports and interact with the host network for DHCP and TFTP. It is tested on a dedicated virtual machine -* Local Name Registration - The quickstart bootstraps a Certificate Authority and issues an SSL certificate with a predictable name. For access, you will need to add that name/IP to /etc/hosts on all clients or make it resolvable through your site DNS -* DHCP Network Configuration: - * Server/Gateway IP Address: __192.168.0.254__ - * Range of IPs for Unknown MAC Addresses: __192.168.0.150__ to __192.168.0.253__ (inclusive) - * These IPs are given to MAC addresses unknown to SMD with a short least time. - * Network Mask: __255.255.255.0__ - * DNS Servers: __1.1.1.1, 8.8.8.8__ - * Duration to renew information from SMD: __30 seconds__ - * "Long" lease time: __1 hour__ - * This duration is used in leases for devices known by SMD. - * "Short" lease time: __5 minutes__ - * This duration is used in leases for devices unknown by SMD. - -## Start Here - -1. Clone the repository and switch to that directory - ```bash - git clone https://github.com/OpenCHAMI/deployment-recipes.git - cd deployment-recipes/quickstart/ - ``` -1. Create the secrets file and choose a name for your system. We use `foobar` in our example. - - __Note__ The certificates for the system use the name you provide in this file. It's not easy to change. - - __Note__ The full url will be https://foobar.openchami.cluster which you should set manually in /etc/hosts and point to the same ip address as `LOCAL_IP` in `.env`, which should be 192.168.0.254. - - ```bash - # Create the secrets in the .env file. Do not share them with anyone. - ./generate-configs.sh - ``` - If you have problems with this step, check to make sure that the main IP address of your host is in `.env` as `LOCAL_IP`. -1. Update your /etc/hosts to point `foobar.openchami.cluster` to 192.168.0.254 (this is important for valid certs). -1. Start the main services - ```bash - docker compose -f base.yml -f postgres.yml -f jwt-security.yml -f haproxy-api-gateway.yml -f openchami-svcs.yml -f autocert.yml -f coredhcp.yml -f configurator.yml up -d - ``` - __If this step produces an error like: `Error response from daemon: invalid IP address in add-host: ""` it means you're missing the LOCAL_IP in step 2.__ - You can fix it by destroying everything, editing `.env` manually and starting over. The command to destroy is the same as the command to create, just replace `up -d` with `down --volumes` -1. Use the running system to download your certs and create your access token(s) - ```bash - # Assuming you're using bash as your shell, you can use the included functions to simplify interactions with your new OpenCHAMI system. - source bash_functions.sh - # Download the root ca so you can validate the ssl certificates included with your system - get_ca_cert > cacert.pem - # Create a jwt access token for use with the apis. - ACCESS_TOKEN=$(gen_access_token) - # If you're curious about that token, you can safely copy and paste it into https://jwt.io to learn more. - # Use curl to confirm that everything is working - curl --cacert cacert.pem -H "Authorization: Bearer $ACCESS_TOKEN" https://foobar.openchami.cluster:8443/hsm/v2/State/Components - # This should respond with an empty set of Components: {"Components":[]} - ``` - - -## cloud-init Server Setup - -OpenCHAMI utilizes the cloud-init platform for post-boot configuration. -A custom cloud-init server container is included with this quickstart Docker Compose setup, but must be populated prior to use. - -The cloud-init server provides two API endpoints, described in the sections below. -Choose the appropriate option for your needs. - -### Unprotected Data - -#### Setup -The first endpoint, located at `/cloud-init/`, permits access to all stored data (and should therefore not contain configuration secrets). -Storing data into this endpoint is accomplished