00-core.bu

variant: fcos
version: 1.0.0
passwd:
  groups:
    - name: libvirtd
  users:
    - name: core
      gecos: CoreOS Admin
      groups:
        - sudo
        - wheel
        - adm
        - systemd-journal
    - name: onp
      gecos: OpenShift Network Playground User
      groups:
        - sudo
        - wheel
        - adm
        - systemd-journal
        - libvirtd
      password_hash: $y$j9T$PNaoSZJskJ6WwR/2iS78a0$/6.dOJ1S2UWLMz0F/1mJvNN4dH3EZ1Y68hLfBsODgi0
systemd:
  units:
    - name: systemd-resolved.service
      enabled: false
      mask: true
    - name: zincati.service
      enabled: false
    - name: libvirtd.socket
      enabled: true
    - name: host-configure.service
      enabled: true
      contents: |
        [Unit]
        Wants=network-online.target
        After=network-online.target

        [Service]
        Type=oneshot
        ExecStart=/opt/openshift-network-playground/host/configure.sh
        RemainAfterExit=yes

        [Install]
        WantedBy=basic.target
    - name: master0.service
      enabled: true
      contents: |
        [Unit]
        Wants=libvirtd.socket
        After=libvirtd.socket
        Requires=libvirtd.socket
        ConditionPathExists=!/opt/openshift-network-playground/master0.done

        [Service]
        Timeout=0
        Type=oneshot
        ExecStart=/opt/openshift-network-playground/libvirt/create-vm.sh master0 52:54:00:11:22:b1 52:54:00:11:22:a1
        ExecStartPost=/usr/bin/touch /opt/openshift-network-playground/master0.done
        RemainAfterExit=yes

        [Install]
        WantedBy=basic.target
    - name: master1.service
      enabled: true
      contents: |
        [Unit]
        Wants=libvirtd.socket
        After=libvirtd.socket
        Requires=libvirtd.socket
        ConditionPathExists=!/opt/openshift-network-playground/master1.done

        [Service]
        Timeout=0
        Type=oneshot
        ExecStart=/opt/openshift-network-playground/libvirt/create-vm.sh master1 52:54:00:11:22:b2 52:54:00:11:22:a2
        ExecStartPost=/usr/bin/touch /opt/openshift-network-playground/master1.done
        RemainAfterExit=yes

        [Install]
        WantedBy=basic.target
    - name: master2.service
      enabled: true
      contents: |
        [Unit]
        Wants=libvirtd.socket
        After=libvirtd.socket
        Requires=libvirtd.socket
        ConditionPathExists=!/opt/openshift-network-playground/master2.done

        [Service]
        Timeout=0
        Type=oneshot
        ExecStart=/opt/openshift-network-playground/libvirt/create-vm.sh master2 52:54:00:11:22:b3 52:54:00:11:22:a3
        ExecStartPost=/usr/bin/touch /opt/openshift-network-playground/master2.done
        RemainAfterExit=yes

        [Install]
        WantedBy=basic.target
    - name: worker0.service
      enabled: true
      contents: |
        [Unit]
        Wants=libvirtd.socket
        After=libvirtd.socket
        Requires=libvirtd.socket
        ConditionPathExists=!/opt/openshift-network-playground/worker0.done

        [Service]
        Timeout=0
        Type=oneshot
        ExecStart=/opt/openshift-network-playground/libvirt/create-vm.sh worker0 52:54:00:11:22:b4 52:54:00:11:22:a4 2 8192
        ExecStartPost=/usr/bin/touch /opt/openshift-network-playground/worker0.done
        RemainAfterExit=yes

        [Install]
        WantedBy=basic.target
    - name: worker1.service
      enabled: true
      contents: |
        [Unit]
        Wants=libvirtd.socket
        After=libvirtd.socket
        Requires=libvirtd.socket
        ConditionPathExists=!/opt/openshift-network-playground/worker1.done

        [Service]
        Timeout=0
        Type=oneshot
        ExecStart=/opt/openshift-network-playground/libvirt/create-vm.sh worker1 52:54:00:11:22:b5 52:54:00:11:22:a5 2 8192
        ExecStartPost=/usr/bin/touch /opt/openshift-network-playground/worker1.done
        RemainAfterExit=yes

        [Install]
        WantedBy=basic.target
    - name: webserver.service
      enabled: true
      contents: |
        [Unit]
        Description=Webserver for openshift-network-playground
        Wants=network-online.target
        After=network-online.target
        RequiresMountsFor=%t/containers

        [Service]
        Environment=PODMAN_SYSTEMD_UNIT=%n
        Restart=on-failure
        TimeoutStopSec=70
        ExecStartPre=/bin/rm -f %t/%n.ctr-id
        ExecStart=/usr/bin/podman run \
                --cidfile=%t/%n.ctr-id \
                --cgroups=no-conmon \
                --rm \
                --sdnotify=conmon \
                --replace \
                --detach \
                --net host \
                --name webserver \
                -v /home/onp/openshift-network-playground/rhcos_image_cache:/var/www/html quay.io/centos7/httpd-24-centos7:latest
        ExecStop=/usr/bin/podman stop --ignore --cidfile=%t/%n.ctr-id
        ExecStopPost=/usr/bin/podman rm -f --ignore --cidfile=%t/%n.ctr-id
        Type=notify
        NotifyAccess=all

        [Install]
        WantedBy=default.target
    - name: vbmc.service
      enabled: true
      contents: |
        [Unit]
        Description=vbmc for openshift-network-playground
        Wants=network-online.target
        After=network-online.target
        RequiresMountsFor=%t/containers

        [Service]
        Environment=PODMAN_SYSTEMD_UNIT=%n
        Restart=always
        TimeoutStopSec=70
        TimeoutStartSec=600
        ExecStartPre=/usr/bin/rm -f %t/%n.ctr-id
        ExecStartPre=/usr/bin/rm -vf /opt/openshift-network-playground/vbmc/config/master.pid
        ExecStart=/usr/bin/podman run \
                --cidfile=%t/%n.ctr-id \
                --cgroups=no-conmon \
                --rm \
                --sdnotify=conmon \
                --replace \
                -d \
                -ti \
                --name vbmc \
                --net host \
                --volume "/opt/openshift-network-playground/vbmc/config:/root/.vbmc" \
                --volume "/opt/openshift-network-playground/vbmc/ssh:/root/.ssh" \
                quay.io/metal3-io/vbmc
        ExecStop=/usr/bin/podman stop --ignore --cidfile=%t/%n.ctr-id
        ExecStopPost=/usr/bin/podman rm -f --ignore --cidfile=%t/%n.ctr-id
        Type=notify
        NotifyAccess=all

        [Install]
        WantedBy=default.target
    - name: dhcp.service
      enabled: true
      contents: |
        [Unit]
        Description=DHCP for openshift-network-playground
        Wants=network-online.target
        After=network-online.target
        RequiresMountsFor=%t/containers

        [Service]
        Environment=PODMAN_SYSTEMD_UNIT=%n
        Restart=always
        TimeoutStartSec=180
        TimeoutStopSec=70
        ExecStartPre=-/usr/bin/rm -f %t/%n.ctr-id
        ExecStartPre=/usr/bin/podman build --net host --tag localhost/dhcp /opt/openshift-network-playground/dhcp
        ExecStart=/usr/bin/podman run --cidfile=%t/%n.ctr-id --cgroups=no-conmon --rm --sdnotify=conmon --name dhcp -d --net host --cap-add NET_ADMIN,NET_RAW localhost/dhcp
        ExecStop=/usr/bin/podman stop --ignore --cidfile=%t/%n.ctr-id
        ExecStopPost=/usr/bin/podman rm -f --ignore --cidfile=%t/%n.ctr-id
        Type=notify
        NotifyAccess=all

        [Install]
        WantedBy=default.target
    - name: onp1-dhcp.service
      enabled: false
      contents: |
        [Unit]
        Description=DHCP for openshift-network-playground
        Wants=network-online.target
        After=network-online.target
        RequiresMountsFor=%t/containers

        [Service]
        Environment=PODMAN_SYSTEMD_UNIT=%n
        Restart=always
        TimeoutStartSec=180
        TimeoutStopSec=70
        ExecStartPre=-/usr/bin/rm -f %t/%n.ctr-id
        ExecStartPre=/usr/bin/podman build --net host --tag localhost/onp1-dhcp /opt/openshift-network-playground/onp1-dhcp
        ExecStart=/usr/bin/podman run --cidfile=%t/%n.ctr-id --cgroups=no-conmon --rm --sdnotify=conmon --name onp1-dhcp -d --net host --cap-add NET_ADMIN,NET_RAW localhost/onp1-dhcp
        ExecStop=/usr/bin/podman stop --ignore --cidfile=%t/%n.ctr-id
        ExecStopPost=/usr/bin/podman rm -f --ignore --cidfile=%t/%n.ctr-id
        Type=notify
        NotifyAccess=all

        [Install]
        WantedBy=default.target
    - name: onp2-dhcp.service
      enabled: false
      contents: |
        [Unit]
        Description=DHCP for openshift-network-playground
        Wants=network-online.target
        After=network-online.target
        RequiresMountsFor=%t/containers

        [Service]
        Environment=PODMAN_SYSTEMD_UNIT=%n
        Restart=always
        TimeoutStartSec=180
        TimeoutStopSec=70
        ExecStartPre=-/usr/bin/rm -f %t/%n.ctr-id
        ExecStartPre=/usr/bin/podman build --net host --tag localhost/onp2-dhcp /opt/openshift-network-playground/onp2-dhcp
        ExecStart=/usr/bin/podman run --cidfile=%t/%n.ctr-id --cgroups=no-conmon --rm --sdnotify=conmon --name onp2-dhcp -d --net host --cap-add NET_ADMIN,NET_RAW localhost/onp2-dhcp
        ExecStop=/usr/bin/podman stop --ignore --cidfile=%t/%n.ctr-id
        ExecStopPost=/usr/bin/podman rm -f --ignore --cidfile=%t/%n.ctr-id
        Type=notify
        NotifyAccess=all

        [Install]
        WantedBy=default.target
    - name: pxe.service
      enabled: false
      contents: |
        [Unit]
        Description=PXE for openshift-network-playground
        Wants=network-online.target
        After=network-online.target
        RequiresMountsFor=%t/containers

        [Service]
        Environment=PODMAN_SYSTEMD_UNIT=%n
        Restart=always
        TimeoutStartSec=180
        TimeoutStopSec=70
        ExecStartPre=-/usr/bin/rm -f %t/%n.ctr-id
        ExecStartPre=/usr/bin/podman build --net host --tag localhost/pxe /opt/openshift-network-playground/pxe
        ExecStart=/usr/bin/podman run --cidfile=%t/%n.ctr-id --cgroups=no-conmon --rm --sdnotify=conmon --name pxe -d --net host --cap-add NET_ADMIN,NET_RAW localhost/pxe
        ExecStop=/usr/bin/podman stop --ignore --cidfile=%t/%n.ctr-id
        ExecStopPost=/usr/bin/podman rm -f --ignore --cidfile=%t/%n.ctr-id
        Type=notify
        NotifyAccess=all

        [Install]
        WantedBy=default.target
    - name: broadcast.service
      enabled: true
      contents: |
        [Unit]
        Description=Check containers status
        After=selinux-configure.service

        [Service]
        Timeout=0
        Type=oneshot
        ExecStart=/opt/openshift-network-playground/host/broadcast.sh
        RemainAfterExit=yes

        [Install]
        WantedBy=basic.target
    - name: nat64.service
      enabled: true
      contents: |
        [Unit]
        Description=NAT64 for openshift-network-playground
        Wants=network-online.target
        After=network-online.target
        RequiresMountsFor=%t/containers
        
        [Service]
        Environment=PODMAN_SYSTEMD_UNIT=%n
        Restart=always
        TimeoutStartSec=180
        TimeoutStopSec=70
        ExecStartPre=-/usr/bin/rm -f %t/%n.ctr-id
        ExecStartPre=/usr/bin/podman build --net host --tag localhost/nat64 /opt/openshift-network-playground/nat64
        ExecStart=/usr/bin/podman run --cidfile=%t/%n.ctr-id --cgroups=no-conmon --rm --sdnotify=conmon --name nat64 --detach --net host --privileged localhost/nat64
        ExecStartPost=/opt/openshift-network-playground/nat64/host.sh
        ExecStop=/usr/bin/podman stop --ignore --cidfile=%t/%n.ctr-id
        ExecStopPost=/usr/bin/podman rm -f --ignore --cidfile=%t/%n.ctr-id
        Type=notify
        NotifyAccess=all
        
        [Install]
        WantedBy=default.target
    - name: dns64.service
      enabled: true
      contents: |
        [Unit]
        Description=DNS64 for openshift-network-playground
        Wants=network-online.target
        After=network-online.target
        RequiresMountsFor=%t/containers
        
        [Service]
        Environment=PODMAN_SYSTEMD_UNIT=%n
        Restart=always
        TimeoutStartSec=180
        TimeoutStopSec=70
        ExecStartPre=-/usr/bin/rm -f %t/%n.ctr-id
        ExecStartPre=/usr/bin/podman build --net host --tag localhost/dns64 /opt/openshift-network-playground/dns64
        ExecStart=/usr/bin/podman run --cidfile=%t/%n.ctr-id --cgroups=no-conmon --rm --sdnotify=conmon --name dns64 -d --net host --cap-add NET_ADMIN,NET_RAW localhost/dns64
        ExecStop=/usr/bin/podman stop --ignore --cidfile=%t/%n.ctr-id
        ExecStopPost=/usr/bin/podman rm -f --ignore --cidfile=%t/%n.ctr-id
        Type=notify
        NotifyAccess=all
        
        [Install]
        WantedBy=default.target
    - name: proxy.service
      enabled: true
      contents: |
        [Unit]
        Description=Proxy for openshift-network-playground
        Wants=network-online.target
        After=network-online.target
        RequiresMountsFor=%t/containers
        
        [Service]
        Environment=PODMAN_SYSTEMD_UNIT=%n
        Restart=always
        TimeoutStartSec=180
        TimeoutStopSec=70
        ExecStartPre=-/usr/bin/rm -f %t/%n.ctr-id
        ExecStartPre=/usr/bin/podman build --net host --tag localhost/proxy /opt/openshift-network-playground/proxy
        ExecStart=/usr/bin/podman run --cidfile=%t/%n.ctr-id --cgroups=no-conmon --rm --sdnotify=conmon --name proxy -d --net host --volume /opt/openshift-network-playground/proxy/certs:/etc/squid-cert --cap-add NET_ADMIN,NET_RAW localhost/proxy
        ExecStop=/usr/bin/podman stop --ignore --cidfile=%t/%n.ctr-id
        ExecStopPost=/usr/bin/podman rm -f --ignore --cidfile=%t/%n.ctr-id
        Type=notify
        NotifyAccess=all
        
