From 150911af46705be2e2b0726cfb6e0446b2c7a3d4 Mon Sep 17 00:00:00 2001 From: Christian Pointner Date: Tue, 28 Apr 2020 22:56:12 +0200 Subject: kubeguard: split up role --- roles/kubernetes/net/kubeguard/defaults/main.yml | 2 - .../kubeguard/files/kubeguard-interfaces.service | 12 --- .../net/kubeguard/filter_plugins/kubeguard.py | 33 ------- roles/kubernetes/net/kubeguard/handlers/main.yml | 4 - .../node/files/kubeguard-interfaces.service | 12 +++ .../net/kubeguard/node/filter_plugins/kubeguard.py | 33 +++++++ .../net/kubeguard/node/handlers/main.yml | 4 + roles/kubernetes/net/kubeguard/node/tasks/main.yml | 107 +++++++++++++++++++++ .../net/kubeguard/node/templates/ifupdown.sh.j2 | 55 +++++++++++ .../net/kubeguard/node/templates/k8s.json.j2 | 12 +++ .../node/templates/kubeguard-peer.service.j2 | 37 +++++++ .../kubernetes/net/kubeguard/reset/tasks/main.yml | 26 +++++ roles/kubernetes/net/kubeguard/tasks/add.yml | 107 --------------------- roles/kubernetes/net/kubeguard/tasks/main.yml | 3 - roles/kubernetes/net/kubeguard/tasks/remove.yml | 26 ----- .../net/kubeguard/templates/ifupdown.sh.j2 | 55 ----------- .../kubernetes/net/kubeguard/templates/k8s.json.j2 | 12 --- .../kubeguard/templates/kubeguard-peer.service.j2 | 37 ------- 18 files changed, 286 insertions(+), 291 deletions(-) delete mode 100644 roles/kubernetes/net/kubeguard/defaults/main.yml delete mode 100644 roles/kubernetes/net/kubeguard/files/kubeguard-interfaces.service delete mode 100644 roles/kubernetes/net/kubeguard/filter_plugins/kubeguard.py delete mode 100644 roles/kubernetes/net/kubeguard/handlers/main.yml create mode 100644 roles/kubernetes/net/kubeguard/node/files/kubeguard-interfaces.service create mode 100644 roles/kubernetes/net/kubeguard/node/filter_plugins/kubeguard.py create mode 100644 roles/kubernetes/net/kubeguard/node/handlers/main.yml create mode 100644 roles/kubernetes/net/kubeguard/node/tasks/main.yml create mode 100644 roles/kubernetes/net/kubeguard/node/templates/ifupdown.sh.j2 create mode 100644 roles/kubernetes/net/kubeguard/node/templates/k8s.json.j2 create mode 100644 roles/kubernetes/net/kubeguard/node/templates/kubeguard-peer.service.j2 create mode 100644 roles/kubernetes/net/kubeguard/reset/tasks/main.yml delete mode 100644 roles/kubernetes/net/kubeguard/tasks/add.yml delete mode 100644 roles/kubernetes/net/kubeguard/tasks/main.yml delete mode 100644 roles/kubernetes/net/kubeguard/tasks/remove.yml delete mode 100644 roles/kubernetes/net/kubeguard/templates/ifupdown.sh.j2 delete mode 100644 roles/kubernetes/net/kubeguard/templates/k8s.json.j2 delete mode 100644 roles/kubernetes/net/kubeguard/templates/kubeguard-peer.service.j2 (limited to 'roles/kubernetes') diff --git a/roles/kubernetes/net/kubeguard/defaults/main.yml b/roles/kubernetes/net/kubeguard/defaults/main.yml deleted file mode 100644 index acabaa25..00000000 --- a/roles/kubernetes/net/kubeguard/defaults/main.yml +++ /dev/null @@ -1,2 +0,0 @@ ---- -kubeguard_action: add diff --git a/roles/kubernetes/net/kubeguard/files/kubeguard-interfaces.service b/roles/kubernetes/net/kubeguard/files/kubeguard-interfaces.service deleted file mode 100644 index 35fc8f90..00000000 --- a/roles/kubernetes/net/kubeguard/files/kubeguard-interfaces.service +++ /dev/null @@ -1,12 +0,0 @@ -[Unit] -Description=Kubeguard Network Setup -After=network.target - -[Service] -Type=oneshot -ExecStart=/var/lib/kubeguard/ifupdown.sh up -ExecStop=/var/lib/kubeguard/ifupdown.sh down -RemainAfterExit=yes - -[Install] -WantedBy=multi-user.target diff --git a/roles/kubernetes/net/kubeguard/filter_plugins/kubeguard.py b/roles/kubernetes/net/kubeguard/filter_plugins/kubeguard.py deleted file mode 100644 index 199ff14b..00000000 --- a/roles/kubernetes/net/kubeguard/filter_plugins/kubeguard.py +++ /dev/null @@ -1,33 +0,0 @@ -from __future__ import (absolute_import, division, print_function) -__metaclass__ = type - -from ansible import errors - - -def direct_net_zone(data, myname, peer): - try: - zones = [] - for zone in data: - if myname in data[zone]['node_interface'] and peer in data[zone]['node_interface']: - zones.append(zone) - - if not zones: - return "" - if len(zones) > 1: - raise errors.AnsibleFilterError("host '%s' and '%s' have multiple direct net zones in common: %s" % - (myname, peer, zones.join(','))) - return zones[0] - - except Exception as e: - raise errors.AnsibleFilterError("direct_net_zones(): %s" % str(e)) - - -class FilterModule(object): - - ''' Kubeguard Network Filters ''' - filter_map = { - 'direct_net_zone': direct_net_zone, - } - - def filters(self): - return self.filter_map diff --git a/roles/kubernetes/net/kubeguard/handlers/main.yml b/roles/kubernetes/net/kubeguard/handlers/main.yml deleted file mode 100644 index bb7fde2b..00000000 --- a/roles/kubernetes/net/kubeguard/handlers/main.yml +++ /dev/null @@ -1,4 +0,0 @@ ---- -- name: reload systemd - systemd: - daemon_reload: yes diff --git a/roles/kubernetes/net/kubeguard/node/files/kubeguard-interfaces.service b/roles/kubernetes/net/kubeguard/node/files/kubeguard-interfaces.service new file mode 100644 index 00000000..35fc8f90 --- /dev/null +++ b/roles/kubernetes/net/kubeguard/node/files/kubeguard-interfaces.service @@ -0,0 +1,12 @@ +[Unit] +Description=Kubeguard Network Setup +After=network.target + +[Service] +Type=oneshot +ExecStart=/var/lib/kubeguard/ifupdown.sh up +ExecStop=/var/lib/kubeguard/ifupdown.sh down +RemainAfterExit=yes + +[Install] +WantedBy=multi-user.target diff --git a/roles/kubernetes/net/kubeguard/node/filter_plugins/kubeguard.py b/roles/kubernetes/net/kubeguard/node/filter_plugins/kubeguard.py new file mode 100644 index 00000000..199ff14b --- /dev/null +++ b/roles/kubernetes/net/kubeguard/node/filter_plugins/kubeguard.py @@ -0,0 +1,33 @@ +from __future__ import (absolute_import, division, print_function) +__metaclass__ = type + +from ansible import errors + + +def direct_net_zone(data, myname, peer): + try: + zones = [] + for zone in data: + if myname in data[zone]['node_interface'] and peer in data[zone]['node_interface']: + zones.append(zone) + + if not zones: + return "" + if len(zones) > 1: + raise errors.AnsibleFilterError("host '%s' and '%s' have multiple direct net zones in common: %s" % + (myname, peer, zones.join(','))) + return zones[0] + + except Exception as e: + raise errors.AnsibleFilterError("direct_net_zones(): %s" % str(e)) + + +class FilterModule(object): + + ''' Kubeguard Network Filters ''' + filter_map = { + 'direct_net_zone': direct_net_zone, + } + + def filters(self): + return self.filter_map diff --git a/roles/kubernetes/net/kubeguard/node/handlers/main.yml b/roles/kubernetes/net/kubeguard/node/handlers/main.yml new file mode 100644 index 00000000..bb7fde2b --- /dev/null +++ b/roles/kubernetes/net/kubeguard/node/handlers/main.yml @@ -0,0 +1,4 @@ +--- +- name: reload systemd + systemd: + daemon_reload: yes diff --git a/roles/kubernetes/net/kubeguard/node/tasks/main.yml b/roles/kubernetes/net/kubeguard/node/tasks/main.yml new file mode 100644 index 00000000..0658b42c --- /dev/null +++ b/roles/kubernetes/net/kubeguard/node/tasks/main.yml @@ -0,0 +1,107 @@ +--- +- name: install wireguard + import_role: + name: wireguard/base + +- name: create network config directory + file: + name: /var/lib/kubeguard/ + state: directory + +- name: configure wireguard port + set_fact: + kubeguard_wireguard_port: "{{ kubernetes.wireguard_port | default(51820) }}" + +- name: install ifupdown script + template: + src: ifupdown.sh.j2 + dest: /var/lib/kubeguard/ifupdown.sh + mode: 0755 + # TODO: notify reload... this is unfortunately already to late because + # it must probably be brought down by the old version of the script + +- name: generate wireguard private key + shell: "umask 077; wg genkey > /var/lib/kubeguard/kube-wg0.privatekey" + args: + creates: /var/lib/kubeguard/kube-wg0.privatekey + +- name: fetch wireguard public key + shell: "wg pubkey < /var/lib/kubeguard/kube-wg0.privatekey" + register: kubeguard_wireguard_pubkey + changed_when: false + check_mode: no + +- name: install systemd service unit for network interfaces + copy: + src: kubeguard-interfaces.service + dest: /etc/systemd/system/kubeguard-interfaces.service + # TODO: notify: reload??? + +- name: make sure kubeguard interfaces service is started and enabled + systemd: + daemon_reload: yes + name: kubeguard-interfaces.service + state: started + enabled: yes + +- name: get list of currently installed kubeguard peers + find: + path: /etc/systemd/system/ + pattern: "kubeguard-peer-*.service" + register: kubeguard_peers_installed + +- name: compute list of peers to be added + set_fact: + kubeguard_peers_to_add: "{{ groups['_kubernetes_nodes_'] | difference(inventory_hostname) }}" + +- name: compute list of peers to be removed + set_fact: + kubeguard_peers_to_remove: "{{ kubeguard_peers_installed.files | map(attribute='path') | map('replace', '/etc/systemd/system/kubeguard-peer-', '') | map('replace', '.service', '') | difference(kubeguard_peers_to_add) }}" + +- name: stop/disable systemd units for stale kubeguard peers + loop: "{{ kubeguard_peers_to_remove }}" + systemd: + name: "kubeguard-peer-{{ item }}.service" + state: stopped + enabled: no + +- name: remove systemd units for stale kubeguard peers + loop: "{{ kubeguard_peers_to_remove }}" + file: + name: "/etc/systemd/system/kubeguard-peer-{{ item }}.service" + state: absent + +- name: install systemd units for every kubeguard peer + loop: "{{ kubeguard_peers_to_add }}" + loop_control: + loop_var: peer + template: + src: kubeguard-peer.service.j2 + dest: "/etc/systemd/system/kubeguard-peer-{{ peer }}.service" + # TODO: notify restart for peers that