via HTTP POST requests containing JSON-formatted cloud-init configuration details. -For example: -```bash -curl --cacert cacert.pem 'https://foobar.openchami.cluster:8443/cloud-init/' \ - -X POST \ - -d '{"name": "IDENTIFIER", "cloud-init": { - "userdata": { - "write_files": [{"content": "hello world", "path": "/etc/hello"}] - }, - "metadata": {}, - "vendordata": {} - }}' -``` -`IDENTIFIER` can be: -- A node MAC address -- A node xname -- An SMD group name -It may be easiest to add nodes to a group for testing, and upload a cloud-init configuration for that group to this server. - -#### Usage -Data is retrieved via HTTP GET requests to the `meta-data`, `user-data`, and `vendor-data` endpoints. -For example, one could download all cloud-init data for a node/group via `curl --cacert cacert.pem 'https://foobar.openchami.cluster:8443/cloud-init/IDENTIFIER/{meta-data,user-data,vendor-data}'`. - -When retrieving data, `IDENTIFIER` can also be omitted entirely (e.g. `https://foobar.openchami.cluster/cloud-init/user-data`). -In this case, the cloud-init server will attempt to look up the relevant xname based on the request's source IP address. - -Thus, the intended use case is to set nodes' cloud-init datasource URLs to `https://foobar.openchami.cluster/cloud-init/`, from which the cloud-init client will load its configuration data. -Note that in this case, no `IDENTIFIER` is provided, so IP-based autodetection will be performed. - -### JWT-Protected Data - -#### Setup -The second endpoint, located at `/cloud-init-secure/`, restricts access to its cloud-init data behind a valid bearer token (i.e. a JWT). -Storing data into this endpoint requires a valid access token, which we assume is stored in `$ACCESS_TOKEN`. -The workflow described for unprotected data can be used, with the addition of the required authorization header, via e.g. `curl`'s `-H "Authorization: Bearer $ACCESS_TOKEN"`. - -#### Usage -In order to access this protected data, nodes must also supply valid JWTs. -These may be distributed to nodes at boot time by including [`tpm-manager.yml`](tpm-manager.yml) in the `docker compose` command provided above. -(It should be provided last, since it supplements service definitions from other files.) - -For nodes without hardware TPMs, the TPM manager will drop a JWT into `/var/run/cloud-init-jwt`. -The token can be retrieved and included with a request to the cloud-init server, using an invocation such as: -```bash -curl 'https://foobar.openchami.cluster:8443/cloud-init-secure/IDENTIFIER/{meta-data,user-data,vendor-data}' \ - --create-dirs --output '/PATH/TO/DATA-DIR/#1' \ - --header "Authorization: Bearer $(` allows you to check the logs of containers even after they have exited -`docker compose ... down --volumes` will not only bring down all the services, but also delete the volumes - -## Going even further diff --git a/quickstart/autocert.yml b/quickstart/autocert.yml deleted file mode 100644 index 9b91bdd8..00000000 --- a/quickstart/autocert.yml +++ /dev/null @@ -1,39 +0,0 @@ -volumes: - step-ca-db: - step-ca-home: - step-root-ca: - local-certs: - -networks: - cert-internal: - -services: - # step-ca is a local CA that can be used to issue certificates. - # It supports the ACME standard for automatic certificate issuance and rotation. - # See https://github.com/smallstep/certificates for more information. - # Our container is based on wolfi and an entrypoint from the step-ca repository. - step-ca: - container_name: step-ca - hostname: step-ca - image: ghcr.io/openchami/local-ca:v0.2.2 - #ports: - # - "9000:9000" - networks: - - cert-internal - volumes: - - step-ca-home:/home/step - # Keeping the database in a volume improves performance. I don't understand why. - - step-ca-db:/home/step/db - # Keeping the root CA in a volume allows us to back it up and restore it. - - step-root-ca:/root_ca/ - environment: - # To