move kubernetes roles to subdir

3 files changed, 103 insertions, 0 deletions

diff --git a/roles/kubernetes/net/templates/ifupdown.sh.j2 b/roles/kubernetes/net/templates/ifupdown.sh.j2
new file mode 100644
index 00000000..995d358b
--- /dev/null
+++ b/roles/kubernetes/net/templates/ifupdown.sh.j2
@@ -0,0 +1,55 @@
+#!/bin/bash
+
+set -e
+
+CONF_D="/var/lib/kubenet/"
+
+INET_IF="{{ ansible_default_ipv4.interface }}"
+
+POD_NET_CIDR="{{ kubernetes.pod_ip_range }}"
+
+{% set br_net = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubernetes.net_index[inventory_hostname]) -%}
+BR_IF="kube-br0"
+BR_IP="{{ br_net | ipaddr(1) | ipaddr('address')  }}"
+BR_IP_CIDR="{{ br_net | ipaddr(1) }}"
+BR_NET_CIDR="{{ br_net }}"
+
+TUN_IF="kube-wg0"
+TUN_IP_CIDR="{{ kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, 0) | ipaddr(kubernetes.net_index[inventory_hostname]) }}"
+
+
+case "$1" in
+  up)
+    # bring up bridge for local pods
+    ip link add dev "$BR_IF" type bridge
+    ip addr add dev "$BR_IF" "$BR_IP_CIDR"
+    ip link set up dev "$BR_IF"
+    iptables -t nat -A POSTROUTING -s "$BR_NET_CIDR" -o "$INET_IF" -j MASQUERADE
+    modprobe br_netfilter
+
+    # bring up wireguard tunnel to other nodes
+    ip link add dev "$TUN_IF" type wireguard
+    ip addr add dev "$TUN_IF" "$TUN_IP_CIDR"
+    wg set "$TUN_IF" listen-port {{ kubenet_wireguard_port }} private-key "$CONF_D/$TUN_IF.privatekey"
+    ip link set up dev "$TUN_IF"
+
+    # make pods and service IPs reachable
+    # !!! use IP of bridge as source so we don't produce martians if direct-zones are involved!!!
+    ip route add "$POD_NET_CIDR" dev "$TUN_IF" src "$BR_IP"
+    ;;
+  down)
+    # bring down wireguard tunnel to other nodes
+    ip route del "$POD_NET_CIDR" dev "$TUN_IF"
+    ip link del dev "$TUN_IF"
+
+    # bring down bridge for local pods
+    iptables -t nat -D POSTROUTING -s "$BR_NET_CIDR" -o "$INET_IF" -j MASQUERADE
+    ip link del dev "$BR_IF"
+    ;;
+  *)
+    echo "usage: $0 (up|down)"
+    exit 1
+    ;;
+esac
+
+exit 0
diff --git a/roles/kubernetes/net/templates/k8s.json.j2 b/roles/kubernetes/net/templates/k8s.json.j2
new file mode 100644
index 00000000..f457ed1c
--- /dev/null
+++ b/roles/kubernetes/net/templates/k8s.json.j2
@@ -0,0 +1,12 @@
+{
+  "cniVersion": "0.3.1",
+  "name": "k8s",
+  "type": "bridge",
+  "bridge": "kube-br0",
+  "isDefaultGateway": true,
+  "hairpinMode": true,
+  "ipam": {
+    "type": "host-local",
+    "subnet": "{{ kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubernetes.net_index[inventory_hostname]) }}"
+  }
+}
diff --git a/roles/kubernetes/net/templates/kubenet-peer.service.j2 b/roles/kubernetes/net/templates/kubenet-peer.service.j2
new file mode 100644
index 00000000..bee211af
--- /dev/null
+++ b/roles/kubernetes/net/templates/kubenet-peer.service.j2
@@ -0,0 +1,36 @@
+[Unit]
+Description=Kubernetes Network Peer {{ peer }}
+After=network.target
+Requires=kubenet-interfaces.service
+After=kubenet-interfaces.service
+
+{% set pod_net_peer = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubernetes.net_index[peer]) -%}
+{% set direct_zone = kubernetes.direct_net_zones | direct_net_zone(inventory_hostname, peer) -%}
+{% if direct_zone %}
+{% set direct_ip = kubernetes.direct_net_zones[direct_zone].transfer_net | ipaddr(kubernetes.net_index[inventory_hostname]) %}
+{% set direct_interface = kubernetes.direct_net_zones[direct_zone].node_interface[inventory_hostname] %}
+{% set direct_ip_peer = kubernetes.direct_net_zones[direct_zone].transfer_net | ipaddr(kubernetes.net_index[peer]) %}
+{% else %}
+{% set tun_ip = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, 0) | ipaddr(kubernetes.net_index[peer]) -%}
+{% set wg_pubkey = hostvars[peer].kubenet_wireguard_pubkey.stdout -%}
+{% set wg_host = hostvars[peer].external_ip | default(hostvars[peer].ansible_default_ipv4.address) -%}
+{% set wg_port = hostvars[peer].kubenet_wireguard_port -%}
+{% set wg_allowedips = (tun_ip | ipaddr('address')) + "/32," + pod_net_peer %}
+{% endif %}
+[Service]
+Type=oneshot
+{% if direct_zone %}
+ExecStart=/sbin/ip addr add {{ direct_ip }} dev {{ direct_interface }}
+ExecStart=/sbin/ip link set up dev {{ direct_interface }}
+ExecStart=/sbin/ip route add {{ pod_net_peer }} via {{ direct_ip_peer | ipaddr('address') }}
+ExecStop=/sbin/ip route del {{ pod_net_peer }}
+ExecStop=/sbin/ip link set down dev {{ direct_interface }}
+ExecStop=/sbin/ip addr del {{ direct_ip }} dev {{ direct_interface }}
+{% else %}
+ExecStart=/usr/bin/wg set kube-wg0 peer {{ wg_pubkey }} allowed-ips {{ wg_allowedips }} endpoint {{ wg_host }}:{{ wg_port }} persistent-keepalive 10
+ExecStop=/usr/bin/wg set kube-wg0 peer {{ wg_pubkey }} remove
+{% endif %}
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target