change... + +- name: make sure kubeguard peer services are started and enabled + loop: "{{ kubeguard_peers_to_add }}" + systemd: + daemon_reload: yes + name: "kubeguard-peer-{{ item }}.service" + state: started + enabled: yes + +- name: enable IPv4 forwarding + sysctl: + name: net.ipv4.ip_forward + value: '1' + sysctl_set: yes + state: present + reload: yes + +- name: create cni config directory + file: + name: /etc/cni/net.d + state: directory + +- name: install cni config + template: + src: k8s.json.j2 + dest: /etc/cni/net.d/k8s.json diff --git a/roles/kubernetes/net/kubeguard/node/templates/ifupdown.sh.j2 b/roles/kubernetes/net/kubeguard/node/templates/ifupdown.sh.j2 new file mode 100644 index 00000000..98b38cf4 --- /dev/null +++ b/roles/kubernetes/net/kubeguard/node/templates/ifupdown.sh.j2 @@ -0,0 +1,55 @@ +#!/bin/bash + +set -e + +CONF_D="/var/lib/kubeguard/" + +INET_IF="{{ ansible_default_ipv4.interface }}" + +POD_NET_CIDR="{{ kubernetes.pod_ip_range }}" + +{% set br_net = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubeguard.node_index[inventory_hostname]) -%} +BR_IF="kube-br0" +BR_IP="{{ br_net | ipaddr(1) | ipaddr('address') }}" +BR_IP_CIDR="{{ br_net | ipaddr(1) }}" +BR_NET_CIDR="{{ br_net }}" + +TUN_IF="kube-wg0" +TUN_IP_CIDR="{{ kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, 0) | ipaddr(kubeguard.node_index[inventory_hostname]) }}" + + +case "$1" in + up) + # bring up bridge for local pods + ip link add dev "$BR_IF" type bridge + ip addr add dev "$BR_IF" "$BR_IP_CIDR" + ip link set up dev "$BR_IF" + iptables -t nat -A POSTROUTING -s "$BR_NET_CIDR" -o "$INET_IF" -j MASQUERADE + modprobe br_netfilter + + # bring up wireguard tunnel to other nodes + ip link add dev "$TUN_IF" type wireguard + ip addr add dev "$TUN_IF" "$TUN_IP_CIDR" + wg set "$TUN_IF" listen-port {{ kubeguard_wireguard_port }} private-key "$CONF_D/$TUN_IF.privatekey" + ip link set up dev "$TUN_IF" + + # make pods and service IPs reachable + # !!! use IP of bridge as source so we don't produce martians if direct-zones are involved!!! + ip route add "$POD_NET_CIDR" dev "$TUN_IF" src "$BR_IP" + ;; + down) + # bring down wireguard tunnel to other nodes + ip route del "$POD_NET_CIDR" dev "$TUN_IF" + ip link del dev "$TUN_IF" + + # bring down bridge for local pods + iptables -t nat -D POSTROUTING -s "$BR_NET_CIDR" -o "$INET_IF" -j MASQUERADE + ip link del dev "$BR_IF" + ;; + *) + echo "usage: $0 (up|down)" + exit 1 + ;; +esac + +exit 0 diff --git a/roles/kubernetes/net/kubeguard/node/templates/k8s.json.j2 b/roles/kubernetes/net/kubeguard/node/templates/k8s.json.j2 new file mode 100644 index 00000000..65b1357a --- /dev/null +++ b/roles/kubernetes/net/kubeguard/node/templates/k8s.json.j2 @@ -0,0 +1,12 @@ +{ + "cniVersion": "0.3.1", + "name": "k8s", + "type": "bridge", + "bridge": "kube-br0", + "isDefaultGateway": true, + "hairpinMode": true, + "ipam": { + "type": "host-local", + "subnet": "{{ kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubeguard.node_index[inventory_hostname]) }}" + } +} diff --git a/roles/kubernetes/net/kubeguard/node/templates/kubeguard-peer.service.j2 b/roles/kubernetes/net/kubeguard/node/templates/kubeguard-peer.service.j2 new file mode 100644 index 00000000..72b39c3f --- /dev/null +++ b/roles/kubernetes/net/kubeguard/node/templates/kubeguard-peer.service.j2 @@ -0,0 +1,37 @@ +[Unit] +Description=Kubernetes Network Peer {{ peer }} +After=network.target +Requires=kubeguard-interfaces.service +After=kubeguard-interfaces.service + +{% set pod_ip_self = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubeguard.node_index[inventory_hostname]) | ipaddr(1) | ipaddr('address') -%} +{% set pod_net_peer = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubeguard.node_index[peer]) -%} +{% set direct_zone = kubeguard.direct_net_zones | direct_net_zone(inventory_hostname, peer) -%} +{% if direct_zone %} +{% set direct_ip = kubeguard.direct_net_zones[direct_zone].transfer_net | ipaddr(kubeguard.node_index[inventory_hostname]) %} +{% set direct_interface = kubeguard.direct_net_zones[direct_zone].node_interface[inventory_hostname] %} +{% set direct_ip_peer = kubeguard.direct_net_zones[direct_zone].transfer_net | ipaddr(kubeguard.node_index[peer]) %} +{% else %} +{% set tun_ip = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, 0) | ipaddr(kubeguard.node_index[peer]) -%} +{% set wg_pubkey = hostvars[peer].kubeguard_wireguard_pubkey.stdout -%} +{% set wg_host = hostvars[peer].external_ip_cooked | default(hostvars[peer].ansible_default_ipv4.address) -%} +{% set wg_port = hostvars[peer].kubeguard_wireguard_port -%} +{% set wg_allowedips = (tun_ip | ipaddr('address')) + "/32," + pod_net_peer %} +{% endif %} +[Service] +Type=oneshot +{% if direct_zone %} +ExecStart=/sbin/ip addr add {{ direct_ip }} dev {{ direct_interface }} +ExecStart=/sbin/ip link set up dev {{ direct_interface }} +ExecStart=/sbin/ip route add {{ pod_net_peer }} via {{ direct_ip_peer | ipaddr('address') }} src {{ pod_ip_self }} +ExecStop=/sbin/ip route del {{ pod_net_peer }} +ExecStop=/sbin/ip link set down dev {{ direct_interface }} +ExecStop=/sbin/ip addr del {{ direct_ip }} dev {{ direct_interface }} +{% else %} +ExecStart=/usr/bin/wg set kube-wg0 peer {{ wg_pubkey }} allowed-ips {{ wg_allowedips }} endpoint {{ wg_host }}:{{ wg_port }} persistent-keepalive 10 +ExecStop=/usr/bin/wg set kube-wg0 peer {{ wg_pubkey }} remove +{% endif %} +RemainAfterExit=yes + +[Install] +WantedBy=multi-user.target diff --git a/roles/kubernetes/net/kubeguard/reset/tasks/main.yml b/roles/kubernetes/net/kubeguard/reset/tasks/main.yml new file mode 100644 index 00000000..d24f9eff --- /dev/null +++ b/roles/kubernetes/net/kubeguard/reset/tasks/main.yml @@ -0,0 +1,26 @@ +--- +- name: check if kubeguard interface service unit exists + stat: + path: /etc/systemd/system/kubeguard-interfaces.service + register: kubeguard_interface_unit + +- name: bring down kubeguard interface + systemd: + name: kubeguard-interfaces.service + state: stopped + when: kubeguard_interface_unit.stat.exists + +- name: gather list of all kubeguard related service units + find: + path: /etc/systemd/system/ + patterns: + - "kubeguard-peer-*.service" + - kubeguard-interfaces.service + register: kubeguard_units_installed + +- name: remove all kubeguard related files and directories + loop: "{{ kubeguard_units_installed.files | map(attribute='path') | list | flatten | union(['/var/lib/kubeguard']) }}" + file: + path: "{{ item }}" + state: absent + notify: reload systemd diff --git a/roles/kubernetes/net/kubeguard/tasks/add.yml b/roles/kubernetes/net/kubeguard/tasks/add.yml deleted file mode 100644 index 0658b42c..00000000 --- a/roles/kubernetes/net/kubeguard/tasks/add.yml +++ /dev/null @@ -1,107 +0,0 @@ ---- -- name: install wireguard - import_role: - name: wireguard/base - -- name: create network config directory - file: - name: /var/lib/kubeguard/ - state: directory - -- name: configure wireguard port - set_fact: - kubeguard_wireguard_port: "{{ kubernetes.wireguard_port | default(51820) }}" - -- name: install ifupdown script - template: - src: ifupdown.sh.j2 - dest: /var/lib/kubeguard/ifupdown.sh - mode: 0755 - # TODO: notify reload... this is unfortunately already to late because - # it must probably be brought down by the old version of the script - -- name: generate wireguard private key - shell: "umask 077; wg genkey > /var/lib/kubeguard/kube-wg0.privatekey" - args: - creates: /var/lib/kubeguard/kube-wg0.privatekey - -- name: fetch wireguard public key - shell: "wg pubkey < /var/lib/kubeguard/kube-wg0.privatekey" - register: kubeguard_wireguard_pubkey - changed_when: false - check_mode: no - -- name: install systemd service unit for network interfaces - copy: - src: kubeguard-interfaces.service - dest: /etc/systemd/system/kubeguard-interfaces.service - # TODO: notify: reload??? - -- name: make sure kubeguard interfaces service is started and enabled - systemd: - daemon_reload: yes - name: kubeguard-interfaces.service - state: started - enabled: yes - -- name: get list of currently installed kubeguard peers - find: - path: /etc/systemd/system/ - pattern: "kubeguard-peer-*.service" - register: kubeguard_peers_installed - -- name: compute list of peers to be added - set_fact: - kubeguard_peers_to_add: "{{ groups['_kubernetes_nodes_'] | difference(inventory_hostname) }}" - -- name: compute list of peers to be removed - set_fact: - kubeguard_peers_to_remove: "{{ kubeguard_peers_installed.files | map(attribute='path') | map('replace', '/etc/systemd/system/kubeguard-peer-', '') | map('replace', '.service', '') | difference(kubeguard_peers_to_add) }}" - -- name: stop/disable systemd units for stale kubeguard peers - loop: "{{ kubeguard_peers_to_remove }}" - systemd: - name: "kubeguard-peer-{{ item }}.service" - state: stopped - enabled: no - -- name: remove systemd units for stale kubeguard peers - loop: "{{ kubeguard_peers_to_remove }}" - file: - name: "/etc/systemd/system/kubeguard-peer-{{ item }}.service" - state: absent - -- name: install systemd units for every kubeguard peer - loop: "{{ kubeguard_peers_to_add }}" - loop_control: - loop_var: peer - template: - src: kubeguard-peer.service.j2 - dest: "/etc/systemd/system/kubeguard-peer-{{ peer }}.service" - # TODO: notify restart for peers that change... - -- name: make sure kubeguard peer services are started and enabled - loop: "{{ kubeguard_peers_to_add }}" - systemd: - daemon_reload: yes - name: "kubeguard-peer-{{ item }}.service" - state: started - enabled: yes - -- name: enable IPv4 forwarding - sysctl: - name: net.ipv4.ip_forward - value: '1' - sysctl_set: yes - state: present - reload: yes - -- name: create cni config directory - file: - name: /etc/cni/net.d - state: directory - -- name: install cni config - template: - src: k8s.json.j2 - dest: /etc/cni/net.d/k8s.json diff --git a/roles/kubernetes/net/kubeguard/tasks/main.yml b/roles/kubernetes/net/kubeguard/tasks/main.yml deleted file mode 100644 index 10b0d547..00000000 --- a/roles/kubernetes/net/kubeguard/tasks/main.yml +++ /dev/null @@ -1,3 +0,0 @@ ---- -- name: add/remove nodes to overlay network - include_tasks: "{{ kubeguard_action }}.yml" diff --git a/roles/kubernetes/net/kubeguard/tasks/remove.yml b/roles/kubernetes/net/kubeguard/tasks/remove.yml deleted file mode 100644 index d24f9eff..00000000 --- a/roles/kubernetes/net/kubeguard/tasks/remove.yml +++ /dev/null @@ -1,26 +0,0 @@ ---- -- name: check if kubeguard interface service unit exists - stat: - path: /etc/systemd/system/kubeguard-interfaces.service - register: kubeguard_interface_unit - -- name: bring down kubeguard interface - systemd: - name: kubeguard-interfaces.service - state: stopped - when: kubeguard_interface_unit.stat.exists - -- name: gather list of all kubeguard related service units - find: - path: /etc/systemd/system/ - patterns: - - "kubeguard-peer-*.service" - - kubeguard-interfaces.service - register: kubeguard_units_installed - -- name: remove all kubeguard related files and directories - loop: "{{ kubeguard_units_installed.files | map(attribute='path') | list | flatten | union(['/var/lib/kubeguard']) }}" - file: - path: "{{ item }}" - state: absent - notify: reload systemd diff --git a/roles/kubernetes/net/kubeguard/templates/ifupdown.sh.j2 b/roles/kubernetes/net/kubeguard/templates/ifupdown.sh.j2 deleted file mode 100644 index 98b38cf4..00000000 --- a/roles/kubernetes/net/kubeguard/templates/ifupdown.sh.j2 +++ /dev/null @@ -1,55 +0,0 @@ -#!/bin/bash - -set -e - -CONF_D="/var/lib/kubeguard/" - -INET_IF="{{ ansible_default_ipv4.interface }}" - -POD_NET_CIDR="{{ kubernetes.pod_ip_range }}" - -{% set br_net = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubeguard.node_index[inventory_hostname]) -%} -BR_IF="kube-br0" -BR_IP="{{ br_net | ipaddr(1) | ipaddr('address') }}" -BR_IP_CIDR="{{ br_net | ipaddr(1) }}" -BR_NET_CIDR="{{ br_net }}" - -TUN_IF="kube-wg0" -TUN_IP_CIDR="{{ kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, 0) | ipaddr(kubeguard.node_index[inventory_hostname]) }}" - - -case "$1" in - up) - # bring up bridge for local pods - ip link add dev "$BR_IF" type bridge - ip addr add dev "$BR_IF" "$BR_IP_CIDR" - ip link set up dev "$BR_IF" - iptables -t nat -A POSTROUTING -s "$BR_NET_CIDR" -o "$INET_IF" -j MASQUERADE - modprobe br_netfilter - - # bring up wireguard tunnel to other nodes - ip link add dev "$TUN_IF" type wireguard - ip addr add dev "$TUN_IF" "$TUN_IP_CIDR" - wg set "$TUN_IF" listen-port {{ kubeguard_wireguard_port }} private-key "$CONF_D/$TUN_IF.privatekey" - ip link set up dev "$TUN_IF" - - # make pods and service IPs reachable - # !!! use IP of bridge as source so we don't produce martians if direct-zones are involved!!! - ip route add "$POD_NET_CIDR" dev "$TUN_IF" src "$BR_IP" - ;; - down) - # bring down wireguard tunnel to other nodes - ip route del "$POD_NET_CIDR" dev "$TUN_IF" - ip link del dev "$TUN_IF" - - # bring