apiserver: fix installing dependent libraries upon deploy

fullstaq-ruby · Aug 21, 2024 · dd437fa · dd437fa
1 parent e4be2be
commit dd437fa
Show file tree

Hide file tree

Showing 5 changed files with 29 additions and 5 deletions.
diff --git a/ansible/files/apiserver-deployer-sudoers b/ansible/files/apiserver-deployer-sudoers
@@ -0,0 +1 @@
+apiserver-deployer ALL=(ALL) NOPASSWD: /usr/local/bin/apt-satisfy-dependency-string.sh *
diff --git a/ansible/files/apiserver-deployer.service b/ansible/files/apiserver-deployer.service
@@ -8,7 +8,6 @@ Type=oneshot
 User=apiserver-deployer
 Group=apiserver-deployer
 PrivateTmp=true
-ProtectSystem=full
 ReadWritePaths=/opt/apiserver/versions
 ExecStart=/usr/local/bin/apiserver-deployer
 RemainAfterExit=yes

diff --git a/ansible/files/apiserver-deployer.sh b/ansible/files/apiserver-deployer.sh
@@ -37,10 +37,7 @@ else
     mkdir "${TARGET_DIR}.tmp"
     tar --use-compress-program=unzstd -xf "/tmp/$ASSET_NAME" -C "${TARGET_DIR}.tmp"
     DPKG_DEPENDENCIES=$(cat "${TARGET_DIR}.tmp/dpkg-dependencies.txt")
-    if [[ -n "$DPKG_DEPENDENCIES" ]]; then
-        echo "Installing dependencies: $DPKG_DEPENDENCIES"
-        apt satisfy -y --no-install-recommends --no-install-suggests "$DPKG_DEPENDENCIES"
-    fi
+    sudo apt-satisfy-dependency-string.sh "$DPKG_DEPENDENCIES"
     rm "/tmp/$ASSET_NAME"
     mv "${TARGET_DIR}.tmp" "$TARGET_DIR"
 

diff --git a/ansible/files/apt-satisfy-dependency-string.sh b/ansible/files/apt-satisfy-dependency-string.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+# A wrapper around 'apt satisfy' that allows it to be called safely through sudo
+# without passing arbitrary arguments to apt.
+set -eo pipefail
+
+if [[ -n "$*" ]]; then
+    echo "Installing dependencies: $*"
+    exec apt satisfy -y --no-install-recommends --no-install-suggests "$*"
+else
+    echo "No dependencies to satisfy."
+fi
diff --git a/ansible/tasks/apiserver-deployer.yml b/ansible/tasks/apiserver-deployer.yml
@@ -9,6 +9,22 @@
     group: apiserver-deployer
     uid: 954
 
+- name: Install apt-satisfy-dependency-string.sh
+  copy:
+    src: apt-satisfy-dependency-string.sh
+    dest: /usr/local/bin/apt-satisfy-dependency-string.sh
+    owner: root
+    group: root
+    mode: 0755
+
+- name: Install apiserver-deployer sudoers entry
+  copy:
+    src: apiserver-deployer-sudoers
+    dest: /etc/sudoers.d/apiserver-deployer
+    owner: root
+    group: root
+    mode: 0440
+
 - name: Create apiserver deployment directory
   file:
     path: /opt/apiserver/versions
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		apiserver-deployer ALL=(ALL) NOPASSWD: /usr/local/bin/apt-satisfy-dependency-string.sh *