maarten
/
incus-contrib
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
incus-contrib/bin/deploy-haproxy

1243 lines
39 KiB
Bash
Executable File
Raw Blame History

#!/usr/bin/env bash
# deploy-haproxy - Deploy and manage HAProxy load balancing on an Incus cluster
#
# Deploys test backends (nginx), builds a HAProxy image via Aether,
# deploys HA infrastructure (2x HAProxy + OVN LB), and creates an
# HTTP service with health checks.
#
# Uses Aether session-based authentication (not JWT) for HAProxy
# management endpoints that are not in the public API.
#
# Usage: deploy-haproxy [OPTIONS]
# Run 'deploy-haproxy --help' for full usage information.
set -euo pipefail
readonly VERSION="0.1.0"
readonly SCRIPT_NAME="deploy-haproxy"
readonly SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# ---------------------------------------------------------------------------
# Defaults (overridden by config file or CLI flags)
# ---------------------------------------------------------------------------
CLUSTER_REMOTE=""
CLUSTER_ID=""
OVN_NETWORK="net-prod"
VIP=""
HAPROXY_01_IP=""
HAPROXY_02_IP=""
HAPROXY_CPU="2"
HAPROXY_MEMORY="1GB"
BACKEND_IPS=""
BACKEND_PORT="80"
SERVICE_NAME="web-test"
SERVICE_MODE="http"
SERVICE_BALANCE="roundrobin"
IMAGE_VERSION="1.0.0"
AETHER_URL=""
AETHER_USER="admin"
AETHER_PASSWORD=""
# Runtime flags
DRY_RUN=false
VERBOSE=false
QUIET=false
CONFIG_FILE=""
ACTION=""
SKIP_BACKENDS=false
SKIP_IMAGE=false
# Session state
COOKIE_JAR=""
CSRF_TOKEN=""
# ---------------------------------------------------------------------------
# Color and formatting
# ---------------------------------------------------------------------------
setup_colors() {
if [[ -t 1 ]] && [[ "${NO_COLOR:-}" != "1" ]] && [[ "${TERM:-}" != "dumb" ]]; then
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[0;33m'
BLUE='\033[0;34m'
CYAN='\033[0;36m'
BOLD='\033[1m'
DIM='\033[2m'
RESET='\033[0m'
else
RED='' GREEN='' YELLOW='' BLUE='' CYAN='' BOLD='' DIM='' RESET=''
fi
}
info() { [[ "$QUIET" == true ]] && return; echo -e "${BLUE}[info]${RESET} $*"; }
success() { [[ "$QUIET" == true ]] && return; echo -e "${GREEN}[ok]${RESET} $*"; }
warn() { echo -e "${YELLOW}[warn]${RESET} $*" >&2; }
error() { echo -e "${RED}[error]${RESET} $*" >&2; }
step() { [[ "$QUIET" == true ]] && return; echo -e "${CYAN}[step]${RESET} ${BOLD}$*${RESET}"; }
detail() { [[ "$VERBOSE" != true ]] && return; echo -e "${DIM} $*${RESET}"; }
dry_run_guard() {
if [[ "$DRY_RUN" == true ]]; then
info "(dry-run) $*"
return 1
fi
return 0
}
# ---------------------------------------------------------------------------
# Help
# ---------------------------------------------------------------------------
usage() {
cat <<EOF
${BOLD}${SCRIPT_NAME}${RESET} v${VERSION} - Deploy HAProxy load balancing on an Incus cluster
${BOLD}USAGE${RESET}
${SCRIPT_NAME} [OPTIONS]
${BOLD}ACTIONS${RESET}
--deploy Full deploy: backends, image, infrastructure, service
--status Check HAProxy health, backends, service stats
--cleanup Remove HAProxy infrastructure and test backends
--doctor Check prerequisites (incus CLI, curl, Aether access)
${BOLD}OPTIONS${RESET}
-c, --config FILE Configuration file
-p, --password PASS Aether admin password (default: from env file)
--skip-backends Skip backend deployment (use existing)
--skip-image Skip image build (use existing)
-n, --dry-run Preview actions without executing
-v, --verbose Show detailed output
-q, --quiet Suppress informational output
-h, --help Show this help message
${BOLD}CONFIGURATION${RESET}
The script uses built-in defaults for the lab environment. Override with
a config file or CLI flags. Password is read from the 'env' file
(AETHER_ADMIN_PASSWORD) or passed via --password.
Defaults:
Cluster remote: ${CLUSTER_REMOTE}
Cluster ID: ${CLUSTER_ID}
OVN network: ${OVN_NETWORK}
VIP: ${VIP}
HAProxy IPs: ${HAPROXY_01_IP}, ${HAPROXY_02_IP}
Backend IPs: ${BACKEND_IPS}
Service: ${SERVICE_NAME} (${SERVICE_MODE}, ${SERVICE_BALANCE})
Image version: ${IMAGE_VERSION}
Aether: ${AETHER_URL}
${BOLD}EXAMPLES${RESET}
# Check prerequisites
${SCRIPT_NAME} --doctor
# Full deployment with defaults
${SCRIPT_NAME} --deploy
# Preview deployment
${SCRIPT_NAME} --deploy --dry-run
# Deploy without rebuilding image
${SCRIPT_NAME} --deploy --skip-image
# Deploy without creating new backends
${SCRIPT_NAME} --deploy --skip-backends
# Check health
${SCRIPT_NAME} --status
# Clean up everything
${SCRIPT_NAME} --cleanup
EOF
}
# ---------------------------------------------------------------------------
# Config parsing
# ---------------------------------------------------------------------------
parse_config() {
local file="$1"
if [[ ! -f "$file" ]]; then
error "Config file not found: $file"
exit 1
fi
local val
val=$(grep -A50 '^haproxy:' "$file" | grep '^ *cluster_remote:' | head -1 | sed 's/.*: *//' | tr -d '"' || true)
[[ -n "$val" ]] && CLUSTER_REMOTE="$val"
val=$(grep -A50 '^haproxy:' "$file" | grep '^ *cluster_id:' | head -1 | sed 's/.*: *//' | tr -d '"' || true)
[[ -n "$val" ]] && CLUSTER_ID="$val"
val=$(grep -A50 '^haproxy:' "$file" | grep '^ *ovn_network:' | head -1 | sed 's/.*: *//' | tr -d '"' || true)
[[ -n "$val" ]] && OVN_NETWORK="$val"
val=$(grep -A50 '^haproxy:' "$file" | grep '^ *vip:' | head -1 | sed 's/.*: *//' | tr -d '"' || true)
[[ -n "$val" ]] && VIP="$val"
val=$(grep -A50 '^haproxy:' "$file" | grep '^ *haproxy_01_ip:' | head -1 | sed 's/.*: *//' | tr -d '"' || true)
[[ -n "$val" ]] && HAPROXY_01_IP="$val"
val=$(grep -A50 '^haproxy:' "$file" | grep '^ *haproxy_02_ip:' | head -1 | sed 's/.*: *//' | tr -d '"' || true)
[[ -n "$val" ]] && HAPROXY_02_IP="$val"
val=$(grep -A50 '^haproxy:' "$file" | grep '^ *backend_ips:' | head -1 | sed 's/.*: *//' | tr -d '"' || true)
[[ -n "$val" ]] && BACKEND_IPS="$val"
val=$(grep -A50 '^haproxy:' "$file" | grep '^ *service_name:' | head -1 | sed 's/.*: *//' | tr -d '"' || true)
[[ -n "$val" ]] && SERVICE_NAME="$val"
val=$(grep -A50 '^haproxy:' "$file" | grep '^ *image_version:' | head -1 | sed 's/.*: *//' | tr -d '"' || true)
[[ -n "$val" ]] && IMAGE_VERSION="$val"
val=$(grep -A50 '^haproxy:' "$file" | grep '^ *aether_url:' | head -1 | sed 's/^ *aether_url: *//' | tr -d '"' || true)
[[ -n "$val" ]] && AETHER_URL="$val"
}
# ---------------------------------------------------------------------------
# Load password from env file
# ---------------------------------------------------------------------------
load_password() {
if [[ -n "$AETHER_PASSWORD" ]]; then
return 0
fi
# Check if already exported (user sourced envs/*/env)
if [[ -n "${AETHER_ADMIN_PASSWORD:-}" ]]; then
AETHER_PASSWORD="$AETHER_ADMIN_PASSWORD"
return 0
fi
# Search for env file: walk up from script dir
local dir="$SCRIPT_DIR"
while [[ "$dir" != "/" ]]; do
if [[ -f "${dir}/env" ]]; then
local val
val=$(grep 'AETHER_ADMIN_PASSWORD=' "${dir}/env" | head -1 | sed 's/^.*AETHER_ADMIN_PASSWORD=//' | tr -d '"' | tr -d "'" || true)
if [[ -n "$val" ]]; then
AETHER_PASSWORD="$val"
detail "Password loaded from ${dir}/env"
return 0
fi
fi
dir="$(dirname "$dir")"
done
error "Aether password not found"
error "Source envs/<env>/env or use --password"
return 1
}
# ---------------------------------------------------------------------------
# Aether session authentication
# ---------------------------------------------------------------------------
aether_login() {
step "Authenticating with Aether"
COOKIE_JAR=$(mktemp /tmp/aether-haproxy-cookies.XXXXXX)
detail "Cookie jar: ${COOKIE_JAR}"
# Step 1: Get login page and extract CSRF token from hidden form field
# Aether serves the login form at / (root), not /login
# The form POSTs to /login
local login_page
login_page=$(curl -sSk -c "$COOKIE_JAR" "${AETHER_URL}/" 2>/dev/null)
CSRF_TOKEN=$(echo "$login_page" \
| grep -o 'name="csrf_token" value="[^"]*"' \
| head -1 \
| sed 's/.*value="//;s/"//' || true)
if [[ -z "$CSRF_TOKEN" ]]; then
# Try alternate pattern (some versions use different attribute order)
CSRF_TOKEN=$(echo "$login_page" \
| grep -o 'value="[^"]*" name="csrf_token"' \
| head -1 \
| sed 's/value="//;s/" name=.*//' || true)
fi
if [[ -z "$CSRF_TOKEN" ]]; then
error "Failed to extract CSRF token from login page"
error "Check that Aether is accessible at ${AETHER_URL}"
return 1
fi
detail "CSRF token: ${CSRF_TOKEN:0:20}..."
# Step 2: POST login (form-urlencoded, NOT JSON)
local login_code
login_code=$(curl -sSk -b "$COOKIE_JAR" -c "$COOKIE_JAR" \
-X POST "${AETHER_URL}/login" \
-d "csrf_token=${CSRF_TOKEN}&username=${AETHER_USER}&password=${AETHER_PASSWORD}" \
-o /dev/null -w '%{http_code}' \
-L 2>/dev/null)
detail "Login response: HTTP ${login_code}"
# Step 3: Refresh CSRF token from an authenticated page
local haproxy_page
haproxy_page=$(curl -sSk -b "$COOKIE_JAR" "${AETHER_URL}/haproxy" 2>/dev/null)
CSRF_TOKEN=$(echo "$haproxy_page" \
| grep -o 'name="csrf_token" value="[^"]*"' \
| head -1 \
| sed 's/.*value="//;s/"//' || true)
if [[ -z "$CSRF_TOKEN" ]]; then
error "Failed to get CSRF token after login — authentication may have failed"
error "Verify password is correct (AETHER_ADMIN_PASSWORD in env file)"
return 1
fi
success "Authenticated with Aether (session + CSRF)"
detail "CSRF token: ${CSRF_TOKEN:0:20}..."
}
aether_api() {
local method="$1" path="$2"
shift 2
curl -sSk -b "$COOKIE_JAR" \
-H "X-CSRF-Token: ${CSRF_TOKEN}" \
-H "Referer: ${AETHER_URL}/haproxy" \
-X "$method" "${AETHER_URL}${path}" \
"$@"
}
aether_cleanup() {
if [[ -n "${COOKIE_JAR:-}" && -f "${COOKIE_JAR:-}" ]]; then
rm -f "$COOKIE_JAR"
fi
}
# ---------------------------------------------------------------------------
# Helpers
# ---------------------------------------------------------------------------
# Split BACKEND_IPS into array
get_backend_ips() {
echo "$BACKEND_IPS" | tr ',' ' '
}
get_backend_count() {
local ips
ips=$(get_backend_ips)
echo "$ips" | wc -w
}
backend_name() {
local index="$1"
printf "nginx-lb-%02d" "$index"
}
haproxy_container_01() {
echo "ffsdn-haproxy-${CLUSTER_ID}-01"
}
haproxy_container_02() {
echo "ffsdn-haproxy-${CLUSTER_ID}-02"
}
container_exists() {
local name="$1"
incus info "${CLUSTER_REMOTE}:${name}" &>/dev/null 2>&1
}
container_running() {
local name="$1"
local state
state=$(incus info "${CLUSTER_REMOTE}:${name}" 2>/dev/null | grep -i '^status:' | awk '{print $2}')
[[ "$state" == "RUNNING" || "$state" == "Running" ]]
}
# ---------------------------------------------------------------------------
# Doctor — prerequisite checks
# ---------------------------------------------------------------------------
action_doctor() {
step "Checking prerequisites"
local ok=true
# incus CLI
if command -v incus &>/dev/null; then
success "incus CLI: $(incus version 2>/dev/null || echo 'installed')"
else
error "incus CLI not found — install the Incus client"
ok=false
fi
# curl
if command -v curl &>/dev/null; then
success "curl: $(curl --version | head -1 | awk '{print $2}')"
else
error "curl not found"
ok=false
fi
# python3
if command -v python3 &>/dev/null; then
success "python3: $(python3 --version 2>&1 | awk '{print $2}')"
else
error "python3 not found"
ok=false
fi
# Aether password
if load_password 2>/dev/null; then
success "Aether password: configured"
else
error "Aether password: not found (set AETHER_ADMIN_PASSWORD in env file)"
ok=false
fi
# Cluster remote
if incus remote list -f csv 2>/dev/null | grep -q "^${CLUSTER_REMOTE},"; then
success "Incus remote '${CLUSTER_REMOTE}': reachable"
else
warn "Incus remote '${CLUSTER_REMOTE}' not found (needed for deployment)"
fi
# Aether accessibility (login page is at root /)
local aether_code
aether_code=$(curl -sk -o /dev/null -w '%{http_code}' "${AETHER_URL}/" 2>/dev/null || echo "000")
if [[ "$aether_code" == "200" || "$aether_code" == "302" ]]; then
success "Aether: reachable at ${AETHER_URL} (HTTP ${aether_code})"
else
error "Aether: not reachable at ${AETHER_URL} (HTTP ${aether_code})"
ok=false
fi
# Existing HAProxy containers
if container_exists "$(haproxy_container_01)"; then
info "HAProxy infrastructure exists on cluster ${CLUSTER_ID}"
if container_running "$(haproxy_container_01)"; then
success " $(haproxy_container_01): running"
else
warn " $(haproxy_container_01): not running"
fi
if container_running "$(haproxy_container_02)"; then
success " $(haproxy_container_02): running"
else
warn " $(haproxy_container_02): not running"
fi
else
info "No HAProxy infrastructure on cluster ${CLUSTER_ID} (--deploy to create)"
fi
# Existing backends
local idx=1
for ip in $(get_backend_ips); do
local name
name=$(backend_name "$idx")
if container_exists "$name"; then
success " Backend ${name} (${ip}): exists"
else
info " Backend ${name} (${ip}): not deployed"
fi
idx=$((idx + 1))
done
echo
if [[ "$ok" == true ]]; then
success "All prerequisites satisfied"
else
error "Some prerequisites missing — fix the issues above"
return 1
fi
}
# ---------------------------------------------------------------------------
# Deploy — full deployment pipeline
# ---------------------------------------------------------------------------
action_deploy() {
step "Deploying HAProxy load balancing on cluster ${CLUSTER_ID}"
echo
info " Cluster: ${CLUSTER_REMOTE} (ID: ${CLUSTER_ID})"
info " OVN network: ${OVN_NETWORK}"
info " VIP: ${VIP}"
info " HAProxy: ${HAPROXY_01_IP}, ${HAPROXY_02_IP}"
info " Backends: ${BACKEND_IPS}"
info " Service: ${SERVICE_NAME} (${SERVICE_MODE}, ${SERVICE_BALANCE})"
echo
load_password
# Check existing infrastructure
if container_exists "$(haproxy_container_01)"; then
error "HAProxy infrastructure already exists ($(haproxy_container_01))"
error "Use --status to check health, or --cleanup first."
return 1
fi
if [[ "$SKIP_BACKENDS" != true ]]; then
phase_deploy_backends
else
info "Skipping backend deployment (--skip-backends)"
fi
# Authenticate with Aether for remaining phases
if [[ "$DRY_RUN" != true ]]; then
aether_login
trap aether_cleanup EXIT
fi
if [[ "$SKIP_IMAGE" != true ]]; then
phase_build_image
else
info "Skipping image build (--skip-image)"
fi
phase_deploy_infrastructure
phase_create_service
phase_verify
echo
success "HAProxy deployment complete!"
info " VIP: http://${VIP}/"
info " Service: ${SERVICE_NAME}"
info " Backends: $(get_backend_count)"
echo
info "Next steps:"
info " curl http://${VIP}/ # test load balancing"
info " ${SCRIPT_NAME} --status # check health"
}
# ---------------------------------------------------------------------------
# Phase 1: Deploy test backends
# ---------------------------------------------------------------------------
phase_deploy_backends() {
step "Phase 1: Deploy test backends"
local idx=1
for ip in $(get_backend_ips); do
local name
name=$(backend_name "$idx")
if container_exists "$name"; then
if container_running "$name"; then
success "Backend ${name} already running"
idx=$((idx + 1))
continue
else
warn "Backend ${name} exists but not running — starting"
if dry_run_guard "incus start ${CLUSTER_REMOTE}:${name}"; then
incus start "${CLUSTER_REMOTE}:${name}"
fi
idx=$((idx + 1))
continue
fi
fi
if ! dry_run_guard "Launch ${name} on ${OVN_NETWORK} at ${ip}"; then
idx=$((idx + 1))
continue
fi
info "Launching ${name} (${ip})..."
incus launch images:debian/12 "${CLUSTER_REMOTE}:${name}" \
-n "$OVN_NETWORK"
# Wait for container agent
local elapsed=0
while ! incus exec "${CLUSTER_REMOTE}:${name}" -- true &>/dev/null 2>&1; do
sleep 2
elapsed=$((elapsed + 2))
if [[ $elapsed -ge 60 ]]; then
error "Container agent not available after 60s"
return 1
fi
done
# Configure backend
incus exec "${CLUSTER_REMOTE}:${name}" -- bash -c "
# Wait for initial network
sleep 3
# Install nginx + curl (curl needed for verification)
export DEBIAN_FRONTEND=noninteractive
apt-get update -qq
apt-get install -y -qq nginx curl 2>&1 | tail -1
# Create unique index page
cat > /var/www/html/index.html << HTML
<html><body>
<h1>Backend: ${name}</h1>
<p>IP: ${ip}</p>
</body></html>
HTML
systemctl enable nginx
systemctl start nginx
"
# Set static IP
incus exec "${CLUSTER_REMOTE}:${name}" -- bash -c "
cat > /etc/systemd/network/10-static.network << NETCFG
[Match]
Name=eth0
[Network]
Address=${ip}/24
Gateway=10.10.10.1
DNS=10.10.10.1
NETCFG
systemctl restart systemd-networkd
"
success "Backend ${name} deployed at ${ip}"
idx=$((idx + 1))
done
# Verify backends
info "Waiting for backends to stabilize..."
sleep 5
local all_ok=true
idx=1
for ip in $(get_backend_ips); do
local name
name=$(backend_name "$idx")
if container_running "$name"; then
detail "Backend ${name}: running"
else
warn "Backend ${name}: not running"
all_ok=false
fi
idx=$((idx + 1))
done
if [[ "$all_ok" == true ]]; then
success "All $(get_backend_count) backends deployed"
else
warn "Some backends may not be ready"
fi
}
# ---------------------------------------------------------------------------
# Phase 2: Build HAProxy image
# ---------------------------------------------------------------------------
phase_build_image() {
step "Phase 2: Build HAProxy image"
if ! dry_run_guard "Build HAProxy image v${IMAGE_VERSION} on cluster ${CLUSTER_ID}"; then
return 0
fi
# Check if image already exists
local images_response
images_response=$(aether_api GET "/haproxy/images" 2>/dev/null || echo "[]")
local existing_version
existing_version=$(echo "$images_response" \
| python3 -c "
import sys, json
try:
imgs = json.load(sys.stdin)
if isinstance(imgs, list):
for img in imgs:
if img.get('version') == '${IMAGE_VERSION}':
print(img.get('id', ''))
break
except: pass
" 2>/dev/null || true)
if [[ -n "$existing_version" ]]; then
success "Image v${IMAGE_VERSION} already exists (ID: ${existing_version})"
info "Ensuring image is pushed to cluster and set as current..."
aether_api POST "/haproxy/image/push" \
-H "Content-Type: application/json" \
-d "{\"image_id\": ${existing_version}, \"cluster_id\": ${CLUSTER_ID}}" \
2>/dev/null || true
aether_api POST "/haproxy/image/set-current" \
-H "Content-Type: application/json" \
-d "{\"image_id\": ${existing_version}}" \
2>/dev/null || true
success "Image v${IMAGE_VERSION} ready on cluster ${CLUSTER_ID}"
return 0
fi
# Build new image
info "Building HAProxy image v${IMAGE_VERSION} on cluster ${CLUSTER_ID}..."
info "This takes 5-10 minutes..."
local build_response
build_response=$(aether_api POST "/haproxy/image/build" \
-H "Content-Type: application/json" \
-d "{\"cluster_id\": ${CLUSTER_ID}, \"version\": \"${IMAGE_VERSION}\"}" \
2>/dev/null)
detail "Build response: ${build_response}"
# Poll build status
local elapsed=0
local timeout=600
local status=""
while true; do
status=$(aether_api GET "/haproxy/image/build-status" 2>/dev/null \
| python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('status','unknown'))" \
2>/dev/null || echo "unknown")
detail "Build status: ${status} (${elapsed}s)"
if [[ "$status" == "completed" || "$status" == "success" ]]; then
success "Image build completed"
break
elif [[ "$status" == "failed" || "$status" == "error" ]]; then
error "Image build failed"
local build_error
build_error=$(aether_api GET "/haproxy/image/build-status" 2>/dev/null \
| python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('error','unknown'))" \
2>/dev/null || true)
[[ -n "$build_error" ]] && error "Error: ${build_error}"
return 1
fi
sleep 15
elapsed=$((elapsed + 15))
if [[ $elapsed -ge $timeout ]]; then
error "Image build timed out after ${timeout}s"
return 1
fi
done
# Get new image ID
local image_id
image_id=$(aether_api GET "/haproxy/images" 2>/dev/null \
| python3 -c "
import sys, json
try:
imgs = json.load(sys.stdin)
if isinstance(imgs, list):
for img in imgs:
if img.get('version') == '${IMAGE_VERSION}':
print(img['id'])
break
except: pass
" 2>/dev/null || true)
if [[ -z "$image_id" ]]; then
error "Cannot find built image — check Aether UI"
return 1
fi
# Push to cluster
info "Pushing image to cluster ${CLUSTER_ID}..."
aether_api POST "/haproxy/image/push" \
-H "Content-Type: application/json" \
-d "{\"image_id\": ${image_id}, \"cluster_id\": ${CLUSTER_ID}}" \
2>/dev/null || true
# Set as current
info "Setting as current version..."
aether_api POST "/haproxy/image/set-current" \
-H "Content-Type: application/json" \
-d "{\"image_id\": ${image_id}}" \
2>/dev/null || true
success "Image v${IMAGE_VERSION} built and pushed (ID: ${image_id})"
}
# ---------------------------------------------------------------------------
# Phase 3: Deploy HAProxy infrastructure
# ---------------------------------------------------------------------------
phase_deploy_infrastructure() {
step "Phase 3: Deploy HAProxy infrastructure"
if ! dry_run_guard "Deploy infrastructure: VIP=${VIP}, HAProxy=${HAPROXY_01_IP}/${HAPROXY_02_IP}"; then
return 0
fi
# Check existing infrastructure
local infra_response
infra_response=$(aether_api GET "/haproxy/infrastructure/${CLUSTER_ID}" 2>/dev/null || echo "{}")
local infra_exists
infra_exists=$(echo "$infra_response" \
| python3 -c "
import sys, json
try:
d = json.load(sys.stdin)
if d.get('deployed') or d.get('haproxy_01_ip'):
print('yes')
else:
print('no')
except: print('no')
" 2>/dev/null || echo "no")
if [[ "$infra_exists" == "yes" ]]; then
success "Infrastructure already deployed on cluster ${CLUSTER_ID}"
return 0
fi
info "Deploying infrastructure..."
info " OVN network: ${OVN_NETWORK}"
info " VIP: ${VIP}"
info " HAProxy 01: ${HAPROXY_01_IP}"
info " HAProxy 02: ${HAPROXY_02_IP}"
info " CPU: ${HAPROXY_CPU}"
info " Memory: ${HAPROXY_MEMORY}"
local deploy_response
deploy_response=$(aether_api POST "/haproxy/infrastructure/deploy" \
-H "Content-Type: application/json" \
-d "{
\"cluster_id\": ${CLUSTER_ID},
\"ovn_network\": \"${OVN_NETWORK}\",
\"vip\": \"${VIP}\",
\"haproxy_01_ip\": \"${HAPROXY_01_IP}\",
\"haproxy_02_ip\": \"${HAPROXY_02_IP}\",
\"cpu_limit\": \"${HAPROXY_CPU}\",
\"memory_limit\": \"${HAPROXY_MEMORY}\"
}" 2>/dev/null)
detail "Deploy response: ${deploy_response}"
# Verify containers appeared
info "Waiting for HAProxy containers to start..."
local elapsed=0
local timeout=120
while true; do
if container_exists "$(haproxy_container_01)" && container_exists "$(haproxy_container_02)"; then
break
fi
sleep 5
elapsed=$((elapsed + 5))
if [[ $elapsed -ge $timeout ]]; then
error "HAProxy containers not found after ${timeout}s"
error "Check Aether UI for deployment errors"
return 1
fi
detail "Waiting for containers... (${elapsed}s)"
done
# Wait for running state
elapsed=0
while true; do
if container_running "$(haproxy_container_01)" && container_running "$(haproxy_container_02)"; then
break
fi
sleep 5
elapsed=$((elapsed + 5))
if [[ $elapsed -ge $timeout ]]; then
warn "HAProxy containers exist but not all running after ${timeout}s"
break
fi
done
success "Infrastructure deployed"
success " $(haproxy_container_01): $(container_running "$(haproxy_container_01)" && echo "running" || echo "not running")"
success " $(haproxy_container_02): $(container_running "$(haproxy_container_02)" && echo "running" || echo "not running")"
}
# ---------------------------------------------------------------------------
# Phase 4: Create HTTP service
# ---------------------------------------------------------------------------
phase_create_service() {
step "Phase 4: Create HTTP service"
if ! dry_run_guard "Create service: ${SERVICE_NAME} on ${VIP}:${BACKEND_PORT}"; then
return 0
fi
# Build backends JSON
local backends_json="["
local idx=1
local first=true
for ip in $(get_backend_ips); do
local name
name=$(backend_name "$idx")
if [[ "$first" == true ]]; then
first=false
else
backends_json+=","
fi
backends_json+="{\"name\":\"${name}\",\"ip\":\"${ip}\",\"port\":${BACKEND_PORT},\"weight\":100}"
idx=$((idx + 1))
done
backends_json+="]"
detail "Backends JSON: ${backends_json}"
info "Creating service '${SERVICE_NAME}'..."
info " VIP: ${VIP}:${BACKEND_PORT}"
info " Mode: ${SERVICE_MODE}"
info " Balance: ${SERVICE_BALANCE}"
info " Health: enabled"
info " Backends: $(get_backend_count)"
local service_response
service_response=$(aether_api POST "/haproxy/service" \
-H "Content-Type: application/json" \
-d "{
\"cluster_id\": ${CLUSTER_ID},
\"name\": \"${SERVICE_NAME}\",
\"description\": \"HTTP load balancer for nginx test backends\",
\"vip\": \"${VIP}\",
\"listen_port\": ${BACKEND_PORT},
\"mode\": \"${SERVICE_MODE}\",
\"balance\": \"${SERVICE_BALANCE}\",
\"health_check\": true,
\"sticky_sessions\": false,
\"backends\": ${backends_json}
}" 2>/dev/null)
detail "Service response: ${service_response}"
success "Service '${SERVICE_NAME}' created"
}
# ---------------------------------------------------------------------------
# Phase 5: Verify
# ---------------------------------------------------------------------------
phase_verify() {
step "Phase 5: Verify deployment"
info "Waiting for HAProxy to configure backends..."
sleep 10
# Test VIP
info "Testing VIP at http://${VIP}/..."
local response
response=$(curl -sk --connect-timeout 5 --max-time 10 "http://${VIP}/" 2>/dev/null || true)
if [[ -n "$response" ]]; then
local backend_hit
backend_hit=$(echo "$response" | grep -o 'Backend: [^<]*' || echo "unknown")
success "VIP responding: ${backend_hit}"
else
warn "VIP not responding yet — HAProxy may still be configuring"
warn "Try: curl http://${VIP}/"
fi
# Test distribution
if [[ -n "$response" ]]; then
info "Testing traffic distribution (6 requests)..."
local hits=""
for i in $(seq 1 6); do
local hit
hit=$(curl -sk --connect-timeout 5 --max-time 10 "http://${VIP}/" 2>/dev/null \
| grep -o 'Backend: [^<]*' || echo "no response")
detail " Request ${i}: ${hit}"
hits="${hits}${hit}\n"
done
local unique_backends
unique_backends=$(echo -e "$hits" | sort -u | grep -c 'Backend:' || echo 0)
if [[ "$unique_backends" -gt 1 ]]; then
success "Traffic distributed across ${unique_backends} backends"
elif [[ "$unique_backends" -eq 1 ]]; then
info "Traffic going to 1 backend (health checks may not have completed yet)"
else
warn "No successful responses — check HAProxy and backend health"
fi
fi
}
# ---------------------------------------------------------------------------
# Status — health checks
# ---------------------------------------------------------------------------
action_status() {
step "HAProxy Status for cluster ${CLUSTER_ID}"
echo
# HAProxy containers
if container_exists "$(haproxy_container_01)"; then
if container_running "$(haproxy_container_01)"; then
success "$(haproxy_container_01): running"
else
error "$(haproxy_container_01): not running"
fi
else
error "$(haproxy_container_01): not found (no infrastructure deployed)"
return 1
fi
if container_exists "$(haproxy_container_02)"; then
if container_running "$(haproxy_container_02)"; then
success "$(haproxy_container_02): running"
else
warn "$(haproxy_container_02): not running"
fi
else
warn "$(haproxy_container_02): not found"
fi
# Backend containers
echo
info "Backends:"
local idx=1
for ip in $(get_backend_ips); do
local name
name=$(backend_name "$idx")
if container_exists "$name"; then
if container_running "$name"; then
success " ${name} (${ip}): running"
else
warn " ${name} (${ip}): not running"
fi
else
info " ${name} (${ip}): not deployed"
fi
idx=$((idx + 1))
done
# VIP connectivity
echo
info "VIP connectivity:"
local vip_code
vip_code=$(curl -sk -o /dev/null -w '%{http_code}' --connect-timeout 5 \
"http://${VIP}/" 2>/dev/null || echo "000")
if [[ "$vip_code" == "200" ]]; then
success "VIP http://${VIP}/ responding (HTTP ${vip_code})"
else
warn "VIP http://${VIP}/ not responding (HTTP ${vip_code})"
fi
# Aether health stats (requires session auth)
echo
if load_password 2>/dev/null; then
aether_login 2>/dev/null
trap aether_cleanup EXIT
local health_response
health_response=$(aether_api GET \
"/haproxy/service/health-stats?cluster_id=${CLUSTER_ID}&service_name=${SERVICE_NAME}" \
2>/dev/null || echo "{}")
local has_stats
has_stats=$(echo "$health_response" \
| python3 -c "
import sys, json
try:
d = json.load(sys.stdin)
if d and not d.get('error'):
print('yes')
else:
print('no')
except: print('no')
" 2>/dev/null || echo "no")
if [[ "$has_stats" == "yes" ]]; then
info "Service health (from Aether):"
echo "$health_response" | python3 -c "
import sys, json
try:
d = json.load(sys.stdin)
# Print backend stats if available
backends = d.get('backends', d.get('backend_stats', []))
if isinstance(backends, list):
for b in backends:
name = b.get('name', b.get('server', 'unknown'))
status = b.get('status', 'unknown')
icon = 'UP' if status.upper() == 'UP' else 'DOWN'
print(f' {name}: {icon}')
# Print frontend stats if available
frontend = d.get('frontend', d.get('frontend_stats', {}))
if isinstance(frontend, dict) and frontend:
sessions = frontend.get('scur', frontend.get('current_sessions', '?'))
print(f' Frontend sessions: {sessions}')
except Exception as e:
print(f' (could not parse stats: {e})')
" 2>/dev/null || warn " Could not parse health stats"
else
info "No health stats available (service may not exist yet)"
fi
else
info "Skipping Aether health stats (no password configured)"
fi
}
# ---------------------------------------------------------------------------
# Cleanup — remove everything
# ---------------------------------------------------------------------------
action_cleanup() {
step "Cleaning up HAProxy deployment"
echo
local has_infra=false
local has_backends=false
if container_exists "$(haproxy_container_01)"; then
has_infra=true
fi
local idx=1
for ip in $(get_backend_ips); do
if container_exists "$(backend_name "$idx")"; then
has_backends=true
break
fi
idx=$((idx + 1))
done
if [[ "$has_infra" == false && "$has_backends" == false ]]; then
info "Nothing to clean up"
return 0
fi
echo
if [[ "$has_infra" == true ]]; then
warn "This will delete HAProxy infrastructure ($(haproxy_container_01), $(haproxy_container_02))"
warn "All services and VIPs will be removed."
fi
if [[ "$has_backends" == true ]]; then
warn "This will delete test backend containers."
fi
echo
if [[ "$DRY_RUN" == true ]]; then
info "(dry-run) Would delete infrastructure and backends"
return 0
fi
read -r -p "Type 'yes' to confirm: " confirm
if [[ "$confirm" != "yes" ]]; then
info "Aborted"
return 0
fi
# Delete infrastructure via Aether API (removes containers, VIPs, services)
if [[ "$has_infra" == true ]]; then
step "Removing HAProxy infrastructure via Aether"
if load_password 2>/dev/null; then
aether_login
trap aether_cleanup EXIT
local delete_response
delete_response=$(aether_api DELETE "/haproxy/infrastructure/${CLUSTER_ID}" \
-H "Content-Type: application/json" \
2>/dev/null || echo "")
detail "Delete response: ${delete_response}"
# Wait for containers to be removed
local elapsed=0
while container_exists "$(haproxy_container_01)" && [[ $elapsed -lt 60 ]]; do
sleep 5
elapsed=$((elapsed + 5))
detail "Waiting for cleanup... (${elapsed}s)"
done
if ! container_exists "$(haproxy_container_01)"; then
success "HAProxy infrastructure removed"
else
warn "Infrastructure may not be fully removed — check Aether UI"
fi
else
warn "Cannot authenticate with Aether — deleting containers directly"
if container_running "$(haproxy_container_01)"; then
incus stop "${CLUSTER_REMOTE}:$(haproxy_container_01)" --force 2>/dev/null || true
fi
incus delete "${CLUSTER_REMOTE}:$(haproxy_container_01)" --force 2>/dev/null || true
if container_running "$(haproxy_container_02)"; then
incus stop "${CLUSTER_REMOTE}:$(haproxy_container_02)" --force 2>/dev/null || true
fi
incus delete "${CLUSTER_REMOTE}:$(haproxy_container_02)" --force 2>/dev/null || true
success "HAProxy containers deleted directly"
fi
fi
# Delete backends
if [[ "$has_backends" == true ]]; then
step "Removing test backends"
idx=1
for ip in $(get_backend_ips); do
local name
name=$(backend_name "$idx")
if container_exists "$name"; then
info "Deleting ${name}..."
incus delete "${CLUSTER_REMOTE}:${name}" --force 2>/dev/null || true
success "Deleted ${name}"
fi
idx=$((idx + 1))
done
fi
echo
success "Cleanup complete"
}
# ---------------------------------------------------------------------------
# Argument parsing
# ---------------------------------------------------------------------------
parse_args() {
while [[ $# -gt 0 ]]; do
case "$1" in
--deploy) ACTION="deploy";;
--status) ACTION="status";;
--cleanup) ACTION="cleanup";;
--doctor) ACTION="doctor";;
--skip-backends) SKIP_BACKENDS=true;;
--skip-image) SKIP_IMAGE=true;;
-c|--config) CONFIG_FILE="$2"; shift;;
-p|--password) AETHER_PASSWORD="$2"; shift;;
-n|--dry-run) DRY_RUN=true;;
-v|--verbose) VERBOSE=true;;
-q|--quiet) QUIET=true;;
-h|--help) usage; exit 0;;
*)
error "Unknown option: $1"
echo "Run '${SCRIPT_NAME} --help' for usage."
exit 1
;;
esac
shift
done
if [[ -z "$ACTION" ]]; then
error "No action specified"
echo "Run '${SCRIPT_NAME} --help' for usage."
exit 1
fi
}
# ---------------------------------------------------------------------------
# Main
# ---------------------------------------------------------------------------
require_config() {
local missing=()
[[ -z "$CLUSTER_REMOTE" ]] && missing+=("cluster_remote")
[[ -z "$CLUSTER_ID" ]] && missing+=("cluster_id")
[[ -z "$VIP" ]] && missing+=("vip")
[[ -z "$HAPROXY_01_IP" ]] && missing+=("haproxy_01_ip")
[[ -z "$HAPROXY_02_IP" ]] && missing+=("haproxy_02_ip")
[[ -z "$BACKEND_IPS" ]] && missing+=("backend_ips")
[[ -z "$AETHER_URL" ]] && missing+=("aether_url")
if [[ ${#missing[@]} -gt 0 ]]; then
error "Required config missing: ${missing[*]}"
error "Use --config FILE to load environment settings (see envs/)"
exit 1
fi
}
main() {
setup_colors
parse_args "$@"
# Load config file if provided
if [[ -n "$CONFIG_FILE" ]]; then
parse_config "$CONFIG_FILE"
fi
# Validate required fields (must come from --config or CLI flags)
if [[ "$ACTION" != "doctor" ]]; then
require_config
fi
echo
case "$ACTION" in
deploy) action_deploy;;
status) action_status;;
cleanup) action_cleanup;;
doctor) action_doctor;;
esac
}
main "$@"
Reference in New Issue View Git Blame Copy Permalink