        [Install]
        WantedBy=default.target
storage:
  directories:
    - path: /home/onp/openshift-network-playground
      mode: 0755
      overwrite: true
      user:
        name: onp
      group:
        name: onp
    - path: /home/onp/openshift-network-playground/rhcos_image_cache
      mode: 0755
      overwrite: true
      user:
        name: onp
      group:
        name: onp
    - path: /home/onp/.local/bin
      mode: 0755
      overwrite: true
      user:
        name: onp
      group:
        name: onp
  files:
    - path: /opt/openshift-network-playground/vbmc/ssh/config
      mode: 0644
      overwrite: true
      contents:
        inline: |
          StrictHostKeyChecking no
    - path: /opt/openshift-network-playground/vbmc/config/master0/config
      mode: 0644
      user:
        id: 1001
      group:
        id: 1001
      overwrite: true
      contents:
        inline: |
          [VirtualBMC]
          username = admin
          password = password
          address = 192.168.123.1
          port = 6230
          domain_name = master0
          libvirt_uri = qemu+ssh://onp@192.168.123.1/system
          active = True
    - path: /opt/openshift-network-playground/vbmc/config/master1/config
      mode: 0644
      user:
        id: 1001
      group:
        id: 1001
      overwrite: true
      contents:
        inline: |
          [VirtualBMC]
          username = admin
          password = password
          address = 192.168.123.1
          port = 6231
          domain_name = master1
          libvirt_uri = qemu+ssh://onp@192.168.123.1/system
          active = True
    - path: /opt/openshift-network-playground/vbmc/config/master2/config
      mode: 0644
      user:
        id: 1001
      group:
        id: 1001
      overwrite: true
      contents:
        inline: |
          [VirtualBMC]
          username = admin
          password = password
          address = 192.168.123.1
          port = 6232
          domain_name = master2
          libvirt_uri = qemu+ssh://onp@192.168.123.1/system
          active = True
    - path: /opt/openshift-network-playground/vbmc/config/worker0/config
      mode: 0644
      user:
        id: 1001
      group:
        id: 1001
      overwrite: true
      contents:
        inline: |
          [VirtualBMC]
          username = admin
          password = password
          address = 192.168.123.1
          port = 6233
          domain_name = worker0
          libvirt_uri = qemu+ssh://onp@192.168.123.1/system
          active = True
    - path: /opt/openshift-network-playground/vbmc/config/worker1/config
      mode: 0644
      user:
        id: 1001
      group:
        id: 1001
      overwrite: true
      contents:
        inline: |
          [VirtualBMC]
          username = admin
          password = password
          address = 192.168.123.1
          port = 6234
          domain_name = worker1
          libvirt_uri = qemu+ssh://onp@192.168.123.1/system
          active = True
    - path: /etc/resolv.conf
      mode: 0644
      overwrite: true
      contents:
        inline: ""
    - path: /etc/sudoers.d/onp
      mode: 0644
      overwrite: true
      contents:
        inline: |
          onp ALL=(ALL) NOPASSWD: ALL
    - path: /etc/polkit-1/localauthority/50-local.d/50-onp-libvirt-remote-access.pkla
      mode: 0644
      overwrite: true
      contents:
        inline: |
          [Remote libvirt SSH access]
          Identity=unix-user:onp
          Action=org.libvirt.unix.manage
          ResultAny=yes
          ResultInactive=yes
          ResultActive=yes
    - path: /etc/libvirt/libvirt.conf
      mode: 0644
      overwrite: true
      contents:
        inline: |
          uri_default = "qemu:///system"
    - path: /etc/sysctl.d/99-sysctl.conf
      mode: 0644
      overwrite: true
      contents:
        inline: |
          net.ipv4.ip_forward = 1
    - path: /etc/ssh/sshd_config.d/20-enable-passwords.conf
      mode: 0644
      overwrite: true
      contents:
        inline: |
          PasswordAuthentication yes
    - path: /opt/openshift-network-playground/host/configure.sh
      mode: 0755
      contents:
        inline: |
          #!/bin/sh
          /usr/sbin/iptables -t nat -I POSTROUTING -s 192.168.123.0/24 ! -d 192.168.123.0/24 -j MASQUERADE
          /usr/sbin/iptables -t nat -I POSTROUTING -s 192.168.124.0/24 ! -d 192.168.124.0/24 -j MASQUERADE
          /usr/sbin/iptables -t nat -I POSTROUTING -s 192.168.125.0/24 ! -d 192.168.125.0/24 -j MASQUERADE
          /usr/bin/echo 1 > /proc/sys/net/ipv6/conf/$(ip -o -4 route show default | awk '{print $5}')/disable_ipv6
          /usr/sbin/iptables -t nat -I PREROUTING -p tcp -i $(/usr/sbin/ip r | grep default | awk '{print $5}' | head -n 1) --dport 443 -j DNAT --to-destination 192.168.123.89:443
          /usr/sbin/iptables -t nat -I PREROUTING -p tcp -i $(/usr/sbin/ip r | grep default | awk '{print $5}' | head -n 1) --dport 80 -j DNAT --to-destination 192.168.123.89:80
          /usr/sbin/iptables -t nat -I PREROUTING -p tcp -i $(/usr/sbin/ip r | grep default | awk '{print $5}' | head -n 1) --dport 6443 -j DNAT --to-destination 192.168.123.88:6443
          /usr/bin/test -f /opt/openshift-network-playground/vbmc/ssh/id_rsa || (ssh-keygen -N '' -f /opt/openshift-network-playground/vbmc/ssh/id_rsa && mkdir -p /home/onp/.ssh && cp /opt/openshift-network-playground/vbmc/ssh/id_rsa.pub /home/onp/.ssh/authorized_keys && chown onp:onp -R /home/onp/.ssh)
          /usr/bin/test -f /opt/openshift-network-playground/cockpit-ws.done || (/usr/bin/test -d /usr/share/cockpit && podman container runlabel --name cockpit-ws RUN quay.io/cockpit/ws && podman container runlabel INSTALL quay.io/cockpit/ws && systemctl enable --now cockpit.service && touch /opt/openshift-network-playground/cockpit-ws.done)
          /usr/bin/chown -R onp:onp /home/onp/.local
    - path: /etc/NetworkManager/system-connections/ens3.nmconnection
      mode: 0600
      overwrite: true
      user:
        name: root
      contents:
        inline: |
          [connection]
          id=ens3
          type=ethernet
          autoconnect=yes
          interface-name=ens3
          [ipv4]
          method=auto
          [ipv6]
          method=disabled
    - path: /etc/NetworkManager/system-connections/baremetal-dummy.nmconnection
      mode: 0600
      overwrite: true
      user:
        name: root
      contents:
        inline: |
          [connection]
          id=baremetal-dummy
          type=dummy
          interface-name=baremetal-dummy
          autoconnect=yes
          master=baremetal
          slave-type=bridge
          [ipv4]
          method=link-local
          [ipv6]
          method=disabled
    - path: /etc/NetworkManager/system-connections/baremetal.nmconnection
      mode: 0600
      overwrite: true
      user:
        name: root
      contents:
        inline: |
          [connection]
          id=baremetal
          type=bridge
          autoconnect=yes
          interface-name=baremetal
          [ipv4]
          method=manual
          addresses=192.168.123.1
          [ipv6]
          method=disabled
          [bridge]
          mac-address=52:54:00:11:22:a0
          interface-name=baremetal
    - path: /etc/NetworkManager/system-connections/baremetal-slave.nmconnection
      mode: 0600
      overwrite: true
      user:
        name: root
      contents:
        inline: |
          [connection]
          id=baremetal-slave
          type=ethernet
          interface-name=baremetal-dummy
          master=baremetal
          autoconnect=yes
          slave-type=bridge
    - path: /etc/NetworkManager/system-connections/provision-dummy.nmconnection
      mode: 0600
      overwrite: true
      user:
        name: root
      contents:
        inline: |
          [connection]
          id=provision-dummy
          type=dummy
          interface-name=provision-dummy
          autoconnect=yes
          master=provisioning
          slave-type=bridge
          [ipv4]
          method=link-local
          [ipv6]
          method=disabled
    - path: /etc/NetworkManager/system-connections/provisioning.nmconnection
      mode: 0600
      overwrite: true
      user:
        name: root
      contents:
        inline: |
          [connection]
          id=provisioning
          type=bridge
          interface-name=provisioning
          autoconnect=yes
          [ipv4]
          method=manual
          addresses=172.22.0.254/24
          [ipv6]
          method=disabled
          [bridge]
          mac-address=52:54:00:11:22:b0
          interface-name=provisioning
    - path: /etc/NetworkManager/system-connections/provisioning-slave.nmconnection
      mode: 0600
      overwrite: true
      user:
        name: root
      contents:
        inline: |
          [connection]
          id=provisioning-slave
          type=ethernet
          interface-name=provision-dummy
          master=provisioning
          autoconnect=yes
          slave-type=bridge
    - path: /etc/NetworkManager/system-connections/onp1-dummy.nmconnection
      mode: 0600
      overwrite: true
      user:
        name: root
      contents:
        inline: |
          [connection]
          id=onp1-dummy
          type=dummy
          interface-name=onp1-dummy
          autoconnect=yes
          master=onp1
          slave-type=bridge
          [ipv4]
          method=link-local
          [ipv6]
          method=disabled
    - path: /etc/NetworkManager/system-connections/onp1.nmconnection
      mode: 0600
      overwrite: true
      user:
        name: root
      contents:
        inline: |
          [connection]
          id=onp1
          type=bridge
          autoconnect=yes
          interface-name=onp1
          [ipv4]
          method=manual
          addresses=192.168.124.1
          [ipv6]
          method=disabled
          [bridge]
          mac-address=52:54:00:11:22:c0
          interface-name=onp1
    - path: /etc/NetworkManager/system-connections/onp1-slave.nmconnection
      mode: 0600
      overwrite: true
      user:
        name: root
      contents:
        inline: |
          [connection]
          id=onp1-slave
          type=ethernet
          interface-name=onp1-dummy
          master=onp1
          autoconnect=yes
          slave-type=bridge
    - path: /etc/NetworkManager/system-connections/onp2-dummy.nmconnection
      mode: 0600
      overwrite: true
      user:
        name: root
      contents:
        inline: |
          [connection]
          id=onp2-dummy
          type=dummy
          interface-name=onp2-dummy
          autoconnect=yes
          master=onp2
          slave-type=bridge
          [ipv4]
          method=link-local
          [ipv6]
          method=disabled
    - path: /etc/NetworkManager/system-connections/onp2.nmconnection
      mode: 0600
      overwrite: true
      user:
        name: root
      contents:
        inline: |
          [connection]
          id=onp2
          type=bridge
          autoconnect=yes
          interface-name=onp2
          [ipv4]
          method=manual
          addresses=192.168.125.1
          [ipv6]
          method=disabled
          [bridge]
          mac-address=52:54:00:11:22:d0
          interface-name=onp2
    - path: /etc/NetworkManager/system-connections/onp2-slave.nmconnection
      mode: 0600
      overwrite: true
      user:
        name: root
      contents:
        inline: |
          [connection]
          id=onp2-slave
          type=ethernet
          interface-name=onp2-dummy
          master=onp2
          autoconnect=yes
          slave-type=bridge
    - path: /etc/NetworkManager/system-connections/sno0-dummy.nmconnection
      mode: 0600
      overwrite: true
      user:
        name: root
      contents:
        inline: |
          [connection]
          id=sno0-dummy
          type=dummy
          interface-name=sno0-dummy
          autoconnect=yes
          master=sno0
          slave-type=bridge
          [ipv4]
          method=link-local
          [ipv6]
          method=disabled
    - path: /etc/NetworkManager/system-connections/sno0-slave.nmconnection
      mode: 0600
      overwrite: true
      user:
        name: root
      contents:
        inline: |
          [connection]
          id=sno0-slave
          type=ethernet
          interface-name=sno0-dummy
          master=sno0
          autoconnect=yes
          slave-type=bridge
    - path: /etc/NetworkManager/system-connections/sno0.nmconnection
      mode: 0600
      overwrite: true
      user:
        name: root
      contents:
        inline: |
          [connection]
          id=sno0
          type=bridge
          autoconnect=yes
          interface-name=sno0
          [ipv4]
          method=manual
          addresses=192.168.126.1
          [ipv6]
          method=manual
          addresses=fd00:dead:beef::1/96
          [bridge]
          mac-address=52:54:00:11:22:e0
          interface-name=sno0
    - path: /etc/NetworkManager/conf.d/openshift-network-playground.conf
      mode: 0644
      overwrite: true
      user:
        name: root
      contents:
        inline: |
          [main]
          plugins=keyfile
          dns=dnsmasq
    - path: /etc/NetworkManager/dnsmasq.d/openshift-network-playground.conf
      mode: 0644
      overwrite: true
      user:
        name: root
      contents:
        inline: |
          address=/.apps.ocp.example.local/192.168.123.89
          address=/.apps.sno4.example.local/192.168.124.2
          address=/.apps.sno64.example.local/192.168.124.3
          address=/.apps.sno6.example.local/fd00:dead:beef::2
          address=/.apps.sno64.example.local/fd00:dead:beef::3
          addn-hosts=/etc/hosts
    - path: /etc/hosts
      mode: 0644
      overwrite: true
      user:
        name: root
      contents:
        inline: |
          127.0.0.1 localhost localhost.localdomain onp.ocp.example.local
          192.168.123.88 api.ocp.example.local
          192.168.123.90 bootstrap.ocp.example.local
          192.168.123.91 master0.ocp.example.local
          192.168.123.92 master1.ocp.example.local
          192.168.123.93 master2.ocp.example.local
          192.168.123.94 worker0.ocp.example.local
          192.168.123.95 worker1.ocp.example.local
          192.168.123.1 onp.ocp.example.local lb.ocp.example.local mirror.ocp.example.local proxy.ocp.example.local
          192.168.126.2 api.sno4.example.local api-int.sno4.example.local node.sno4.example.local
          192.168.126.3 api.sno64.example.local api-int.sno64.example.local node.sno64.example.local
          fd00:dead:beef::2 api.sno6.example.local api-int.sno6.example.local node.sno6.example.local
          fd00:dead:beef::3 api.sno64.example.local api-int.sno64.example.local node.sno64.example.local
    - path: /etc/zincati/config.d/90-disable-auto-updates.toml
      contents:
        inline: |
          [updates]
          enabled = false
    - path: /opt/openshift-network-playground/libvirt/create-vm.sh
      mode: 0755
      overwrite: true
      user:
        name: onp
      group:
        name: onp
      contents:
        inline: |
          #!/bin/bash
          # Create node for openshift-network-playground
          
