We're going to rewrite the script completely, and getting the current implementation out of the way firts will make the diffs more reasonable. Signed-off-by: Andrea Bolognani <abologna(a)redhat.com&gt; --- guests/lcitool | 227 ------------------------------------------------- 1 file changed, 227 deletions(-) delete mode 100755 guests/lcitool diff --git a/guests/lcitool b/guests/lcitool deleted file mode 100755 index 0c1520e..0000000 --- a/guests/lcitool +++ /dev/null @@ -1,227 +0,0 @@ -#!/bin/sh - -# ------------------- -# Utility functions -# ------------------- - -# die MESSAGE -# -# Abort the program after displaying $MESSAGE on standard error. -die() { - echo "$1" >&2 - exit 1 -} - -# hash_file PASS_FILE -# -# Generate a password hash from the contents of PASS_FILE. -hash_file() { - PASS_FILE="$1" - - perl -le ' - my @chars = ("A".."Z", "a".."z", "0".."9"); - my $salt; $salt .= $chars[rand @chars] for 1..16; - my $handle; open($handle, "'"$PASS_FILE"'"); - my $pass = <$handle>; chomp($pass); - print crypt("$pass", "\$6\$$salt\$");' -} - -# yaml_var FILE VAR -# -# Read $FILE and output the value of YAML variable $VAR. Only trivial YAML -# values are supported, eg. strings and numbers that don't depend on the -# value of other variables. That's enough for our use case. -yaml_var() { - grep "^$2:\\s*" "$1" 2>/dev/null | tail -1 | sed "s/$2:\\s*//g" -} - -# load_install_config FILE -# -# Read all known configuration variables from $FILE and set them in the -# environment. Configuration variables that have already been set in -# the environment will not be updated. -load_install_config() { - INSTALL_URL=${INSTALL_URL:-$(yaml_var "$1" install_url)} - INSTALL_CONFIG=${INSTALL_CONFIG:-$(yaml_var "$1" install_config)} - INSTALL_VIRT_TYPE=${INSTALL_VIRT_TYPE:-$(yaml_var "$1" install_virt_type)} - INSTALL_ARCH=${INSTALL_ARCH:-$(yaml_var "$1" install_arch)} - INSTALL_MACHINE=${INSTALL_MACHINE:-$(yaml_var "$1" install_machine)} - INSTALL_CPU_MODEL=${INSTALL_CPU_MODEL:-$(yaml_var "$1" install_cpu_model)} - INSTALL_VCPUS=${INSTALL_VCPUS:-$(yaml_var "$1" install_vcpus)} - INSTALL_MEMORY_SIZE=${INSTALL_MEMORY_SIZE:-$(yaml_var "$1" install_memory_size)} - INSTALL_DISK_SIZE=${INSTALL_DISK_SIZE:-$(yaml_var "$1" install_disk_size)} - INSTALL_STORAGE_POOL=${INSTALL_STORAGE_POOL:-$(yaml_var "$1" install_storage_pool)} - INSTALL_NETWORK=${INSTALL_NETWORK:-$(yaml_var "$1" install_network)} -} - -# load_config -# -# Read tool configuration and perform the necessary validation. -load_config() { - CONFIG_DIR="$HOME/.config/$PROGRAM_NAME" - - mkdir -p "$CONFIG_DIR" >/dev/null 2>&1 || { - die "$PROGRAM_NAME: $CONFIG_DIR: Unable to create config directory" - } - - FLAVOR_FILE="$CONFIG_DIR/flavor" - VAULT_PASS_FILE="$CONFIG_DIR/vault-password" - ROOT_PASS_FILE="$CONFIG_DIR/root-password" - - # Two flavors are supported: test (default) and jenkins. Read the - # flavor from configuration, validate it and write it back in case - # it was not present - FLAVOR="$(cat "$FLAVOR_FILE" 2>/dev/null)" - FLAVOR=${FLAVOR:-test} - test "$FLAVOR" = test || test "$FLAVOR" = jenkins || { - die "$PROGRAM_NAME: Invalid flavor '$FLAVOR'" - } - echo "$FLAVOR" >"$FLAVOR_FILE" || { - die "$PROGRAM_NAME: $FLAVOR_FILE: Unable to save flavor" - } - - test "$FLAVOR" = jenkins && { - # The vault password is only needed for the jenkins flavor, so only - # validate it in that case - test -f "$VAULT_PASS_FILE" && test "$(cat "$VAULT_PASS_FILE")" || { - die "$PROGRAM_NAME: $VAULT_PASS_FILE: Missing or invalid password" - } - } || { - # For other flavors, undefine the variable so that Ansible - # will not try to read the file at all - VAULT_PASS_FILE= - } - - # Make sure the root password has been configured properly - test -f "$ROOT_PASS_FILE" && test "$(cat "$ROOT_PASS_FILE")" || { - die "$PROGRAM_NAME: $ROOT_PASS_FILE: Missing or invalid password" - } - - ROOT_HASH_FILE="$CONFIG_DIR/.root-password.hash" - - # Regenerate root password hash. Ansible expects passwords as hashes but - # doesn't provide a built-in facility to generate one from plain text - hash_file "$ROOT_PASS_FILE" >"$ROOT_HASH_FILE" || { - die "$PROGRAM_NAME: Failure while hashing root password" - } -} - -# ---------------------- -# User-visible actions -# ---------------------- - -do_help() { - echo "\ -Usage: $CALL_NAME ACTION [OPTIONS] - -Actions: - list List known guests - install GUEST Install GUEST - prepare GUEST|all Prepare or update GUEST. Can be run multiple times - update GUEST|all Alias for prepare - help Display this help" -} - -do_list() { - # List all guests present in the inventory. Skip group names, - # comments and empty lines - grep -vE '^#|^\[|^$' inventory | sort -u -} - -do_install() -{ - GUEST="$1" - - test "$GUEST" || { - die "$(do_help)" - } - do_list | grep -q "$GUEST" || { - die "$PROGRAM_NAME: $GUEST: Unknown guest" - } - test -f "host_vars/$GUEST/install.yml" || { - die "$PROGRAM_NAME: $GUEST: Missing configuration, guest must be installed manually" - } - - load_config - - # Load configuration files. Values don't get overwritten after being - # set the first time, so loading the host-specific configuration before - # the group configuration ensures overrides work as expected - load_install_config "host_vars/$GUEST/install.yml" - load_install_config "group_vars/all/install.yml" - - # Both memory size and disk size use GiB as unit, but virt-install wants - # disk size in GiB and memory size in *MiB*, so perform conversion here - INSTALL_MEMORY_SIZE=$(expr "$INSTALL_MEMORY_SIZE" \* 1024 2>/dev/null) - - # preseed files must use a well-known name to be picked up by d-i; - # for kickstart files, we can use whatever name we please but we need - # to point anaconda in the right direction through a kernel argument - case "$INSTALL_CONFIG" in - *kickstart*|*ks*) EXTRA_ARGS="ks=file:/${INSTALL_CONFIG##*/}" ;; - esac - - # Only configure autostart for the guest for the jenkins flavor - test "$FLAVOR" = jenkins && { - AUTOSTART="--autostart" - } - - virt-install \ - --name "$GUEST" \ - --location "$INSTALL_URL" \ - --virt-type "$INSTALL_VIRT_TYPE" \ - --arch "$INSTALL_ARCH" \ - --machine "$INSTALL_MACHINE" \ - --cpu "$INSTALL_CPU_MODEL" \ - --vcpus "$INSTALL_VCPUS" \ - --memory "$INSTALL_MEMORY_SIZE" \ - --disk "size=$INSTALL_DISK_SIZE,pool=$INSTALL_STORAGE_POOL,bus=virtio" \ - --network "network=$INSTALL_NETWORK,model=virtio" \ - --graphics none \ - --console pty \ - --sound none \ - --initrd-inject "$INSTALL_CONFIG" \ - --extra-args "console=ttyS0 $EXTRA_ARGS" \ - $AUTOSTART \ - --wait 0 -} - -do_prepare() { - GUEST="$1" - - test "$GUEST" || { - die "$(do_help)" - } - do_list | grep -q "$GUEST" || test "$GUEST" = all || { - die "$PROGRAM_NAME: $GUEST: Unknown guest" - } - - load_config - - EXTRA_VARS="flavor=$FLAVOR root_password_file=$ROOT_HASH_FILE" - - ansible-playbook \ - --vault-password-file "$VAULT_PASS_FILE" \ - --extra-vars "$EXTRA_VARS" \ - -l "$GUEST" \ - site.yml -} - -# --------------------- -# Program entry point -# --------------------- - -CALL_NAME="$0" -PROGRAM_NAME="${0##*/}" - -test -f "$PROGRAM_NAME" || { - die "$PROGRAM_NAME: Must be run from the source directory" -} - -case "$1" in - list) do_list ;; - install) do_install "$2" ;; - prepare|update) do_prepare "$2" ;; - *help) do_help ;; - *) die "$(do_help)" ;; -esac -- 2.17.1

The on-disk configuration format and its behavior are fully backwards compatible with the previous implementation. Signed-off-by: Andrea Bolognani <abologna(a)redhat.com&gt; --- guests/lcitool | 109 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 109 insertions(+) diff --git a/guests/lcitool b/guests/lcitool index 1cba8ad..6d4010b 100755 --- a/guests/lcitool +++ b/guests/lcitool @@ -18,6 +18,10 @@ # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. import argparse +import crypt +import os +import random +import string import sys import textwrap @@ -32,9 +36,114 @@ class Error(Exception): def __init__(self, message): self.message = message +class Config: + + def _mksalt(self): + alphabeth = string.ascii_letters + string.digits + salt = "".join(random.choice(alphabeth) for x in range(0, 16)) + return "$6${}$".format(salt) + + def _get_config_file(self, name): + try: + config_dir = os.environ["XDG_CONFIG_HOME"] + except KeyError: + config_dir = os.path.join(os.environ["HOME"], ".config/") + config_dir = os.path.join(config_dir, "lcitool/") + + # Create the directory if it doesn't already exist + if not os.path.exists(config_dir): + try: + os.mkdir(config_dir) + except: + raise Error( + "Can't create configuration directory ({})".format( + config_dir, + ) + ) + + return os.path.join(config_dir, name) + + def get_flavor(self): + flavor_file = self._get_config_file("flavor") + + try: + with open(flavor_file, "r") as f: + flavor = f.readline().strip() + except: + # If the flavor