From ac2c15fe06f00f1432c169f520c5db10231ec4f0 Mon Sep 17 00:00:00 2001 From: Christian Pointner Date: Sat, 17 Feb 2018 19:09:51 +0100 Subject: fix source martions for service-ips and host-network pods --- roles/kubernetes-net/templates/ifupdown.sh.j2 | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) (limited to 'roles/kubernetes-net') diff --git a/roles/kubernetes-net/templates/ifupdown.sh.j2 b/roles/kubernetes-net/templates/ifupdown.sh.j2 index 701128f3..3f6826c8 100644 --- a/roles/kubernetes-net/templates/ifupdown.sh.j2 +++ b/roles/kubernetes-net/templates/ifupdown.sh.j2 @@ -8,12 +8,13 @@ INET_IF="{{ ansible_default_ipv4.interface }}" POD_NET_CIDR="{{ kubernetes.pod_ip_range }}" +{% set br_net = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubernetes.net_index[inventory_hostname]) -%} BR_IF="kube-br0" -BR_IP_CIDR="{{ kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubernetes.net_index[inventory_hostname]) | ipaddr(1) }}" -BR_NET_CIDR="{{ kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubernetes.net_index[inventory_hostname]) }}" +BR_IP="{{ br_net | ipaddr(1) | ipaddr('address') }}" +BR_IP_CIDR="{{ br_net | ipaddr(1) }}" +BR_NET_CIDR="{{ br_net }}" TUN_IF="kube-wg0" -TUN_IP="{{ kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, 0) | ipaddr(kubernetes.net_index[inventory_hostname]) | ipaddr('address') }}" TUN_IP_CIDR="{{ kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, 0) | ipaddr(kubernetes.net_index[inventory_hostname]) }}" @@ -36,7 +37,10 @@ case "$1" in ip addr add dev "$TUN_IF" "$TUN_IP_CIDR" wg set "$TUN_IF" listen-port {{ kubenet_wireguard_port }} private-key "$CONF_D/$TUN_IF.privatekey" ip link set up dev "$TUN_IF" - ip route add "$POD_NET_CIDR" dev "$TUN_IF" src "$TUN_IP" + + # make pods and service IPs reachable + # !!! use IP of bridge as source so we don't produce martians if direct-zones are involved!!! + ip route add "$POD_NET_CIDR" dev "$TUN_IF" src "$BR_IP" ;; down) # bring down wireguard tunnel to other nodes -- cgit v1.2.3