initialize your CA, modify these environment variables - - STEPPATH=/home/step - - DOCKER_STEPCA_INIT_NAME=OpenCHAMI - - DOCKER_STEPCA_INIT_DNS_NAMES=localhost,step-ca - - DOCKER_STEPCA_INIT_ACME=true - healthcheck: - test: ["CMD", "step", "ca", "health"] - interval: 10s - timeout: 10s - retries: 5 diff --git a/quickstart/base.yml b/quickstart/base.yml deleted file mode 100644 index cba408ee..00000000 --- a/quickstart/base.yml +++ /dev/null @@ -1,5 +0,0 @@ -networks: - internal: - jwt-internal: - external: - driver: bridge \ No newline at end of file diff --git a/quickstart/bash_functions.sh b/quickstart/bash_functions.sh deleted file mode 100644 index 4d63a164..00000000 --- a/quickstart/bash_functions.sh +++ /dev/null @@ -1,55 +0,0 @@ -# Several functions that have been useful to me in developing and testing the quickstart. -# They aren't necessary. Just educational. - -CURL_CONTAINER=cgr.dev/chainguard/curl -CURL_TAG=latest - -get_eth0_ipv4() { - local ipv4 - ipv4=$(ip -o -4 addr show eth0 | awk '{print $4}') - echo "${ipv4%/*}" -} - -get_ca_cert() { - local ca_cert - ${CONTAINER_CMD:-docker} exec step-ca step ca root - echo "${ca_cert}" -} - -container_curl() { - local url=$1 - ${CONTAINER_CMD:-docker} run --rm "${CURL_CONTAINER}:${CURL_TAG}" -s $url -} - -create_client_credentials() { - ${CONTAINER_CMD:-docker} exec hydra hydra create client \ - --endpoint http://hydra:4445/ \ - --format json \ - --grant-type client_credentials \ - --scope openid \ - --scope smd.read -} - -# CLIENT_CREDENTIALS=$(create_client_credentials) -# $(echo $CLIENT_CREDENTIALS | jq -r '"\(.client_id):\(.client_secret)"') - -retrieve_access_token() { - local CLIENT_ID=$1 - local CLIENT_SECRET=$2 - - ${CONTAINER_CMD:-docker} run --rm --network quickstart_jwt-internal "${CURL_CONTAINER}:${CURL_TAG}" -s -u "$CLIENT_ID:$CLIENT_SECRET" \ - -d grant_type=client_credentials \ - -d scope=openid+smd.read \ - http://hydra:4444/oauth2/token -} - -# ACCESS_TOKEN=$(retrieve_access_token $CLIENT_ID $CLIENT_SECRET | jq -r .access_token) - -gen_access_token() { - local CLIENT_CREDENTIALS - CLIENT_CREDENTIALS=$(create_client_credentials) - local CLIENT_ID=`echo $CLIENT_CREDENTIALS | jq -r '.client_id'` - local CLIENT_SECRET=`echo $CLIENT_CREDENTIALS | jq -r '.client_secret'` - local ACCESS_TOKEN=$(retrieve_access_token $CLIENT_ID $CLIENT_SECRET | jq -r .access_token) - echo $ACCESS_TOKEN -} diff --git a/quickstart/configs/.gitignore b/quickstart/configs/.gitignore deleted file mode 100644 index 00468f4c..00000000 --- a/quickstart/configs/.gitignore +++ /dev/null @@ -1,2 +0,0 @@ -opaal.yaml -coredhcp.yaml diff --git a/quickstart/configs/configurator.yaml b/quickstart/configs/configurator.yaml deleted file mode 100644 index 8c2044bd..00000000 --- a/quickstart/configs/configurator.yaml +++ /dev/null @@ -1,27 +0,0 @@ -# Server-related parameters when using as service -server: - host: 0.0.0.0:3334 - # Set the JWKS uri to protect /generate route - jwks: - uri: "" - retries: 5 -# SMD-related parameters -smd: - host: http://smd:27779 -# targets to call with --target flag with CLI or "target" query param -targets: - coredhcp: - templates: - - templates/coredhcp.jinja - syslog: - templates: - - templates/syslog.jinja - ansible: - templates: - - templates/ansible.jinja - powerman: - templates: - - templates/powerman.jinja - conman: - templates: - - templates/conman.jinja diff --git a/quickstart/configs/coredhcp-template.yaml b/quickstart/configs/coredhcp-template.yaml deleted file mode 100644 index 9801763a..00000000 --- a/quickstart/configs/coredhcp-template.yaml +++ /dev/null @@ -1,27 +0,0 @@ -server4: - plugins: - # - # Base CoreDHCP config - # - - - server_id: 192.168.0.254 - - dns: 1.1.1.1 8.8.8.8 - - router: 172.16.0.254 - - netmask: 255.255.255.0 - - # - # CoreSMD config - # - - # Args: ochami_base_url boot_script_base_url ca_cert_path cache_update_interval