raucao
a96a49c633
The migration script installed Cinc with no version, which floated and triggered omnitruck's "You are installing a package without a version pin" warning. Pass -v latest so omnitruck resolves the current stable build for the node's platform (20.04 -> 19.2.12, 22.04+/24.04/26.04 -> 19.4.46) and the warning is suppressed. Document the behavior in the README. Drop the stale chef_version: 18.2.7 pins from the Test Kitchen suites: dokken defaults chef_version to "latest", so passing -v is what actually tracks the current stable client. Add the missing provisioner.product_name: cinc to the deno and strfry submodule suites so they run Cinc instead of the license-gated Chef Infra Client. Submodule pointers: site-cookbooks/deno 3795c9e -> c78bc66 site-cookbooks/strfry 9c04b39 -> 8107b1e
86 lines
3.6 KiB
Bash
Executable File
86 lines
3.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Prepare a node for Cinc Workstation management so that a plain
|
|
# `knife zero converge` works afterwards.
|
|
#
|
|
# Usage: scripts/knife/migrate_node_to_cinc.sh NODE_NAME
|
|
#
|
|
# Idempotent and safe to re-run. Run from the chef repo (uses .cinc/config.rb).
|
|
#
|
|
# What it does on the node (as root, over knife's own SSH connection):
|
|
# 1. installs the current stable Cinc Client if the node still runs Chef
|
|
# Infra Client (omnitruck resolves the right build for the platform)
|
|
# 2. makes /etc/cinc resolve to the existing knife-zero config in /etc/chef
|
|
# 3. drops the deprecated attribute whitelist/blacklist lines from client.rb
|
|
# 4. pre-seeds /etc/cinc/client.d/attributes.rb (the allowed_* lists) so the
|
|
# first converge does not filter node attributes
|
|
# 5. best-effort removes the leftover upstream chef package
|
|
set -euo pipefail
|
|
|
|
node="${1:?usage: $0 NODE_NAME}"
|
|
|
|
repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
|
attributes_file="$repo_root/site-cookbooks/kosmos-base/files/default/chef_attributes.rb"
|
|
node_file="$repo_root/nodes/$node.json"
|
|
|
|
[[ -f "$node_file" ]] || { echo "error: no node file at $node_file" >&2; exit 1; }
|
|
[[ -f "$attributes_file" ]] || { echo "error: no attributes file at $attributes_file" >&2; exit 1; }
|
|
|
|
# host + port, same convention as scripts/knife/converge_all.sh
|
|
read -r host vm_host < <(python3 -c '
|
|
import json, sys
|
|
d = json.load(open(sys.argv[1]))
|
|
n = d.get("normal", {})
|
|
print(n.get("knife_zero", {}).get("host", ""), n.get("vm_host", ""))
|
|
' "$node_file")
|
|
[[ -n "$host" ]] || { echo "error: $node has no knife_zero.host" >&2; exit 1; }
|
|
port=22; [[ -n "$vm_host" ]] || port=2222
|
|
|
|
attr_b64="$(base64 -w0 "$attributes_file")"
|
|
|
|
remote="$(mktemp)"; trap 'rm -f "$remote"' EXIT
|
|
cat >"$remote" <<EOF
|
|
set -euo pipefail
|
|
|
|
# 1. Cinc Client (Chef -> Cinc migration, or fresh).
|
|
# Install the current stable release for this platform. omnitruck resolves the
|
|
# right build per OS (so 20.04 and 22.04+ each get their latest supported
|
|
# version), and passing -v also suppresses the "without a version pin" warning.
|
|
if ! command -v cinc-client >/dev/null 2>&1 && [ ! -x /opt/cinc/bin/cinc-client ]; then
|
|
echo ">> installing the current stable Cinc Client"
|
|
curl -sL https://omnitruck.cinc.sh/install.sh | bash -s -- -v latest
|
|
fi
|
|
|
|
# 2. Point /etc/cinc at the existing knife-zero config in /etc/chef
|
|
if [ -L /etc/cinc ]; then
|
|
echo ">> /etc/cinc already a symlink"
|
|
elif [ -d /etc/cinc ] && [ -d /etc/chef ]; then
|
|
echo ">> replacing package /etc/cinc with symlink to /etc/chef"
|
|
rm -rf /etc/cinc && ln -s /etc/chef /etc/cinc
|
|
elif [ ! -e /etc/cinc ] && [ -d /etc/chef ]; then
|
|
echo ">> linking /etc/cinc -> /etc/chef"
|
|
ln -s /etc/chef /etc/cinc
|
|
fi
|
|
|
|
# 3. Drop deprecated attribute lists so they don't shadow the new ones
|
|
sed -i -E '/^[[:space:]]*(automatic|default|normal|override)_attribute_(white|black)list/d' /etc/cinc/client.rb 2>/dev/null || true
|
|
|
|
# 4. Pre-seed the allowlist from the repo (source of truth), before first converge
|
|
mkdir -p /etc/cinc/client.d
|
|
echo '$attr_b64' | base64 -d > /etc/cinc/client.d/attributes.rb
|
|
echo ">> wrote /etc/cinc/client.d/attributes.rb"
|
|
|
|
# 5. Best-effort: drop the leftover upstream chef package
|
|
if command -v dpkg >/dev/null 2>&1 && dpkg -l chef 2>/dev/null | grep -q '^ii'; then
|
|
echo ">> removing the upstream chef package"
|
|
apt-get remove -y chef >/dev/null
|
|
fi
|
|
|
|
echo ">> $node is ready. Converge with:"
|
|
echo ">> knife zero converge -a knife_zero.host -p$port name:$node"
|
|
EOF
|
|
|
|
# ship the script (base64) and run it as root over knife's own connection
|
|
b64="$(base64 -w0 "$remote")"
|
|
knife ssh -a knife_zero.host -p"$port" "name:$node" "echo $b64 | base64 -d | sudo bash"
|