rc/servers
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ceph: improve cluster setup

Browse source 
Remove separate NetBox lookups. Explicitly allow connections between
cluster nodes. Tigthen temporary allowed IPv6 ranges.
This commit is contained in:
Timotej Lazar 2024-03-01 08:43:15 +01:00
parent 0af8474e52
commit ce7903e43a
5 changed files with 48 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

7
roles/ceph/templates/hosts.j2
View file

@ -3,9 +3,8 @@
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
{% set my_cluster = query('netbox.netbox.nb_lookup', 'clusters', raw_data=true, api_filter='name='~cluster) | first %}
{% for host in query('netbox.netbox.nb_lookup', 'devices', raw_data=true, api_filter='cluster_id='~my_cluster.id) | map(attribute='name') %}
{% for address in (hostvars[host].interfaces | selectattr('name', 'equalto', 'lo') | map(attribute='ip_addresses') | first) %}
{{ address.address | ipaddr('address') }} {{ host }}
{% for node in nodes %}
{% for address in node|device_address %}
{{ address.address | ipaddr('address') }} {{ node.inventory_hostname }}
{% endfor %}
{% endfor %}

27
roles/ceph/templates/nftables.conf.j2
View file

@ -2,16 +2,28 @@
flush ruleset
# Just a temporary filter until we get our shit together policy-wise.
table inet filter {
set allowed {
type ipv4_addr; flags interval
elements = { 10.32.0.0/14, 193.2.76.176/24, 192.168.19.0/24, 192.168.251.0/24, 88.200.23.0/24 }
set cluster {
type ipv4_addr; flags interval; auto-merge
elements = {
{{ nodes | map('device_address') | flatten | selectattr('family.value', '==', 4) | map(attribute='address') | join(',\n') | indent(12, first=True) }}
}
}
set cluster/6 {
type ipv6_addr; flags interval; auto-merge
elements = {
{{ nodes | map('device_address') | flatten | selectattr('family.value', '==', 6) | map(attribute='address') | join(',\n') | indent(12, first=True) }}
}
}
# Just a temporary filter until we get our shit together policy-wise.
set allowed {
type ipv4_addr; flags interval
elements = { 10.32.0.0/14, 193.2.76.176/24, 192.168.251.0/24, 88.200.23.0/24 }
}
set allowed/6 {
type ipv6_addr; flags interval
elements = { 2001:1470:fffd::/48 }
elements = { 2001:1470:fffd:3432::/64, 2001:1470:fffd:a000::/64 }
}
chain input {
@ -24,6 +36,11 @@ table inet filter {
iif lan0 ip6 saddr fe80::/64 accept
iif lan1 ip6 saddr fe80::/64 accept
iif mgmt accept comment "management access"
ip saddr @cluster accept comment "accept connections from other nodes"
ip6 saddr @cluster/6 accept comment "accept connections from other nodes"
ip saddr @allowed accept
ip6 saddr @allowed/6 accept
}