Lakehouse Admin
f0c56f137c
ObjectScale blocks root SSH by default; only admin accepts login. Bootstrap installs cluster key for admin and root; document in ssh-mesh.md.
62 lines
2.8 KiB
Bash
62 lines
2.8 KiB
Bash
#!/usr/bin/env bash
|
|
# Bootstrap passwordless SSH on Dell ObjectScale (Luna OS).
|
|
# ObjectScale blocks root SSH until keys are installed via admin (wheel + NOPASSWD sudo).
|
|
set -euo pipefail
|
|
|
|
OBJECTSCALE_IP="${OBJECTSCALE_IP:-10.0.20.111}"
|
|
OBJECTSCALE_USER="${OBJECTSCALE_USER:-admin}"
|
|
# Lab-only: set OBJECTSCALE_PASSWORD in environment, never commit to git
|
|
OBJECTSCALE_PASSWORD="${OBJECTSCALE_PASSWORD:-Dell2026!}"
|
|
CLUSTER_KEY_SRC="${CLUSTER_KEY_SRC:-root@10.0.21.45:/root/.ssh/atc_cluster}"
|
|
|
|
SSH_OPTS=(-o StrictHostKeyChecking=no -o ConnectTimeout=10)
|
|
REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
|
|
HOSTS_FILE="${REPO_ROOT}/config/hosts/atc-lab.hosts"
|
|
|
|
command -v sshpass >/dev/null || { echo "Install sshpass first"; exit 1; }
|
|
|
|
TMPDIR=$(mktemp -d)
|
|
trap 'rm -rf "$TMPDIR"' EXIT
|
|
scp "${SSH_OPTS[@]}" "${CLUSTER_KEY_SRC}" "${CLUSTER_KEY_SRC}.pub" "$TMPDIR/" 2>/dev/null || {
|
|
scp "${SSH_OPTS[@]}" "${CLUSTER_KEY_SRC}" "$TMPDIR/atc_cluster"
|
|
scp "${SSH_OPTS[@]}" "${CLUSTER_KEY_SRC}.pub" "$TMPDIR/atc_cluster.pub"
|
|
}
|
|
CLUSTER_PUB=$(cat "$TMPDIR/atc_cluster.pub")
|
|
PVE_PUB=""
|
|
[[ -f ~/.ssh/id_rsa.pub ]] && PVE_PUB=$(cat ~/.ssh/id_rsa.pub)
|
|
|
|
echo "==> ObjectScale $OBJECTSCALE_IP (user: $OBJECTSCALE_USER)"
|
|
|
|
sshpass -p "$OBJECTSCALE_PASSWORD" ssh "${SSH_OPTS[@]}" "${OBJECTSCALE_USER}@${OBJECTSCALE_IP}" bash -s <<REMOTE
|
|
set -e
|
|
grep -qF 'atc-lakehouse-cluster' ~/.ssh/authorized_keys 2>/dev/null || echo '$CLUSTER_PUB' >> ~/.ssh/authorized_keys
|
|
chmod 600 ~/.ssh/authorized_keys
|
|
sudo mkdir -p /root/.ssh && sudo chmod 700 /root/.ssh
|
|
echo '$CLUSTER_PUB' | sudo tee -a /root/.ssh/authorized_keys >/dev/null
|
|
REMOTE
|
|
|
|
if [[ -n "$PVE_PUB" ]]; then
|
|
sshpass -p "$OBJECTSCALE_PASSWORD" ssh "${SSH_OPTS[@]}" "${OBJECTSCALE_USER}@${OBJECTSCALE_IP}" \
|
|
"echo '$PVE_PUB' | sudo tee -a /root/.ssh/authorized_keys >/dev/null"
|
|
fi
|
|
|
|
sshpass -p "$OBJECTSCALE_PASSWORD" scp "${SSH_OPTS[@]}" \
|
|
"$TMPDIR/atc_cluster" "$TMPDIR/atc_cluster.pub" \
|
|
"${OBJECTSCALE_USER}@${OBJECTSCALE_IP}:.ssh/"
|
|
sshpass -p "$OBJECTSCALE_PASSWORD" ssh "${SSH_OPTS[@]}" "${OBJECTSCALE_USER}@${OBJECTSCALE_IP}" \
|
|
'chmod 600 ~/.ssh/atc_cluster ~/.ssh/atc_cluster.pub'
|
|
|
|
# /etc/hosts + ssh config on objectscale
|
|
sshpass -p "$OBJECTSCALE_PASSWORD" ssh "${SSH_OPTS[@]}" "${OBJECTSCALE_USER}@${OBJECTSCALE_IP}" bash -s <<REMOTE
|
|
sudo grep -q 'ATC Lakehouse lab' /etc/hosts 2>/dev/null && sudo sed -i '/# ATC Lakehouse lab/,/^$/d' /etc/hosts || true
|
|
echo '' | sudo tee -a /etc/hosts >/dev/null
|
|
echo '# ATC Lakehouse lab (managed by Lakehouse git)' | sudo tee -a /etc/hosts >/dev/null
|
|
REMOTE
|
|
grep -v '^#' "$HOSTS_FILE" | grep -v '^$' | \
|
|
sshpass -p "$OBJECTSCALE_PASSWORD" ssh "${SSH_OPTS[@]}" "${OBJECTSCALE_USER}@${OBJECTSCALE_IP}" \
|
|
'sudo tee -a /etc/hosts >/dev/null'
|
|
|
|
echo "==> Verify key-only login"
|
|
ssh -i "$TMPDIR/atc_cluster" "${SSH_OPTS[@]}" "root@${OBJECTSCALE_IP}" hostname -f
|
|
echo "ObjectScale OK"
|