kubernetes: move kubeguard to kubeadm/base

8 files changed, 83 insertions, 90 deletions

diff --git a/roles/kubernetes/net/kubeguard/node/filter_plugins/kubeguard.py b/roles/kubernetes/kubeadm/base/filter_plugins/net_kubeguard.py
index 199ff14b..2220e545 100644
--- a/roles/kubernetes/net/kubeguard/node/filter_plugins/kubeguard.py
+++ b/roles/kubernetes/kubeadm/base/filter_plugins/net_kubeguard.py
@@ -4,7 +4,7 @@ __metaclass__ = type
 from ansible import errors
 
 
-def direct_net_zone(data, myname, peer):
+def kubeguard_direct_net_zone(data, myname, peer):
     try:
         zones = []
         for zone in data:
@@ -19,14 +19,14 @@ def direct_net_zone(data, myname, peer):
         return zones[0]
 
     except Exception as e:
-        raise errors.AnsibleFilterError("direct_net_zones(): %s" % str(e))
+        raise errors.AnsibleFilterError("kubeguard_direct_net_zones(): %s" % str(e))
 
 
 class FilterModule(object):
 
     ''' Kubeguard Network Filters '''
     filter_map = {
-        'direct_net_zone': direct_net_zone,
+        'kubeguard_direct_net_zone': kubeguard_direct_net_zone,
     }
 
     def filters(self):
diff --git a/roles/kubernetes/kubeadm/base/tasks/net_kubeguard.yml b/roles/kubernetes/kubeadm/base/tasks/net_kubeguard.yml
index 0924c458..8c5f5065 100644
--- a/roles/kubernetes/kubeadm/base/tasks/net_kubeguard.yml
+++ b/roles/kubernetes/kubeadm/base/tasks/net_kubeguard.yml
@@ -5,3 +5,80 @@
     msg: "this network plugin can not replace kube-proxy please set kubernetes_network_plugin_replaces_kube_proxy to false."
     that:
       - not kubernetes_network_plugin_replaces_kube_proxy
+
+
+- name: install wireguard
+  import_role:
+    name: wireguard/base
+
+- name: create network config directory
+  file:
+    name: /var/lib/kubeguard/
+    state: directory
+
+- name: install ifupdown script
+  template:
+    src: net_kubeguard/ifupdown.sh.j2
+    dest: /var/lib/kubeguard/ifupdown.sh
+    mode: 0755
+  # TODO: notify reload... this is unfortunately already to late because
+  #                        it must probably be brought down by the old version of the script
+
+- name: generate wireguard private key
+  shell: "umask 077; wg genkey > /var/lib/kubeguard/kube-wg0.privatekey"
+  args:
+    creates: /var/lib/kubeguard/kube-wg0.privatekey
+
+- name: fetch wireguard public key
+  shell: "wg pubkey < /var/lib/kubeguard/kube-wg0.privatekey"
+  register: kubeguard_wireguard_pubkey
+  changed_when: false
+  check_mode: no
+
+- name: install systemd service unit for network interfaces
+  template:
+    src: net_kubeguard/kubeguard-interfaces.service.j2
+    dest: /etc/systemd/system/kubeguard-interfaces.service
+  # TODO: notify: reload???
+
+- name: make sure kubeguard interfaces service is started and enabled
+  systemd:
+    daemon_reload: yes
+    name: kubeguard-interfaces.service
+    state: started
+    enabled: yes
+
+- name: install systemd units for every kubeguard peer
+  loop: "{{ groups['_kubernetes_nodes_'] | difference(inventory_hostname) }}"
+  loop_control:
+    loop_var: peer
+  template:
+    src: net_kubeguard/kubeguard-peer.service.j2
+    dest: "/etc/systemd/system/kubeguard-peer-{{ peer }}.service"
+  # TODO: notify restart for peers that change...
+
+- name: make sure kubeguard peer services are started and enabled
+  loop: "{{ groups['_kubernetes_nodes_'] | difference(inventory_hostname) }}"
+  systemd:
+    daemon_reload: yes
+    name: "kubeguard-peer-{{ item }}.service"
+    state: started
+    enabled: yes
+
+- name: enable IPv4 forwarding
+  sysctl:
+    name: net.ipv4.ip_forward
+    value: '1'
+    sysctl_set: yes
+    state: present
+    reload: yes
+
+- name: create cni config directory
+  file:
+    name: /etc/cni/net.d
+    state: directory
+
+- name: install cni config
+  template:
+    src: net_kubeguard/k8s.json.j2
+    dest: /etc/cni/net.d/kubeguard.json
diff --git a/roles/kubernetes/net/kubeguard/node/templates/ifupdown.sh.j2 b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/ifupdown.sh.j2
index 98b38cf4..d8153102 100644
--- a/roles/kubernetes/net/kubeguard/node/templates/ifupdown.sh.j2
+++ b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/ifupdown.sh.j2
@@ -30,7 +30,7 @@ case "$1" in
     # bring up wireguard tunnel to other nodes
     ip link add dev "$TUN_IF" type wireguard
     ip addr add dev "$TUN_IF" "$TUN_IP_CIDR"
-    wg set "$TUN_IF" listen-port {{ kubeguard_wireguard_port }} private-key "$CONF_D/$TUN_IF.privatekey"
+    wg set "$TUN_IF" listen-port {{ kubeguard_wireguard_port | default(51820) }} private-key "$CONF_D/$TUN_IF.privatekey"
     ip link set up dev "$TUN_IF"
 
