mirror of
https://github.com/NLnetLabs/krill.git
synced 2026-09-20 16:37:43 +02:00
Ximon EighteenandGitHub
cf1f8a9c16
Note: Until merged to master this branch requires that a branch by the same name exists in the rpki-deploy repo with the corresponding changes to support these changes, which include: - OpenAPI YML corrections. - Support the new way to activate the TA. - FIX: Include the correct ta.cer URI in the TAL. - Use two seprarate Python libraries for Krill: one for CA REST SAPIs and one for PUB REST APIs. - FIX: Test for the actual CAs and resources to create, as the presence of the testbed CA violates the previous check assumptions. - FIX: Resource ASN, v4 and v6 values can no longer be assumed to have the same sort order as when given to Krill. - Factor out test suite code into helper functions for better readability and maintainability. - Retry RTR fetching (needed for ROAs obtained from Rcynic Lihttpd server served JSON as otherwise connecting too early results in SyncTimeout). Known issues: on failure all RP tests will retry 3 times while actually only the Rcynic test should retry.
81 lines
3.4 KiB
Bash
Executable File
81 lines
3.4 KiB
Bash
Executable File
#!/bin/bash
|
|
# Prepare the environment and config file for the Krill daemon.
|
|
# This script supports several scenarios:
|
|
# A. The operator wants to run the Krill daemon using the default setup:
|
|
# We have to fix a couple of things before running the Krill daemon:
|
|
# - Krill doesn't know the FQDN at which it's HTTPS, RSYNC and RRDP
|
|
# endpoints are published but needs to include that FQDN in data that
|
|
# it produces. Configure it based on env var KRILL_FQDN.
|
|
# - Krill doesn't have a default API token value, we have to supply one.
|
|
# Generate one and announce it, if no KRILL_AUTH_TOKEN env var was
|
|
# supplied by the operator.
|
|
#
|
|
# B: The operator wants to control the Krill daemon configuration themselves.
|
|
# They do this by Docker mounting their own krill.conf over the
|
|
# /var/krill/data/krill.conf path.
|
|
#
|
|
# C: The operator wants to run some other command in the container, e.g.
|
|
# krill_admin.
|
|
#
|
|
set -e
|
|
KRILL_CONF=/var/krill/data/krill.conf
|
|
KRILL_FQDN="${KRILL_FQDN:-localhost:3000}"
|
|
KRILL_AUTH_TOKEN="${KRILL_AUTH_TOKEN:-None}"
|
|
KRILL_LOG_LEVEL="${KRILL_LOG_LEVEL:-warn}"
|
|
KRILL_USE_TA="${KRILL_USE_TA:-false}"
|
|
|
|
MAGIC="# DO NOT TOUCH, THIS LINE IS MANAGED BY DOCKER KRILL"
|
|
LOG_PREFIX="docker-krill:"
|
|
|
|
log_warning() {
|
|
echo >&2 "${LOG_PREFIX} Warning! $*"
|
|
}
|
|
|
|
log_info() {
|
|
echo "${LOG_PREFIX} $*"
|
|
}
|
|
|
|
if [ "$1" == "krill" ]; then
|
|
# Does the operator want to use their own API token? If so they must
|
|
# supply the KRILL_AUTH_TOKEN env var.
|
|
if [ "${KRILL_AUTH_TOKEN}" == "None" ]; then
|
|
# Generate a unique hard to guess authorization token and export it
|
|
# so that the Krill daemon uses it (unless overridden by the Krill
|
|
# daemon config file). Only do this if the operator didn't already
|
|
# supply a token when launching the Docker container.
|
|
export KRILL_AUTH_TOKEN=$(uuidgen)
|
|
fi
|
|
|
|
# Announce the token in the Docker logs so that clients can obtain it.
|
|
log_info "Securing Krill daemon with token ${KRILL_AUTH_TOKEN}"
|
|
|
|
log_info "Configuring ${KRILL_CONF} .."
|
|
# If the config file was persisted and the container was recreated with
|
|
# different arguments to docker run there may still be some lines in the
|
|
# config file that we added before which are now no longer correct. Remove
|
|
# any lines that we added.
|
|
if ! sed -i "/.\\+${MAGIC}/d" ${KRILL_CONF} 2>/dev/null; then
|
|
log_warning "Cannot write to ${KRILL_CONF}. You can ignore this warning if you mounted your own config file over ${KRILL_CONF}."
|
|
else
|
|
# Append to the default Krill config file to direct clients of the
|
|
# RSYNC and RRDP endpoints to the correct FQDN. We cannot know know the
|
|
# FQDN which clients use to reach us so the operator must inform this
|
|
# script via a "-e KRILL_FQDN=some.domain.name" argument to
|
|
# "docker run".
|
|
cat << EOF >> ${KRILL_CONF}
|
|
log_level = "${KRILL_LOG_LEVEL}" ${MAGIC}
|
|
EOF
|
|
|
|
log_info "Dumping ${KRILL_CONF} config file"
|
|
cat ${KRILL_CONF}
|
|
log_info "End of dump"
|
|
fi
|
|
fi
|
|
|
|
# Launch the command supplied either by the default CMD (krill) in the
|
|
# Dockerfile or that given by the operator when invoking Docker run. Use exec
|
|
# to ensure krill runs as PID 1 as required by Docker for proper signal
|
|
# handling. This also allows this Docker image to be used to run krill_admin
|
|
# instead of krill.
|
|
exec "$@"
|