-
Notifications
You must be signed in to change notification settings - Fork 13
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
8781769
commit 49ce025
Showing
9 changed files
with
191 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,74 @@ | ||
- name: Setup k8s-lb | ||
hosts: k8s-lb | ||
vars_files: | ||
- k8s_lb_config.yaml | ||
tasks: | ||
- name: Install deps | ||
ansible.builtin.apt: | ||
update_cache: true | ||
pkg: | ||
- iptables-persistent | ||
|
||
- name: dummy0 interface | ||
ansible.builtin.template: | ||
src: ./lb_config/netplan_dummy0.yaml.j2 | ||
dest: /etc/netplan/dummy0.yaml | ||
mode: "640" | ||
|
||
- name: eth0 interface | ||
ansible.builtin.template: | ||
src: ./lb_config/netplan_50_cloud_init.yaml.j2 | ||
dest: /etc/netplan/50-cloud-init.yaml | ||
mode: "640" | ||
|
||
- name: Install frr | ||
ansible.builtin.apt: | ||
update_cache: true | ||
pkg: | ||
- frr | ||
|
||
- name: Enable ospfd | ||
ansible.builtin.lineinfile: | ||
path: /etc/frr/daemons | ||
search_string: ospfd=no | ||
line: "ospfd=yes" | ||
|
||
- name: Config template frr | ||
ansible.builtin.template: | ||
src: ./lb_config/frr.conf.j2 | ||
dest: /etc/frr/frr.conf | ||
|
||
- name: Iptables rules | ||
ansible.builtin.template: | ||
src: ./lb_config/iptables.j2 | ||
dest: /etc/iptables/rules.v4 | ||
|
||
- name: Restore iptables rules | ||
ansible.builtin.command: | ||
cmd: "bash -c '/sbin/iptables-restore < /etc/iptables/rules.v4 && touch /tmp/firewall_set'" | ||
creates: /tmp/firewall_set | ||
|
||
- name: Restore iptables rules | ||
ansible.builtin.command: | ||
cmd: "bash -c 'netplan apply && touch /tmp/netplan_applied'" | ||
creates: /tmp/netplan_applied | ||
|
||
- name: Restart and enable iptables service | ||
ansible.builtin.service: | ||
name: netfilter-persistent | ||
state: restarted | ||
enabled: true | ||
|
||
- name: Restart and enable frr service | ||
ansible.builtin.service: | ||
name: frr | ||
state: restarted | ||
enabled: true | ||
|
||
- name: net.ipv4.ip_forward | ||
ansible.posix.sysctl: | ||
name: net.ipv4.ip_forward | ||
value: '1' | ||
sysctl_set: true | ||
state: present | ||
reload: true |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,4 @@ | ||
LB_HOSTNAME: k8s-lb | ||
EXTERNAL_LISTEN_IP: "something" | ||
INTERNAL_NETWORK_RANGE: 24 | ||
INTERNAL_NETWORK_MAC_ADDRESS: "something" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,17 @@ | ||
frr version 8.4.4 | ||
frr defaults traditional | ||
hostname {{ LB_HOSTNAME }} | ||
log syslog informational | ||
no ip forwarding | ||
no ipv6 forwarding | ||
service integrated-vtysh-config | ||
! | ||
interface eth0 | ||
ip ospf cost 10 | ||
exit | ||
! | ||
router ospf | ||
network {{ INTERNAL_NETWORK_RANGE }} area 0 | ||
network {{ EXTERNAL_LISTEN_IP }}/32 area 0 | ||
exit | ||
! |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,11 @@ | ||
*filter | ||
:INPUT ACCEPT [0:0] | ||
:FORWARD ACCEPT [0:0] | ||
:OUTPUT ACCEPT [0:0] | ||
-A INPUT -d {{ EXTERNAL_LISTEN_IP }}/32 -p tcp -m tcp --dport 80 -j ACCEPT | ||
-A INPUT -d {{ EXTERNAL_LISTEN_IP }}/32 -p tcp -m tcp --dport 443 -j ACCEPT | ||
-A INPUT -d {{ EXTERNAL_LISTEN_IP }}/32 -j DROP | ||
-A FORWARD -d {{ EXTERNAL_LISTEN_IP }}/32 -p tcp -m tcp --dport 80 -j ACCEPT | ||
-A FORWARD -d {{ EXTERNAL_LISTEN_IP }}/32 -p tcp -m tcp --dport 443 -j ACCEPT | ||
-A FORWARD -d {{ EXTERNAL_LISTEN_IP }}/32 -j DROP | ||
COMMIT |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,17 @@ | ||
# This file is generated from information provided by the datasource. Changes | ||
# to it will not persist across an instance reboot. To disable cloud-init's | ||
# network configuration capabilities, write a file | ||
# /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg with the following: | ||
# network: {config: disabled} | ||
network: | ||
version: 2 | ||
ethernets: | ||
eth0: | ||
dhcp4: false | ||
dhcp6: false | ||
addresses: [ "{{ inventory_hostname }}/{{ INTERNAL_NETWORK_RANGE }}" ] | ||
nameservers: | ||
addresses: [ "10.10.10.10", "10.10.10.11" ] | ||
match: | ||
macaddress: {{ INTERNAL_NETWORK_MAC_ADDRESS }} | ||
set-name: eth0 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,9 @@ | ||
network: | ||
version: 2 | ||
renderer: networkd | ||
ethernets: | ||
lo: | ||
dhcp4: no | ||
dhcp6: no | ||
addresses: | ||
- {{ EXTERNAL_LISTEN_IP }}/32 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,51 @@ | ||
resource "proxmox_vm_qemu" "k8s-lb" { | ||
name = "k8s-lb" | ||
desc = "router and lb for k8s" | ||
target_node = var.meshdb_proxmox_node | ||
|
||
clone = var.meshdb_proxmox_template_image | ||
|
||
cores = 2 | ||
sockets = 1 | ||
memory = 2560 | ||
os_type = "cloud-init" | ||
agent = 1 | ||
cloudinit_cdrom_storage = var.meshdb_proxmox_storage_location | ||
ciuser = "${var.meshdb_local_user}" | ||
cipassword = "${var.meshdb_local_password}" | ||
|
||
scsihw = "virtio-scsi-pci" | ||
|
||
disks { | ||
scsi { | ||
scsi0 { | ||
disk { | ||
backup = false | ||
size = 10 | ||
storage = var.meshdb_proxmox_storage_location | ||
|
||
} | ||
} | ||
} | ||
} | ||
|
||
network { | ||
bridge = "vmbr0" | ||
model = "virtio" | ||
} | ||
|
||
ipconfig0 = "ip=${var.meshdb_lb_ip}/${var.meshdb_networkrange},gw=${var.meshdb_gateway}" | ||
|
||
ssh_user = "root" | ||
ssh_private_key = file("${path.module}/meshdb${var.meshdb_env_name}") | ||
|
||
sshkeys = file("${path.module}/meshdb${var.meshdb_env_name}.pub") | ||
|
||
serial { | ||
id = 0 | ||
type = "socket" | ||
} | ||
|
||
tags = "meshdb${var.meshdb_env_name}" | ||
} | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters