Update backup ignorelist

Reviewed-on: #653
Reviewed-by: Greg <greg@kosmos.org>

clients/redis-3.json

@@ -0,0 +1,4 @@
+{
+  "name": "redis-3",
+  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoRDTlMy6e+GXmen1nvQL\nTlbfXosRk1qTiqXYKtH0fmXz6i0OchBeNj4xZP+UvkrKcsifoumScGhSslQo1lzU\nASAJe5/lG1govkK27UFXwnYPZGRaB13CXJSDe5nbhga21HdDBbZOYttYa8/xQIes\nkbUGUu6uzJKXux5tiOD1ZhQTVIgnXx0ELjeRvRR4NOqEaXW+PPht6pK9MFFoN3tf\nnG/vt19QBM6Eox+UuKqSYloBseu8HRbves7jN4g/ml4qdjftgXft9H6OGCPmv+rA\nyRezzcVN7L092y3Ti+d6RftOBnIl8ABlURChnEFvUFxNRtT/0Zo7321w2TaDBfGa\n2wIDAQAB\n-----END PUBLIC KEY-----\n"
+}

clients/redis-4.json

@@ -0,0 +1,4 @@
+{
+  "name": "redis-4",
+  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAn3Zdzfao+n3PdtlJlViJ\nnpVDcL8ofw2rb2/VK7ivpWMKaL7mOq8HIQ+R+ghvllX/vPmN6co3+aUxOvvQ6KGC\nmAcnc7StqOpYUK0g6QZFROESO0vz1hy078AL9D2dEwOj7XS8leWCQyGgA1Z89T9n\naatXqEF1zGuvnVLA340prYkJk5S1X6KHq1WIi9H23hYehvGZlpkJ87wv8sKIo4Y3\nzIVA5hio0t0q+JyStOGr+xRl3mM43b25XcIh2ibrzKp3YoRWSCvMfhAdMKm1WEEI\njM/3fQRtkI1OQSb0o/wUoAmpUEEOTIvbWU2SuFVY7HYRuPwEilvbrGZKgrvbp8R+\nZQIDAQAB\n-----END PUBLIC KEY-----\n"
+}

data_bags/users/kare.json

@@ -1,7 +1,7 @@
 {
   "id": "kare",
   "ssh_keys": [
-    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCw0I82gT8R4tpsqWGovLyjm2SR2F863MqNz224h3h/wl0xA5Eu0eRro+ELLv2hoebqQbcMsb89X5+7ObhDRar+b7tzDlXq4x+ECkAy6WbDSmBp3kNVd7muT4c9Zw7UxKsIvIm1ven1TkJ3UG80o6PyGiAUlBj4puIQwhp7OVknVutBBe8Rpp4f6BEuWluwpnPxc3KSaGhhr9p10xeX69cfspH40r8vHpI0zp19O5GpfYSOEH64UbwRpN2QypNB8ISmDHFsNGwdz0Ba4qrEOSGU9GveyOcsvEtt630/0fHqtbPBovOYu/FJISQZya2tofDig4EngBCJNfsPCbXFHtlp greg@karekinian.com"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE0mZjhqMeoA//SFg8i8XvXIaiUwXXjoCiBTloe7HPQH greg+2026@kosmos.org"
   ],
   "groups": ["sysadmin", "systemd-journal"],
   "shell": "\/bin\/bash"

environments/production.json

@@ -81,7 +81,7 @@
           "garage-",
           "lq-",
           "rsk-",
-          "postgres-6"
+          "postgres-11"
         ]
       }
     },

scripts/knife/converge_all.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+#
+# Converge every node in nodes/ with a runlist override (-o).
+#
+# Usage:
+#   ./converge_all.sh "recipe[kosmos-base::users]"
+#
+# Port selection per node:
+#   - nodes WITH a normal.vm_host attribute (KVM guests):  port 22
+#   - nodes WITHOUT a normal.vm_host attribute (bare metal): port 2222
+#
+# Runs sequentially and aborts on the first failure (set -euo pipefail).
+
+set -euo pipefail
+
+if [[ $# -ne 1 ]]; then
+  echo "Usage: $0 '<runlist override>'" >&2
+  echo "  e.g. $0 \"recipe[kosmos-base::users]\"" >&2
+  exit 1
+fi
+
+RUNLIST="$1"
+
+shopt -s nullglob
+nodes=( nodes/*.json )
+
+if [[ ${#nodes[@]} -eq 0 ]]; then
+  echo "No nodes found in nodes/" >&2
+  exit 1
+fi
+
+total=${#nodes[@]}
+i=0
+
+for f in "${nodes[@]}"; do
+  i=$((i + 1))
+
+  IFS=$'\x1f' read -r node_name vm_host knife_host < <(python3 -c '
+import json, sys
+d = json.load(open(sys.argv[1]))
+print("\x1f".join([
+    d.get("name", "") or "",
+    d.get("normal", {}).get("vm_host", "") or "",
+    d.get("normal", {}).get("knife_zero", {}).get("host", "") or "",
+]))
+' "$f")
+
+  if [[ -z "$node_name" ]]; then
+    echo "[$i/$total] $f: could not read node name, skipping" >&2
+    exit 1
+  fi
+
+  if [[ -z "$knife_host" ]]; then
+    echo "[$i/$total] $node_name: no knife_zero.host set, skipping" >&2
+    exit 1
+  fi
+
+  if [[ -n "$vm_host" ]]; then
+    port=22
+    label="vm_host=${vm_host}"
+  else
+    port=2222
+    label="bare metal"
+  fi
+
+  echo "[$i/$total] $node_name ($label, port ${port}, host ${knife_host})"
+  knife zero converge "name:${node_name}" -a knife_zero.host -p"${port}" -o "${RUNLIST}"
+done
+
+echo "Converged ${total} node(s) successfully."

site-cookbooks/kosmos-base/recipes/default.rb

@@ -60,25 +60,7 @@ package "vim"
 # Don't create users and rewrite the sudo config in development environment.
 # It breaks the vagrant user
 unless node.chef_environment == "development"
-  # Searches data bag "users" for groups attribute "sysadmin".
+  include_recipe "kosmos-base::users"
-  # Places returned users in Unix group "sysadmin" with GID 2300.
-  users_manage "sysadmin" do
-    group_id 2300
-    action %i[remove create]
-  end
-
-  sudo "sysadmin" do
-    groups "sysadmin"
-    nopasswd true
-    defaults [
-      # not default on Ubuntu, explicitely enable. Uses a minimal white list of
-      # environment variables
-      "env_reset",
-      # Send emails on unauthorized attempts
-      "mail_badpass",
-      'secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"'
-    ]
-  end
 
   include_recipe "kosmos-base::firewall"
 

site-cookbooks/kosmos-base/recipes/users.rb

@@ -0,0 +1,24 @@
+#
+# Cookbook Name:: kosmos-base
+# Recipe:: default
+#
+
+# Searches data bag "users" for groups attribute "sysadmin".
+# Places returned users in Unix group "sysadmin" with GID 2300.
+users_manage "sysadmin" do
+  group_id 2300
+  action %i[remove create]
+end
+
+sudo "sysadmin" do
+  groups "sysadmin"
+  nopasswd true
+  defaults [
+    # not default on Ubuntu, explicitely enable. Uses a minimal white list of
+    # environment variables
+    "env_reset",
+    # Send emails on unauthorized attempts
+    "mail_badpass",
+    'secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"'
+  ]
+end

site-cookbooks/kosmos_kvm/recipes/host.rb

@@ -5,6 +5,11 @@
 
 package %w(virtinst libvirt-daemon-system libvirt-clients)
 
+# Required on legacy hosts (Ubuntu 20.04) to build the NoCloud seed ISO
+# via cloud-localds. Modern virt-install (>= 4.0.0, Ubuntu >= 22.04)
+# handles cloud-init natively via --cloud-init and does not need it.
+package "cloud-image-utils" if node["platform_version"].to_f < 22.04
+
 directory "/var/lib/libvirt/images/base" do
   recursive true
   owner "libvirt-qemu"
@@ -24,7 +29,10 @@ end
 template "/usr/local/sbin/create_vm" do
   source "create_vm.erb"
   mode "0750"
-  variables base_image_path: node["kosmos_kvm"]["host"]["qemu_base_image"]["path"]
+  variables(
+    base_image_path: node["kosmos_kvm"]["host"]["qemu_base_image"]["path"],
+    modern_virt_install: node["platform_version"].to_f >= 22.04
+  )
 end
 
 firewall_rule 'ssh-alt-port' do

site-cookbooks/kosmos_kvm/templates/create_vm.erb

@@ -64,6 +64,7 @@ EOS
   popd
 fi
 
+<% if @modern_virt_install -%>
 virt-install \
   --name "$VMNAME" \
   --ram "$RAM" \
@@ -83,3 +84,30 @@ virt-install \
   --autostart \
   --import \
   --cloud-init root-password-generate=off,disable=on,meta-data=$CIDATA_PATH/meta-data,user-data=$CIDATA_PATH/user-data
+<% else -%>
+# Legacy path for hosts running virt-install < 4.0.0 (e.g. Ubuntu 20.04,
+# virt-install 2.2.x). These versions predate the --osinfo/--cloud-init
+# options, so we build a NoCloud seed ISO from the same user-data and
+# meta-data files and attach it as a cdrom. The guest receives the
+# exact same cloud-init configuration as on modern hosts.
+cloud-localds "$CIDATA_PATH/seed.iso" "$CIDATA_PATH/user-data" "$CIDATA_PATH/meta-data"
+
+virt-install \
+  --name "$VMNAME" \
+  --ram "$RAM" \
+  --vcpus "$CPUS" \
+  --cpu host \
+  --arch x86_64 \
+  --hvm \
+  --virt-type kvm \
+  --disk "$IMAGE_PATH" \
+  --disk "$CIDATA_PATH/seed.iso,device=cdrom" \
+  --boot hd \
+  --network=bridge=virbr0,model=virtio \
+  --graphics none \
+  --serial pty \
+  --console pty \
+  --channel unix,mode=bind,path=/var/lib/libvirt/qemu/$VMNAME.guest_agent.0,target_type=virtio,name=org.qemu.guest_agent.0 \
+  --autostart \
+  --import
+<% end -%>