diff options
Diffstat (limited to 'roles')
8 files changed, 83 insertions, 90 deletions
diff --git a/roles/kubernetes/net/kubeguard/node/filter_plugins/kubeguard.py b/roles/kubernetes/kubeadm/base/filter_plugins/net_kubeguard.py index 199ff14b..2220e545 100644 --- a/roles/kubernetes/net/kubeguard/node/filter_plugins/kubeguard.py +++ b/roles/kubernetes/kubeadm/base/filter_plugins/net_kubeguard.py @@ -4,7 +4,7 @@ __metaclass__ = type from ansible import errors -def direct_net_zone(data, myname, peer): +def kubeguard_direct_net_zone(data, myname, peer): try: zones = [] for zone in data: @@ -19,14 +19,14 @@ def direct_net_zone(data, myname, peer): return zones[0] except Exception as e: - raise errors.AnsibleFilterError("direct_net_zones(): %s" % str(e)) + raise errors.AnsibleFilterError("kubeguard_direct_net_zones(): %s" % str(e)) class FilterModule(object): ''' Kubeguard Network Filters ''' filter_map = { - 'direct_net_zone': direct_net_zone, + 'kubeguard_direct_net_zone': kubeguard_direct_net_zone, } def filters(self): diff --git a/roles/kubernetes/kubeadm/base/tasks/net_kubeguard.yml b/roles/kubernetes/kubeadm/base/tasks/net_kubeguard.yml index 0924c458..8c5f5065 100644 --- a/roles/kubernetes/kubeadm/base/tasks/net_kubeguard.yml +++ b/roles/kubernetes/kubeadm/base/tasks/net_kubeguard.yml @@ -5,3 +5,80 @@ msg: "this network plugin can not replace kube-proxy please set kubernetes_network_plugin_replaces_kube_proxy to false." that: - not kubernetes_network_plugin_replaces_kube_proxy + + +- name: install wireguard + import_role: + name: wireguard/base + +- name: create network config directory + file: + name: /var/lib/kubeguard/ + state: directory + +- name: install ifupdown script + template: + src: net_kubeguard/ifupdown.sh.j2 + dest: /var/lib/kubeguard/ifupdown.sh + mode: 0755 + # TODO: notify reload... this is unfortunately already to late because + # it must probably be brought down by the old version of the script + +- name: generate wireguard private key + shell: "umask 077; wg genkey > /var/lib/kubeguard/kube-wg0.privatekey" + args: + creates: /var/lib/kubeguard/kube-wg0.privatekey + +- name: fetch wireguard public key + shell: "wg pubkey < /var/lib/kubeguard/kube-wg0.privatekey" + register: kubeguard_wireguard_pubkey + changed_when: false + check_mode: no + +- name: install systemd service unit for network interfaces + template: + src: net_kubeguard/kubeguard-interfaces.service.j2 + dest: /etc/systemd/system/kubeguard-interfaces.service + # TODO: notify: reload??? + +- name: make sure kubeguard interfaces service is started and enabled + systemd: + daemon_reload: yes + name: kubeguard-interfaces.service + state: started + enabled: yes + +- name: install systemd units for every kubeguard peer + loop: "{{ groups['_kubernetes_nodes_'] | difference(inventory_hostname) }}" + loop_control: + loop_var: peer + template: + src: net_kubeguard/kubeguard-peer.service.j2 + dest: "/etc/systemd/system/kubeguard-peer-{{ peer }}.service" + # TODO: notify restart for peers that change... + +- name: make sure kubeguard peer services are started and enabled + loop: "{{ groups['_kubernetes_nodes_'] | difference(inventory_hostname) }}" + systemd: + daemon_reload: yes + name: "kubeguard-peer-{{ item }}.service" + state: started + enabled: yes + +- name: enable IPv4 forwarding + sysctl: + name: net.ipv4.ip_forward + value: '1' + sysctl_set: yes + state: present + reload: yes + +- name: create cni config directory + file: + name: /etc/cni/net.d + state: directory + +- name: install cni config + template: + src: net_kubeguard/k8s.json.j2 + dest: /etc/cni/net.d/kubeguard.json diff --git a/roles/kubernetes/net/kubeguard/node/templates/ifupdown.sh.j2 b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/ifupdown.sh.j2 index 98b38cf4..d8153102 100644 --- a/roles/kubernetes/net/kubeguard/node/templates/ifupdown.sh.j2 +++ b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/ifupdown.sh.j2 @@ -30,7 +30,7 @@ case "$1" in # bring up wireguard tunnel to other nodes ip link add dev "$TUN_IF" type wireguard ip addr add dev "$TUN_IF" "$TUN_IP_CIDR" - wg set "$TUN_IF" listen-port {{ kubeguard_wireguard_port }} private-key "$CONF_D/$TUN_IF.privatekey" + wg set "$TUN_IF" listen-port {{ kubeguard_wireguard_port | default(51820) }} private-key "$CONF_D/$TUN_IF.privatekey" ip link set up dev "$TUN_IF" # make pods and service IPs reachable diff --git a/roles/kubernetes/net/kubeguard/node/templates/k8s.json.j2 b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/k8s.json.j2 index 65b1357a..65b1357a 100644 --- a/roles/kubernetes/net/kubeguard/node/templates/k8s.json.j2 +++ b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/k8s.json.j2 diff --git a/roles/kubernetes/net/kubeguard/node/files/kubeguard-interfaces.service