site_type/sriov/templates/baremetal/calico-ip-rules.j2

   1 ---
   2 ##############################################################################
   3 # Copyright (c) 2018 AT&T Intellectual Property. All rights reserved.        #
   4 #                                                                            #
   5 # Licensed under the Apache License, Version 2.0 (the "License"); you may    #
   6 # not use this file except in compliance with the License.                   #
   7 #                                                                            #
   8 # You may obtain a copy of the License at                                    #
   9 #       http://www.apache.org/licenses/LICENSE-2.0                           #
  10 #                                                                            #
  11 # Unless required by applicable law or agreed to in writing, software        #
  12 # distributed under the License is distributed on an "AS IS" BASIS, WITHOUT  #
  13 # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.           #
  14 # See the License for the specific language governing permissions and        #
  15 # limitations under the License.                                             #
  16 ##############################################################################
  17
  18 schema: 'drydock/BootAction/v1'
  19 metadata:
  20   schema: 'metadata/Document/v1'
  21   name: calico-ip-rules
  22   storagePolicy: 'cleartext'
  23   layeringDefinition:
  24     abstract: false
  25     layer: site
  26   labels:
  27     application: 'drydock'
  28   substitutions:
  29     - src:
  30         schema: pegleg/CommonAddresses/v1
  31         name: common-addresses
  32         path: .kubernetes.pod_cidr
  33       dest:
  34         path: .assets[0].data
  35         pattern: DH_SUB_POD_CIDR
  36 data:
  37   signaling: false
  38   assets:
  39     - path: /etc/systemd/system/configure-ip-rules.service
  40       type: unit
  41       permissions: '444'
  42       data: |-
  43         [Unit]
  44         Description=IP Rules Initialization Service
  45         After=network-online.target local-fs.target
  46
  47         [Service]
  48         Type=simple
  49         ExecStart=/opt/configure-ip-rules.sh -g {{yaml.networks.ksn.vrrp_ip}} -c {{yaml.kubernetes.pod_cidr}} -s {{yaml.networks.ksn.additional_cidrs | first}}
  50
  51         [Install]
  52         WantedBy=multi-user.target
  53       data_pipeline:
  54         - utf8_decode
  55     - path: /opt/configure-ip-rules.sh
  56       type: file
  57       permissions: '700'
  58       data_pipeline:
  59         - utf8_decode
  60       data: |-
  61         #!/bin/bash
  62         set -ex
  63
  64         function usage() {
  65             cat <<EOU
  66         Options are:
  67
  68           -c POD_CIDR     The pod CIDR for the Kubernetes cluster, e.g. {{yaml.kubernetes.pod_cidr}}
  69           -i INTERFACE    The interface for internal pod traffic, e.g. bond1.2006
  70           -o OVERLAP_CIDR (optional) This CIDR will be routed via the VRRP IP on
  71                           INTERFACE.  It is used to provide a work around when
  72                           complete Calico routes cannot be received via BGP.
  73                           e.g. 10.96.0.0/15.  NOTE: This must include the POD_CIDR.
  74           -s SERVICE_CIDR (optional) A routable CIDR to configure for ingress, maas,
  75                           e.g. 135.21.99.192/29
  76         EOU
  77         }
  78
  79         SERVICE_CIDR=
  80         OVERLAP_CIDR=
  81
  82         while getopts ":c:hi:o:s:" o; do
  83             case "${o}" in
  84                 c)
  85                     POD_CIDR=${OPTARG}
  86                     ;;
  87                 h)
  88                     usage
  89                     exit 0
  90                     ;;
  91                 i)
  92                     INTERFACE=${OPTARG}
  93                     ;;
  94                 o)
  95                     OVERLAP_CIDR=${OPTARG}
  96                     ;;
  97                 s)
  98                     SERVICE_CIDR=${OPTARG}
  99                     ;;
 100                 \?)
 101                     echo "Unknown option: -${OPTARG}" >&2
 102                     exit 1
 103                     ;;
 104                 :)
 105                     echo "Missing argument for option: -${OPTARG}" >&2
 106                     exit 1
 107                     ;;
 108                 *)
 109                     echo "Unimplemented option: -${OPTARG}" >&2
 110                     exit 1
 111                     ;;
 112             esac
 113         done
 114         shift $((OPTIND-1))
 115
 116         if [ "x$POD_CIDR" == "x" ]; then
 117             echo "Missing pod CIDR, e.g -c {{yaml.kubernetes.pod_cidr}}" >&2
 118             usage
 119             exit 1
 120         fi
 121
 122         if [ "x$INTERFACE" == "x" ]; then
 123             echo "Missing interface, e.g. -i bond1.2006" >&2
 124             usage
 125             exit 1
 126         fi
 127
 128         while ! ip route list dev "${INTERFACE}" > /dev/null; do
 129             echo Waiting for device "${INTERFACE}" to be ready. >&2
 130             sleep 5
 131         done
 132
 133         intra_vrrp_ip=$(ip route list dev "${INTERFACE}" | awk '($2~/via/){print $3}' | head -n 1)
 134
 135         TABLE="1500"
 136
 137         # Setup a routing table for traffic from service IPs
 138         ip route flush table "${TABLE}"
 139         ip route add default via "${intra_vrrp_ip}" table "${TABLE}"
 140
 141         if [ "x$OVERLAP_CIDR" != "x" ]; then
 142             # NOTE(mb874d): This is a work-around for nodes not receiving complete
 143             # routes via BGP.  It may also be required for brownfield large sites.
 144             ip route add "${OVERLAP_CIDR}" via "${intra_vrrp_ip}"
 145         fi
 146
 147         if [ "x$SERVICE_CIDR" != "x" ]; then
 148             # Traffic from the service IPs to pods should use the pod network.
 149             ip rule add \
 150                 from "${SERVICE_CIDR}" \
 151                 to "${POD_CIDR}" \
 152                 lookup main \
 153                 pref 10000
 154             # Other traffic from service IPs should only use the VRRP IP
 155             ip rule add \
 156                 from "${SERVICE_CIDR}" \
 157                 lookup "${TABLE}" \
 158                 pref 10100
 159         fi
 160 ...