From 4fd722c4c12b441d0857c5bc29d1cd43df64b9b7 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Tue, 26 May 2020 18:08:10 +0200
Subject: finalize handling of network plugins. (needs testing)

---
 roles/kubernetes/kubeadm/reset/tasks/main.yml | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'roles/kubernetes/kubeadm/reset')

diff --git a/roles/kubernetes/kubeadm/reset/tasks/main.yml b/roles/kubernetes/kubeadm/reset/tasks/main.yml
index c35e2bfc..1ecf1c1e 100644
--- a/roles/kubernetes/kubeadm/reset/tasks/main.yml
+++ b/roles/kubernetes/kubeadm/reset/tasks/main.yml
@@ -6,9 +6,13 @@
   loop:
     - /etc/kubernetes/kubeadm.config
     - /etc/kubernetes/kubeadm-init.log
+    - /etc/kubernetes/kubeadm-init.errors
     - /etc/kubernetes/kubeadm-join.log
+    - /etc/kubernetes/kubeadm-join.errors
     - /etc/kubernetes/pki
     - /etc/kubernetes/encryption
+    - /etc/kubernetes/network-plugin.yml
+    - /etc/kubernetes/node-local-dns.yml
   file:
     path: "{{ item }}"
     state: absent
-- 
cgit v1.2.3


From 9fdd190e0ac9ac5b82c40c2f90aa25a3c0c0b0ae Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Wed, 17 Jun 2020 00:13:46 +0200
Subject: kubernetes: install addon configs into common sub-dir

---
 roles/kubernetes/addons/metrics-server/tasks/main.yml | 9 +++++++--
 roles/kubernetes/kubeadm/reset/tasks/main.yml         | 1 +
 2 files changed, 8 insertions(+), 2 deletions(-)

(limited to 'roles/kubernetes/kubeadm/reset')

diff --git a/roles/kubernetes/addons/metrics-server/tasks/main.yml b/roles/kubernetes/addons/metrics-server/tasks/main.yml
index e09106c1..fb725a87 100644
--- a/roles/kubernetes/addons/metrics-server/tasks/main.yml
+++ b/roles/kubernetes/addons/metrics-server/tasks/main.yml
@@ -1,10 +1,15 @@
 ---
+- name: create base directory for metrics-server addon
+  file:
+    path: /etc/kubernetes/addons/metrics-server
+    state: directory
+
 - name: copy config for metrics-server
   template:
     src: "components.{{ kubernetes_metrics_server_version }}.yml.j2"
-    dest: /etc/kubernetes/metrics-server.yml
+    dest: /etc/kubernetes/addons/metrics-server/config.yml
 
 - name: install metrics-server onto the cluster
-  command: kubectl --kubeconfig /etc/kubernetes/admin.conf apply -f /etc/kubernetes/metrics-server.yml
+  command: kubectl --kubeconfig /etc/kubernetes/admin.conf apply -f /etc/kubernetes/addons/metrics-server/config.yml
   register: kube_metrics_server_apply_result
   changed_when: (kube_metrics_server_apply_result.stdout_lines | reject("regex", " unchanged$") | list | length) > 0
diff --git a/roles/kubernetes/kubeadm/reset/tasks/main.yml b/roles/kubernetes/kubeadm/reset/tasks/main.yml
index 1ecf1c1e..57a3faf4 100644
--- a/roles/kubernetes/kubeadm/reset/tasks/main.yml
+++ b/roles/kubernetes/kubeadm/reset/tasks/main.yml
@@ -13,6 +13,7 @@
     - /etc/kubernetes/encryption
     - /etc/kubernetes/network-plugin.yml
     - /etc/kubernetes/node-local-dns.yml
+    - /etc/kubernetes/addons
   file:
     path: "{{ item }}"
     state: absent
-- 
cgit v1.2.3


From ac06da81fbf302c12b235ddde0a5fae93bba20f4 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Sat, 20 Jun 2020 03:35:08 +0200
Subject: kubernetes: move kubeguard/reset to kubeadm/reset

---
 common/kubernetes-cluster-cleanup.yml              |  2 --
 roles/kubernetes/kubeadm/reset/handlers/main.yml   |  4 ++++
 roles/kubernetes/kubeadm/reset/tasks/main.yml      |  3 +++
 .../kubeadm/reset/tasks/net_kubeguard.yml          | 26 ++++++++++++++++++++++
 .../net/kubeguard/reset/handlers/main.yml          |  4 ----
 .../kubernetes/net/kubeguard/reset/tasks/main.yml  | 26 ----------------------
 6 files changed, 33 insertions(+), 32 deletions(-)
 create mode 100644 roles/kubernetes/kubeadm/reset/handlers/main.yml
 create mode 100644 roles/kubernetes/kubeadm/reset/tasks/net_kubeguard.yml
 delete mode 100644 roles/kubernetes/net/kubeguard/reset/handlers/main.yml
 delete mode 100644 roles/kubernetes/net/kubeguard/reset/tasks/main.yml