long_lease_time single_port_mode - - coresmd: http://192.168.0.254:8081 /root_ca/root_ca.crt 30s 1h true - - # Optionally include the file plugin here if it matters which IPs get assigned to which - # MACs. Otherwise, unknown MACs get passed to the bootloop "catch-all" plugin below. - # Note that lease_time is used to set the short lease time for the file plugin. - # - #- lease_time: 10m - #- file /etc/coredhcp/hostsfile - - # Args: storage_path boot_script_file short_lease_time ip_pool_start ip_pool_end - - bootloop: /tmp/coredhcp.db default 5m 192.168.0.150 192.168.0.253 diff --git a/quickstart/configs/haproxy.cfg b/quickstart/configs/haproxy.cfg deleted file mode 100644 index c46a8a25..00000000 --- a/quickstart/configs/haproxy.cfg +++ /dev/null @@ -1,72 +0,0 @@ -global - stats socket /var/run/api.sock user haproxy group haproxy mode 660 level admin expose-fd listeners - log stdout format raw local0 info - fd-hard-limit 50000 - ssl-default-bind-options ssl-min-ver TLSv1.3 no-tls-tickets - -defaults - mode http - timeout client 10s - timeout connect 5s - timeout server 10s - timeout http-request 10s - log global - -frontend stats - bind *:8404 - stats enable - stats uri / - stats refresh 10s - -frontend openchami - bind :80 - bind :443 ssl crt /etc/haproxy/certs/ strict-sni - option forwardfor - - acl PATH_smd path_beg -i /hsm/v2 - - acl PATH_bss path_beg -i /boot/v1 - acl PATH_bss path_beg -i /apis/bss/ - - acl PATH_opaal path_beg -i /token - acl PATH_opaal path_beg -i /login - acl PATH_opaal path_beg -i /oidc/callback - - acl PATH_opaal-idp path_beg -i /.well-known/openid-configuration - acl PATH_opaal-idp path_beg -i /.well-known/jwks.json - acl PATH_opaal-idp path_beg -i /browser/login - acl PATH_opaal-idp path_beg -i /api/login - acl PATH_opaal-idp path_beg -i /oauth2/authorize - acl PATH_opaal-idp path_beg -i /oauth2/token - - acl PATH_cloud-init path_beg -i /cloud-init - acl PATH_cloud-init path_beg -i /cloud-init-secure - - acl PATH_configurator path_beg -i /generate - acl PATH_configurator path_beg -i /configurator - - use_backend opaal if PATH_opaal - use_backend opaal-idp if PATH_opaal-idp - use_backend smd if PATH_smd - use_backend bss if PATH_bss - use_backend cloud-init if PATH_cloud-init - use_backend configurator if PATH_configurator - -backend opaal - server opaal opaal:3333 - -backend opaal-idp - server opaal-idp opaal-idp:3332 - -backend smd - server smd smd:27779 - -backend bss - server bss bss:27778 - http-request replace-path ^/apis/bss/(.*) /\1 - -backend cloud-init - server cloud-init-server cloud-init:27777 - -backend configurator - server configurator configurator:3334 diff --git a/quickstart/configs/hydra.yml b/quickstart/configs/hydra.yml deleted file mode 100644 index 4a3f29b6..00000000 --- a/quickstart/configs/hydra.yml +++ /dev/null @@ -1,20 +0,0 @@ -serve: - cookies: - same_site_mode: Lax - -oidc: - dynamic_client_registration: - enabled: true - subject_identifiers: - supported_types: - - public - -oauth2: - grant: - jwt: - jti_optional: true - iat_optional: true - max_ttl: 24h - -strategies: - access_token: jwt diff --git a/quickstart/configs/opaal-template.yaml b/quickstart/configs/opaal-template.yaml deleted file mode 100644 index 5787c884..00000000 --- a/quickstart/configs/opaal-template.yaml +++ /dev/null @@ -1,68 +0,0 @@ -version: "0.0.1" -server: - host: "opaal" - port: 3333 - callback: "/oidc/callback" - issuer: # Opaal-idp only uses this section of the config - host: "opaal-idp" - port: 3332 - endpoints: - authorization: "https://./oauth2/authorize" - clients: - - id: openchami - secret: openchami - name: openchami - redirect-uris: - - "https://./oidc/callback" - -authentication: - state: "" - test-all: false - clients: - - id: "openchami" - secret: "openchami" - name: "openchami" - provider: - issuer: "http://opaal-idp:3332" - redirect-uris: - - "https://./oidc/callback" - - id: "" - secret: "" - name: "gitlab" - provider: - issuer: "" - scope: - - "openid" - - "profile" - - "email" - redirect-uris: - - "https://./oidc/callback" - -authorization: - token: - forwarding: false - refresh: false - duration: 16h - scope: - - smd.read - audience: - - https://./oauth2/token - key-path: ./keys - endpoints: - issuer: http://hydra:4444 - config: http://hydra:4444/.well-known/openid-configuration - jwks: http://hydra:4444/.well-known/jwks.json - trusted-issuers: http://hydra:4445/admin/trust/grants/jwt-bearer/issuers - login: http://hydra:4433/self-service/login/api - clients: http://hydra:4445/admin/clients - authorize: http://hydra:4444/oauth2/auth - register: http://hydra:4444/oauth2/register - token: http://hydra:4444/oauth2/token - - -options: - run-once: true - open-browser: false - flow: authorization_code - cache-only: false - verbose: true diff --git a/quickstart/configurator.yml b/quickstart/configurator.yml deleted file mode 100644 index daacc1de..00000000 --- a/quickstart/configurator.yml +++ /dev/null @@ -1,25 +0,0 @@ -services: - configurator: - image: ghcr.io/openchami/configurator:latest - container_name: configurator - hostname: configurator - command: - - '/configurator/configurator' - - 'serve' - - '--config' - - '/configurator/config.yaml' - - '--verbose' - volumes: - - ./configs/configurator.yaml:/configurator/config.yaml - networks: - - internal - ports: - - 3334:3334 - depends_on: - smd: - condition: service_healthy - healthcheck: - test: ["CMD", "curl", "--fail", "--silent", "http://localhost:3334/configurator/status"] - interval: 5s - timeout: 10s - retries: 60 diff --git a/quickstart/coredhcp.yml b/quickstart/coredhcp.yml deleted file mode 100644 index 0c5a4164..00000000 --- a/quickstart/coredhcp.yml +++ /dev/null @@ -1,23 +0,0 @@ -services: - coredhcp: - image: ghcr.io/openchami/coredhcp:v0.3.1 - container_name: coredhcp - hostname: coredhcp - network_mode: host - cap_add: - - NET_ADMIN - volumes: - - ./configs/coredhcp.yaml:/etc/coredhcp/config.yaml:ro - - step-root-ca:/root_ca/:ro - command: - - "/coredhcp" - - "-L" - - "debug" - healthcheck: - test: "dhcping -c {{cluster_boot_ip}} -s {{cluster_boot_ip}} -h 00:00:00:00:00:00" - interval: 5s - timeout: 10s - retries: 60 - depends_on: - smd: - condition: service_healthy diff --git a/quickstart/generate-configs.sh b/quickstart/generate-configs.sh deleted file mode 100755 index 367ad865..00000000 --- a/quickstart/generate-configs.sh +++ /dev/null @@ -1,114 +0,0 @@ -#!/bin/bash -l - -set -euo pipefail - -usage() { - echo "Usage: [options] $0" - echo "" - echo "Generate configuration for OpenCHAMI quickstart using example" - echo "parameters." - echo "" - echo "OPTIONS:" - echo " -h Print this usage message to stdout." - echo " -f Force overwriting config files." -} - -while getopts "fh" opt; do - case "${opt}" in - f) - FORCE_OVERWRITE=true - ;; - h) - usage - exit - ;; - *) - usage >&2 - exit - ;; - esac -done -shift $((OPTIND-1)) - -if [ -f .env ] && [ -z "${FORCE_OVERWRITE+x}" ] -then - echo "A config file (.env) exists. Delete to generate a new one or -f to overwrite." - file_exists=true -fi - -if [ -f configs/opaal.yaml ] && [ -z "${FORCE_OVERWRITE+x}" ] -then - echo "An OPAAL config (configs/opaal.yaml) exists. Delete to generate a new one or -f to overwrite." - file_exists=true -fi - -if [ -f configs/coredhcp.yaml ] && [ -z "${FORCE_OVERWRITE+x}" ] -then - echo "A CoreDHCP config (configs/coredhcp.yaml) exists. Delete to generate a new one or -f to overwrite." - file_exists=true -fi - -if [ -n "${file_exists+x}" ]; then exit 1; fi - -SYSNAME=foobar -SYSDOMAIN="openchami.cluster" - -# Check for required commands -if [[ ! -x $(command -v jq) ]] -then - echo "Command \"jq\" not found" - exit 1 -fi -if [[ ! -x $(command -v sed) ]] -then - echo "Command \"sed\" not found" - exit 1 -fi -if [[ ! -x $(command -v