Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
41435578
Unverified
Commit
41435578
authored
Jul 16, 2020
by
neil
Committed by
GitHub
Jul 16, 2020
Browse files
Merge pull request #3055 from andybotting/openstack-dns
Add OpenStack Designate DNS API support
parents
7f33ae3b
aad9afad
Changes
1
Show whitespace changes
Inline
Side-by-side
dnsapi/openstack.sh
0 → 100755
View file @
41435578
#!/usr/bin/env sh
# OpenStack Designate API plugin
#
# This requires you to have OpenStackClient and python-desginateclient
# installed.
#
# You will require Keystone V3 credentials loaded into your environment, which
# could be either password or v3applicationcredential type.
#
# Author: Andy Botting <andy@andybotting.com>
######## Public functions #####################
# Usage: dns_openstack_add _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
dns_openstack_add
()
{
fulldomain
=
$1
txtvalue
=
$2
_debug fulldomain
"
$fulldomain
"
_debug txtvalue
"
$txtvalue
"
_dns_openstack_credentials
||
return
$?
_dns_openstack_check_setup
||
return
$?
_dns_openstack_find_zone
||
return
$?
_dns_openstack_get_recordset
||
return
$?
_debug _recordset_id
"
$_recordset_id
"
if
[
-n
"
$_recordset_id
"
]
;
then
_dns_openstack_get_records
||
return
$?
_debug _records
"
$_records
"
fi
_dns_openstack_create_recordset
||
return
$?
}
# Usage: dns_openstack_rm _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
# Remove the txt record after validation.
dns_openstack_rm
()
{
fulldomain
=
$1
txtvalue
=
$2
_debug fulldomain
"
$fulldomain
"
_debug txtvalue
"
$txtvalue
"
_dns_openstack_credentials
||
return
$?
_dns_openstack_check_setup
||
return
$?
_dns_openstack_find_zone
||
return
$?
_dns_openstack_get_recordset
||
return
$?
_debug _recordset_id
"
$_recordset_id
"
if
[
-n
"
$_recordset_id
"
]
;
then
_dns_openstack_get_records
||
return
$?
_debug _records
"
$_records
"
fi
_dns_openstack_delete_recordset
||
return
$?
}
#################### Private functions below ##################################
_dns_openstack_create_recordset
()
{
if
[
-z
"
$_recordset_id
"
]
;
then
_info
"Creating a new recordset"
if
!
_recordset_id
=
$(
openstack recordset create
-c
id
-f
value
--type
TXT
--record
"
$txtvalue
"
"
$_zone_id
"
"
$fulldomain
."
)
;
then
_err
"No recordset ID found after create"
return
1
fi
else
_info
"Updating existing recordset"
# Build new list of --record <rec> args for update
_record_args
=
"--record
$txtvalue
"
for
_rec
in
$_records
;
do
_record_args
=
"
$_record_args
--record
$_rec
"
done
# shellcheck disable=SC2086
if
!
_recordset_id
=
$(
openstack recordset
set
-c
id
-f
value
$_record_args
"
$_zone_id
"
"
$fulldomain
."
)
;
then
_err
"Recordset update failed"
return
1
fi
fi
_max_retries
=
60
_sleep_sec
=
5
_retry_times
=
0
while
[
"
$_retry_times
"
-lt
"
$_max_retries
"
]
;
do
_retry_times
=
$(
_math
"
$_retry_times
"
+ 1
)
_debug3 _retry_times
"
$_retry_times
"
_record_status
=
$(
openstack recordset show
-c
status
-f
value
"
$_zone_id
"
"
$_recordset_id
"
)
_info
"Recordset status is
$_record_status
"
if
[
"
$_record_status
"
=
"ACTIVE"
]
;
then
return
0
elif
[
"
$_record_status
"
=
"ERROR"
]
;
then
return
1
else
_sleep
$_sleep_sec
fi
done
_err
"Recordset failed to become ACTIVE"
return
1
}
_dns_openstack_delete_recordset
()
{
if
[
"
$_records
"
=
"
$txtvalue
"
]
;
then
_info
"Only one record found, deleting recordset"
if
!
openstack recordset delete
"
$_zone_id
"
"
$fulldomain
."
