addhost

@@ -13,12 +13,11 @@ function usage() {
    echo "  <host> can be an IP number, or something that resolves to one"
 }
 
-while getopts "bhnp:" this; do
+while getopts "bhn:" this; do
    case "${this}" in
       h) usage; exit 0;;
       b) cmd_do_bootstrap="yes" ;;
       n) cmd_fqdn="${OPTARG}" ; shift ;;
-      p) cmd_proxy="${OPTARG}" ; shift ;;
       *) echo "Unknown option ${this}"; echo ""; usage; exit 1;;
    esac
 done
@@ -37,10 +36,6 @@ if test -z "$cmd_hostname"; then
     exit 1
 fi
 
-if [[ -n $cmd_proxy ]]; then
-  proxyjump="-o ProxyJump=${cmd_proxy}"
-fi
-
 test -f cosmos.conf && . ./cosmos.conf
 
 _remote=${remote:='ro'}
@@ -62,8 +57,8 @@ fi
 
 if [ "$cmd_do_bootstrap" = "yes" ]; then
    cosmos_deb=$(find apt/ -maxdepth 1 -name 'cosmos_*.deb' | sort -V | tail -1)
-   scp $proxyjump "$cosmos_deb" apt/bootstrap-cosmos.sh root@"$cmd_hostname":
-   ssh root@"$cmd_hostname" $proxyjump ./bootstrap-cosmos.sh "$cmd_fqdn" "$rrepo" "$rtag"
-   ssh root@"$cmd_hostname" $proxyjump cosmos update
-   ssh root@"$cmd_hostname" $proxyjump cosmos apply
+   scp "$cosmos_deb" apt/bootstrap-cosmos.sh root@"$cmd_hostname":
+   ssh root@"$cmd_hostname" ./bootstrap-cosmos.sh "$cmd_fqdn" "$rrepo" "$rtag"
+   ssh root@"$cmd_hostname" cosmos update
+   ssh root@"$cmd_hostname" cosmos apply
 fi

bump-tag

@@ -173,15 +173,12 @@ tag_list="$(git tag -l "${tagpfx}-*")"
 # shellcheck disable=SC2181
 if [[ ${?} -ne 0 ]] || [[ -z "${tag_list}" ]]; then
 
-    if [[ -z ${ALLOW_UNSIGNED_COMMITS_WITHOUT_TAGS} ]]; then
-      echo "No tags found, verifying all commits instead."
-      echo "Please set environment variable ALLOW_UNSIGNED_COMMITS_WITHOUT_TAGS if you want to disable this check."
-      # %H = commit hash
-      # %G? = show "G" for a good (valid) signature
-      git_log="$(git log --pretty="format:%H${t}%G?" \
-                         --first-parent \
-                         | grep -v "${t}G$")"
-    fi
+    echo "No tags found, verifying all commits instead."
+    # %H = commit hash
+    # %G? = show "G" for a good (valid) signature
+    git_log="$(git log --pretty="format:%H${t}%G?" \
+                       --first-parent \
+                       | grep -v "${t}G$")"
 
 else
 
@@ -258,7 +255,7 @@ while [[ -z "${ok}" ]]; do
     esac
 done
 
-if [[ "${deftag}" != "${tagpfx}" ]]; then
+if [ "${deftag}" != "${tagpfx}" ]; then
     echo -e "Using new tag \e[94m${this_tag}\e[0m according to pattern in cosmos.conf"
 else
     echo -e "Using new tag \e[94m${this_tag}\e[0m"

global/overlay/etc/puppet/cosmos_enc.py

@@ -26,8 +26,7 @@ found = False
 classes = dict()
 for reg, cls in rules.items():
     if re.search(reg, node_name):
-        if cls:
-            classes.update(cls)
+        classes.update(cls)
         found = True
 
 if not found:

global/overlay/etc/systemd/system/run-cosmos-fleetlock-unlocker.service

@@ -1,11 +0,0 @@
-[Unit]
-Description=run-cosmos fleetlock unlocker
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=oneshot
-ExecStart=/usr/local/bin/run-cosmos fleetlock-unlock
-
-[Install]
-WantedBy=multi-user.target

global/overlay/usr/local/bin/run-cosmos

@@ -9,7 +9,6 @@ readonly LOCK_FD=200
 readonly FLEETLOCK_CONFIG=/etc/run-cosmos-fleetlock-conf
 readonly FLEETLOCK_DISABLE_FILE=/etc/run-cosmos-fleetlock-disable
 readonly FLEETLOCK_TOOL=/usr/local/bin/sunet-fleetlock
-readonly FLEETLOCK_UNLOCK_SERVICE=run-cosmos-fleetlock-unlocker.service
 readonly HEALTHCHECK_TOOL=/usr/local/bin/sunet-machine-healthy
 readonly HEALTHCHECK_DISABLE_FILE=/etc/run-cosmos-healthcheck-disable
 
@@ -34,109 +33,60 @@ eexit() {
     exit 1
 }
 
-oexit() {
-    local info_str="$*"
-
-    echo "$info_str"
-    exit 0
-}
-
-fleetlock_enable_unlock_service() {
-    # In case e.g. the unit file has been removed "FragmentPath" will still
-    # return the old filename until daemon-reload is called, so do that here
-    # before we try checking for the FragmentPath.
-    need_reload=$(systemctl show --property NeedDaemonReload $FLEETLOCK_UNLOCK_SERVICE | awk -F= '{print $2}')
-    if [ "$need_reload" = "yes" ]; then
-        systemctl daemon-reload
-    fi
-
-    unit_file=$(systemctl show --property FragmentPath $FLEETLOCK_UNLOCK_SERVICE | awk -F= '{print $2}')
-    if [ -z "$unit_file" ]; then
-        # No unit file matching the service name, do nothing
-        return 0
-    fi
-
-    # Enable the service if needed
-    systemctl is-enabled --quiet $FLEETLOCK_UNLOCK_SERVICE || systemctl enable --quiet $FLEETLOCK_UNLOCK_SERVICE
-}
-
 fleetlock_lock() {
-    if [ ! -f $FLEETLOCK_DISABLE_FILE ] && [ -f $FLEETLOCK_CONFIG ] && [ -x $FLEETLOCK_TOOL ]; then
-        # Make sure the unlock service is enabled before we take a lock if
-        # cosmos ends up rebooting the machine before fleetlock_unlock() is
-        # called.
-        fleetlock_enable_unlock_service || return 1
-        local fleetlock_group=""
-        # shellcheck source=/dev/null
-        . $FLEETLOCK_CONFIG || return 1
-        if [ -z "$fleetlock_group" ]; then
-            echo "Unable to set fleetlock_group"
-            return 1
-        fi
-        echo "Getting fleetlock lock"
-        $FLEETLOCK_TOOL --lock-group "$fleetlock_group" --lock || return 1
-    fi
-    return 0
+   if [ ! -f $FLEETLOCK_DISABLE_FILE ] && [ -f $FLEETLOCK_CONFIG ] && [ -x $FLEETLOCK_TOOL ]; then
+      local fleetlock_group=""
+      # shellcheck source=/dev/null
+      . $FLEETLOCK_CONFIG || return 1
+      if [ -z "$fleetlock_group" ]; then
+          echo "Unable to set fleetlock_group"
+	  return 1
+      fi
+      echo "Getting fleetlock lock"
+      $FLEETLOCK_TOOL --lock-group "$fleetlock_group" --lock || return 1
+   fi
+   return 0
 }
 
 fleetlock_unlock() {
-    if [ ! -f $FLEETLOCK_DISABLE_FILE ] && [ -f $FLEETLOCK_CONFIG ] && [ -x $FLEETLOCK_TOOL ]; then
-        local fleetlock_group=""
-        # shellcheck source=/dev/null
-        . $FLEETLOCK_CONFIG || return 1
-        if [ -z "$fleetlock_group" ]; then
-            echo "Unable to set fleetlock_group"
-            return 1
-        fi
-        machine_is_healthy || return 1
-        echo "Releasing fleetlock lock"
-        $FLEETLOCK_TOOL --lock-group "$fleetlock_group" --unlock || return 1
-    fi
-    return 0
+   if [ ! -f $FLEETLOCK_DISABLE_FILE ] && [ -f $FLEETLOCK_CONFIG ] && [ -x $FLEETLOCK_TOOL ]; then
+      local fleetlock_group=""
+      # shellcheck source=/dev/null
+      . $FLEETLOCK_CONFIG || return 1
+      if [ -z "$fleetlock_group" ]; then
+          echo "Unable to set fleetlock_group"
+	  return 1
+      fi
+      machine_is_healthy || return 1
+      echo "Releasing fleetlock lock"
+      $FLEETLOCK_TOOL --lock-group "$fleetlock_group" --unlock || return 1
+   fi
+   return 0
 }
 
 machine_is_healthy() {
-    if [ ! -f $HEALTHCHECK_DISABLE_FILE ] && [ -x $HEALTHCHECK_TOOL ]; then
-        local fleetlock_healthcheck_timeout=""
-        local optional_args=()
-        # shellcheck source=/dev/null
-        . $FLEETLOCK_CONFIG || return 1
-        if [ -n "$fleetlock_healthcheck_timeout" ]; then
-            optional_args+=("--timeout")
-            optional_args+=("$fleetlock_healthcheck_timeout")
-        fi
-        echo "Running any health checks"
-        $HEALTHCHECK_TOOL "${optional_args[@]}" || return 1
-    fi
-    return 0
+   if [ ! -f $HEALTHCHECK_DISABLE_FILE ] && [ -x $HEALTHCHECK_TOOL ]; then
+       echo "Running any health checks"
+       $HEALTHCHECK_TOOL || return 1
+   fi
+   return 0
 }
 
 main () {
-    lock "$PROGNAME" || eexit "Only one instance of $PROGNAME can run at one time."
-    fleetlock_lock || eexit "Unable to acquire fleetlock lock."
-    cosmos "$@" update
-    cosmos "$@" apply
-    fleetlock_unlock || eexit "Unable to release fleetlock lock."
+   lock "$PROGNAME" || eexit "Only one instance of $PROGNAME can run at one time."
+   fleetlock_lock || eexit "Unable to acquire fleetlock lock."
+   cosmos "$@" update
+   cosmos "$@" apply
+   fleetlock_unlock || eexit "Unable to release fleetlock lock."
 
-    touch /var/run/last-cosmos-ok.stamp
+   touch /var/run/last-cosmos-ok.stamp
 
-    find /var/lib/puppet/reports/ -type f -mtime +10 -print0 | xargs -0 rm -f
-
-    if [ -f /cosmos-reboot ]; then
-        rm -f /cosmos-reboot
-        reboot
-    fi
+   find /var/lib/puppet/reports/ -type f -mtime +10 -print0 | xargs -0 rm -f
 }
 
-# Most of the time we just pass on any arguments to the underlying cosmos
-# tools, if adding special cases here make sure to not shadow any arguments
-# (like "-v") which users expect to be passed on to cosmos.
-case "$1" in
-    "fleetlock-unlock")
-        lock "$PROGNAME" || oexit "$PROGNAME appears locked by a running run-cosmos, let it handle unlocking instead."
-        fleetlock_unlock || eexit "Unable to release fleetlock lock."
-        ;;
-    *)
-        main "$@"
-        ;;
-esac
+main "$@"
+
+if [ -f /cosmos-reboot ]; then
+   rm -f /cosmos-reboot
+   reboot
+fi

prepare-iaas-debian

@@ -1,6 +1,5 @@
 #!/bin/bash
 ip="${1}"
-ssh_proxy="${2}"
 
 if [[ -z "${ip}" ]]; then
     echo "Please specify a cloud image host that the script should do the following on:"
@@ -10,9 +9,6 @@ if [[ -z "${ip}" ]]; then
     echo "  #4 reboot to start using the new kernel, updated packages etc."
     exit 1
 fi
-if [[ -n "${ssh_proxy}" ]]; then
-  proxyjump="-o ProxyJump=${ssh_proxy}"
-fi
 
 set -x
 
@@ -25,5 +21,5 @@ script_dir=$(dirname "$0")
 # ===
 # userdel: user debian is currently used by process 1082
 # ===
-ssh "debian@${ip}" ${proxyjump} "bash -s" < "$script_dir"/iaas-enable-root.sh
-ssh "root@${ip}" ${proxyjump} "bash -s" < "$script_dir"/iaas-setup.sh
+ssh "debian@${ip}" "bash -s" < "$script_dir"/iaas-enable-root.sh
+ssh "root@${ip}" "bash -s" < "$script_dir"/iaas-setup.sh

prepare-iaas-ubuntu

@@ -1,6 +1,5 @@
 #!/bin/bash
 ip="${1}"
-ssh_proxy="${2}"
 
 if [[ -z "${ip}" ]]; then
     echo "Please specify a cloud image host that the script should do the following on:"
@@ -11,9 +10,6 @@ if [[ -z "${ip}" ]]; then
     exit 1
 fi
 
-if [[ -n "${ssh_proxy}" ]]; then
-  proxyjump="-o ProxyJump=${ssh_proxy}"
-fi
 set -x
 
 # Make sure we read the additional scripts from the same directory as
@@ -25,5 +21,5 @@ script_dir=$(dirname "$0")
 # ===
 # userdel: user ubuntu is currently used by process 44063
 # ===
-ssh "ubuntu@${ip}" ${proxyjump} "bash -s" < "$script_dir"/iaas-enable-root.sh
-ssh "root@${ip}" ${proxyjump} "bash -s" < "$script_dir"/iaas-setup.sh
+ssh "ubuntu@${ip}" "bash -s" < "$script_dir"/iaas-enable-root.sh
+ssh "root@${ip}" "bash -s" < "$script_dir"/iaas-setup.sh