templates/aic-clcp-manifests/baremetal/bootaction.j2

   1 ---
   2 ##############################################################################
   3 # Copyright © 2018 AT&T Intellectual Property. All rights reserved.          #
   4 #                                                                            #
   5 # Licensed under the Apache License, Version 2.0 (the "License"); you may    #
   6 # not use this file except in compliance with the License.                   #
   7 #                                                                            #
   8 # You may obtain a copy of the License at                                    #
   9 #       http://www.apache.org/licenses/LICENSE-2.0                           #
  10 #                                                                            #
  11 # Unless required by applicable law or agreed to in writing, software        #
  12 # distributed under the License is distributed on an "AS IS" BASIS, WITHOUT  #
  13 # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.           #
  14 # See the License for the specific language governing permissions and        #
  15 # limitations under the License.                                             #
  16 ##############################################################################
  17
  18 schema: 'drydock/BootAction/v1'
  19 metadata:
  20   schema: 'metadata/Document/v1'
  21   name: promjoin
  22   storagePolicy: 'cleartext'
  23   layeringDefinition:
  24     abstract: false
  25     layer: site
  26   labels:
  27     application: 'drydock'
  28 data:
  29   node_filter:
  30     filter_set_type: 'union'
  31     filter_set:
  32       - filter_type: 'union'
  33         node_names:
  34 {% for server in yaml.servers %}
  35           - '{{server.name}}'
  36 {% endfor %}
  37 {% raw %}  # TODO(alanmeadows) move what is global about this document - everything except nodenames to global
  38   assets:
  39     - path: /opt/promjoin.sh
  40       type: file
  41       permissions: '555'
  42       # TODO(alanmeadows) You must replace the ip= parameter below with the appropriate MaaS network name of the network
  43       # you should use to contact kubernetes in the case below, this is cab24_mgmt
  44       location: promenade+http://promenade-api.ucp.svc.cluster.local/api/v1.0/join-scripts?design_ref={{ action.design_ref | urlencode }}&hostname={{ node.hostname }}{% if 'ksn' in node.network %}&ip={{ node.network.ksn.ip }}{% endif %}{% for k, v in node.labels.items() %}&labels.dynamic={{ k }}={{ v }}{% endfor %}
  45       location_pipeline:
  46         - template
  47       data_pipeline:
  48         - utf8_decode
  49     - path: /lib/systemd/system/promjoin.service
  50       type: unit
  51       permissions: '600'
  52       data: |-
  53         W1VuaXRdCkRlc2NyaXB0aW9uPVByb21lbmFkZSBJbml0aWFsaXphdGlvbiBTZXJ2aWNlCkFmdGVy
  54         PW5ldHdvcmstb25saW5lLnRhcmdldCBsb2NhbC1mcy50YXJnZXQKQ29uZGl0aW9uUGF0aEV4aXN0
  55         cz0hL3Zhci9saWIvcHJvbS5kb25lCgpbU2VydmljZV0KVHlwZT1zaW1wbGUKRXhlY1N0YXJ0PS9v
  56         cHQvcHJvbWpvaW4uc2gKCltJbnN0YWxsXQpXYW50ZWRCeT1tdWx0aS11c2VyLnRhcmdldAo=
  57       data_pipeline:
  58         - base64_decode
  59         - utf8_decode
  60 {% endraw %}
  61 ---
  62 schema: 'drydock/BootAction/v1'
  63 metadata:
  64   schema: 'metadata/Document/v1'
  65   name: calico-ip-rules
  66   storagePolicy: 'cleartext'
  67   layeringDefinition:
  68     abstract: false
  69     layer: site
  70   labels:
  71     application: 'drydock'
  72   substitutions:
  73     - src:
  74         schema: pegleg/CommonAddresses/v1
  75         name: common-addresses
  76         path: .kubernetes.pod_cidr
  77       dest:
  78         path: .assets[0].data
  79         pattern: DH_SUB_POD_CIDR
  80 data:
  81   signaling: false
  82   assets:
  83     - path: /etc/systemd/system/configure-ip-rules.service
  84       type: unit
  85       permissions: '444'
  86       data: |-
  87         [Unit]
  88         Description=IP Rules Initialization Service
  89         After=network-online.target local-fs.target
  90
  91         [Service]
  92         Type=simple
  93         ExecStart=/opt/configure-ip-rules.sh -g {{yaml.networks.ksn.vrrp_ip}} -c {{yaml.kubernetes.pod_cidr}} -s {{yaml.networks.ksn.additional_cidrs | first}}
  94
  95         [Install]
  96         WantedBy=multi-user.target
  97       data_pipeline:
  98         - utf8_decode
  99     - path: /opt/configure-ip-rules.sh
 100       type: file
 101       permissions: '700'
 102       data_pipeline:
 103         - utf8_decode
 104       data: |-
 105         #!/bin/bash
 106         set -ex
 107
 108         function usage() {
 109             cat <<EOU
 110         Options are:
 111
 112           -c POD_CIDR     The pod CIDR for the Kubernetes cluster, e.g. {{yaml.kubernetes.pod_cidr}}
 113           -i INTERFACE    The interface for internal pod traffic, e.g. bond1.2006
 114           -o OVERLAP_CIDR (optional) This CIDR will be routed via the VRRP IP on
 115                           INTERFACE.  It is used to provide a work around when
 116                           complete Calico routes cannot be received via BGP.
