Move install responsibilities to domU
As we are moving forward to test XenAPI in the gate, it is necessary to
move dom0 related modifications to be performed from domU. For this
purpose, a new user is created, and that user should be used to talk to
dom0 from domU. This change creates that user, makes it possible for
dom0 to log in to domU with that account, and configure that account to
be able to talk down to dom0.
Also move several steps to the nova xenserver plugin:
- dom0 plugin installation
- create kernels and images directory
- install console rotate script
- configure a cron to execute console rotate script
Configuration changes:
A new configuration option, DOMZERO_USER has been created, that
specifies a user account that is configured to be able to do
passwordless ssh to dom0.
Change-Id: If9de0b297a67b7cdb5de78d8dd0e8b2ca578b601
diff --git a/tools/xen/prepare_guest.sh b/tools/xen/prepare_guest.sh
index 05ac86c..0946126 100755
--- a/tools/xen/prepare_guest.sh
+++ b/tools/xen/prepare_guest.sh
@@ -18,6 +18,57 @@
GUEST_PASSWORD="$1"
XS_TOOLS_PATH="$2"
STACK_USER="$3"
+DOMZERO_USER="$4"
+
+
+function setup_domzero_user() {
+ local username
+
+ username="$1"
+
+ local key_updater_script
+ local sudoers_file
+ key_updater_script="/home/$username/update_authorized_keys.sh"
+ sudoers_file="/etc/sudoers.d/allow_$username"
+
+ # Create user
+ adduser --disabled-password --quiet "$username" --gecos "$username"
+
+ # Give passwordless sudo
+ cat > $sudoers_file << EOF
+ $username ALL = NOPASSWD: ALL
+EOF
+ chmod 0440 $sudoers_file
+
+ # A script to populate this user's authenticated_keys from xenstore
+ cat > $key_updater_script << EOF
+#!/bin/bash
+set -eux
+
+DOMID=\$(sudo xenstore-read domid)
+sudo xenstore-exists /local/domain/\$DOMID/authorized_keys/$username
+sudo xenstore-read /local/domain/\$DOMID/authorized_keys/$username > /home/$username/xenstore_value
+cat /home/$username/xenstore_value > /home/$username/.ssh/authorized_keys
+EOF
+
+ # Give the key updater to the user
+ chown $username:$username $key_updater_script
+ chmod 0700 $key_updater_script
+
+ # Setup the .ssh folder
+ mkdir -p /home/$username/.ssh
+ chown $username:$username /home/$username/.ssh
+ chmod 0700 /home/$username/.ssh
+ touch /home/$username/.ssh/authorized_keys
+ chown $username:$username /home/$username/.ssh/authorized_keys
+ chmod 0600 /home/$username/.ssh/authorized_keys
+
+ # Setup the key updater as a cron job
+ crontab -u $username - << EOF
+* * * * * $key_updater_script
+EOF
+
+}
# Install basics
apt-get update
@@ -48,6 +99,8 @@
echo $STACK_USER:$GUEST_PASSWORD | chpasswd
echo "$STACK_USER ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
+setup_domzero_user "$DOMZERO_USER"
+
# Add an udev rule, so that new block devices could be written by stack user
cat > /etc/udev/rules.d/50-openstack-blockdev.rules << EOF
KERNEL=="xvd[b-z]", GROUP="$STACK_USER", MODE="0660"