Sunyard/cisd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix:权限调整

Browse Source
This commit is contained in:
waner
2026-05-19 17:12:53 +08:00
parent a30c029fc4
commit 58dc015e01
14 changed files with 651 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/cisd_init_flow.sh
+2 -2
View File
@@ -9,12 +9,12 @@ set -euo pipefail
# REQUEST_JSON=/tmp/cisd-init-standard-rabbit.json ./scripts/cisd_init_flow.sh
#
# Optional env:
# BASE_URL=http://127.0.0.1:8080
# BASE_URL=http://127.0.0.1:8088
# INTERNAL_TOKEN=change-me-internal-token
# OUT_DIR=/tmp/cisd-init-run
# FETCH_FAILED_STEP_LOG=true
BASE_URL="${BASE_URL:-http://127.0.0.1:8080}"
BASE_URL="${BASE_URL:-http://127.0.0.1:8088}"
INTERNAL_TOKEN="${INTERNAL_TOKEN:-change-me-internal-token}"
REQUEST_JSON="${REQUEST_JSON:-}"
OUT_DIR="${OUT_DIR:-/tmp/cisd-init-run}"
scripts/pcie_realcard_smoke.sh
+1 -1
View File
@@ -6,7 +6,7 @@ set -euo pipefail
# chmod +x scripts/pcie_realcard_smoke.sh
# ./scripts/pcie_realcard_smoke.sh
BASE_URL="${BASE_URL:-http://127.0.0.1:8080}"
BASE_URL="${BASE_URL:-http://127.0.0.1:8088}"
INTERNAL_TOKEN="${INTERNAL_TOKEN:-change-me-internal-token}"
TIMEOUT_SECONDS="${TIMEOUT_SECONDS:-15}"
scripts/resource-restore/replay-mq.sh
+28 -8
View File
@@ -40,25 +40,44 @@ json_text() {
sed -nE 's/.*"'"${key}"'"[[:space:]]*:[[:space:]]*"([^"]*)".*/\1/p' "${CONTEXT_FILE}" | head -n 1
}
split_command() {
local value="$1"
# shellcheck disable=SC2206
CTL_COMMAND=(${value})
}
find_ctl() {
local configured="${RABBITMQ_CTL_COMMAND:-}"
if [[ -n "${configured}" ]]; then
printf '%s' "${configured}"
split_command "${configured}"
return 0
fi
if [[ -x "/usr/local/sbin/tms-rabbitmqctl" ]] && command -v sudo >/dev/null 2>&1; then
CTL_COMMAND=(sudo -n /usr/local/sbin/tms-rabbitmqctl)
return 0
fi
for candidate in rabbitmqctl /usr/local/rabbitmq/sbin/rabbitmqctl /usr/local/rabbitmq-server/sbin/rabbitmqctl /usr/sbin/rabbitmqctl /usr/lib/rabbitmq/bin/rabbitmqctl; do
if command -v "${candidate}" >/dev/null 2>&1; then
command -v "${candidate}"
CTL_COMMAND=("$(command -v "${candidate}")")
return 0
fi
if [[ -x "${candidate}" ]]; then
printf '%s' "${candidate}"
CTL_COMMAND=("${candidate}")
return 0
fi
done
return 1
}
run_ctl() {
local timeout_seconds="${RABBITMQ_CTL_TIMEOUT_SECONDS:-30}"
if command -v timeout >/dev/null 2>&1; then
timeout "${timeout_seconds}" "${CTL_COMMAND[@]}" "$@"
else
"${CTL_COMMAND[@]}" "$@"
fi
}
if [[ -n "${MQ_REPLAY_COMMAND:-}" ]]; then
log "delegating mq replay to configured command"
"${MQ_REPLAY_COMMAND}" --context-file "${CONTEXT_FILE}" --work-dir "${WORK_DIR}" >> "${LOG_FILE}" 2>&1
@@ -85,15 +104,16 @@ if [[ -z "${USER_NAME}" || -z "${USER_PASS}" ]]; then
exit 1
fi
CTL="$(find_ctl)" || {
CTL_COMMAND=()
find_ctl || {
echo "[ERROR] rabbitmqctl not found" >&2
exit 1
}
"${CTL}" status >> "${LOG_FILE}" 2>&1 || log "rabbitmqctl status failed, continue replay"
"${CTL}" add_vhost "${VHOST}" >> "${LOG_FILE}" 2>&1 || true
"${CTL}" add_user "${USER_NAME}" "${USER_PASS}" >> "${LOG_FILE}" 2>&1 || "${CTL}" change_password "${USER_NAME}" "${USER_PASS}" >> "${LOG_FILE}" 2>&1
"${CTL}" set_permissions -p "${VHOST}" "${USER_NAME}" ".*" ".*" ".*" >> "${LOG_FILE}" 2>&1
run_ctl status >> "${LOG_FILE}" 2>&1 || log "rabbitmqctl status failed, continue replay"
run_ctl add_vhost "${VHOST}" >> "${LOG_FILE}" 2>&1 || true
run_ctl add_user "${USER_NAME}" "${USER_PASS}" >> "${LOG_FILE}" 2>&1 || run_ctl change_password "${USER_NAME}" "${USER_PASS}" >> "${LOG_FILE}" 2>&1
run_ctl set_permissions -p "${VHOST}" "${USER_NAME}" ".*" ".*" ".*" >> "${LOG_FILE}" 2>&1
log "rabbitmq user and permissions replayed"
if [[ -n "${RABBIT_QUEUE_REPLAY_SCRIPT_PATH:-}" && -x "${RABBIT_QUEUE_REPLAY_SCRIPT_PATH}" ]]; then
scripts/resource-restore/restore-db.sh
+1 -2
View File
@@ -60,5 +60,4 @@ fi
--host="${HOST}" \
--port="${PORT}" \
--user="${USERNAME}" \
--password="${PASSWORD}" \
"${DB_NAME}" < "${SQL_FILE}"
--password="${PASSWORD}" < "${SQL_FILE}"
scripts/standard-init/root-sbin/tms-rabbitmqctl
Executable
+92
View File
@@ -0,0 +1,92 @@
#!/usr/bin/env bash
set -euo pipefail
if [[ "$(id -u)" -ne 0 ]]; then
echo "tms-rabbitmqctl must be executed as root through sudo" >&2
exit 77
fi
if [[ $# -lt 1 ]]; then
echo "usage: tms-rabbitmqctl <allowed-rabbitmqctl-command> [args...]" >&2
exit 64
fi
require_arg_count() {
local expected="$1"
shift
if [[ $# -ne "${expected}" ]]; then
echo "unsupported rabbitmqctl arguments" >&2
exit 64
fi
}
case "$1" in
status|list_users)
require_arg_count 1 "$@"
;;
add_vhost|delete_user)
require_arg_count 2 "$@"
;;
add_user|change_password|authenticate_user)
require_arg_count 3 "$@"
;;
set_permissions)
if [[ $# -ne 7 || "${2:-}" != "-p" ]]; then
echo "unsupported rabbitmqctl set_permissions arguments" >&2
exit 64
fi
;;
clear_permissions)
if [[ $# -ne 4 || "${2:-}" != "-p" ]]; then
echo "unsupported rabbitmqctl clear_permissions arguments" >&2
exit 64
fi
;;
list_queues)
if [[ ! ( $# -eq 2 || ( $# -eq 4 && "${2:-}" == "-p" ) ) ]]; then
echo "unsupported rabbitmqctl list_queues arguments" >&2
exit 64
fi
;;
delete_queue)
if [[ ! ( $# -eq 2 || ( $# -eq 4 && "${2:-}" == "-p" ) ) ]]; then
echo "unsupported rabbitmqctl delete_queue arguments" >&2
exit 64
fi
;;
*)
echo "unsupported rabbitmqctl command: $1" >&2
exit 64
;;
esac
export ERLANG_HOME="${ERLANG_HOME:-/usr/local/erlang}"
export RABBITMQ_HOME="${RABBITMQ_HOME:-/usr/local/rabbitmq}"
export PATH="${ERLANG_HOME}/bin:${RABBITMQ_HOME}/sbin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/bin"
if [[ -n "${RABBITMQ_CTL:-}" ]]; then
RABBITMQ_CTL_CANDIDATES=("${RABBITMQ_CTL}")
else
RABBITMQ_CTL_CANDIDATES=(
"${RABBITMQ_HOME}/sbin/rabbitmqctl"
"/usr/local/rabbitmq/sbin/rabbitmqctl"
"/usr/local/rabbitmq-server/sbin/rabbitmqctl"
"/usr/sbin/rabbitmqctl"
"/usr/lib/rabbitmq/bin/rabbitmqctl"
)
fi
RABBITMQ_CTL=""
for candidate in "${RABBITMQ_CTL_CANDIDATES[@]}"; do
if [[ -x "${candidate}" ]]; then
RABBITMQ_CTL="${candidate}"
break
fi
done
if [[ ! -x "${RABBITMQ_CTL}" ]]; then
echo "rabbitmqctl not executable" >&2
exit 69
fi
exec "${RABBITMQ_CTL}" "$@"