(limited to 'roles/kubernetes/kubeadm/reset')

diff --git a/common/kubernetes-cluster-cleanup.yml b/common/kubernetes-cluster-cleanup.yml
index d56940ee..7c10d17c 100644
--- a/common/kubernetes-cluster-cleanup.yml
+++ b/common/kubernetes-cluster-cleanup.yml
@@ -38,5 +38,3 @@
   hosts: _kubernetes_nodes_remove_
   roles:
   - role: kubernetes/kubeadm/reset
-  - role: kubernetes/net/kubeguard/reset
-    when: hostvars[groups['_kubernetes_primary_master_'][0]].kubernetes_network_plugin == 'kubeguard'
diff --git a/roles/kubernetes/kubeadm/reset/handlers/main.yml b/roles/kubernetes/kubeadm/reset/handlers/main.yml
new file mode 100644
index 00000000..bb7fde2b
--- /dev/null
+++ b/roles/kubernetes/kubeadm/reset/handlers/main.yml
@@ -0,0 +1,4 @@
+---
+- name: reload systemd
+  systemd:
+    daemon_reload: yes
diff --git a/roles/kubernetes/kubeadm/reset/tasks/main.yml b/roles/kubernetes/kubeadm/reset/tasks/main.yml
index 57a3faf4..cf9c125d 100644
--- a/roles/kubernetes/kubeadm/reset/tasks/main.yml
+++ b/roles/kubernetes/kubeadm/reset/tasks/main.yml
@@ -30,3 +30,6 @@
   file:
     path: "{{ item.path }}"
     state: absent
+
+- name: extra-cleanup for kubeguard network plugin
+  import_tasks: net_kubeguard.yml
diff --git a/roles/kubernetes/kubeadm/reset/tasks/net_kubeguard.yml b/roles/kubernetes/kubeadm/reset/tasks/net_kubeguard.yml
new file mode 100644
index 00000000..03b3f205
--- /dev/null
+++ b/roles/kubernetes/kubeadm/reset/tasks/net_kubeguard.yml
@@ -0,0 +1,26 @@
+---
+- name: check if kubeguard interface service unit exists
+  stat:
+    path: /etc/systemd/system/kubeguard-interfaces.service
+  register: kubeguard_interface_unit
+
+- name: bring down kubeguard interface
+  when: kubeguard_interface_unit.stat.exists
+  systemd:
+    name: kubeguard-interfaces.service
+    state: stopped
+
+- name: gather list of all kubeguard related service units
+  find:
+    path: /etc/systemd/system/
+    patterns:
+    - "kubeguard-peer-*.service"
+    - kubeguard-interfaces.service
+  register: kubeguard_units_installed
+
+- name: remove all kubeguard related files and directories
+  loop: "{{ kubeguard_units_installed.files | map(attribute='path') | list | flatten | union(['/var/lib/kubeguard']) }}"
+  file:
+    path: "{{ item }}"
+    state: absent
+  notify: reload systemd
diff --git a/roles/kubernetes/net/kubeguard/reset/handlers/main.yml b/roles/kubernetes/net/kubeguard/reset/handlers/main.yml
deleted file mode 100644
index bb7fde2b..00000000
--- a/roles/kubernetes/net/kubeguard/reset/handlers/main.yml
+++ /dev/null
@@ -1,4 +0,0 @@
----
-- name: reload systemd
-  systemd:
-    daemon_reload: yes
diff --git a/roles/kubernetes/net/kubeguard/reset/tasks/main.yml b/roles/kubernetes/net/kubeguard/reset/tasks/main.yml
deleted file mode 100644
index d24f9eff..00000000
--- a/roles/kubernetes/net/kubeguard/reset/tasks/main.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: check if kubeguard interface service unit exists
-  stat:
-    path: /etc/systemd/system/kubeguard-interfaces.service
-  register: kubeguard_interface_unit
-
-- name: bring down kubeguard interface
-  systemd:
-    name: kubeguard-interfaces.service
-    state: stopped
-  when: kubeguard_interface_unit.stat.exists
-
-- name: gather list of all kubeguard related service units
-  find:
-    path: /etc/systemd/system/
-    patterns:
-      - "kubeguard-peer-*.service"
-      - kubeguard-interfaces.service
-  register: kubeguard_units_installed
-
-- name: remove all kubeguard related files and directories
-  loop: "{{ kubeguard_units_installed.files | map(attribute='path') | list | flatten | union(['/var/lib/kubeguard']) }}"
-  file:
-    path: "{{ item }}"
-    state: absent
-  notify: reload systemd
-- 
cgit v1.2.3


From b39c3b91269a8482207863234acc298f623deae6 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Sat, 20 Jun 2020 05:20:46 +0200
Subject: kubernetes: add node pruning role

