No OneTemporary
Actions

Size

46 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/heartbeat/aws-vpc-move-ip b/heartbeat/aws-vpc-move-ip
	index cbb629b00..3ca3d6bd6 100755
	--- a/heartbeat/aws-vpc-move-ip
	+++ b/heartbeat/aws-vpc-move-ip
	@@ -1,467 +1,467 @@
	#!/bin/sh
	#
	#
	# OCF resource agent to move an IP address within a VPC in the AWS
	#
	# Copyright (c) 2017 Markus Guertler (SUSE)
	# Based on code of Adam Gandelman (GitHub ec2-resource-agents/elasticip)
	# All Rights Reserved.
	#
	# This program is free software; you can redistribute it and/or modify
	# it under the terms of version 2 of the GNU General Public License as
	# published by the Free Software Foundation.
	#
	# This program is distributed in the hope that it would be useful, but
	# WITHOUT ANY WARRANTY; without even the implied warranty of
	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
	#
	# Further, this software is distributed without any warranty that it is
	# free of the rightful claim of any third person regarding infringement
	# or the like. Any license provided herein, whether implied or
	# otherwise, applies only to this software file. Patent licenses, if
	# any, provided herein do not apply to combinations of this program with
	# other software, or any other product whatsoever.
	#
	# You should have received a copy of the GNU General Public License
	# along with this program; if not, write the Free Software Foundation,
	# Inc., 59 Temple Place - Suite 330, Boston MA 02111-1307, USA.
	#


	#######################################################################
	# Initialization:

	: ${OCF_FUNCTIONS_DIR=${OCF_ROOT}/lib/heartbeat}
	. ${OCF_FUNCTIONS_DIR}/ocf-shellfuncs

	# Defaults
	OCF_RESKEY_awscli_default="/usr/bin/aws"
	OCF_RESKEY_profile_default="default"
	OCF_RESKEY_region_default=""
	OCF_RESKEY_ip_default=""
	OCF_RESKEY_address_default=""
	OCF_RESKEY_routing_table_default=""
	OCF_RESKEY_routing_table_role_default=""
	OCF_RESKEY_interface_default="eth0"
	OCF_RESKEY_monapi_default="false"
	OCF_RESKEY_lookup_type_default="InstanceId"

	: ${OCF_RESKEY_awscli=${OCF_RESKEY_awscli_default}}
	: ${OCF_RESKEY_profile=${OCF_RESKEY_profile_default}}
	: ${OCF_RESKEY_region=${OCF_RESKEY_region_default}}
	: ${OCF_RESKEY_ip=${OCF_RESKEY_ip_default}}
	: ${OCF_RESKEY_address=${OCF_RESKEY_address_default}}
	: ${OCF_RESKEY_routing_table=${OCF_RESKEY_routing_table_default}}
	: ${OCF_RESKEY_routing_table_role=${OCF_RESKEY_routing_table_role_default}}
	: ${OCF_RESKEY_interface=${OCF_RESKEY_interface_default}}
	: ${OCF_RESKEY_monapi=${OCF_RESKEY_monapi_default}}
	: ${OCF_RESKEY_lookup_type=${OCF_RESKEY_lookup_type_default}}

	[ -n "$OCF_RESKEY_region" ] && region_opt="--region $OCF_RESKEY_region"
	#######################################################################


	USAGE="usage: $0 {start\|stop\|status\|meta-data}";
	###############################################################################


	###############################################################################
	#
	# Functions
	#
	###############################################################################


	metadata() {
	cat <<END
	<?xml version="1.0"?>
	<!DOCTYPE resource-agent SYSTEM "ra-api-1.dtd">
	<resource-agent name="aws-vpc-move-ip">
	<version>2.0</version>
	<longdesc lang="en">
	Resource Agent to move IP addresses within a VPC of the Amazon Webservices EC2
	by changing an entry in an specific routing table
	</longdesc>
	<shortdesc lang="en">Move IP within a VPC of the AWS EC2</shortdesc>

	<parameters>
	<parameter name="awscli">
	<longdesc lang="en">
	Path to command line tools for AWS
	</longdesc>
	<shortdesc lang="en">Path to AWS CLI tools</shortdesc>
	<content type="string" default="${OCF_RESKEY_awscli_default}" />
	</parameter>

	<parameter name="profile">
	<longdesc lang="en">
	Valid AWS CLI profile name (see ~/.aws/config and 'aws configure')
	</longdesc>
	<shortdesc lang="en">profile name</shortdesc>
	<content type="string" default="${OCF_RESKEY_profile_default}" />
	</parameter>

	<parameter name="region">
	<longdesc lang="en">
	Valid AWS region name (e.g., 'us-west-2')
	</longdesc>
	<shortdesc lang="en">region name</shortdesc>
	<content type="string" default="${OCF_RESKEY_region_default}" />
	</parameter>

	<parameter name="ip" required="1">
	<longdesc lang="en">
	VPC private IP address
	</longdesc>
	<shortdesc lang="en">VPC private IP</shortdesc>
	<content type="string" default="${OCF_RESKEY_ip_default}" />
	</parameter>

	<parameter name="address">
	<longdesc lang="en">
	Deprecated IP address param. Use the ip param instead.
	</longdesc>
	<shortdesc lang="en">Deprecated VPC private IP Address</shortdesc>
	<content type="string" default="${OCF_RESKEY_address_default}" />
	</parameter>

	<parameter name="routing_table" required="1">
	<longdesc lang="en">
	Name of the routing table(s), where the route for the IP address should be changed. If declaring multiple routing tables they should be separated by comma. Example: rtb-XXXXXXXX,rtb-YYYYYYYYY
	</longdesc>
	<shortdesc lang="en">routing table name(s)</shortdesc>
	<content type="string" default="${OCF_RESKEY_routing_table_default}" />
	</parameter>

	<parameter name="routing_table_role" required="0">
	<longdesc lang="en">
	Role to use to query/update the route table
	</longdesc>
	<shortdesc lang="en">route table query/update role</shortdesc>
	<content type="string" default="${OCF_RESKEY_routing_table_role_default}" />
	</parameter>

	<parameter name="interface" required="1">
	<longdesc lang="en">
	Name of the network interface, i.e. eth0
	</longdesc>
	<shortdesc lang="en">network interface name</shortdesc>
	<content type="string" default="${OCF_RESKEY_interface_default}" />
	</parameter>

	<parameter name="monapi">
	<longdesc lang="en">
	Enable enhanced monitoring using AWS API calls to check route table entry
	</longdesc>
	<shortdesc lang="en">Enhanced Monitoring</shortdesc>
	<content type="boolean" default="${OCF_RESKEY_monapi_default}" />
	</parameter>

	<parameter name="lookup_type" required="0">
	<longdesc lang="en">
	Name of resource type to lookup in route table.
	"InstanceId" : EC2 instance ID. (default)
	"NetworkInterfaceId" : ENI ID. (useful in shared VPC setups).
	</longdesc>
	<shortdesc lang="en">lookup type for route table resource</shortdesc>
	<content type="string" default="${OCF_RESKEY_lookup_type_default}" />
	</parameter>

