Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
8cbbd022
Unverified
Commit
8cbbd022
authored
Jul 16, 2020
by
neil
Committed by
GitHub
Jul 16, 2020
Browse files
Merge pull request #3057 from andybotting/openstack-deploy
Add OpenStack Barbican deploy support
parents
5c295254
9b23cd6d
Changes
1
Show whitespace changes
Inline
Side-by-side
deploy/openstack.sh
0 → 100644
View file @
8cbbd022
#!/usr/bin/env sh
# OpenStack Barbican deploy hook
#
# This requires you to have OpenStackClient and python-barbicanclient
# installed.
#
# You will require Keystone V3 credentials loaded into your environment, which
# could be either password or v3applicationcredential type.
#
# Author: Andy Botting <andy@andybotting.com>
openstack_deploy
()
{
_cdomain
=
"
$1
"
_ckey
=
"
$2
"
_ccert
=
"
$3
"
_cca
=
"
$4
"
_cfullchain
=
"
$5
"
_debug _cdomain
"
$_cdomain
"
_debug _ckey
"
$_ckey
"
_debug _ccert
"
$_ccert
"
_debug _cca
"
$_cca
"
_debug _cfullchain
"
$_cfullchain
"
if
!
_exists openstack
;
then
_err
"OpenStack client not found"
return
1
fi
_openstack_credentials
||
return
$?
_info
"Generate import pkcs12"
_import_pkcs12
=
"
$(
_mktemp
)
"
if
!
_openstack_to_pkcs
"
$_import_pkcs12
"
"
$_ckey
"
"
$_ccert
"
"
$_cca
"
;
then
_err
"Error creating pkcs12 certificate"
return
1
fi
_debug _import_pkcs12
"
$_import_pkcs12
"
_base64_pkcs12
=
$(
_base64
"multiline"
<
"
$_import_pkcs12
"
)
secretHrefs
=
$(
_openstack_get_secrets
)
_debug secretHrefs
"
$secretHrefs
"
_openstack_store_secret
||
return
$?
if
[
-n
"
$secretHrefs
"
]
;
then
_info
"Cleaning up existing secret"
_openstack_delete_secrets
||
return
$?
fi
_info
"Certificate successfully deployed"
return
0
}
_openstack_store_secret
()
{
if
!
openstack secret store
--name
"
$_cdomain
."
-t
'application/octet-stream'
-e
base64
--payload
"
$_base64_pkcs12
"
;
then
_err
"Failed to create OpenStack secret"
return
1
fi
return
}
_openstack_delete_secrets
()
{
echo
"
$secretHrefs
"
|
while
read
-r
secretHref
;
do
_info
"Deleting old secret
$secretHref
"
if
!
openstack secret delete
"
$secretHref
"
;
then
_err
"Failed to delete OpenStack secret"
return
1
fi
done
return
}
_openstack_get_secrets
()
{
if
!
secretHrefs
=
$(
openstack secret list
-f
value
--name
"
$_cdomain
."
|
cut
-d
' '
-f1
)
;
then
_err
"Failed to list secrets"
return
1
fi
echo
"
$secretHrefs
"
}
_openstack_to_pkcs
()
{
# The existing _toPkcs command can't allow an empty password, due to sh
# -z test, so copied here and forcing the empty password.
_cpfx
=
"
$1
"
_ckey
=
"
$2
"
_ccert
=
"
$3
"
_cca
=
"
$4
"
${
ACME_OPENSSL_BIN
:-
openssl
}
pkcs12
-export
-out
"
$_cpfx
"
-inkey
"
$_ckey
"
-in
"
$_ccert
"
-certfile
"
$_cca
"
-password
"pass:"
}
_openstack_credentials
()
{
_debug
"Check OpenStack credentials"
# If we have OS_AUTH_URL already set in the environment, then assume we want
# to use those, otherwise use stored credentials
if
[
-n
"
$OS_AUTH_URL
"
]
;
then
_debug
"OS_AUTH_URL env var found, using environment"