>
/dev/null
;
then
_err
"Failed to delete recordset"
return
1
fi
else
_info
"Found existing records, updating recordset"
# Build new list of --record <rec> args for update
_record_args
=
""
for
_rec
in
$_records
;
do
if
[
"
$_rec
"
=
"
$txtvalue
"
]
;
then
continue
fi
_record_args
=
"
$_record_args
--record
$_rec
"
done
# shellcheck disable=SC2086
if
!
openstack recordset
set
-c
id
-f
value
$_record_args
"
$_zone_id
"
"
$fulldomain
."
>
/dev/null
;
then
_err
"Recordset update failed"
return
1
fi
fi
}
_dns_openstack_get_root
()
{
# Take the full fqdn and strip away pieces until we get an exact zone name
# match. For example, _acme-challenge.something.domain.com might need to go
# into something.domain.com or domain.com
_zone_name
=
$1
_zone_list
=
$2
while
[
"
$_zone_name
"
!=
""
]
;
do
_zone_name
=
"
$(
echo
"
$_zone_name
"
|
sed
's/[^.]*\.*//'
)
"
echo
"
$_zone_list
"
|
while
read
-r
id
name
;
do
if
_startswith
"
$_zone_name
."
"
$name
"
;
then
echo
"
$id
"
fi
done
done
| _head_n 1
}
_dns_openstack_find_zone
()
{
if
!
_zone_list
=
"
$(
openstack zone list
-c
id
-c
name
-f
value
)
"
;
then
_err
"Can't list zones. Check your OpenStack credentials"
return
1
fi
_debug _zone_list
"
$_zone_list
"
if
!
_zone_id
=
"
$(
_dns_openstack_get_root
"
$fulldomain
"
"
$_zone_list
"
)
"
;
then
_err
"Can't find a matching zone. Check your OpenStack credentials"
return
1
fi
_debug _zone_id
"
$_zone_id
"
}
_dns_openstack_get_records
()
{
if
!
_records
=
$(
openstack recordset show
-c
records
-f
value
"
$_zone_id
"
"
$fulldomain
."
)
;
then
_err
"Failed to get records"
return
1
fi
return
0
}
_dns_openstack_get_recordset
()
{
if
!
_recordset_id
=
$(
openstack recordset list
-c
id
-f
value
--name
"
$fulldomain
."
"
$_zone_id
"
)
;
then
_err
"Failed to get recordset"
return
1
fi
return
0
}
_dns_openstack_check_setup
()
{
if
!
_exists openstack
;
then
_err
"OpenStack client not found"
return
1
fi
}
_dns_openstack_credentials
()
{
_debug
"Check OpenStack credentials"
# If we have OS_AUTH_URL already set in the environment, then assume we want
# to use those, otherwise use stored credentials
if
[
-n
"
$OS_AUTH_URL
"
]
;
then
_debug
"OS_AUTH_URL env var found, using environment"
else
_debug
"OS_AUTH_URL not found, loading stored credentials"
OS_AUTH_URL
=
"
${
OS_AUTH_URL
:-
$(
_readaccountconf_mutable OS_AUTH_URL
)
}
"
OS_IDENTITY_API_VERSION
=
"
${
OS_IDENTITY_API_VERSION
:-
$(
_readaccountconf_mutable OS_IDENTITY_API_VERSION
)
}
"
OS_AUTH_TYPE
=
"
${
OS_AUTH_TYPE
:-
$(
_readaccountconf_mutable OS_AUTH_TYPE
)
}
"
OS_APPLICATION_CREDENTIAL_ID
=
"
${
OS_APPLICATION_CREDENTIAL_ID
:-
$(
_readaccountconf_mutable OS_APPLICATION_CREDENTIAL_ID
)
}
"
OS_APPLICATION_CREDENTIAL_SECRET
=
"
${
OS_APPLICATION_CREDENTIAL_SECRET
:-
$(
_readaccountconf_mutable OS_APPLICATION_CREDENTIAL_SECRET
)
}
"
OS_USERNAME
=
"
${
OS_USERNAME
:-
$(
_readaccountconf_mutable OS_USERNAME
)
}
"
OS_PASSWORD
=
"
${
OS_PASSWORD
:-
$(
_readaccountconf_mutable OS_PASSWORD
)
}
"
OS_PROJECT_NAME
=
"
${
OS_PROJECT_NAME
:-
$(
_readaccountconf_mutable OS_PROJECT_NAME
)
}
"
OS_PROJECT_ID
=
"
${
OS_PROJECT_ID
:-
$(
_readaccountconf_mutable OS_PROJECT_ID
)
}
"
OS_USER_DOMAIN_NAME
=
"
${
OS_USER_DOMAIN_NAME
:-
$(
_readaccountconf_mutable OS_USER_DOMAIN_NAME
)
}
"
OS_USER_DOMAIN_ID
=
"
${
OS_USER_DOMAIN_ID
:-
$(
_readaccountconf_mutable OS_USER_DOMAIN_ID
)
}
"
OS_PROJECT_DOMAIN_NAME
=
"
${
OS_PROJECT_DOMAIN_NAME
:-
$(
_readaccountconf_mutable OS_PROJECT_DOMAIN_NAME
)
}
"
OS_PROJECT_DOMAIN_ID
=
"
${
OS_PROJECT_DOMAIN_ID
:-
$(
_readaccountconf_mutable OS_PROJECT_DOMAIN_ID
)
}
"
