From aef8d86e4b1fc2970e27e578a6dd92ae3024f933 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Thu, 24 May 2018 23:53:00 +0200
Subject: move kubernetes roles to subdir

---
 roles/kubernetes-net/files/daemon.json             |   4 -
 .../files/kubenet-interfaces.service               |  12 ---
 roles/kubernetes-net/filter_plugins/kubenet.py     |  33 ------
 roles/kubernetes-net/handlers/main.yml             |   4 -
 roles/kubernetes-net/meta/main.yml                 |   4 -
 roles/kubernetes-net/tasks/add.yml                 | 114 ---------------------
 roles/kubernetes-net/tasks/main.yml                |   8 --
 roles/kubernetes-net/tasks/remove.yml              |  28 -----
 roles/kubernetes-net/templates/ifupdown.sh.j2      |  55 ----------
 roles/kubernetes-net/templates/k8s.json.j2         |  12 ---
 .../templates/kubenet-peer.service.j2              |  36 -------
 11 files changed, 310 deletions(-)
 delete mode 100644 roles/kubernetes-net/files/daemon.json
 delete mode 100644 roles/kubernetes-net/files/kubenet-interfaces.service
 delete mode 100644 roles/kubernetes-net/filter_plugins/kubenet.py
 delete mode 100644 roles/kubernetes-net/handlers/main.yml
 delete mode 100644 roles/kubernetes-net/meta/main.yml
 delete mode 100644 roles/kubernetes-net/tasks/add.yml
 delete mode 100644 roles/kubernetes-net/tasks/main.yml
 delete mode 100644 roles/kubernetes-net/tasks/remove.yml
 delete mode 100644 roles/kubernetes-net/templates/ifupdown.sh.j2
 delete mode 100644 roles/kubernetes-net/templates/k8s.json.j2
 delete mode 100644 roles/kubernetes-net/templates/kubenet-peer.service.j2

(limited to 'roles/kubernetes-net')

diff --git a/roles/kubernetes-net/files/daemon.json b/roles/kubernetes-net/files/daemon.json
deleted file mode 100644
index 28001640..00000000
--- a/roles/kubernetes-net/files/daemon.json
+++ /dev/null
@@ -1,4 +0,0 @@
-{
-  "bridge": "none",
-  "iptables": false
-}
diff --git a/roles/kubernetes-net/files/kubenet-interfaces.service b/roles/kubernetes-net/files/kubenet-interfaces.service
deleted file mode 100644
index f27fb85b..00000000
--- a/roles/kubernetes-net/files/kubenet-interfaces.service
+++ /dev/null
@@ -1,12 +0,0 @@
-[Unit]
-Description=Kubernetes Network Interfaces
-After=network.target
-
-[Service]
-Type=oneshot
-ExecStart=/var/lib/kubenet/ifupdown.sh up
-ExecStop=/var/lib/kubenet/ifupdown.sh down
-RemainAfterExit=yes
-
-[Install]
-WantedBy=multi-user.target
diff --git a/roles/kubernetes-net/filter_plugins/kubenet.py b/roles/kubernetes-net/filter_plugins/kubenet.py
deleted file mode 100644
index c1312dd8..00000000
--- a/roles/kubernetes-net/filter_plugins/kubenet.py
+++ /dev/null
@@ -1,33 +0,0 @@
-from __future__ import (absolute_import, division, print_function)
-__metaclass__ = type
-
-from ansible import errors
-
-
-def direct_net_zone(data, myname, peer):
-    try:
-        zones = []
-        for zone in data:
-            if myname in data[zone]['node_interface'] and peer in data[zone]['node_interface']:
-                zones.append(zone)
-
-        if not zones:
-            return ""
-        if len(zones) > 1:
-            raise errors.AnsibleFilterError("host '%s' and '%s' have multiple direct net zones in common: %s" %
-                                            (myname, peer, zones.join(',')))
-        return zones[0]
-
-    except Exception as e:
-        raise errors.AnsibleFilterError("direct_net_zones(): %s" % str(e))
-
-
-class FilterModule(object):
-
-    ''' Kubernetes Network Filters '''
-    filter_map = {
-        'direct_net_zone': direct_net_zone,
-    }
-
-    def filters(self):
