-# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: Apache-2.0
# Copyright (c) 2021 Intel Corporation
+---
+apiVersion: v1
+kind: Secret
+metadata:
+ name: sdewan-safe-pass
+ namespace: default
+type: Opaque
+stringData:
+ password: root1
+...
+
---
apiVersion: v1
data:
#!/bin/bash
# Always exit on errors.
set -ex
+ sysctl -w net.ipv4.ip_forward=1
echo "" > /etc/config/network
cat > /etc/config/mwan3 <<EOF
config globals 'globals'
option mmx_mask '0x3F00'
option local_source 'lan'
EOF
+
+ providerip=$(echo 10.10.70.0/24 | cut -d/ -f1)
+ sep="."
+ suf="0"
+
eval "networks=$(grep nfn-network /tmp/podinfo/annotations | awk -F '=' '{print $2}')"
for net in $(echo -e $networks | jq -c ".interface[]")
do
option proto 'static'
option ipaddr '$ipaddr'
option netmask '$netmask'
- EOF
- cat >> /etc/config/mwan3 <<EOF
- config interface '$vif'
- option enabled '1'
- option family 'ipv4'
- option reliability '2'
- option count '1'
- option timeout '2'
- option failure_latency '1000'
- option recovery_latency '500'
- option failure_loss '20'
- option recovery_loss '5'
- option interval '5'
- option down '3'
- option up '8'
EOF
done
+
+ if [ -f "/tmp/sdewan/account/password" ]; then
+ echo "Changing password ..."
+ pass=$(cat /tmp/sdewan/account/password)
+ echo root:$pass | chpasswd -m
+ fi
+
+ if [ -d "/tmp/sdewan/serving-certs/" ]; then
+ echo "Configuration certificates ..."
+ cp /tmp/sdewan/serving-certs/tls.crt /etc/uhttpd.crt
+ cp /tmp/sdewan/serving-certs/tls.key /etc/uhttpd.key
+ fi
+
/sbin/procd &
/sbin/ubusd &
iptables -t nat -L
/etc/init.d/dropbear start
/etc/init.d/mwan3 restart
/etc/init.d/firewall restart
+ defaultip=$(grep "\podIP\b" /tmp/podinfo/annotations | cut -d/ -f2 | cut -d'"' -f2)
+ for net in $(echo -e $networks | jq -c ".interface[]")
+ do
+ interface=$(echo $net | jq -r .interface)
+ ipaddr=$(ifconfig $interface | awk '/inet/{print $2}' | cut -f2 -d ":" | awk 'NR==1 {print $1}')
+ echo $ipaddr | ( IFS="." read -r var1 var2 var3 var4; CIDR="$var1$sep$var2$sep$var3$sep$suf"; \
+ if [ "${CIDR}" = "${providerip}" ] ; then iptables -t nat -A POSTROUTING -o $interface -d 10.10.70.0/24 -j SNAT --to-source $ipaddr; fi)
+ done
+ iptables -t nat -I PREROUTING 1 -m tcp -p tcp -d 10.10.70.39 --dport 6443 -j DNAT --to-dest 10.96.0.1:443
+ ip rule add from 10.233.84.0/24 lookup 40
+ ip rule add from $defaultip lookup main
echo "Entering sleep... (success)"
# Sleep forever.
while true; do sleep 100; done
kind: ConfigMap
metadata:
- name: sdewan-sh
+ name: sdewan-safe-sh
namespace: default
...
apiVersion: apps/v1
kind: Deployment
metadata:
- name: cnf1
+ name: sdewan-safe
namespace: default
labels:
- sdewanPurpose: cnf1
+ sdewanPurpose: base
spec:
progressDeadlineSeconds: 600
- replicas: 2
+ replicas: 1
selector:
matchLabels:
- sdewanPurpose: cnf1
+ sdewanPurpose: base
strategy:
rollingUpdate:
maxSurge: 25%
{ "type": "ovn4nfv", "interface": [
{
"defaultGateway": "false",
- "interface": "net1",
- "name": "ovn-net1"
+ "interface": "net2",
+ "ipAddress": "10.10.70.39",
+ "name": "pnetwork"
},
{
"defaultGateway": "false",
- "interface": "net2",
- "name": "ovn-net2"
+ "interface": "net0",
+ "ipAddress": "172.16.70.39",
+ "name": "ovn-network"
}
]}
- k8s.v1.cni.cncf.io/networks: '[{ "name": "ovn-networkobj"}]'
+ k8s.v1.cni.cncf.io/networks: '[{ "name": "ovn4nfv-k8s-plugin"}]'
labels:
- sdewanPurpose: cnf1
+ sdewanPurpose: base
+ cnf-account-secret: sdewan-safe-pass
+ cnf-cert-secret: cnf-default-cert
spec:
containers:
- command:
#- sleep
#- "3600"
+ - /usr/bin/sudo
- /bin/sh
- /tmp/sdewan/entrypoint.sh
- image: integratedcloudnative/openwrt:0.3.0
+ image: integratedcloudnative/sdewan-cnf:0.5.2
imagePullPolicy: IfNotPresent
name: sdewan
readinessProbe:
procMount: Default
volumeMounts:
- mountPath: /tmp/sdewan
- name: sdewan-sh
+ name: sdewan-safe-sh
readOnly: true
- mountPath: /tmp/podinfo
name: podinfo
readOnly: true
+ - mountPath: /tmp/sdewan/serving-certs
+ name: cert
+ readOnly: true
+ - mountPath: /tmp/sdewan/account
+ name: account
+ readOnly: true
nodeSelector:
node-role.kubernetes.io/master: ""
restartPolicy: Always
volumes:
- configMap:
defaultMode: 420
- name: sdewan-sh
- name: sdewan-sh
+ name: sdewan-safe-sh
+ name: sdewan-safe-sh
- name: podinfo
downwardAPI:
items:
- path: "annotations"
fieldRef:
fieldPath: metadata.annotations
+ - name: cert
+ secret:
+ defaultMode: 420
+ secretName: cnf-default-cert
+ - name: account
+ secret:
+ defaultMode: 420
+ secretName: sdewan-safe-pass
Code Review / icn / sdwan.git / commitdiff