move kubernetes roles to subdir

11 files changed, 310 insertions, 0 deletions

diff --git a/roles/kubernetes/net/files/daemon.json b/roles/kubernetes/net/files/daemon.json
new file mode 100644
index 00000000..28001640
--- /dev/null
+++ b/roles/kubernetes/net/files/daemon.json
@@ -0,0 +1,4 @@
+{
+  "bridge": "none",
+  "iptables": false
+}
diff --git a/roles/kubernetes/net/files/kubenet-interfaces.service b/roles/kubernetes/net/files/kubenet-interfaces.service
new file mode 100644
index 00000000..f27fb85b
--- /dev/null
+++ b/roles/kubernetes/net/files/kubenet-interfaces.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=Kubernetes Network Interfaces
+After=network.target
+
+[Service]
+Type=oneshot
+ExecStart=/var/lib/kubenet/ifupdown.sh up
+ExecStop=/var/lib/kubenet/ifupdown.sh down
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target
diff --git a/roles/kubernetes/net/filter_plugins/kubenet.py b/roles/kubernetes/net/filter_plugins/kubenet.py
new file mode 100644
index 00000000..c1312dd8
--- /dev/null
+++ b/roles/kubernetes/net/filter_plugins/kubenet.py
@@ -0,0 +1,33 @@
+from __future__ import (absolute_import, division, print_function)
+__metaclass__ = type
+
+from ansible import errors
+
+
+def direct_net_zone(data, myname, peer):
+    try:
+        zones = []
+        for zone in data:
+            if myname in data[zone]['node_interface'] and peer in data[zone]['node_interface']:
+                zones.append(zone)
+
+        if not zones:
+            return ""
+        if len(zones) > 1:
+            raise errors.AnsibleFilterError("host '%s' and '%s' have multiple direct net zones in common: %s" %
+                                            (myname, peer, zones.join(',')))
+        return zones[0]
+
+    except Exception as e:
+        raise errors.AnsibleFilterError("direct_net_zones(): %s" % str(e))
+
+
+class FilterModule(object):
+
+    ''' Kubernetes Network Filters '''
+    filter_map = {
+        'direct_net_zone': direct_net_zone,
+    }
+
+    def filters(self):
+        return self.filter_map
diff --git a/roles/kubernetes/net/handlers/main.yml b/roles/kubernetes/net/handlers/main.yml
new file mode 100644
index 00000000..bb7fde2b
--- /dev/null
+++ b/roles/kubernetes/net/handlers/main.yml
@@ -0,0 +1,4 @@
+---
+- name: reload systemd
+  systemd:
+    daemon_reload: yes
diff --git a/roles/kubernetes/net/meta/main.yml b/roles/kubernetes/net/meta/main.yml
new file mode 100644
index 00000000..03dfcb23
--- /dev/null
+++ b/roles/kubernetes/net/meta/main.yml
@@ -0,0 +1,4 @@
+---
+dependencies:
+- role: wireguard
+  when: k8s_remove_node is not defined
diff --git a/roles/kubernetes/net/tasks/add.yml b/roles/kubernetes/net/tasks/add.yml
new file mode 100644
index 00000000..f4e422c6
--- /dev/null
+++ b/roles/kubernetes/net/tasks/add.yml
@@ -0,0 +1,114 @@
+---
+- name: create docker config directory
+  file:
+    name: /etc/docker
+    state: directory
+    mode: 0700
+
+- name: disable docker iptables and bridge
+  copy:
+    src: daemon.json
+    dest: /etc/docker/daemon.json
+
+- name: create network config directory
+  file:
+    name: /var/lib/kubenet/
+    state: directory
+
+- name: configure wireguard port
+  set_fact:
+    kubenet_wireguard_port: "{{ kubernetes.wireguard_port | default(51820) }}"
+
+- name: install ifupdown script
+  template:
+    src: ifupdown.sh.j2
+    dest: /var/lib/kubenet/ifupdown.sh
+    mode: 0755
+  # TODO: notify reload... this is unfortunately already to late because
+  #                        it must probably be brought down by the old version of the script
+
+- name: generate wireguard private key
+  shell: "umask 077; wg genkey > /var/lib/kubenet/kube-wg0.privatekey"
+  args:
+    creates: /var/lib/kubenet/kube-wg0.privatekey
+
+- name: fetch wireguard public key
+  shell: "wg pubkey < /var/lib/kubenet/kube-wg0.privatekey"
+  register: kubenet_wireguard_pubkey
+  changed_when: false
+  check_mode: no
+
+- name: install systemd service unit for network interfaces
+  copy:
+    src: kubenet-interfaces.service
+    dest: /etc/systemd/system/kubenet-interfaces.service
+  # TODO: notify: reload???
+
+- name: make sure kubenet interfaces service is started and enabled
+  systemd:
+    daemon_reload: yes
+    name: kubenet-interfaces.service
+    state: started
+    enabled: yes
+
+- name: get list of currently installed kubenet peers
+  find:
+    path: /etc/systemd/system/
+    pattern: "kubenet-peer-*.service"
+  register: kubenet_peers_installed
+
+- name: compute list of peers to be added
+  set_fact:
+    kubenet_peers_to_add: "{{ kubernetes_nodes | difference(inventory_hostname) }}"
+
+- name: compute list of peers to be removed
+  set_fact:
+    kubenet_peers_to_remove: "{{ kubenet_peers_installed.files | map(attribute='path') | map('replace', '/etc/systemd/system/kubenet-peer-', '') | map('replace', '.service', '') | difference(kubenet_peers_to_add) }}"
+
+- name: stop/disable systemd units for stale kubenet peers
+  with_items: "{{ kubenet_peers_to_remove }}"
+  systemd:
+    name: "kubenet-peer-{{ item }}.service"
+    state: stopped
+    enabled: no
+
+- name: remove systemd units for stale kubenet peers
+  with_items: "{{ kubenet_peers_to_remove }}"
+  file:
+    name: "/etc/systemd/system/kubenet-peer-{{ item }}.service"
+    state: absent
+
+- name: install systemd units for every kubenet peer
+  with_items: "{{ kubenet_peers_to_add }}"
+  loop_control:
+    loop_var: peer
+  template:
+    src: kubenet-peer.service.j2
+    dest: "/etc/systemd/system/kubenet-peer-{{ peer }}.service"
+  # TODO: notify restart for peers that change...
+
+- name: make sure kubenet peer services are started and enabled
+  with_items: "{{ kubenet_peers_to_add }}"
+  systemd:
+    daemon_reload: yes
+    name: "kubenet-peer-{{ item }}.service"
+    state: started
+    enabled: yes
+
+- name: enable IPv4 forwarding
+  sysctl:
+    name: net.ipv4.ip_forward
+    value: 1
+    sysctl_set: yes
+    state: present
+    reload: yes
+
+- name: create cni config directory
+  file:
+    name: /etc/cni/net.d
+    state: directory
+
+- name: install cni config
+  template:
+    src: k8s.json.j2
+    dest: /etc/cni/net.d/k8s.json
diff --git a/roles/kubernetes/net/tasks/main.yml b/roles/kubernetes/net/tasks/main.yml
new file mode 100644
index 00000000..8c94292e
--- /dev/null
+++ b/roles/kubernetes/net/tasks/main.yml
@@ -0,0 +1,8 @@
+---
+- name: add node to overlay network
+  include_tasks: add.yml
+  when: k8s_remove_node is not defined
+
+- name: remove node from overlay network
+  include_tasks: remove.yml
+  when: k8s_remove_node is defined
diff --git a/roles/kubernetes/net/tasks/remove.yml b/roles/kubernetes/net/tasks/remove.yml
new file mode 100644
index 00000000..6695bd5d
--- /dev/null
+++ b/roles/kubernetes/net/tasks/remove.yml
@@ -0,0 +1,28 @@
+---
+- name: check if kubenet interface service unit exists
+  stat:
+    path: /etc/systemd/system/kubenet-interfaces.service
+  register: kubenet_interface_unit
+
+- name: bring down kubenet interface
+  systemd:
+    name: kubenet-interfaces.service
+    state: stopped
+  when: kubenet_interface_unit.stat.exists
+
+- name: gather list of all kubenet related service units
+  find:
+    path: /etc/systemd/system/
+    patterns:
+      - "kubenet-peer-*.service"
+      - kubenet-interfaces.service
+  register: kubenet_units_installed
+
+- name: remove all kubenet related files and directories
+  with_flattened:
+  - "{{ kubenet_units_installed.files | map(attribute='path') | list }}"
+  - /var/lib/kubenet
+  file:
+    path: "{{ item }}"
+    state: absent
+  notify: reload systemd
diff --git a/roles/kubernetes/net/templates/ifupdown.sh.j2 b/roles/kubernetes/net/templates/ifupdown.sh.j2
new file mode 100644
index 00000000..995d358b
--- /dev/null
+++ b/roles/kubernetes/net/templates/ifupdown.sh.j2
@@ -0,0 +1,55 @@
+#!/bin/bash
+
+set -e
+
+CONF_D="/var/lib/kubenet/"
+
+INET_IF="{{ ansible_default_ipv4.interface }}"
+
+POD_NET_CIDR="{{ kubernetes.pod_ip_range }}"
+
+{% set br_net = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubernetes.net_index[inventory_hostname]) -%}
+BR_IF="kube-br0"
+BR_IP="{{ br_net | ipaddr(1) | ipaddr('address')  }}"
+BR_IP_CIDR="{{ br_net | ipaddr(1) }}"
+BR_NET_CIDR="{{ br_net }}"
+
+TUN_IF="kube-wg0"
+TUN_IP_CIDR="{{ kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, 0) | ipaddr(kubernetes.net_index[inventory_hostname]) }}"
+
+
+case "$1" in
+  up)
+    # bring up bridge for local pods
+    ip link add dev "$BR_IF" type bridge
+    ip addr add dev "$BR_IF" "$BR_IP_CIDR"
+    ip link set up dev "$BR_IF"
+    iptables -t nat -A POSTROUTING -s "$BR_NET_CIDR" -o "$INET_IF" -j MASQUERADE
+    modprobe br_netfilter
+
+    # bring up wireguard tunnel to other nodes
+    ip link add dev "$TUN_IF" type wireguard
+    ip addr add dev "$TUN_IF" "$TUN_IP_CIDR"
+    wg set "$TUN_IF" listen-port {{ kubenet_wireguard_port }} private-key "$CONF_D/$TUN_IF.privatekey"
+    ip link set up dev "$TUN_IF"
+
+    # make pods and service IPs reachable
+    # !!! use IP of bridge as source so we don't produce martians if direct-zones are involved!!!