	</parameters>

	<actions>
	<action name="start" timeout="180s" />
	<action name="stop" timeout="180s" />
	<action name="monitor" depth="0" timeout="30s" interval="60s" />
	<action name="validate-all" timeout="5s" />
	<action name="meta-data" timeout="5s" />
	</actions>
	</resource-agent>
	END
	}


	execute_cmd_as_role(){
	cmd=$1
	role=$2
	output="$($OCF_RESKEY_awscli sts assume-role --role-arn $role --role-session-name AWSCLI-RouteTableUpdate --profile $OCF_RESKEY_profile $region_opt --output=text)"
	export AWS_ACCESS_KEY_ID="$(echo $output \| awk -F" " '$4=="CREDENTIALS" {print $5}')"
	export AWS_SECRET_ACCESS_KEY="$(echo $output \| awk -F" " '$4=="CREDENTIALS" {print $7}')"
	export AWS_SESSION_TOKEN="$(echo $output \| awk -F" " '$4=="CREDENTIALS" {print $8}')"

	#Execute command
	ocf_log debug "Assumed Role ${role}"
	ocf_log debug "$($OCF_RESKEY_awscli sts get-caller-identity)"
	ocf_log debug "executing command: $cmd"
	response="$($cmd)"
	unset output AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN
	echo $response
	}

	ec2ip_set_address_param_compat(){
	# Include backward compatibility for the deprecated address parameter
	if [ -z "$OCF_RESKEY_ip" ] && [ -n "$OCF_RESKEY_address" ]; then
	OCF_RESKEY_ip="$OCF_RESKEY_address"
	fi
	}

	ec2ip_validate() {
	for cmd in $OCF_RESKEY_awscli ip curl; do
	check_binary "$cmd"
	done

	if [ -z "$OCF_RESKEY_profile" ]; then
	ocf_exit_reason "profile parameter not set"
	return $OCF_ERR_CONFIGURED
	fi

	- TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
	+ TOKEN=$(curl -sX PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
	EC2_INSTANCE_ID=$(curl -s http://169.254.169.254/latest/meta-data/instance-id -H "X-aws-ec2-metadata-token: $TOKEN")

	if [ -z "${EC2_INSTANCE_ID}" ]; then
	ocf_exit_reason "Instance ID not found. Is this a EC2 instance?"
	return $OCF_ERR_GENERIC
	fi

	return $OCF_SUCCESS
	}

	ec2ip_monitor() {
	MON_RES=""
	if [ "${OCF_RESKEY_lookup_type}" = "NetworkInterfaceId" ]; then
	EC2_ID="$(ec2ip_get_instance_eni)"
	RESOURCE_TYPE="interface"
	else
	EC2_ID="$EC2_INSTANCE_ID"
	RESOURCE_TYPE="instance"
	fi

	if ocf_is_true ${OCF_RESKEY_monapi} \|\| [ "$__OCF_ACTION" = "start" ] \|\| ocf_is_probe; then
	for rtb in $(echo $OCF_RESKEY_routing_table \| sed -e 's/,/ /g'); do
	ocf_log info "monitor: check routing table (API call) - $rtb"
	if [ -z "${OCF_RESKEY_routing_table_role}" ]; then
	cmd="$OCF_RESKEY_awscli --profile $OCF_RESKEY_profile $region_opt --output text ec2 describe-route-tables --route-table-ids $rtb --query RouteTables[*].Routes[?DestinationCidrBlock=='$OCF_RESKEY_ip/32'].$OCF_RESKEY_lookup_type"
	ocf_log debug "executing command: $cmd"
	ROUTE_TO_INSTANCE="$($cmd)"
	else
	cmd="$OCF_RESKEY_awscli $region_opt --output text ec2 describe-route-tables --route-table-ids $rtb --query RouteTables[*].Routes[?DestinationCidrBlock=='$OCF_RESKEY_ip/32'].$OCF_RESKEY_lookup_type"
	ROUTE_TO_INSTANCE="$(execute_cmd_as_role "$cmd" $OCF_RESKEY_routing_table_role)"
	fi
	ocf_log debug "Overlay IP is currently routed to ${ROUTE_TO_INSTANCE}"
	if [ -z "$ROUTE_TO_INSTANCE" ]; then
	ROUTE_TO_INSTANCE="<unknown>"
	fi

	if [ "$EC2_ID" != "$ROUTE_TO_INSTANCE" ]; then
	ocf_log warn "not routed to this $RESOURCE_TYPE ($EC2_ID) but to $RESOURCE_TYPE $ROUTE_TO_INSTANCE on $rtb"
	MON_RES="$MON_RES $rtb"
	fi
	sleep 1
	done

	if [ ! -z "$MON_RES" ]; then
	return $OCF_NOT_RUNNING
	fi

	else
	ocf_log debug "monitor: Enhanced Monitoring disabled - omitting API call"
	fi

	cmd="ip addr show to $OCF_RESKEY_ip up"
	ocf_log debug "executing command: $cmd"
	RESULT=$($cmd \| grep "$OCF_RESKEY_ip")
	if [ -z "$RESULT" ]; then
	if [ "$__OCF_ACTION" = "monitor" ] && ! ocf_is_probe; then
	level="error"
	else
	level="info"
	fi

	ocf_log "$level" "IP $OCF_RESKEY_ip not assigned to running interface"
	return $OCF_NOT_RUNNING
	fi

	ocf_log debug "route in VPC and address assigned"
	return $OCF_SUCCESS
	}


	ec2ip_drop() {
	cmd="ip addr delete ${OCF_RESKEY_ip}/32 dev $OCF_RESKEY_interface"
	ocf_log debug "executing command: $cmd"
	output=$($cmd 2>&1)
	rc=$?

	if [ "$rc" -gt 0 ]; then
	if [ "$__OCF_ACTION" = "start" ]; then
	# expected to fail during start
	level="debug"
	else
	level="warn"
	fi

	ocf_log "$level" "command failed, rc $rc"
	ocf_log "$level" "output/error: $output"
	return $OCF_ERR_GENERIC
	else
	ocf_log debug "output/error: $output"
	fi

