diff options
| author | Christian Pointner <equinox@spreadspace.org> | 2018-02-17 19:09:51 +0100 |
|---|---|---|
| committer | Christian Pointner <equinox@spreadspace.org> | 2018-02-17 19:09:51 +0100 |
| commit | ac2c15fe06f00f1432c169f520c5db10231ec4f0 (patch) | |
| tree | 025d2fab3592f3424225b4375887c6a3a4963121 /roles/kubernetes-net/templates | |
| parent | add waiting period if new nodes are added (diff) | |
fix source martions for service-ips and host-network pods
Diffstat (limited to 'roles/kubernetes-net/templates')
| -rw-r--r-- | roles/kubernetes-net/templates/ifupdown.sh.j2 | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/roles/kubernetes-net/templates/ifupdown.sh.j2 b/roles/kubernetes-net/templates/ifupdown.sh.j2 index 701128f3..3f6826c8 100644 --- a/roles/kubernetes-net/templates/ifupdown.sh.j2 +++ b/roles/kubernetes-net/templates/ifupdown.sh.j2 @@ -8,12 +8,13 @@ INET_IF="{{ ansible_default_ipv4.interface }}" POD_NET_CIDR="{{ kubernetes.pod_ip_range }}" +{% set br_net = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubernetes.net_index[inventory_hostname]) -%} BR_IF="kube-br0" -BR_IP_CIDR="{{ kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubernetes.net_index[inventory_hostname]) | ipaddr(1) }}" -BR_NET_CIDR="{{ kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubernetes.net_index[inventory_hostname]) }}" +BR_IP="{{ br_net | ipaddr(1) | ipaddr('address') }}" +BR_IP_CIDR="{{ br_net | ipaddr(1) }}" +BR_NET_CIDR="{{ br_net }}" TUN_IF="kube-wg0" -TUN_IP="{{ kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, 0) | ipaddr(kubernetes.net_index[inventory_hostname]) | ipaddr('address') }}" TUN_IP_CIDR="{{ kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, 0) | ipaddr(kubernetes.net_index[inventory_hostname]) }}" @@ -36,7 +37,10 @@ case "$1" in ip addr add dev "$TUN_IF" "$TUN_IP_CIDR" wg set "$TUN_IF" listen-port {{ kubenet_wireguard_port }} private-key "$CONF_D/$TUN_IF.privatekey" ip link set up dev "$TUN_IF" - ip route add "$POD_NET_CIDR" dev "$TUN_IF" src "$TUN_IP" + + # make pods and service IPs reachable + # !!! use IP of bridge as source so we don't produce martians if direct-zones are involved!!! + ip route add "$POD_NET_CIDR" dev "$TUN_IF" src "$BR_IP" ;; down) # bring down wireguard tunnel to other nodes |