summaryrefslogtreecommitdiff
path: root/roles/kubernetes-net/templates/ifupdown.sh.j2
diff options
context:
space:
mode:
Diffstat (limited to 'roles/kubernetes-net/templates/ifupdown.sh.j2')
-rw-r--r--roles/kubernetes-net/templates/ifupdown.sh.j212
1 files changed, 8 insertions, 4 deletions
diff --git a/roles/kubernetes-net/templates/ifupdown.sh.j2 b/roles/kubernetes-net/templates/ifupdown.sh.j2
index 701128f3..3f6826c8 100644
--- a/roles/kubernetes-net/templates/ifupdown.sh.j2
+++ b/roles/kubernetes-net/templates/ifupdown.sh.j2
@@ -8,12 +8,13 @@ INET_IF="{{ ansible_default_ipv4.interface }}"
POD_NET_CIDR="{{ kubernetes.pod_ip_range }}"
+{% set br_net = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubernetes.net_index[inventory_hostname]) -%}
BR_IF="kube-br0"
-BR_IP_CIDR="{{ kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubernetes.net_index[inventory_hostname]) | ipaddr(1) }}"
-BR_NET_CIDR="{{ kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubernetes.net_index[inventory_hostname]) }}"
+BR_IP="{{ br_net | ipaddr(1) | ipaddr('address') }}"
+BR_IP_CIDR="{{ br_net | ipaddr(1) }}"
+BR_NET_CIDR="{{ br_net }}"
TUN_IF="kube-wg0"
-TUN_IP="{{ kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, 0) | ipaddr(kubernetes.net_index[inventory_hostname]) | ipaddr('address') }}"
TUN_IP_CIDR="{{ kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, 0) | ipaddr(kubernetes.net_index[inventory_hostname]) }}"
@@ -36,7 +37,10 @@ case "$1" in
ip addr add dev "$TUN_IF" "$TUN_IP_CIDR"
wg set "$TUN_IF" listen-port {{ kubenet_wireguard_port }} private-key "$CONF_D/$TUN_IF.privatekey"
ip link set up dev "$TUN_IF"
- ip route add "$POD_NET_CIDR" dev "$TUN_IF" src "$TUN_IP"
+
+ # make pods and service IPs reachable
+ # !!! use IP of bridge as source so we don't produce martians if direct-zones are involved!!!
+ ip route add "$POD_NET_CIDR" dev "$TUN_IF" src "$BR_IP"
;;
down)
# bring down wireguard tunnel to other nodes