unkin/puppet-prod
3
0
Fork 0
Code Issues 10 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

feat: continue incus implementation (#245)

Browse Source 
- migrate to systemd-networkd
- setup dummy, bridge and static/ethernet interfaces
- manage sshd.service droping to start ssh after networking is online
- enable ip forewarding
- add fastpool/data/incus dataset
- enable ospf and frr
- add loopback0 as ssh listenaddress
- add loopback1/2 for ceph cluster/public traffic

Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/245
This commit was merged in pull request #245.
This commit is contained in:
Ben Vincent
2025-04-06 16:38:04 +10:00
parent 06666fe488
commit c225564bdb
17 changed files with 310 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/libs/lib/facter/subnet_facts.rb
+12 -1
View File
@@ -10,7 +10,18 @@ class SubnetAttributes
'198.18.15.0/24' => { environment: 'prod', region: 'syd1', country: 'au' },
'198.18.16.0/24' => { environment: 'test', region: 'syd1', country: 'au' },
'198.18.17.0/24' => { environment: 'prod', region: 'drw1', country: 'au' },
'198.18.18.0/24' => { environment: 'test', region: 'drw1', country: 'au' }
'198.18.18.0/24' => { environment: 'test', region: 'drw1', country: 'au' },
'198.18.19.0/24' => { environment: 'prod', region: 'syd1', country: 'au' }, # loopbacks
'198.18.20.0/24' => { environment: 'prod', region: 'syd1', country: 'au' }, # RESERVED
'198.18.21.0/24' => { environment: 'prod', region: 'syd1', country: 'au' }, # physical network 2.5gbe
'198.18.22.0/24' => { environment: 'prod', region: 'syd1', country: 'au' }, # ceph cluster
'198.18.23.0/24' => { environment: 'prod', region: 'syd1', country: 'au' }, # ceph public
'198.18.24.0/24' => { environment: 'prod', region: 'syd1', country: 'au' }, # dmz 1
'198.18.25.0/24' => { environment: 'prod', region: 'syd1', country: 'au' }, # common node0009
'198.18.26.0/24' => { environment: 'prod', region: 'syd1', country: 'au' }, # common node0010
'198.18.27.0/24' => { environment: 'prod', region: 'syd1', country: 'au' }, # common node0011
'198.18.28.0/24' => { environment: 'prod', region: 'syd1', country: 'au' }, # common node0012
'198.18.29.0/24' => { environment: 'prod', region: 'syd1', country: 'au' } # common node0013
}.freeze
# Default attributes if no subnet matches, also defined as a constant
modules/networking/manifests/bridge.pp
+22
View File
@@ -0,0 +1,22 @@
# manage bridges and bridge slaves
define networking::bridge (
String $type,
Optional[Stdlib::IP::Address] $ipaddress,
Optional[Stdlib::IP::Address] $netmask = undef,
Optional[Stdlib::IP::Address] $gateway = undef,
Optional[Boolean] $nocarrier = undef,
Boolean $bridge = true,
Integer[100-9200] $mtu = 1500,
Optional[Boolean] $forwarding = false,
) {
include systemd
systemd::network { "${title}.netdev":
content => template('networking/bridge.netdev.erb'),
}
# Use shared template, it will detect bridge=true and skip Address/DNS/etc
systemd::network { "${title}.network":
content => template('networking/networkd-network.erb'),
}
}
modules/networking/manifests/dummy.pp
+18
View File
@@ -0,0 +1,18 @@
# manage dummy/loopback interfaces
define networking::dummy (
String $type,
Stdlib::IP::Address $ipaddress,
Stdlib::IP::Address $netmask,
Integer[100-9200] $mtu = 1500,
Optional[Boolean] $forwarding = false,
) {
include systemd
systemd::network { "${title}.netdev":
content => template('networking/dummy.netdev.erb'),
}
systemd::network { "${title}.network":
content => template('networking/networkd-network.erb'),
}
}
modules/networking/manifests/init.pp
+51 -21
View File
@@ -4,37 +4,67 @@ class networking (
Hash $interface_defaults = {},
Hash $routes = {},
Hash $route_defaults = {},
Boolean $use_networkd = lookup('systemd::manage_networkd'),
){
include network
include networking::params
# manage interfaces
$interfaces.each | $interface, $data | {
$merged_data = merge($interface_defaults, $data)
network_config { $interface:
* => $merged_data,
notify => Exec['networking_reload_network'],
}
}
if $use_networkd {
# manage routes
$routes.each | $route, $data | {
$merged_data = merge($route_defaults, $data)
network_route { $route:
* => $merged_data,
notify => Exec['networking_reload_network'],
include systemd
service { 'NetworkManager':
ensure => 'stopped',
enable => false,
}
$interfaces.each |String $iface, Hash $data| {
$type = $data['type']
#$params = $data.filter |$key, $value| { $key != 'type' }
case $type {
'bridge': { networking::bridge { $iface: * => $data } }
'dummy': { networking::dummy { $iface: * => $data } }
'static': { networking::static { $iface: * => $data } }
'physical': { networking::static { $iface: * => $data } }
default: {
fail("Unsupported interface type '${type}' for interface '${iface}'")
}
}
}
}else{
# manage interfaces
$interfaces.each | $interface, $data | {
$merged_data = merge($interface_defaults, $data)
network_config { $interface:
* => $merged_data,
notify => Exec['networking_reload_network'],
}
}
# manage routes
$routes.each | $route, $data | {
$merged_data = merge($route_defaults, $data)
network_route { $route:
* => $merged_data,
notify => Exec['networking_reload_network'],
}
}
}
# determine which networking service to restart
$restart_command = $facts['os']['family'] ? {
'RedHat' => $facts['os']['release']['major'] ? {
'8' => '/usr/bin/systemctl restart network',
'9' => '/usr/bin/systemctl restart NetworkManager',
},
'Debian' => '/usr/bin/systemctl restart networking',
default => fail('Unsupported OS in networking-restart-command'),
$restart_command = $use_networkd ? {
true => '/usr/bin/systemctl restart systemd-networkd',
default => $facts['os']['family'] ? {
'RedHat' => $facts['os']['release']['major'] ? {
'8' => '/usr/bin/systemctl restart network',
'9' => '/usr/bin/systemctl restart NetworkManager',
default => fail('Unsupported RedHat OS release for networking restart'),
},
'Debian' => '/usr/bin/systemctl restart networking',
default => fail('Unsupported OS in networking-restart-command'),
}
}
# restart network/networking only if $restart_networking boolean is true
modules/networking/manifests/static.pp
+26
View File
@@ -0,0 +1,26 @@
# manage static interfaces
define networking::static (
String $type,
Stdlib::IP::Address $ipaddress,
Stdlib::IP::Address $netmask = '255.255.255.0',
Integer[100-9200] $mtu = 1500,
Optional[Boolean] $forwarding = false,
Optional[Stdlib::IP::Address] $gateway = undef,
Optional[Array[Stdlib::IP::Address]] $dns = undef,
Optional[Array[Stdlib::Fqdn]] $domains = undef,
Optional[Integer[0-4096]] $vlan = undef,
Optional[Variant[Boolean,String]] $bridge = undef,
Optional[Integer[0-4294967294]] $txqueuelen = undef,
Optional[Stdlib::MAC] $mac = undef,
) {
include systemd
systemd::network { "${title}.network":
content => template('networking/networkd-network.erb'),
}
#if $type == 'physical' and $mac {
# systemd::network { "${title}.link":
# content => template('networking/networkd-link.erb'),
# }
#}
}
modules/networking/templates/bridge.netdev.erb
+3
View File
@@ -0,0 +1,3 @@
[NetDev]
Name=<%= @title %>
Kind=bridge
modules/networking/templates/dummy.netdev.erb
+3
View File
@@ -0,0 +1,3 @@
[NetDev]
Name=<%= @title %>
Kind=dummy
modules/networking/templates/networkd-link.erb
+8
View File
@@ -0,0 +1,8 @@
[Match]
MACAddress=<%= @mac %>
[Link]
MTUBytes=<%= @mtu %>
<% if @txqueuelen and @txqueuelen >= 1 -%>
TransmitQueueLength=<%= @txqueuelen %>
<% end -%>
modules/networking/templates/networkd-network.erb
+37
View File
@@ -0,0 +1,37 @@
[Match]
Name=<%= @title %>
[Network]
<% if @ipaddress && @netmask -%>
Address=<%= @ipaddress %>/<%= IPAddr.new(@netmask).to_i.to_s(2).count('1') %>
<% end -%>
<% if @gateway -%>
Gateway=<%= @gateway %>
<% end -%>
<% if @dns -%>
DNS=<%= Array(@dns).join(' ') %>
<% end -%>
<% if @domains -%>
Domains=<%= Array(@domains).join(' ') %>
<% end -%>
<% if @bridge and @bridge != true -%>
Bridge=<%= @bridge %>
<% end -%>
<% if @vlan -%>
VLAN=<%= @vlan %>
<% end -%>
<% if @nocarrier and @nocarrier == true -%>
ConfigureWithoutCarrier=true
DuplicateAddressDetection=none
RequiredForOnline=no-carrier
<% end -%>
<% if @type == 'dummy' -%>
LinkLocalAddressing=no
ActivationPolicy=always-up
<% end -%>
<% if @forwarding and @forwarding == true -%>
IPForward=true
<% end -%>
[Link]
MTUBytes=<%= @mtu %>