---
 common/kubernetes-cluster-cleanup.yml              | 21 ++++--------
 .../kubeadm/base/tasks/net_kubeguard.yml           | 20 ++++++------
 .../base/templates/net_kubeguard/cni.json.j2       | 12 +++++++
 .../base/templates/net_kubeguard/ifupdown.sh.j2    |  4 +--
 .../templates/net_kubeguard/interface.service.j2   | 12 +++++++
 .../base/templates/net_kubeguard/k8s.json.j2       | 12 -------
 .../net_kubeguard/kubeguard-interfaces.service.j2  | 12 -------
 .../net_kubeguard/kubeguard-peer.service.j2        | 37 ----------------------
 .../base/templates/net_kubeguard/peer.service.j2   | 37 ++++++++++++++++++++++
 roles/kubernetes/kubeadm/prune/tasks/main.yml      |  9 ++++++
 .../kubeadm/prune/tasks/net_kubeguard.yml          | 14 ++++++++
 roles/kubernetes/kubeadm/prune/tasks/net_none.yml  |  2 ++
 .../kubeadm/reset/tasks/net_kubeguard.yml          |  6 ++--
 .../net/kubeguard/cleanup/tasks/main.yml           | 14 --------
 14 files changed, 107 insertions(+), 105 deletions(-)
 create mode 100644 roles/kubernetes/kubeadm/base/templates/net_kubeguard/cni.json.j2
 create mode 100644 roles/kubernetes/kubeadm/base/templates/net_kubeguard/interface.service.j2
 delete mode 100644 roles/kubernetes/kubeadm/base/templates/net_kubeguard/k8s.json.j2
 delete mode 100644 roles/kubernetes/kubeadm/base/templates/net_kubeguard/kubeguard-interfaces.service.j2
 delete mode 100644 roles/kubernetes/kubeadm/base/templates/net_kubeguard/kubeguard-peer.service.j2
 create mode 100644 roles/kubernetes/kubeadm/base/templates/net_kubeguard/peer.service.j2
 create mode 100644 roles/kubernetes/kubeadm/prune/tasks/main.yml
 create mode 100644 roles/kubernetes/kubeadm/prune/tasks/net_kubeguard.yml
 create mode 100644 roles/kubernetes/kubeadm/prune/tasks/net_none.yml
 delete mode 100644 roles/kubernetes/net/kubeguard/cleanup/tasks/main.yml

(limited to 'roles/kubernetes/kubeadm/reset')

diff --git a/common/kubernetes-cluster-cleanup.yml b/common/kubernetes-cluster-cleanup.yml
index 7c10d17c..5647e3d6 100644
--- a/common/kubernetes-cluster-cleanup.yml
+++ b/common/kubernetes-cluster-cleanup.yml
@@ -13,28 +13,19 @@
     add_host:
       name: "{{ item }}"
       inventory_dir: "{{ hostvars[item].inventory_dir }}"
-      group: _kubernetes_nodes_remove_
+      group: _kubernetes_nodes_prune_
     changed_when: False
 
   - name: drain superflous nodes
-    loop: "{{ groups['_kubernetes_nodes_remove_'] | default([]) }}"
+    loop: "{{ groups['_kubernetes_nodes_prune_'] | default([]) }}"
     command: "kubectl drain {{ item }} --delete-local-data --force --ignore-daemonsets"
 
-
-- name: remove nodes from api server
-  hosts: _kubernetes_primary_master_
-  tasks:
-  - name: remove superflous nodes
-    loop: "{{ groups['_kubernetes_nodes_remove_'] | default([]) }}"
-    command: "kubectl delete node {{ item }}"
-
-- name: cleanup kubeguard connections
+- name: prune superflous nodes from cluster
   hosts: _kubernetes_nodes_
   roles:
-  - role: kubernetes/net/kubeguard/cleanup
-    when: hostvars[groups['_kubernetes_primary_master_'][0]].kubernetes_network_plugin == 'kubeguard'
+  - role: kubernetes/kubeadm/prune
 
-- name: try to clean superflous nodes
-  hosts: _kubernetes_nodes_remove_
+- name: wipe superflous nodes
+  hosts: _kubernetes_nodes_prune_
   roles:
   - role: kubernetes/kubeadm/reset
diff --git a/roles/kubernetes/kubeadm/base/tasks/net_kubeguard.yml b/roles/kubernetes/kubeadm/base/tasks/net_kubeguard.yml
index 8c5f5065..37b5030d 100644
--- a/roles/kubernetes/kubeadm/base/tasks/net_kubeguard.yml
+++ b/roles/kubernetes/kubeadm/base/tasks/net_kubeguard.yml
@@ -25,26 +25,26 @@
   #                        it must probably be brought down by the old version of the script
 
 - name: generate wireguard private key
-  shell: "umask 077; wg genkey > /var/lib/kubeguard/kube-wg0.privatekey"
+  shell: "umask 077; wg genkey > /var/lib/kubeguard/kubeguard-wg0.privatekey"
   args:
-    creates: /var/lib/kubeguard/kube-wg0.privatekey
+    creates: /var/lib/kubeguard/kubeguard-wg0.privatekey
 
 - name: fetch wireguard public key
-  shell: "wg pubkey < /var/lib/kubeguard/kube-wg0.privatekey"
+  shell: "wg pubkey < /var/lib/kubeguard/kubeguard-wg0.privatekey"
   register: kubeguard_wireguard_pubkey
   changed_when: false
   check_mode: no
 
-- name: install systemd service unit for network interfaces
+- name: install systemd service unit for network interface
   template:
-    src: net_kubeguard/kubeguard-interfaces.service.j2
-    dest: /etc/systemd/system/kubeguard-interfaces.service
+    src: net_kubeguard/interface.service.j2
+    dest: /etc/systemd/system/kubeguard-interface.service
   # TODO: notify: reload???
 
