Skip to content

Gelencsér Szabolcs / salt

Go to a project
Commit e70df3ca by Bach Dániel
Options

firewall: set BRIDGE_TYPE=NONE

parent 48b6c5a1
Showing with 17 additions and 48 deletions
pillar/firewall.sls
fwdriver: fwdriver:
repo_name: https://git.ik.bme.hu/circle/fwdriver.git repo_name: https://git.ik.bme.hu/circle/fwdriver.git
repo_revision: master repo_revision: master
user: fw user: fw
queue_name: cloud queue_name: cloud
portal_ip: 192.168.1.1
portal_netmask: 255.255.255.0 vm_if: vm
vm_net: 192.168.2.254/24 vm_net: 192.168.2.254/24
management_if: eth5
management_net: 192.168.1.254/24 management_net: 192.168.1.254/24
external_if: eth0
external_net: 10.0.0.97/16 external_net: 10.0.0.97/16
gateway: 10.0.255.254 gateway: 10.0.255.254
external_if: eth0
trunk_if: linkb
management_if: ethy
salt/fwdriver/configuration.sls
...@@ -32,13 +32,6 @@ ...@@ -32,13 +32,6 @@
- user: {{ pillar['fwdriver']['user'] }} - user: {{ pillar['fwdriver']['user'] }}
- group: {{ pillar['fwdriver']['user'] }} - group: {{ pillar['fwdriver']['user'] }}
/etc/init/isc-dhcp-server.conf:
file.managed:
- user: root
- group: root
- template: jinja
- source: salt://fwdriver/files/isc-dhcp-server.conf
/etc/init.d/isc-dhcp-server: /etc/init.d/isc-dhcp-server:
file.symlink: file.symlink:
- target: /lib/init/upstart-job - target: /lib/init/upstart-job
...@@ -50,7 +43,6 @@ isc-dhcp-server: ...@@ -50,7 +43,6 @@ isc-dhcp-server:
- watch: - watch:
- file: /etc/dhcp/dhcpd.conf - file: /etc/dhcp/dhcpd.conf
- file: /etc/dhcp/dhcpd.conf.generated - file: /etc/dhcp/dhcpd.conf.generated
- file: /etc/init/isc-dhcp-server.conf
- file: /etc/init.d/isc-dhcp-server - file: /etc/init.d/isc-dhcp-server
/etc/sysctl.d/60-circle-firewall.conf: /etc/sysctl.d/60-circle-firewall.conf:
......
salt/fwdriver/files/postactivate
export GATEWAY={{ pillar['fwdriver']['gateway'] }} export GATEWAY={{ pillar['fwdriver']['gateway'] }}
export AMQP_URI=amqp://{{ pillar['amqp']['user'] }}:{{ pillar['amqp']['password'] }}@{{ pillar['amqp']['host'] }}:{{ pillar['amqp']['port'] }}/{{ pillar['amqp']['vhost'] }} export AMQP_URI=amqp://{{ pillar['amqp']['user'] }}:{{ pillar['amqp']['password'] }}@{{ pillar['amqp']['host'] }}:{{ pillar['amqp']['port'] }}/{{ pillar['amqp']['vhost'] }}
export CACHE_URI={{ pillar['cache'] }} export CACHE_URI={{ pillar['cache'] }}
export BRIDGE_TYPE=NONE
salt/fwdriver/files/sudoers
{{ pillar['fwdriver']['user'] }} ALL= (ALL) NOPASSWD: /sbin/ip netns exec fw ip addr *, /sbin/ip netns exec fw ip ro *, /sbin/ip netns exec fw ip link *, /sbin/ip netns exec fw ipset *, /usr/bin/ovs-vsctl, /sbin/ip netns exec fw iptables-restore -c, /sbin/ip netns exec fw ip6tables-restore -c, /etc/init.d/isc-dhcp-server restart, /sbin/ip link * {{ pillar['fwdriver']['user'] }} ALL= (ALL) NOPASSWD: /sbin/ip netns exec fw ip addr *, /sbin/ip netns exec fw ip ro *, /sbin/ip netns exec fw ip link *, /sbin/ip netns exec fw ipset *, /usr/bin/ovs-vsctl, /sbin/ip netns exec fw iptables-restore -c, /sbin/ip netns exec fw ip6tables-restore -c, /etc/init.d/isc-dhcp-server restart, /sbin/ip link *, /sbin/iptables-restore -c, /sbin/ip6tables-restore -c, /sbin/ipset *
salt/manager/files/init.sh
