Set wgvpn keys and resolve the vpc ospf interface from its subnet

hieradata/nodes/aubne1nxvm2133.main.unkin.net.yaml

@@ -1,7 +1,6 @@
 ---
 networking_loopback0_ip: 198.18.2.162
 networking_wg_link: 198.18.2.178/31
-networking_vpc_iface: eth1
 networking_vpc_cidr: 172.18.32.0/24
 
 # wg0 p2p to prodnxsr0020; lab routes stay pinned to wg0 sourced from the /31 until ospf learns them
@@ -14,9 +13,9 @@ wireguard::interfaces:
     post_up:
       - ip route replace 198.18.0.0/16 dev wg0 src 198.18.2.179
       - ip route replace 10.10.12.200/32 dev wg0 src 198.18.2.179
-    private_key: ''
+    private_key: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAe680Uimksc8igs5HhN58HI1g4WsneHsI3Az66pAZIP7AQaISMCuQD51PGGzFxZqBd3wNf5eyhZdyBV3Yl5Rb+1lte28gld1gYtoTRkLW64BZOGcjs4kaIgIfKjPpp0pcdEBzFb0nVeMRkjvJFw3BGaj05yN+eUCNMf3qYpP47SD4JE8DnpgtRP09FhZ27suJylkB2SkrX+MUJPnuZ3SrKLYEI8kCsXB6puCMRALWAysjoWEXyElT+tShRv5eOcGvcUIenygBVTgBTyu7EsLtDtTmY0gGzG3VMIXxriW0RQ4UwcAW0fkiUxWc+KdVKysVthyjjuUupL6we0GTqC3KSjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBB7FdQ73iu+fttRMUQwmaH5gDBpnsnowpVZP96vIs6ldfkm0mtO4ymnU6e+D3U9CRayiZXdhGVfHmHNb8L3s98YsQE=]
     peers:
-      - public_key: ''
+      - public_key: 'mPiOahdhI4jyS7IpkSW1HV7ERd8VH53yv/H4hCxES1g='
         endpoint: 103.216.191.185:51822
         allowed_ips:
           - 224.0.0.5/32

hieradata/nodes/ausyd2nxvm2131.main.unkin.net.yaml

@@ -1,7 +1,6 @@
 ---
 networking_loopback0_ip: 198.18.2.161
 networking_wg_link: 198.18.2.176/31
-networking_vpc_iface: eth1
 networking_vpc_cidr: 172.18.30.0/24
 
 # wg0 p2p to prodnxsr0020; lab routes stay pinned to wg0 sourced from the /31 until ospf learns them
@@ -14,9 +13,9 @@ wireguard::interfaces:
     post_up:
       - ip route replace 198.18.0.0/16 dev wg0 src 198.18.2.177
       - ip route replace 10.10.12.200/32 dev wg0 src 198.18.2.177
-    private_key: ''
+    private_key: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAEFLiAUx3WWC+nAl+XfKayu1J9gXlQI3dGAx6/0NCgIf/gDk64lrnuwzCJW9W0y00utkhoqdydx0rvjfFlI5v5+3vKWb/zyPQwcroQ1T/Tp+5627F6skuNa5LMVNk+GQHb729JluUmCW2Q8Rj4BSYYQKBS7tftgAnBiVB3aXANxgBeBZuONbI8hhFjTXHrSvDidgIHJzMpWwU40ZAwhk6B4Z9bTQ0yhs8Ucq6klaF2lDM6OO3mCrBeylCs9mgoLTE2q5B/+EqCHssNpQdhdKJ3FXp6IISn5Q3nnr7px7ks1Gzl5Ckke1D5O0WfXa1QvHQsiTkMF8B7tkY2IFHcfQz1DBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBA5YvFDxQEIxXzHJr2fVYmjgDBgflL2FY/Eu+thiGsS11m7VZ6qCy+x0d/8lcIa95aS7F3PadIyo4xGMgKtfQNzHwI=]
     peers:
-      - public_key: ''
+      - public_key: 'XB2X5NwuoE+QJLjZG4i/0+6Jj0AtfK+UsZZ7wEfYLjk='
         endpoint: 103.216.191.185:51821
         allowed_ips:
           - 224.0.0.5/32

hieradata/roles/infra/network/wgvpn.yaml

@@ -27,7 +27,8 @@ frrouting::ospfd_interfaces:
   dum0:
     area: 0.0.0.0
     passive: true
-  "%{hiera('networking_vpc_iface')}":
+frrouting::ospfd_network_interfaces:
+  "%{hiera('networking_vpc_cidr')}":
     area: 0.0.0.0
     passive: true
 frrouting::ospfd_redistribute:

modules/frrouting/manifests/init.pp

@@ -6,6 +6,7 @@ class frrouting (
   String  $service_name             = 'frr',
   Hash    $daemons                  = {},
   Hash    $ospfd_interfaces         = {},
+  Hash[Stdlib::IP::Address::V4::CIDR, Hash] $ospfd_network_interfaces = {}, # like ospfd_interfaces, keyed by a subnet the interface holds
   String  $ospfd_router_id          = $facts['networking']['ip'],
   Array[String] $ospfd_redistribute = [],
   Array[String] $ospfd_networks     = [],
@@ -28,6 +29,17 @@ class frrouting (
     warning('frrouting: ospf_exclude_k8s_enable is true but no k8s_*_cidr provided; nothing will be filtered.')
   }
 
+  $network_interfaces = $ospfd_network_interfaces.reduce({}) |$memo, $entry| {
+    $matched = $facts['networking']['interfaces'].filter |$name, $iface| {
+      $iface['bindings'] =~ Array and $iface['bindings'].any |$binding| { stdlib::ip_in_range($binding['address'], $entry[0]) }
+    }
+    if empty($matched) {
+      fail("frrouting: no interface holds an address in ${entry[0]}")
+    }
+    $memo + $matched.keys.reduce({}) |$acc, $name| { $acc + { $name => $entry[1] } }
+  }
+  $ospfd_interfaces_all = $ospfd_interfaces + $network_interfaces
+
   $daemons_defaults = {
     'bgpd'    => false,
     'ospfd'   => true,

modules/frrouting/templates/frr.conf.erb

@@ -3,7 +3,7 @@ frr defaults traditional
 hostname <%= @hostname %>
 no ipv6 forwarding
 
-<% @ospfd_interfaces.each do |iface, params| -%>
+<% @ospfd_interfaces_all.each do |iface, params| -%>
 interface <%= iface %>
 <% if params['area'] -%>
  ip ospf area <%= params['area'] %>