openssl) ]] -then - echo "Command \"openssl\" not found" - exit 1 -fi - -generate_random_alphanumeric() { - local num_chars=${1:-32} - openssl rand -base64 "${num_chars}" | openssl dgst | cut -d' ' -f2 | fold -w "${num_chars}" | head -n 1 -} - -# Generate OPAAL config from configs/opaal-template.yaml. This will populate the -# system name and domain of the config with the values set for SYSTEM_NAME and -# SYSTEM_DOMAIN in this script. -# TODO: Populate GitLab information in OPAAL config. -sed \ - -e "s//${SYSNAME}/g" \ - -e "s//${SYSDOMAIN}/g" \ -configs/opaal-template.yaml > configs/opaal.yaml - -# Generate CoreDHCP configuration from configs/coredhcp-template.yaml. -sed \ - -e "s||https://${SYSNAME}.${SYSDOMAIN}:8443|g" \ - configs/coredhcp-template.yaml > configs/coredhcp.yaml - -# Set the system name -cat > .env </dev/tcp/haproxy/8404; echo -e \"GET / HTTP/1.1\\nConnection: close\\n\" >&3; cat <&3 | grep \"200 OK\"'"] - interval: 10s - timeout: 10s - retries: 5 - depends_on: - opaal-idp: - condition: service_healthy - opaal: - condition: service_healthy - smd: - condition: service_healthy - bss: - condition: service_healthy - volumes: - - ./configs/:/usr/local/etc/haproxy/:ro - - haproxy-certs:/etc/haproxy/certs/:ro - acme-register: - container_name: ${SYSTEM_NAME}.${SYSTEM_DOMAIN} - image: ghcr.io/openchami/acme.sh:v0.2.2 - networks: - - cert-internal - depends_on: - step-ca: - condition: service_healthy - volumes: - - step-root-ca:/root_ca/:ro - - acme-certs:/root/.acme.sh - entrypoint: ["/usr/bin/acme.sh", "--server", "https://step-ca:9000/acme/acme/directory", "--ca-bundle", "/root_ca/root_ca.crt", "-d", "${SYSTEM_NAME}.${SYSTEM_DOMAIN}", "--issue", "--standalone", "--force"] - acme-deploy: - container_name: acme-deploy - image: ghcr.io/openchami/acme.sh:v0.2.2 - networks: - - cert-internal - depends_on: - acme-register: - condition: service_completed_successfully - volumes: - - /:/root_ca/:ro - - acme-certs:/root/.acme.sh - - haproxy-certs:/root/certs/ - environment: - - DEPLOY_HAPROXY_PEM_PATH=/root/certs/ - entrypoint: ["/usr/bin/acme.sh", "--server", "https://step-ca:9000/acme/acme/directory", "--ca-bundle", "/root_ca/root_ca.crt", "--deploy", "--deploy-hook", "haproxy", "--domain", "${SYSTEM_NAME}.${SYSTEM_DOMAIN}"] diff --git a/quickstart/jwt-security.yml b/quickstart/jwt-security.yml deleted file mode 100644 index c7e1ad44..00000000 --- a/quickstart/jwt-security.yml +++ /dev/null @@ -1,91 +0,0 @@ -services: - opaal-idp: - image: ghcr.io/openchami/opaal:v0.3.8 - container_name: opaal-idp - hostname: opaal-idp - command: - - '/opaal/opaal' - - 'serve' - - '--config' - - '/opaal/config/opaal.yaml' - volumes: - - ./configs:/opaal/config/ - networks: - - jwt-internal - #ports: - # - 3332:3332 - healthcheck: - test: ["CMD", "curl", "--fail", "--silent", "http://opaal-idp:3332/.well-known/jwks.json"] - interval: 5s - timeout: 10s - retries: 60 - opaal: - image: ghcr.io/openchami/opaal:v0.3.8 - container_name: opaal - hostname: opaal - command: - - '/opaal/opaal' - - 'login' - - '--config' - - '/opaal/config/opaal.yaml' - volumes: - - ./configs:/opaal/config/ - networks: - - internal - - jwt-internal - extra_hosts: - - "${SYSTEM_NAME}.${SYSTEM_DOMAIN}:${LOCAL_IP}" - - healthcheck: - test: ["CMD", "curl", "--fail", "--silent", "http://opaal:3333/keys"] - interval: 5s - timeout: 10s - retries: 60 - depends_on: - hydra: - condition: service_healthy - opaal-idp: - condition: service_healthy - hydra: - image: docker.io/oryd/hydra:v2.2.0-rc.3 - container_name: hydra - hostname: hydra - healthcheck: - test: ["CMD", "wget", "--spider", "-q", "http://hydra:4444/health/alive"] - interval: 10s - timeout: 10s - retries: 10 - #ports: - # - "4444:4444" # Public port - # - "4445:4445" # Admin port - # - "5555:5555" # Port for hydra token user - command: serve -c /etc/config/hydra/hydra.yml all --sqa-opt-out - volumes: - - ./configs/:/etc/config/hydra - environment: - - SECRETS_SYSTEM=${HYDRA_SYSTEM_SECRET} # set in .env - - URLS_SELF_ISSUER=https://${SYSTEM_NAME}.${SYSTEM_DOMAIN}/ - - URLS_SELF_PUBLIC=https://${SYSTEM_NAME}.${SYSTEM_DOMAIN}/ - - URLS_LOGIN=https://${SYSTEM_NAME}.${SYSTEM_DOMAIN}/login - - URLS_CONSENT=https://${SYSTEM_NAME}.${SYSTEM_DOMAIN}/consent - - URLS_LOGOUT=https://${SYSTEM_NAME}.${SYSTEM_DOMAIN}/logout - - DSN=postgres://hydra-user:${HYDRA_POSTGRES_PASSWORD}@postgres:5432/hydradb?sslmode=disable&max_conns=20&max_idle_conns=4 - restart: unless-stopped - depends_on: - hydra-migrate: - condition: service_completed_successfully - networks: - - jwt-internal - hydra-migrate: - image: docker.io/oryd/hydra:v2.2.0-rc.3 - container_name: hydra-migrate - hostname: hydra-migrate - environment: - - SECRETS_SYSTEM=${HYDRA_SYSTEM_SECRET} # set in .env - - DSN=postgres://hydra-user:${HYDRA_POSTGRES_PASSWORD}@postgres:5432/hydradb?sslmode=disable&max_conns=20&max_idle_conns=4 - command: migrate -c /etc/config/hydra/hydra.yml sql -e --yes - volumes: - - ./configs/:/etc/config/hydra - restart: on-failure - networks: - - internal diff --git a/quickstart/openchami-svcs.yml b/quickstart/openchami-svcs.yml deleted file mode 100644 index 53649eca..00000000 --- a/quickstart/openchami-svcs.yml +++ /dev/null @@ -1,140 +0,0 @@ -services: -### -# SMD Init and Server Containers -### - # sets up postgres for SMD data - smd-init: - image: ghcr.io/openchami/smd:v2.17.7 - container_name: smd-init - hostname: smd-init - environment: - - SMD_DBHOST=postgres - - SMD_DBPORT=5432 - - SMD_DBNAME=hmsds - - SMD_DBUSER=smd-user - - SMD_DBPASS=${SMD_POSTGRES_PASSWORD} # Set in .env file - - SMD_DBOPTS=sslmode=disable - depends_on: - postgres: - condition: service_healthy - networks: - - internal - entrypoint: - - /smd-init - # SMD - smd: - image: ghcr.io/openchami/smd:v2.17.7 - container_name: smd - hostname: smd - environment: - - SMD_DBHOST=postgres - - SMD_DBPORT=5432 - - SMD_DBNAME=hmsds - - SMD_DBUSER=smd-user - - SMD_DBPASS=${SMD_POSTGRES_PASSWORD} # Set in .env file - - SMD_DBOPTS=sslmode=disable - - SMD_JWKS_URL=http://opaal:3333/keys - depends_on: - postgres: - condition: service_healthy - smd-init: - condition: service_completed_successfully - opaal: - condition: service_healthy - #ports: - # - "27779:27779" - healthcheck: - test: ["CMD", "curl", "--fail", "--silent", "http://localhost:27779/hsm/v2/service/ready"] - interval: 5s - retries: 60 - start_period: 20s - timeout: 10s - networks: - - internal -### -# BSS Init and Server Containers -### -# sets up postgres for BSS data - bss-init: - image: ghcr.io/openchami/bss:v1.32.0 - container_name: bss-init - hostname: bss-init - environment: - - BSS_USESQL=true - - BSS_INSECURE=true - - BSS_DBHOST=postgres - - BSS_DBPORT=5432 - - BSS_DBNAME=bssdb - - BSS_DBUSER=bss-user - - BSS_DBPASS=${BSS_POSTGRES_PASSWORD} # Set in .env file - depends_on: - postgres: - condition: service_healthy - networks: - - internal - entrypoint: - - /usr/local/bin/bss-init - # boot-script-service - bss: - image: ghcr.io/openchami/bss:v1.32.0 - container_name: bss - hostname: bss - environment: - - BSS_USESQL=true - - BSS_INSECURE=true - - BSS_DEBUG=true - - BSS_DBHOST=postgres - - BSS_DBPORT=5432 - - BSS_DBNAME=bssdb - - BSS_DBUSER=bss-user - - BSS_DBPASS=${BSS_POSTGRES_PASSWORD} # Set in .env file - - BSS_JWKS_URL=http://opaal:3333/keys - - BSS_OAUTH2_ADMIN_BASE_URL=http://opaal:3333 - - BSS_OAUTH2_PUBLIC_BASE_URL=http://opaal:3333 - - BSS_IPXE_SERVER=${SYSTEM_NAME}.