-        return self.filter_map
diff --git a/roles/kubernetes-net/handlers/main.yml b/roles/kubernetes-net/handlers/main.yml
deleted file mode 100644
index bb7fde2b..00000000
--- a/roles/kubernetes-net/handlers/main.yml
+++ /dev/null
@@ -1,4 +0,0 @@
----
-- name: reload systemd
-  systemd:
-    daemon_reload: yes
diff --git a/roles/kubernetes-net/meta/main.yml b/roles/kubernetes-net/meta/main.yml
deleted file mode 100644
index 03dfcb23..00000000
--- a/roles/kubernetes-net/meta/main.yml
+++ /dev/null
@@ -1,4 +0,0 @@
----
-dependencies:
-- role: wireguard
-  when: k8s_remove_node is not defined
diff --git a/roles/kubernetes-net/tasks/add.yml b/roles/kubernetes-net/tasks/add.yml
deleted file mode 100644
index f4e422c6..00000000
--- a/roles/kubernetes-net/tasks/add.yml
+++ /dev/null
@@ -1,114 +0,0 @@
----
-- name: create docker config directory
-  file:
-    name: /etc/docker
-    state: directory
-    mode: 0700
-
-- name: disable docker iptables and bridge
-  copy:
-    src: daemon.json
-    dest: /etc/docker/daemon.json
-
-- name: create network config directory
-  file:
-    name: /var/lib/kubenet/
-    state: directory
-
-- name: configure wireguard port
-  set_fact:
-    kubenet_wireguard_port: "{{ kubernetes.wireguard_port | default(51820) }}"
-
-- name: install ifupdown script
-  template:
-    src: ifupdown.sh.j2
-    dest: /var/lib/kubenet/ifupdown.sh
-    mode: 0755
-  # TODO: notify reload... this is unfortunately already to late because
-  #                        it must probably be brought down by the old version of the script
-
-- name: generate wireguard private key
-  shell: "umask 077; wg genkey > /var/lib/kubenet/kube-wg0.privatekey"
-  args:
-    creates: /var/lib/kubenet/kube-wg0.privatekey
-
-- name: fetch wireguard public key
-  shell: "wg pubkey < /var/lib/kubenet/kube-wg0.privatekey"
-  register: kubenet_wireguard_pubkey
-  changed_when: false
-  check_mode: no
-
-- name: install systemd service unit for network interfaces
-  copy:
-    src: kubenet-interfaces.service
-    dest: /etc/systemd/system/kubenet-interfaces.service
-  # TODO: notify: reload???
-
-- name: make sure kubenet interfaces service is started and enabled
-  systemd:
-    daemon_reload: yes
-    name: kubenet-interfaces.service
-    state: started
-    enabled: yes
-
-- name: get list of currently installed kubenet peers
-  find:
-    path: /etc/systemd/system/
-    pattern: "kubenet-peer-*.service"
-  register: kubenet_peers_installed
-
-- name: compute list of peers to be added
-  set_fact:
-    kubenet_peers_to_add: "{{ kubernetes_nodes | difference(inventory_hostname) }}"
-
-- name: compute list of peers to be removed
-  set_fact:
-    kubenet_peers_to_remove: "{{ kubenet_peers_installed.files | map(attribute='path') | map('replace', '/etc/systemd/system/kubenet-peer-', '') | map('replace', '.service', '') | difference(kubenet_peers_to_add) }}"
-
-- name: stop/disable systemd units for stale kubenet peers
-  with_items: "{{ kubenet_peers_to_remove }}"
-  systemd:
-    name: "kubenet-peer-{{ item }}.service"
-    state: stopped
-    enabled: no
-
-- name: remove systemd units for stale kubenet peers
-  with_items: "{{ kubenet_peers_to_remove }}"
-  file:
-    name: "/etc/systemd/system/kubenet-peer-{{ item }}.service"
-    state: absent
-
-- name: install systemd units for every kubenet peer
-  with_items: "{{ kubenet_peers_to_add }}"
-  loop_control:
-    loop_var: peer
-  template:
-    src: kubenet-peer.service.j2
-    dest: "/etc/systemd/system/kubenet-peer-{{ peer }}.service"
-  # TODO: notify restart for peers that change...
-
-- name: make sure kubenet peer services are started and enabled
-  with_items: "{{ kubenet_peers_to_add }}"
-  systemd:
-    daemon_reload: yes
-    name: "kubenet-peer-{{ item }}.service"
-    state: started
-    enabled: yes
-
-- name: enable IPv4 forwarding
-  sysctl:
-    name: net.ipv4.ip_forward
-    value: 1
-    sysctl_set: yes
-    state: present
-    reload: yes
-
-- name: create cni config directory
-  file:
-    name: /etc/cni/net.d
-    state: directory
-
-- name: install cni config
-  template:
-    src: k8s.json.j2
-    dest: /etc/cni/net.d/k8s.json
diff --git a/roles/kubernetes-net/tasks/main.yml b/roles/kubernetes-net/tasks/main.yml
deleted file mode 100644
index 8c94292e..00000000
--- a/roles/kubernetes-net/tasks/main.yml
+++ /dev/null
@@ -1,8 +0,0 @@
----
-- name: add node to overlay network
-  include_tasks: add.yml
-  when: k8s_remove_node is not defined
-
-- name: remove node from overlay network
-  include_tasks: remove.yml
-  when: k8s_remove_node is defined
diff --git a/roles/kubernetes-net/tasks/remove.yml b/roles/kubernetes-net/tasks/remove.yml
deleted file mode 100644
index 6695bd5d..00000000
--- a/roles/kubernetes-net/tasks/remove.yml
+++ /dev/null
@@ -1,28 +0,0 @@
----
-- name: check if kubenet interface service unit exists
-  stat:
-    path: /etc/systemd/system/kubenet-interfaces.service
-  register: kubenet_interface_unit
-
-- name: bring down kubenet interface
-  systemd:
-    name: kubenet-interfaces.service
-    state: stopped
-  when: kubenet_interface_unit.stat.exists
-
-- name: gather list of all kubenet related service units
-  find:
-    path: /etc/systemd/system/
-    patterns:
-      - "kubenet-peer-*.service"
-      - kubenet-interfaces.service
-  register: kubenet_units_installed
-
-- name: remove all kubenet related files and directories
-  with_flattened:
-  - "{{ kubenet_units_installed.files | map(attribute='path') | list }}"
-  - /var/lib/kubenet
-  file:
-    path: "{{ item }}"
-    state: absent
-  notify: reload systemd
diff --git a/roles/kubernetes-net/templates/ifupdown.sh.j2 b/roles/kubernetes-net/templates/ifupdown.sh.j2
deleted file mode 100644
index 995d358b..00000000
--- a/roles/kubernetes-net/templates/ifupdown.sh.j2
+++ /dev/null
@@ -1,55 +0,0 @@
-#!/bin/bash
-
-set -e
-
-CONF_D="/var/lib/kubenet/"
-
-INET_IF="{{ ansible_default_ipv4.interface }}"
-
-POD_NET_CIDR="{{ kubernetes.pod_ip_range }}"
-
-{% set br_net = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubernetes.net_index[inventory_hostname]) -%}
-BR_IF="kube-br0"
-BR_IP="{{ br_net | ipaddr(1) | ipaddr('address')  }}"
-BR_IP_CIDR="{{ br_net | ipaddr(1) }}"
-BR_NET_CIDR="{{ br_net }}"
-
-TUN_IF="kube-wg0"
-TUN_IP_CIDR="{{ kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, 0) | ipaddr(kubernetes.net_index[inventory_hostname]) }}"
-
-
-case "$1" in
-  up)
-    # bring up bridge for local pods
-    ip link add dev "$BR_IF" type bridge
-    ip addr add dev "$BR_IF" "$BR_IP_CIDR"
-    ip link set up dev "$BR_IF"
-    iptables -t nat -A POSTROUTING -s "$BR_NET_CIDR" -o "$INET_IF" -j MASQUERADE
-    modprobe br_netfilter
-
-    # bring up wireguard tunnel to other nodes
-    ip link add dev "$TUN_IF" type wireguard
-    ip addr add dev "$TUN_IF" "$TUN_IP_CIDR"
-    wg set "$TUN_IF" listen-port {{ kubenet_wireguard_port }} private-key "$CONF_D/$TUN_IF.privatekey"
-    ip link set up dev "$TUN_IF"
-
-    # make pods and service IPs reachable
-    # !!! use IP of bridge as source so we don't produce martians if direct-zones are involved!!!