has not been configured, we choose the default + # and store it on disk to ensure consistent behavior from now on + flavor = "test" + try: + with open(flavor_file, "w") as f: + f.write("{}\n".format(flavor)) + except: + raise Error( + "Can't write flavor file ({})".format( + flavor_file, + ) + ) + + if flavor != "test" and flavor != "jenkins": + raise Error("Invalid flavor '{}'".format(flavor)) + + return flavor + + def get_vault_password_file(self): + vault_pass_file = None + + # The vault password is only needed for the jenkins flavor, but in + # that case we want to make sure there's *something* in there + if self.get_flavor() != "test": + vault_pass_file = self._get_config_file("vault-password") + + try: + with open(vault_pass_file, 'r') as f: + if len(f.readline().strip()) == 0: + raise ValueError + except: + raise Error( + "Missing or invalid vault password file ({})".format( + vault_pass_file, + ) + ) + + return vault_pass_file + + def get_root_password_file(self): + root_pass_file = self._get_config_file("root-password") + root_hash_file = self._get_config_file(".root-password.hash") + + try: + with open(root_pass_file, "r") as f: + root_pass = f.readline().strip() + except: + raise Error( + "Missing or invalid root password file ({})".format( + root_pass_file, + ) + ) + + # The hash will be different every time we run, but that doesn't + # matter - it will still validate the correct root password + root_hash = crypt.crypt(root_pass, self._mksalt()) + + try: + with open(root_hash_file, "w") as f: + f.write("{}\n".format(root_hash)) + except: + raise Error( + "Can't write hashed root password file ({})".format( + root_hash_file, + ) + ) + + return root_hash_file + class Application: def __init__(self): + self._config = Config() + self._parser = argparse.ArgumentParser( conflict_handler = "resolve", formatter_class = argparse.RawDescriptionHelpFormatter, -- 2.17.1

Signed-off-by: Andrea Bolognani <abologna(a)redhat.com&gt; --- guests/lcitool | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/guests/lcitool b/guests/lcitool index 3564eb8..1dd1ec8 100755 --- a/guests/lcitool +++ b/guests/lcitool @@ -237,6 +237,7 @@ class Application: description = "libvirt CI guest management tool", epilog = textwrap.dedent(""" supported actions: + list list all known hosts """), ) self._parser.add_argument( @@ -245,15 +246,25 @@ class Application: required = True, help = "action to perform (see below)", ) + self._parser.add_argument( + "-h", + metavar = "HOSTS", + help = "list of hosts to act on (glob patterns are supported)", + ) + + def _action_list(self, hosts): + for host in self._inventory.expand_pattern("all"): + print(host) def run(self): cmdline = self._parser.parse_args() action = cmdline.a + hosts = cmdline.h method = "_action_{}".format(action.replace("-", "_")) if hasattr(self, method): - getattr(self, method).__call__() + getattr(self, method).__call__(hosts) else: raise Error("Invalid action '{}'".format(action)) -- 2.17.1

The 'prepare' alias was kinda redundant and offered dubious value, so it has been dropped. Signed-off-by: Andrea Bolognani <abologna(a)redhat.com&gt; --- guests/lcitool | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/guests/lcitool b/guests/lcitool index cefce65..c17c174 100755 --- a/guests/lcitool +++ b/guests/lcitool @@ -240,6 +240,7 @@ class Application: supported actions: list list all known hosts install perform unattended host installation + update prepare hosts and keep them updated """), ) self._parser.add_argument( @@ -316,6 +317,35 @@ class Application: except: raise Error("Failed to install '{}'".format(host)) + def _action_update(self, hosts): + flavor = self._config.get_flavor() + vault_pass_file = self._config.get_vault_password_file() + root_pass_file = self._config.get_root_password_file() + + ansible_hosts = ",".join(self._inventory.expand_pattern(hosts)) + + extra_vars = "flavor={} root_password_file={}".format( + flavor, + root_pass_file, + ) + + cmd = [ "ansible-playbook" ] + + # Provide the vault password if available + if vault_pass_file is not None: + cmd += [ "--vault-password-file", vault_pass_file ] + + cmd += [ + "--limit", ansible_hosts, + "--extra-vars", extra_vars, + "./site.yml", + ] + + try: + subprocess.check_call(cmd) + except: + raise Error("Failed to update '{}'".format(hosts)) + def run(self): cmdline = self._parser.parse_args() action = cmdline.a -- 2.17.1