...@@ -4,7 +4,6 @@ source /home/{{ pillar['user'] }}/.virtualenvs/circle/bin/activate ...@@ -4,7 +4,6 @@ source /home/{{ pillar['user'] }}/.virtualenvs/circle/bin/activate
source /home/{{ pillar['user'] }}/.virtualenvs/circle/bin/postactivate source /home/{{ pillar['user'] }}/.virtualenvs/circle/bin/postactivate
{% set fw = pillar['fwdriver'] %} {% set fw = pillar['fwdriver'] %}
exec python /home/{{ pillar['user'] }}/circle/circle/manage.py init \ exec python /home/{{ pillar['user'] }}/circle/circle/manage.py init \
--portal-ip={{ fw['portal_ip'] }} \
--external-net={{ fw['external_net'] }} \ --external-net={{ fw['external_net'] }} \
--management-net={{ fw['management_net'] }} \ --management-net={{ fw['management_net'] }} \
--vm-net={{ fw['vm_net'] }} \ --vm-net={{ fw['vm_net'] }} \
...@@ -14,4 +13,4 @@ exec python /home/{{ pillar['user'] }}/circle/circle/manage.py init \ ...@@ -14,4 +13,4 @@ exec python /home/{{ pillar['user'] }}/circle/circle/manage.py init \
--firewall-queue={{ fw['queue_name'] }} \ --firewall-queue={{ fw['queue_name'] }} \
--external-if={{ fw['external_if'] }} \ --external-if={{ fw['external_if'] }} \
--management-if={{ fw['management_if'] }} \ --management-if={{ fw['management_if'] }} \
--trunk-if={{ fw['trunk_if'] }} --vm-if={{ fw['vm_if'] }}
salt/network/init.sls
ovs-if: ovs-if:
cmd.run: cmd.run:
- name: ovs-vsctl add-port cloud man0 tag=3 -- set Interface man0 type=internal - name: ovs-vsctl add-port cloud vm tag=2 -- set Interface vm type=internal
- unless: ovs-vsctl list-ifaces cloud | grep "^man0$" - unless: ovs-vsctl list-ifaces cloud | grep "^vm$"
linka: vm:
network.managed:
- enabled: True
- type: eth
- proto: manual
- pre_up_cmds:
- ip link add linka type veth peer name linkb
- /etc/init.d/openvswitch-switch restart
- /usr/bin/ovs-vsctl --if-exists del-port cloud linka
- /usr/bin/ovs-vsctl --may-exist add-port cloud linka
- ip link set linka up
- ip link set linkb up
- post_down_cmds:
- ip link del linka
{{ pillar['fwdriver']['external_if'] }}:
network.managed:
- enabled: True
- type: eth
- proto: manual
man0:
network.managed: network.managed:
- enabled: True - enabled: True
- type: eth - type: eth
- proto: static - proto: static
- ipaddr: {{ pillar['fwdriver']['portal_ip'] }} - ipaddr: {{ pillar['fwdriver']['vm_net'].split('/')[0] }}
- netmask: {{ pillar['fwdriver']['portal_netmask'] }} - netmask: {{ pillar['fwdriver']['vm_net'].split('/')[1] }}
- gateway: {{ pillar['fwdriver']['management_net'].split('/')[0] }}
- dns:
- 8.8.8.8
- 8.8.4.4
- pre_up_cmds: - pre_up_cmds:
- /etc/init.d/openvswitch-switch restart - /etc/init.d/openvswitch-switch restart
- require: - require:
...@@ -45,7 +20,7 @@ firewall2: ...@@ -45,7 +20,7 @@ firewall2:
- name: firewall - name: firewall
- running - running
- require: - require:
- network: man0 - network: vm
salt://network/files/reload_firewall.sh: salt://network/files/reload_firewall.sh:
cmd.script: cmd.script:
...@@ -53,4 +28,3 @@ salt://network/files/reload_firewall.sh: ...@@ -53,4 +28,3 @@ salt://network/files/reload_firewall.sh:
- user: {{ pillar['user'] }} - user: {{ pillar['user'] }}
- require: - require:
- service: firewall2 - service: firewall2
- network: linka
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or sign in to comment