summaryrefslogtreecommitdiff
path: root/roles
diff options
context:
space:
mode:
Diffstat (limited to 'roles')
-rw-r--r--roles/kubernetes/kubeadm/base/filter_plugins/net_kubeguard.py (renamed from roles/kubernetes/net/kubeguard/node/filter_plugins/kubeguard.py)6
-rw-r--r--roles/kubernetes/kubeadm/base/tasks/net_kubeguard.yml77
-rw-r--r--roles/kubernetes/kubeadm/base/templates/net_kubeguard/ifupdown.sh.j2 (renamed from roles/kubernetes/net/kubeguard/node/templates/ifupdown.sh.j2)2
-rw-r--r--roles/kubernetes/kubeadm/base/templates/net_kubeguard/k8s.json.j2 (renamed from roles/kubernetes/net/kubeguard/node/templates/k8s.json.j2)0
-rw-r--r--roles/kubernetes/kubeadm/base/templates/net_kubeguard/kubeguard-interfaces.service.j2 (renamed from roles/kubernetes/net/kubeguard/node/files/kubeguard-interfaces.service)0
-rw-r--r--roles/kubernetes/kubeadm/base/templates/net_kubeguard/kubeguard-peer.service.j2 (renamed from roles/kubernetes/net/kubeguard/node/templates/kubeguard-peer.service.j2)4
-rw-r--r--roles/kubernetes/net/kubeguard/node/handlers/main.yml4
-rw-r--r--roles/kubernetes/net/kubeguard/node/tasks/main.yml80
8 files changed, 83 insertions, 90 deletions
diff --git a/roles/kubernetes/net/kubeguard/node/filter_plugins/kubeguard.py b/roles/kubernetes/kubeadm/base/filter_plugins/net_kubeguard.py
index 199ff14b..2220e545 100644
--- a/roles/kubernetes/net/kubeguard/node/filter_plugins/kubeguard.py
+++ b/roles/kubernetes/kubeadm/base/filter_plugins/net_kubeguard.py
@@ -4,7 +4,7 @@ __metaclass__ = type
from ansible import errors
-def direct_net_zone(data, myname, peer):
+def kubeguard_direct_net_zone(data, myname, peer):
try:
zones = []
for zone in data:
@@ -19,14 +19,14 @@ def direct_net_zone(data, myname, peer):
return zones[0]
except Exception as e:
- raise errors.AnsibleFilterError("direct_net_zones(): %s" % str(e))
+ raise errors.AnsibleFilterError("kubeguard_direct_net_zones(): %s" % str(e))
class FilterModule(object):
''' Kubeguard Network Filters '''
filter_map = {
- 'direct_net_zone': direct_net_zone,
+ 'kubeguard_direct_net_zone': kubeguard_direct_net_zone,
}
def filters(self):
diff --git a/roles/kubernetes/kubeadm/base/tasks/net_kubeguard.yml b/roles/kubernetes/kubeadm/base/tasks/net_kubeguard.yml
index 0924c458..8c5f5065 100644
--- a/roles/kubernetes/kubeadm/base/tasks/net_kubeguard.yml
+++ b/roles/kubernetes/kubeadm/base/tasks/net_kubeguard.yml
@@ -5,3 +5,80 @@
msg: "this network plugin can not replace kube-proxy please set kubernetes_network_plugin_replaces_kube_proxy to false."
that:
- not kubernetes_network_plugin_replaces_kube_proxy
+
+
+- name: install wireguard
+ import_role:
+ name: wireguard/base
+
+- name: create network config directory
+ file:
+ name: /var/lib/kubeguard/
+ state: directory
+
+- name: install ifupdown script
+ template:
+ src: net_kubeguard/ifupdown.sh.j2
+ dest: /var/lib/kubeguard/ifupdown.sh
+ mode: 0755
+ # TODO: notify reload... this is unfortunately already to late because
+ # it must probably be brought down by the old version of the script
+
+- name: generate wireguard private key
+ shell: "umask 077; wg genkey > /var/lib/kubeguard/kube-wg0.privatekey"
+ args:
+ creates: /var/lib/kubeguard/kube-wg0.privatekey
+
+- name: fetch wireguard public key
+ shell: "wg pubkey < /var/lib/kubeguard/kube-wg0.privatekey"
+ register: kubeguard_wireguard_pubkey
+ changed_when: false
+ check_mode: no
+
+- name: install systemd service unit for network interfaces
+ template:
+ src: net_kubeguard/kubeguard-interfaces.service.j2
+ dest: /etc/systemd/system/kubeguard-interfaces.service
+ # TODO: notify: reload???
