--- /dev/null
+#!/bin/bash
+##############################################################################
+# Copyright (c) 2017 Nokia and others.
+#
+# All rights reserved. This program and the accompanying materials
+# are made available under the terms of the Apache License, Version 2.0
+# which accompanies this distribution, and is available at
+# http://www.apache.org/licenses/LICENSE-2.0
+##############################################################################
+# A script to create virtual hosts in Apache2 to proxy communication
+# to the web dashboards/consoles which might be on private networks. In case
+# of frequent access to these services, this approach is simpler than using
+# SSH tunneling each time.
+# Additionally, this script creates a customized homepage for the jumphost
+# with links to the dashboards and information about the credentials.
+#
+# Note that this script is meant for test deployments and might pose
+# security risks for other uses (the SSL certificates are not validated,
+# passwords are displayed in plaintext etc).
+#
+# Usage: ./setupproxy.sh [-v] openstack
+# ./setupproxy.sh [-v] kubernetes
+# ./setupproxy.sh --help
+# Options:
+# -v verbose (xtrace)
+#
+# Author: Martin Kulhavy
+##############################################################################
+
+# Imports
+source tools.sh
+
+# Halt on error
+set -e
+
+# CONFIGURATION
+
+## JOID
+JOID_CONFIG_DIR=../../joid_config
+
+## Apache config directories
+A2_DIR=/etc/apache2
+A2_SSL_DIR=$A2_DIR/ssl/joid
+A2_SITES_ENABLED_DIR=$A2_DIR/sites-enabled
+
+## Juju
+JUJU_LOCAL_PORT=17070
+
+## OpenStack
+OS_LOCAL_PORT=17080
+OS_LOCAL_PORT_SSL=17443
+
+# Kubernetes
+KUBE_LOCAL_PORT=17080
+
+# end of CONFIGURATION
+
+# Other global vars
+VERBOSE=false
+MAAS_WUI_PATH='/MAAS'
+MAAS_CREDENTIALS=('ubuntu' 'ubuntu')
+SETUP_JUJU=true
+SETUP_OPENSTACK=false
+SETUP_KUBERNETES=false
+JUJU_GUI_PATH='/gui'
+JUJU_GUI_CREDENTIALS=()
+OS_DB_CREDENTIALS=()
+KUBE_DB_PATH='/ui'
+KUBE_DB_CREDENTIALS=()
+EXTERNAL_HOST=jumphost
+
+
+# Print out usage information and exit.
+# $1 - exit code [optional, default 0]
+usage() {
+ # no xtrace output
+ { set +x; } 2> /dev/null
+
+ echo "Usage: $0 [-v] openstack"
+ echo " $0 [-v] kubernetes"
+ echo " $0 --help"
+ echo "Options:"
+ echo " -v verbose (xtrace)"
+ echo ""
+ echo "Sets up Apache proxy to the Juju and OpenStack or Kubernetes "
+ echo "dashboards, so that they are accessible through the jumphost, "
+ echo "even when on private networks."
+ exit ${1-0}
+}
+
+# Parse the arguments of the script
+# $@ - script arguments
+parse_args() {
+ # Print usage help message if requested
+ if [ "$1" = "help" ] || [ "$1" = "-h" ] || [ "$1" = "--help" ]; then
+ usage
+ fi
+
+ # Parse args
+ if [ "-v" = "$1" ]; then
+ VERBOSE=true
+ shift
+ set -x
+ fi
+
+ if [ "openstack" = "$1" ]; then
+ SETUP_OPENSTACK=true
+ elif [ "kubernetes" = "$1" ]; then
+ SETUP_KUBERNETES=true
+ else
+ usage 1
+ fi
+}
+
+
+# Get a value from a script exporting variables, i.e. consisting of lines
+# in format `export VAR=value`.
+# $1 - filename
+# $2 - variable name
+get_export_var_value() {
+ value=$(cat $1 | grep -Px "export $2=.+" | cut -d '=' -f 2)
+ echo "$value"
+}
+
+
+# Attempt to find the external IP address.
+# Takes the source address for traffic on default route.
+get_external_ip() {
+ # Look for the source IP when trying to request outside address
+ ext_ip=$(ip route get 8.8.8.8 | awk '/src/{print $7}')
+ if [ -n "ext_ip" ]; then
+ EXTERNAL_HOST=$ext_ip
+ fi
+}
+
+
+# Enable Apache mods needed for the proxy.
