baseline.sh revision 5a3c31ca
1#!/bin/bash
2
3# vim: ts=4 sw=4 sts=4 et tw=72 :
4
5# force any errors to cause the script and job to end in failure
6set -xeu -o pipefail
7
8rh_systems() {
9    # Handle the occurance where SELINUX is actually disabled
10    SELINUX=$(grep -E '^SELINUX=(disabled|permissive|enforcing)$' /etc/selinux/config)
11    MODE=$(echo "$SELINUX" | cut -f 2 -d '=')
12    case "$MODE" in
13        permissive)
14            echo "************************************"
15            echo "** SYSTEM ENTERING ENFORCING MODE **"
16            echo "************************************"
17            # make sure that the filesystem is properly labelled.
18            # it could be not fully labeled correctly if it was just switched
19            # from disabled, the autorelabel misses some things
20            # skip relabelling on /dev as it will generally throw errors
21            restorecon -R -e /dev /
22
23            # enable enforcing mode from the very start
24            setenforce enforcing
25
26            # configure system for enforcing mode on next boot
27            sed -i 's/SELINUX=permissive/SELINUX=enforcing/' /etc/selinux/config
28        ;;
29        disabled)
30            sed -i 's/SELINUX=disabled/SELINUX=permissive/' /etc/selinux/config
31            touch /.autorelabel
32
33            echo "*******************************************"
34            echo "** SYSTEM REQUIRES A RESTART FOR SELINUX **"
35            echo "*******************************************"
36        ;;
37        enforcing)
38            echo "*********************************"
39            echo "** SYSTEM IS IN ENFORCING MODE **"
40            echo "*********************************"
41        ;;
42    esac
43
44    echo "---> Updating operating system"
45    yum clean all
46    yum install -y deltarpm
47    yum update -y
48
49    # add in components we need or want on systems
50    echo "---> Installing base packages"
51    yum install -y @base https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
52    # separate group installs from package installs since a non-existing
53    # group with dnf based systems (F21+) will fail the install if such
54    # a group does not exist
55    yum install -y unzip xz puppet git git-review perl-XML-XPath wget make
56
57    # All of our systems require Java (because of Jenkins)
58    # Install all versions of the OpenJDK devel but force 1.7.0 to be the
59    # default
60
61    echo "---> Configuring OpenJDK"
62    yum install -y 'java-*-openjdk-devel'
63
64    FACTER_OS=$(/usr/bin/facter operatingsystem)
65    FACTER_OSVER=$(/usr/bin/facter operatingsystemrelease)
66    case "$FACTER_OS" in
67        Fedora)
68            if [ "$FACTER_OSVER" -ge "21" ]
69            then
70                echo "---> not modifying java alternatives as OpenJDK 1.7.0 does not exist"
71            else
72                alternatives --set java /usr/lib/jvm/jre-1.7.0-openjdk.x86_64/bin/java
73                alternatives --set java_sdk_openjdk /usr/lib/jvm/java-1.7.0-openjdk.x86_64
74            fi
75        ;;
76        RedHat|CentOS)
77            if [ "$(echo $FACTER_OSVER | cut -d'.' -f1)" -ge "7" ]
78            then
79                echo "---> not modifying java alternatives as OpenJDK 1.7.0 does not exist"
80            else
81                alternatives --set java /usr/lib/jvm/jre-1.7.0-openjdk.x86_64/bin/java
82                alternatives --set java_sdk_openjdk /usr/lib/jvm/java-1.7.0-openjdk.x86_64
83            fi
84        ;;
85        *)
86            alternatives --set java /usr/lib/jvm/jre-1.7.0-openjdk.x86_64/bin/java
87            alternatives --set java_sdk_openjdk /usr/lib/jvm/java-1.7.0-openjdk.x86_64
88        ;;
89    esac
90
91    # Needed to parse OpenStack commands used by infra stack commands
92    # to initialize Heat template based systems.
93    yum install -y jq
94}
95
96ubuntu_systems() {
97    # Ignore SELinux since slamming that onto Ubuntu leads to
98    # frustration
99
100    export DEBIAN_FRONTEND=noninteractive
101    cat <<EOF >> /etc/apt/apt.conf
102APT {
103  Get {
104    Assume-Yes "true";
105    allow-change-held-packages "true";
106    allow-downgrades "true";
107    allow-remove-essential "true";
108  };
109};
110
111Dpkg::Options {
112  "--force-confdef";
113  "--force-confold";
114};
115
116EOF
117
118    # Wrap apt-get to wait for the lock to become available for operation
119    # http://askubuntu.com/questions/132059/how-to-make-a-package-manager-wait-if-another-instance-of-apt-is-running
120    cat << 'EOF' >> /usr/local/bin/apt-get
121#!/bin/bash
122
123i=0
124tput sc
125LOCKFILES="/var/lib/dpkg/lock /var/lib/apt/lists/lock"
126WASLOCKED=0
127while [ fuser ${LOCKFILES} >/dev/null 2>&1 ]; do
128    WASLOCKED=$?
129    case $(($i % 4)) in
130        0 ) j="-" ;;
131        1 ) j="\\" ;;
132        2 ) j="|" ;;
133        3 ) j="/" ;;
134    esac
135    tput rc
136    echo -en "\r[$j] Waiting for other software managers to finish..."
137    sleep 0.5
138    ((i=i+1))
139done
140
141if [ $WASLOCKED==0 ]
142then
143  /usr/bin/apt-get "$@"
144else
145  exec /usr/local/bin/apt-get "$@"
146fi
147
148EOF
149    chmod +x /usr/local/bin/apt-get
150
151    echo "---> Updating operating system"
152    apt-get update
153    apt-get upgrade
154
155    # add in stuff we know we need
156    echo "---> Installing base packages"
157    apt-get install unzip xz-utils puppet git git-review libxml-xpath-perl make wget
158
159    # install Java 7
160    echo "---> Configuring OpenJDK"
161    FACTER_OSVER=$(/usr/bin/facter operatingsystemrelease)
162    case "$FACTER_OSVER" in
163        14.04)
164            apt-get install openjdk-7-jdk
165            # make jdk8 available
166            add-apt-repository -y ppa:openjdk-r/ppa
167            apt-get update
168            # We need to force openjdk-8-jdk to install
169            apt-get install openjdk-8-jdk
170            # make sure that we still default to openjdk 7
171            update-alternatives --set java /usr/lib/jvm/java-7-openjdk-amd64/jre/bin/java
172            update-alternatives --set javac /usr/lib/jvm/java-7-openjdk-amd64/bin/javac
173
174            # disable auto-update service?
175            if [ -f /etc/cron.daily/apt ]
176            then
177                rm -rf /etc/cron.daily/apt
178            fi
179        ;;
180        16.04)
181            apt-get install openjdk-8-jdk
182
183            # force auto-update services off and mask them so they can't
184            # be started
185            for i in apt-daily.{service,timer}
186            do
187                systemctl disable ${i}
188                systemctl mask ${i}
189            done
190        ;;
191        *)
192            echo "---> Unknown Ubuntu version $FACTER_OSVER"
193            exit 1
194        ;;
195    esac
196
197
198
199    # Needed to parse OpenStack commands used by infra stack commands
200    # to initialize Heat template based systems.
201    apt-get install jq
202
203    # disable unattended upgrades & daily updates
204    echo '---> Disabling automatic daily upgrades'
205    grep -lR 'APT::Periodic' /etc/apt/apt.conf.d/ | perl -pi -e 's/"1"/"0"/g'
206
207}
208
209all_systems() {
210    # Allow jenkins access to update-alternatives command to switch java version
211    cat <<EOF >/etc/sudoers.d/89-jenkins-user-defaults
212Defaults:jenkins !requiretty
213jenkins ALL = NOPASSWD: /usr/bin/update-alternatives
214EOF
215
216    # Enable Hugepages
217    puppet module install thias-sysctl --version 1.0.6
218    puppet apply -e "sysctl {'vm.nr_hugepages': value => '128'}"
219    puppet apply -e "file { '/mnt/huge': ensure => directory }"
220    puppet apply -e "mount { '/mnt/huge': ensure => mounted, atboot => true, \
221      device => 'none', fstype => 'hugetlbfs', options => 'mode=01777' }"
222
223    # Do any Distro specific installations here
224    echo "Checking distribution"
225    FACTER_OS=$(/usr/bin/facter operatingsystem)
226    case "$FACTER_OS" in
227        *)
228            echo "---> $FACTER_OS found"
229            echo "No extra steps for $FACTER_OS"
230        ;;
231    esac
232}
233
234echo "---> Attempting to detect OS"
235# upstream cloud images use the distro name as the initial user
236ORIGIN=$(if [ -e /etc/redhat-release ]
237    then
238        echo redhat
239    else
240        echo ubuntu
241    fi)
242#ORIGIN=$(logname)
243
244case "${ORIGIN}" in
245    fedora|centos|redhat)
246        echo "---> RH type system detected"
247        rh_systems
248    ;;
249    ubuntu)
250        echo "---> Ubuntu system detected"
251        ubuntu_systems
252    ;;
253    *)
254        echo "---> Unknown operating system"
255    ;;
256esac
257
258# execute steps for all systems
259all_systems
260