You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

112 lines
3.8 KiB

contiv network support (#1914) * Add Contiv support Contiv is a network plugin for Kubernetes and Docker. It supports vlan/vxlan/BGP/Cisco ACI technologies. It support firewall policies, multiple networks and bridging pods onto physical networks. * Update contiv version to 1.1.4 Update contiv version to 1.1.4 and added SVC_SUBNET in contiv-config. * Load openvswitch module to workaround on CentOS7.4 * Set contiv cni version to 0.1.0 Correct contiv CNI version to 0.1.0. * Use kube_apiserver_endpoint for K8S_API_SERVER Use kube_apiserver_endpoint as K8S_API_SERVER to make contiv talks to a available endpoint no matter if there's a loadbalancer or not. * Make contiv use its own etcd Before this commit, contiv is using a etcd proxy mode to k8s etcd, this work fine when the etcd hosts are co-located with contiv etcd proxy, however the k8s peering certs are only in etcd group, as a result the etcd-proxy is not able to peering with the k8s etcd on etcd group, plus the netplugin is always trying to find the etcd endpoint on localhost, this will cause problem for all netplugins not runnign on etcd group nodes. This commit make contiv uses its own etcd, separate from k8s one. on kube-master nodes (where net-master runs), it will run as leader mode and on all rest nodes it will run as proxy mode. * Use cp instead of rsync to copy cni binaries Since rsync has been removed from hyperkube, this commit changes it to use cp instead. * Make contiv-etcd able to run on master nodes * Add rbac_enabled flag for contiv pods * Add contiv into CNI network plugin lists * migrate contiv test to tests/files Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> * Add required rules for contiv netplugin * Better handling json return of fwdMode * Make contiv etcd port configurable * Use default var instead of templating * roles/download/defaults/main.yml: use contiv 1.1.7 Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com>
7 years ago
6 years ago
contiv network support (#1914) * Add Contiv support Contiv is a network plugin for Kubernetes and Docker. It supports vlan/vxlan/BGP/Cisco ACI technologies. It support firewall policies, multiple networks and bridging pods onto physical networks. * Update contiv version to 1.1.4 Update contiv version to 1.1.4 and added SVC_SUBNET in contiv-config. * Load openvswitch module to workaround on CentOS7.4 * Set contiv cni version to 0.1.0 Correct contiv CNI version to 0.1.0. * Use kube_apiserver_endpoint for K8S_API_SERVER Use kube_apiserver_endpoint as K8S_API_SERVER to make contiv talks to a available endpoint no matter if there's a loadbalancer or not. * Make contiv use its own etcd Before this commit, contiv is using a etcd proxy mode to k8s etcd, this work fine when the etcd hosts are co-located with contiv etcd proxy, however the k8s peering certs are only in etcd group, as a result the etcd-proxy is not able to peering with the k8s etcd on etcd group, plus the netplugin is always trying to find the etcd endpoint on localhost, this will cause problem for all netplugins not runnign on etcd group nodes. This commit make contiv uses its own etcd, separate from k8s one. on kube-master nodes (where net-master runs), it will run as leader mode and on all rest nodes it will run as proxy mode. * Use cp instead of rsync to copy cni binaries Since rsync has been removed from hyperkube, this commit changes it to use cp instead. * Make contiv-etcd able to run on master nodes * Add rbac_enabled flag for contiv pods * Add contiv into CNI network plugin lists * migrate contiv test to tests/files Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> * Add required rules for contiv netplugin * Better handling json return of fwdMode * Make contiv etcd port configurable * Use default var instead of templating * roles/download/defaults/main.yml: use contiv 1.1.7 Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com>
7 years ago
  1. ---
  2. - name: Contiv | Wait for netmaster
  3. uri:
  4. url: "http://127.0.0.1:{{ contiv_netmaster_port }}/info"