b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/kubeguard-interfaces.service.j2 index 35fc8f90..35fc8f90 100644 --- a/roles/kubernetes/net/kubeguard/node/files/kubeguard-interfaces.service +++ b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/kubeguard-interfaces.service.j2 diff --git a/roles/kubernetes/net/kubeguard/node/templates/kubeguard-peer.service.j2 b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/kubeguard-peer.service.j2 index 0503ca03..92300253 100644 --- a/roles/kubernetes/net/kubeguard/node/templates/kubeguard-peer.service.j2 +++ b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/kubeguard-peer.service.j2 @@ -6,7 +6,7 @@ After=kubeguard-interfaces.service {% set pod_ip_self = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubeguard.node_index[inventory_hostname]) | ipaddr(1) | ipaddr('address') -%} {% set pod_net_peer = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubeguard.node_index[peer]) -%} -{% set direct_zone = kubeguard.direct_net_zones | default({}) | direct_net_zone(inventory_hostname, peer) -%} +{% set direct_zone = kubeguard.direct_net_zones | default({}) | kubeguard_direct_net_zone(inventory_hostname, peer) -%} {% if direct_zone %} {% set direct_ip = kubeguard.direct_net_zones[direct_zone].transfer_net | ipaddr(kubeguard.node_index[inventory_hostname]) %} {% set direct_interface = kubeguard.direct_net_zones[direct_zone].node_interface[inventory_hostname] %} @@ -15,7 +15,7 @@ After=kubeguard-interfaces.service {% set tun_ip = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, 0) | ipaddr(kubeguard.node_index[peer]) -%} {% set wg_pubkey = hostvars[peer].kubeguard_wireguard_pubkey.stdout -%} {% set wg_host = hostvars[peer].external_ip_cooked | default(hostvars[peer].ansible_default_ipv4.address) -%} -{% set wg_port = hostvars[peer].kubeguard_wireguard_port -%} +{% set wg_port = hostvars[peer].kubeguard_wireguard_port | default(51820) -%} {% set wg_allowedips = (tun_ip | ipaddr('address')) + "/32," + pod_net_peer %} {% endif %} [Service] diff --git a/roles/kubernetes/net/kubeguard/node/handlers/main.yml b/roles/kubernetes/net/kubeguard/node/handlers/main.yml deleted file mode 100644 index bb7fde2b..00000000 --- a/roles/kubernetes/net/kubeguard/node/handlers/main.yml +++ /dev/null @@ -1,4 +0,0 @@ ---- -- name: reload systemd - systemd: - daemon_reload: yes diff --git a/roles/kubernetes/net/kubeguard/node/tasks/main.yml b/roles/kubernetes/net/kubeguard/node/tasks/main.yml deleted file mode 100644 index 72814e06..00000000 --- a/roles/kubernetes/net/kubeguard/node/tasks/main.yml +++ /dev/null @@ -1,80 +0,0 @@ ---- -- name: install wireguard - import_role: - name: wireguard/base - -- name: create network config directory - file: - name: /var/lib/kubeguard/ - state: directory - -- name: configure wireguard port - set_fact: - kubeguard_wireguard_port: "{{ kubernetes.wireguard_port | default(51820) }}" - -- name: install ifupdown script - template: - src: ifupdown.sh.j2 - dest: /var/lib/kubeguard/ifupdown.sh - mode: 0755 - # TODO: notify reload... this is unfortunately already to late because - # it must probably be brought down by the old version of the script - -- name: generate wireguard private key - shell: "umask 077; wg genkey > /var/lib/kubeguard/kube-wg0.privatekey" - args: - creates: /var/lib/kubeguard/kube-wg0.privatekey - -- name: fetch wireguard public key - shell: "wg pubkey < /var/lib/kubeguard/kube-wg0.privatekey" - register: kubeguard_wireguard_pubkey - changed_when: false - check_mode: no - -- name: install systemd service unit for network interfaces - copy: - src: kubeguard-interfaces.service - dest: /etc/systemd/system/kubeguard-interfaces.service - # TODO: notify: reload??? - -- name: make sure kubeguard interfaces service is started and enabled - systemd: - daemon_reload: yes - name: kubeguard-interfaces.service - state: started - enabled: yes - -- name: install systemd units for every kubeguard peer - loop: "{{ groups['_kubernetes_nodes_'] | difference(inventory_hostname) }}" - loop_control: - loop_var: peer - template: - src: kubeguard-peer.service.j2 - dest: "/etc/systemd/system/kubeguard-peer-{{ peer }}.service" - # TODO: notify restart for peers that change... - -- name: make sure kubeguard peer services are started and enabled - loop: "{{ groups['_kubernetes_nodes_'] | difference(inventory_hostname) }}" - systemd: - daemon_reload: yes - name: "kubeguard-peer-{{ item }}.service" - state: started - enabled: yes - -- name: enable IPv4 forwarding - sysctl: - name: net.ipv4.ip_forward - value: '1' - sysctl_set: yes - state: present - reload: yes - -- name: create cni config directory - file: - name: /etc/cni/net.d - state: directory - -- name: install cni config - template: - src: k8s.json.j2 - dest: /etc/cni/net.d/k8s.json |