3 # Used environment variables:
7 # - DirectoryManagerPassword
11 # - ProvisioningCIDR: If set, it adds the given CIDR to the provisioning
12 # interface (which is hardcoded to eth1)
13 # - UsingNovajoin: If unset, we pre-provision the service principals
14 # needed for the overcloud deploy. If set, we skip this,
15 # since novajoin will do it.
19 if [ -f "~/freeipa-setup.env" ]; then
20 source ~/freeipa-setup.env
21 elif [ -f "/tmp/freeipa-setup.env" ]; then
22 source /tmp/freeipa-setup.env
25 export Hostname=${Hostname:-""}
26 export FreeIPAIP=${FreeIPAIP:-""}
27 export DirectoryManagerPassword=${DirectoryManagerPassword:-""}
28 export AdminPassword=${AdminPassword:-""}
29 export UndercloudFQDN=${UndercloudFQDN:-""}
30 export HostsSecret=${HostsSecret:-""}
31 export ProvisioningCIDR=${ProvisioningCIDR:-""}
32 export UsingNovajoin=${UsingNovajoin:-""}
34 if [ -n "$ProvisioningCIDR" ]; then
35 # Add address to provisioning network interface
36 ip link set dev eth1 up
37 ip addr add $ProvisioningCIDR dev eth1
41 echo "nameserver 8.8.8.8" >> /etc/resolv.conf
42 echo "nameserver 8.8.4.4" >> /etc/resolv.conf
44 yum -q -y remove openstack-dashboard
46 # Install the needed packages
47 yum -q install -y ipa-server ipa-server-dns epel-release rng-tools mod_nss git
48 yum -q install -y haveged
51 hostnamectl set-hostname --static $Hostname
53 echo $FreeIPAIP `hostname` | tee -a /etc/hosts
56 cat << EOF > freeipa-iptables-rules.txt
57 # Firewall configuration written by system-config-firewall
58 # Manual customization of this file is not recommended.
63 -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
64 -A INPUT -p icmp -j ACCEPT
65 -A INPUT -i lo -j ACCEPT
66 -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
67 #TCP ports for FreeIPA
68 -A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
69 -A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
70 -A INPUT -m state --state NEW -m tcp -p tcp --dport 389 -j ACCEPT
71 -A INPUT -m state --state NEW -m tcp -p tcp --dport 636 -j ACCEPT
72 -A INPUT -m state --state NEW -m tcp -p tcp --dport 88 -j ACCEPT
73 -A INPUT -m state --state NEW -m tcp -p tcp --dport 464 -j ACCEPT
74 -A INPUT -m state --state NEW -m tcp -p tcp --dport 53 -j ACCEPT
75 #UDP ports for FreeIPA
76 -A INPUT -m state --state NEW -m udp -p udp --dport 88 -j ACCEPT
77 -A INPUT -m state --state NEW -m udp -p udp --dport 464 -j ACCEPT
78 -A INPUT -m state --state NEW -m udp -p udp --dport 123 -j ACCEPT
79 -A INPUT -m state --state NEW -m udp -p udp --dport 53 -j ACCEPT
80 -A INPUT -j REJECT --reject-with icmp-host-prohibited
81 -A FORWARD -j REJECT --reject-with icmp-host-prohibited
85 iptables-restore < freeipa-iptables-rules.txt
87 # Entropy generation; otherwise, ipa-server-install will lag.
89 systemctl start haveged
91 # Remove conflicting httpd configuration
92 rm -f /etc/httpd/conf.d/ssl.conf
95 ipa-server-install -U -r `hostname -d|tr "[a-z]" "[A-Z]"` \
96 -p $DirectoryManagerPassword -a $AdminPassword \
97 --hostname `hostname -f` \
98 --ip-address=$FreeIPAIP \
99 --setup-dns --auto-forwarders --auto-reverse
102 echo $AdminPassword | kinit admin
107 if [ "$?" = '1' ]; then
111 if [ -z "$UsingNovajoin" ]; then
112 # Create undercloud host
113 ipa host-add $UndercloudFQDN --password=$HostsSecret --force
115 # Create overcloud nodes and services
116 git clone https://github.com/JAORMX/freeipa-tripleo-incubator.git
117 cd freeipa-tripleo-incubator
118 python create_ipa_tripleo_host_setup.py -w $HostsSecret -d $(hostname -d) \
119 --controller-count 1 --compute-count 1