rc/servers
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Factor frr role from debian, ceph and proxmox

Browse source 
Consolidate base system and networking setup into debian role and BGP
configuration into frr role. Add facts role to collect data from NetBox
once to avoid many slow lookups. Also many other tweaks and cleanups.
This commit is contained in:
Timotej Lazar 2024-05-18 18:35:41 +02:00
parent 256dae2955
commit 25bcddede1
31 changed files with 167 additions and 312 deletions
Download patch file Download diff file Expand all files Collapse all files

4
roles/proxmox/templates/cluster.fw.j2
View file

@ -1,5 +1,3 @@
{% set services = query('netbox.netbox.nb_lookup', 'clusters', raw_data=true, api_filter='name='+cluster)
| map(attribute='custom_fields.services') | flatten -%}
[OPTIONS]
enable: 1
@ -10,7 +8,7 @@ IN Ping(ACCEPT) -log nolog # don’t be rude
IN SSH(ACCEPT) -i mgmt # for ansible etc.
IN ACCEPT -source {{ nodes | map('device_address') | flatten | selectattr('family.value', '==', 4) | map(attribute='address') | join(',') }} # my cluster
IN ACCEPT -source {{ nodes | map('device_address') | flatten | selectattr('family.value', '==', 6) | map(attribute='address') | join(',') }} # my cluster
{% for service in services %}
{% for service in cluster.custom_fields.services %}
{% set prefixes = service | allowed_prefixes %}
{% set prefixes4 = prefixes | selectattr('family.value', '==', 4) | map('string') %}
{% set prefixes6 = prefixes | selectattr('family.value', '==', 6) | map('string') %}

44
roles/proxmox/templates/frr.conf.j2
View file

@ -1,44 +0,0 @@
frr defaults datacenter
service integrated-vtysh-config
log syslog
# We only have the default route, so allow talking to BGP peers over it.
ip nht resolve-via-default
router bgp {{ asn.asn }}
bgp bestpath as-path multipath-relax
neighbor fabric peer-group
neighbor fabric remote-as external
neighbor fabric capability extended-nexthop
{% for iface in interfaces | rejectattr('name', '==', 'lo') | rejectattr('mgmt_only') | rejectattr('vrf') %}
neighbor {{ iface.name }} interface peer-group fabric
neighbor {{ iface.name }} bfd
{% endfor %}
address-family ipv4 unicast
redistribute connected route-map loopback
neighbor fabric activate
neighbor fabric route-map local out
exit-address-family
address-family ipv6 unicast
redistribute connected route-map loopback
neighbor fabric activate
neighbor fabric route-map local out
exit-address-family
address-family l2vpn evpn
neighbor fabric activate
neighbor fabric route-map local out
advertise-all-vni
exit-address-family
bgp as-path access-list local permit ^$
route-map loopback permit 1
match interface lo
route-map local permit 1
match as-path local

8
roles/proxmox/templates/interfaces.j2
View file

@ -1,8 +1,6 @@
{% set my_cluster = query('netbox.netbox.nb_lookup', 'clusters', raw_data=true,
api_filter='name='~cluster) | first -%}
# bridges must be named vmbrN for proxmox to care
{% for vlan in my_cluster.custom_fields.vlans | default([], true) | sort(attribute='vid') %}
{# bridges must be named vmbrN for proxmox to care #}
{% for vlan in cluster.custom_fields.vlans | default([], true) | sort(attribute='vid') %}
# bridge and VNI for {{ vlan.name }}
auto vmbr{{ vlan.vid }}
iface vmbr{{ vlan.vid }}
# {{ vlan.name }}

7
roles/proxmox/templates/loopback.intf.j2 Normal file
View file

@ -0,0 +1,7 @@
{% set lo = hostvars[inventory_hostname].interfaces | selectattr('name', '==', 'lo') | first %}
{% set vxlan_ip = lo.ip_addresses | selectattr('family.value', '==', 4)
| map(attribute='address') | first
| ipaddr('address') %}
iface lo
# without this the local tunnel IP is sometimes advertised as 0.0.0.0 on boot
vxlan-local-tunnelip {{ vxlan_ip }}

27
roles/proxmox/templates/real.intf.j2
View file

@ -1,27 +0,0 @@
# Management VRF.
auto mgmt
iface mgmt
address 127.0.0.1/8
address ::1/128
vrf-table auto
{% for iface in interfaces | rejectattr('mgmt_only') %}
auto {{ iface.name }}
iface {{ iface.name }} inet {% if iface.name == 'lo' %}loopback{% else %}static{% endif +%}
{% if iface.mtu %}
mtu {{ iface.mtu }}
{% endif %}
{% if iface.vrf %}
vrf {{ iface.vrf.name }}
{% endif %}
{% for ip in iface.ip_addresses %}
address {{ ip.address }}
{% endfor %}
{% if iface.custom_fields.gateway %}
gateway {{ iface.custom_fields.gateway.address | ipaddr('address') }}
{% endif %}
{% if iface.name == 'lo' %}
vxlan-local-tunnelip {{ iface.ip_addresses | selectattr('family.value', '==', 4) | map(attribute='address') | sort | first | ipaddr('address') }}
{% endif %}
{% endfor %}

2
roles/proxmox/templates/sync-ldap.py.j2
View file

@ -6,7 +6,7 @@ import re
import ldap3
{% set password = lookup('passwordstore', "cluster/"+cluster, returnall=true) | from_yaml %}
{% set password = lookup('passwordstore', "cluster/"+cluster.name, returnall=true) | from_yaml %}
realm = '{{ hostvars[inventory_hostname]["sync-ldap"] }}'
ldap_host = '{{ domain }}'
ldap_user = '{{ password.ldap_user }}'