          set -euxo pipefail
          
          VM_NAME=$1
          MAC1=$2
          MAC2=$3
          VM_DIR=/opt/openshift-network-playground/libvirt
          VM_DISK=$VM_DIR/$VM_NAME/$VM_NAME.img
          VCPU=${4:-4}
          MEMORY=${5:-16384}
          NETWORK1=bridge=provisioning,mac=$MAC1
          NETWORK2=bridge=baremetal,mac=$MAC2
          
          if virsh list | grep $VM_NAME 2>&1>/dev/null; then virsh destroy $VM_NAME 2>/dev/null; virsh undefine $VM_NAME 2>/dev/null; fi
          if virsh list --all | grep $VM_NAME 2>&1>/dev/null; then virsh undefine $VM_NAME 2>/dev/null; fi
          if [ ! -f $VM_DISK ] ; then mkdir -p $VM_DIR/$VM_NAME; qemu-img create $VM_DISK 120G; fi
          
          virsh define <(virt-install --name $VM_NAME \
                  --os-variant fedora-coreos-stable \
                  --vcpus $VCPU \
                  --memory $MEMORY \
                  --disk $VM_DISK \
                  --network $NETWORK1 \
                  --network $NETWORK2 \
                  --pxe \
                  --boot network,hd \
                  --graphics spice,listen=0.0.0.0 \
                  --video virtio \
                  --channel spicevmc \
                  --console pty,target.type=virtio \
                  --serial pty \
                  --noautoconsole \
                  --print-xml 2)
          touch /opt/openshift-network-playground/$VM_NAME.done
    - path: /opt/openshift-network-playground/dhcp/Containerfile
      mode: 0644
      overwrite: true
      contents:
        inline: |
          FROM fedora
          MAINTAINER "Vinu K" <vkochuku@redhat.com>
          RUN yum install -y dnsmasq
          ADD dnsmasq.conf /dnsmasq.conf
          ENTRYPOINT ["dnsmasq"]
          CMD ["-C", "/dnsmasq.conf"]
    - path: /opt/openshift-network-playground/dhcp/dnsmasq.conf
      mode: 0644
      overwrite: true
      contents:
        inline: |
          no-daemon
          interface=baremetal
          dhcp-range=192.168.123.2,192.168.123.254,255.255.255.0
          except-interface=lo
          bind-interfaces
          log-dhcp
          dhcp-authoritative
          log-async
          dhcp-host=52:54:00:11:22:a1,192.168.123.91
          dhcp-host=52:54:00:11:22:a2,192.168.123.92
          dhcp-host=52:54:00:11:22:a3,192.168.123.93
          dhcp-host=52:54:00:11:22:a4,192.168.123.94
          dhcp-host=52:54:00:11:22:a5,192.168.123.95
    - path: /opt/openshift-network-playground/pxe/Containerfile
      mode: 0644
      overwrite: true
      contents:
        inline: |
          FROM fedora
          MAINTAINER "Vinu K" <vkochuku@redhat.com>
          RUN yum install -y dnsmasq
          ADD dnsmasq.conf /dnsmasq.conf
          ENTRYPOINT ["dnsmasq"]
          CMD ["-C", "/dnsmasq.conf"]
    - path: /opt/openshift-network-playground/pxe/dnsmasq.conf
      mode: 0644
      overwrite: true
      contents:
        inline: |
          no-daemon
          interface=provisioning
          dhcp-range=172.22.0.3,172.22.0.253,255.255.255.0
          except-interface=lo
          bind-interfaces
          log-dhcp
          log-queries
          dhcp-authoritative
          log-async
          enable-tftp
          dhcp-userclass=set:ipxe,iPXE
          dhcp-boot=tag:ipxe,http://172.22.0.2/boot.ipxe
    - path: /opt/openshift-network-playground/onp1-dhcp/Containerfile
      mode: 0644
      overwrite: true
      contents:
        inline: |
          FROM fedora
          MAINTAINER "Vinu K" <vkochuku@redhat.com>
          RUN yum install -y dnsmasq
          ADD dnsmasq.conf /dnsmasq.conf
          ENTRYPOINT ["dnsmasq"]
          CMD ["-C", "/dnsmasq.conf"]
    - path: /opt/openshift-network-playground/onp1-dhcp/dnsmasq.conf
      mode: 0644
      overwrite: true
      contents:
        inline: |
          no-daemon
          interface=onp1
          dhcp-range=192.168.124.2,192.168.124.254,255.255.255.0
          except-interface=lo
          bind-interfaces
          log-dhcp
          dhcp-authoritative
          log-async
    - path: /opt/openshift-network-playground/onp2-dhcp/Containerfile
      mode: 0644
      overwrite: true
      contents:
        inline: |
          FROM fedora
          MAINTAINER "Vinu K" <vkochuku@redhat.com>
          RUN yum install -y dnsmasq
          ADD dnsmasq.conf /dnsmasq.conf
          ENTRYPOINT ["dnsmasq"]
          CMD ["-C", "/dnsmasq.conf"]
    - path: /opt/openshift-network-playground/onp2-dhcp/dnsmasq.conf
      mode: 0644
      overwrite: true
      contents:
        inline: |
          no-daemon
          interface=onp2
          dhcp-range=192.168.125.2,192.168.125.254,255.255.255.0
          except-interface=lo
          bind-interfaces
          log-dhcp
          dhcp-authoritative
          log-async
    - path: /opt/openshift-network-playground/nat64/Containerfile
      mode: 0644
      overwrite: true
      contents:
        inline: |
          FROM fedora
          MAINTAINER "Vinu K" <vkochuku@redhat.com>
          ADD env entrypoint.sh /
          RUN yum install -y \
                  iproute \
                  iptables \
                  make \
                  gcc \
                  bzip2 \
                  bind && \
                  curl -O http://www.litech.org/tayga/tayga-0.9.2.tar.bz2 && \
                  bzip2 -dk tayga-0.9.2.tar.bz2 && \
                  tar xfv tayga-0.9.2.tar && \
                  pushd tayga-0.9.2 && \
                  ./configure && \
                  make && \
                  make install && \
                  popd && \
                  chmod +x /entrypoint.sh
          ENTRYPOINT ["/entrypoint.sh"]
    - path: /opt/openshift-network-playground/nat64/entrypoint.sh
      mode: 0644
      overwrite: true
      contents:
        inline: |
          #!/bin/bash
          
          source /env
        
          # Create Tayga directories.
          mkdir -p ${TDATADIR} ${TCONFDIR}
          
          # Configure Tayga.
          cat << EOF > ${TCONFDIR}/tayga.conf
          tun-device nat64
          ipv4-addr ${TIP4ADDR}
          ipv6-addr ${TIP6ADDR}
          prefix ${TPREFIX}
          dynamic-pool ${TDPOOL}
          data-dir ${TDATADIR}
          EOF
          
          # Setup Tayga networking.
          ip link del dev ${TINT} 2>/dev/null
          tayga -c ${TCONFDIR}/tayga.conf --mktun
          ip link set dev ${TINT} up
          ip route del ${TDPOOL} dev ${TINT} 2>/dev/null
          ip route add ${TDPOOL} dev ${TINT}
          ip -6 route del ${TPREFIX} dev ${TINT} 2>/dev/null
          ip -6 route add ${TPREFIX} dev ${TINT}
         
          # Run tayga
          echo "Starting tayga ..."
          tayga -c ${TCONFDIR}/tayga.conf -d
    - path: /opt/openshift-network-playground/nat64/env
      mode: 0644
      overwrite: true
      contents:
        inline: |
          TIP4ADDR=192.168.126.1
          TIP6ADDR=fd00:dead:beef::1
          TPREFIX=2001:db8:1:ffff::/96
          TDPOOL=192.168.126.128/25
          TDATADIR=/var/db/tayga
          TCONFDIR=/usr/local/etc
          TINT=nat64
          TVMINT=sno0
          TMAININT=$(ip -o -4 route show default | awk '{print $5}' | head -n 1)
    - path: /opt/openshift-network-playground/nat64/host.sh
      mode: 0755
      overwrite: true
      contents:
        inline: |
          #!/bin/bash

          DIR=$( cd -- $( dirname -- ${BASH_SOURCE[0]:-$0}; ) &> /dev/null && pwd 2> /dev/null; )
          source ${DIR}/env
          
          echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward
          echo 1 | sudo tee /proc/sys/net/ipv6/conf/all/forwarding
          echo 2 | sudo tee /proc/sys/net/ipv6/conf/all/accept_ra
          
          sudo iptables -t nat -C POSTROUTING -o ${TINT} -j MASQUERADE || \
          sudo iptables -t nat -I POSTROUTING -o ${TINT} -j MASQUERADE
          sudo iptables -t nat -C POSTROUTING -o ${TMAININT} -j MASQUERADE || \
          sudo iptables -t nat -I POSTROUTING -o ${TMAININT} -j MASQUERADE
          sudo iptables -C FORWARD -i ${TVMINT} -o ${TINT} -j ACCEPT || \
          sudo iptables -I FORWARD -i ${TVMINT} -o ${TINT} -j ACCEPT
          sudo iptables -C FORWARD -o ${TVMINT} -i ${TINT} -j ACCEPT || \
          sudo iptables -I FORWARD -o ${TVMINT} -i ${TINT} -j ACCEPT
    - path: /opt/openshift-network-playground/dns64/Containerfile
      mode: 0644
      overwrite: true
      contents:
        inline: |
          FROM fedora
          MAINTAINER "Vinu K" <vkochuku@redhat.com>
          COPY named.conf \
              example.local.forward \
              example.local.reverse.v4 \
              example.local.reverse.v6 \
              /
          RUN yum install -y bind
          ENTRYPOINT ["/usr/sbin/named", "-c", "/named.conf", "-g", "-u", "named"]
    - path: /opt/openshift-network-playground/dns64/named.conf
      mode: 0644
      overwrite: true
      contents:
        inline: |
          options {
          listen-on port 53 { 192.168.126.1; };
          listen-on-v6 port 53 { fd00:dead:beef::1; };
          directory       "/var/named";
          allow-query     { 192.168.126.0/24; fd00:dead:beef::/96; };
          forwarders { 127.0.0.1; };
          dns64 2001:db8:1:ffff::/96 {
                  clients { fd00:dead:beef::/96; };
                  exclude { !fd00:dead:beef::/96; any; };
          };
          recursion yes;
          };
          
          zone "example.local" IN {
                  type master;
                  file "/example.local.forward";
          };
          
          zone "126.168.192.in-addr.arpa" IN {
                  type master;
                  file "/example.local.reverse.v4";
          };
          
          zone "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.f.e.e.b.d.a.e.d.0.0.d.f.ip6.arpa" IN {
                  type master;
                  file "/example.local.reverse.v6";
          };
    - path: /opt/openshift-network-playground/dns64/example.local.forward
      mode: 0644
      overwrite: true
      contents:
        inline: |
          $TTL 86400
          @               IN      SOA     example.local. root.example.local (
                                          2001062501  ; serial
                                          21600       ; refresh after 6 hours
                                          3600        ; retry after 1 hour
                                          604800      ; expire after 1 week
                                          86400 )     ; minimum TTL of 1 day
                          IN      NS      ns1.example.local.
          
          ns1             IN      A       192.168.126.1
          node.sno4       IN      A       192.168.126.2
          node.sno6       IN      AAAA    fd00:dead:beef::2
          node.sno64      IN      A       192.168.126.3
                          IN      AAAA    fd00:dead:beef::3
          api.sno4        IN      A       192.168.126.2
          api.sno6        IN      AAAA    fd00:dead:beef::2
          api.sno64       IN      A       192.168.126.3
                          IN      AAAA    fd00:dead:beef::3
          api-int.sno4    IN      A       192.168.126.2
          api-int.sno6    IN      AAAA    fd00:dead:beef::2
          api-int.sno64   IN      A       192.168.126.3
                          IN      AAAA    fd00:dead:beef::3
          *.apps.sno4     IN      A       192.168.126.2
          *.apps.sno6     IN      AAAA    fd00:dead:beef::2
          *.apps.sno64    IN      A       192.168.126.3
                          IN      AAAA    fd00:dead:beef::3
    - path: /opt/openshift-network-playground/dns64/example.local.reverse.v4
      mode: 0644
      overwrite: true
      contents:
        inline: |
          $TTL 86400
          @       IN      SOA     example.local. root.example.local (
                                          2001062501  ; serial
                                          21600       ; refresh after 6 hours
                                          3600        ; retry after 1 hour
                                          604800      ; expire after 1 week
                                          86400 )     ; minimum TTL of 1 day
                  IN      NS      ns1.example.local.
          
          1       IN      PTR     ns1.example.local.
          2       IN      PTR     node.sno4.example.local.
          3       IN      PTR     node.sno64.example.local.
    - path: /opt/openshift-network-playground/dns64/example.local.reverse.v6
      mode: 0644
      overwrite: true
      contents:
        inline: |
          $TTL 86400
          @       IN      SOA     example.local. root.example.local (
                                          2001062501  ; serial
                                          21600       ; refresh after 6 hours
                                          3600        ; retry after 1 hour
                                          604800      ; expire after 1 week
                                          86400 )     ; minimum TTL of 1 day
                  IN      NS      ns1.example.local.
          
          1       IN      PTR     ns1.example.local.
          2       IN      PTR     node.sno6.example.local.
          3       IN      PTR     node.sno64.example.local.
    - path: /opt/openshift-network-playground/proxy/Containerfile
      mode: 0644
      overwrite: true
      contents:
        inline: |
          FROM fedora
          MAINTAINER "Vinu K" <vkochuku@redhat.com>
          ADD entrypoint.sh /usr/local/bin/entrypoint.sh
          ADD openssl.cnf.add /etc/ssl/openssl.cnf.add
          ADD squid.conf /etc/squid/squid.conf
          ADD env /env
          RUN yum install -y squid openssl ca-certificates which && \
              chmod +x /usr/local/bin/entrypoint.sh && \
              cat /etc/ssl/openssl.cnf.add >> /etc/ssl/openssl.cnf
          EXPOSE 3128
          EXPOSE 4128
          ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
    - path: /opt/openshift-network-playground/proxy/squid.conf
      mode: 0644
      overwrite: true
      contents:
        inline: |
          #
          # Recommended minimum configuration:
          #
          
          # Example rule allowing access from your local networks.
          # Adapt to list your (internal) IP networks from where browsing
          # should be allowed
          acl localnet src 10.0.0.0/8     # RFC1918 possible internal network
          acl localnet src 172.16.0.0/12  # RFC1918 possible internal network
          acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
          acl localnet src fc00::/7       # RFC 4193 local private network range
          acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines
          
          acl SSL_ports port 443
          acl Safe_ports port 80          # http
          acl Safe_ports port 21          # ftp
          acl Safe_ports port 443         # https
          acl Safe_ports port 70          # gopher
          acl Safe_ports port 210         # wais
          acl Safe_ports port 1025-65535  # unregistered ports
          acl Safe_ports port 280         # http-mgmt
          acl Safe_ports port 488         # gss-http
          acl Safe_ports port 591         # filemaker
          acl Safe_ports port 777         # multiling http
          acl CONNECT method CONNECT
          
          #
          # Recommended minimum Access Permission configuration:
          #
          # Deny requests to certain unsafe ports
          http_access deny !Safe_ports
          
          # Deny CONNECT to other than secure SSL ports
          http_access deny CONNECT !SSL_ports
          
          # Only allow cachemgr access from localhost
          http_access allow localhost manager
          http_access deny manager
          
          # We strongly recommend the following be uncommented to protect innocent
          # web applications running on the proxy server who think the only
          # one who can access services on "localhost" is a local user
          #http_access deny to_localhost
          
          #
          # INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
          #
          
          # Example rule allowing access from your local networks.
          # Adapt localnet in the ACL section to list your (internal) IP networks
          # from where browsing should be allowed
          http_access allow localnet
          http_access allow localhost
          
          # And finally deny all other access to this proxy
          http_access deny all
          
          # Squid normally listens to port 3128
          http_port 3128
          
          # Squid normally listens to port 4128 for ssl bump
          http_port 4128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/etc/squid-cert/private.pem key=/etc/squid-cert/private.pem
          ssl_bump server-first all
          always_direct allow all
          
          # Uncomment and adjust the following to add a disk cache directory.
          cache_dir ufs /var/cache/squid 100 16 256
          
          # Leave coredumps in the first cache dir
          coredump_dir /var/cache/squid
          
          #
          # Add any of your own refresh_pattern entries above these.
          #
          refresh_pattern ^ftp:           1440    20%     10080
          refresh_pattern ^gopher:        1440    0%      1440
          refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
          refresh_pattern .               30      20%     4320 reload-into-ims
          
          
          range_offset_limit 200 MB
          maximum_object_size 200 MB
          quick_abort_min -1
          
          sslcrtd_program /usr/lib64/squid/security_file_certgen -s /var/lib/squid/ssl_db -M 20MB
          sslproxy_cert_error allow all
          ssl_bump stare all
    - path: /opt/openshift-network-playground/proxy/openssl.cnf.add
      mode: 0644
      overwrite: true
      contents:
        inline: |
          [ v3_req ]
          basicConstraints = CA:FALSE
          keyUsage = nonRepudiation, digitalSignature, keyEncipherment
          [ v3_ca ]
          keyUsage = cRLSign, keyCertSign
          subjectKeyIdentifier=hash
          authorityKeyIdentifier=keyid:always,issuer:always
          basicConstraints = CA:true
    - path: /opt/openshift-network-playground/proxy/entrypoint.sh
      mode: 0644
      overwrite: true
      contents:
        inline: |
          #!/bin/sh
          
          set -xe

          source /env
          
          CHOWN=$(/usr/bin/which chown)
          SQUID=$(/usr/bin/which squid)
          
          prepare_folders() {
                  echo "Preparing folders..."
                  mkdir -p /etc/squid-cert/
                  mkdir -p /var/cache/squid/
                  mkdir -p /var/log/squid/
                  "$CHOWN" -R squid:squid /etc/squid-cert/
                  "$CHOWN" -R squid:squid /var/cache/squid/
                  "$CHOWN" -R squid:squid /var/log/squid/
          }
          
          initialize_cache() {
                  echo "Creating cache folder..."
                  "$SQUID" -z
          
                  sleep 5
          }
          
          create_cert() {
                  if [ ! -f /etc/squid-cert/private.pem ]; then
                          echo "Creating certificate..."
                          openssl req -new -newkey rsa:2048 -sha256 -days 3650 -nodes -x509 \
                                  -extensions v3_ca -keyout /etc/squid-cert/private.pem \
                                  -out /etc/squid-cert/private.pem \
                                  -subj "/CN=proxy.${CLUSTER_NAME}.${DOMAIN}/O=Squid/OU=Squid/C=IN" -utf8 -nameopt multiline,utf8
          
                          openssl x509 -in /etc/squid-cert/private.pem \
                                  -outform DER -out /etc/squid-cert/CA.der
          
                          openssl x509 -inform DER -in /etc/squid-cert/CA.der \
                                  -out /etc/squid-cert/CA.pem
                  else
                          echo "Certificate found..."
                  fi
          }
          
          clear_certs_db() {
                  echo "Clearing generated certificate db..."
                  rm -rfv /var/lib/squid
                  mkdir -p /var/lib/squid
                  /usr/lib64/squid/security_file_certgen -c -s /var/lib/squid/ssl_db -M 20MB
                  "$CHOWN" -R squid:squid /var/lib/squid
          }
          
          run() {
                  echo "Starting squid..."
                  prepare_folders
                  create_cert
                  clear_certs_db
                  initialize_cache
                  exec "$SQUID" -NYCd 1 -f /etc/squid/squid.conf
          }
          
          run
    - path: /opt/openshift-network-playground/proxy/env
      mode: 0644
      overwrite: true
      contents:
        inline: |
          CLUSTER_NAME=ocp
          DOMAIN=example.local
    - path: /opt/openshift-network-playground/proxy/certs/.keepdir
      mode: 0644
      overwrite: true
      contents:
        inline: |
          keepdir
    - path: /home/onp/.Makefile
      mode: 0755
      overwrite: true
      user:
        name: onp
      group:
        name: onp
      contents:
        inline: |
          SHELL = /bin/bash
          RELEASE ?= stable
          LOGLEVEL ?= info
          SCRIPT_DIR = $(shell cd -- "$( dirname -- "${BASH_SOURCE[0]:-$0}"; )" &> /dev/null && pwd 2> /dev/null; )
          CONTAINERS = $(shell sudo podman ps --format {{.Names}} | sort | grep -oE '^dhcp|vbmc|webserver|proxy' | xargs)
          VMS = $(shell sudo virsh list --all --name | grep -oE 'master0|master1|master2|worker0|worker1' | xargs)
          TFF = $(shell ls /tmp/openshift-install-bootstrap-*/terraform.platform.auto.tfvars.json 2>/dev/null | wc -l)
          VIRBR0=$(shell sudo virsh net-info default | awk '/Bridge:/{print $$2}')
          VIRBR0MAC=$(shell ip a s ${VIRBR0} | awk '/ether /{print $$2}' | cut -f1-4 -d':')

          .PHONY: all
          
          all: help
          
          check-from:
          ifndef FROM
                $(error FROM is undefined | Usage: onp store-release FROM=4.x.y)
          endif

          check-to:
          ifndef TO
                $(error TO is undefined | Usage: onp restore-release TO=4.x.y)
          endif

          check-containers:
          ifneq ($(CONTAINERS),dhcp proxy vbmc webserver)
                $(error The containerized services (dhcp proxy vbmc webserver) are not ready. Check with 'sudo podman ps' and wait for a while to retry)
          endif

          check-vms:
          ifneq ($(VMS),master0 master1 master2 worker0 worker1)
                $(error The VMs are not ready. Please restart the services with 'sudo systemctl restart master0 master1 master2 worker0 worker1' and retry)
          endif

          check-terraform-file:
          ifneq ($(TFF),1)
                $(error The terraform.platform.auto.tfvars.json file is not present in /tmp)
          endif
          
          .PHONY: ssh-pullsecret
          
          ssh-pullsecret:
          ifneq ($(shell for FILE in ${HOME}/openshift-network-playground/pullsecret ${HOME}/openshift-network-playground/id_ed25519.pub; do test -e $${FILE} && echo -n OK; done),OKOK)
          ifndef OCM_TOKEN
                $(error OCM_TOKEN is undefined | Get it from https://cloud.redhat.com/openshift/token/show)
          else
                @echo "Generating SSH keys and pullsecret ..."
                @openshift-network-playground/ssh-pullsecret.sh $(OCM_TOKEN)
          endif
          endif

          .PHONY: install-config

          install-config: ssh-pullsecret
                @openshift-network-playground/install-config.sh $(RELEASE)

          .PHONY: manifests

          manifests: $(SCRIPT_DIR)/openshift-network-playground/clusterconfigs/install-config.yaml
                @echo "Generating manifests ..."
                @/usr/local/bin/openshift-baremetal-install --log-level=${LOGLEVEL} --dir=$(SCRIPT_DIR)/openshift-network-playground/clusterconfigs create manifests

          .PHONY: ignition-configs

          ignition-configs:
                @echo "Generating ignition-configs ..."
                @/usr/local/bin/openshift-baremetal-install --log-level=${LOGLEVEL} --dir=$(SCRIPT_DIR)/openshift-network-playground/clusterconfigs create ignition-configs
          
          .PHONY: cluster
          
          cluster: ssh-pullsecret check-containers check-vms
                @echo "Creating cluster ..."
                @/usr/local/bin/openshift-baremetal-install --log-level=${LOGLEVEL} --dir=$(SCRIPT_DIR)/openshift-network-playground/clusterconfigs create cluster
          
          .PHONY: clean
          
          clean:
                @echo "Removing old bootstrap resources ..."
                -@$(SCRIPT_DIR)/openshift-network-playground/clean-bootstrap.sh
          
          .PHONY: destroy
          
          destroy:
                @echo "Destroying bootrap ..."
                -@openshift-baremetal-install destroy --log-level=${LOGLEVEL} --dir=/home/onp/openshift-network-playground/clusterconfigs bootstrap
                @echo "Destroying cluster ..."
                -@openshift-baremetal-install destroy --log-level=${LOGLEVEL} --dir=/home/onp/openshift-network-playground/clusterconfigs cluster
                @echo "Removing installation directory ..."
                -@rm -rfv $(SCRIPT_DIR)/openshift-network-playground/clusterconfigs
                @echo "Powering off master nodes ..."
                -@for i in master0 master1 master2; do sudo virsh destroy $$i; done
                @echo "!!! IGNORE THE ERRORS !!!"

          .PHONY: deploy

          deploy: ssh-pullsecret clean install-config manifests core-passwd-auth cluster

          .PHONY: core-passwd-auth

          core-passwd-auth:
                sed "s/version: 4.x.x/version: $(shell oc version --client -o json | jq -r .releaseClientVersion | cut -d'.' -f'1-2').0/g" \
                /home/onp/openshift-network-playground/99_openshift-machineconfig_99-master-core-passwd-auth.bu > /tmp/master-core-passwd-auth.bu
                sed "s/version: 4.x.x/version: $(shell oc version --client -o json | jq -r .releaseClientVersion | cut -d'.' -f'1-2').0/g" \
                /home/onp/openshift-network-playground/99_openshift-machineconfig_99-worker-core-passwd-auth.bu > /tmp/worker-core-passwd-auth.bu
                podman run -i --rm quay.io/coreos/butane:release --strict < /tmp/master-core-passwd-auth.bu > \
                /home/onp/openshift-network-playground/clusterconfigs/openshift/99_openshift-machineconfig_99-master-core-passwd-auth.yaml
                podman run -i --rm quay.io/coreos/butane:release --strict < /tmp/worker-core-passwd-auth.bu > \
                /home/onp/openshift-network-playground/clusterconfigs/openshift/99_openshift-machineconfig_99-worker-core-passwd-auth.yaml

          .PHONY: onp-files

          onp-files:
                @echo "Cloning onp-files ..."
                -@rm -rf $(SCRIPT_DIR)/onp-files 2>/dev/null
                @git clone https://github.com/kevydotvinu/onp-files

          .PHONY: ironic-client

          ironic-client: check-terraform-file
                @echo "Creating clouds.yaml file ..."
                -@jq -jr '"clouds:","\n","  metal3:","\n","    auth_type: http_basic","\n","    username: ",.ironic_username,"\n","    password: ",.ironic_password,"\n","    baremetal_endpoint_override: ",.ironic_uri,"\n","    baremetal_introspection_endpoint_override: ",.inspector_uri,"\n"' /tmp/openshift-*/terraform.platform.auto.tfvars.json > /home/onp/openshift-network-playground/clouds.yaml
                @echo "Starting ironic-client container ..."
                -@sudo podman run -ti --rm --entrypoint /bin/bash --net host -v /home/onp/openshift-network-playground/clouds.yaml:/clouds.yaml -e OS_CLOUD=metal3 quay.io/metal3-io/ironic-client:latest

          .PHONY: go-download

          go-download:
                @echo "Downloading go ..."
                @curl -sL https://golang.org$$(curl -sL https://golang.org/dl/ | grep -oP '/dl/go([0-9\.]+)\.linux-amd64.tar.gz' | head -1) | sudo tar xzf - -C /usr/local
                @echo "OK!"


          .PHONY: kind-download

          kind-download:
                @echo "Downloading kind ..."
                @sudo curl -sLo /usr/local/bin/kind $$(curl -sL https://api.github.com/repos/kubernetes-sigs/kind/releases/latest | jq -r '.assets | .[] | select(.name == "kind-linux-amd64") | .browser_download_url')
                @sudo chmod +x /usr/local/bin/kind
                @echo "OK"
                @echo "Downloading kubectl ..."
                @sudo curl -sLo /usr/local/bin/kubectl https://dl.k8s.io/release/$$(curl -sL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl
                @sudo chmod +x /usr/local/bin/kubectl
                @echo "OK"

          .PHONY: kind-create-onp

          kind-create-onp:
                @echo "Creating kind cluster ..."
                @sudo KIND_EXPERIMENTAL_PROVIDER=podman kind create cluster --name onp
                @sudo cp /root/.kube/config ${HOME}/.kube/onp-kind-config
                @sudo chown onp:onp ${HOME}/.kube/onp-kind-config
                @echo "OK"
                @echo "Try, k get nodes."