down bridge for local pods - iptables -t nat -D POSTROUTING -s "$BR_NET_CIDR" -o "$INET_IF" -j MASQUERADE - ip link del dev "$BR_IF" - ;; - *) - echo "usage: $0 (up|down)" - exit 1 - ;; -esac - -exit 0 diff --git a/roles/kubernetes/net/kubeguard/templates/k8s.json.j2 b/roles/kubernetes/net/kubeguard/templates/k8s.json.j2 deleted file mode 100644 index 65b1357a..00000000 --- a/roles/kubernetes/net/kubeguard/templates/k8s.json.j2 +++ /dev/null @@ -1,12 +0,0 @@ -{ - "cniVersion": "0.3.1", - "name": "k8s", - "type": "bridge", - "bridge": "kube-br0", - "isDefaultGateway": true, - "hairpinMode": true, - "ipam": { - "type": "host-local", - "subnet": "{{ kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubeguard.node_index[inventory_hostname]) }}" - } -} diff --git a/roles/kubernetes/net/kubeguard/templates/kubeguard-peer.service.j2 b/roles/kubernetes/net/kubeguard/templates/kubeguard-peer.service.j2 deleted file mode 100644 index 72b39c3f..00000000 --- a/roles/kubernetes/net/kubeguard/templates/kubeguard-peer.service.j2 +++ /dev/null @@ -1,37 +0,0 @@ -[Unit] -Description=Kubernetes Network Peer {{ peer }} -After=network.target -Requires=kubeguard-interfaces.service -After=kubeguard-interfaces.service - -{% set pod_ip_self = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubeguard.node_index[inventory_hostname]) | ipaddr(1) | ipaddr('address') -%} -{% set pod_net_peer = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, kubeguard.node_index[peer]) -%} -{% set direct_zone = kubeguard.direct_net_zones | direct_net_zone(inventory_hostname, peer) -%} -{% if direct_zone %} -{% set direct_ip = kubeguard.direct_net_zones[direct_zone].transfer_net | ipaddr(kubeguard.node_index[inventory_hostname]) %} -{% set direct_interface = kubeguard.direct_net_zones[direct_zone].node_interface[inventory_hostname] %} -{% set direct_ip_peer = kubeguard.direct_net_zones[direct_zone].transfer_net | ipaddr(kubeguard.node_index[peer]) %} -{% else %} -{% set tun_ip = kubernetes.pod_ip_range | ipsubnet(kubernetes.pod_ip_range_size, 0) | ipaddr(kubeguard.node_index[peer]) -%} -{% set wg_pubkey = hostvars[peer].kubeguard_wireguard_pubkey.stdout -%} -{% set wg_host = hostvars[peer].external_ip_cooked | default(hostvars[peer].ansible_default_ipv4.address) -%} -{% set wg_port = hostvars[peer].kubeguard_wireguard_port -%} -{% set wg_allowedips = (tun_ip | ipaddr('address')) + "/32," + pod_net_peer %} -{% endif %} -[Service] -Type=oneshot -{% if direct_zone %} -ExecStart=/sbin/ip addr add {{ direct_ip }} dev {{ direct_interface }} -ExecStart=/sbin/ip link set up dev {{ direct_interface }} -ExecStart=/sbin/ip route add {{ pod_net_peer }} via {{ direct_ip_peer | ipaddr('address') }} src {{ pod_ip_self }} -ExecStop=/sbin/ip route del {{ pod_net_peer }} -ExecStop=/sbin/ip link set down dev {{ direct_interface }} -ExecStop=/sbin/ip addr del {{ direct_ip }} dev {{ direct_interface }} -{% else %} -ExecStart=/usr/bin/wg set kube-wg0 peer {{ wg_pubkey }} allowed-ips {{ wg_allowedips }} endpoint {{ wg_host }}:{{ wg_port }} persistent-keepalive 10 -ExecStop=/usr/bin/wg set kube-wg0 peer {{ wg_pubkey }} remove -{% endif %} -RemainAfterExit=yes - -[Install] -WantedBy=multi-user.target -- cgit v1.2.3