From 351e6f13d5bee3275f46fda4a1780c71d9f338d6 Mon Sep 17 00:00:00 2001 From: Alex Auvolat Date: Sat, 18 Jan 2020 17:34:55 +0100 Subject: Network configuration: - Remove nomad interface (unused) - Deactivate systemd-resolved - Add dns_server to production nodes variables - Add recursors option to Consul so that it can resolve outside DNS queries - Use consul as a global DNS server for machines and containers, with the outside DNS as a fallback (see roles/consul/templates/resolv.conf.j2) --- ansible/roles/consul/tasks/main.yml | 3 ++ ansible/roles/consul/templates/consul.json.j2 | 3 ++ ansible/roles/consul/templates/resolv.conf.j2 | 2 ++ ansible/roles/network/files/nsswitch.conf | 3 +- .../network/files/systemd-resolve-no-listen.conf | 2 -- ansible/roles/network/handlers/main.yml | 6 ---- ansible/roles/network/tasks/main.yml | 33 ++++++++-------------- ansible/roles/network/templates/nomad-interface.j2 | 8 ------ 8 files changed, 20 insertions(+), 40 deletions(-) create mode 100644 ansible/roles/consul/templates/resolv.conf.j2 delete mode 100644 ansible/roles/network/files/systemd-resolve-no-listen.conf delete mode 100644 ansible/roles/network/templates/nomad-interface.j2 (limited to 'ansible/roles') diff --git a/ansible/roles/consul/tasks/main.yml b/ansible/roles/consul/tasks/main.yml index bb1d9ef..5cb68ab 100644 --- a/ansible/roles/consul/tasks/main.yml +++ b/ansible/roles/consul/tasks/main.yml @@ -47,3 +47,6 @@ - name: "Enable consul systemd service at boot" service: name=consul state=started enabled=yes daemon_reload=yes + +- name: "Deploy resolv.conf to use Consul" + template: src=resolv.conf.j2 dest=/etc/resolv.conf diff --git a/ansible/roles/consul/templates/consul.json.j2 b/ansible/roles/consul/templates/consul.json.j2 index d1bd2d8..b6c86aa 100644 --- a/ansible/roles/consul/templates/consul.json.j2 +++ b/ansible/roles/consul/templates/consul.json.j2 @@ -17,6 +17,9 @@ "ports": { "dns": 53 }, + "recursors": [ + "{{ dns_server }}" + ], "encrypt": "{{ consul_gossip_encrypt }}", "domain": "2.cluster.deuxfleurs.fr", "performance": { diff --git a/ansible/roles/consul/templates/resolv.conf.j2 b/ansible/roles/consul/templates/resolv.conf.j2 new file mode 100644 index 0000000..2404034 --- /dev/null +++ b/ansible/roles/consul/templates/resolv.conf.j2 @@ -0,0 +1,2 @@ +nameserver {{ private_ip }} +nameserver {{ dns_server }} diff --git a/ansible/roles/network/files/nsswitch.conf b/ansible/roles/network/files/nsswitch.conf index f4c3149..a84e024 100644 --- a/ansible/roles/network/files/nsswitch.conf +++ b/ansible/roles/network/files/nsswitch.conf @@ -9,8 +9,7 @@ group: files systemd shadow: files gshadow: files -#hosts: files dns -hosts: files mymachines resolve [!UNAVAIL=return] dns myhostname +hosts: files dns networks: files protocols: db files diff --git a/ansible/roles/network/files/systemd-resolve-no-listen.conf b/ansible/roles/network/files/systemd-resolve-no-listen.conf deleted file mode 100644 index 6e95967..0000000 --- a/ansible/roles/network/files/systemd-resolve-no-listen.conf +++ /dev/null @@ -1,2 +0,0 @@ -[Resolve] -DNSStubListener=no diff --git a/ansible/roles/network/handlers/main.yml b/ansible/roles/network/handlers/main.yml index 3454894..85873ee 100644 --- a/ansible/roles/network/handlers/main.yml +++ b/ansible/roles/network/handlers/main.yml @@ -4,9 +4,3 @@ - name: reload ip6tables shell: ip6tables-restore < /etc/iptables/rules.v6 - -- name: reload nomad interface - shell: ifdown nomad1 || true ; ifup nomad1 - -- name: reload systemd-resolved - service: name=systemd-resolved state=restarted diff --git a/ansible/roles/network/tasks/main.yml b/ansible/roles/network/tasks/main.yml index 7f95b0f..ee2f21e 100644 --- a/ansible/roles/network/tasks/main.yml +++ b/ansible/roles/network/tasks/main.yml @@ -1,9 +1,3 @@ -- name: "Add dummy interface to handle Nomad NAT restriction nomad#2770" - template: src=nomad-interface.j2 dest=/etc/network/interfaces.d/nomad.cfg - when: public_ip != private_ip - notify: - - reload nomad interface - - name: "Deploy iptablesv4 configuration" template: src=rules.v4.j2 dest=/etc/iptables/rules.v4 notify: @@ -20,23 +14,18 @@ value: 1 sysctl_set: yes -- name: "Create systemd-resolved override directory" - file: path=/etc/systemd/resolved.conf.d/ state=directory - -- name: "Prevent systemd-resolved from listening on port 53 (DNS)" - copy: src=systemd-resolve-no-listen.conf dest=/etc/systemd/resolved.conf.d/systemd-resolve-no-listen.conf - notify: reload systemd-resolved +- name: "Flush handlers" + meta: flush_handlers -- name: "Use systemd-resolved as a source for /etc/resolv.conf" - file: - src: "/run/systemd/resolve/resolv.conf" - dest: "/etc/resolv.conf" - state: link - force: yes - notify: reload systemd-resolved -- name: "Update nsswitch.conf to use systemd-resolved" +# These two lines are used to undo previous config, remove them once it is done +- name: "Update nsswitch.conf to not use systemd-resolved" copy: src=nsswitch.conf dest=/etc/nsswitch.conf -- name: "Flush handlers" - meta: flush_handlers +- name: "Disable systemd-resolved" + systemd: + name: systemd-resolved + state: stopped + enabled: false + + diff --git a/ansible/roles/network/templates/nomad-interface.j2 b/ansible/roles/network/templates/nomad-interface.j2 deleted file mode 100644 index 74e9cd4..0000000 --- a/ansible/roles/network/templates/nomad-interface.j2 +++ /dev/null @@ -1,8 +0,0 @@ -auto nomad1 -iface nomad1 inet manual - pre-up /sbin/ip link add nomad1 type dummy - up /sbin/ip addr add {{ public_ip }} dev nomad1 - up /sbin/iptables -t nat -A PREROUTING -d {{ private_ip }}/32 -j NETMAP --to {{ public_ip }}/32 - down /sbin/iptables -t nat -D PREROUTING -d {{ private_ip }}/32 -j NETMAP --to {{ public_ip }}/32 - post-down /sbin/ip link del nomad1 - -- cgit v1.2.3 From d590a98bed417390fd061d5753822af045c70bc1 Mon Sep 17 00:00:00 2001 From: Alex Auvolat Date: Thu, 21 May 2020 15:29:43 +0200 Subject: Remove last reference to obsolete nomad1 interface --- ansible/roles/network/handlers/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'ansible/roles') diff --git a/ansible/roles/network/handlers/main.yml b/ansible/roles/network/handlers/main.yml index 85873ee..1c72d85 100644 --- a/ansible/roles/network/handlers/main.yml +++ b/ansible/roles/network/handlers/main.yml @@ -1,6 +1,6 @@ --- - name: reload iptables - shell: iptables-restore < /etc/iptables/rules.v4 && systemctl restart docker && ifdown nomad1 || true && ifup nomad1 || true + shell: iptables-restore < /etc/iptables/rules.v4 && systemctl restart docker - name: reload ip6tables shell: ip6tables-restore < /etc/iptables/rules.v6 -- cgit v1.2.3 From 03d4e50b0508a292a7d24cc0e4cd4327118050d8 Mon Sep 17 00:00:00 2001 From: Quentin Dufour Date: Sun, 5 Jul 2020 19:49:32 +0200 Subject: Add my own modifications --- ansible/roles/common/tasks/main.yml | 6 ++++++ ansible/roles/network/handlers/main.yml | 6 ------ ansible/roles/network/tasks/main.yml | 8 -------- 3 files changed, 6 insertions(+), 14 deletions(-) delete mode 100644 ansible/roles/network/handlers/main.yml (limited to 'ansible/roles') diff --git a/ansible/roles/common/tasks/main.yml b/ansible/roles/common/tasks/main.yml index b4d00bb..0b15790 100644 --- a/ansible/roles/common/tasks/main.yml +++ b/ansible/roles/common/tasks/main.yml @@ -12,6 +12,12 @@ autoclean: yes autoremove: yes +- name: "Remove base tools" + apt: + name: + - systemd-resolved + state: absent + - name: "Install base tools" apt: name: diff --git a/ansible/roles/network/handlers/main.yml b/ansible/roles/network/handlers/main.yml deleted file mode 100644 index 1c72d85..0000000 --- a/ansible/roles/network/handlers/main.yml +++ /dev/null @@ -1,6 +0,0 @@ ---- -- name: reload iptables - shell: iptables-restore < /etc/iptables/rules.v4 && systemctl restart docker - -- name: reload ip6tables - shell: ip6tables-restore < /etc/iptables/rules.v6 diff --git a/ansible/roles/network/tasks/main.yml b/ansible/roles/network/tasks/main.yml index ee2f21e..e0cf60c 100644 --- a/ansible/roles/network/tasks/main.yml +++ b/ansible/roles/network/tasks/main.yml @@ -1,12 +1,8 @@ - name: "Deploy iptablesv4 configuration" template: src=rules.v4.j2 dest=/etc/iptables/rules.v4 - notify: - - reload iptables - name: "Deploy iptablesv6 configuration" copy: src=rules.v6 dest=/etc/iptables/rules.v6 - notify: - - reload ip6tables - name: "Activate IP forwarding" sysctl: @@ -14,10 +10,6 @@ value: 1 sysctl_set: yes -- name: "Flush handlers" - meta: flush_handlers - - # These two lines are used to undo previous config, remove them once it is done - name: "Update nsswitch.conf to not use systemd-resolved" copy: src=nsswitch.conf dest=/etc/nsswitch.conf -- cgit v1.2.3 From 9cf37f9fe0da315b73df5933b7dd494727c1c7b8 Mon Sep 17 00:00:00 2001 From: Quentin Dufour Date: Sun, 5 Jul 2020 20:12:51 +0200 Subject: Clean nomad+consul deploy tasks as we do not deploy anymore on ARM so it is untested for real --- ansible/roles/consul/handlers/main.yml | 4 ---- ansible/roles/consul/tasks/main.yml | 28 +--------------------------- ansible/roles/nomad/handlers/main.yml | 5 ----- ansible/roles/nomad/tasks/main.yml | 28 +--------------------------- 4 files changed, 2 insertions(+), 63 deletions(-) delete mode 100644 ansible/roles/consul/handlers/main.yml delete mode 100644 ansible/roles/nomad/handlers/main.yml (limited to 'ansible/roles') diff --git a/ansible/roles/consul/handlers/main.yml b/ansible/roles/consul/handlers/main.yml deleted file mode 100644 index e8cd4a4..0000000 --- a/ansible/roles/consul/handlers/main.yml +++ /dev/null @@ -1,4 +0,0 @@ ---- - -- name: restart consul - service: name=consul state=restarted diff --git a/ansible/roles/consul/tasks/main.yml b/ansible/roles/consul/tasks/main.yml index 5cb68ab..2b77080 100644 --- a/ansible/roles/consul/tasks/main.yml +++ b/ansible/roles/consul/tasks/main.yml @@ -1,16 +1,6 @@ - name: "Set consul version" set_fact: - consul_version: 1.7.4 - -- name: "Download and install Consul for armv7l" - unarchive: - src: "https://releases.hashicorp.com/consul/{{ consul_version }}/consul_{{ consul_version }}_linux_arm.zip" - dest: /usr/local/bin - remote_src: yes - when: - - "ansible_architecture == 'armv7l'" - notify: - - restart consul + consul_version: 1.8.0 - name: "Download and install Consul for x86_64" unarchive: @@ -19,31 +9,15 @@ remote_src: yes when: - "ansible_architecture == 'x86_64'" - notify: - - restart consul - -- name: "Download and install Consul for arm64" - unarchive: - src: "https://releases.hashicorp.com/consul/{{ consul_version }}/consul_{{ consul_version }}_linux_arm64.zip" - dest: /usr/local/bin - remote_src: yes - when: - - "ansible_architecture == 'aarch64'" - notify: - - restart consul - name: "Create consul configuration directory" file: path=/etc/consul/ state=directory - name: "Deploy consul configuration" template: src=consul.json.j2 dest=/etc/consul/consul.json - notify: - - restart consul - name: "Deploy consul systemd service" copy: src=consul.service dest=/etc/systemd/system/consul.service - notify: - - restart consul - name: "Enable consul systemd service at boot" service: name=consul state=started enabled=yes daemon_reload=yes diff --git a/ansible/roles/nomad/handlers/main.yml b/ansible/roles/nomad/handlers/main.yml deleted file mode 100644 index 0274673..0000000 --- a/ansible/roles/nomad/handlers/main.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- - -- name: restart nomad - service: name=nomad state=restarted - diff --git a/ansible/roles/nomad/tasks/main.yml b/ansible/roles/nomad/tasks/main.yml index 0b7b65c..7c73362 100644 --- a/ansible/roles/nomad/tasks/main.yml +++ b/ansible/roles/nomad/tasks/main.yml @@ -1,16 +1,6 @@ - name: "Set nomad version" set_fact: - nomad_version: 0.11.3 - -- name: "Download and install Nomad for armv7l" - unarchive: - src: "https://releases.hashicorp.com/nomad/{{ nomad_version }}/nomad_{{ nomad_version }}_linux_arm.zip" - dest: /usr/local/bin - remote_src: yes - when: - - "ansible_architecture == 'armv7l'" - notify: - - restart nomad + nomad_version: 0.12.0-beta2 - name: "Download and install Nomad for x86_64" unarchive: @@ -19,31 +9,15 @@ remote_src: yes when: - "ansible_architecture == 'x86_64'" - notify: - - restart nomad - -- name: "Download and install Nomad for arm64" - unarchive: - src: "https://releases.hashicorp.com/nomad/{{ nomad_version }}/nomad_{{ nomad_version }}_linux_arm64.zip" - dest: /usr/local/bin - remote_src: yes - when: - - "ansible_architecture == 'aarch64'" - notify: - - restart nomad - name: "Create Nomad configuration directory" file: path=/etc/nomad/ state=directory - name: "Deploy Nomad configuration" template: src=nomad.hcl.j2 dest=/etc/nomad/nomad.hcl - notify: - - restart nomad - name: "Deploy Nomad systemd service" copy: src=nomad.service dest=/etc/systemd/system/nomad.service - notify: - - restart nomad - name: "Enable Nomad systemd service at boot" service: name=nomad state=started enabled=yes daemon_reload=yes -- cgit v1.2.3 From 81480fa1f99dc374fa1a444c34683187b7525b43 Mon Sep 17 00:00:00 2001 From: Quentin Dufour Date: Sun, 5 Jul 2020 20:15:28 +0200 Subject: Add docs + fix warning --- ansible/roles/network/tasks/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'ansible/roles') diff --git a/ansible/roles/network/tasks/main.yml b/ansible/roles/network/tasks/main.yml index e0cf60c..2087765 100644 --- a/ansible/roles/network/tasks/main.yml +++ b/ansible/roles/network/tasks/main.yml @@ -7,7 +7,7 @@ - name: "Activate IP forwarding" sysctl: name: net.ipv4.ip_forward - value: 1 + value: "1" sysctl_set: yes # These two lines are used to undo previous config, remove them once it is done -- cgit v1.2.3 From faf39bbb282542efa237c39f4371918589508254 Mon Sep 17 00:00:00 2001 From: Quentin Dufour Date: Sun, 5 Jul 2020 20:36:16 +0200 Subject: Fix docker volume --- ansible/roles/nomad/templates/nomad.hcl.j2 | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'ansible/roles') diff --git a/ansible/roles/nomad/templates/nomad.hcl.j2 b/ansible/roles/nomad/templates/nomad.hcl.j2 index 8107410..b0be6a8 100644 --- a/ansible/roles/nomad/templates/nomad.hcl.j2 +++ b/ansible/roles/nomad/templates/nomad.hcl.j2 @@ -26,5 +26,9 @@ client { #cpu_total_compute = 4000 servers = ["127.0.0.1:4648"] network_interface = "{{ interface }}" + options { + docker.privileged.enabled = "true" + docker.volumes.enabled = "true" + } } -- cgit v1.2.3