+
+- name: make sure kubeguard interfaces service is started and enabled
+ systemd:
+ daemon_reload: yes
+ name: kubeguard-interfaces.service
+ state: started
+ enabled: yes
+
+- name: install systemd units for every kubeguard peer
+ loop: "{{ groups['_kubernetes_nodes_'] | difference(inventory_hostname) }}"
+ loop_control:
+ loop_var: peer
+ template:
+ src: net_kubeguard/kubeguard-peer.service.j2
+ dest: "/etc/systemd/system/kubeguard-peer-{{ peer }}.service"
+ # TODO: notify restart for peers that change...
+
+- name: make sure kubeguard peer services are started and enabled
+ loop: "{{ groups['_kubernetes_nodes_'] | difference(inventory_hostname) }}"
+ systemd:
+ daemon_reload: yes
+ name: "kubeguard-peer-{{ item }}.service"
+ state: started
+ enabled: yes
+
+- name: enable IPv4 forwarding
+ sysctl:
+ name: net.ipv4.ip_forward
+ value: '1'
+ sysctl_set: yes
+ state: present
+ reload: yes
+
+- name: create cni config directory
+ file:
+ name: /etc/cni/net.d
+ state: directory
+
+- name: install cni config
+ template:
+ src: net_kubeguard/k8s.json.j2
+ dest: /etc/cni/net.d/kubeguard.json
diff --git a/roles/kubernetes/net/kubeguard/node/templates/ifupdown.sh.j2 b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/ifupdown.sh.j2
index 98b38cf4..d8153102 100644
--- a/roles/kubernetes/net/kubeguard/node/templates/ifupdown.sh.j2
+++ b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/ifupdown.sh.j2
@@ -30,7 +30,7 @@ case "$1" in
# bring up wireguard tunnel to other nodes
ip link add dev "$TUN_IF" type wireguard
ip addr add dev "$TUN_IF" "$TUN_IP_CIDR"
- wg set "$TUN_IF" listen-port {{ kubeguard_wireguard_port }} private-key "$CONF_D/$TUN_IF.privatekey"
+ wg set "$TUN_IF" listen-port {{ kubeguard_wireguard_port | default(51820) }} private-key "$CONF_D/$TUN_IF.privatekey"
ip link set up dev "$TUN_IF"
# make pods and service IPs reachable
diff --git a/roles/kubernetes/net/kubeguard/node/templates/k8s.json.j2 b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/k8s.json.j2
index 65b1357a..65b1357a 100644
--- a/roles/kubernetes/net/kubeguard/node/templates/k8s.json.j2
+++ b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/k8s.json.j2
diff --git a/roles/kubernetes/net/kubeguard/node/files/kubeguard-interfaces.service b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/kubeguard-interfaces.service.j2
index 35fc8f90..35fc8f90 100644
--- a/roles/kubernetes/net/kubeguard/node/files/kubeguard-interfaces.service
+++ b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/kubeguard-interfaces.service.j2
diff --git a/roles/kubernetes/net/kubeguard/node/templates/kubeguard-peer.service.j2 b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/kubeguard-peer.service.j2
index 0503ca03..92300253 100644
--- a/roles/kubernetes/net/kubeguard/node/templates/kubeguard-peer.service.j2
+++ b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/kubeguard-peer.service.j2
@@ -6,7 +6,7 @@ After=kubeguard-interfaces.service
{% set pod_ip_self = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubeguard.node_index[inventory_hostname]) | ipaddr(1) | ipaddr('address') -%}
{% set pod_net_peer = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubeguard.node_index[peer]) -%}
-{% set direct_zone = kubeguard.direct_net_zones | default({}) | direct_net_zone(inventory_hostname, peer) -%}
+{% set direct_zone = kubeguard.direct_net_zones | default({}) | kubeguard_direct_net_zone(inventory_hostname, peer) -%}
{% if direct_zone %}