-    ip route add "$POD_NET_CIDR" dev "$TUN_IF" src "$BR_IP"
-    ;;
-  down)
-    # bring down wireguard tunnel to other nodes
-    ip route del "$POD_NET_CIDR" dev "$TUN_IF"
-    ip link del dev "$TUN_IF"
-
-    # bring down bridge for local pods
-    iptables -t nat -D POSTROUTING -s "$BR_NET_CIDR" -o "$INET_IF" -j MASQUERADE
-    ip link del dev "$BR_IF"
-    ;;
-  *)
-    echo "usage: $0 (up|down)"
-    exit 1
-    ;;
-esac
-
-exit 0
diff --git a/roles/kubernetes-net/templates/k8s.json.j2 b/roles/kubernetes-net/templates/k8s.json.j2
deleted file mode 100644
index f457ed1c..00000000
--- a/roles/kubernetes-net/templates/k8s.json.j2
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "cniVersion": "0.3.1",
-  "name": "k8s",
-  "type": "bridge",
-  "bridge": "kube-br0",
-  "isDefaultGateway": true,
-  "hairpinMode": true,
-  "ipam": {
-    "type": "host-local",
-    "subnet": "{{ kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubernetes.net_index[inventory_hostname]) }}"
-  }
-}
diff --git a/roles/kubernetes-net/templates/kubenet-peer.service.j2 b/roles/kubernetes-net/templates/kubenet-peer.service.j2
deleted file mode 100644
index bee211af..00000000
--- a/roles/kubernetes-net/templates/kubenet-peer.service.j2
+++ /dev/null
@@ -1,36 +0,0 @@
-[Unit]
-Description=Kubernetes Network Peer {{ peer }}
-After=network.target
-Requires=kubenet-interfaces.service
-After=kubenet-interfaces.service
-
-{% set pod_net_peer = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubernetes.net_index[peer]) -%}
-{% set direct_zone = kubernetes.direct_net_zones | direct_net_zone(inventory_hostname, peer) -%}
-{% if direct_zone %}
-{% set direct_ip = kubernetes.direct_net_zones[direct_zone].transfer_net | ipaddr(kubernetes.net_index[inventory_hostname]) %}
-{% set direct_interface = kubernetes.direct_net_zones[direct_zone].node_interface[inventory_hostname] %}
-{% set direct_ip_peer = kubernetes.direct_net_zones[direct_zone].transfer_net | ipaddr(kubernetes.net_index[peer]) %}
-{% else %}
-{% set tun_ip = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, 0) | ipaddr(kubernetes.net_index[peer]) -%}
-{% set wg_pubkey = hostvars[peer].kubenet_wireguard_pubkey.stdout -%}
-{% set wg_host = hostvars[peer].external_ip | default(hostvars[peer].ansible_default_ipv4.address) -%}
-{% set wg_port = hostvars[peer].kubenet_wireguard_port -%}
-{% set wg_allowedips = (tun_ip | ipaddr('address')) + "/32," + pod_net_peer %}
-{% endif %}
-[Service]
-Type=oneshot
-{% if direct_zone %}
-ExecStart=/sbin/ip addr add {{ direct_ip }} dev {{ direct_interface }}
-ExecStart=/sbin/ip link set up dev {{ direct_interface }}
-ExecStart=/sbin/ip route add {{ pod_net_peer }} via {{ direct_ip_peer | ipaddr('address') }}
-ExecStop=/sbin/ip route del {{ pod_net_peer }}
-ExecStop=/sbin/ip link set down dev {{ direct_interface }}
-ExecStop=/sbin/ip addr del {{ direct_ip }} dev {{ direct_interface }}
-{% else %}
-ExecStart=/usr/bin/wg set kube-wg0 peer {{ wg_pubkey }} allowed-ips {{ wg_allowedips }} endpoint {{ wg_host }}:{{ wg_port }} persistent-keepalive 10
-ExecStop=/usr/bin/wg set kube-wg0 peer {{ wg_pubkey }} remove
-{% endif %}
-RemainAfterExit=yes
-
-[Install]
-WantedBy=multi-user.target
-- 
cgit v1.2.3