          .PHONY: kind-delete-onp

          kind-delete-onp:
                @echo "Deleting kind cluster ..."
                @sudo KIND_EXPERIMENTAL_PROVIDER=podman kind delete cluster --name onp
                @rm -rf ${HOME}/.kube/onp-kind-config

          .PHONY: kind-create-ovn

          kind-create-ovn: go-download
                @echo "Creating OVN kind cluster ..."
                go env -w GO111MODULE=auto && \
                (sudo rm -rf ${HOME}/ovn-kubernetes || true) && \
                git clone https://github.com/ovn-org/ovn-kubernetes ${HOME}/ovn-kubernetes && \
                sudo pip3 install j2cli && \
                pushd ${HOME}/ovn-kubernetes/go-controller && \
                make && \
                popd && \
                pushd ${HOME}/ovn-kubernetes/dist/images && \
                OCI_BIN=podman make fedora && \
                popd && \
                pushd ${HOME}/ovn-kubernetes/contrib && \
                sudo PATH=${PATH}:/usr/local/go/bin ./kind.sh -ep podman && \
                mkdir -p ${HOME}/.kube && \
                sudo cp /root/ovn.conf ${HOME}/.kube/ovn-kind-config && \
                sudo chown $$(id -u):$$(id -g) ${HOME}/.kube/ovn-kind-config && \
                popd

          .PHONY: kind-delete-ovn

          kind-delete-ovn:
                @echo "Deleting OVN kind cluster ..."
                pushd ${HOME}/ovn-kubernetes/contrib && \
                sudo ./kind.sh -ep podman --delete && \
                rm -rf ${HOME}/ovn-kubernetes && \
                sudo rm -rf ${HOME}/.kube/ovn-kind-config && \
                popd

          .PHONY: sno4

          sno4: ssh-pullsecret
                @echo "Creating SNO4 cluster ..."
                @openshift-network-playground/sno.sh ${RELEASE} sno4
                @/usr/local/bin/openshift-install --log-level=${LOGLEVEL} \
                                                  --dir=$(SCRIPT_DIR)/openshift-network-playground/sno4 create single-node-ignition-config
                @sudo podman run --privileged \
                                 --quiet \
                                 --pull always \
                                 --rm \
                                 --volume /dev:/dev \
                                 --volume /run/udev:/run/udev \
                                 --volume /:/data \
                                 --workdir /data \
                                 quay.io/coreos/coreos-installer:release iso ignition embed -fi \
                                 var/home/onp/openshift-network-playground/sno4/bootstrap-in-place-for-live-iso.ign \
                                 opt/openshift-network-playground/libvirt/sno4/rhcos-live.iso
                @sudo podman run --privileged \
                                 --quiet \
                                 --pull always \
                                 --rm \
                                 --volume /dev:/dev \
                                 --volume /run/udev:/run/udev \
                                 --volume /:/data \
                                 --workdir /data \
                                 quay.io/coreos/coreos-installer:release iso network embed -fk \
                                 var/home/onp/openshift-network-playground/sno4-enp1s0.nmconnection \
                                 opt/openshift-network-playground/libvirt/sno4/rhcos-live.iso
                @sudo virt-install --name sno4 \
                                   --quiet \
                                   --os-variant fedora-coreos-stable \
                                   --vcpu 4 \
                                   --memory 16384 \
                                   --boot menu=on \
                                   --pxe \
                                   --disk /opt/openshift-network-playground/libvirt/sno4/sno4.img,bus=scsi \
                                   --cdrom /opt/openshift-network-playground/libvirt/sno4/rhcos-live.iso \
                                   --network bridge=sno0 \
                                   --noautoconsole \
                                   --graphics spice,listen=0.0.0.0
                @$(SCRIPT_DIR)/openshift-network-playground/sno-restart.sh sno4
                @/usr/local/bin/openshift-install --log-level=${LOGLEVEL} \
                                                  --dir=$(SCRIPT_DIR)/openshift-network-playground/sno4 wait-for install-complete

          .PHONY: sno6

          sno6: ssh-pullsecret
                @echo "Creating SNO6 cluster ..."
                @openshift-network-playground/sno.sh ${RELEASE} sno6
                @/usr/local/bin/openshift-install --log-level=${LOGLEVEL} \
                                                  --dir=$(SCRIPT_DIR)/openshift-network-playground/sno6 create single-node-ignition-config
                @sudo podman run --privileged \
                                 --quiet \
                                 --pull always \
                                 --rm \
                                 --volume /dev:/dev \
                                 --volume /run/udev:/run/udev \
                                 --volume /:/data \
                                 --workdir /data \
                                 quay.io/coreos/coreos-installer:release iso ignition embed -fi \
                                 var/home/onp/openshift-network-playground/sno6/bootstrap-in-place-for-live-iso.ign \
                                 opt/openshift-network-playground/libvirt/sno6/rhcos-live.iso
                @sudo podman run --privileged \
                                 --quiet \
                                 --pull always \
                                 --rm \
                                 --volume /dev:/dev \
                                 --volume /run/udev:/run/udev \
                                 --volume /:/data \
                                 --workdir /data \
                                 quay.io/coreos/coreos-installer:release iso network embed -fk \
                                 var/home/onp/openshift-network-playground/sno6-enp1s0.nmconnection \
                                 opt/openshift-network-playground/libvirt/sno6/rhcos-live.iso
                @sudo virt-install --name sno6 \
                                   --quiet \
                                   --os-variant fedora-coreos-stable \
                                   --vcpu 4 \
                                   --memory 16384 \
                                   --boot menu=on \
                                   --pxe \
                                   --disk /opt/openshift-network-playground/libvirt/sno4/sno4.img,bus=scsi \
                                   --cdrom /opt/openshift-network-playground/libvirt/sno4/rhcos-live.iso \
                                   --network bridge=sno0 \
                                   --noautoconsole \
                                   --graphics spice,listen=0.0.0.0
                @$(SCRIPT_DIR)/openshift-network-playground/sno-restart.sh sno6
                @/usr/local/bin/openshift-install --log-level=${LOGLEVEL} \
                                                  --dir=$(SCRIPT_DIR)/openshift-network-playground/sno6 wait-for install-complete

          .PHONY: sno64

          sno64: ssh-pullsecret
                @echo "Creating SNO64 cluster ..."
                @openshift-network-playground/sno.sh ${RELEASE} sno64
                @/usr/local/bin/openshift-install --log-level=${LOGLEVEL} \
                                                  --dir=$(SCRIPT_DIR)/openshift-network-playground/sno64 create single-node-ignition-config
                @sudo podman run --privileged \
                                 --quiet \
                                 --pull always \
                                 --rm \
                                 --volume /dev:/dev \
                                 --volume /run/udev:/run/udev \
                                 --volume /:/data \
                                 --workdir /data \
                                 quay.io/coreos/coreos-installer:release iso ignition embed -fi \
                                 var/home/onp/openshift-network-playground/sno64/bootstrap-in-place-for-live-iso.ign \
                                 opt/openshift-network-playground/libvirt/sno64/rhcos-live.iso
                @sudo podman run --privileged \
                                 --quiet \
                                 --pull always \
                                 --rm \
                                 --volume /dev:/dev \
                                 --volume /run/udev:/run/udev \
                                 --volume /:/data \
                                 --workdir /data \
                                 quay.io/coreos/coreos-installer:release iso network embed -fk \
                                 var/home/onp/openshift-network-playground/sno64-enp1s0.nmconnection \
                                 opt/openshift-network-playground/libvirt/sno64/rhcos-live.iso
                @sudo virt-install --name sno64 \
                                   --quiet \
                                   --os-variant fedora-coreos-stable \
                                   --vcpu 4 \
                                   --memory 16384 \
                                   --boot menu=on \
                                   --pxe \
                                   --disk /opt/openshift-network-playground/libvirt/sno4/sno64.img,bus=scsi \
                                   --cdrom /opt/openshift-network-playground/libvirt/sno64/rhcos-live.iso \
                                   --network bridge=sno0 \
                                   --noautoconsole \
                                   --graphics spice,listen=0.0.0.0
                @$(SCRIPT_DIR)/openshift-network-playground/sno-restart.sh sno64
                @/usr/local/bin/openshift-install --log-level=${LOGLEVEL} \
                                                  --dir=$(SCRIPT_DIR)/openshift-network-playground/sno64 wait-for install-complete

          .PHONY: network-tools

          network-tools:
                @echo "Cloning network-tools ..."
                -@rm -rf $(SCRIPT_DIR)/.local/network-tools 2>/dev/null
                @git clone https://github.com/openshift/network-tools $(SCRIPT_DIR)/.local/network-tools

          .PHONY: fcos

          fcos:
                @echo "Creating FCOS VM ..."
                @$(SCRIPT_DIR)/openshift-network-playground/fcos.sh

          .PHONY: rhcos-livecd

          NETWORK?=network=default

          rhcos-livecd:
                  @echo "Creating RHCOS live CD ..."
                  @sudo mkdir -p /opt/openshift-network-playground/libvirt/rhcos-livecd
                  @if [ ! -f /opt/openshift-network-playground/libvirt/rhcos-livecd/rhcos-livecd.iso ]; then \
                  sudo curl -# -o /opt/openshift-network-playground/libvirt/rhcos-livecd/rhcos-livecd.iso \
                  https://mirror.openshift.com/pub/openshift-v4/dependencies/rhcos/latest/rhcos-live.x86_64.iso; \
                  fi
                  -@sudo virsh destroy rhcos-livecd >/dev/null 2>&1
                  -@sudo virsh undefine rhcos-livecd >/dev/null 2>&1
                  @echo "Press TAB and type console=ttyS0 in the next screen ..."
                  @sleep 5s
                  @sudo virt-install --name rhcos-livecd \
                                     --network ${NETWORK} \
                                     --pxe \
                                     --boot menu=on \
                                     --memory 2096 \
                                     --vcpu 2 \
                                     --disk none \
                                     --os-variant fedora-coreos-stable \
                                     --cdrom /opt/openshift-network-playground/libvirt/rhcos-livecd/rhcos-livecd.iso \
                                     --noautoconsole \
                                     --graphics spice,listen=0.0.0.0
                  @sudo virsh console rhcos-livecd

          .PHONY: disconnect-cluster

          disconnect-cluster:
                @echo "Disabling internet for OpenShift cluster ..."
                @sudo iptables -C FORWARD -i baremetal -o eno1 -j DROP || sudo iptables -A FORWARD -i baremetal -o eno1 -j DROP
                @echo "OK!"

          .PHONY: connect-cluster

          connect-cluster:
                @echo "Enabling internet for OpenShift cluster ..."
                @sudo iptables -D FORWARD -i baremetal -o eno1 -j DROP > /dev/null 2>&1 || echo "Rule exists!"
                @echo "OK!"

          .PHONY: services

          BAREMETAL-DHCP=$$(sudo systemctl is-active dhcp)
          VBMC=$$(sudo systemctl is-active vbmc)
          WEBSERVER=$$(sudo systemctl is-active webserver)
          ONP1-DHCP=$$(sudo systemctl is-active onp1-dhcp)
          ONP2-DHCP=$$(sudo systemctl is-active onp2-dhcp)
          COCKPIT=$$(sudo systemctl is-active cockpit)
          PXE=$$(sudo systemctl is-active pxe)
          PROXY=$$(sudo systemctl is-active proxy)
          NAT64=$$(sudo systemctl is-active nat64)
          DNS64=$$(sudo systemctl is-active dns64)
          
          services:
                @echo -e "SERVICE\t\tIS-ACTIVE"
                @echo -e "baremetal-dhcp\t${BAREMETAL-DHCP}"
                @echo -e "vbmc\t\t${VBMC}"
                @echo -e "webserver\t${WEBSERVER}"
                @echo -e "onp1-dhcp\t${ONP1-DHCP}"
                @echo -e "onp2-dhcp\t${ONP2-DHCP}"
                @echo -e "cockpit\t\t${COCKPIT}"
                @echo -e "pxe\t\t${PXE}"
                @echo -e "proxy\t\t${PROXY}"
                @echo -e "nat64\t\t${NAT64}"
                @echo -e "dns64\t\t${DNS64}"

          .PHONY: bootstrap-ip

          bootstrap-ip:
                @if sudo virsh -q list | grep -q bootstrap; then journalctl -u dhcp | grep PACK | grep $$(sudo virsh -q domiflist $$(sudo virsh -q list | grep bootstrap | awk '{print $$2}') | grep baremetal | awk '{print $$5}') | awk '{print $$9}'; fi

          .PHONY: list-releases

          list-releases:
                @echo -e "RELEASES"
                @ls /opt/openshift-network-playground/ | grep 4[.] || true

          .PHONY: store-release

          store-release: check-from
                @echo -e "Storing ${FROM} release ..."
                @${HOME}/openshift-network-playground/store-release.sh ${FROM}

          .PHONY: restore-release

          restore-release: check-to
                @echo -e "Restoring ${TO} release ..."
                @${HOME}/openshift-network-playground/restore-release.sh ${TO}

          .PHONY: openshift-sdn

          openshift-sdn: $(SCRIPT_DIR)/openshift-network-playground/clusterconfigs/install-config.yaml
                @echo -e "Switching OpenShift cluster networkType from OVNKubernetes to OpenShiftSDN ..."
                @sed -i 's/OVNKubernetes/OpenShiftSDN/g' $(SCRIPT_DIR)/openshift-network-playground/clusterconfigs/install-config.yaml

          .PHONY: rhcos

          BUTANE=${HOME}/openshift-network-playground/core-passwd.bu

          rhcos: ssh-pullsecret
                @${HOME}/openshift-network-playground/rhcos.sh ${BUTANE}

          .PHONY: help

          help:
                @echo "OpenShift Network Playground CLI"
                @echo ""
                @echo "It includes the administrative commands for managing the ONP."
                @echo ""
                @echo "Usage: onp [SUBCOMMAND] [VARIABLE_NAME]=<variable>"
                @echo ""
                @echo "Subcommands:"
                @echo -e "  ssh-pullsecret OCM_TOKEN=<OCM_TOKEN>\tGenerate SSH keys and download pullsecret file"
                @echo -e "  install-config\t\t\tGenerate install-config.yaml file"
                @echo -e "  cluster\t\t\t\tCreate an OpenShift cluster"
                @echo -e "  clean\t\t\t\t\tClean old cluster resources"
                @echo -e "  go-download\t\t\t\tDownload and install Golang"
                @echo -e "  kind-download\t\t\t\tDownload and install Kind"
                @echo -e "  kind-create-onp\t\t\tCreate a Kind cluster"
                @echo -e "  kind-delete-onp\t\t\tDelete a Kind cluster"
                @echo -e "  kind-create-ovn\t\t\tCreate an OVN Kind cluster"
                @echo -e "  kind-delete-ovn\t\t\tCreate an OVN Kind cluster"
                @echo -e "  sno\t\t\t\t\tCreate an IPv6 single-stack SNO cluster"
                @echo -e "  onp-files\t\t\t\tClone the ONP sample manifests"
                @echo -e "  rhcos-livecd NETWORK=newtork=default\tCreate a RHCOS Live CD"
                @echo -e "  rhcos BUTANE=file.bu\t\t\tCreate a RHCOS VM with custom butane"
                @echo -e "  disconnect-cluster\t\t\tDisconnect cluster from internet"
                @echo -e "  connect-cluster\t\t\tConnect cluster to internet"
                @echo -e "  services\t\t\t\tList services status"
                @echo -e "  bootstrap-ip\t\t\t\tShow bootstrap IP"
                @echo -e "  store-release FROM=4.x.y\t\tStore OpenShift 4.x.y release"
                @echo -e "  restore-release TO=4.x.y\t\tRestore OpenShift 4.x.y release"
                @echo ""
                @echo "Example:"
                @echo "  onp cluster LOGLEVEL=debug"
                @echo ""
                @echo "Variables:"
                @echo -e "  OCM_TOKEN\ttoken from https://cloud.redhat.com/openshift/token/show"
                @echo -e "  RELEASE\tstable-4.10, latest-4.9, 4.9.0, etc"
                @echo -e "  LOGLEVEL\tdebug, info, warn, error"
                @echo -e "  NETWORK\tnetwork=default, bridge=onp1-dhcp, bridge=onp2-dhcp"
                @echo -e "  TO\t\t4.10.10, 4.11.11, 4.12.12, etc"
                @echo -e "  FROM\t\t4.10.10, 4.11.11, 4.12.12, etc"
                @echo -e "  BUTANE\tfile.bu"
    - path: /home/onp/openshift-network-playground/clean-bootstrap.sh
      mode: 0755
      overwrite: true
      user:
        name: onp
      group:
        name: onp
      contents:
        inline: |
          #!/bin/bash
          #
          # Remove old bootstrap resources if any are left over from a previous deployment attempt
          