	# delete remaining route-entries if any
	ip route show to exact ${OCF_RESKEY_ip}/32 dev $OCF_RESKEY_interface \| xargs -r ip route delete
	ip route show table local to exact ${OCF_RESKEY_ip}/32 dev $OCF_RESKEY_interface \| xargs -r ip route delete

	return $OCF_SUCCESS
	}

	ec2ip_get_instance_eni() {
	MAC_FILE="/sys/class/net/${OCF_RESKEY_interface}/address"
	if [ -f $MAC_FILE ]; then
	cmd="cat ${MAC_FILE}"
	else
	cmd="ip -br link show dev ${OCF_RESKEY_interface} \| tr -s ' ' \| cut -d' ' -f3"
	fi
	ocf_log debug "executing command: $cmd"
	MAC_ADDR="$(eval $cmd)"
	rc=$?
	if [ $rc != 0 ]; then
	ocf_log warn "command failed, rc: $rc"
	return $OCF_ERR_GENERIC
	fi
	ocf_log debug "MAC address associated with interface ${OCF_RESKEY_interface}: ${MAC_ADDR}"

	cmd="curl -s http://169.254.169.254/latest/meta-data/network/interfaces/macs/${MAC_ADDR}/interface-id -H \"X-aws-ec2-metadata-token: $TOKEN\""
	ocf_log debug "executing command: $cmd"
	EC2_NETWORK_INTERFACE_ID="$(eval $cmd)"
	rc=$?
	if [ $rc != 0 ]; then
	ocf_log warn "command failed, rc: $rc"
	return $OCF_ERR_GENERIC
	fi
	ocf_log debug "network interface id associated MAC address ${MAC_ADDR}: ${EC2_NETWORK_INTERFACE_ID}"
	echo $EC2_NETWORK_INTERFACE_ID
	}

	ec2ip_get_and_configure() {
	EC2_NETWORK_INTERFACE_ID="$(ec2ip_get_instance_eni)"
	for rtb in $(echo $OCF_RESKEY_routing_table \| sed -e 's/,/ /g'); do
	if [ -z "${OCF_RESKEY_routing_table_role}" ]; then
	cmd="$OCF_RESKEY_awscli --profile $OCF_RESKEY_profile $region_opt --output text ec2 replace-route --route-table-id $rtb --destination-cidr-block ${OCF_RESKEY_ip}/32 --network-interface-id $EC2_NETWORK_INTERFACE_ID"
	ocf_log debug "executing command: $cmd"
	$cmd
	else
	cmd="$OCF_RESKEY_awscli $region_opt --output text ec2 replace-route --route-table-id $rtb --destination-cidr-block ${OCF_RESKEY_ip}/32 --network-interface-id $EC2_NETWORK_INTERFACE_ID"
	update_response="$(execute_cmd_as_role "$cmd" $OCF_RESKEY_routing_table_role)"
	fi
	rc=$?
	if [ "$rc" != 0 ]; then
	ocf_log warn "command failed, rc: $rc"
	return $OCF_ERR_GENERIC
	fi
	sleep 1
	done

	# Reconfigure the local ip address
	ec2ip_drop
	cmd="ip addr add ${OCF_RESKEY_ip}/32 dev $OCF_RESKEY_interface"
	ocf_log debug "executing command: $cmd"
	$cmd
	rc=$?
	if [ $rc != 0 ]; then
	ocf_log warn "command failed, rc: $rc"
	return $OCF_ERR_GENERIC
	fi

	return $OCF_SUCCESS
	}

	ec2ip_stop() {
	ocf_log info "EC2: Bringing down IP address $OCF_RESKEY_ip"

	ec2ip_monitor
	if [ $? = $OCF_NOT_RUNNING ]; then
	ocf_log info "EC2: Address $OCF_RESKEY_ip already down"
	return $OCF_SUCCESS
	fi

	ec2ip_drop
	if [ $? != $OCF_SUCCESS ]; then
	return $OCF_ERR_GENERIC
	fi

	ec2ip_monitor
	if [ $? != $OCF_NOT_RUNNING ]; then
	ocf_log error "EC2: Couldn't bring down IP address $OCF_RESKEY_ip on interface $OCF_RESKEY_interface."
	return $OCF_ERR_GENERIC
	fi

	ocf_log info "EC2: Successfully brought down $OCF_RESKEY_ip"
	return $OCF_SUCCESS
	}

	ec2ip_start() {
	ocf_log info "EC2: Moving IP address $OCF_RESKEY_ip to this host by adjusting routing table $OCF_RESKEY_routing_table"

	ec2ip_monitor
	if [ $? = $OCF_SUCCESS ]; then
	ocf_log info "EC2: $OCF_RESKEY_ip already started"
	return $OCF_SUCCESS
	fi

	ocf_log info "EC2: Adjusting routing table and locally configuring IP address"
	ec2ip_get_and_configure
	rc=$?
	if [ $rc != $OCF_SUCCESS ]; then
	ocf_log error "Received $rc from 'aws'"
	return $OCF_ERR_GENERIC
	fi

	ec2ip_monitor
	if [ $? != $OCF_SUCCESS ]; then
	ocf_log error "EC2: IP address couldn't be configured on this host (IP: $OCF_RESKEY_ip, Interface: $OCF_RESKEY_interface)"
	return $OCF_ERR_GENERIC
	fi

	return $OCF_SUCCESS
	}

	###############################################################################
	#
	# MAIN
	#
	###############################################################################

	case $__OCF_ACTION in
	meta-data)
	metadata
	exit $OCF_SUCCESS
	;;
	usage\|help)
	echo $USAGE
	exit $OCF_SUCCESS
	;;
	esac

	if ! ocf_is_root; then
	ocf_log err "You must be root for $__OCF_ACTION operation."
	exit $OCF_ERR_PERM
	fi

	ec2ip_set_address_param_compat

	ec2ip_validate

	case $__OCF_ACTION in
	start)
	ec2ip_start;;
	stop)
	ec2ip_stop;;
	monitor)
	ec2ip_monitor;;
	validate-all)
	exit $?;;
	*)
	echo $USAGE
	exit $OCF_ERR_UNIMPLEMENTED
	;;
	esac
	diff --git a/heartbeat/aws-vpc-route53.in b/heartbeat/aws-vpc-route53.in
	index 4fb17019b..21948eaca 100644
	--- a/heartbeat/aws-vpc-route53.in
	+++ b/heartbeat/aws-vpc-route53.in
	@@ -1,449 +1,449 @@
	#!@BASH_SHELL@
	#
	# Copyright 2017 Amazon.com, Inc. and its affiliates. All Rights Reserved.
	# Licensed under the MIT License.
	#
	# Copyright 2017 Amazon.com, Inc. and its affiliates

	# Permission is hereby granted, free of charge, to any person obtaining a copy of
	# this software and associated documentation files (the "Software"), to deal in
	# the Software without restriction, including without limitation the rights to
	# use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
	# of the Software, and to permit persons to whom the Software is furnished to do
	# so, subject to the following conditions:

	# The above copyright notice and this permission notice shall be included in
	# all copies or substantial portions of the Software.

	# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
	# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
	# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
	# THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
	# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
	# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
	# OTHER DEALINGS IN THE SOFTWARE.

	#
	#
	#
	# OCF resource agent to move an IP address within a VPC in the AWS
	# Written by Stefan Schneider , Martin Tegmeier (AWS)
	# Based on code of Markus Guertler#
	#
	#
	# OCF resource agent to move an IP address within a VPC in the AWS
	# Written by Stefan Schneider (AWS) , Martin Tegmeier (AWS)
	# Based on code of Markus Guertler (SUSE)
	#
	# Mar. 15, 2017, vers 1.0.2


	#######################################################################
	# Initialization:

	: ${OCF_FUNCTIONS_DIR=${OCF_ROOT}/lib/heartbeat}
	. ${OCF_FUNCTIONS_DIR}/ocf-shellfuncs

	# Defaults
	OCF_RESKEY_awscli_default="/usr/bin/aws"
	OCF_RESKEY_profile_default="default"
	OCF_RESKEY_hostedzoneid_default=""
	OCF_RESKEY_fullname_default=""
	OCF_RESKEY_ip_default="local"
	OCF_RESKEY_ttl_default=10

	: ${OCF_RESKEY_awscli=${OCF_RESKEY_awscli_default}}
	: ${OCF_RESKEY_profile=${OCF_RESKEY_profile_default}}
	: ${OCF_RESKEY_hostedzoneid:=${OCF_RESKEY_hostedzoneid_default}}
	: ${OCF_RESKEY_fullname:=${OCF_RESKEY_fullname_default}}
	: ${OCF_RESKEY_ip:=${OCF_RESKEY_ip_default}}
	: ${OCF_RESKEY_ttl:=${OCF_RESKEY_ttl_default}}
	#######################################################################


	AWS_PROFILE_OPT="--profile $OCF_RESKEY_profile --cli-connect-timeout 10"
	#######################################################################


	usage() {
	cat <<-EOT
	usage: $0 {start\|stop\|status\|monitor\|validate-all\|meta-data}
	EOT
	}

	metadata() {
	cat <<END
	<?xml version="1.0"?>
	<!DOCTYPE resource-agent SYSTEM "ra-api-1.dtd">
	<resource-agent name="aws-vpc-route53">
	<version>1.0</version>
	<longdesc lang="en">
	Update Route53 record of Amazon Webservices EC2 by updating an entry in a
	hosted zone ID table.

	AWS instances will require policies which allow them to update Route53 ARecords:
	{
	"Version": "2012-10-17",
	"Statement": [
	{
	"Sid": "Stmt1471878724000",
	"Effect": "Allow",
	"Action": [
	"route53:ChangeResourceRecordSets",
	"route53:GetChange",
	"route53:ListResourceRecordSets",
	],
	"Resource": [
	"*"
	]
	}
	]
	}

	Example Cluster Configuration:

	Use a configuration in "crm configure edit" which looks as follows. Replace
	hostedzoneid, fullname and profile with the appropriate values:

	primitive res_route53 ocf:heartbeat:aws-vpc-route53 \
	params hostedzoneid=EX4MPL3EX4MPL3 fullname=service.cloud.example.corp. profile=cluster \
	op start interval=0 timeout=180 \
	op stop interval=0 timeout=180 \
	op monitor interval=300 timeout=180 \
	meta target-role=Started
	</longdesc>
	<shortdesc lang="en">Update Route53 VPC record for AWS EC2</shortdesc>

	<parameters>
	<parameter name="awscli">
	<longdesc lang="en">
	Path to command line tools for AWS
	</longdesc>
	<shortdesc lang="en">Path to AWS CLI tools</shortdesc>
	<content type="string" default="${OCF_RESKEY_awscli_default}" />
	</parameter>

	<parameter name="profile">
	<longdesc lang="en">
	The name of the AWS CLI profile of the root account. This
	profile will have to use the "text" format for CLI output.
	The file /root/.aws/config should have an entry which looks
	like:

	[profile cluster]
	region = us-east-1
	output = text

	"cluster" is the name which has to be used in the cluster
	configuration. The region has to be the current one. The
	output has to be "text".
	</longdesc>
	<shortdesc lang="en">AWS Profile Name</shortdesc>
	<content type="string" default="${OCF_RESKEY_profile_default}" />
	</parameter>

	<parameter name="hostedzoneid" required="1">
	<longdesc lang="en">
	Hosted zone ID of Route 53. This is the table of
	the Route 53 record.
	</longdesc>
	<shortdesc lang="en">AWS hosted zone ID</shortdesc>
	<content type="string" default="${OCF_RESKEY_hostedzoneid_default}" />
	</parameter>

	<parameter name="fullname" required="1">
	<longdesc lang="en">
	The full name of the service which will host the IP address.
	Example: service.cloud.example.corp.
	Note: The trailing dot is important to Route53!
	</longdesc>
	<shortdesc lang="en">Full service name</shortdesc>
	<content type="string" default="${OCF_RESKEY_fullname_default}" />
	</parameter>

	<parameter name="ip" required="0">
	<longdesc lang="en">
	IP (local (default), public or secondary private IP address (e.g. 10.0.0.1).

	A secondary private IP can be setup with the awsvip agent.
	</longdesc>
	<shortdesc lang="en">Type of IP or secondary private IP address (local, public or e.g. 10.0.0.1)</shortdesc>
	<content type="string" default="${OCF_RESKEY_ip_default}" />
	</parameter>

	<parameter name="ttl" required="0">
	<longdesc lang="en">
	Time to live for Route53 ARECORD
	</longdesc>
	<shortdesc lang="en">ARECORD TTL</shortdesc>
	<content type="string" default="${OCF_RESKEY_ttl_default}" />
	</parameter>
	</parameters>

	<actions>
	<action name="start" timeout="180s" />
	<action name="stop" timeout="180s" />
	<action name="monitor" depth="0" timeout="180s" interval="300s" />
	<action name="validate-all" timeout="5s" />
	<action name="meta-data" timeout="5s" />
	</actions>
	</resource-agent>
	END
	}

	r53_validate() {
	ocf_log debug "function: validate"

	# Check for required binaries
	ocf_log debug "Checking for required binaries"
	for command in curl dig; do
	check_binary "$command"
	done

	# Full name
	[[ -z "$OCF_RESKEY_fullname" ]] && ocf_log error "Full name parameter not set $OCF_RESKEY_fullname!" && exit $OCF_ERR_CONFIGURED

	# Hosted Zone ID
	[[ -z "$OCF_RESKEY_hostedzoneid" ]] && ocf_log error "Hosted Zone ID parameter not set $OCF_RESKEY_hostedzoneid!" && exit $OCF_ERR_CONFIGURED

	# Type of IP/secondary IP address
	case $OCF_RESKEY_ip in
	local\|public\|...)
	;;
	*)
	ocf_exit_reason "Invalid value for ip: ${OCF_RESKEY_ip}"
	exit $OCF_ERR_CONFIGURED
	esac

	# profile
	[[ -z "$OCF_RESKEY_profile" ]] && ocf_log error "AWS CLI profile not set $OCF_RESKEY_profile!" && exit $OCF_ERR_CONFIGURED

	# TTL
	[[ -z "$OCF_RESKEY_ttl" ]] && ocf_log error "TTL not set $OCF_RESKEY_ttl!" && exit $OCF_ERR_CONFIGURED

	ocf_log debug "Testing aws command"
	$OCF_RESKEY_awscli --version 2>&1
	if [ "$?" -gt 0 ]; then
	ocf_log error "Error while executing aws command as user root! Please check if AWS CLI tools (Python flavor) are properly installed and configured." && exit $OCF_ERR_INSTALLED
	fi
	ocf_log debug "ok"

	return $OCF_SUCCESS
	}

	r53_start() {
	#
	# Start agent and config DNS in Route53
	#
	ocf_log info "Starting Route53 DNS update...."
	_get_ip
	r53_monitor
	if [ $? != $OCF_SUCCESS ]; then
	ocf_log info "Could not start agent - check configurations"
	return $OCF_ERR_GENERIC
	fi
	return $OCF_SUCCESS
	}

	r53_stop() {
	#
	# Stop operation doesn't perform any API call or try to remove the DNS record
	# this mostly because this is not necessarily mandatory or desired
	# the start and monitor functions will take care of changing the DNS record
	# if the agent starts in a different cluster node
	#
	ocf_log info "Bringing down Route53 agent. (Will NOT remove Route53 DNS record)"
	return $OCF_SUCCESS
	}

	r53_monitor() {
	#
	# For every start action the agent will call Route53 API to check for DNS record
	# otherwise it will try to get results directly bu querying the DNS using "dig".
	# Due to complexity in some DNS architectures "dig" can fail, and if this happens
	# the monitor will fallback to the Route53 API call.
	#
	# There will be no failure, failover or restart of the agent if the monitor operation fails
	# hence we only return $OCF_SUCESS in this function
	#
	# In case of the monitor operation detects a wrong or non-existent Route53 DNS entry
	# it will try to fix the existing one, or create it again
	#
	#
	ARECORD=""
	IPREGEX="^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$"
	r53_validate
	ocf_log debug "Checking Route53 record sets"
	#
	_get_ip
	#
	if [ "$__OCF_ACTION" = "start" ] \|\| ocf_is_probe ; then
	#
	cmd="$OCF_RESKEY_awscli $AWS_PROFILE_OPT route53 list-resource-record-sets --hosted-zone-id $OCF_RESKEY_hostedzoneid --query ResourceRecordSets[?Name=='$OCF_RESKEY_fullname']"
	ocf_log info "Route53 Agent Starting or probing - executing monitoring API call: $cmd"
	CLIRES="$($cmd 2>&1)"
	rc=$?
	ocf_log debug "awscli returned code: $rc"
	if [ $rc -ne 0 ]; then
	CLIRES=$(echo $CLIRES \| grep -v '^$')
	ocf_log warn "Route53 API returned an error: $CLIRES"
	ocf_log warn "Skipping cluster action due to API call error"
	return $OCF_ERR_GENERIC
	fi
	ARECORD=$(echo $CLIRES \| grep RESOURCERECORDS \| awk '{ print $5 }')
	#
	if ocf_is_probe; then
	#
	# Prevent R53 record change during probe
	#
	if [[ $ARECORD =~ $IPREGEX ]] && [ "$ARECORD" != "$IPADDRESS" ]; then
	ocf_log debug "Route53 DNS record $ARECORD found at probing, disregarding"
	return $OCF_NOT_RUNNING
	fi
	fi
	else
	#
	cmd="dig +retries=3 +time=5 +short $OCF_RESKEY_fullname 2>/dev/null"
	ocf_log info "executing monitoring command : $cmd"
	ARECORD="$($cmd)"
	rc=$?
	ocf_log debug "dig return code: $rc"
	#
	if [[ ! $ARECORD =~ $IPREGEX ]] \|\| [ $rc -ne 0 ]; then
	ocf_log info "Fallback to Route53 API query due to DNS resolution failure"
	cmd="$OCF_RESKEY_awscli $AWS_PROFILE_OPT route53 list-resource-record-sets --hosted-zone-id $OCF_RESKEY_hostedzoneid --query ResourceRecordSets[?Name=='$OCF_RESKEY_fullname']"
	ocf_log debug "executing monitoring API call: $cmd"
	CLIRES="$($cmd 2>&1)"
	rc=$?
	ocf_log debug "awscli return code: $rc"
	if [ $rc -ne 0 ]; then
	CLIRES=$(echo $CLIRES \| grep -v '^$')
	ocf_log warn "Route53 API returned an error: $CLIRES"
	ocf_log warn "Monitor skipping cluster action due to API call error"
	return $OCF_SUCCESS
	fi
	ARECORD=$(echo $CLIRES \| grep RESOURCERECORDS \| awk '{ print $5 }')
	fi
	#
	fi
	ocf_log info "Route53 DNS record pointing $OCF_RESKEY_fullname to IP address $ARECORD"
	#
	if [ "$ARECORD" == "$IPADDRESS" ]; then
	ocf_log info "Route53 DNS record $ARECORD found"
	return $OCF_SUCCESS
	elif [[ $ARECORD =~ $IPREGEX ]] && [ "$ARECORD" != "$IPADDRESS" ]; then
	ocf_log info "Route53 DNS record points to a different host, setting DNS record on Route53 to this host"
	_update_record "UPSERT" "$IPADDRESS"
	return $OCF_SUCCESS
	else
	ocf_log info "No Route53 DNS record found, setting DNS record on Route53 to this host"
	_update_record "UPSERT" "$IPADDRESS"
	return $OCF_SUCCESS
	fi

	return $OCF_SUCCESS
	}

	_get_ip() {
	case $OCF_RESKEY_ip in
	local\|public)
	- TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
	+ TOKEN=$(curl -sX PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
	IPADDRESS=$(curl -s http://169.254.169.254/latest/meta-data/${OCF_RESKEY_ip}-ipv4 -H "X-aws-ec2-metadata-token: $TOKEN");;
	...)
	IPADDRESS="${OCF_RESKEY_ip}";;
	esac
	}

	_update_record() {
	#
	# This function is the one that will actually execute Route53's API call
	# and configure the DNS record using the correct API calls and parameters
	#
	# It creates a temporary JSON file under /tmp with the required API payload
	#
	# Failures in this function are critical and will cause the agent to fail
	#
	update_action="$1"
	IPADDRESS="$2"
	ocf_log info "Updating Route53 $OCF_RESKEY_hostedzoneid with $IPADDRESS for $OCF_RESKEY_fullname"
	ROUTE53RECORD="$(maketempfile)"
	if [ $? -ne 0 ] \|\| [ -z "$ROUTE53RECORD" ]; then
	ocf_exit_reason "Failed to create temporary file for record update"
	exit $OCF_ERR_GENERIC
	fi
	cat >>"$ROUTE53RECORD" <<-EOF
	{
	"Comment": "Update record to reflect new IP address for a system ",
	"Changes": [
	{
	"Action": "$update_action",
	"ResourceRecordSet": {
	"Name": "$OCF_RESKEY_fullname",
	"Type": "A",
	"TTL": $OCF_RESKEY_ttl,
	"ResourceRecords": [
	{
	"Value": "$IPADDRESS"
	}
	]
	}
	}
	]
	}
	EOF
	cmd="$OCF_RESKEY_awscli $AWS_PROFILE_OPT route53 change-resource-record-sets --hosted-zone-id $OCF_RESKEY_hostedzoneid --change-batch file://$ROUTE53RECORD "
	ocf_log debug "Executing command: $cmd"
	CLIRES="$($cmd 2>&1)"
	rc=$?
	ocf_log debug "awscli returned code: $rc"
	if [ $rc -ne 0 ]; then
	CLIRES=$(echo $CLIRES \| grep -v '^$')
	ocf_log warn "Route53 API returned an error: $CLIRES"
	ocf_log warn "Skipping cluster action due to API call error"
	return $OCF_ERR_GENERIC
	fi
	CHANGEID=$(echo $CLIRES \| awk '{ print $12 }')
	ocf_log debug "Change id: $CHANGEID"
	rmtempfile $ROUTE53RECORD
	CHANGEID=$(echo $CHANGEID \| cut -d'/' -f 3 \| cut -d'"' -f 1 )
	ocf_log debug "Change id: $CHANGEID"
	STATUS="PENDING"
	MYSECONDS=20
	while [ "$STATUS" = 'PENDING' ]; do
	sleep $MYSECONDS
	STATUS="$($OCF_RESKEY_awscli $AWS_PROFILE_OPT route53 get-change --id $CHANGEID \| grep CHANGEINFO \| awk -F'\t' '{ print $4 }' \|cut -d'"' -f 2 )"
	ocf_log debug "Waited for $MYSECONDS seconds and checked execution of Route 53 update status: $STATUS "
	done
	}

	###############################################################################

	case $__OCF_ACTION in
	usage\|help)
	usage
	exit $OCF_SUCCESS
	;;
	meta-data)
	metadata
	exit $OCF_SUCCESS
	;;
	start)
	r53_validate \|\| exit $?
	r53_start
	;;
	stop)
	r53_stop
	;;
	monitor)
	r53_monitor
	;;
	validate-all)
	r53_validate
	;;
	*)
	usage
	exit $OCF_ERR_UNIMPLEMENTED
	;;
	esac

	exit $?
	diff --git a/heartbeat/awseip b/heartbeat/awseip
	index de1967774..12ffffaa3 100755
	--- a/heartbeat/awseip
	+++ b/heartbeat/awseip
	@@ -1,287 +1,287 @@
	#!/bin/sh
	#
	#
	# Manage Elastic IP with Pacemaker
	#
	#
	# Copyright 2016-2018 guessi <guessi@gmail.com>
	#
	# Licensed under the Apache License, Version 2.0 (the "License");
	# you may not use this file except in compliance with the License.
	# You may obtain a copy of the License at
	#
	# http://www.apache.org/licenses/LICENSE-2.0
	#
	# Unless required by applicable law or agreed to in writing, software
	# distributed under the License is distributed on an "AS IS" BASIS,
	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	# See the License for the specific language governing permissions and
	# limitations under the License.
	#
	#

	#
	# Prerequisites:
	#
	# - preconfigured AWS CLI running environment (AccessKey, SecretAccessKey, etc.)
	# - a reserved secondary private IP address for EC2 instances high availability
	# - IAM user role with the following permissions:
	# * DescribeInstances
	# * AssociateAddress
	# * DescribeAddresses
	# * DisassociateAddress
	#

	#######################################################################
	# Initialization:

	: ${OCF_FUNCTIONS_DIR=${OCF_ROOT}/lib/heartbeat}
	. ${OCF_FUNCTIONS_DIR}/ocf-shellfuncs

	#######################################################################

	#
	# Defaults
	#
	OCF_RESKEY_awscli_default="/usr/bin/aws"
	OCF_RESKEY_profile_default="default"
	OCF_RESKEY_api_delay_default="3"

	: ${OCF_RESKEY_awscli=${OCF_RESKEY_awscli_default}}
	: ${OCF_RESKEY_profile=${OCF_RESKEY_profile_default}}
	: ${OCF_RESKEY_api_delay=${OCF_RESKEY_api_delay_default}}

	meta_data() {
	cat <<END
	<?xml version="1.0"?>
	<!DOCTYPE resource-agent SYSTEM "ra-api-1.dtd">
	<resource-agent name="awseip">
	<version>1.0</version>

	<longdesc lang="en">
	Resource Agent for Amazon AWS Elastic IP Addresses.

	It manages AWS Elastic IP Addresses with awscli.

	Credentials needs to be setup by running "aws configure".

	See https://aws.amazon.com/cli/ for more information about awscli.
	</longdesc>
	<shortdesc lang="en">Amazon AWS Elastic IP Address Resource Agent</shortdesc>

	<parameters>

	<parameter name="awscli" unique="0">
	<longdesc lang="en">
	command line tools for aws services
	</longdesc>
	<shortdesc lang="en">aws cli tools</shortdesc>
	<content type="string" default="${OCF_RESKEY_awscli_default}" />
	</parameter>

	<parameter name="profile">
	<longdesc lang="en">
	Valid AWS CLI profile name (see ~/.aws/config and 'aws configure')
	</longdesc>
	<shortdesc lang="en">profile name</shortdesc>
	<content type="string" default="${OCF_RESKEY_profile_default}" />
	</parameter>

	<parameter name="elastic_ip" unique="1" required="1">
	<longdesc lang="en">
	reserved elastic ip for ec2 instance
	</longdesc>
	<shortdesc lang="en">reserved elastic ip for ec2 instance</shortdesc>
	<content type="string" default="" />
	</parameter>

	<parameter name="allocation_id" unique="1" required="1">
	<longdesc lang="en">
	reserved allocation id for ec2 instance
	</longdesc>
	<shortdesc lang="en">reserved allocation id for ec2 instance</shortdesc>
	<content type="string" default="" />
	</parameter>

	<parameter name="private_ip_address" unique="1" required="0">
	<longdesc lang="en">
	predefined private ip address for ec2 instance
	</longdesc>
	<shortdesc lang="en">predefined private ip address for ec2 instance</shortdesc>
	<content type="string" default="" />
	</parameter>

	<parameter name="api_delay" unique="0">
	<longdesc lang="en">
	a short delay between API calls, to avoid sending API too quick
	</longdesc>
	<shortdesc lang="en">a short delay between API calls</shortdesc>
	<content type="integer" default="${OCF_RESKEY_api_delay_default}" />
	</parameter>

	</parameters>

	<actions>
	<action name="start" timeout="30s" />
	<action name="stop" timeout="30s" />
	<action name="monitor" timeout="30s" interval="20s" depth="0" />
	<action name="migrate_to" timeout="30s" />
	<action name="migrate_from" timeout="30s" />
	<action name="meta-data" timeout="5s" />
	<action name="validate" timeout="10s" />
	<action name="validate-all" timeout="10s" />
	</actions>
	</resource-agent>
	END
	}

	#######################################################################

	awseip_usage() {
	cat <<END
	usage: $0 {start\|stop\|monitor\|migrate_to\|migrate_from\|validate\|validate-all\|meta-data}

	Expects to have a fully populated OCF RA-compliant environment set.
	END
	}

	awseip_start() {
	awseip_monitor && return $OCF_SUCCESS

	if [ -n "${PRIVATE_IP_ADDRESS}" ]; then
	NETWORK_INTERFACES_MACS=$(curl -s http://169.254.169.254/latest/meta-data/network/interfaces/macs/ -H "X-aws-ec2-metadata-token: $TOKEN")
	for MAC in ${NETWORK_INTERFACES_MACS}; do
	curl -s http://169.254.169.254/latest/meta-data/network/interfaces/macs/${MAC}/local-ipv4s -H "X-aws-ec2-metadata-token: $TOKEN" \|
	grep -q "^${PRIVATE_IP_ADDRESS}$"
	if [ $? -eq 0 ]; then
	NETWORK_ID=$(curl -s http://169.254.169.254/latest/meta-data/network/interfaces/macs/${MAC}/interface-id -H "X-aws-ec2-metadata-token: $TOKEN")
	fi
	done
	$AWSCLI --profile $OCF_RESKEY_profile ec2 associate-address \
	--network-interface-id ${NETWORK_ID} \
	--allocation-id ${ALLOCATION_ID} \
	--private-ip-address ${PRIVATE_IP_ADDRESS}
	RET=$?
	else
	$AWSCLI --profile $OCF_RESKEY_profile ec2 associate-address \
	--instance-id ${INSTANCE_ID} \
	--allocation-id ${ALLOCATION_ID}
	RET=$?
	fi

	# delay to avoid sending request too fast
	sleep ${OCF_RESKEY_api_delay}

	if [ $RET -ne 0 ]; then
	return $OCF_NOT_RUNNING
	fi

	ocf_log info "elastic_ip has been successfully brought up (${ELASTIC_IP})"
	return $OCF_SUCCESS
	}

	awseip_stop() {
	awseip_monitor \|\| return $OCF_SUCCESS

	ASSOCIATION_ID=$($AWSCLI --profile $OCF_RESKEY_profile --output json ec2 describe-addresses \
	--allocation-id ${ALLOCATION_ID} \| grep -m 1 "AssociationId" \| awk -F'"' '{print$4}')

	if [ -z "${ASSOCIATION_ID}" ]; then
	ocf_log info "ASSOCIATION_ID not found while stopping AWS Elastic IP"
	return $OCF_NOT_RUNNING
	fi

	$AWSCLI --profile ${OCF_RESKEY_profile} \
	ec2 disassociate-address \
	--association-id ${ASSOCIATION_ID}
	RET=$?

	# delay to avoid sending request too fast
	sleep ${OCF_RESKEY_api_delay}

	if [ $RET -ne 0 ]; then
	return $OCF_NOT_RUNNING
	fi

	ocf_log info "elastic_ip has been successfully brought down (${ELASTIC_IP})"
	return $OCF_SUCCESS
	}

	awseip_monitor() {
	$AWSCLI --profile $OCF_RESKEY_profile ec2 describe-instances --instance-id "${INSTANCE_ID}" \| grep -q "${ELASTIC_IP}"
	RET=$?

	if [ $RET -ne 0 ]; then
	return $OCF_NOT_RUNNING
	fi
	return $OCF_SUCCESS
	}

	awseip_validate() {
	check_binary ${AWSCLI}

	if [ -z "$OCF_RESKEY_profile" ]; then
	ocf_exit_reason "profile parameter not set"
	return $OCF_ERR_CONFIGURED
	fi

	if [ -z "${INSTANCE_ID}" ]; then
	ocf_exit_reason "instance_id not found. Is this a EC2 instance?"
	return $OCF_ERR_GENERIC
	fi

	return $OCF_SUCCESS
	}

	case $__OCF_ACTION in
	meta-data)
	meta_data
	exit $OCF_SUCCESS
	;;
	esac

	AWSCLI="${OCF_RESKEY_awscli}"
	ELASTIC_IP="${OCF_RESKEY_elastic_ip}"
	ALLOCATION_ID="${OCF_RESKEY_allocation_id}"
	PRIVATE_IP_ADDRESS="${OCF_RESKEY_private_ip_address}"
	-TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
	+TOKEN=$(curl -sX PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
	INSTANCE_ID=$(curl -s http://169.254.169.254/latest/meta-data/instance-id -H "X-aws-ec2-metadata-token: $TOKEN")

	case $__OCF_ACTION in
	start)
	awseip_validate
	awseip_start
	;;
	stop)
	awseip_stop
	;;
	monitor)
	awseip_monitor
	;;
	migrate_to)
	ocf_log info "Migrating ${OCF_RESOURCE_INSTANCE} to ${OCF_RESKEY_CRM_meta_migrate_target}."
	awseip_stop
	;;
	migrate_from)
	ocf_log info "Migrating ${OCF_RESOURCE_INSTANCE} from ${OCF_RESKEY_CRM_meta_migrate_source}."
	awseip_start
	;;
	reload)
	ocf_log info "Reloading ${OCF_RESOURCE_INSTANCE} ..."
	;;
	validate\|validate-all)
	awseip_validate
	;;
	usage\|help)
	awseip_usage
	exit $OCF_SUCCESS
	;;
	*)
	awseip_usage
	exit $OCF_ERR_UNIMPLEMENTED
	;;
	esac

	rc=$?
	ocf_log debug "${OCF_RESOURCE_INSTANCE} $__OCF_ACTION : $rc"
	exit $rc
	diff --git a/heartbeat/awsvip b/heartbeat/awsvip
	index 8050107e8..7d0bf35b6 100755
	--- a/heartbeat/awsvip
	+++ b/heartbeat/awsvip
	@@ -1,251 +1,251 @@
	#!/bin/sh
	#
	#
	# Manage Secondary Private IP with Pacemaker
	#
	#
	# Copyright 2016-2018 guessi <guessi@gmail.com>
	#
	# Licensed under the Apache License, Version 2.0 (the "License");
	# you may not use this file except in compliance with the License.
	# You may obtain a copy of the License at
	#
	# http://www.apache.org/licenses/LICENSE-2.0
	#
	# Unless required by applicable law or agreed to in writing, software
	# distributed under the License is distributed on an "AS IS" BASIS,
	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	# See the License for the specific language governing permissions and
	# limitations under the License.
	#
	#

	#
	# Prerequisites:
	#
	# - preconfigured AWS CLI running environment (AccessKey, SecretAccessKey, etc.)
	# - a reserved secondary private IP address for EC2 instances high availablity
	# - IAM user role with the following permissions:
	# * DescribeInstances
	# * AssignPrivateIpAddresses
	# * UnassignPrivateIpAddresses
	#

	#######################################################################
	# Initialization:

	: ${OCF_FUNCTIONS_DIR=${OCF_ROOT}/lib/heartbeat}
	. ${OCF_FUNCTIONS_DIR}/ocf-shellfuncs

	#######################################################################

	#
	# Defaults
	#
	OCF_RESKEY_awscli_default="/usr/bin/aws"
	OCF_RESKEY_profile_default="default"
	OCF_RESKEY_api_delay_default="3"

	: ${OCF_RESKEY_awscli=${OCF_RESKEY_awscli_default}}
	: ${OCF_RESKEY_profile=${OCF_RESKEY_profile_default}}
	: ${OCF_RESKEY_api_delay=${OCF_RESKEY_api_delay_default}}

	meta_data() {
	cat <<END
	<?xml version="1.0"?>
	<!DOCTYPE resource-agent SYSTEM "ra-api-1.dtd">
	<resource-agent name="awsvip">
	<version>1.0</version>

	<longdesc lang="en">
	Resource Agent for Amazon AWS Secondary Private IP Addresses.

	It manages AWS Secondary Private IP Addresses with awscli.

	Credentials needs to be setup by running "aws configure".

	See https://aws.amazon.com/cli/ for more information about awscli.
	</longdesc>
	<shortdesc lang="en">Amazon AWS Secondary Private IP Address Resource Agent</shortdesc>

	<parameters>

	<parameter name="awscli" unique="0">
	<longdesc lang="en">
	command line tools for aws services
	</longdesc>
	<shortdesc lang="en">aws cli tools</shortdesc>
	<content type="string" default="${OCF_RESKEY_awscli_default}" />
	</parameter>

	<parameter name="profile">
	<longdesc lang="en">
	Valid AWS CLI profile name (see ~/.aws/config and 'aws configure')
	</longdesc>
	<shortdesc lang="en">profile name</shortdesc>
	<content type="string" default="${OCF_RESKEY_profile_default}" />
	</parameter>

	<parameter name="secondary_private_ip" unique="1" required="1">
	<longdesc lang="en">
	reserved secondary private ip for ec2 instance
	</longdesc>
	<shortdesc lang="en">reserved secondary private ip for ec2 instance</shortdesc>
	<content type="string" default="" />
	</parameter>

	<parameter name="api_delay" unique="0">
	<longdesc lang="en">
	a short delay between API calls, to avoid sending API too quick
	</longdesc>
	<shortdesc lang="en">a short delay between API calls</shortdesc>
	<content type="integer" default="${OCF_RESKEY_api_delay_default}" />
	</parameter>

	</parameters>

	<actions>
	<action name="start" timeout="30s" />
	<action name="stop" timeout="30s" />
	<action name="monitor" timeout="30s" interval="20s" depth="0" />
	<action name="migrate_to" timeout="30s" />
	<action name="migrate_from" timeout="30s" />
	<action name="meta-data" timeout="5s" />
	<action name="validate" timeout="10s" />
	<action name="validate-all" timeout="10s" />
	</actions>
	</resource-agent>
	END
	}

	#######################################################################

	awsvip_usage() {
	cat <<END
	usage: $0 {start\|stop\|monitor\|migrate_to\|migrate_from\|validate\|validate-all\|meta-data}

	Expects to have a fully populated OCF RA-compliant environment set.
	END
	}

	awsvip_start() {
	awsvip_monitor && return $OCF_SUCCESS

	$AWSCLI --profile $OCF_RESKEY_profile ec2 assign-private-ip-addresses \
	--network-interface-id ${NETWORK_ID} \
	--private-ip-addresses ${SECONDARY_PRIVATE_IP} \
	--allow-reassignment
	RET=$?

	# delay to avoid sending request too fast
	sleep ${OCF_RESKEY_api_delay}

	if [ $RET -ne 0 ]; then
	return $OCF_NOT_RUNNING
	fi

	ocf_log info "secondary_private_ip has been successfully brought up (${SECONDARY_PRIVATE_IP})"
	return $OCF_SUCCESS
	}

	awsvip_stop() {
	awsvip_monitor \|\| return $OCF_SUCCESS

	$AWSCLI --profile $OCF_RESKEY_profile ec2 unassign-private-ip-addresses \
	--network-interface-id ${NETWORK_ID} \
	--private-ip-addresses ${SECONDARY_PRIVATE_IP}
	RET=$?

	# delay to avoid sending request too fast
	sleep ${OCF_RESKEY_api_delay}

	if [ $RET -ne 0 ]; then
	return $OCF_NOT_RUNNING
	fi

	ocf_log info "secondary_private_ip has been successfully brought down (${SECONDARY_PRIVATE_IP})"
	return $OCF_SUCCESS
	}

	awsvip_monitor() {
	$AWSCLI --profile ${OCF_RESKEY_profile} ec2 describe-instances \
	--instance-id "${INSTANCE_ID}" \
	--query 'Reservations[].Instances[].NetworkInterfaces[].PrivateIpAddresses[].PrivateIpAddress[]' \
	--output text \| \
	grep -q "${SECONDARY_PRIVATE_IP}"
	RET=$?

	if [ $RET -ne 0 ]; then
	return $OCF_NOT_RUNNING
	fi
	return $OCF_SUCCESS
	}

	awsvip_validate() {
	check_binary ${AWSCLI}

	if [ -z "$OCF_RESKEY_profile" ]; then
	ocf_exit_reason "profile parameter not set"
	return $OCF_ERR_CONFIGURED
	fi

	if [ -z "${INSTANCE_ID}" ]; then
	ocf_exit_reason "instance_id not found. Is this a EC2 instance?"
	return $OCF_ERR_GENERIC
	fi

	return $OCF_SUCCESS
	}

	case $__OCF_ACTION in
	meta-data)
	meta_data
	exit $OCF_SUCCESS
	;;
	esac

	AWSCLI="${OCF_RESKEY_awscli}"
	SECONDARY_PRIVATE_IP="${OCF_RESKEY_secondary_private_ip}"
	-TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
	+TOKEN=$(curl -sX PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
	INSTANCE_ID=$(curl -s http://169.254.169.254/latest/meta-data/instance-id -H "X-aws-ec2-metadata-token: $TOKEN")
	MAC_ADDRESS=$(curl -s http://169.254.169.254/latest/meta-data/mac -H "X-aws-ec2-metadata-token: $TOKEN")
	NETWORK_ID=$(curl -s http://169.254.169.254/latest/meta-data/network/interfaces/macs/${MAC_ADDRESS}/interface-id -H "X-aws-ec2-metadata-token: $TOKEN")

	case $__OCF_ACTION in
	start)
	awsvip_validate
	awsvip_start
	;;
	stop)
	awsvip_stop
	;;
	monitor)
	awsvip_monitor
	;;
	migrate_to)
	ocf_log info "Migrating ${OCF_RESOURCE_INSTANCE} to ${OCF_RESKEY_CRM_meta_migrate_target}."
	awsvip_stop
	;;
	migrate_from)
	ocf_log info "Migrating ${OCF_RESOURCE_INSTANCE} from ${OCF_RESKEY_CRM_meta_migrate_source}."
	awsvip_start
	;;
	reload)
	ocf_log info "Reloading ${OCF_RESOURCE_INSTANCE} ..."
	;;
	validate\|validate-all)
	awsvip_validate
	;;
	usage\|help)
	awsvip_usage
	exit $OCF_SUCCESS
	;;
	*)
	awsvip_usage
	exit $OCF_ERR_UNIMPLEMENTED
	;;
	esac

	rc=$?
	ocf_log debug "${OCF_RESOURCE_INSTANCE} $__OCF_ACTION : $rc"
	exit $rc

File Metadata

Mime Type: text/x-diff
Expires: Sat, Jan 25, 6:20 AM (1 d, 4 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1321106
Default Alt Text: (46 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions