a886b4958b
- changed "secure port" to "tls port" - removed the --create flag for "wwctl configure tls"; made it the default behavior - fixed a TLS creation bug in "wwctl configure --all" - added logging to "wwctl configure tls" and "wwctl configure --all" (for the tls case) Signed-off-by: Jonathon Anderson <janderson@ciq.com>
78 lines
2.6 KiB
Bash
78 lines
2.6 KiB
Bash
#!/bin/bash
|
|
|
|
[ -z "${wwinit_root_device}" ] && return 0
|
|
|
|
get_stage() {
|
|
stage="${1}"
|
|
uri="${2:-${wwinit_uri}}"
|
|
cacert="${3}"
|
|
info "warewulf: loading stage: ${stage}"
|
|
# Load runtime overlay from a static privledged port.
|
|
# Others use default settings.
|
|
localport=""
|
|
if [ "${stage}" = "runtime" ]; then
|
|
localport="--local-port 1-1023"
|
|
fi
|
|
cacert_opt=""
|
|
if [ -n "${cacert}" ]; then
|
|
cacert_opt="--cacert ${cacert}"
|
|
fi
|
|
(
|
|
curl --location --silent --get ${localport} ${cacert_opt} \
|
|
--retry 60 --retry-connrefused --retry-delay 1 \
|
|
--data-urlencode "assetkey=${wwinit_assetkey}" \
|
|
--data-urlencode "uuid=${wwinit_uuid}" \
|
|
--data-urlencode "stage=${stage}" \
|
|
--data-urlencode "compress=gz" \
|
|
"${uri}" \
|
|
| gzip -d \
|
|
| cpio -ium --directory="${NEWROOT}"
|
|
)
|
|
}
|
|
|
|
mkdir /tmp/wwinit
|
|
(
|
|
# fetch the system overlay into /tmp/wwinit
|
|
local NEWROOT=/tmp/wwinit
|
|
get_stage "system" || die "Unable to load stage: system"
|
|
)
|
|
if [ -x /tmp/wwinit/warewulf/run-wwinit.d ]; then
|
|
PREFIX=/tmp/wwinit /tmp/wwinit/warewulf/run-wwinit.d
|
|
fi
|
|
|
|
info "warewulf: mounting ${wwinit_root_device} at ${NEWROOT}"
|
|
(
|
|
if [ "${wwinit_root_device}" = "tmpfs" ]; then
|
|
mount -t tmpfs -o mpol=interleave ${wwinit_tmpfs_size_option} "${wwinit_root_device}" "${NEWROOT}"
|
|
else
|
|
mount "${wwinit_root_device}" "${NEWROOT}"
|
|
fi
|
|
) || die "warewulf: failed to mount ${wwinit_root_device} at ${NEWROOT}"
|
|
|
|
for stage in "image" "system"; do
|
|
get_stage "${stage}" || die "Unable to load stage: ${stage}"
|
|
done
|
|
|
|
# Fetch runtime overlay (non-fatal)
|
|
# Source config from system overlay for TLS settings
|
|
. /tmp/wwinit/warewulf/config
|
|
cert_file="/tmp/wwinit/warewulf/tls/warewulf.crt"
|
|
if [ "${WWTLS}" = "true" ] && [ -f "$cert_file" ]; then
|
|
# TLS enabled: build HTTPS URI using wwid from kernel cmdline
|
|
# (mirrors wwclient URL construction in internal/app/wwclient/root.go)
|
|
wwid=$(getarg wwid)
|
|
runtime_uri="https://${WWIPADDR}:${WWTLSPORT}/provision/${wwid}"
|
|
get_stage "runtime" "${runtime_uri}" "${cert_file}" || warn "warewulf: unable to load runtime overlay over HTTPS (ignored)"
|
|
else
|
|
# No TLS: fetch runtime over HTTP
|
|
get_stage "runtime" || warn "warewulf: unable to load runtime overlay (ignored)"
|
|
fi
|
|
|
|
# Copy /warewulf/run from initramfs to NEWROOT
|
|
# This preserves state files created by wwinit.d scripts (e.g., ignition marker)
|
|
if [ -d /tmp/wwinit/warewulf/run ]; then
|
|
info "warewulf: preserving /warewulf/run to mounted root"
|
|
mkdir -p "${NEWROOT}/warewulf"
|
|
cp -a /tmp/wwinit/warewulf/run "${NEWROOT}/warewulf/"
|
|
fi
|