raucao
87d4305c0d
One-shot, idempotent helper that prepares an existing (Chef) node for Cinc Workstation management: installs Cinc Client, points /etc/cinc at the existing /etc/chef config, drops the deprecated attribute lists, and pre-seeds the allowed_* attribute lists so the first converge does not filter node attributes (e.g. vm_host). The node can then be converged as usual. Verified against drone-1.
82 lines
3.3 KiB
Bash
Executable File
82 lines
3.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Prepare a node for Cinc Workstation management so that a plain
|
|
# `knife zero converge` works afterwards.
|
|
#
|
|
# Usage: scripts/knife/migrate_node_to_cinc.sh NODE_NAME
|
|
#
|
|
# Idempotent and safe to re-run. Run from the chef repo (uses .cinc/config.rb).
|
|
#
|
|
# What it does on the node (as root, over knife's own SSH connection):
|
|
# 1. installs Cinc Client if the node still runs Chef Infra Client
|
|
# 2. makes /etc/cinc resolve to the existing knife-zero config in /etc/chef
|
|
# 3. drops the deprecated attribute whitelist/blacklist lines from client.rb
|
|
# 4. pre-seeds /etc/cinc/client.d/attributes.rb (the allowed_* lists) so the
|
|
# first converge does not filter node attributes
|
|
# 5. best-effort removes the leftover upstream chef package
|
|
set -euo pipefail
|
|
|
|
node="${1:?usage: $0 NODE_NAME}"
|
|
|
|
repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
|
attributes_file="$repo_root/site-cookbooks/kosmos-base/files/default/chef_attributes.rb"
|
|
node_file="$repo_root/nodes/$node.json"
|
|
|
|
[[ -f "$node_file" ]] || { echo "error: no node file at $node_file" >&2; exit 1; }
|
|
[[ -f "$attributes_file" ]] || { echo "error: no attributes file at $attributes_file" >&2; exit 1; }
|
|
|
|
# host + port, same convention as scripts/knife/converge_all.sh
|
|
read -r host vm_host < <(python3 -c '
|
|
import json, sys
|
|
d = json.load(open(sys.argv[1]))
|
|
n = d.get("normal", {})
|
|
print(n.get("knife_zero", {}).get("host", ""), n.get("vm_host", ""))
|
|
' "$node_file")
|
|
[[ -n "$host" ]] || { echo "error: $node has no knife_zero.host" >&2; exit 1; }
|
|
port=22; [[ -n "$vm_host" ]] || port=2222
|
|
|
|
attr_b64="$(base64 -w0 "$attributes_file")"
|
|
|
|
remote="$(mktemp)"; trap 'rm -f "$remote"' EXIT
|
|
cat >"$remote" <<EOF
|
|
set -euo pipefail
|
|
|
|
# 1. Cinc Client (Chef -> Cinc migration, or fresh)
|
|
if ! command -v cinc-client >/dev/null 2>&1 && [ ! -x /opt/cinc/bin/cinc-client ]; then
|
|
echo ">> installing Cinc Client"
|
|
curl -sL https://omnitruck.cinc.sh/install.sh | bash
|
|
fi
|
|
|
|
# 2. Point /etc/cinc at the existing knife-zero config in /etc/chef
|
|
if [ -L /etc/cinc ]; then
|
|
echo ">> /etc/cinc already a symlink"
|
|
elif [ -d /etc/cinc ] && [ -d /etc/chef ]; then
|
|
echo ">> replacing package /etc/cinc with symlink to /etc/chef"
|
|
rm -rf /etc/cinc && ln -s /etc/chef /etc/cinc
|
|
elif [ ! -e /etc/cinc ] && [ -d /etc/chef ]; then
|
|
echo ">> linking /etc/cinc -> /etc/chef"
|
|
ln -s /etc/chef /etc/cinc
|
|
fi
|
|
|
|
# 3. Drop deprecated attribute lists so they don't shadow the new ones
|
|
sed -i -E '/^[[:space:]]*(automatic|default|normal|override)_attribute_(white|black)list/d' /etc/cinc/client.rb 2>/dev/null || true
|
|
|
|
# 4. Pre-seed the allowlist from the repo (source of truth), before first converge
|
|
mkdir -p /etc/cinc/client.d
|
|
echo '$attr_b64' | base64 -d > /etc/cinc/client.d/attributes.rb
|
|
echo ">> wrote /etc/cinc/client.d/attributes.rb"
|
|
|
|
# 5. Best-effort: drop the leftover upstream chef package
|
|
if command -v dpkg >/dev/null 2>&1 && dpkg -l chef 2>/dev/null | grep -q '^ii'; then
|
|
echo ">> removing the upstream chef package"
|
|
apt-get remove -y chef >/dev/null
|
|
fi
|
|
|
|
echo ">> $node is ready. Converge with:"
|
|
echo ">> knife zero converge -a knife_zero.host -p$port name:$node"
|
|
EOF
|
|
|
|
# ship the script (base64) and run it as root over knife's own connection
|
|
b64="$(base64 -w0 "$remote")"
|
|
knife ssh -a knife_zero.host -p"$port" "name:$node" "echo $b64 | base64 -d | sudo bash"
|