  5. register: result
  6. until: result.status is defined and result.status == 200
  7. retries: 10
  8. delay: 5
  9. - name: Contiv | Get global configuration
  10. command: |
  11. {{ bin_dir }}/netctl --netmaster "http://127.0.0.1:{{ contiv_netmaster_port }}" \
  12. global info --json --all
  13. register: global_config
  14. run_once: true
  15. changed_when: false
  16. - set_fact:
  17. contiv_global_config: "{{ (global_config.stdout|from_json)[0] }}"
  18. - name: Contiv | Set global forwarding mode
  19. command: |
  20. {{ bin_dir }}/netctl --netmaster "http://127.0.0.1:{{ contiv_netmaster_port }}" \
  21. global set --fwd-mode={{ contiv_fwd_mode }}
  22. when: "contiv_global_config.get('fwdMode', '') != contiv_fwd_mode"
  23. run_once: true
  24. - name: Contiv | Set global fabric mode
  25. command: |
  26. {{ bin_dir }}/netctl --netmaster "http://127.0.0.1:{{ contiv_netmaster_port }}" \
  27. global set --fabric-mode={{ contiv_fabric_mode }}
  28. when: "contiv_global_config.networkInfraType != contiv_fabric_mode"
  29. run_once: true
  30. - name: Contiv | Set peer hostname
  31. set_fact:
  32. contiv_peer_hostname: >-
  33. {%- if override_system_hostname|default(true) -%}
  34. {{ contiv_peer_hostname|default({})|combine({item: hostvars[item]['inventory_hostname']}) }}
  35. {%- else -%}
  36. {{ contiv_peer_hostname|default({})|combine({item: hostvars[item]['ansible_fqdn']}) }}
  37. {%- endif -%}
  38. with_items: "{{ groups['k8s-cluster'] }}"
  39. run_once: true
  40. when:
  41. - contiv_fwd_mode == 'routing'
  42. - contiv_peer_with_uplink_leaf
  43. - name: Contiv | Get BGP configuration
  44. command: |
  45. {{ bin_dir }}/netctl --netmaster "http://127.0.0.1:{{ contiv_netmaster_port }}" \
  46. bgp ls --json
  47. register: bgp_config
  48. run_once: true
  49. changed_when: false
  50. when:
  51. - contiv_fwd_mode == 'routing'
  52. - contiv_peer_with_uplink_leaf
  53. - name: Contiv | Configure peering with router(s)
  54. command: |
  55. {{ bin_dir }}/netctl --netmaster "http://127.0.0.1:{{ contiv_netmaster_port }}" \
  56. bgp create {{ item.value }} \
  57. --router-ip="{{ hostvars[item.key]['contiv']['router_ip'] }}" \
  58. --as="{{ hostvars[item.key]['contiv']['as'] | default(contiv_global_as) }}" \
  59. --neighbor-as="{{ hostvars[item.key]['contiv']['neighbor_as'] | default(contiv_global_neighbor_as) }}" \
  60. --neighbor="{{ hostvars[item.key]['contiv']['neighbor'] }}"
  61. run_once: true
  62. with_dict: "{{ contiv_peer_hostname }}"
  63. when:
  64. - contiv_fwd_mode == 'routing'
  65. - contiv_peer_with_uplink_leaf
  66. - bgp_config.stdout|from_json|length == 0 or not item.value in bgp_config.stdout|from_json|map(attribute='key')|list
  67. - name: Contiv | Get existing networks
  68. command: |
  69. {{ bin_dir }}/netctl --netmaster "http://127.0.0.1:{{ contiv_netmaster_port }}" \
  70. net ls -q
  71. register: net_result
  72. run_once: true
  73. changed_when: false
  74. - name: Contiv | Create networks
  75. command: |
  76. {{ bin_dir }}/netctl --netmaster "http://127.0.0.1:{{ contiv_netmaster_port }}" \
  77. net create \
  78. --encap={{ item.encap|default("vxlan") }} \
  79. --gateway={{ item.gateway }} \
  80. --nw-type={{ item.nw_type|default("data") }} \
  81. --pkt-tag={{ item.pkt_tag|default("0") }} \
  82. --subnet={{ item.subnet }} \
  83. --tenant={{ item.tenant|default("default") }} \
  84. "{{ item.name }}"
  85. with_items: "{{ contiv_networks }}"
  86. when: item['name'] not in net_result.stdout_lines
  87. run_once: true
  88. - name: Contiv | Check if default group exists
  89. command: |
  90. {{ bin_dir }}/netctl --netmaster "http://127.0.0.1:{{ contiv_netmaster_port }}" \
  91. group ls -q
  92. register: group_result
  93. run_once: true
  94. changed_when: false
  95. - name: Contiv | Create default group
  96. command: |
  97. {{ bin_dir }}/netctl --netmaster "http://127.0.0.1:{{ contiv_netmaster_port }}" \
  98. group create default-net default
  99. when: "'default' not in group_result.stdout_lines"
  100. run_once: true