     # make pods and service IPs reachable
diff --git a/roles/kubernetes/net/kubeguard/node/templates/k8s.json.j2 b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/k8s.json.j2
index 65b1357a..65b1357a 100644
--- a/roles/kubernetes/net/kubeguard/node/templates/k8s.json.j2
+++ b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/k8s.json.j2
diff --git a/roles/kubernetes/net/kubeguard/node/files/kubeguard-interfaces.service b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/kubeguard-interfaces.service.j2
index 35fc8f90..35fc8f90 100644
--- a/roles/kubernetes/net/kubeguard/node/files/kubeguard-interfaces.service
+++ b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/kubeguard-interfaces.service.j2
diff --git a/roles/kubernetes/net/kubeguard/node/templates/kubeguard-peer.service.j2 b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/kubeguard-peer.service.j2
index 0503ca03..92300253 100644
--- a/roles/kubernetes/net/kubeguard/node/templates/kubeguard-peer.service.j2
+++ b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/kubeguard-peer.service.j2
@@ -6,7 +6,7 @@ After=kubeguard-interfaces.service
 
 {% set pod_ip_self = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubeguard.node_index[inventory_hostname]) | ipaddr(1) | ipaddr('address') -%}
 {% set pod_net_peer = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubeguard.node_index[peer]) -%}
-{% set direct_zone = kubeguard.direct_net_zones | default({}) | direct_net_zone(inventory_hostname, peer) -%}
+{% set direct_zone = kubeguard.direct_net_zones | default({}) | kubeguard_direct_net_zone(inventory_hostname, peer) -%}
 {% if direct_zone %}
 {% set direct_ip = kubeguard.direct_net_zones[direct_zone].transfer_net | ipaddr(kubeguard.node_index[inventory_hostname]) %}
 {% set direct_interface = kubeguard.direct_net_zones[direct_zone].node_interface[inventory_hostname] %}
@@ -15,7 +15,7 @@ After=kubeguard-interfaces.service
 {% set tun_ip = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, 0) | ipaddr(kubeguard.node_index[peer]) -%}
 {% set wg_pubkey = hostvars[peer].kubeguard_wireguard_pubkey.stdout -%}
 {% set wg_host = hostvars[peer].external_ip_cooked | default(hostvars[peer].ansible_default_ipv4.address) -%}
-{% set wg_port = hostvars[peer].kubeguard_wireguard_port -%}
+{% set wg_port = hostvars[peer].kubeguard_wireguard_port | default(51820) -%}
 {% set wg_allowedips = (tun_ip | ipaddr('address')) + "/32," + pod_net_peer %}
 {% endif %}
 [Service]
diff --git a/roles/kubernetes/net/kubeguard/node/handlers/main.yml b/roles/kubernetes/net/kubeguard/node/handlers/main.yml
deleted file mode 100644
index bb7fde2b..00000000
--- a/roles/kubernetes/net/kubeguard/node/handlers/main.yml
+++ /dev/null
@@ -1,4 +0,0 @@
----
-- name: reload systemd
-  systemd:
-    daemon_reload: yes
diff --git a/roles/kubernetes/net/kubeguard/node/tasks/main.yml b/roles/kubernetes/net/kubeguard/node/tasks/main.yml
deleted file mode 100644
index 72814e06..00000000
--- a/roles/kubernetes/net/kubeguard/node/tasks/main.yml
+++ /dev/null
@@ -1,80 +0,0 @@
----
-- name: install wireguard
-  import_role:
-    name: wireguard/base
-
-- name: create network config directory
-  file:
-    name: /var/lib/kubeguard/
-    state: directory
-
-- name: configure wireguard port
-  set_fact:
-    kubeguard_wireguard_port: "{{ kubernetes.wireguard_port | default(51820) }}"
-
-- name: install ifupdown script
-  template:
-    src: ifupdown.sh.j2
-    dest: /var/lib/kubeguard/ifupdown.sh
-    mode: 0755
-  # TODO: notify reload... this is unfortunately already to late because
-  #                        it must probably be brought down by the old version of the script
-
-- name: generate wireguard private key
-  shell: "umask 077; wg genkey > /var/lib/kubeguard/kube-wg0.privatekey"
-  args:
-    creates: /var/lib/kubeguard/kube-wg0.privatekey
-
-- name: fetch wireguard public key
-  shell: "wg pubkey < /var/lib/kubeguard/kube-wg0.privatekey"
-  register: kubeguard_wireguard_pubkey
-  changed_when: false
-  check_mode: no
-
-- name: install systemd service unit for network interfaces
-  copy:
-    src: kubeguard-interfaces.service
-    dest: /etc/systemd/system/kubeguard-interfaces.service
-  # TODO: notify: reload???
-
-- name: make sure kubeguard interfaces service is started and enabled
-  systemd:
-    daemon_reload: yes
-    name: kubeguard-interfaces.service
-    state: started
-    enabled: yes
-
-- name: install systemd units for every kubeguard peer
-  loop: "{{ groups['_kubernetes_nodes_'] | difference(inventory_hostname) }}"
-  loop_control:
-    loop_var: peer
-  template:
-    src: kubeguard-peer.service.j2
-    dest: "/etc/systemd/system/kubeguard-peer-{{ peer }}.service"
-  # TODO: notify restart for peers that change...
-
-- name: make sure kubeguard peer services are started and enabled
-  loop: "{{ groups['_kubernetes_nodes_'] | difference(inventory_hostname) }}"
-  systemd:
-    daemon_reload: yes
-    name: "kubeguard-peer-{{ item }}.service"
-    state: started
-    enabled: yes
-
-- name: enable IPv4 forwarding
-  sysctl:
-    name: net.ipv4.ip_forward
-    value: '1'
-    sysctl_set: yes
-    state: present
-    reload: yes
-
-- name: create cni config directory
-  file:
-    name: /etc/cni/net.d
-    state: directory
-
-- name: install cni config
-  template:
-    src: k8s.json.j2
-    dest: /etc/cni/net.d/k8s.json