+enable_mods() {
+ sudo a2enmod proxy
+ sudo a2enmod proxy_http
+ sudo a2enmod rewrite
+ sudo a2enmod deflate
+ sudo a2enmod headers
+ sudo a2enmod ssl
+}
+
+
+# Generate SSL keys and certificate to allow serving content over https.
+generate_ssl_keys_cert() {
+ if [ ! -e $A2_SSL_DIR ]; then
+ sudo mkdir -p $A2_SSL_DIR
+ fi
+ sudo openssl genrsa -out $A2_SSL_DIR/ca.key 2048
+ sudo openssl req -nodes -new \
+ -subj "/C=OS/ST=None/L=None/O=OS/CN=localhost" \
+ -key $A2_SSL_DIR/ca.key -out $A2_SSL_DIR/ca.csr
+ sudo openssl x509 -req -days 365 \
+ -in $A2_SSL_DIR/ca.csr -signkey $A2_SSL_DIR/ca.key \
+ -out $A2_SSL_DIR/ca.crt
+}
+
+
+# Remove the Apache configuration file for the default virtual host.
+remove_default_site() {
+ def_site_conf=$A2_SITES_ENABLED_DIR/000-default.conf
+ if [ -e $def_site_conf ]; then
+ sudo rm $def_site_conf
+ fi
+}
+
+
+# Add a port for Apache to listen on. Only added if not yet present
+# $1 - port number
+add_listening_port() {
+ if [ -z "$1" ]; then
+ echo_error "No port to add specified"
+ exit 1
+ fi
+
+ # Add the port only if not already added
+ if [ $(cat $A2_DIR/ports.conf | grep -Fx "Listen $1" | wc -l) -eq 0 ]; then
+ echo "Listen $1" | sudo tee -a $A2_DIR/ports.conf
+ fi
+}
+
+
+# Setup a proxy for requests to the Juju GUI.
+setup_juju_gui_proxy() {
+ # Get Juju GUI info
+ juju_gui_info=$(juju gui 2>&1)
+ juju_gui_url=$(echo "$juju_gui_info" | grep -Po 'https://[^\s]+')
+ juju_socket=$(echo "$juju_gui_url" | grep -Po 'https://\K[^/]+')
+ JUJU_GUI_PATH=$(echo "$juju_gui_url" | grep -Po 'https://[^/]+\K/.+')
+ juju_gui_username=$(echo "$juju_gui_info" | grep -Po 'username: .+' \
+ | cut -d ' ' -f 2)
+ juju_gui_password=$(echo "$juju_gui_info" | grep -Po 'password: .+' \
+ | cut -d ' ' -f 2)
+ JUJU_GUI_CREDENTIALS=("$juju_gui_username" "$juju_gui_password")
+
+ # Virtual host settings
+ sudo tee "${A2_DIR}/sites-enabled/juju-gui.conf" > /dev/null <<-EOF
+ <VirtualHost *:${JUJU_LOCAL_PORT}>
+ ServerName localhost
+ ServerAlias *
+ SSLEngine On
+ SSLCertificateFile ${A2_SSL_DIR}/ca.crt
+ SSLCertificateKeyFile ${A2_SSL_DIR}/ca.key
+ RewriteEngine On
+ RewriteCond %{HTTP:Connection} Upgrade [NC]
+ RewriteCond %{HTTP:Upgrade} websocket [NC]
+ RewriteRule /(.*) wss://${juju_socket}/\$1 [P,L]
+ SSLProxyEngine on
+ SSLProxyVerify none
+ SSLProxyCheckPeerCN off
+ SSLProxyCheckPeerName off
+ SSLProxyCheckPeerExpire off
+ ProxyPass / https://${juju_socket}/
+ ProxyPassReverse / https://${juju_socket}/
+ </VirtualHost>
+EOF
+
+ # Add the local port to listen on
+ add_listening_port ${JUJU_LOCAL_PORT}
+}
+
+
+# Setup a proxy for requests to the OpenStack dashboard.
+setup_openstack_dashboard_proxy() {
+ # Get OpenStack dashboard info
+ os_ip=$(juju status | awk '/openstack-dashboard\/0/ {print $5}')
+ if [ -z "$os_ip" ]; then
+ echo_error "Unable to find unit openstack-dashboard/0. Is this an OpenStack deployment?"
+ exit 1
+ fi
+
+ # Virtual host settings
+ sudo tee "${A2_DIR}/sites-enabled/openstack-dashboard.conf" > /dev/null \
+ <<-EOF
+ <VirtualHost *:${OS_LOCAL_PORT}>
+ ServerName localhost
+ ServerAlias *
+ ProxyPass / http://${os_ip}/
+ ProxyPassReverse / http://${os_ip}/
+ </VirtualHost>
+ <VirtualHost *:${OS_LOCAL_PORT_SSL}>
+ ServerName localhost
+ ServerAlias *
+ SSLEngine On
+ SSLCertificateFile ${A2_SSL_DIR}/ca.crt
+ SSLCertificateKeyFile ${A2_SSL_DIR}/ca.key
+ SSLProxyEngine on
+ SSLProxyVerify none
+ SSLProxyCheckPeerCN off
+ SSLProxyCheckPeerName off
+ SSLProxyCheckPeerExpire off
+ ProxyPass / https://${os_ip}/
+ ProxyPassReverse / https://${os_ip}/
+ </VirtualHost>
+EOF
+
+ # Add the local ports to listen on
+ add_listening_port ${OS_LOCAL_PORT}
+ add_listening_port ${OS_LOCAL_PORT_SSL}
+
+ # Collect login credentials
+ openrc=${JOID_CONFIG_DIR}/admin-openrc
+ OS_DB_CREDENTIALS[0]=$(get_export_var_value $openrc 'OS_USERNAME')
+ OS_DB_CREDENTIALS[1]=$(get_export_var_value $openrc 'OS_PASSWORD')
+ OS_DB_CREDENTIALS[2]=$(get_export_var_value $openrc 'OS_USER_DOMAIN_NAME')
+}
+
+
+# Attempt to start the Kubernetes Web UI (Dashboard)
+start_kubernetes_dashboard() {
+ # See docs: https://kubernetes.io/docs/tasks/access-application-cluster/web-ui-dashboard/
+
+ machine_num=$(juju status | awk '/kubernetes-master\/0/ {print $4}')
+ if [ -z "$machine_num" ]; then
+ echo_error "Unable to find unit kubernetes-master/0. Is this a Kubernetes deployment?"
+ exit 1
+ fi
+
+ echo "Attempting to start Kubernetes Web UI proxy. A timeout error can be expected here."
+ juju run --machine="$machine_num" --timeout=5s "kubectl proxy --address='' --accept-hosts='' &" || true
+}
+
+
+# Setup a proxy for requests to the Kubernetes dashboard.
+setup_kubernetes_dashboard_proxy() {
+
+ # Get Kubernetes master ip (where dashboard is running)
+ kube_ip=$(juju status | awk '/kubernetes-master\/0/ {print $5}')
+ # Note: Maybe the port discovery can be automated. Port 8001 is default.
+ kube_socket="$kube_ip:8001"
+
+ # Virtual host settings
+ sudo tee "${A2_DIR}/sites-enabled/kubernetes-dashboard.conf" > /dev/null \
+ <<-EOF
+ <VirtualHost *:${KUBE_LOCAL_PORT}>
+ ServerName localhost
+ ServerAlias *
+ ProxyPass / http://${kube_socket}/
+ ProxyPassReverse / http://${kube_socket}/
+ </VirtualHost>
+EOF
+
+ # Add the local port to listen on
+ add_listening_port ${KUBE_LOCAL_PORT}
+}
+
+
+print_info_message() {
+ # no xtrace output
+ { set +x; } 2> /dev/null
+
+ echo ''
+ echo_info -n "JOID deployment overview page";
+ echo " is now accessible on the following url (jumphost):"
+ echo -n " Address: "; echo_info "http://${EXTERNAL_HOST}/"
+ echo ''
+
+ if [ "$SETUP_JUJU" = true ]; then
+ echo_info -n "Juju GUI";
+ echo " is now accessible with the following url and credentials:"
+ echo -n " Address: "; echo_info "https://${EXTERNAL_HOST}:${JUJU_LOCAL_PORT}${JUJU_GUI_PATH}"
+ echo -n " Username: "; echo_info "${JUJU_GUI_CREDENTIALS[0]}"
+ echo -n " Password: "; echo_info "${JUJU_GUI_CREDENTIALS[1]}"
+ echo ''
+ fi
+ if [ "$SETUP_OPENSTACK" = true ]; then
+ echo_info -n "OpenStack dashboard"
+ echo " is now accessible with the following url and credentials:"
+ echo -n " Address: "; echo_info -n "https://${EXTERNAL_HOST}:${OS_LOCAL_PORT_SSL}/";
+ echo -n " or "; echo_info "http://${EXTERNAL_HOST}:${OS_LOCAL_PORT}/"
+ echo -n " Domain: "; echo_info "${OS_DB_CREDENTIALS[2]}"
+ echo -n " User Name: "; echo_info "${OS_DB_CREDENTIALS[0]}"
+ echo -n " Password: "; echo_info "${OS_DB_CREDENTIALS[1]}"
+ echo ''
+ fi
+ if [ "$SETUP_KUBERNETES" = true ]; then
+ echo_info -n "Kubernetes dashboard"
+ echo " is now accessible with the following url and credentials:"
+ echo -n " Address: "; echo_info "http://${EXTERNAL_HOST}:${KUBE_LOCAL_PORT}${KUBE_DB_PATH}";
+ echo " No credentials needed if started on kubernetes-master/0 with command:"
+ echo " kubectl proxy --address='' --accept-hosts='' &"
+ echo ''
+ fi
+
+}
+
+
+# Create a homepage for the jumphost with links to the dashboards
+create_homepage() {
+ # Note: If this function is about to get any more complicated,
+ # it might be worth using template rendering instead.
+
+ juju_origin="10.21.19.100:17070"
+ juju_url="https://10.21.19.100:17070/gui/u/admin/default"
+ os_origin="https://10.21.19.100:17443/"
+ os_url="10.21.19.100:17443"
+ kube_origin="https://10.21.19.100:17443/"
+ kube_url="10.21.19.100:17443"
+
+ sudo tee "/var/www/html/index.html" > /dev/null <<EOF
+ <!doctype html>
+ <html lang="en">
+ <head>
+ <meta charset="utf-8">
+ <title>OPNFV - deployed with JOID</title>
+ <script src="https://cdn.rawgit.com/zenorocha/clipboard.js/v1.7.1/dist/clipboard.min.js"></script>
+ <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/7.0.0/normalize.css" />
+ <style>
+ body { text-align: center; padding-top: 15%; line-height: 1.3;
+ font-size: 14pt; font-family: Helvetica, Arial, sans-serif;
+ color: #383a35; }
+ * { box-sizing: border-box; }
+ #logo { max-width: 600px; margin: auto; }
+ fieldset { display: inline-block; width: 400px; min-height: 150pt;
+ text-align: center; border: 2px solid #383a35;
+ vertical-align: top; }
+ legend { font-size: 16pt; font-weight: bold; padding: 0 5pt; }
+ table { width: 100%; }
+ a { font-weight: bold; text-decoration: none; display: block;
+ padding: 5px; margin: 10px; }
+ a:hover, a:active { background-color: #eef; }
+ th { width: 40%; text-align: right; }
+ td { width: 60%; text-align: left; }
+ input { width: 170px; height: 16pt; color: #000; background: #fff;
+ border: 1px solid #ddd; vertical-align: bottom; }
+ button.copy { width: 16pt; height: 16pt; vertical-align: bottom;
+ background: white url('https://cdnjs.cloudflare.com/ajax/libs/octicons/4.4.0/svg/clippy.svg') no-repeat center; }
+ p { font-size: 12pt; text-align: left; }
+ pre { font-size: 10pt }
+ </style>
+ </head>
+ <body>
+ <img src="https://www.opnfv.org/wp-content/uploads/sites/12/2016/11/opnfv_logo_wp.png"
+ id="logo" alt="OPNFV logo" />
+ <h1>Deployed with JOID</h1>
+EOF
+
+ # MAAS info box
+ origin="${EXTERNAL_HOST}:80"
+ url="http://${origin}${MAAS_WUI_PATH}"
+ user="${MAAS_CREDENTIALS[0]}"
+ pass="${MAAS_CREDENTIALS[1]}"
+ sudo tee -a "/var/www/html/index.html" > /dev/null <<EOF
+ <fieldset><legend>MAAS dashboard</legend>
+ <a href="${url}" target="_blank" title="Open MAAS dashboard">${origin}</a>
+ <table><tr><th>Username:</th><td><input type="text" id="maas-user" value="${user}"
+ /><button class="copy" data-clipboard-target="#maas-user"></button></td></tr>
+ <tr><th>Password:</th><td><input type="text" id="maas-pass" value="${pass}"
+ /><button class="copy" data-clipboard-target="#maas-pass"></button></td></tr>
+ </tbody></table>
+ </fieldset>
+EOF
+
+ if [ "$SETUP_JUJU" = true ]; then
+ origin="${EXTERNAL_HOST}:${JUJU_LOCAL_PORT}"
+ url="https://${origin}${JUJU_GUI_PATH}"
+ user="${JUJU_GUI_CREDENTIALS[0]}"
+ pass="${JUJU_GUI_CREDENTIALS[1]}"
+ sudo tee -a "/var/www/html/index.html" > /dev/null <<EOF
+ <fieldset><legend>Juju GUI</legend>
+ <a href="${url}" target="_blank" title="Open Juju GUI">${origin}</a>
+ <table><tr><th>Username:</th><td><input type="text" id="juju-user" value="${user}"