          set -o pipefail
          
          BOOTSTRAP_RESOURCES=$(sudo virsh pool-list | grep bootstrap | awk '{print $1}' | xargs)
          MASTER_RESOURCES=$(sudo virsh list --all | grep master | awk '{print $2}' | xargs)
          
          if [ -z ${BOOTSTRAP_RESOURCES} ]; then
                  echo "No bootstrap resources ..."
          else
                  for RESOURCE in ${BOOTSTRAP_RESOURCES}; do
                          sudo virsh -q destroy ${RESOURCE} 2>/dev/null || true
                          sudo virsh -q undefine ${RESOURCE} 2>/dev/null || true
                          sudo virsh -q pool-start ${RESOURCE} 2>/dev/null || true
                          sudo virsh -q vol-delete ${RESOURCE} --pool ${RESOURCE} 2>/dev/null || true
                          sudo virsh -q vol-delete ${RESOURCE}-base --pool ${RESOURCE} 2>/dev/null || true
                          sudo virsh -q vol-delete ${RESOURCE}.ign --pool ${RESOURCE} 2>/dev/null || true
                          sudo virsh -q pool-destroy ${RESOURCE} 2>/dev/null || true
                          sudo virsh -q pool-delete ${RESOURCE} 2>/dev/null || true
                          sudo virsh -q pool-undefine ${RESOURCE} 2>/dev/null || true
                  done
          fi

          echo "Removing installation directory ..."
          rm -rf ${HOME}/openshift-network-playground/clusterconfigs

          echo "Powering off master nodes ..."
          if [[ -z ${MASTER_RESOURCES} ]]; then
                  echo "No master resources ..."
          else
                  for i in master0 master1 master2 worker0 worker1; do
                          sudo virsh -q destroy $i 2>/dev/null || true
                  done
          fi
    - path: /home/onp/openshift-network-playground/ssh-pullsecret.sh
      mode: 0755
      overwrite: true
      user:
        name: onp
      group:
        name: onp
      contents:
        inline: |
          #!/bin/bash
          # Download pull secret using OpenShift Cluster Manager API Token
          
          set -euo pipefail
          
          function USAGE {
                  echo "Usage: $0 '<OCM API Token>'"
                  echo "You need to authenticate using a Bearer token, which you can get from the link: https://cloud.redhat.com/openshift/token/show"
                  exit 1
          }
          
          function DOWNLOAD_PULLSECRET {
                  export BEARER=$(curl \
                          --silent \
                          --data-urlencode "grant_type=refresh_token" \
                          --data-urlencode "client_id=cloud-services" \
                          --data-urlencode "refresh_token=${OCM_API_TOKEN}" \
                          https://sso.redhat.com/auth/realms/redhat-external/protocol/openid-connect/token | \
                          jq -r .access_token)
                  [ -f ${SCRIPT_DIR}/pullsecret ] || curl -s -X POST https://api.openshift.com/api/accounts_mgmt/v1/access_token --header "Content-Type:application/json" --header "Authorization: Bearer $BEARER" > ${SCRIPT_DIR}/pullsecret
          }
          
          function SSH_KEY {
                  # rm -fv ${SCRIPT_DIR}/id_ed25519 ${SCRIPT_DIR}/id_ed25519.pub
                  [ -f ${SCRIPT_DIR}/id_ed25519 ] || ssh-keygen -q -t ed25519 -N '' -f ${SCRIPT_DIR}/id_ed25519
          }
          
          SCRIPT_DIR="$( cd -- "$( dirname -- "${BASH_SOURCE[0]:-$0}"; )" &> /dev/null && pwd 2> /dev/null; )"
          ARG_COUNT=${#}
          OCM_API_TOKEN=${1}
          ARG_SIZE=${#OCM_API_TOKEN}
          
          if [ ${ARG_COUNT} -eq 1 ] && [ ${ARG_SIZE} -gt 50 ]; then
                  ( SSH_KEY && echo "✔ SSH key generated!" ) || echo "✗ Error: SSH key generation failed!"
                  ( DOWNLOAD_PULLSECRET 1>/dev/null && echo "✔ Pull secret downloaded!" ) || echo "✗ Error: Pull secret download failed!"
          else
                  USAGE
          fi
    - path: /home/onp/openshift-network-playground/install-config.sh
      mode: 0755
      overwrite: true
      user:
        name: onp
      group:
        name: onp
      contents:
        inline: |
          set -euo pipefail

          SCRIPT_DIR="$( cd -- "$( dirname -- "${BASH_SOURCE[0]:-$0}"; )" &> /dev/null && pwd 2> /dev/null; )"
          export VERSION=${1}
          export RELEASE_IMAGE=$(curl -s https://mirror.openshift.com/pub/openshift-v4/clients/ocp/$VERSION/release.txt | grep 'Pull From: quay.io' | awk -F ' ' '{print $3}')
          export cmd=openshift-baremetal-install
          export pullsecret_file=${SCRIPT_DIR}/pullsecret
          export extract_dir=${SCRIPT_DIR}
          echo "Downloading oc binary ..."
          curl -s https://mirror.openshift.com/pub/openshift-v4/clients/ocp/$VERSION/openshift-client-linux.tar.gz | tar zxf - -C ${SCRIPT_DIR} oc
          sudo mv ${SCRIPT_DIR}/oc /usr/local/bin
          echo "✔ Downloaded!"
          echo "Downloading openshift-install binary ..."
          /usr/local/bin/oc adm release extract --registry-config "${pullsecret_file}" --command=$cmd --to "${extract_dir}" ${RELEASE_IMAGE}
          sudo mv ${SCRIPT_DIR}/openshift-baremetal-install /usr/local/bin
          echo "✔ Downloaded!"
          export RHCOS_QEMU_URI=$(/usr/local/bin/openshift-baremetal-install coreos print-stream-json | jq -r --arg ARCH "$(arch)" '.architectures[$ARCH].artifacts.qemu.formats["qcow2.gz"].disk.location')
          export RHCOS_QEMU_NAME=${RHCOS_QEMU_URI##*/}
          export RHCOS_QEMU_UNCOMPRESSED_SHA256=$(/usr/local/bin/openshift-baremetal-install coreos print-stream-json | jq -r --arg ARCH "$(arch)" '.architectures[$ARCH].artifacts.qemu.formats["qcow2.gz"].disk["uncompressed-sha256"]')
          echo "Downloading bootstrap os image ..."
          [ -f "/home/onp/openshift-network-playground/rhcos_image_cache/${RHCOS_QEMU_NAME}" ] || curl -sL ${RHCOS_QEMU_URI} -o /home/onp/openshift-network-playground/rhcos_image_cache/${RHCOS_QEMU_NAME}
          echo "✔ Downloaded!"
          export BAREMETAL_IP=$(ip addr show dev baremetal | awk '/inet /{print $2}' | cut -d"/" -f1)
          export BOOTSTRAP_OS_IMAGE="http://${BAREMETAL_IP}:8080/${RHCOS_QEMU_NAME}?sha256=${RHCOS_QEMU_UNCOMPRESSED_SHA256}"
          echo "Generating install-config.yaml file ..."
          cat << EOF > ${SCRIPT_DIR}/install-config.yaml
          apiVersion: v1
          baseDomain: example.local
          metadata:
            name: ocp
          networking:
            machineNetwork:
            - cidr: 192.168.123.0/24
            networkType: OVNKubernetes
          compute:
          - name: worker
            replicas: 0
          controlPlane:
            name: master
            replicas: 3
            platform:
              baremetal: {}
          platform:
            baremetal:
              libvirtURI: qemu:///system
              bootstrapOSImage: ${BOOTSTRAP_OS_IMAGE}
              apiVIP: 192.168.123.88
              ingressVIP: 192.168.123.89
              provisioningNetworkCIDR: 172.22.0.0/24
              hosts:
                - name: master0
                  role: master
                  bmc:
                    address: ipmi://192.168.123.1:6230
                    username: admin
                    password: password
                  bootMACAddress: 52:54:00:11:22:b1
                  hardwareProfile: libvirt
                  rootDeviceHints:
                   deviceName: "/dev/vda"
                - name: master1
                  role: master
                  bmc:
                    address: ipmi://192.168.123.1:6231
                    username: admin
                    password: password
                  bootMACAddress: 52:54:00:11:22:b2
                  hardwareProfile: libvirt
                  rootDeviceHints:
                   deviceName: "/dev/vda"
                - name: master2
                  role: master
                  bmc:
                    address: ipmi://192.168.123.1:6232
                    username: admin
                    password: password
                  bootMACAddress: 52:54:00:11:22:b3
                  hardwareProfile: libvirt
                  rootDeviceHints:
                   deviceName: "/dev/vda"
          pullSecret: '$(cat ${SCRIPT_DIR}/pullsecret)'
          sshKey: '$(cat ${SCRIPT_DIR}/id_ed25519.pub)'
          proxy:
            httpProxy: http://proxy.ocp.example.local:3128
            httpsProxy: http://proxy.ocp.example.local:4128
            noProxy: example.local,192.168.122.0/24,192.168.123.0/24,192.168.124.0/24,192.168.125.0/24,192.168.126.0/24,172.22.0.0/24
          additionalTrustBundle: |
          $(cat /opt/openshift-network-playground/proxy/certs/CA.pem | sed 's/^/    /')
          EOF
          echo "✔ Generated!"
          mkdir -p ${SCRIPT_DIR}/clusterconfigs
          echo "Copying install-config.yaml file to clusterconfigs directory ..."
          cp ${SCRIPT_DIR}/install-config.yaml ${SCRIPT_DIR}/clusterconfigs/
          echo "✔ Copied!"
    - path: /opt/openshift-network-playground/host/broadcast.sh
      mode: 0755
      overwrite: true
      contents:
        inline: |
          #!/bin/sh
          while true; do if [[ $(podman ps --format json | jq -r '.[] | .Names | .[]' | wc -l) == "3" ]]; then echo -e "The containerized services ($(podman ps --format json | jq -r '.[] | .Names | .[]' | xargs)) are ready.\nYou can start the OpenShift baremetal IPI installation now." | wall -n; break; fi; done
    - path: /home/onp/.bashrc
      append:
        - inline: |
            alias onp='make --no-print-directory -C ${HOME} -f /home/onp/.Makefile'
            alias konp='kubectl --kubeconfig ${HOME}/.kube/onp-kind-config'
            alias kovn='kubectl --kubeconfig ${HOME}/.kube/ovn-kind-config'
            alias kind='sudo KIND_EXPERIMENTAL_PROVIDER=podman kind'
            alias sno4='oc --kubeconfig ${HOME}/openshift-network-playground/sno4/auth/kubeconfig'
            alias sno6='oc --kubeconfig ${HOME}/openshift-network-playground/sno6/auth/kubeconfig'
            alias sno64='oc --kubeconfig ${HOME}/openshift-network-playground/sno64/auth/kubeconfig'
            alias ssh='ssh -i ${HOME}/openshift-network-playground/id_ed25519 -o StrictHostKeyChecking=no'
            export EDITOR=vi
            export PATH=${PATH}:/usr/local/go/bin
            export PATH=${PATH}:${HOME}/.local/network-tools/debug-scripts
            export KUBECONFIG=${HOME}/openshift-network-playground/clusterconfigs/auth/kubeconfig
            sed -i -e 's/      /\t/g' ${HOME}/.Makefile
    - path: /home/onp/.zshenv
      mode: 0644
      overwrite: true
      user:
        name: onp
      group:
        name: onp
      contents:
        inline: |
            alias onp='make --no-print-directory -C ${HOME} -f /home/onp/.Makefile'
            alias konp='kubectl --kubeconfig ${HOME}/.kube/onp-kind-config'
            alias kovn='kubectl --kubeconfig ${HOME}/.kube/ovn-kind-config'
            alias kind='sudo KIND_EXPERIMENTAL_PROVIDER=podman kind'
            alias sno='oc --kubeconfig ${HOME}/openshift-network-playground/sno/auth/kubeconfig'
            alias ssh='ssh -i ${HOME}/openshift-network-playground/id_ed25519 -o StrictHostKeyChecking=no'
            export EDITOR=vi
            export PATH=${PATH}:/usr/local/go/bin
            export PATH=${PATH}:${HOME}/.local/network-tools/debug-scripts
            export KUBECONFIG=${HOME}/openshift-network-playground/clusterconfigs/auth/kubeconfig
            sed -i -e 's/      /\t/g' ${HOME}/.Makefile
    - path: /home/onp/openshift-network-playground/worker0.yaml
      mode: 0755
      overwrite: true
      user:
        name: onp
      group:
        name: onp
      contents:
        inline: |
          apiVersion: v1
          kind: Secret
          metadata:
            name: openshift-worker-0-bmc-secret
            namespace: openshift-machine-api
          type: Opaque
          data:
            username: YWRtaW4K
            password: cGFzc3dvcmQK
          ---
          apiVersion: metal3.io/v1alpha1
          kind: BareMetalHost
          metadata:
            name: openshift-worker-0
            namespace: openshift-machine-api
          spec:
            online: true
            bootMACAddress: 52:54:00:11:22:b4
            bmc:
              address: ipmi://192.168.123.1:6233
              credentialsName: openshift-worker-0-bmc-secret
            rootDeviceHints:
              deviceName: "/dev/vda"
    - path: /home/onp/openshift-network-playground/worker1.yaml
      mode: 0755
      overwrite: true
      user:
        name: onp
      group:
        name: onp
      contents:
        inline: |
          apiVersion: v1
          kind: Secret
          metadata:
            name: openshift-worker-1-bmc-secret
            namespace: openshift-machine-api
          type: Opaque
          data:
            username: YWRtaW4K
            password: cGFzc3dvcmQK
          ---
          apiVersion: metal3.io/v1alpha1
          kind: BareMetalHost
          metadata:
            name: openshift-worker-1
            namespace: openshift-machine-api
          spec:
            online: true
            bootMACAddress: 52:54:00:11:22:b5
            bmc:
              address: ipmi://192.168.123.1:6234
              credentialsName: openshift-worker-1-bmc-secret
            rootDeviceHints:
              deviceName: "/dev/vda"
    - path: /home/onp/openshift-network-playground/99_openshift-machineconfig_99-master-core-passwd-auth.bu
      mode: 0755
      overwrite: true
      user:
        name: onp
      group:
        name: onp
      contents:
        inline: |
          variant: openshift
          version: 4.x.x
          metadata:
            labels:
              machineconfiguration.openshift.io/role: master
            name: 99-master-onp
          openshift:
            kernel_arguments:
            - console=ttyS0
            - console=tty0
          systemd:
            units:
              - name: serial-getty@ttyS0.service
                dropins:
                - name: autologin-core.conf
                  contents: |
                    [Service]
                    ExecStart=
                    ExecStart=-/usr/sbin/agetty --autologin core --noclear %I $TERM
          storage:
            files:
            - path: /etc/ssh/sshd_config.d/99-onp.conf
              mode: 0644
              overwrite: true
              contents:
                inline: |
                  PasswordAuthentication yes
    - path: /home/onp/openshift-network-playground/99_openshift-machineconfig_99-worker-core-passwd-auth.bu
      mode: 0755
      overwrite: true
      user:
        name: onp
      group:
        name: onp
      contents:
        inline: |
          variant: openshift
          version: 4.x.x
          metadata:
            labels:
              machineconfiguration.openshift.io/role: worker
            name: 99-worker-onp
          openshift:
            kernel_arguments:
            - console=ttyS0
            - console=tty0
          systemd:
            units:
              - name: serial-getty@ttyS0.service
                dropins:
                - name: autologin-core.conf
                  contents: |
                    [Service]
                    ExecStart=
                    ExecStart=-/usr/sbin/agetty --autologin core --noclear %I $TERM
          storage:
            files:
            - path: /etc/ssh/sshd_config.d/99-onp.conf
              mode: 0644
              overwrite: true
              contents:
                inline: |
                  PasswordAuthentication yes
    - path: /home/onp/.local/share/cockpit/openshift/deploy-cluster.sh
      mode: 0755
      overwrite: true
      user:
        name: onp
      group:
        name: onp
      contents:
        inline: |
          #!/bin/bash
          # This script initiates an OpenShift cluster deployment in transient systemd service.
          sudo systemd-run --uid=onp --unit=deploy-cluster --remain-after-exit --description='OpenShift cluster deployment' make -C /home/onp/ -f /home/onp/.Makefile deploy RELEASE=${1} OCM_TOKEN=${2}
          journalctl -f -u deploy-cluster.service
    - path: /home/onp/.local/share/cockpit/openshift/manifest.json
      mode: 0755
      overwrite: true
      user:
        name: onp
      group:
        name: onp
      contents:
        inline: |
          {
            "version": 0,
            "tools": {
              "openshift": {
                "label": "OpenShift",
                "path": "openshift.html"
              }
            }
          }
    - path: /home/onp/.local/share/cockpit/openshift/openshift.html
      mode: 0755
      overwrite: true
      user:
        name: onp
      group:
        name: onp
      contents:
        inline: |
          <!DOCTYPE html>
          <html>
          <head>
              <title>OpenShift</title>
              <meta charset="utf-8">
              <script src="../base1/cockpit.js"></script>
          </head>
          <body class="pf-m-redhat-font">
              <main tabindex="-1">
                  <section>
                      <div id="app">
                          <h3> OpenShift cluster credentials </h3>
                          <div>
                              <button id="passwordButton">Show</button>
                              <span id="passwordResult"></span>
                          </div>
                          <div>
                              <pre id="passwordOutput"></pre>
                          </div>
                          <h3> Deploy a compact OpenShift cluster </h3>
                          <div>
                              <label for="deployRelease">Release</label>
                              <input id="deployRelease" value="stable">
                          </div>
                          <div>
                              <p>
                              <label for="deployToken">OCM token</label>
                              <input id="deployToken" value="">
                              </p>
                          </div>
                          <div>
                              <p>
                              Get OCM token from <a href="https://cloud.redhat.com/openshift/token/show" target="_blank">here</a>.
                              OCM token is only reqired in the first deployment. The pullsecret will be saved locally.
                              </p>
                          </div>
                          <div>
                              <button id="deployButton">Deploy</button>
                              <span id="deployResult"></span>
                          </div>
                          <div>
                              <pre id="deployOutput"></pre>
                          </div>
                      </div>
                  </section>
              </main>
          
              <script src="deploy.js"></script>
              <script src="password.js"></script>
          </body>
          </html>
    - path: /home/onp/.local/share/cockpit/openshift/deploy.js
      mode: 0755
      overwrite: true
      user:
        name: onp
      group:
        name: onp
      contents:
        inline: |
          const deployRelease = document.getElementById("deployRelease");
          const deployToken = document.getElementById("deployToken");
          const deployOutput = document.getElementById("deployOutput");
          const deployResult = document.getElementById("deployResult");
          const deployButton = document.getElementById("deployButton");
          
          function deploy_run() {
              /* global cockpit */
              cockpit.spawn(["/home/onp/.local/share/cockpit/openshift/deploy-cluster.sh", deployRelease.value, deployToken.value])
                      .stream(deploy_output)
                      .then(deploy_success)
                      .catch(deploy_fail);
          
              deployResult.innerHTML = "";
              deployOutput.innerHTML = "";
          }
          
          function deploy_success() {
              deployResult.style.color = "green";
              deployResult.innerHTML = "Deployment started!";
          }
          
          function deploy_fail() {
              deployResult.style.color = "red";
              deployResult.innerHTML = "Deployment failed!";
          }
          
          function deploy_output(data) {
              deployOutput.append(document.createTextNode(data));
          }
          
          // Connect the button to starting the "deploy" process
          deployButton.addEventListener("click", deploy_run);
          
          // Send a 'init' message.  This tells integration tests that we are ready to go
          cockpit.transport.wait(function() { });
    - path: /home/onp/.local/share/cockpit/openshift/password.js
      mode: 0755
      overwrite: true
      user:
        name: onp
      group:
        name: onp
      contents:
        inline: |
          const passwordOutput = document.getElementById("passwordOutput");
          const passwordResult = document.getElementById("passwordResult");
          const passwordButton = document.getElementById("passwordButton");
          
          function password_run() {
              /* global cockpit */
              cockpit.spawn(["/home/onp/.local/share/cockpit/openshift/password.sh"])
                      .stream(password_output)
                      .then(password_success)
                      .catch(password_fail);
          
              passwordResult.innerHTML = "";
              passwordOutput.innerHTML = "";
          }
          
          function password_success() {
              passwordResult.style.color = "green";
              passwordResult.innerHTML = "Found credentials!";
          }
          
          function password_fail() {
              passwordResult.style.color = "red";
              passwordResult.innerHTML = "No credentials!";
          }
          
          function password_output(data) {
              passwordOutput.append(document.createTextNode(data));
          }
          
          // Connect the button to starting the "show" process
          passwordButton.addEventListener("click", password_run);
          
          // Send a 'init' message.  This tells integration tests that we are ready to go
          cockpit.transport.wait(function() { });
    - path: /home/onp/.local/share/cockpit/openshift/password.sh
      mode: 0755
      overwrite: true
      user:
        name: onp
      group:
        name: onp
      contents:
        inline: |
          #!/bin/bash

          set -eou pipefail

          PASSWORD=$(cat /home/onp/openshift-network-playground/clusterconfigs/auth/kubeadmin-password)
          IP=$(/usr/sbin/ip r s default | awk '{print $9}' | head -n 1)

          cat << EOF
          Console
          URL      : https://console-openshift-console.apps.ocp.example.local
          username : kubeadmin
          password : ${PASSWORD}
          DNS      : echo "${IP} console-openshift-console.apps.ocp.example.local oauth-openshift.apps.ocp.example.local" | sudo tee -a /etc/hosts

          CLI
          command : oc login -u kubeadmin -p ${PASSWORD} https://api.ocp.example.local:6443
          DNS     : echo "${IP} api.ocp.example.local" | sudo tee -a /etc/hosts
          EOF
    - path: /home/onp/openshift-network-playground/sno.sh
      mode: 0755
      overwrite: true
      user:
        name: onp
      group:
        name: onp
      contents:
        inline: |
          set -euo pipefail
          
          ONPDIR="$( cd -- "$( dirname -- "${BASH_SOURCE[0]:-$0}"; )" &> /dev/null && pwd 2> /dev/null; )"
          VERSION=${1}
          NAME=${2}
          
          rm -rf ${ONPDIR}/${NAME}
          rm -rf ${ONPDIR}/${NAME}.yaml
          echo "Downloading oc binary ..."
          curl -s https://mirror.openshift.com/pub/openshift-v4/clients/ocp/$VERSION/openshift-client-linux.tar.gz | tar zxf - -C ${ONPDIR} oc
          sudo mv ${ONPDIR}/oc /usr/local/bin
          echo "✔ Downloaded!"
          echo "Downloading openshift-install binary ..."
          curl -s https://mirror.openshift.com/pub/openshift-v4/clients/ocp/$VERSION/openshift-install-linux.tar.gz | tar zxf - -C ${ONPDIR} openshift-install
          sudo mv ${ONPDIR}/openshift-install /usr/local/bin
          echo "✔ Downloaded!"
          echo "Downloading RHCOS ISO ..."
          sudo mkdir -p /opt/openshift-network-playground/libvirt/${NAME}
          sudo rm -f /opt/openshift-network-playground/libvirt/sno4/rhcos-live.iso
          sudo rm -f /opt/openshift-network-playground/libvirt/sno6/rhcos-live.iso
          sudo rm -f /opt/openshift-network-playground/libvirt/sno64/rhcos-live.iso
          sudo curl -sLo /opt/openshift-network-playground/libvirt/${NAME}/rhcos-live.iso $(/usr/local/bin/openshift-install coreos print-stream-json | grep location | grep x86_64 | grep iso | cut -d\" -f4)
          echo "✔ Downloaded!"
          echo "Generating install-config.yaml file ..."
          case ${NAME} in
          sno4)
          cat << EOF > ${ONPDIR}/${NAME}.yaml
          apiVersion: v1
          baseDomain: example.local
          metadata:
            name: ${NAME}
          networking:
            clusterNetwork:
            - cidr: 10.128.0.0/14
              hostPrefix: 23
            machineNetwork:
            - cidr: 192.168.123.0/24
            networkType: OVNKubernetes
            serviceNetwork:
            - 172.30.0.0/16
          compute:
          - name: worker
            replicas: 0
          controlPlane:
            name: master
            replicas: 1
          platform:
            none: {}
          bootstrapInPlace:
            installationDisk: /dev/sda
          pullSecret: '$(cat ${ONPDIR}/pullsecret)'
          sshKey: '$(cat ${ONPDIR}/id_ed25519.pub)'
          EOF
          ;;
          sno6)
          cat << EOF > ${ONPDIR}/${NAME}.yaml
          apiVersion: v1
          baseDomain: example.local
          metadata:
            name: ${NAME}
          networking:
            machineNetwork:
            - cidr: fd00:dead:beef::/96
            clusterNetwork:
            - cidr: fd01::/48
              hostPrefix: 64
            serviceNetwork:
            - fd02::/112
            networkType: OVNKubernetes
          compute:
          - name: worker
            replicas: 0
          controlPlane:
            name: master
            replicas: 1
          platform:
            none: {}
          bootstrapInPlace:
            installationDisk: /dev/sda
          pullSecret: '$(cat ${ONPDIR}/pullsecret)'
          sshKey: '$(cat ${ONPDIR}/id_ed25519.pub)'
          EOF
          ;;
          sno64)
          cat << EOF > ${ONPDIR}/${NAME}.yaml
          apiVersion: v1
          baseDomain: example.local
          metadata:
            name: ${NAME}
          networking:
            machineNetwork:
            - cidr: 192.168.123.0/24
            - cidr: fd00:dead:beef::/96
            clusterNetwork:
            - cidr: 10.128.0.0/14
              hostPrefix: 23
            - cidr: fd01::/48
              hostPrefix: 64
            serviceNetwork:
            - 172.30.0.0/16
            - fd02::/112
            networkType: OVNKubernetes
          compute:
          - name: worker
            replicas: 0
          controlPlane:
            name: master
            replicas: 1
          platform:
            none: {}
          bootstrapInPlace:
            installationDisk: /dev/sda
          pullSecret: '$(cat ${ONPDIR}/pullsecret)'
          sshKey: '$(cat ${ONPDIR}/id_ed25519.pub)'
          EOF
          ;;
          *) # do nothing
          ;;
          esac
          echo "✔ Generated!"
          mkdir -p ${ONPDIR}/${NAME}
          echo "Copying install-config.yaml file to the installation directory ..."
          cp ${ONPDIR}/${NAME}.yaml ${ONPDIR}/${NAME}/install-config.yaml
          echo "✔ Copied!"
          sudo virsh -q destroy sno4 2>/dev/null || true
          sudo virsh -q destroy sno6 2>/dev/null || true
          sudo virsh -q destroy sno64 2>/dev/null || true
          sudo virsh -q undefine sno4 2>/dev/null || true
          sudo virsh -q undefine sno6 2>/dev/null || true
          sudo virsh -q undefine sno64 2>/dev/null || true
          sudo rm -f /opt/openshift-network-playground/libvirt/sno4/sno4.img
          sudo rm -f /opt/openshift-network-playground/libvirt/sno6/sno6.img
          sudo rm -f /opt/openshift-network-playground/libvirt/sno64/sno64.img
          sudo qemu-img create /opt/openshift-network-playground/libvirt/${NAME}/${NAME}.img 120G
    - path: /home/onp/openshift-network-playground/sno-restart.sh
      mode: 0755
      overwrite: true
      user:
        name: onp
      group:
        name: onp
      contents:
        inline: |
          #!/bin/bash
          
          NAME=${1}
          
          function WAIT_FOR_REBOOT {
          sp='/-\|'
          sc=0
          
          spin() {
             printf "\r[${sp:sc++:1}] $1"
             ((sc==${#sp})) && sc=0
          }
          
          endspin() {
             printf "\r%s\n" "$@"
          }
          
          until [[ $(sudo virsh -q list | grep -o ${NAME} | wc -c) -eq 0 ]]
          do spin "Waiting for the installation and restart ..."
          sleep 0.5
          done
          endspin
          }
          
          function START_NODE {
                  sudo virsh start ${NAME} > /dev/null
                  echo "[✔] Installation completed!"
          }
          
          WAIT_FOR_REBOOT
          START_NODE
    - path: /home/onp/openshift-network-playground/sno4-enp1s0.nmconnection
      mode: 0755
      overwrite: true
      user:
        name: onp
      group:
        name: onp
      contents:
        inline: |
          [connection]
          id=ens3
          type=ethernet
          autoconnect=yes
          interface-name=enp1s0
          [ipv6]
          method=disabled
          [ipv4]
          method=manual
          addresses=192.168.126.2/24
          dns=192.168.126.1
          gateway=192.168.126.1
    - path: /home/onp/openshift-network-playground/sno6-enp1s0.nmconnection
      mode: 0755
      overwrite: true
      user:
        name: onp
      group:
        name: onp
      contents:
        inline: |
          [connection]
          id=ens3
          type=ethernet
          autoconnect=yes
          interface-name=enp1s0
          [ipv6]
          method=manual
          addresses=fd00:dead:beef::2/96
          dns=fd00:dead:beef::1
          gateway=fd00:dead:beef::1
          [ipv4]
          method=disabled
    - path: /home/onp/openshift-network-playground/sno64-enp1s0.nmconnection
      mode: 0755
      overwrite: true
      user:
        name: onp
      group:
        name: onp
      contents:
        inline: |
          [connection]
          id=ens3
          type=ethernet
          autoconnect=yes
          interface-name=enp1s0
          [ipv6]
          method=manual
          addresses=fd00:dead:beef::3/96
          dns=fd00:dead:beef::1
          gateway=fd00:dead:beef::1
          [ipv4]
          method=manual
          addresses=192.168.126.3/24
          dns=192.168.126.1
          gateway=192.168.126.1
    - path: /home/onp/openshift-network-playground/fcos.sh
      mode: 0755
      overwrite: true
      user:
        name: onp
      group:
        name: onp
      contents:
        inline: |
          #!/bin/bash
          set -exuo pipefail
          DIR=/opt/openshift-network-playground/libvirt/fcos
          
          function downloadImage {
                  sudo mkdir -p ${DIR}
                  STREAM="stable"
                  sudo podman run --pull=always \
                             --rm -v ${DIR}:/data \
                             --workdir /data \
                             quay.io/coreos/coreos-installer:release \
                             download -s ${STREAM} -p qemu -f qcow2.xz --decompress
          }
          
          function createButane {
          cat << EOF | sudo tee ${DIR}/fcos.bu
          variant: fcos
          version: 1.4.0
          passwd:
            users:
              - name: core
                groups:
                  - wheel
                  - sudo
                password_hash: \$y\$j9T\$9NWuGa4oxrKeZ6T8eo8Ef1\$cEQV6UhM1XvR2sfUvSwKs.BTmYNut3VRP33/c5qfw35
          EOF
          }
          
          function createIgnition {
                  sudo podman run --interactive \
                             --rm quay.io/coreos/butane:release \
                             --pretty \
                             --strict \
                             < ${DIR}/fcos.bu \
                             | sudo tee ${DIR}/fcos.ign
          }
          
          function createVirtualMachine {
                  IGNITION_CONFIG="${DIR}/fcos.ign"
                  IMAGE="${DIR}/fedora*.qcow2"
                  DISK="${DIR}/fcos.qcow2"
                  VM_NAME="fcos"
                  VCPUS="2"
                  RAM_MB="2048"
                  STREAM="stable"
                  DISK_GB="10"
                  IGNITION_DEVICE_ARG=(--qemu-commandline="-fw_cfg name=opt/com.coreos/config,file=${IGNITION_CONFIG}")
          
                  sudo cp ${DIR}/fedora-coreos-* ${DIR}/fcos.qcow2
                  sudo virsh destroy fcos > /dev/null 2>&1 || :
                  sudo virsh undefine fcos > /dev/null 2>&1 || :
                  sudo virt-install --connect="qemu:///system" \
                          --name=${VM_NAME} \
                          --vcpus=${VCPUS} \
                          --memory=${RAM_MB} \
                          --pxe \
                          --boot menu=on \
                          --os-variant=fedora-coreos-${STREAM} \
                          --import \
                          --graphics spice,listen=0.0.0.0 \
                          --noautoconsole \
                          --disk=size=${DISK_GB} \
                          --network network=default \
                          "${IGNITION_DEVICE_ARG[@]}"
                  watch sudo virsh domifaddr fcos
          }
          
          function main {
                  downloadImage
                  createButane
                  createIgnition
                  createVirtualMachine
          }
          
          main
    - path: /home/onp/openshift-network-playground/store-release.sh
      mode: 0755
      overwrite: true
      user:
        name: onp
      group:
        name: onp
      contents:
        inline: |
          #!/bin/bash
          RELEASE=${1}

          function check_size() {
                  SIZE=$(du -cs /opt/openshift-network-playground/libvirt/master* | tail -n1 | awk '{print $1}')
                  SIZEH=$(du -csh /opt/openshift-network-playground/libvirt/master* | tail -n1 | awk '{print $1}')
                  FREE=$(df -P /opt | sed -n 2p | awk '{print $4}')
                  FREEH=$(df -Ph /opt | sed -n 2p | awk '{print $4}')
                  if [[ ${SIZE} -gt ${FREE} ]]; then
                          echo "Error: /opt does not have enough space - Have: ${FREEH} Need: ${SIZEH}"
                          exit 0
                  fi
          }

          function check_release() {
                  if [ -d /opt/openshift-network-playground/${RELEASE} ]; then
                          echo "Directory named $RELEASE exists. It will be replaced."
                          read -r -p "Do you want to continue? [y/N] " response
                                  case "$response" in
                                          [yY][eE][sS]|[yY])
                                                  echo "Removing files..."
                                                  sudo rm -rf /opt/openshift-network-playground/$RELEASE
                                          ;;
                                          *)
                                                  exit 0
                                          ;;
                                  esac
                  fi
          }
          
          function wait_for_shutdown() {
                  sp='/-\|'
                  sc=0
          
                  spin() {
                          printf "\r[${sp:sc++:1}] $1"
                          ((sc==${#sp})) && sc=0
                  }
          
                  endspin() {
                          printf "\r%s\n" "$@"
                  }
          
                  until [[ $(sudo virsh -q list 2>/dev/null | grep -o master | wc -c) -eq 0 ]]
                          do spin "Waiting for the shutdown ..."
                          sleep 0.5
                  done
                  endspin
          }
          
          function setup() {
                  if [[ $(sudo virsh -q list 2>/dev/null | grep -o master | wc -c) != 0 ]]; then
                          for node in $(oc get nodes -o jsonpath='{.items[*].metadata.name}'); do ssh -i openshift-network-playground/id_ed25519 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no core@${node} -- sudo shutdown -h 1; done
                          wait_for_shutdown
                  fi
          
                  sudo mkdir -p /opt/openshift-network-playground/${RELEASE}
          }
          
          function store_release() {
                  for i in master0 master1 master2;
                  do
                          if [ ! -f /opt/openshift-network-playground/${RELEASE}/$i/$i.img ]; then
                                  sudo sudo mkdir -p /opt/openshift-network-playground/${RELEASE}/$i
                                  sudo cp /opt/openshift-network-playground/libvirt/$i/$i.img /opt/openshift-network-playground/${RELEASE}/$i/$i.img
                                  echo "Copied $i.img!"
                          fi
                  done
                  if [ ! -f /opt/openshift-network-playground/${RELEASE}/kubeconfig ]; then
                          sudo cp ${HOME}/openshift-network-playground/clusterconfigs/auth/kubeconfig /opt/openshift-network-playground/${RELEASE}/
                          echo "Copied kubeconfig!"
                          sudo cp ${HOME}/openshift-network-playground/clusterconfigs/auth/kubeadmin-password /opt/openshift-network-playground/${RELEASE}/
                          echo "Copied kubeadmin-password!"
                  fi
          }
          
          check_size
          check_release
          setup
          store_release
    - path: /home/onp/openshift-network-playground/restore-release.sh
      mode: 0755
      overwrite: true
      user:
        name: onp
      group:
        name: onp
      contents:
        inline: |
          #!/bin/bash

          RELEASE=${1}
          
          function download_oc() {
                  echo "Downloading oc binary ..."
                  curl -# https://mirror.openshift.com/pub/openshift-v4/clients/ocp/$RELEASE/openshift-client-linux.tar.gz | tar xzf /dev/stdin oc
                  sudo mv oc /usr/local/bin/
                  echo "✔ Downloaded!"
          }
          
          function setup() {
                  sudo systemctl restart dhcp
          }
          
          function restore_release() {
                  for i in master0 master1 master2;
                  do
                          if [ -f /opt/openshift-network-playground/${RELEASE}/$i/$i.img ]; then
                                  sudo virsh -q destroy $i 2>/dev/null
                                  sudo cp /opt/openshift-network-playground/${RELEASE}/$i/$i.img /opt/openshift-network-playground/libvirt/$i/$i.img
                                  sudo virsh -q start $i
                                  echo "$i started!"
                          else
                                  echo "No $i.img file in /opt/openshift-network-playground/${RELEASE}/$i/"
                          fi
                  done
                  if [ -f /opt/openshift-network-playground/${RELEASE}/kubeconfig ]; then
                          mkdir -p openshift-network-playground/clusterconfigs/auth
                          sudo cp /opt/openshift-network-playground/${RELEASE}/kubeconfig ${HOME}/openshift-network-playground/clusterconfigs/auth/kubeconfig
                          sudo chown onp:onp ${HOME}/openshift-network-playground/clusterconfigs/auth/kubeconfig
                          sudo cp /opt/openshift-network-playground/${RELEASE}/kubeadmin-password ${HOME}/openshift-network-playground/clusterconfigs/auth/kubeadmin-password
                          sudo chown onp:onp ${HOME}/openshift-network-playground/clusterconfigs/auth/kubeadmin-password
                          download_oc
                  else
                          echo "No kubeconfig file in /opt/openshift-network-playground/${RELEASE}/"
                  fi
          }
          
          restore_release
          setup
    - path: /home/onp/openshift-network-playground/rhcos.sh
      mode: 0755
      overwrite: true
      user:
        name: onp
      group:
        name: onp
      contents:
        inline: |
          #!/bin/bash
          # The script only needs the butane file as an arg
          
          set -eou pipefail
          
          BUTANE=$(readlink -f ${1})
          IGNITION_NAME=$(basename -- ${BUTANE})
          IGNITION_NAME=${IGNITION_NAME%.*}
          RELEASE=$(grep 4[.][0-9] ${BUTANE} | awk '{print $2}')
          RELEASE_IMAGE=$(curl -s https://mirror.openshift.com/pub/openshift-v4/clients/ocp/${RELEASE}/release.txt | grep 'Pull From: quay.io' | awk -F ' ' '{print $3}')
          CMD=openshift-baremetal-install
          PULLSECRET=${HOME}/openshift-network-playground/pullsecret
          DIRECTORY=/opt/openshift-network-playground/libvirt/rhcos
         
          sudo mkdir -p ${DIRECTORY}
          podman run --interactive --rm quay.io/coreos/butane:release --raw --strict < ${BUTANE} | sudo tee ${DIRECTORY}/${IGNITION_NAME}.ign > /dev/null
          
          echo "Downloading oc binary ..."
          if [ ! -f "${DIRECTORY}/oc" ] || [ "$(${DIRECTORY}/oc version --client -o json | jq -r .releaseClientVersion)" != "${RELEASE}" ]; then
          curl -s https://mirror.openshift.com/pub/openshift-v4/clients/ocp/${RELEASE}/openshift-client-linux.tar.gz | sudo tar zxf - -C ${DIRECTORY} oc
          fi
          echo "✔ Downloaded!"
          
          echo "Downloading openshift-install binary ..."
          if [ ! -f "${DIRECTORY}/openshift-baremetal-install" ] || [ "$(${DIRECTORY}/openshift-baremetal-install version | head -n 1 | awk '{print $2}')" != "${RELEASE}" ]; then
          sudo ${DIRECTORY}/oc adm release extract --registry-config "${PULLSECRET}" --command=${CMD} --to "${DIRECTORY}" ${RELEASE_IMAGE}
          fi
          echo "✔ Downloaded!"
          
          RHCOS_QEMU_URI=$(${DIRECTORY}/openshift-baremetal-install coreos print-stream-json | jq -r --arg ARCH "$(arch)" '.architectures[$ARCH].artifacts.qemu.formats["qcow2.gz"].disk.location')
          RHCOS_QEMU_NAME=${RHCOS_QEMU_URI##*/}
          echo "Downloading image ..."
          
          if [ ! -f "${DIRECTORY}/${RHCOS_QEMU_NAME}" ]; then
          sudo curl -#L ${RHCOS_QEMU_URI} -o ${DIRECTORY}/${RHCOS_QEMU_NAME}
          fi
          echo "✔ Downloaded!"
          
          echo "Extracting image ..."
          gunzip -c ${DIRECTORY}/${RHCOS_QEMU_NAME} | sudo tee ${DIRECTORY}/${RHCOS_QEMU_NAME%.*} > /dev/null
          sudo cp ${DIRECTORY}/${RHCOS_QEMU_NAME%.*} ${DIRECTORY}/rhcos.qcow2
          echo "✔ Extracted!"
          
          DISK=${DIRECTORY}/rhcos.qcow2
          VM_NAME=$(basename -- ${DISK})
          VM_NAME=${VM_NAME%.*}
          
          sudo virsh -q destroy ${VM_NAME} > /dev/null || true
          sudo virsh -q undefine ${VM_NAME} > /dev/null || true
          sudo virt-install --name ${VM_NAME} \
                            --vcpus 2 \
                            --ram 2048 \
                            --os-variant fedora-coreos-stable \
                            --import --network bridge=baremetal \
                            --qemu-commandline="-fw_cfg name=opt/com.coreos/config,file=${DIRECTORY}/${IGNITION_NAME}.ign" \
                            --disk ${DISK} \
                            --graphics spice,listen=0.0.0.0 \
                            --video virtio \
                            --channel spicevmc \
                            --console pty \
                            --serial pty \
                            --noautoconsole
          sudo virsh console ${VM_NAME}
    - path: /home/onp/openshift-network-playground/core-passwd.bu
      mode: 0644
      overwrite: true
      user:
        name: onp
      group:
        name: onp
      contents:
        inline: |
          variant: openshift
          version: 4.13.0
          metadata:
            labels:
              machineconfiguration.openshift.io/role: onp
            name: core-passwd
          storage:
            files:
            - path: /etc/ssh/sshd_config.d/99-onp.conf
              mode: 0644
              overwrite: true
              contents:
                inline: |
                  PasswordAuthentication yes
          systemd:
            units:
            - name: onp.service
              enabled: true
              contents: |
                [Service]
                Type=oneshot
                ExecStart=/usr/bin/sh -c '/usr/bin/echo "Core@123" | /usr/bin/passwd --stdin core'
                RemainAfterExit=yes
                [Install]
                WantedBy=multi-user.target