mirror of
https://github.com/xcat2/confluent.git
synced 2025-01-15 12:17:47 +00:00
77de3ab25b
While confluent shouldn't put anything sensitive in the log, custom content may. To mitigate the risk, it will now lock down the log permissions.
39 lines
1.7 KiB
Bash
39 lines
1.7 KiB
Bash
#!/bin/sh
|
|
|
|
# This script is executed 'chrooted' into a cloned disk target before rebooting
|
|
#
|
|
|
|
nodename=$(grep ^NODENAME /etc/confluent/confluent.info|awk '{print $2}')
|
|
confluent_apikey=$(cat /etc/confluent/confluent.apikey)
|
|
confluent_mgr=$(grep ^deploy_server: /etc/confluent/confluent.deploycfg|awk '{print $2}')
|
|
confluent_profile=$(grep ^profile: /etc/confluent/confluent.deploycfg|awk '{print $2}')
|
|
export nodename confluent_mgr confluent_profile
|
|
. /etc/confluent/functions
|
|
mkdir -p /var/log/confluent
|
|
exec >> /var/log/confluent/confluent-post.log
|
|
exec 2>> /var/log/confluent/confluent-post.log
|
|
chmod 600 /var/log/confluent/confluent-post.log
|
|
tail -f /var/log/confluent/confluent-post.log > /dev/console &
|
|
logshowpid=$!
|
|
curl -f https://$confluent_mgr/confluent-public/os/$confluent_profile/scripts/firstboot.service > /etc/systemd/system/firstboot.service
|
|
mkdir -p /opt/confluent/bin
|
|
curl -f https://$confluent_mgr/confluent-public/os/$confluent_profile/scripts/firstboot.sh > /opt/confluent/bin/firstboot.sh
|
|
chmod +x /opt/confluent/bin/firstboot.sh
|
|
systemctl enable firstboot
|
|
selinuxpolicy=$(grep ^SELINUXTYPE /etc/selinux/config |awk -F= '{print $2}')
|
|
if [ ! -z "$selinuxpolicy" ]; then
|
|
setfiles /etc/selinux/${selinuxpolicy}/contexts/files/file_contexts /etc/
|
|
fi
|
|
run_remote_python syncfileclient
|
|
run_remote post.custom
|
|
# post scripts may be placed into post.d, e.g. post.d/01-firstaction.sh, post.d/02-secondaction.sh
|
|
run_remote_parts post.d
|
|
|
|
# Induce execution of remote configuration, e.g. ansible plays in ansible/post.d/
|
|
run_remote_config post.d
|
|
|
|
curl -sf -X POST -d 'status: staged' -H "CONFLUENT_NODENAME: $nodename" -H "CONFLUENT_APIKEY: $confluent_apikey" https://$confluent_mgr/confluent-api/self/updatestatus
|
|
|
|
kill $logshowpid
|
|
|