+ /><button class="copy" data-clipboard-target="#juju-user"></button></td></tr>
+ <tr><th>Password:</th><td><input type="text" id="juju-pass" value="${pass}"
+ /><button class="copy" data-clipboard-target="#juju-pass"></button></td></tr>
+ </table>
+ </fieldset>
+EOF
+ fi
+
+ if [ "$SETUP_OPENSTACK" = true ]; then
+ origin="${EXTERNAL_HOST}:${OS_LOCAL_PORT_SSL}"
+ url="https://${origin}/"
+ user="${OS_DB_CREDENTIALS[0]}"
+ pass="${OS_DB_CREDENTIALS[1]}"
+ domain="${OS_DB_CREDENTIALS[2]}"
+ sudo tee -a "/var/www/html/index.html" > /dev/null <<EOF
+ <fieldset><legend>OpenStack dashboard</legend>
+ <a href="${url}" target="_blank" title="Open OpenStack dashboard">${origin}</a>
+ <table><tr><th>Domain:</th><td><input type="text" id="os-domain" value="${domain}"
+ /><button class="copy" data-clipboard-target="#os-domain"></button></td></tr>
+ <tr><th>User Name:</th><td><input type="text" id="os-user" value="${user}"
+ /><button class="copy" data-clipboard-target="#os-user"></button></td></tr>
+ <tr><th>Password:</th><td><input type="text" id="os-pass" value="${pass}"
+ /><button class="copy" data-clipboard-target="#os-pass"></button></td></tr>
+ </table>
+ </fieldset>
+EOF
+ fi
+
+ if [ "$SETUP_KUBERNETES" = true ]; then
+ origin="${EXTERNAL_HOST}:${KUBE_LOCAL_PORT}"
+ url="http://${origin}${KUBE_DB_PATH}"
+ user="${KUBE_DB_CREDENTIALS[0]}"
+ pass="${KUBE_DB_CREDENTIALS[1]}"
+ sudo tee -a "/var/www/html/index.html" > /dev/null <<EOF
+ <fieldset><legend>Kubernetes dashboard</legend>
+ <a href="${url}" target="_blank" title="Open Kubernetes dashboard">${origin}</a>
+ <div>
+ <p>No credentials needed if started with command</p>
+ <pre>kubectl proxy --address='' --accept-hosts='' &</pre>
+ </div>
+ </fieldset>
+EOF
+ fi
+
+ sudo tee -a "/var/www/html/index.html" > /dev/null <<EOF
+ <script>new Clipboard('button.copy');</script>
+ </body>
+ </html>
+EOF
+}
+
+
+main() {
+ # Do not run script as root (causes later permission issues with Juju)
+ if [ "$(id -u)" == "0" ]; then
+ echo_error "Must not be run with sudo or by root"
+ exit 77
+ fi
+
+ parse_args "$@"
+
+ get_external_ip
+
+ echo_info "Enabling Apache mods"
+ enable_mods
+
+ echo_info "Generating SSL keys and certificates"
+ generate_ssl_keys_cert
+
+ remove_default_site
+
+ if [ "$SETUP_JUJU" = true ]; then
+ echo_info "Setting up proxy configuration for Juju GUI"
+ setup_juju_gui_proxy
+ fi
+ if [ "$SETUP_OPENSTACK" = true ]; then
+ echo_info "Setting up proxy configuration for OpenStack dashboard"
+ setup_openstack_dashboard_proxy
+ fi
+ if [ "$SETUP_KUBERNETES" = true ]; then
+ echo_info "Starting Kubernetes dashboard"
+ start_kubernetes_dashboard
+ echo_info "Setting up proxy configuration for Kubernetes dashboard"
+ setup_kubernetes_dashboard_proxy
+ fi
+
+ echo_info "Creating the homepage for jumphost"
+ create_homepage
+
+
+ echo_info "Restarting HTTP server"
+ sudo service apache2 restart
+
+ # Print info message
+ echo_info "Setup finished."
+ print_info_message
+}
+
+# Start the script with the main() function
+main "$@"
Code Review / joid.git / commitdiff