fi
# Check each var and either save or clear it depending on whether its set.
# The helps us clear out old vars in the case where a user may want
# to switch between password and app creds
_debug
"OS_AUTH_URL"
"
$OS_AUTH_URL
"
if
[
-n
"
$OS_AUTH_URL
"
]
;
then
export
OS_AUTH_URL
_saveaccountconf_mutable OS_AUTH_URL
"
$OS_AUTH_URL
"
else
unset
OS_AUTH_URL
_clearaccountconf SAVED_OS_AUTH_URL
fi
_debug
"OS_IDENTITY_API_VERSION"
"
$OS_IDENTITY_API_VERSION
"
if
[
-n
"
$OS_IDENTITY_API_VERSION
"
]
;
then
export
OS_IDENTITY_API_VERSION
_saveaccountconf_mutable OS_IDENTITY_API_VERSION
"
$OS_IDENTITY_API_VERSION
"
else
unset
OS_IDENTITY_API_VERSION
_clearaccountconf SAVED_OS_IDENTITY_API_VERSION
fi
_debug
"OS_AUTH_TYPE"
"
$OS_AUTH_TYPE
"
if
[
-n
"
$OS_AUTH_TYPE
"
]
;
then
export
OS_AUTH_TYPE
_saveaccountconf_mutable OS_AUTH_TYPE
"
$OS_AUTH_TYPE
"
else
unset
OS_AUTH_TYPE
_clearaccountconf SAVED_OS_AUTH_TYPE
fi
_debug
"OS_APPLICATION_CREDENTIAL_ID"
"
$OS_APPLICATION_CREDENTIAL_ID
"
if
[
-n
"
$OS_APPLICATION_CREDENTIAL_ID
"
]
;
then
export
OS_APPLICATION_CREDENTIAL_ID
_saveaccountconf_mutable OS_APPLICATION_CREDENTIAL_ID
"
$OS_APPLICATION_CREDENTIAL_ID
"
else
unset
OS_APPLICATION_CREDENTIAL_ID
_clearaccountconf SAVED_OS_APPLICATION_CREDENTIAL_ID
fi
_secure_debug
"OS_APPLICATION_CREDENTIAL_SECRET"
"
$OS_APPLICATION_CREDENTIAL_SECRET
"
if
[
-n
"
$OS_APPLICATION_CREDENTIAL_SECRET
"
]
;
then
export
OS_APPLICATION_CREDENTIAL_SECRET
_saveaccountconf_mutable OS_APPLICATION_CREDENTIAL_SECRET
"
$OS_APPLICATION_CREDENTIAL_SECRET
"
else
unset
OS_APPLICATION_CREDENTIAL_SECRET
_clearaccountconf SAVED_OS_APPLICATION_CREDENTIAL_SECRET
fi
_debug
"OS_USERNAME"
"
$OS_USERNAME
"
if
[
-n
"
$OS_USERNAME
"
]
;
then
export
OS_USERNAME
_saveaccountconf_mutable OS_USERNAME
"
$OS_USERNAME
"
else
unset
OS_USERNAME
_clearaccountconf SAVED_OS_USERNAME
fi
_secure_debug
"OS_PASSWORD"
"
$OS_PASSWORD
"
if
[
-n
"
$OS_PASSWORD
"
]
;
then
export
OS_PASSWORD
_saveaccountconf_mutable OS_PASSWORD
"
$OS_PASSWORD
"
else
unset
OS_PASSWORD
_clearaccountconf SAVED_OS_PASSWORD
fi
_debug
"OS_PROJECT_NAME"
"
$OS_PROJECT_NAME
"
if
[
-n
"
$OS_PROJECT_NAME
"
]
;
then
export
OS_PROJECT_NAME
_saveaccountconf_mutable OS_PROJECT_NAME
"
$OS_PROJECT_NAME
"
else
unset
OS_PROJECT_NAME
_clearaccountconf SAVED_OS_PROJECT_NAME
fi
_debug
"OS_PROJECT_ID"
"
$OS_PROJECT_ID
"
if
[
-n
"
$OS_PROJECT_ID
"
]
;
then
export
OS_PROJECT_ID
_saveaccountconf_mutable OS_PROJECT_ID
"
$OS_PROJECT_ID
"
else
unset
OS_PROJECT_ID
_clearaccountconf SAVED_OS_PROJECT_ID
fi
_debug
"OS_USER_DOMAIN_NAME"
"
$OS_USER_DOMAIN_NAME
"
if
[
-n
"
$OS_USER_DOMAIN_NAME
"
]
;
then
export
OS_USER_DOMAIN_NAME
_saveaccountconf_mutable OS_USER_DOMAIN_NAME
"
$OS_USER_DOMAIN_NAME
"
else
unset
OS_USER_DOMAIN_NAME
_clearaccountconf SAVED_OS_USER_DOMAIN_NAME
fi
_debug
"OS_USER_DOMAIN_ID"
"
$OS_USER_DOMAIN_ID
"
if
[
-n
"
$OS_USER_DOMAIN_ID
"
]
;
then
export
OS_USER_DOMAIN_ID
_saveaccountconf_mutable OS_USER_DOMAIN_ID
"
$OS_USER_DOMAIN_ID
"
else
unset
OS_USER_DOMAIN_ID
_clearaccountconf SAVED_OS_USER_DOMAIN_ID
fi
_debug
"OS_PROJECT_DOMAIN_NAME"
"
$OS_PROJECT_DOMAIN_NAME
"
if
[
-n
"
$OS_PROJECT_DOMAIN_NAME
"
]
;
then
export
OS_PROJECT_DOMAIN_NAME
_saveaccountconf_mutable OS_PROJECT_DOMAIN_NAME
"
$OS_PROJECT_DOMAIN_NAME
"
else
unset
OS_PROJECT_DOMAIN_NAME
_clearaccountconf SAVED_OS_PROJECT_DOMAIN_NAME
fi
_debug
"OS_PROJECT_DOMAIN_ID"
"
$OS_PROJECT_DOMAIN_ID
"
if
[
-n
"
$OS_PROJECT_DOMAIN_ID
"
]
;
then
export
OS_PROJECT_DOMAIN_ID
_saveaccountconf_mutable OS_PROJECT_DOMAIN_ID
"
$OS_PROJECT_DOMAIN_ID
"
else
unset
OS_PROJECT_DOMAIN_ID
_clearaccountconf SAVED_OS_PROJECT_DOMAIN_ID
fi
if
[
"
$OS_AUTH_TYPE
"
=
"v3applicationcredential"
]
;
then
# Application Credential auth
if
[
-z
"
$OS_APPLICATION_CREDENTIAL_ID
"
]
||
[
-z
"
$OS_APPLICATION_CREDENTIAL_SECRET
"
]
;
then
_err
"When using OpenStack application credentials, OS_APPLICATION_CREDENTIAL_ID"
_err
"and OS_APPLICATION_CREDENTIAL_SECRET must be set."
_err
"Please check your credentials and try again."
return
1
fi
else
# Password auth
if
[
-z
"
$OS_USERNAME
"
]
||
[
-z
"
$OS_PASSWORD
"
]
;
then
_err
"OpenStack username or password not found."
_err
"Please check your credentials and try again."
return
1
fi
if
[
-z
"
$OS_PROJECT_NAME
"
]
&&
[
-z
"
$OS_PROJECT_ID
"
]
;
then
_err
"When using password authentication, OS_PROJECT_NAME or"
_err
"OS_PROJECT_ID must be set."
_err
"Please check your credentials and try again."
return
1
fi
fi
return
0
}
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment