diff options
| author | Christian Pointner <equinox@spreadspace.org> | 2018-01-07 04:41:46 +0100 |
|---|---|---|
| committer | Christian Pointner <equinox@spreadspace.org> | 2018-01-07 04:41:46 +0100 |
| commit | 5e5d86c2a5bbccb88df65059693281c56c6f4abb (patch) | |
| tree | fbbd5b740c0118463c93846cb59b9b39756d667e /roles/kubernetes-net/templates/kubenet-peer.service.j2 | |
| parent | basic interface config for kubenet works now (diff) | |
kubernetes net role works now
Diffstat (limited to 'roles/kubernetes-net/templates/kubenet-peer.service.j2')
| -rw-r--r-- | roles/kubernetes-net/templates/kubenet-peer.service.j2 | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/roles/kubernetes-net/templates/kubenet-peer.service.j2 b/roles/kubernetes-net/templates/kubenet-peer.service.j2 new file mode 100644 index 00000000..a076512d --- /dev/null +++ b/roles/kubernetes-net/templates/kubenet-peer.service.j2 @@ -0,0 +1,20 @@ +[Unit] +Description=Kubernetes Network Peer {{ item }} +After=network.target +Requires=kubenet-interfaces.service +After=kubenet-interfaces.service + +{% set wg_pubkey = hostvars[item].kubenet_wireguard_pubkey.stdout -%} +{% set wg_host = hostvars[item].external_ip | default(hostvars[item].ansible_default_ipv4.address) -%} +{% set wg_port = hostvars[item].kubenet_wireguard_port -%} +{% set tun_ip = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, 0) | ipaddr(kubernetes.net_index[item]) | ipaddr('address') -%} +{% set pod_net = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubernetes.net_index[item]) -%} +{% set wg_allowedips = tun_ip + "/32," + pod_net %} +[Service] +Type=oneshot +ExecStart=/usr/bin/wg set kube-wg0 peer {{ wg_pubkey }} allowed-ips {{ wg_allowedips }} endpoint {{ wg_host }}:{{ wg_port }} persistent-keepalive 10 +ExecStop=/usr/bin/wg set kube-wg0 peer {{ wg_pubkey }} remove +RemainAfterExit=yes + +[Install] +WantedBy=multi-user.target |