Merge pull request 'Split user creation into separate base recipe; add script for mass-converging nodes' (#652) from chore/split_users_recipe into master

Reviewed-on: #652

scripts/knife/converge_all.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+#
+# Converge every node in nodes/ with a runlist override (-o).
+#
+# Usage:
+#   ./converge_all.sh "recipe[kosmos-base::users]"
+#
+# Port selection per node:
+#   - nodes WITH a normal.vm_host attribute (KVM guests):  port 22
+#   - nodes WITHOUT a normal.vm_host attribute (bare metal): port 2222
+#
+# Runs sequentially and aborts on the first failure (set -euo pipefail).
+
+set -euo pipefail
+
+if [[ $# -ne 1 ]]; then
+  echo "Usage: $0 '<runlist override>'" >&2
+  echo "  e.g. $0 \"recipe[kosmos-base::users]\"" >&2
+  exit 1
+fi
+
+RUNLIST="$1"
+
+shopt -s nullglob
+nodes=( nodes/*.json )
+
+if [[ ${#nodes[@]} -eq 0 ]]; then
+  echo "No nodes found in nodes/" >&2
+  exit 1
+fi
+
+total=${#nodes[@]}
+i=0
+
+for f in "${nodes[@]}"; do
+  i=$((i + 1))
+
+  IFS=$'\x1f' read -r node_name vm_host knife_host < <(python3 -c '
+import json, sys
+d = json.load(open(sys.argv[1]))
+print("\x1f".join([
+    d.get("name", "") or "",
+    d.get("normal", {}).get("vm_host", "") or "",
+    d.get("normal", {}).get("knife_zero", {}).get("host", "") or "",
+]))
+' "$f")
+
+  if [[ -z "$node_name" ]]; then
+    echo "[$i/$total] $f: could not read node name, skipping" >&2
+    exit 1
+  fi
+
+  if [[ -z "$knife_host" ]]; then
+    echo "[$i/$total] $node_name: no knife_zero.host set, skipping" >&2
+    exit 1
+  fi
+
+  if [[ -n "$vm_host" ]]; then
+    port=22
+    label="vm_host=${vm_host}"
+  else
+    port=2222
+    label="bare metal"
+  fi
+
+  echo "[$i/$total] $node_name ($label, port ${port}, host ${knife_host})"
+  knife zero converge "name:${node_name}" -a knife_zero.host -p"${port}" -o "${RUNLIST}"
+done
+
+echo "Converged ${total} node(s) successfully."

site-cookbooks/kosmos-base/recipes/default.rb

@@ -60,25 +60,7 @@ package "vim"
 # Don't create users and rewrite the sudo config in development environment.
 # It breaks the vagrant user
 unless node.chef_environment == "development"
-  # Searches data bag "users" for groups attribute "sysadmin".
+  include_recipe "kosmos-base::users"
-  # Places returned users in Unix group "sysadmin" with GID 2300.
-  users_manage "sysadmin" do
-    group_id 2300
-    action %i[remove create]
-  end
-
-  sudo "sysadmin" do
-    groups "sysadmin"
-    nopasswd true
-    defaults [
-      # not default on Ubuntu, explicitely enable. Uses a minimal white list of
-      # environment variables
-      "env_reset",
-      # Send emails on unauthorized attempts
-      "mail_badpass",
-      'secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"'
-    ]
-  end
 
   include_recipe "kosmos-base::firewall"
 

site-cookbooks/kosmos-base/recipes/users.rb

@@ -0,0 +1,24 @@
+#
+# Cookbook Name:: kosmos-base
+# Recipe:: default
+#
+
+# Searches data bag "users" for groups attribute "sysadmin".
+# Places returned users in Unix group "sysadmin" with GID 2300.
+users_manage "sysadmin" do
+  group_id 2300
+  action %i[remove create]
+end
+
+sudo "sysadmin" do
+  groups "sysadmin"
+  nopasswd true
+  defaults [
+    # not default on Ubuntu, explicitely enable. Uses a minimal white list of
+    # environment variables
+    "env_reset",
+    # Send emails on unauthorized attempts
+    "mail_badpass",
+    'secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"'
+  ]
+end