{% set direct_ip = kubeguard.direct_net_zones[direct_zone].transfer_net | ipaddr(kubeguard.node_index[inventory_hostname]) %}
{% set direct_interface = kubeguard.direct_net_zones[direct_zone].node_interface[inventory_hostname] %}
@@ -15,7 +15,7 @@ After=kubeguard-interfaces.service
{% set tun_ip = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, 0) | ipaddr(kubeguard.node_index[peer]) -%}
{% set wg_pubkey = hostvars[peer].kubeguard_wireguard_pubkey.stdout -%}
{% set wg_host = hostvars[peer].external_ip_cooked | default(hostvars[peer].ansible_default_ipv4.address) -%}
-{% set wg_port = hostvars[peer].kubeguard_wireguard_port -%}
+{% set wg_port = hostvars[peer].kubeguard_wireguard_port | default(51820) -%}
{% set wg_allowedips = (tun_ip | ipaddr('address')) + "/32," + pod_net_peer %}
{% endif %}
[Service]
diff --git a/roles/kubernetes/net/kubeguard/node/handlers/main.yml b/roles/kubernetes/net/kubeguard/node/handlers/main.yml
deleted file mode 100644
index bb7fde2b..00000000
--- a/roles/kubernetes/net/kubeguard/node/handlers/main.yml
+++ /dev/null
@@ -1,4 +0,0 @@
----
-- name: reload systemd
- systemd:
- daemon_reload: yes
diff --git a/roles/kubernetes/net/kubeguard/node/tasks/main.yml b/roles/kubernetes/net/kubeguard/node/tasks/main.yml
deleted file mode 100644
index 72814e06..00000000
--- a/roles/kubernetes/net/kubeguard/node/tasks/main.yml
+++ /dev/null
@@ -1,80 +0,0 @@
----
-- name: install wireguard
- import_role:
- name: wireguard/base
-
-- name: create network config directory
- file:
- name: /var/lib/kubeguard/
- state: directory
-
-- name: configure wireguard port
- set_fact:
- kubeguard_wireguard_port: "{{ kubernetes.wireguard_port | default(51820) }}"
-
-- name: install ifupdown script
- template:
- src: ifupdown.sh.j2
- dest: /var/lib/kubeguard/ifupdown.sh
- mode: 0755
- # TODO: notify reload... this is unfortunately already to late because
- # it must probably be brought down by the old version of the script
-
-- name: generate wireguard private key
- shell: "umask 077; wg genkey > /var/lib/kubeguard/kube-wg0.privatekey"
- args:
- creates: /var/lib/kubeguard/kube-wg0.privatekey
-
-- name: fetch wireguard public key
- shell: "wg pubkey < /var/lib/kubeguard/kube-wg0.privatekey"
- register: kubeguard_wireguard_pubkey
- changed_when: false
- check_mode: no
-
-- name: install systemd service unit for network interfaces
- copy:
- src: kubeguard-interfaces.service
- dest: /etc/systemd/system/kubeguard-interfaces.service
- # TODO: notify: reload???
-
-- name: make sure kubeguard interfaces service is started and enabled
- systemd:
- daemon_reload: yes
- name: kubeguard-interfaces.service
- state: started
- enabled: yes
-
-- name: install systemd units for every kubeguard peer
- loop: "{{ groups['_kubernetes_nodes_'] | difference(inventory_hostname) }}"
- loop_control:
- loop_var: peer
- template:
- src: kubeguard-peer.service.j2
- dest: "/etc/systemd/system/kubeguard-peer-{{ peer }}.service"
- # TODO: notify restart for peers that change...
-
-- name: make sure kubeguard peer services are started and enabled
- loop: "{{ groups['_kubernetes_nodes_'] | difference(inventory_hostname) }}"
- systemd:
- daemon_reload: yes
- name: "kubeguard-peer-{{ item }}.service"
- state: started
- enabled: yes
-
-- name: enable IPv4 forwarding
- sysctl:
- name: net.ipv4.ip_forward
- value: '1'
- sysctl_set: yes
- state: present
- reload: yes
-
-- name: create cni config directory
- file:
- name: /etc/cni/net.d
- state: directory
-
-- name: install cni config
- template:
- src: k8s.json.j2
- dest: /etc/cni/net.d/k8s.json