+    ip route add "$POD_NET_CIDR" dev "$TUN_IF" src "$BR_IP"
+    ;;
+  down)
+    # bring down wireguard tunnel to other nodes
+    ip route del "$POD_NET_CIDR" dev "$TUN_IF"
+    ip link del dev "$TUN_IF"
+
+    # bring down bridge for local pods
+    iptables -t nat -D POSTROUTING -s "$BR_NET_CIDR" -o "$INET_IF" -j MASQUERADE
+    ip link del dev "$BR_IF"
+    ;;
+  *)
+    echo "usage: $0 (up|down)"
+    exit 1
+    ;;
+esac
+
+exit 0
diff --git a/roles/kubernetes/net/templates/k8s.json.j2 b/roles/kubernetes/net/templates/k8s.json.j2
new file mode 100644
index 00000000..f457ed1c
--- /dev/null
+++ b/roles/kubernetes/net/templates/k8s.json.j2
@@ -0,0 +1,12 @@
+{
+  "cniVersion": "0.3.1",
+  "name": "k8s",
+  "type": "bridge",
+  "bridge": "kube-br0",
+  "isDefaultGateway": true,
+  "hairpinMode": true,
+  "ipam": {
+    "type": "host-local",
+    "subnet": "{{ kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubernetes.net_index[inventory_hostname]) }}"
+  }
+}
diff --git a/roles/kubernetes/net/templates/kubenet-peer.service.j2 b/roles/kubernetes/net/templates/kubenet-peer.service.j2
new file mode 100644
index 00000000..bee211af
--- /dev/null
+++ b/roles/kubernetes/net/templates/kubenet-peer.service.j2
@@ -0,0 +1,36 @@
+[Unit]
+Description=Kubernetes Network Peer {{ peer }}
+After=network.target
+Requires=kubenet-interfaces.service
+After=kubenet-interfaces.service
+
+{% set pod_net_peer = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubernetes.net_index[peer]) -%}
+{% set direct_zone = kubernetes.direct_net_zones | direct_net_zone(inventory_hostname, peer) -%}
+{% if direct_zone %}
+{% set direct_ip = kubernetes.direct_net_zones[direct_zone].transfer_net | ipaddr(kubernetes.net_index[inventory_hostname]) %}
+{% set direct_interface = kubernetes.direct_net_zones[direct_zone].node_interface[inventory_hostname] %}
+{% set direct_ip_peer = kubernetes.direct_net_zones[direct_zone].transfer_net | ipaddr(kubernetes.net_index[peer]) %}
+{% else %}
+{% set tun_ip = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, 0) | ipaddr(kubernetes.net_index[peer]) -%}
+{% set wg_pubkey = hostvars[peer].kubenet_wireguard_pubkey.stdout -%}
+{% set wg_host = hostvars[peer].external_ip | default(hostvars[peer].ansible_default_ipv4.address) -%}
+{% set wg_port = hostvars[peer].kubenet_wireguard_port -%}
+{% set wg_allowedips = (tun_ip | ipaddr('address')) + "/32," + pod_net_peer %}
+{% endif %}
+[Service]
+Type=oneshot
+{% if direct_zone %}
+ExecStart=/sbin/ip addr add {{ direct_ip }} dev {{ direct_interface }}
+ExecStart=/sbin/ip link set up dev {{ direct_interface }}
+ExecStart=/sbin/ip route add {{ pod_net_peer }} via {{ direct_ip_peer | ipaddr('address') }}
+ExecStop=/sbin/ip route del {{ pod_net_peer }}
+ExecStop=/sbin/ip link set down dev {{ direct_interface }}
+ExecStop=/sbin/ip addr del {{ direct_ip }} dev {{ direct_interface }}
+{% else %}
+ExecStart=/usr/bin/wg set kube-wg0 peer {{ wg_pubkey }} allowed-ips {{ wg_allowedips }} endpoint {{ wg_host }}:{{ wg_port }} persistent-keepalive 10
+ExecStop=/usr/bin/wg set kube-wg0 peer {{ wg_pubkey }} remove
+{% endif %}
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target