mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2025-02-25 18:55:28 -06:00
install: introduce installer class hierarchy
Add class hierarchy which allows inherting knob definitions between the various client and server install scripts. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
This commit is contained in:
Jan Cholasta
@@ -2,7 +2,539 @@
|
||||
# Copyright (C) 2015 FreeIPA Contributors see COPYING for license
|
||||
#
|
||||
|
||||
"""
|
||||
Server installer module
|
||||
"""
|
||||
|
||||
from __future__ import print_function
|
||||
|
||||
import collections
|
||||
import os.path
|
||||
import random
|
||||
|
||||
from ipaclient.install import client
|
||||
from ipalib import constants
|
||||
from ipalib.install.service import (enroll_only,
|
||||
master_install_only,
|
||||
prepare_only,
|
||||
replica_install_only)
|
||||
from ipalib.util import validate_domain_name
|
||||
from ipapython import ipautil
|
||||
from ipapython.dnsutil import check_zone_overlap
|
||||
from ipapython.install import typing
|
||||
from ipapython.install.core import knob
|
||||
|
||||
from .install import validate_admin_password, validate_dm_password
|
||||
from .install import Server
|
||||
from .replicainstall import Replica
|
||||
|
||||
from .upgrade import upgrade_check, upgrade
|
||||
|
||||
from .. import ca, conncheck, dns, kra
|
||||
|
||||
|
||||
class ServerInstallInterface(client.ClientInstallInterface,
|
||||
ca.CAInstallInterface,
|
||||
kra.KRAInstallInterface,
|
||||
dns.DNSInstallInterface,
|
||||
conncheck.ConnCheckInterface):
|
||||
"""
|
||||
Interface of server installers
|
||||
|
||||
Knobs defined here will be available in:
|
||||
* ipa-server-install
|
||||
* ipa-replica-prepare
|
||||
* ipa-replica-install
|
||||
"""
|
||||
|
||||
force_join = False
|
||||
kinit_attempts = 1
|
||||
fixed_primary = True
|
||||
ntp_servers = None
|
||||
force_ntpd = False
|
||||
permit = False
|
||||
enable_dns_updates = False
|
||||
no_krb5_offline_passwords = False
|
||||
preserve_sssd = False
|
||||
|
||||
domain_name = knob(
|
||||
bases=client.ClientInstallInterface.domain_name,
|
||||
# pylint: disable=no-member
|
||||
cli_names=(list(client.ClientInstallInterface.domain_name.cli_names) +
|
||||
['-n']),
|
||||
)
|
||||
domain_name = replica_install_only(domain_name)
|
||||
|
||||
new_domain_name = knob(
|
||||
bases=client.ClientInstallInterface.domain_name,
|
||||
cli_names=['--domain', '-n'],
|
||||
cli_metavar='DOMAIN_NAME',
|
||||
)
|
||||
new_domain_name = master_install_only(new_domain_name)
|
||||
|
||||
@new_domain_name.validator
|
||||
def new_domain_name(self, value):
|
||||
validate_domain_name(value)
|
||||
if (self.setup_dns and
|
||||
not self.allow_zone_overlap): # pylint: disable=no-member
|
||||
print("Checking DNS domain %s, please wait ..." % value)
|
||||
check_zone_overlap(value, False)
|
||||
|
||||
servers = knob(
|
||||
bases=client.ClientInstallInterface.servers,
|
||||
description="fully qualified name of IPA server to enroll to",
|
||||
)
|
||||
servers = enroll_only(servers)
|
||||
|
||||
realm_name = knob(
|
||||
bases=client.ClientInstallInterface.realm_name,
|
||||
cli_names=(list(client.ClientInstallInterface.realm_name.cli_names) +
|
||||
['-r']),
|
||||
)
|
||||
|
||||
host_name = knob(
|
||||
bases=client.ClientInstallInterface.host_name,
|
||||
description="fully qualified name of this host",
|
||||
)
|
||||
|
||||
ca_cert_files = knob(
|
||||
bases=client.ClientInstallInterface.ca_cert_files,
|
||||
description="File containing CA certificates for the service "
|
||||
"certificate files",
|
||||
cli_deprecated_names='--root-ca-file',
|
||||
)
|
||||
ca_cert_files = prepare_only(ca_cert_files)
|
||||
|
||||
new_dm_password = knob(
|
||||
str, None,
|
||||
sensitive=True,
|
||||
description="Directory Manager password",
|
||||
cli_names='--dm-password',
|
||||
cli_metavar='DM_PASSWORD',
|
||||
)
|
||||
new_dm_password = master_install_only(new_dm_password)
|
||||
|
||||
@new_dm_password.validator
|
||||
def new_dm_password(self, value):
|
||||
validate_dm_password(value)
|
||||
|
||||
ip_addresses = knob(
|
||||
bases=client.ClientInstallInterface.ip_addresses,
|
||||
description="Server IP Address. This option can be used multiple "
|
||||
"times",
|
||||
)
|
||||
|
||||
principal = knob(
|
||||
bases=client.ClientInstallInterface.principal,
|
||||
description="User Principal allowed to promote replicas and join IPA "
|
||||
"realm",
|
||||
cli_names=(list(client.ClientInstallInterface.principal.cli_names) +
|
||||
['-P']),
|
||||
)
|
||||
principal = replica_install_only(principal)
|
||||
|
||||
admin_password = knob(
|
||||
bases=client.ClientInstallInterface.admin_password,
|
||||
description="Kerberos password for the specified admin principal",
|
||||
)
|
||||
admin_password = replica_install_only(admin_password)
|
||||
|
||||
new_admin_password = knob(
|
||||
str, None,
|
||||
sensitive=True,
|
||||
description="admin user kerberos password",
|
||||
cli_names='--admin-password',
|
||||
cli_metavar='ADMIN_PASSWORD',
|
||||
)
|
||||
new_admin_password = master_install_only(new_admin_password)
|
||||
|
||||
@new_admin_password.validator
|
||||
def new_admin_password(self, value):
|
||||
validate_admin_password(value)
|
||||
|
||||
master_password = knob(
|
||||
str, None,
|
||||
sensitive=True,
|
||||
deprecated=True,
|
||||
description="kerberos master password (normally autogenerated)",
|
||||
)
|
||||
master_password = master_install_only(master_password)
|
||||
|
||||
domain_level = knob(
|
||||
int, constants.MAX_DOMAIN_LEVEL,
|
||||
description="IPA domain level",
|
||||
deprecated=True,
|
||||
)
|
||||
domain_level = master_install_only(domain_level)
|
||||
|
||||
@domain_level.validator
|
||||
def domain_level(self, value):
|
||||
# Check that Domain Level is within the allowed range
|
||||
if value < constants.MIN_DOMAIN_LEVEL:
|
||||
raise ValueError(
|
||||
"Domain Level cannot be lower than {0}".format(
|
||||
constants.MIN_DOMAIN_LEVEL))
|
||||
elif value > constants.MAX_DOMAIN_LEVEL:
|
||||
raise ValueError(
|
||||
"Domain Level cannot be higher than {0}".format(
|
||||
constants.MAX_DOMAIN_LEVEL))
|
||||
|
||||
setup_ca = knob(
|
||||
None,
|
||||
description="configure a dogtag CA",
|
||||
)
|
||||
setup_ca = enroll_only(setup_ca)
|
||||
|
||||
setup_kra = knob(
|
||||
None,
|
||||
description="configure a dogtag KRA",
|
||||
)
|
||||
setup_kra = enroll_only(setup_kra)
|
||||
|
||||
setup_dns = knob(
|
||||
None,
|
||||
description="configure bind with our zone",
|
||||
)
|
||||
setup_dns = enroll_only(setup_dns)
|
||||
|
||||
idstart = knob(
|
||||
int, random.randint(1, 10000) * 200000,
|
||||
description="The starting value for the IDs range (default random)",
|
||||
)
|
||||
idstart = master_install_only(idstart)
|
||||
|
||||
idmax = knob(
|
||||
int,
|
||||
description=("The max value for the IDs range (default: "
|
||||
"idstart+199999)"),
|
||||
)
|
||||
idmax = master_install_only(idmax)
|
||||
|
||||
@idmax.default_getter
|
||||
def idmax(self):
|
||||
return self.idstart + 200000 - 1
|
||||
|
||||
no_hbac_allow = knob(
|
||||
None,
|
||||
description="Don't install allow_all HBAC rule",
|
||||
cli_deprecated_names='--no_hbac_allow',
|
||||
)
|
||||
no_hbac_allow = master_install_only(no_hbac_allow)
|
||||
|
||||
ignore_topology_disconnect = knob(
|
||||
None,
|
||||
description="do not check whether server uninstall disconnects the "
|
||||
"topology (domain level 1+)",
|
||||
)
|
||||
ignore_topology_disconnect = master_install_only(ignore_topology_disconnect)
|
||||
|
||||
ignore_last_of_role = knob(
|
||||
None,
|
||||
description="do not check whether server uninstall removes last "
|
||||
"CA/DNS server or DNSSec master (domain level 1+)",
|
||||
)
|
||||
ignore_last_of_role = master_install_only(ignore_last_of_role)
|
||||
|
||||
no_pkinit = knob(
|
||||
None,
|
||||
description="disables pkinit setup steps",
|
||||
)
|
||||
no_pkinit = prepare_only(no_pkinit)
|
||||
|
||||
no_ui_redirect = knob(
|
||||
None,
|
||||
description="Do not automatically redirect to the Web UI",
|
||||
)
|
||||
no_ui_redirect = enroll_only(no_ui_redirect)
|
||||
|
||||
ssh_trust_dns = knob(
|
||||
None,
|
||||
description="configure OpenSSH client to trust DNS SSHFP records",
|
||||
)
|
||||
ssh_trust_dns = enroll_only(ssh_trust_dns)
|
||||
|
||||
no_ssh = knob(
|
||||
None,
|
||||
description="do not configure OpenSSH client",
|
||||
)
|
||||
no_ssh = enroll_only(no_ssh)
|
||||
|
||||
no_sshd = knob(
|
||||
None,
|
||||
description="do not configure OpenSSH server",
|
||||
)
|
||||
no_sshd = enroll_only(no_sshd)
|
||||
|
||||
no_dns_sshfp = knob(
|
||||
None,
|
||||
description="Do not automatically create DNS SSHFP records",
|
||||
)
|
||||
no_dns_sshfp = enroll_only(no_dns_sshfp)
|
||||
|
||||
dirsrv_config_file = knob(
|
||||
str, None,
|
||||
description="The path to LDIF file that will be used to modify "
|
||||
"configuration of dse.ldif during installation of the "
|
||||
"directory server instance",
|
||||
cli_metavar='FILE',
|
||||
)
|
||||
dirsrv_config_file = enroll_only(dirsrv_config_file)
|
||||
|
||||
@dirsrv_config_file.validator
|
||||
def dirsrv_config_file(self, value):
|
||||
if not os.path.exists(value):
|
||||
raise ValueError("File %s does not exist." % value)
|
||||
|
||||
dirsrv_cert_files = knob(
|
||||
# pylint: disable=invalid-sequence-index
|
||||
typing.List[str], None,
|
||||
description=("File containing the Directory Server SSL certificate "
|
||||
"and private key"),
|
||||
cli_names='--dirsrv-cert-file',
|
||||
cli_deprecated_names='--dirsrv_pkcs12',
|
||||
cli_metavar='FILE',
|
||||
)
|
||||
dirsrv_cert_files = prepare_only(dirsrv_cert_files)
|
||||
|
||||
http_cert_files = knob(
|
||||
# pylint: disable=invalid-sequence-index
|
||||
typing.List[str], None,
|
||||
description=("File containing the Apache Server SSL certificate and "
|
||||
"private key"),
|
||||
cli_names='--http-cert-file',
|
||||
cli_deprecated_names='--http_pkcs12',
|
||||
cli_metavar='FILE',
|
||||
)
|
||||
http_cert_files = prepare_only(http_cert_files)
|
||||
|
||||
pkinit_cert_files = knob(
|
||||
# pylint: disable=invalid-sequence-index
|
||||
typing.List[str], None,
|
||||
description=("File containing the Kerberos KDC SSL certificate and "
|
||||
"private key"),
|
||||
cli_names='--pkinit-cert-file',
|
||||
cli_deprecated_names='--pkinit_pkcs12',
|
||||
cli_metavar='FILE',
|
||||
)
|
||||
pkinit_cert_files = prepare_only(pkinit_cert_files)
|
||||
|
||||
dirsrv_pin = knob(
|
||||
str, None,
|
||||
sensitive=True,
|
||||
description="The password to unlock the Directory Server private key",
|
||||
cli_deprecated_names='--dirsrv_pin',
|
||||
cli_metavar='PIN',
|
||||
)
|
||||
dirsrv_pin = prepare_only(dirsrv_pin)
|
||||
|
||||
http_pin = knob(
|
||||
str, None,
|
||||
sensitive=True,
|
||||
description="The password to unlock the Apache Server private key",
|
||||
cli_deprecated_names='--http_pin',
|
||||
cli_metavar='PIN',
|
||||
)
|
||||
http_pin = prepare_only(http_pin)
|
||||
|
||||
pkinit_pin = knob(
|
||||
str, None,
|
||||
sensitive=True,
|
||||
description="The password to unlock the Kerberos KDC private key",
|
||||
cli_deprecated_names='--pkinit_pin',
|
||||
cli_metavar='PIN',
|
||||
)
|
||||
pkinit_pin = prepare_only(pkinit_pin)
|
||||
|
||||
dirsrv_cert_name = knob(
|
||||
str, None,
|
||||
description="Name of the Directory Server SSL certificate to install",
|
||||
cli_metavar='NAME',
|
||||
)
|
||||
dirsrv_cert_name = prepare_only(dirsrv_cert_name)
|
||||
|
||||
http_cert_name = knob(
|
||||
str, None,
|
||||
description="Name of the Apache Server SSL certificate to install",
|
||||
cli_metavar='NAME',
|
||||
)
|
||||
http_cert_name = prepare_only(http_cert_name)
|
||||
|
||||
pkinit_cert_name = knob(
|
||||
str, None,
|
||||
description="Name of the Kerberos KDC SSL certificate to install",
|
||||
cli_metavar='NAME',
|
||||
)
|
||||
pkinit_cert_name = prepare_only(pkinit_cert_name)
|
||||
|
||||
def __init__(self, **kwargs):
|
||||
super(ServerInstallInterface, self).__init__(**kwargs)
|
||||
|
||||
# If any of the key file options are selected, all are required.
|
||||
cert_file_req = (self.dirsrv_cert_files, self.http_cert_files)
|
||||
cert_file_opt = (self.pkinit_cert_files,)
|
||||
if any(cert_file_req + cert_file_opt) and not all(cert_file_req):
|
||||
raise RuntimeError(
|
||||
"--dirsrv-cert-file and --http-cert-file are required if any "
|
||||
"key file options are used.")
|
||||
|
||||
if not self.interactive:
|
||||
if self.dirsrv_cert_files and self.dirsrv_pin is None:
|
||||
raise RuntimeError(
|
||||
"You must specify --dirsrv-pin with --dirsrv-cert-file")
|
||||
if self.http_cert_files and self.http_pin is None:
|
||||
raise RuntimeError(
|
||||
"You must specify --http-pin with --http-cert-file")
|
||||
if self.pkinit_cert_files and self.pkinit_pin is None:
|
||||
raise RuntimeError(
|
||||
"You must specify --pkinit-pin with --pkinit-cert-file")
|
||||
|
||||
if not self.setup_dns:
|
||||
if self.forwarders:
|
||||
raise RuntimeError(
|
||||
"You cannot specify a --forwarder option without the "
|
||||
"--setup-dns option")
|
||||
if self.auto_forwarders:
|
||||
raise RuntimeError(
|
||||
"You cannot specify a --auto-forwarders option without "
|
||||
"the --setup-dns option")
|
||||
if self.no_forwarders:
|
||||
raise RuntimeError(
|
||||
"You cannot specify a --no-forwarders option without the "
|
||||
"--setup-dns option")
|
||||
if self.forward_policy:
|
||||
raise RuntimeError(
|
||||
"You cannot specify a --forward-policy option without the "
|
||||
"--setup-dns option")
|
||||
if self.reverse_zones:
|
||||
raise RuntimeError(
|
||||
"You cannot specify a --reverse-zone option without the "
|
||||
"--setup-dns option")
|
||||
if self.auto_reverse:
|
||||
raise RuntimeError(
|
||||
"You cannot specify a --auto-reverse option without the "
|
||||
"--setup-dns option")
|
||||
if self.no_reverse:
|
||||
raise RuntimeError(
|
||||
"You cannot specify a --no-reverse option without the "
|
||||
"--setup-dns option")
|
||||
if self.no_dnssec_validation:
|
||||
raise RuntimeError(
|
||||
"You cannot specify a --no-dnssec-validation option "
|
||||
"without the --setup-dns option")
|
||||
elif self.forwarders and self.no_forwarders:
|
||||
raise RuntimeError(
|
||||
"You cannot specify a --forwarder option together with "
|
||||
"--no-forwarders")
|
||||
elif self.auto_forwarders and self.no_forwarders:
|
||||
raise RuntimeError(
|
||||
"You cannot specify a --auto-forwarders option together with "
|
||||
"--no-forwarders")
|
||||
elif self.reverse_zones and self.no_reverse:
|
||||
raise RuntimeError(
|
||||
"You cannot specify a --reverse-zone option together with "
|
||||
"--no-reverse")
|
||||
elif self.auto_reverse and self.no_reverse:
|
||||
raise RuntimeError(
|
||||
"You cannot specify a --auto-reverse option together with "
|
||||
"--no-reverse")
|
||||
|
||||
if not hasattr(self, 'replica_file'):
|
||||
if self.external_cert_files and self.dirsrv_cert_files:
|
||||
raise RuntimeError(
|
||||
"Service certificate file options cannot be used with the "
|
||||
"external CA options.")
|
||||
|
||||
if self.external_ca_type and not self.external_ca:
|
||||
raise RuntimeError(
|
||||
"You cannot specify --external-ca-type without "
|
||||
"--external-ca")
|
||||
|
||||
if self.uninstalling:
|
||||
if (self.realm_name or self.new_admin_password or
|
||||
self.master_password):
|
||||
raise RuntimeError(
|
||||
"In uninstall mode, -a, -r and -P options are not "
|
||||
"allowed")
|
||||
elif not self.interactive:
|
||||
if (not self.realm_name or not self.new_dm_password or
|
||||
not self.new_admin_password):
|
||||
raise RuntimeError(
|
||||
"In unattended mode you need to provide at least -r, "
|
||||
"-p and -a options")
|
||||
if self.setup_dns:
|
||||
if (not self.forwarders and
|
||||
not self.no_forwarders and
|
||||
not self.auto_forwarders):
|
||||
raise RuntimeError(
|
||||
"You must specify at least one of --forwarder, "
|
||||
"--auto-forwarders, or --no-forwarders options")
|
||||
|
||||
any_ignore_option_true = any(
|
||||
[self.ignore_topology_disconnect, self.ignore_last_of_role])
|
||||
if any_ignore_option_true and not self.uninstalling:
|
||||
raise RuntimeError(
|
||||
"'--ignore-topology-disconnect/--ignore-last-of-role' "
|
||||
"options can be used only during uninstallation")
|
||||
|
||||
if self.idmax < self.idstart:
|
||||
raise RuntimeError(
|
||||
"idmax (%s) cannot be smaller than idstart (%s)" %
|
||||
(self.idmax, self.idstart))
|
||||
else:
|
||||
cert_file_req = (self.dirsrv_cert_files, self.http_cert_files)
|
||||
cert_file_opt = (self.pkinit_cert_files,)
|
||||
|
||||
if self.replica_file is None:
|
||||
# If any of the PKCS#12 options are selected, all are required.
|
||||
if any(cert_file_req + cert_file_opt) and not all(cert_file_req):
|
||||
raise RuntimeError(
|
||||
"--dirsrv-cert-file and --http-cert-file are required "
|
||||
"if any PKCS#12 options are used")
|
||||
|
||||
if self.servers and not self.domain_name:
|
||||
raise RuntimeError(
|
||||
"The --server option cannot be used without providing "
|
||||
"domain via the --domain option")
|
||||
|
||||
else:
|
||||
if not ipautil.file_exists(self.replica_file):
|
||||
raise RuntimeError(
|
||||
"Replica file %s does not exist" % self.replica_file)
|
||||
|
||||
if any(cert_file_req + cert_file_opt):
|
||||
raise RuntimeError(
|
||||
"You cannot specify any of --dirsrv-cert-file, "
|
||||
"--http-cert-file, or --pkinit-cert-file together "
|
||||
"with replica file")
|
||||
|
||||
CLIKnob = collections.namedtuple('CLIKnob', ('value', 'name'))
|
||||
|
||||
conflicting_knobs = (
|
||||
CLIKnob(self.realm_name, '--realm'),
|
||||
CLIKnob(self.domain_name, '--domain'),
|
||||
CLIKnob(self.host_name, '--hostname'),
|
||||
CLIKnob(self.servers, '--server'),
|
||||
CLIKnob(self.principal, '--principal'),
|
||||
)
|
||||
|
||||
if any([k.value is not None for k in conflicting_knobs]):
|
||||
conflicting_knob_names = [
|
||||
knob.name for knob in conflicting_knobs
|
||||
if knob.value is not None
|
||||
]
|
||||
|
||||
raise RuntimeError(
|
||||
"You cannot specify '{0}' option(s) with replica file."
|
||||
.format(", ".join(conflicting_knob_names))
|
||||
)
|
||||
|
||||
if self.setup_dns:
|
||||
if (not self.forwarders and
|
||||
not self.no_forwarders and
|
||||
not self.auto_forwarders):
|
||||
raise RuntimeError(
|
||||
"You must specify at least one of --forwarder, "
|
||||
"--auto-forwarders, or --no-forwarders options")
|
||||
|
||||
# Automatically disable pkinit w/ dogtag until that is supported
|
||||
self.no_pkinit = True
|
||||
|
||||
Reference in New Issue
Block a user