else
_debug
"OS_AUTH_URL not found, loading stored credentials"
OS_AUTH_URL
=
"
${
OS_AUTH_URL
:-
$(
_readaccountconf_mutable OS_AUTH_URL
)
}
"
OS_IDENTITY_API_VERSION
=
"
${
OS_IDENTITY_API_VERSION
:-
$(
_readaccountconf_mutable OS_IDENTITY_API_VERSION
)
}
"
OS_AUTH_TYPE
=
"
${
OS_AUTH_TYPE
:-
$(
_readaccountconf_mutable OS_AUTH_TYPE
)
}
"
OS_APPLICATION_CREDENTIAL_ID
=
"
${
OS_APPLICATION_CREDENTIAL_ID
:-
$(
_readaccountconf_mutable OS_APPLICATION_CREDENTIAL_ID
)
}
"
OS_APPLICATION_CREDENTIAL_SECRET
=
"
${
OS_APPLICATION_CREDENTIAL_SECRET
:-
$(
_readaccountconf_mutable OS_APPLICATION_CREDENTIAL_SECRET
)
}
"
OS_USERNAME
=
"
${
OS_USERNAME
:-
$(
_readaccountconf_mutable OS_USERNAME
)
}
"
OS_PASSWORD
=
"
${
OS_PASSWORD
:-
$(
_readaccountconf_mutable OS_PASSWORD
)
}
"
OS_PROJECT_NAME
=
"
${
OS_PROJECT_NAME
:-
$(
_readaccountconf_mutable OS_PROJECT_NAME
)
}
"
OS_PROJECT_ID
=
"
${
OS_PROJECT_ID
:-
$(
_readaccountconf_mutable OS_PROJECT_ID
)
}
"
OS_USER_DOMAIN_NAME
=
"
${
OS_USER_DOMAIN_NAME
:-
$(
_readaccountconf_mutable OS_USER_DOMAIN_NAME
)
}
"
OS_USER_DOMAIN_ID
=
"
${
OS_USER_DOMAIN_ID
:-
$(
_readaccountconf_mutable OS_USER_DOMAIN_ID
)
}
"
OS_PROJECT_DOMAIN_NAME
=
"
${
OS_PROJECT_DOMAIN_NAME
:-
$(
_readaccountconf_mutable OS_PROJECT_DOMAIN_NAME
)
}
"
OS_PROJECT_DOMAIN_ID
=
"
${
OS_PROJECT_DOMAIN_ID
:-
$(
_readaccountconf_mutable OS_PROJECT_DOMAIN_ID
)
}
"
fi
# Check each var and either save or clear it depending on whether its set.
# The helps us clear out old vars in the case where a user may want
# to switch between password and app creds
_debug
"OS_AUTH_URL"
"
$OS_AUTH_URL
"
if
[
-n
"
$OS_AUTH_URL
"
]
;
then
export
OS_AUTH_URL
_saveaccountconf_mutable OS_AUTH_URL
"
$OS_AUTH_URL
"
else
unset
OS_AUTH_URL
_clearaccountconf SAVED_OS_AUTH_URL
fi
_debug
"OS_IDENTITY_API_VERSION"
"
$OS_IDENTITY_API_VERSION
"
if
[
-n
"
$OS_IDENTITY_API_VERSION
"
]
;
then
export
OS_IDENTITY_API_VERSION
_saveaccountconf_mutable OS_IDENTITY_API_VERSION
"
$OS_IDENTITY_API_VERSION
"
else
unset
OS_IDENTITY_API_VERSION
_clearaccountconf SAVED_OS_IDENTITY_API_VERSION
fi
_debug
"OS_AUTH_TYPE"
"
$OS_AUTH_TYPE
"
if
[
-n
"
$OS_AUTH_TYPE
"
]
;
then
export
OS_AUTH_TYPE
_saveaccountconf_mutable OS_AUTH_TYPE
"
$OS_AUTH_TYPE
"
else
unset
OS_AUTH_TYPE
_clearaccountconf SAVED_OS_AUTH_TYPE
fi
_debug
"OS_APPLICATION_CREDENTIAL_ID"
"
$OS_APPLICATION_CREDENTIAL_ID
"
if
[
-n
"
$OS_APPLICATION_CREDENTIAL_ID
"
]
;
then
export
OS_APPLICATION_CREDENTIAL_ID
_saveaccountconf_mutable OS_APPLICATION_CREDENTIAL_ID
"
$OS_APPLICATION_CREDENTIAL_ID
"
else
unset
OS_APPLICATION_CREDENTIAL_ID
_clearaccountconf SAVED_OS_APPLICATION_CREDENTIAL_ID
fi
_secure_debug
"OS_APPLICATION_CREDENTIAL_SECRET"
"
$OS_APPLICATION_CREDENTIAL_SECRET
"
if
[
-n
"
$OS_APPLICATION_CREDENTIAL_SECRET
"
]
;
then
export
OS_APPLICATION_CREDENTIAL_SECRET
_saveaccountconf_mutable OS_APPLICATION_CREDENTIAL_SECRET
"
$OS_APPLICATION_CREDENTIAL_SECRET
"
else
unset
OS_APPLICATION_CREDENTIAL_SECRET
_clearaccountconf SAVED_OS_APPLICATION_CREDENTIAL_SECRET
fi
_debug
"OS_USERNAME"
"
$OS_USERNAME
"
if
[
-n
"
$OS_USERNAME
"
]
;
then
export
OS_USERNAME
_saveaccountconf_mutable OS_USERNAME
"
$OS_USERNAME
"
else
unset
OS_USERNAME
_clearaccountconf SAVED_OS_USERNAME
fi
_secure_debug
"OS_PASSWORD"
"
$OS_PASSWORD
"
if
[
-n
"
$OS_PASSWORD
"
]
;
then
export
OS_PASSWORD
_saveaccountconf_mutable OS_PASSWORD
"
$OS_PASSWORD
"
else
unset
OS_PASSWORD
_clearaccountconf SAVED_OS_PASSWORD
fi
_debug
"OS_PROJECT_NAME"
"
$OS_PROJECT_NAME
"
if
[
-n
"
$OS_PROJECT_NAME
"
]
;
then
export
OS_PROJECT_NAME
_saveaccountconf_mutable OS_PROJECT_NAME
"
$OS_PROJECT_NAME
"
else
unset
OS_PROJECT_NAME
_clearaccountconf SAVED_OS_PROJECT_NAME
fi
_debug
"OS_PROJECT_ID"
"
$OS_PROJECT_ID
"
if
[
-n
"
$OS_PROJECT_ID
"
]
;
then
export
OS_PROJECT_ID
_saveaccountconf_mutable OS_PROJECT_ID
"
$OS_PROJECT_ID
"
else
unset
OS_PROJECT_ID
_clearaccountconf SAVED_OS_PROJECT_ID
fi
_debug
"OS_USER_DOMAIN_NAME"
"
$OS_USER_DOMAIN_NAME
"
if
[
-n
"
$OS_USER_DOMAIN_NAME
"
]
;
then
export
OS_USER_DOMAIN_NAME
_saveaccountconf_mutable OS_USER_DOMAIN_NAME
"
$OS_USER_DOMAIN_NAME
"
else
unset
OS_USER_DOMAIN_NAME
_clearaccountconf SAVED_OS_USER_DOMAIN_NAME
fi
_debug
"OS_USER_DOMAIN_ID"
"
$OS_USER_DOMAIN_ID
"
if
[
-n
"
$OS_USER_DOMAIN_ID
"
]
;
then
export
OS_USER_DOMAIN_ID
_saveaccountconf_mutable OS_USER_DOMAIN_ID
"
$OS_USER_DOMAIN_ID
"
else
unset
OS_USER_DOMAIN_ID
_clearaccountconf SAVED_OS_USER_DOMAIN_ID
fi
_debug
"OS_PROJECT_DOMAIN_NAME"
"
$OS_PROJECT_DOMAIN_NAME
"
if
[
-n
"
$OS_PROJECT_DOMAIN_NAME
"
]
;
then
export
OS_PROJECT_DOMAIN_NAME
_saveaccountconf_mutable OS_PROJECT_DOMAIN_NAME
"
$OS_PROJECT_DOMAIN_NAME
"
else
unset
OS_PROJECT_DOMAIN_NAME
_clearaccountconf SAVED_OS_PROJECT_DOMAIN_NAME
fi
_debug
"OS_PROJECT_DOMAIN_ID"
"
$OS_PROJECT_DOMAIN_ID
"
if
[
-n
"
$OS_PROJECT_DOMAIN_ID
"
]
;
then
export
OS_PROJECT_DOMAIN_ID
_saveaccountconf_mutable OS_PROJECT_DOMAIN_ID
"
$OS_PROJECT_DOMAIN_ID
"
else
unset
OS_PROJECT_DOMAIN_ID
_clearaccountconf SAVED_OS_PROJECT_DOMAIN_ID
fi
if
[
"
$OS_AUTH_TYPE
"
=
"v3applicationcredential"
]
;
then
# Application Credential auth
if
[
-z
"
$OS_APPLICATION_CREDENTIAL_ID
"
]
||
[
-z
"
$OS_APPLICATION_CREDENTIAL_SECRET
"
]
;
then
_err
"When using OpenStack application credentials, OS_APPLICATION_CREDENTIAL_ID"
_err
"and OS_APPLICATION_CREDENTIAL_SECRET must be set."
_err
"Please check your credentials and try again."
return
1
fi
else
# Password auth
if
[
-z
"
$OS_USERNAME
"
]
||
[
-z
"
$OS_PASSWORD
"
]
;
then
_err
"OpenStack username or password not found."
_err
"Please check your credentials and try again."
return
1
fi
if
[
-z
"
$OS_PROJECT_NAME
"
]
&&
[
-z
"
$OS_PROJECT_ID
"
]
;
then
_err
"When using password authentication, OS_PROJECT_NAME or"
_err
"OS_PROJECT_ID must be set."
_err
"Please check your credentials and try again."
return
1
fi
fi
return
0
}
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment