diff options
author | Christian Pointner <equinox@spreadspace.org> | 2020-06-20 01:53:46 +0200 |
---|---|---|
committer | Christian Pointner <equinox@spreadspace.org> | 2020-06-20 01:53:46 +0200 |
commit | 2ecd6ff7a3390d86f40f062b177fe9babd676f22 (patch) | |
tree | 51f86f459cffb1dbd3f80c4d0d885609758cc415 /roles/kubernetes/net/kubeguard/node/templates | |
parent | hatop is dead, switch to haproxyctl (diff) |
kubernetes: move kubeguard to kubeadm/base
Diffstat (limited to 'roles/kubernetes/net/kubeguard/node/templates')
3 files changed, 0 insertions, 104 deletions
diff --git a/roles/kubernetes/net/kubeguard/node/templates/ifupdown.sh.j2 b/roles/kubernetes/net/kubeguard/node/templates/ifupdown.sh.j2 deleted file mode 100644 index 98b38cf4..00000000 --- a/roles/kubernetes/net/kubeguard/node/templates/ifupdown.sh.j2 +++ /dev/null @@ -1,55 +0,0 @@ -#!/bin/bash - -set -e - -CONF_D="/var/lib/kubeguard/" - -INET_IF="{{ ansible_default_ipv4.interface }}" - -POD_NET_CIDR="{{ kubernetes.pod_ip_range }}" - -{% set br_net = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubeguard.node_index[inventory_hostname]) -%} -BR_IF="kube-br0" -BR_IP="{{ br_net | ipaddr(1) | ipaddr('address') }}" -BR_IP_CIDR="{{ br_net | ipaddr(1) }}" -BR_NET_CIDR="{{ br_net }}" - -TUN_IF="kube-wg0" -TUN_IP_CIDR="{{ kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, 0) | ipaddr(kubeguard.node_index[inventory_hostname]) }}" - - -case "$1" in - up) - # bring up bridge for local pods - ip link add dev "$BR_IF" type bridge - ip addr add dev "$BR_IF" "$BR_IP_CIDR" - ip link set up dev "$BR_IF" - iptables -t nat -A POSTROUTING -s "$BR_NET_CIDR" -o "$INET_IF" -j MASQUERADE - modprobe br_netfilter - - # bring up wireguard tunnel to other nodes - ip link add dev "$TUN_IF" type wireguard - ip addr add dev "$TUN_IF" "$TUN_IP_CIDR" - wg set "$TUN_IF" listen-port {{ kubeguard_wireguard_port }} private-key "$CONF_D/$TUN_IF.privatekey" - ip link set up dev "$TUN_IF" - - # make pods and service IPs reachable - # !!! use IP of bridge as source so we don't produce martians if direct-zones are involved!!! - ip route add "$POD_NET_CIDR" dev "$TUN_IF" src "$BR_IP" - ;; - down) - # bring down wireguard tunnel to other nodes - ip route del "$POD_NET_CIDR" dev "$TUN_IF" - ip link del dev "$TUN_IF" - - # bring down bridge for local pods - iptables -t nat -D POSTROUTING -s "$BR_NET_CIDR" -o "$INET_IF" -j MASQUERADE - ip link del dev "$BR_IF" - ;; - *) - echo "usage: $0 (up|down)" - exit 1 - ;; -esac - -exit 0 diff --git a/roles/kubernetes/net/kubeguard/node/templates/k8s.json.j2 b/roles/kubernetes/net/kubeguard/node/templates/k8s.json.j2 deleted file mode 100644 index 65b1357a..00000000 --- a/roles/kubernetes/net/kubeguard/node/templates/k8s.json.j2 +++ /dev/null @@ -1,12 +0,0 @@ -{ - "cniVersion": "0.3.1", - "name": "k8s", - "type": "bridge", - "bridge": "kube-br0", - "isDefaultGateway": true, - "hairpinMode": true, - "ipam": { - "type": "host-local", - "subnet": "{{ kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubeguard.node_index[inventory_hostname]) }}" - } -} diff --git a/roles/kubernetes/net/kubeguard/node/templates/kubeguard-peer.service.j2 b/roles/kubernetes/net/kubeguard/node/templates/kubeguard-peer.service.j2 deleted file mode 100644 index 0503ca03..00000000 --- a/roles/kubernetes/net/kubeguard/node/templates/kubeguard-peer.service.j2 +++ /dev/null @@ -1,37 +0,0 @@ -[Unit] -Description=Kubernetes Network Peer {{ peer }} -After=network.target -Requires=kubeguard-interfaces.service -After=kubeguard-interfaces.service - -{% set pod_ip_self = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubeguard.node_index[inventory_hostname]) | ipaddr(1) | ipaddr('address') -%} -{% set pod_net_peer = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubeguard.node_index[peer]) -%} -{% set direct_zone = kubeguard.direct_net_zones | default({}) | direct_net_zone(inventory_hostname, peer) -%} -{% if direct_zone %} -{% set direct_ip = kubeguard.direct_net_zones[direct_zone].transfer_net | ipaddr(kubeguard.node_index[inventory_hostname]) %} -{% set direct_interface = kubeguard.direct_net_zones[direct_zone].node_interface[inventory_hostname] %} -{% set direct_ip_peer = kubeguard.direct_net_zones[direct_zone].transfer_net | ipaddr(kubeguard.node_index[peer]) %} -{% else %} -{% set tun_ip = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, 0) | ipaddr(kubeguard.node_index[peer]) -%} -{% set wg_pubkey = hostvars[peer].kubeguard_wireguard_pubkey.stdout -%} -{% set wg_host = hostvars[peer].external_ip_cooked | default(hostvars[peer].ansible_default_ipv4.address) -%} -{% set wg_port = hostvars[peer].kubeguard_wireguard_port -%} -{% set wg_allowedips = (tun_ip | ipaddr('address')) + "/32," + pod_net_peer %} -{% endif %} -[Service] -Type=oneshot -{% if direct_zone %} -ExecStart=/sbin/ip addr add {{ direct_ip }} dev {{ direct_interface }} -ExecStart=/sbin/ip link set up dev {{ direct_interface }} -ExecStart=/sbin/ip route add {{ pod_net_peer }} via {{ direct_ip_peer | ipaddr('address') }} src {{ pod_ip_self }} -ExecStop=/sbin/ip route del {{ pod_net_peer }} -ExecStop=/sbin/ip link set down dev {{ direct_interface }} -ExecStop=/sbin/ip addr del {{ direct_ip }} dev {{ direct_interface }} -{% else %} -ExecStart=/usr/bin/wg set kube-wg0 peer {{ wg_pubkey }} allowed-ips {{ wg_allowedips }} endpoint {{ wg_host }}:{{ wg_port }} persistent-keepalive 10 -ExecStop=/usr/bin/wg set kube-wg0 peer {{ wg_pubkey }} remove -{% endif %} -RemainAfterExit=yes - -[Install] -WantedBy=multi-user.target |