From 015a516f546a45d566372bd02dc080fca4ffd6eb Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 17 Oct 2026 12:51:02 +1100 Subject: [PATCH] Set wgvpn keys and resolve the vpc ospf interface from its subnet --- hieradata/nodes/aubne1nxvm2133.main.unkin.net.yaml | 5 ++--- hieradata/nodes/ausyd2nxvm2131.main.unkin.net.yaml | 5 ++--- hieradata/roles/infra/network/wgvpn.yaml | 3 ++- modules/frrouting/manifests/init.pp | 12 ++++++++++++ modules/frrouting/templates/frr.conf.erb | 2 +- 5 files changed, 19 insertions(+), 8 deletions(-) diff --git a/hieradata/nodes/aubne1nxvm2133.main.unkin.net.yaml b/hieradata/nodes/aubne1nxvm2133.main.unkin.net.yaml index e790071..e16b1e3 100644 --- a/hieradata/nodes/aubne1nxvm2133.main.unkin.net.yaml +++ b/hieradata/nodes/aubne1nxvm2133.main.unkin.net.yaml @@ -1,7 +1,6 @@ --- networking_loopback0_ip: 198.18.2.162 networking_wg_link: 198.18.2.178/31 -networking_vpc_iface: eth1 networking_vpc_cidr: 172.18.32.0/24 # wg0 p2p to prodnxsr0020; lab routes stay pinned to wg0 sourced from the /31 until ospf learns them @@ -14,9 +13,9 @@ wireguard::interfaces: post_up: - ip route replace 198.18.0.0/16 dev wg0 src 198.18.2.179 - ip route replace 10.10.12.200/32 dev wg0 src 198.18.2.179 - private_key: '' + private_key: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAe680Uimksc8igs5HhN58HI1g4WsneHsI3Az66pAZIP7AQaISMCuQD51PGGzFxZqBd3wNf5eyhZdyBV3Yl5Rb+1lte28gld1gYtoTRkLW64BZOGcjs4kaIgIfKjPpp0pcdEBzFb0nVeMRkjvJFw3BGaj05yN+eUCNMf3qYpP47SD4JE8DnpgtRP09FhZ27suJylkB2SkrX+MUJPnuZ3SrKLYEI8kCsXB6puCMRALWAysjoWEXyElT+tShRv5eOcGvcUIenygBVTgBTyu7EsLtDtTmY0gGzG3VMIXxriW0RQ4UwcAW0fkiUxWc+KdVKysVthyjjuUupL6we0GTqC3KSjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBB7FdQ73iu+fttRMUQwmaH5gDBpnsnowpVZP96vIs6ldfkm0mtO4ymnU6e+D3U9CRayiZXdhGVfHmHNb8L3s98YsQE=] peers: - - public_key: '' + - public_key: 'mPiOahdhI4jyS7IpkSW1HV7ERd8VH53yv/H4hCxES1g=' endpoint: 103.216.191.185:51822 allowed_ips: - 224.0.0.5/32 diff --git a/hieradata/nodes/ausyd2nxvm2131.main.unkin.net.yaml b/hieradata/nodes/ausyd2nxvm2131.main.unkin.net.yaml index 3537cf7..d651c88 100644 --- a/hieradata/nodes/ausyd2nxvm2131.main.unkin.net.yaml +++ b/hieradata/nodes/ausyd2nxvm2131.main.unkin.net.yaml @@ -1,7 +1,6 @@ --- networking_loopback0_ip: 198.18.2.161 networking_wg_link: 198.18.2.176/31 -networking_vpc_iface: eth1 networking_vpc_cidr: 172.18.30.0/24 # wg0 p2p to prodnxsr0020; lab routes stay pinned to wg0 sourced from the /31 until ospf learns them @@ -14,9 +13,9 @@ wireguard::interfaces: post_up: - ip route replace 198.18.0.0/16 dev wg0 src 198.18.2.177 - ip route replace 10.10.12.200/32 dev wg0 src 198.18.2.177 - private_key: '' + private_key: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAEFLiAUx3WWC+nAl+XfKayu1J9gXlQI3dGAx6/0NCgIf/gDk64lrnuwzCJW9W0y00utkhoqdydx0rvjfFlI5v5+3vKWb/zyPQwcroQ1T/Tp+5627F6skuNa5LMVNk+GQHb729JluUmCW2Q8Rj4BSYYQKBS7tftgAnBiVB3aXANxgBeBZuONbI8hhFjTXHrSvDidgIHJzMpWwU40ZAwhk6B4Z9bTQ0yhs8Ucq6klaF2lDM6OO3mCrBeylCs9mgoLTE2q5B/+EqCHssNpQdhdKJ3FXp6IISn5Q3nnr7px7ks1Gzl5Ckke1D5O0WfXa1QvHQsiTkMF8B7tkY2IFHcfQz1DBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBA5YvFDxQEIxXzHJr2fVYmjgDBgflL2FY/Eu+thiGsS11m7VZ6qCy+x0d/8lcIa95aS7F3PadIyo4xGMgKtfQNzHwI=] peers: - - public_key: '' + - public_key: 'XB2X5NwuoE+QJLjZG4i/0+6Jj0AtfK+UsZZ7wEfYLjk=' endpoint: 103.216.191.185:51821 allowed_ips: - 224.0.0.5/32 diff --git a/hieradata/roles/infra/network/wgvpn.yaml b/hieradata/roles/infra/network/wgvpn.yaml index f09b77e..fdca9a6 100644 --- a/hieradata/roles/infra/network/wgvpn.yaml +++ b/hieradata/roles/infra/network/wgvpn.yaml @@ -27,7 +27,8 @@ frrouting::ospfd_interfaces: dum0: area: 0.0.0.0 passive: true - "%{hiera('networking_vpc_iface')}": +frrouting::ospfd_network_interfaces: + "%{hiera('networking_vpc_cidr')}": area: 0.0.0.0 passive: true frrouting::ospfd_redistribute: diff --git a/modules/frrouting/manifests/init.pp b/modules/frrouting/manifests/init.pp index 6af391c..0eeea8b 100644 --- a/modules/frrouting/manifests/init.pp +++ b/modules/frrouting/manifests/init.pp @@ -6,6 +6,7 @@ class frrouting ( String $service_name = 'frr', Hash $daemons = {}, Hash $ospfd_interfaces = {}, + Hash[Stdlib::IP::Address::V4::CIDR, Hash] $ospfd_network_interfaces = {}, # like ospfd_interfaces, keyed by a subnet the interface holds String $ospfd_router_id = $facts['networking']['ip'], Array[String] $ospfd_redistribute = [], Array[String] $ospfd_networks = [], @@ -28,6 +29,17 @@ class frrouting ( warning('frrouting: ospf_exclude_k8s_enable is true but no k8s_*_cidr provided; nothing will be filtered.') } + $network_interfaces = $ospfd_network_interfaces.reduce({}) |$memo, $entry| { + $matched = $facts['networking']['interfaces'].filter |$name, $iface| { + $iface['bindings'] =~ Array and $iface['bindings'].any |$binding| { stdlib::ip_in_range($binding['address'], $entry[0]) } + } + if empty($matched) { + fail("frrouting: no interface holds an address in ${entry[0]}") + } + $memo + $matched.keys.reduce({}) |$acc, $name| { $acc + { $name => $entry[1] } } + } + $ospfd_interfaces_all = $ospfd_interfaces + $network_interfaces + $daemons_defaults = { 'bgpd' => false, 'ospfd' => true, diff --git a/modules/frrouting/templates/frr.conf.erb b/modules/frrouting/templates/frr.conf.erb index 582358e..ea446d4 100644 --- a/modules/frrouting/templates/frr.conf.erb +++ b/modules/frrouting/templates/frr.conf.erb @@ -3,7 +3,7 @@ frr defaults traditional hostname <%= @hostname %> no ipv6 forwarding -<% @ospfd_interfaces.each do |iface, params| -%> +<% @ospfd_interfaces_all.each do |iface, params| -%> interface <%= iface %> <% if params['area'] -%> ip ospf area <%= params['area'] %>