 117                           e.g. 10.96.0.0/15.  NOTE: This must include the POD_CIDR.
 118           -s SERVICE_CIDR (optional) A routable CIDR to configure for ingress, maas,
 119                           e.g. 135.21.99.192/29
 120         EOU
 121         }
 122
 123         SERVICE_CIDR=
 124         OVERLAP_CIDR=
 125
 126         while getopts ":c:hi:o:s:" o; do
 127             case "${o}" in
 128                 c)
 129                     POD_CIDR=${OPTARG}
 130                     ;;
 131                 h)
 132                     usage
 133                     exit 0
 134                     ;;
 135                 i)
 136                     INTERFACE=${OPTARG}
 137                     ;;
 138                 o)
 139                     OVERLAP_CIDR=${OPTARG}
 140                     ;;
 141                 s)
 142                     SERVICE_CIDR=${OPTARG}
 143                     ;;
 144                 \?)
 145                     echo "Unknown option: -${OPTARG}" >&2
 146                     exit 1
 147                     ;;
 148                 :)
 149                     echo "Missing argument for option: -${OPTARG}" >&2
 150                     exit 1
 151                     ;;
 152                 *)
 153                     echo "Unimplemented option: -${OPTARG}" >&2
 154                     exit 1
 155                     ;;
 156             esac
 157         done
 158         shift $((OPTIND-1))
 159
 160         if [ "x$POD_CIDR" == "x" ]; then
 161             echo "Missing pod CIDR, e.g -c {{yaml.kubernetes.pod_cidr}}" >&2
 162             usage
 163             exit 1
 164         fi
 165
 166         if [ "x$INTERFACE" == "x" ]; then
 167             echo "Missing interface, e.g. -i bond1.2006" >&2
 168             usage
 169             exit 1
 170         fi
 171
 172         while ! ip route list dev "${INTERFACE}" > /dev/null; do
 173             echo Waiting for device "${INTERFACE}" to be ready. >&2
 174             sleep 5
 175         done
 176
 177         intra_vrrp_ip=$(ip route list dev "${INTERFACE}" | awk '($2~/via/){print $3}' | head -n 1)
 178
 179         TABLE="1500"
 180
 181         # Setup a routing table for traffic from service IPs
 182         ip route flush table "${TABLE}"
 183         ip route add default via "${intra_vrrp_ip}" table "${TABLE}"
 184
 185         if [ "x$OVERLAP_CIDR" != "x" ]; then
 186             # NOTE(mb874d): This is a work-around for nodes not receiving complete
 187             # routes via BGP.  It may also be required for brownfield large sites.
 188             ip route add "${OVERLAP_CIDR}" via "${intra_vrrp_ip}"
 189         fi
 190
 191         if [ "x$SERVICE_CIDR" != "x" ]; then
 192             # Traffic from the service IPs to pods should use the pod network.
 193             ip rule add \
 194                 from "${SERVICE_CIDR}" \
 195                 to "${POD_CIDR}" \
 196                 lookup main \
 197                 pref 10000
 198             # Other traffic from service IPs should only use the VRRP IP
 199             ip rule add \
 200                 from "${SERVICE_CIDR}" \
 201                 lookup "${TABLE}" \
 202                 pref 10100
 203         fi
 204 ---
 205 schema: 'drydock/BootAction/v1'
 206 metadata:
 207   schema: 'metadata/Document/v1'
 208   name: i40evf_blacklist
 209   storagePolicy: 'cleartext'
 210   layeringDefinition:
 211     abstract: false
 212     layer: site
 213   labels:
 214     application: 'drydock'
 215 data:
 216   assets:
 217     - path: /etc/modprobe.d/sriov_blacklist.conf
 218       type: file
 219       permissions: '644'
 220       data_pipeline:
 221         - utf8_decode
 222       data: |
 223         blacklist i40evf
 224 ...