coren has submitted this change and it was merged.
Change subject: Add cron for manage-keys.
......................................................................
Add cron for manage-keys.
Manage-keys will run on the labs nfs server and ensure that
the keys in /keys correspond to those in ldap.
Change-Id: Ia08a330c90b628197b8bb835542aff7ac50e67b9
---
M manifests/openstack.pp
A modules/ldap/files/scripts/manage-keys-nfs
M modules/ldap/manifests/client.pp
3 files changed, 137 insertions(+), 0 deletions(-)
Approvals:
coren: Looks good to me, approved
jenkins-bot: Verified
diff --git a/manifests/openstack.pp b/manifests/openstack.pp
index 9c8206e..1937963 100644
--- a/manifests/openstack.pp
+++ b/manifests/openstack.pp
@@ -144,6 +144,16 @@
ensure => running,
require => Generic::Upstart_job["manage-volumes"];
}
+
+ if ($::site == 'eqiad') {
+ cron { "Update labs ssh keys":
+ ensure => present,
+ user => root,
+ command => '/usr/local/sbin/manage-keys-nfs
--logfile=/var/log/manage-keys.log >/dev/null 2>&1',
+ hour => '*',
+ minute => '*/5',
+ }
+ }
}
class openstack::project-nfs-storage-service {
diff --git a/modules/ldap/files/scripts/manage-keys-nfs
b/modules/ldap/files/scripts/manage-keys-nfs
new file mode 100755
index 0000000..9487c6b
--- /dev/null
+++ b/modules/ldap/files/scripts/manage-keys-nfs
@@ -0,0 +1,120 @@
+#!/usr/bin/python
+
+#####################################################################
+### THIS FILE IS MANAGED BY PUPPET
+### puppet:///files/ldap/scripts/manage-keys-nfs
+#####################################################################
+
+
+import sys
+import traceback
+import ldapsupportlib
+import os
+import socket
+import homedirectorymanager
+import datetime
+from optparse import OptionParser
+
+try:
+ import ldap
+ import ldap.modlist
+except ImportError:
+ sys.stderr.write("Unable to import LDAP library.\n")
+
+NONE = 0
+INFO = 10
+DEBUG = 20
+
+
+class ExportManager:
+ def __init__(self):
+ self.keysdir = "/srv/keys/"
+ self.loglevel = INFO
+ self.logfile = None
+ self.hostname = socket.gethostname()
+
+ def run(self):
+ parser = OptionParser(conflict_handler="resolve")
+ parser.set_usage('manage-exports [options]')
+
+ ldapSupportLib = ldapsupportlib.LDAPSupportLib()
+ ldapSupportLib.addParserOptions(parser)
+
+ parser.add_option("--logfile", dest="logfile", help="Write output to
the specified log file. (default: stdin)")
+ parser.add_option("--loglevel", dest="loglevel", help="Change level of
logging; NONE, INFO, DEBUG (default: INFO)")
+ (options, args) = parser.parse_args()
+ ldapSupportLib.setBindInfoByOptions(options, parser)
+
+ if options.logfile:
+ self.logfile = options.logfile
+ if options.loglevel:
+ self.loglevel = options.loglevel
+
+ base = ldapSupportLib.getBase()
+ ds = ldapSupportLib.connect()
+
+ # w00t We're in!
+ try:
+
+ # Grab keys
+ usersdata = ldapSupportLib.getUsers(ds, '*')
+ if not usersdata:
+ raise ldap.NO_SUCH_OBJECT()
+
+ # Should there be something here to ensure that keysdir is actually
+ # mounted?
+ if not os.path.exists(self.keysdir):
+ raise Exception('keysdir not found')
+ if not os.path.exists(self.keysdir + '/autofs_check'):
+ os.mkdir(self.keysdir + '/autofs_check', 0755)
+ if not os.path.exists(self.keysdir + '/SAVE'):
+ os.mkdir(self.keysdir + '/SAVE', 0755)
+
+ # Hand off the job of writing out keys to homedirectorymanager.py
+ hdm = homedirectorymanager.HomeDirectoryManager()
+ if options.logfile:
+ hdm.logfile = options.logfile
+ if options.loglevel:
+ hdm.loglevel = options.loglevel
+ hdm.setUsersData(usersdata)
+ hdm.basedir = self.keysdir
+ hdm.run()
+ except ldap.NO_SUCH_OBJECT:
+ sys.stderr.write("The key search returned no entries.\n")
+ ds.unbind()
+ return 1
+ except ldap.PROTOCOL_ERROR:
+ sys.stderr.write("There was an LDAP protocol error; see
traceback.\n")
+ traceback.print_exc(file=sys.stderr)
+ ds.unbind()
+ return 1
+ except Exception:
+ try:
+ sys.stderr.write("There was a general error, this is
unexpected; see traceback.\n")
+ traceback.print_exc(file=sys.stderr)
+ ds.unbind()
+ except Exception:
+ sys.stderr.write("Also failed to unbind.\n")
+ traceback.print_exc(file=sys.stderr)
+ return 1
+
+ ds.unbind()
+ return 0
+
+ def log(self, logstring):
+ if self.loglevel >= INFO:
+ log = datetime.datetime.now().strftime("%m/%d/%Y - %H:%M:%S - ") +
logstring + "\n"
+ if self.logfile:
+ lf = open(self.logfile, 'a')
+ lf.write(log)
+ lf.close()
+ else:
+ print log
+
+
+def main():
+ export_manager = ExportManager()
+ export_manager.run()
+
+if __name__ == "__main__":
+ main()
diff --git a/modules/ldap/manifests/client.pp b/modules/ldap/manifests/client.pp
index 5afe9bb..c1fbfc0 100644
--- a/modules/ldap/manifests/client.pp
+++ b/modules/ldap/manifests/client.pp
@@ -197,6 +197,13 @@
source => 'puppet:///modules/ldap/scripts/manage-nfs-volumes-daemon',
}
+ file { '/usr/local/sbin/manage-keys-nfs':
+ owner => 'root',
+ group => 'root',
+ mode => '0544',
+ source => 'puppet:///modules/ldap/scripts/manage-keys-nfs',
+ }
+
file { '/usr/local/sbin/manage-volumes':
ensure => absent,
}
--
To view, visit https://gerrit.wikimedia.org/r/113955
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: Ia08a330c90b628197b8bb835542aff7ac50e67b9
Gerrit-PatchSet: 5
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Andrew Bogott <[email protected]>
Gerrit-Reviewer: coren <[email protected]>
Gerrit-Reviewer: jenkins-bot <>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
