Skip to content

Commit 292938c

Browse files
nightkrnightkr
committed
There was a time before Windows... A happier time...
0 parents  commit 292938c

File tree

13 files changed

+559
-0
lines changed

13 files changed

+559
-0
lines changed

‎.dir-locals.el

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
;;; Directory Local Variables -*- no-byte-compile: t -*-
2+
;;; For more information see (info "(emacs) Directory Variables")
3+
4+
((yaml-mode . ((yaml-indent-offset . 2)
5+
(evil-shift-width . 2))))

‎.gitignore

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
.DS_Store
2+
.idea
3+
*.log
4+
tmp/
5+
/target
6+
roles/create-vm/files/guest-files/spice-guest-tools.exe

‎install.yaml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
- name: Create VM and install Windows
2+
hosts: localhost
3+
roles:
4+
- role: create-vm
5+
- name: Wait for VM to install and boot
6+
hosts: sble-addc
7+
gather_facts: false
8+
tasks:
9+
- name: |
10+
Wait for VM to install and boot.
11+
Make sure to connect to the VM (via virt-manager, virt-viewer, or similar) and follow the prompts (press any key to boot from DVD, confirm partitioning).
12+
This will take a while.. if it times out, restart the playbook but leave the VM running to resume.
13+
It is normal to see a bunch of QEMU guest agent errors in the Ansible output while waiting.
14+
ansible.builtin.wait_for_connection:
15+
- name: Install AD and initialize domain controller
16+
hosts: sble-addc
17+
roles:
18+
- role: ad-dc
19+
- name: Connect Kubernetes To AD
20+
hosts: localhost
21+
roles:
22+
- role: connect-k8s

‎inventory.ini

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
[windows]
2+
sble-addc ansible_connection=community.libvirt.libvirt_qemu ansible_libvirt_uri=qemu:///system ansible_host=stackable-adds-test ansible_shell_type=powershell

‎roles/ad-dc/tasks/main.yaml

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
# - name: Install AD DS
2+
# win_command: Install-WindowsFeature -name AD-Domain-Services -IncludeManagementTools
3+
- name: Promote to Domain Controller
4+
microsoft.ad.domain:
5+
dns_domain_name: sble.test
6+
domain_netbios_name: sbletest
7+
safe_mode_password: Asdf1234
8+
reboot: true
9+
10+
- name: Update Facts With Domain Membership
11+
ansible.builtin.gather_facts:
12+
- name: Extract Primary IP address
13+
set_fact:
14+
vm_network_ipv4: "{{ (ansible_facts.interfaces | rekey_on_member('macaddress'))[vm_network_mac | upper].ipv4.address }}"
15+
16+
- name: Name Secret-Operator User
17+
set_fact:
18+
secret_operator_principal: stackable-secret-operator@{{ ansible_facts.domain | upper }}
19+
- name: Create Secret-Operator User
20+
microsoft.ad.user:
21+
name: stackable-secret-operator
22+
sam_account_name: sble-sec-op
23+
password: Asdf1234
24+
enabled: true
25+
identity: CN=stackable-secret-operator,CN=Users,DC=sble,DC=test
26+
upn: "{{ secret_operator_principal }}"
27+
groups:
28+
add:
29+
- Domain Admins
30+
- name: Create Secret-Operator Keytab
31+
ansible.windows.win_command:
32+
cmd: ktpass /princ {{ secret_operator_principal }} /out secret-op.kt +rndPass /ptype KRB5_NT_PRINCIPAL /mapuser {{ secret_operator_principal }} /crypto AES256-SHA1
33+
- name: Fetch Secret-Operator Keytab
34+
ansible.builtin.fetch:
35+
src: secret-op.kt
36+
dest: target/
37+
flat: true
38+
39+
- name: Install AD Certificate Services
40+
ansible.windows.win_feature:
41+
name:
42+
- AD-Certificate
43+
- ADCS-Cert-Authority
44+
include_management_tools: true
45+
- name: Install ADCS Certificate Authority
46+
ansible.windows.win_shell: |
47+
# Try to access certificate authority, should fail
48+
# iff it is not installed yet
49+
try {
50+
Get-CATemplate
51+
} catch {
52+
Install-AdcsCertificationAuthority -Force
53+
}
54+
- name: Export CA Certificate
55+
ansible.windows.win_command:
56+
cmd: certutil -f -ca.cert ca.crt
57+
- name: Fetch CA Certificate
58+
ansible.builtin.slurp:
59+
src: ca.crt
60+
register: ca_crt
61+
- name: Convert CA Certificate
62+
community.crypto.x509_certificate_convert:
63+
src_content: "{{ ca_crt.content }}"
64+
src_content_base64: true
65+
dest_path: target/ca.crt
66+
format: pem
67+
delegate_to: localhost

‎roles/connect-k8s/tasks/main.yaml

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
- name: Export Current CoreDNS Corefile
2+
kubernetes.core.k8s_info:
3+
api_version: v1
4+
kind: ConfigMap
5+
namespace: kube-system
6+
name: coredns
7+
register: corefile
8+
- name: Export Current Corefile
9+
ansible.builtin.copy:
10+
dest: target/Corefile
11+
content: "{{ corefile.resources[0].data.Corefile }}"
12+
- name: Delegate AD Domain To AD
13+
ansible.builtin.lineinfile:
14+
path: target/Corefile
15+
search_string: "forward {{ hostvars['sble-addc'].ansible_facts.domain }}. "
16+
line: " forward {{ hostvars['sble-addc'].ansible_facts.domain }}. {{ hostvars['sble-addc'].vm_network_ipv4 }}"
17+
insertbefore: "forward . "
18+
- name: Update Corefile
19+
kubernetes.core.k8s:
20+
resource_definition:
21+
apiVersion: v1
22+
kind: ConfigMap
23+
metadata:
24+
namespace: kube-system
25+
name: coredns
26+
data:
27+
Corefile: "{{ lookup('file', 'target/Corefile') }}"
28+
29+
- name: Update Secret-Operator Credentials
30+
kubernetes.core.k8s:
31+
resource_definition:
32+
apiVersion: v1
33+
kind: Secret
34+
metadata:
35+
namespace: default
36+
name: secret-operator-ad-credentials
37+
data:
38+
ca.crt: "{{ lookup('file', 'target/ca.crt') | b64encode }}"
39+
keytab: "{{ lookup('file', 'target/secret-op.kt') | b64encode }}"
40+
- name: Update Secret-Operator Password Cache
41+
kubernetes.core.k8s:
42+
resource_definition:
43+
apiVersion: v1
44+
kind: Secret
45+
metadata:
46+
namespace: default
47+
name: secret-operator-ad-passwords
48+
- name: Create Kerberos SecretClass
49+
kubernetes.core.k8s:
50+
resource_definition:
51+
apiVersion: secrets.stackable.tech/v1alpha1
52+
kind: SecretClass
53+
metadata:
54+
name: kerberos-ad
55+
spec:
56+
backend:
57+
kerberosKeytab:
58+
realmName: "{{ hostvars['sble-addc'].ansible_facts.domain | upper }}"
59+
kdc: "{{ hostvars['sble-addc'].ansible_facts.fqdn }}"
60+
adminPrincipal: "{{ hostvars['sble-addc'].secret_operator_principal }}"
61+
adminKeytabSecret:
62+
namespace: default
63+
name: secret-operator-ad-credentials
64+
admin:
65+
activeDirectory:
66+
ldapServer: "{{ hostvars['sble-addc'].ansible_facts.fqdn }}"
67+
ldapTlsCaSecret:
68+
namespace: default
69+
name: secret-operator-ad-credentials
70+
passwordCacheSecret:
71+
namespace: default
72+
name: secret-operator-ad-passwords
73+
userDistinguishedName: CN=Users,DC=sble,DC=test
74+
schemaDistinguishedName: CN=Schema,CN=Configuration,DC=sble,DC=test

‎roles/create-vm/defaults/main.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
libvirt_uri: qemu:///system
2+
3+
vm_name: stackable-adds-test
4+
vm_memory_mib: 4096
5+
vm_vcpus: 8
6+
vm_disk_name: stackable-adds-test.qcow2
7+
vm_disk_pool: default
8+
vm_disk_size_gib: 30
9+
vm_disk_format: qcow2
10+
vm_disk_path: /var/lib/libvirt/images/stackable-adds-test.qcow2
11+
12+
install_iso_windows: /mnt/data/DL/OS/Windows Server 2022 EVAL.iso
13+
14+
install_iso_virtio_win_url: https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/archive-virtio/virtio-win-0.1.248-1/virtio-win-0.1.248.iso
15+
install_iso_virtio_win_checksum: sha256:d5b5739cf297f0538d263e30678d5a09bba470a7c6bcbd8dff74e44153f16549
16+
install_iso_virtio_win: "{{ lookup('first_found', 'target') }}/virtio-win.iso"
17+
18+
install_exe_spice_guest_tools_url: https://www.spice-space.org/download/windows/spice-guest-tools/spice-guest-tools-0.141/spice-guest-tools-0.141.exe
19+
install_exe_spice_guest_tools_checksum: sha256:b5be0754802bcd7f7fe0ccdb877f8a6224ba13a2af7d84eb087a89b3b0237da2
20+
install_exe_spice_guest_tools: "{{ lookup('first_found', 'guest-files') }}/spice-guest-tools.exe"

‎roles/create-vm/files/guest-files/.gitkeep

Whitespace-only changes.

‎roles/create-vm/files/windows-install-config/Autounattend.xml

Lines changed: 153 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<unattend xmlns="urn:schemas-microsoft-com:unattend">
3+
<settings pass="windowsPE">
4+
<component xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" name="Microsoft-Windows-PnpCustomizationsWinPE" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
5+
<DriverPaths>
6+
<PathAndCredentials wcm:keyValue="2ddfcae9" wcm:action="add">
7+
<!-- Install QEMU storage drivers from virtio-win drive -->
8+
<!-- The drive letter doesn't match the paths user later on, because the primary drive will be inserted as C: after partitioning, shifting all other drive letters a step -->
9+
<Path>E:\</Path>
10+
</PathAndCredentials>
11+
</DriverPaths>
12+
</component>
13+
<component xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
14+
<!-- FIXME: Auto-partitioning seems to prevent install from working? -->
15+
<!-- <DiskConfiguration> -->
16+
<!-- <Disk wcm:action="add"> -->
17+
<!-- <CreatePartitions> -->
18+
<!-- <CreatePartition wcm:action="add"> -->
19+
<!-- <Type>EFI</Type> -->
20+
<!-- <Size>200</Size> -->
21+
<!-- <Order>1</Order> -->
22+
<!-- </CreatePartition> -->
23+
<!-- <CreatePartition wcm:action="add"> -->
24+
<!-- <Type>MSR</Type> -->
25+
<!-- <Size>200</Size> -->
26+
<!-- <Order>2</Order> -->
27+
<!-- </CreatePartition> -->
28+
<!-- <CreatePartition wcm:action="add"> -->
29+
<!-- <Type>Primary</Type> -->
30+
<!-- <Size>1024</Size> -->
31+
<!-- <Order>3</Order> -->
32+
<!-- </CreatePartition> -->
33+
<!-- </CreatePartitions> -->
34+
<!-- <ModifyPartitions> -->
35+
<!-- <ModifyPartition wcm:action="add"> -->
36+
<!-- <!-\- <Active>true</Active> -\-> -->
37+
<!-- <Order>1</Order> -->
38+
<!-- <!-\- <PartitionID>1</PartitionID> -\-> -->
39+
<!-- <!-\- <Label>System</Label> -\-> -->
40+
<!-- <Format>NTFS</Format> -->
41+
<!-- <!-\- <TypeID>0x27</TypeID> -\-> -->
42+
<!-- </ModifyPartition> -->
43+
<!-- <ModifyPartition wcm:action="add"> -->
44+
<!-- <!-\- <Active>true</Active> -\-> -->
45+
<!-- <Order>2</Order> -->
46+
<!-- <!-\- <PartitionID>2</PartitionID> -\-> -->
47+
<!-- <!-\- <Label>Microsoft Reserved</Label> -\-> -->
48+
<!-- <Format>NTFS</Format> -->
49+
<!-- <!-\- <TypeID>0x27</TypeID> -\-> -->
50+
<!-- </ModifyPartition> -->
51+
<!-- <ModifyPartition wcm:action="add"> -->
52+
<!-- <Order>3</Order> -->
53+
<!-- <!-\- <PartitionID>3</PartitionID> -\-> -->
54+
<!-- <!-\- <Active>true</Active> -\-> -->
55+
<!-- <Format>NTFS</Format> -->
56+
<!-- <Extend>true</Extend> -->
57+
<!-- <Letter>C</Letter> -->
58+
<!-- </ModifyPartition> -->
59+
<!-- </ModifyPartitions> -->
60+
<!-- <DiskID>0</DiskID> -->
61+
<!-- <WillWipeDisk>true</WillWipeDisk> -->
62+
<!-- </Disk> -->
63+
<!-- </DiskConfiguration> -->
64+
<ImageInstall>
65+
<OSImage>
66+
<InstallFrom>
67+
<MetaData wcm:action="add">
68+
<Key>/IMAGE/NAME</Key>
69+
<Value>Windows Server 2022 SERVERDATACENTER</Value>
70+
</MetaData>
71+
</InstallFrom>
72+
<!-- <InstallToAvailablePartition>true</InstallToAvailablePartition> -->
73+
<!-- <WillShowUI>OnError</WillShowUI> -->
74+
</OSImage>
75+
</ImageInstall>
76+
<UserData>
77+
<AcceptEula>true</AcceptEula>
78+
</UserData>
79+
</component>
80+
<component xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" name="Microsoft-Windows-International-Core-WinPE" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
81+
<SetupUILanguage>
82+
<UILanguage>en-US</UILanguage>
83+
</SetupUILanguage>
84+
<UILanguage>en-US</UILanguage>
85+
<InputLocale>sv-SE</InputLocale>
86+
</component>
87+
</settings>
88+
<settings pass="specialize">
89+
<component xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
90+
<RunSynchronous>
91+
<!-- Install guest tools certificate to suppress driver permission prompts -->
92+
<RunSynchronousCommand wcm:action="add">
93+
<Order>1</Order>
94+
<Path>certutil -addstore TrustedPublisher A:\redhat-drivers.crt</Path>
95+
</RunSynchronousCommand>
96+
<!-- Disable the "new network detected" prompt -->
97+
<RunSynchronousCommand wcm:action="add">
98+
<Order>2</Order>
99+
<Path>reg add HKLM\System\CurrentControlSet\Control\Network\NewNetworkWindowOff /f</Path>
100+
</RunSynchronousCommand>
101+
<!-- RTC is in UTC -->
102+
<!-- If time is desynced then ADCS will generate certificates that aren't valid yet -->
103+
<RunSynchronousCommand wcm:action="add">
104+
<Order>3</Order>
105+
<Path>reg add HKLM\System\CurrentControlSet\Control\TimeZoneInformation /v RealTimeIsUniversal /t REG_DWORD /d 1 /f</Path>
106+
</RunSynchronousCommand>
107+
</RunSynchronous>
108+
</component>
109+
</settings>
110+
<!-- <settings pass="auditSystem"> -->
111+
<!-- <component xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS"> -->
112+
<!-- <AuditComputerName> -->
113+
<!-- <Name>sble-adds</Name> -->
114+
<!-- </AuditComputerName> -->
115+
<!-- </component> -->
116+
<!-- </settings> -->
117+
<settings pass="oobeSystem">
118+
<component xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
119+
<UserAccounts>
120+
<AdministratorPassword>
121+
<Value>Asdf1234</Value>
122+
<PlainText>true</PlainText>
123+
</AdministratorPassword>
124+
</UserAccounts>
125+
<AutoLogon>
126+
<Enabled>true</Enabled>
127+
<Username>Administrator</Username>
128+
<Password>
129+
<Value>Asdf1234</Value>
130+
<PlainText>true</PlainText>
131+
</Password>
132+
</AutoLogon>
133+
<FirstLogonCommands>
134+
<!-- Install QEMU and SPICE guest tools -->
135+
<!-- NOTE: MUST happen in OOBE stage since Ansible assumes that having guest tools (more specifically, the qemu guest agent) available means the install is ready to proceed -->
136+
<SynchronousCommand wcm:action="add">
137+
<Order>1</Order>
138+
<!-- QEMU guest tools are on virtio-win drive -->
139+
<CommandLine>F:\virtio-win-guest-tools.exe /passive</CommandLine>
140+
<RequiresUserInput>true</RequiresUserInput>
141+
</SynchronousCommand>
142+
<!-- SPICE guest tools aren't strictly required, but makes it Nicer(tm) to interact with graphically (automatic resolution adjustment, clipboard sync, etc) -->
143+
<SynchronousCommand wcm:action="add">
144+
<Order>2</Order>
145+
<!-- SPICE guest tools are on the guest-files virtual USB drive -->
146+
<CommandLine>D:\spice-guest-tools.exe /S</CommandLine>
147+
<RequiresUserInput>true</RequiresUserInput>
148+
</SynchronousCommand>
149+
</FirstLogonCommands>
150+
</component>
151+
</settings>
152+
<cpi:offlineImage xmlns:cpi="urn:schemas-microsoft-com:cpi" cpi:source="wim:c:/users/administrator/desktop/install.wim#Windows Server 2022 SERVERDATACENTER"/>
153+
</unattend>

‎roles/create-vm/files/windows-install-config/redhat-drivers.crt

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIFBjCCA+6gAwIBAgIQVsbSZ63gf3LutGA7v4TOpTANBgkqhkiG9w0BAQUFADCB
3+
tDELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL
4+
ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2Ug
5+
YXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykxMDEuMCwGA1UEAxMl
6+
VmVyaVNpZ24gQ2xhc3MgMyBDb2RlIFNpZ25pbmcgMjAxMCBDQTAeFw0xNjAzMTgw
7+
MDAwMDBaFw0xODEyMjkyMzU5NTlaMGgxCzAJBgNVBAYTAlVTMRcwFQYDVQQIEw5O
8+
b3J0aCBDYXJvbGluYTEQMA4GA1UEBxMHUmFsZWlnaDEWMBQGA1UEChQNUmVkIEhh
9+
dCwgSW5jLjEWMBQGA1UEAxQNUmVkIEhhdCwgSW5jLjCCASIwDQYJKoZIhvcNAQEB
10+
BQADggEPADCCAQoCggEBAMA3SYpIcNIEzqqy1PNimjt3bVY1KuIuvDABkx8hKUG6
11+
rl9WDZ7ibcW6f3cKgr1bKOAeOsMSDu6i/FzB7Csd9u/a/YkASAIIw48q9iD4K6lb
12+
Kvd+26eJCUVyLHcWlzVkqIEFcvCrvaqaU/YlX/antLWyHGbtOtSdN3FfY5pvvTbW
13+
xf8PJBWGO3nV9CVL1DMK3wSn3bRNbkTLttdIUYdgiX+q8QjbM/VyGz7nA9UvGO0n
14+
FWTZRdoiKWI7HA0Wm7TjW3GSxwDgoFb2BZYDDNSlfzQpZmvnKth/fQzNDwumhDw7
15+
tVicu/Y8E7BLhGwxFEaP0xZtENTpn+1f0TxPxpzL2zMCAwEAAaOCAV0wggFZMAkG
16+
A1UdEwQCMAAwDgYDVR0PAQH/BAQDAgeAMCsGA1UdHwQkMCIwIKAeoByGGmh0dHA6
17+
Ly9zZi5zeW1jYi5jb20vc2YuY3JsMGEGA1UdIARaMFgwVgYGZ4EMAQQBMEwwIwYI
18+
KwYBBQUHAgEWF2h0dHBzOi8vZC5zeW1jYi5jb20vY3BzMCUGCCsGAQUFBwICMBkM
19+
F2h0dHBzOi8vZC5zeW1jYi5jb20vcnBhMBMGA1UdJQQMMAoGCCsGAQUFBwMDMFcG
20+
CCsGAQUFBwEBBEswSTAfBggrBgEFBQcwAYYTaHR0cDovL3NmLnN5bWNkLmNvbTAm
21+
BggrBgEFBQcwAoYaaHR0cDovL3NmLnN5bWNiLmNvbS9zZi5jcnQwHwYDVR0jBBgw
22+
FoAUz5mp6nsm9EvJjo/X8AUm7+PSp50wHQYDVR0OBBYEFL/39F5yNDVDib3B3Uk3
23+
I8XJSrxaMA0GCSqGSIb3DQEBBQUAA4IBAQDWtaW0Dar82t1AdSalPEXshygnvh87
24+
Rce6PnM2/6j/ijo2DqwdlJBNjIOU4kxTFp8jEq8oM5Td48p03eCNsE23xrZl5qim
25+
xguIfHqeiBaLeQmxZavTHPNM667lQWPAfTGXHJb3RTT4siowcmGhxwJ3NGP0gNKC
26+
PHW09x3CdMNCIBfYw07cc6h9+Vm2Ysm9MhqnVhvROj+AahuhvfT9K0MJd3IcEpjX
27+
Z7aMX78Vt9/vrAIUR8EJ54YGgQsF/G9Adzs6fsfEw5Nrk8R0pueRMHRTMSroTe0V
28+
Ae2nvuUU6rVI30q8+UjQCxu/ji1/JnitNkUyOPyC46zL+kfHYSnld8U1
29+
-----END CERTIFICATE-----

0 commit comments

Comments
 (0)