Allow configuring CoreOS IPA as a new entrypoint

Adds a new entrypoint /bin/configure-coreos-ipa to be run as an init
container after the images are downloaded.

Dockerfile.ocp

@@ -36,7 +36,7 @@ COPY --from=builder /tmp/esp.img /tmp/uefi_esp.img
 
 COPY ironic-config/ironic.conf.j2 /etc/ironic/
 COPY ironic-config/dnsmasq.conf.j2 /etc/
-COPY ironic-config/inspector.ipxe.j2 ironic-config/dualboot.ipxe /tmp/
+COPY ironic-config/inspector.ipxe.j2 ironic-config/dualboot.ipxe ironic-config/ironic-python-agent.ign.j2 /tmp/
 
 # Custom httpd config, removes all but the bare minimum needed modules
 RUN rm -f /etc/httpd/conf.d/autoindex.conf /etc/httpd/conf.d/welcome.conf /etc/httpd/conf.modules.d/*.conf

Dockerfile.okd

@@ -51,7 +51,7 @@ COPY ./runlogwatch.sh /bin/runlogwatch.sh
 COPY ./runironic.sh /bin/runironic
 
 COPY ./dnsmasq.conf.j2 /etc/dnsmasq.conf.j2
-COPY config/inspector.ipxe.j2 config/dualboot.ipxe /tmp/
+COPY ironic-config/inspector.ipxe.j2 ironic-config/dualboot.ipxe ironic-config/ironic-python-agent.ign.j2 /tmp/
 
 # Custom httpd config, removes all but the bare minimum needed modules
 RUN rm -f /etc/httpd/conf.d/autoindex.conf /etc/httpd/conf.d/welcome.conf /etc/httpd/conf.modules.d/*.conf

ironic-config/ironic-python-agent.ign.j2

@@ -0,0 +1,59 @@
+{% set service %}
+[Unit]
+Description=Ironic Agent
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+TimeoutStartSec=0
+ExecStartPre=/bin/podman pull {{ env.IRONIC_AGENT_REGISTRY }}/ironic-agent --tls-verify=false
+ExecStart=/bin/podman run --privileged --network host --mount type=bind,src=/etc/ironic-python-agent.conf,dst=/etc/ironic-python-agent/ignition.conf --mount type=bind,src=/dev,dst=/dev --mount type=bind,src=/sys,dst=/sys --mount type=bind,src=/,dst=/mnt/coreos --name ironic-agent ironic-agent
+
+[Install]
+WantedBy=multi-user.target
+{% endset -%}
+
+{% set ipa_config %}
+[DEFAULT]
+api_url = {{ env.IRONIC_BASE_URL }}:6385
+inspection_callback_url = {{ env.IRONIC_BASE_URL }}:5050/v1/continue
+
+collect_lldp = True
+enable_vlan_interfaces = {{ env.IRONIC_INSPECTOR_VLAN_INTERFACES }}
+inspection_collectors = default,extra-hardware,logs
+inspection_dhcp_all_interfaces = True
+{% endset -%}
+
+
+{
+  "ignition": {
+    "version": "3.0.0"
+  },
+  {% if env.IRONIC_RAMDISK_SSH_KEY %}
+  "passwd": {
+    "users": [
+      {
+        "name": "core",
+        "sshAuthorizedKeys": [
+          "{{ env.IRONIC_RAMDISK_SSH_KEY | trim }}"
+        ]
+      }
+    ]
+  },
+  {% endif -%}
+  "storage": {
+    "files": [{
+      "path": "/etc/ironic-python-agent.conf",
+      "contents": {"source": "data:,{{ ipa_config | urlencode }}"}
+    }]
+  },
+  "systemd": {
+    "units": [
+      {
+        "contents": "{{ service | trim | replace('\n', '\\n') }}",
+        "enabled": true,
+        "name": "ironic-agent.service"
+      }
+    ]
+  }
+}

main-packages-list.txt

@@ -1,3 +1,4 @@
+coreos-installer
 crudini
 dnsmasq >= 2.79-13.el8_3.1
 gdisk
@@ -47,4 +48,4 @@ python3-sushy >= 3.9.1-0.20210610202221.5b38ec5.el8
 python3-sushy-oem-idrac >= 2.0.1-0.20210326153413.83b7eb0.el8
 python3-zipp >= 0.5.1-2.el8ost
 qemu-img
-sqlite
+sqlite

scripts/configure-coreos-ipa

@@ -0,0 +1,20 @@
+#!/usr/bin/bash
+
+. /bin/ironic-common.sh
+. /bin/coreos-ipa-common.sh
+
+export IRONIC_INSPECTOR_VLAN_INTERFACES=${IRONIC_INSPECTOR_VLAN_INTERFACES:-all}
+
+IRONIC_CERT_FILE=/certs/ironic/tls.crt
+
+if [ -f "$IRONIC_CERT_FILE" ]; then
+    export IRONIC_BASE_URL="https://${IRONIC_URL_HOST}"
+else
+    export IRONIC_BASE_URL="http://${IRONIC_URL_HOST}"
+fi
+
+# FIXME(dtantsur): the default is most certainly undesired
+export IRONIC_AGENT_REGISTRY=${IRONIC_AGENT_REGISTRY:-quay.io/dtantsur/ironic-agent}
+
+render_j2_config /tmp/ironic-python-agent.ign.j2 "$IGNITION_FILE"
+coreos-installer iso ignition embed -i "$IGNITION_FILE" -f "$ISO_FILE"

scripts/configure-ironic.sh

@@ -145,6 +145,11 @@ EOF
     fi
 fi
 
+. /bin/coreos-ipa-common.sh
+if use_coreos_ipa; then
+    IRONIC_KERNEL_PARAMS+=" $(coreos_kernel_params)"
+fi
+
 # The original ironic.conf is empty, and can be found in ironic.conf_orig
 render_j2_config /etc/ironic/ironic.conf.j2 /etc/ironic/ironic.conf
 

scripts/coreos-ipa-common.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/bash
+
+ROOTFS_FILE=/shared/html/images/ironic-python-agent.rootfs
+IGNITION_FILE=/shared/html/ironic-python-agent.ign
+ISO_FILE=/shared/html/images/ironic-python-agent.iso
+
+function coreos_kernel_params {
+    echo -n "coreos.live.rootfs_url=http://$IRONIC_IP:$HTTP_PORT/images/ironic-python-agent.rootfs"
+    echo -n " ignition.config.url=http://$IRONIC_IP:$HTTP_PORT/ironic-python-agent.ign"
+    echo " ignition.firstboot ignition.platform.id=metal"
+}
+
+function use_coreos_ipa {
+    [ -f "$ROOTFS_FILE" ] && [ -f "$IGNITION_FILE" ] && return 0 || return 1
+}

scripts/runhttpd

@@ -25,6 +25,11 @@ else
     INSPECTOR_EXTRA_ARGS=" ipa-inspection-callback-url=${IRONIC_BASE_URL}:5050/v1/continue"
 fi
 
+. /bin/coreos-ipa-common.sh
+if use_coreos_ipa; then
+    INSPECTOR_EXTRA_ARGS+=" $(coreos_kernel_params)"
+fi
+
 # Copy files to shared mount
 render_j2_config /tmp/inspector.ipxe.j2 /shared/html/inspector.ipxe
 cp /tmp/dualboot.ipxe /shared/html/dualboot.ipxe