${SYSTEM_DOMAIN} - - BSS_CHAIN_PROTO=https - - BSS_BOOTSCRIPT_NOTIFY_URL=http://tpm-manager:27780/Node - #ports: - # - '27778:27778' - depends_on: - postgres: - condition: service_healthy - smd: - condition: service_healthy - bss-init: - condition: service_completed_successfully - opaal: - condition: service_healthy - networks: - - internal - healthcheck: - test: ["CMD", "curl", "--fail", "--silent", "http://localhost:27778/boot/v1/service/status"] - interval: 5s - timeout: 10s - retries: 60 -### -# cloud-init Server Container -### - # cloud-init server, with the secure route disabled for now - cloud-init: - image: ghcr.io/openchami/cloud-init:v1.2.3 - container_name: cloud-init - hostname: cloud-init - environment: - - LISTEN_ADDR=:27777 - - SMD_URL=http://smd:27779 - - OPAAL_URL=http://opaal:3333 - ports: - - '27777:27777' - depends_on: - smd: - condition: service_healthy - opaal: - condition: service_healthy - networks: - - internal - healthcheck: - test: ["CMD", "curl", "http://127.0.0.1:27777/cloud-init/version"] - interval: 5s - timeout: 10s - retries: 60 diff --git a/quickstart/pg-init/multi-psql-db.sh b/quickstart/pg-init/multi-psql-db.sh deleted file mode 100755 index 5474b9e0..00000000 --- a/quickstart/pg-init/multi-psql-db.sh +++ /dev/null @@ -1,31 +0,0 @@ -#!/bin/bash -# -# Adapted from: -# https://github.com/mrts/docker-postgresql-multiple-databases/blob/master/create-multiple-postgresql-databases.sh - -set -e -set -u - -function create_user_and_database() { - local database=$1 - local username=$2 - local password="'$3'" - echo " Creating user '$username' and database '$database'" - psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" <<-EOSQL - CREATE USER "$username" WITH PASSWORD $password; - CREATE DATABASE "$database"; - GRANT ALL PRIVILEGES ON DATABASE "$database" TO "$username"; -EOSQL -} - -if [ -n "$POSTGRES_MULTIPLE_DATABASES" ]; then - echo "Multiple database creation requested: $POSTGRES_MULTIPLE_DATABASES" - for dbstr in $(echo $POSTGRES_MULTIPLE_DATABASES | tr ',' ' '); do - dbname=$(echo $dbstr | cut -d: -f1) - username=$(echo $dbstr | cut -d: -f2) - password=$(echo $dbstr | cut -d: -f3) - echo "Creating: db=$dbname user=$username" - create_user_and_database $dbname $username $password - done - echo "Multiple databases created" -fi diff --git a/quickstart/postgres.yml b/quickstart/postgres.yml deleted file mode 100644 index 810230d5..00000000 --- a/quickstart/postgres.yml +++ /dev/null @@ -1,25 +0,0 @@ -volumes: - postgres-data: - -services: - postgres: # Postgres - image: docker.io/postgres:11.5-alpine - container_name: postgres - restart: always - environment: - POSTGRES_USER: ${POSTGRES_USER} - POSTGRES_PASSWORD: ${POSTGRES_PASSWORD} # Set in .env file for now. - POSTGRES_MULTIPLE_DATABASES: hmsds:smd-user:${SMD_POSTGRES_PASSWORD},bssdb:bss-user:${BSS_POSTGRES_PASSWORD},hydradb:hydra-user:${HYDRA_POSTGRES_PASSWORD} - volumes: - - postgres-data:/var/lib/postgresql/data - - ./pg-init:/docker-entrypoint-initdb.d - networks: - - internal - - jwt-internal - #ports: - # - 5432:5432 - healthcheck: - test: ["CMD", "pg_isready", "--username", "${POSTGRES_USER}"] - interval: 10s - timeout: 10s - retries: 5 diff --git a/quickstart/tpm-manager.yml b/quickstart/tpm-manager.yml deleted file mode 100644 index 76889879..00000000 --- a/quickstart/tpm-manager.yml +++ /dev/null @@ -1,32 +0,0 @@ -services: - ### - # TPM-manager container, pushes cloud-init tokens into nodes' TPM storage - ### - tpm-manager: - image: ghcr.io/openchami/tpm-manager:v0.2.2 - container_name: tpm-manager - hostname: tpm-manager - command: ["-port", "27780", "-batch-size", "100", "-interval", "30s"] - environment: - - OPAAL_URL=http://opaal:3333 - - HSM_URL=http://smd:27779 - - ANSIBLE_HOST_KEY_CHECKING=False - volumes: - - type: bind - source: /root/.ssh - target: /root/.ssh - depends_on: - opaal: - condition: service_healthy - smd: - condition: service_healthy - networks: - - internal - ### - # cloud-init server container, provides secured config access via JWT authorization - # NOTE: This merges with the default cloud-init config specified in openchami-svcs.yml - ### - cloud-init: - environment: - # This enables the server's secure route - - JWKS_URL=http://opaal:3333/keys