-- name: make sure kubeguard interfaces service is started and enabled
+- name: make sure kubeguard interface service is started and enabled
   systemd:
     daemon_reload: yes
-    name: kubeguard-interfaces.service
+    name: kubeguard-interface.service
     state: started
     enabled: yes
 
@@ -53,7 +53,7 @@
   loop_control:
     loop_var: peer
   template:
-    src: net_kubeguard/kubeguard-peer.service.j2
+    src: net_kubeguard/peer.service.j2
     dest: "/etc/systemd/system/kubeguard-peer-{{ peer }}.service"
   # TODO: notify restart for peers that change...
 
@@ -80,5 +80,5 @@
 
 - name: install cni config
   template:
-    src: net_kubeguard/k8s.json.j2
+    src: net_kubeguard/cni.json.j2
     dest: /etc/cni/net.d/kubeguard.json
diff --git a/roles/kubernetes/kubeadm/base/templates/net_kubeguard/cni.json.j2 b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/cni.json.j2
new file mode 100644
index 00000000..eb9e3d61
--- /dev/null
+++ b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/cni.json.j2
@@ -0,0 +1,12 @@
+{
+  "cniVersion": "0.3.1",
+  "name": "kubeguard",
+  "type": "bridge",
+  "bridge": "kubeguard-br0",
+  "isDefaultGateway": true,
+  "hairpinMode": true,
+  "ipam": {
+    "type": "host-local",
+    "subnet": "{{ kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubeguard.node_index[inventory_hostname]) }}"
+  }
+}
diff --git a/roles/kubernetes/kubeadm/base/templates/net_kubeguard/ifupdown.sh.j2 b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/ifupdown.sh.j2
index d8153102..f940d413 100644
--- a/roles/kubernetes/kubeadm/base/templates/net_kubeguard/ifupdown.sh.j2
+++ b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/ifupdown.sh.j2
@@ -9,12 +9,12 @@ INET_IF="{{ ansible_default_ipv4.interface }}"
 POD_NET_CIDR="{{ kubernetes.pod_ip_range }}"
 
 {% set br_net = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubeguard.node_index[inventory_hostname]) -%}
-BR_IF="kube-br0"
+BR_IF="kubeguard-br0"
 BR_IP="{{ br_net | ipaddr(1) | ipaddr('address')  }}"
 BR_IP_CIDR="{{ br_net | ipaddr(1) }}"
 BR_NET_CIDR="{{ br_net }}"
 
-TUN_IF="kube-wg0"
+TUN_IF="kubeguard-wg0"
 TUN_IP_CIDR="{{ kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, 0) | ipaddr(kubeguard.node_index[inventory_hostname]) }}"
 
 
diff --git a/roles/kubernetes/kubeadm/base/templates/net_kubeguard/interface.service.j2 b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/interface.service.j2
new file mode 100644
index 00000000..35fc8f90
--- /dev/null
+++ b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/interface.service.j2
@@ -0,0 +1,12 @@
+[Unit]
+Description=Kubeguard Network Setup
+After=network.target
+
+[Service]
+Type=oneshot
+ExecStart=/var/lib/kubeguard/ifupdown.sh up
+ExecStop=/var/lib/kubeguard/ifupdown.sh down
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target
diff --git a/roles/kubernetes/kubeadm/base/templates/net_kubeguard/k8s.json.j2 b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/k8s.json.j2
deleted file mode 100644
index 65b1357a..00000000
--- a/roles/kubernetes/kubeadm/base/templates/net_kubeguard/k8s.json.j2
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "cniVersion": "0.3.1",
-  "name": "k8s",
-  "type": "bridge",
-  "bridge": "kube-br0",
-  "isDefaultGateway": true,
-  "hairpinMode": true,
-  "ipam": {
-    "type": "host-local",
-    "subnet": "{{ kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubeguard.node_index[inventory_hostname]) }}"
-  }
-}
diff --git a/roles/kubernetes/kubeadm/base/templates/net_kubeguard/kubeguard-interfaces.service.j2 b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/kubeguard-interfaces.service.j2
deleted file mode 100644
index 35fc8f90..00000000
--- a/roles/kubernetes/kubeadm/base/templates/net_kubeguard/kubeguard-interfaces.service.j2
+++ /dev/null
@@ -1,12 +0,0 @@
-[Unit]
-Description=Kubeguard Network Setup
-After=network.target
-
-[Service]
-Type=oneshot
-ExecStart=/var/lib/kubeguard/ifupdown.sh up
-ExecStop=/var/lib/kubeguard/ifupdown.sh down
-RemainAfterExit=yes
-
-[Install]
-WantedBy=multi-user.target
diff --git a/roles/kubernetes/kubeadm/base/templates/net_kubeguard/kubeguard-peer.service.j2 b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/kubeguard-peer.service.j2
deleted file mode 100644
index 92300253..00000000
--- a/roles/kubernetes/kubeadm/base/templates/net_kubeguard/kubeguard-peer.service.j2
+++ /dev/null
@@ -1,37 +0,0 @@
-[Unit]
-Description=Kubernetes Network Peer {{ peer }}
-After=network.target
-Requires=kubeguard-interfaces.service
-After=kubeguard-interfaces.service
-
-{% set pod_ip_self = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubeguard.node_index[inventory_hostname]) | ipaddr(1) | ipaddr('address') -%}
-{% set pod_net_peer = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubeguard.node_index[peer]) -%}
-{% set direct_zone = kubeguard.direct_net_zones | default({}) | kubeguard_direct_net_zone(inventory_hostname, peer) -%}
-{% if direct_zone %}
-{% set direct_ip = kubeguard.direct_net_zones[direct_zone].transfer_net | ipaddr(kubeguard.node_index[inventory_hostname]) %}
-{% set direct_interface = kubeguard.direct_net_zones[direct_zone].node_interface[inventory_hostname] %}
-{% set direct_ip_peer = kubeguard.direct_net_zones[direct_zone].transfer_net | ipaddr(kubeguard.node_index[peer]) %}
-{% else %}
-{% set tun_ip = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, 0) | ipaddr(kubeguard.node_index[peer]) -%}
-{% set wg_pubkey = hostvars[peer].kubeguard_wireguard_pubkey.stdout -%}
-{% set wg_host = hostvars[peer].external_ip_cooked | default(hostvars[peer].ansible_default_ipv4.address) -%}
-{% set wg_port = hostvars[peer].kubeguard_wireguard_port | default(51820) -%}
-{% set wg_allowedips = (tun_ip | ipaddr('address')) + "/32," + pod_net_peer %}
-{% endif %}
-[Service]
-Type=oneshot
-{% if direct_zone %}
-ExecStart=/sbin/ip addr add {{ direct_ip }} dev {{ direct_interface }}
-ExecStart=/sbin/ip link set up dev {{ direct_interface }}
-ExecStart=/sbin/ip route add {{ pod_net_peer }} via {{ direct_ip_peer | ipaddr('address') }} src {{ pod_ip_self }}
-ExecStop=/sbin/ip route del {{ pod_net_peer }}
-ExecStop=/sbin/ip link set down dev {{ direct_interface }}
-ExecStop=/sbin/ip addr del {{ direct_ip }} dev {{ direct_interface }}
-{% else %}
-ExecStart=/usr/bin/wg set kube-wg0 peer {{ wg_pubkey }} allowed-ips {{ wg_allowedips }} endpoint {{ wg_host }}:{{ wg_port }} persistent-keepalive 10
-ExecStop=/usr/bin/wg set kube-wg0 peer {{ wg_pubkey }} remove
-{% endif %}
-RemainAfterExit=yes
-
-[Install]
-WantedBy=multi-user.target
diff --git a/roles/kubernetes/kubeadm/base/templates/net_kubeguard/peer.service.j2 b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/peer.service.j2
new file mode 100644
index 00000000..c9d96a5a
--- /dev/null
+++ b/roles/kubernetes/kubeadm/base/templates/net_kubeguard/peer.service.j2
@@ -0,0 +1,37 @@
+[Unit]
+Description=Kubernetes Network Peer {{ peer }}
+After=network.target
+Requires=kubeguard-interface.service
+After=kubeguard-interface.service
+
+{% set pod_ip_self = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubeguard.node_index[inventory_hostname]) | ipaddr(1) | ipaddr('address') -%}
+{% set pod_net_peer = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubeguard.node_index[peer]) -%}
+{% set direct_zone = kubeguard.direct_net_zones | default({}) | kubeguard_direct_net_zone(inventory_hostname, peer) -%}
+{% if direct_zone %}
+{% set direct_ip = kubeguard.direct_net_zones[direct_zone].transfer_net | ipaddr(kubeguard.node_index[inventory_hostname]) %}
+{% set direct_interface = kubeguard.direct_net_zones[direct_zone].node_interface[inventory_hostname] %}
+{% set direct_ip_peer = kubeguard.direct_net_zones[direct_zone].transfer_net | ipaddr(kubeguard.node_index[peer]) %}
+{% else %}
+{% set tun_ip = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, 0) | ipaddr(kubeguard.node_index[peer]) -%}
+{% set wg_pubkey = hostvars[peer].kubeguard_wireguard_pubkey.stdout -%}
+{% set wg_host = hostvars[peer].external_ip_cooked | default(hostvars[peer].ansible_default_ipv4.address) -%}
+{% set wg_port = hostvars[peer].kubeguard_wireguard_port | default(51820) -%}
+{% set wg_allowedips = (tun_ip | ipaddr('address')) + "/32," + pod_net_peer %}
+{% endif %}
+[Service]
+Type=oneshot
+{% if direct_zone %}
+ExecStart=/sbin/ip addr add {{ direct_ip }} dev {{ direct_interface }}
+ExecStart=/sbin/ip link set up dev {{ direct_interface }}
+ExecStart=/sbin/ip route add {{ pod_net_peer }} via {{ direct_ip_peer | ipaddr('address') }} src {{ pod_ip_self }}
+ExecStop=/sbin/ip route del {{ pod_net_peer }}
+ExecStop=/sbin/ip link set down dev {{ direct_interface }}
+ExecStop=/sbin/ip addr del {{ direct_ip }} dev {{ direct_interface }}
+{% else %}
+ExecStart=/usr/bin/wg set kubeguard-wg0 peer {{ wg_pubkey }} allowed-ips {{ wg_allowedips }} endpoint {{ wg_host }}:{{ wg_port }} persistent-keepalive 10
+ExecStop=/usr/bin/wg set kubeguard-wg0 peer {{ wg_pubkey }} remove
+{% endif %}
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target
diff --git a/roles/kubernetes/kubeadm/prune/tasks/main.yml b/roles/kubernetes/kubeadm/prune/tasks/main.yml
new file mode 100644
index 00000000..71ed0d04
--- /dev/null
+++ b/roles/kubernetes/kubeadm/prune/tasks/main.yml
@@ -0,0 +1,9 @@
+---
+- name: remove nodes from api server
+  run_once: true
+  delegate_to: "{{ groups['_kubernetes_primary_master_'] | first }}"
+  loop: "{{ groups['_kubernetes_nodes_prune_'] | default([]) }}"
+  command: "kubectl delete node {{ item }}"
+
+- name: prune network plugin
+  include_tasks: "net_{{ kubernetes_network_plugin }}.yml"
diff --git a/roles/kubernetes/kubeadm/prune/tasks/net_kubeguard.yml b/roles/kubernetes/kubeadm/prune/tasks/net_kubeguard.yml
new file mode 100644
index 00000000..8a8c7752
--- /dev/null
+++ b/roles/kubernetes/kubeadm/prune/tasks/net_kubeguard.yml
@@ -0,0 +1,14 @@
+---
+- name: stop/disable systemd units for stale kubeguard peers
+  loop: "{{ groups['_kubernetes_nodes_prune_'] | default([]) }}"
+  systemd:
+    name: "kubeguard-peer-{{ item }}.service"
+    state: stopped
+    enabled: no
+  failed_when: false
+
+- name: remove systemd units for stale kubeguard peers
+  loop: "{{ groups['_kubernetes_nodes_prune_'] | default([]) }}"
+  file:
+    name: "/etc/systemd/system/kubeguard-peer-{{ item }}.service"
+    state: absent
diff --git a/roles/kubernetes/kubeadm/prune/tasks/net_none.yml b/roles/kubernetes/kubeadm/prune/tasks/net_none.yml
new file mode 100644
index 00000000..94832c38
--- /dev/null
+++ b/roles/kubernetes/kubeadm/prune/tasks/net_none.yml
@@ -0,0 +1,2 @@
+---
+## nothing to do here
diff --git a/roles/kubernetes/kubeadm/reset/tasks/net_kubeguard.yml b/roles/kubernetes/kubeadm/reset/tasks/net_kubeguard.yml
index 03b3f205..bcb48960 100644
--- a/roles/kubernetes/kubeadm/reset/tasks/net_kubeguard.yml
+++ b/roles/kubernetes/kubeadm/reset/tasks/net_kubeguard.yml
@@ -1,13 +1,13 @@
 ---
 - name: check if kubeguard interface service unit exists
   stat:
-    path: /etc/systemd/system/kubeguard-interfaces.service
+    path: /etc/systemd/system/kubeguard-interface.service
   register: kubeguard_interface_unit
 
 - name: bring down kubeguard interface
   when: kubeguard_interface_unit.stat.exists
   systemd:
-    name: kubeguard-interfaces.service
+    name: kubeguard-interface.service
     state: stopped
 
 - name: gather list of all kubeguard related service units
@@ -15,7 +15,7 @@
     path: /etc/systemd/system/
     patterns:
     - "kubeguard-peer-*.service"
-    - kubeguard-interfaces.service
+    - kubeguard-interface.service
   register: kubeguard_units_installed
 
 - name: remove all kubeguard related files and directories
diff --git a/roles/kubernetes/net/kubeguard/cleanup/tasks/main.yml b/roles/kubernetes/net/kubeguard/cleanup/tasks/main.yml
deleted file mode 100644
index f15058d2..00000000
--- a/roles/kubernetes/net/kubeguard/cleanup/tasks/main.yml
+++ /dev/null
@@ -1,14 +0,0 @@
----
-- name: stop/disable systemd units for stale kubeguard peers
-  loop: "{{ groups['_kubernetes_nodes_remove_'] | default([]) }}"
-  systemd:
-    name: "kubeguard-peer-{{ item }}.service"
-    state: stopped
-    enabled: no
-  failed_when: false
-
-- name: remove systemd units for stale kubeguard peers
-  loop: "{{ groups['_kubernetes_nodes_remove_'] | default([]) }}"
-  file:
-    name: "/etc/systemd/system/kubeguard-peer-{{ item }}.service"
-    state: absent
-- 
cgit v1.2.3


From b77997ae59aedcf9afb292cf2eb7a49999a33e94 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Sat, 20 Jun 2020 19:37:18 +0200
Subject: kubernetes: add network-plugin kube-router

---
 .../kubeadm/base/tasks/net_kube-router.yml         |   8 +
 .../kubeadm/master/tasks/net_kube-router.yml       |  10 +
 .../templates/net_kube-router/config.0.4.0.yml.j2  | 237 +++++++++++++++++++++
 .../kubeadm/prune/tasks/net_kube-router.yml        |   2 +
 roles/kubernetes/kubeadm/reset/tasks/main.yml      |   1 +
 5 files changed, 258 insertions(+)
 create mode 100644 roles/kubernetes/kubeadm/base/tasks/net_kube-router.yml
 create mode 100644 roles/kubernetes/kubeadm/master/tasks/net_kube-router.yml
 create mode 100644 roles/kubernetes/kubeadm/master/templates/net_kube-router/config.0.4.0.yml.j2
 create mode 100644 roles/kubernetes/kubeadm/prune/tasks/net_kube-router.yml

(limited to 'roles/kubernetes/kubeadm/reset')

diff --git a/roles/kubernetes/kubeadm/base/tasks/net_kube-router.yml b/roles/kubernetes/kubeadm/base/tasks/net_kube-router.yml
new file mode 100644
index 00000000..246b20bc
--- /dev/null
+++ b/roles/kubernetes/kubeadm/base/tasks/net_kube-router.yml
@@ -0,0 +1,8 @@
+---
+- name: install packages needed for debugging kube-router
+  apt:
+    name:
+    - iptables
+    - ipvsadm
+    - ipset
+    state: present
diff --git a/roles/kubernetes/kubeadm/master/tasks/net_kube-router.yml b/roles/kubernetes/kubeadm/master/tasks/net_kube-router.yml
new file mode 100644
index 00000000..5368b6f5
--- /dev/null
+++ b/roles/kubernetes/kubeadm/master/tasks/net_kube-router.yml
@@ -0,0 +1,10 @@
+---
+- name: generate kube-router configuration
+  template:
+    src: "net_kube-router/config.{{ kubernetes_network_plugin_version }}.yml.j2"
+    dest: /etc/kubernetes/network-plugin.yml
+
+- name: install kube-router on to the cluster
+  command: kubectl --kubeconfig /etc/kubernetes/admin.conf apply -f /etc/kubernetes/network-plugin.yml
+  register: kube_router_apply_result
+  changed_when: (kube_router_apply_result.stdout_lines | reject("regex", " unchanged$") | list | length) > 0
diff --git a/roles/kubernetes/kubeadm/master/templates/net_kube-router/config.0.4.0.yml.j2 b/roles/kubernetes/kubeadm/master/templates/net_kube-router/config.0.4.0.yml.j2
new file mode 100644
index 00000000..b06687d5
--- /dev/null
+++ b/roles/kubernetes/kubeadm/master/templates/net_kube-router/config.0.4.0.yml.j2
@@ -0,0 +1,237 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kube-router-kubeconfig
+  namespace: kube-system
+  labels:
+    tier: node
+    k8s-app: kube-router
+data:
+  kubeconfig.conf: |
+    apiVersion: v1
+    kind: Config
+    clusters:
+    - cluster:
+        certificate-authority: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+        server: https://127.0.0.1:{{ kubernetes_api_lb_port | default('6443') }}
+      name: default
+    contexts:
+    - context:
+        cluster: default
+        namespace: default
+        user: default
+      name: default
+    current-context: default
+    users:
+    - name: default
+      user:
+        tokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kube-router-cfg
+  namespace: kube-system
+  labels:
+    tier: node
+    k8s-app: kube-router
+data:
+  cni-conf.json: |
+    {
+       "cniVersion":"0.3.0",
+       "name":"mynet",
+       "plugins":[
+          {
+             "name":"kubernetes",
+             "type":"bridge",
+             "bridge":"kube-bridge",
+             "isDefaultGateway":true,
+             "hairpinMode": true,
+             "ipam":{
+                "type":"host-local"
+             }
+          },
+          {
+             "type":"portmap",
+             "capabilities":{
+                "snat":true,
+                "portMappings":true
+             }
+          }
+       ]
+    }
+---
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  labels:
+    k8s-app: kube-router
+    tier: node
+  name: kube-router
+  namespace: kube-system
+spec:
+  selector:
+    matchLabels:
+      k8s-app: kube-router
+      tier: node
+  template:
+    metadata:
+      labels:
+        k8s-app: kube-router
+        tier: node
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "8080"
+    spec:
+      priorityClassName: system-node-critical
+      serviceAccountName: kube-router
+      serviceAccount: kube-router
+      containers:
+      - name: kube-router
+        image: docker.io/cloudnativelabs/kube-router:v{{ kubernetes_network_plugin_version }}
+        imagePullPolicy: Always
+        args:
+        - --run-router=true
+        - --run-firewall=true
+        - --run-service-proxy={{ kubernetes_network_plugin_replaces_kube_proxy | string | lower }}
+        - --kubeconfig=/var/lib/kube-router/kubeconfig
+        - --hairpin-mode
+        - --iptables-sync-period=10s
+        - --ipvs-sync-period=10s
+        - --routes-sync-period=10s
+        env:
+        - name: NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
+        - name: KUBE_ROUTER_CNI_CONF_FILE
+          value: /etc/cni/net.d/10-kuberouter.conflist
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: 20244
+          initialDelaySeconds: 10
+          periodSeconds: 3
+        resources:
+          requests:
+            cpu: 250m
+            memory: 250Mi
+        securityContext:
+          privileged: true
+        volumeMounts:
+        - name: lib-modules
+          mountPath: /lib/modules
+          readOnly: true
+        - name: cni-conf-dir
+          mountPath: /etc/cni/net.d
+        - name: kubeconfig
+          mountPath: /var/lib/kube-router
+          readOnly: true
+        - name: xtables-lock
+          mountPath: /run/xtables.lock
+          readOnly: false
+      initContainers:
+      - name: install-cni
+        image: busybox
+        imagePullPolicy: Always
+        command:
+        - /bin/sh
+        - -c
+        - set -e -x;
+          if [ ! -f /etc/cni/net.d/10-kuberouter.conflist ]; then
+            if [ -f /etc/cni/net.d/*.conf ]; then
+              rm -f /etc/cni/net.d/*.conf;
+            fi;
+            TMP=/etc/cni/net.d/.tmp-kuberouter-cfg;
+            cp /etc/kube-router/cni-conf.json ${TMP};
+            mv ${TMP} /etc/cni/net.d/10-kuberouter.conflist;
+          fi
+        volumeMounts:
+        - name: cni-conf-dir
+          mountPath: /etc/cni/net.d
+        - name: kube-router-cfg
+          mountPath: /etc/kube-router
+      hostNetwork: true
+      tolerations:
+      - key: CriticalAddonsOnly
+        operator: Exists
+      - effect: NoSchedule
+        key: node-role.kubernetes.io/master
+        operator: Exists
+      - effect: NoSchedule
+        key: node.kubernetes.io/not-ready
+        operator: Exists
+      volumes:
+      - name: lib-modules
+        hostPath:
+          path: /lib/modules
+      - name: cni-conf-dir
+        hostPath:
+          path: /etc/cni/net.d
+      - name: kube-router-cfg
+        configMap:
+          name: kube-router-cfg
+      - name: kubeconfig
+        configMap:
+          name: kube-router-kubeconfig
+          items:
+          - key: kubeconfig.conf
+            path: kubeconfig
+      - name: xtables-lock
+        hostPath:
+          path: /run/xtables.lock
+          type: FileOrCreate
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kube-router
+  namespace: kube-system
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1beta1
+metadata:
+  name: kube-router
+  namespace: kube-system
+rules:
+  - apiGroups:
+    - ""
+    resources:
+      - namespaces
+      - pods
+      - services
+      - nodes
+      - endpoints
+    verbs:
+      - list
+      - get
+      - watch
+  - apiGroups:
+    - "networking.k8s.io"
+    resources:
+      - networkpolicies
+    verbs:
+      - list
+      - get
+      - watch
+  - apiGroups:
+    - extensions
+    resources:
+      - networkpolicies
+    verbs:
+      - get
+      - list
+      - watch
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1beta1
+metadata:
+  name: kube-router
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: kube-router
+subjects:
+- kind: ServiceAccount
+  name: kube-router
+  namespace: kube-system
diff --git a/roles/kubernetes/kubeadm/prune/tasks/net_kube-router.yml b/roles/kubernetes/kubeadm/prune/tasks/net_kube-router.yml
new file mode 100644
index 00000000..94832c38
--- /dev/null
+++ b/roles/kubernetes/kubeadm/prune/tasks/net_kube-router.yml
@@ -0,0 +1,2 @@
+---
+## nothing to do here
diff --git a/roles/kubernetes/kubeadm/reset/tasks/main.yml b/roles/kubernetes/kubeadm/reset/tasks/main.yml
index cf9c125d..8a21fbd5 100644
--- a/roles/kubernetes/kubeadm/reset/tasks/main.yml
+++ b/roles/kubernetes/kubeadm/reset/tasks/main.yml
@@ -14,6 +14,7 @@
     - /etc/kubernetes/network-plugin.yml
     - /etc/kubernetes/node-local-dns.yml
     - /etc/kubernetes/addons
+    - /etc/default/kubelet
   file:
     path: "{{ item }}"
     state: absent
-- 
cgit v1.2.3