4 files changed, 164 insertions, 0 deletions
diff --git a/roles/nuage_node/tasks/certificates.yml b/roles/nuage_node/tasks/certificates.yml
new file mode 100644
index 000000000..d1c8bf59a
--- /dev/null
+++ b/roles/nuage_node/tasks/certificates.yml
@@ -0,0 +1,50 @@
+---
+- name: Create a directory to hold the certificates
+  file: path="{{ nuage_plugin_rest_client_crt_dir }}" state=directory
+  delegate_to: "{{ nuage_ca_master }}"
+
+- name: Create the key
+  command: >
+    openssl genrsa -out "{{ nuage_ca_master_plugin_key }}" 4096
+  delegate_to: "{{ nuage_ca_master }}"
+
+- name: Create the req file
+  command: >
+    openssl req -key "{{ nuage_ca_master_plugin_key }}" -new -out "{{ nuage_plugin_rest_client_crt_dir }}/restClient.req" -subj "/CN=nuage-client"
+  delegate_to: "{{ nuage_ca_master }}"
+
+- name: Generate the crt file
+  command: >
+    openssl x509 -req -in "{{ nuage_plugin_rest_client_crt_dir }}/restClient.req" -CA "{{ nuage_ca_crt }}" -CAkey "{{ nuage_ca_key }}" -CAserial "{{ nuage_ca_serial }}"  -out "{{ nuage_ca_master_plugin_crt }}" -extensions clientauth -extfile "{{ nuage_ca_dir }}"/openssl.cnf -days {{ nuage_mon_cert_validity_period }}
+  delegate_to: "{{ nuage_ca_master }}"
+
+- name: Remove the req file
+  file: path="{{ nuage_plugin_rest_client_crt_dir }}/restClient.req" state=absent
+  delegate_to: "{{ nuage_ca_master }}"
+
+- name: Copy nuage CA crt
+  shell: cp "{{ nuage_ca_crt }}" "{{ nuage_plugin_rest_client_crt_dir }}"
+  delegate_to: "{{ nuage_ca_master }}"
+
+- name: Archive the certificate dir
+  shell: "cd {{ nuage_plugin_rest_client_crt_dir }} && tar -czvf /tmp/{{ ansible_nodename }}.tgz *"
+  delegate_to: "{{ nuage_ca_master }}"
+
+- name: Create a temp directory for the certificates
+  local_action: command mktemp -d "/tmp/openshift-{{ ansible_nodename }}-XXXXXXX"
+  register: mktemp
+
+- name: Download the certificates
+  fetch: src="/tmp/{{ ansible_nodename }}.tgz" dest="{{ mktemp.stdout }}/{{ ansible_nodename }}.tgz" flat=yes
+  delegate_to: "{{ nuage_ca_master }}"
+
+- name: Extract the certificates
+  unarchive: src="{{ mktemp.stdout }}/{{ ansible_nodename }}.tgz" dest={{ nuage_plugin_crt_dir }}
+
+- name: Delete the certificates after copy
+  file: path="{{ nuage_plugin_rest_client_crt_dir }}" state=absent
+  delegate_to: "{{ nuage_ca_master }}"
+
+- name: Delete the temp directory
+  file: path="{{ mktemp.stdout }}" state=absent
+  delegate_to: "{{ nuage_ca_master }}"
diff --git a/roles/nuage_node/tasks/firewall.yml b/roles/nuage_node/tasks/firewall.yml
new file mode 100644
index 000000000..baf600d57
--- /dev/null
+++ b/roles/nuage_node/tasks/firewall.yml
@@ -0,0 +1,40 @@
+---
+- when: r_nuage_node_firewall_enabled | bool and not r_nuage_node_use_firewalld | bool
+  block:
+  - name: Add iptables allow rules
+    os_firewall_manage_iptables:
+      name: "{{ item.service }}"
+      action: add
+      protocol: "{{ item.port.split('/')[1] }}"
+      port: "{{ item.port.split('/')[0] }}"
+    when: item.cond | default(True)
+    with_items: "{{ r_nuage_node_os_firewall_allow }}"
+
+  - name: Remove iptables rules
+    os_firewall_manage_iptables:
+      name: "{{ item.service }}"
+      action: remove
+      protocol: "{{ item.port.split('/')[1] }}"
+      port: "{{ item.port.split('/')[0] }}"
+    when: item.cond | default(True)
+    with_items: "{{ r_nuage_node_os_firewall_deny }}"
+
+- when: r_nuage_node_firewall_enabled | bool and r_nuage_node_use_firewalld | bool
+  block:
+  - name: Add firewalld allow rules
+    firewalld:
+      port: "{{ item.port }}"
+      permanent: true
+      immediate: true
+      state: enabled
+    when: item.cond | default(True)
+    with_items: "{{ r_nuage_node_os_firewall_allow }}"
+
+  - name: Remove firewalld allow rules
+    firewalld:
+      port: "{{ item.port }}"
+      permanent: true
+      immediate: true
+      state: disabled
+    when: item.cond | default(True)
+    with_items: "{{ r_nuage_node_os_firewall_deny }}"
diff --git a/roles/nuage_node/tasks/iptables.yml b/roles/nuage_node/tasks/iptables.yml
new file mode 100644
index 000000000..95ee8643a
--- /dev/null
+++ b/roles/nuage_node/tasks/iptables.yml
@@ -0,0 +1,23 @@
+---
+- name: IPtables | Get iptables rules
+  command: iptables -L --wait
+  register: iptablesrules
+  check_mode: no
+
+- name: Allow traffic from overlay to underlay
+  command: /sbin/iptables --wait -I FORWARD 1 -s {{ hostvars[groups.oo_first_master.0].openshift.master.sdn_cluster_network_cidr }} -j ACCEPT -m comment --comment "nuage-overlay-underlay"
+  when: "'nuage-overlay-underlay' not in iptablesrules.stdout"
+  notify:
+    - save iptable rules
+
+- name: Allow traffic from underlay to overlay
+  command: /sbin/iptables --wait -I FORWARD 1 -d {{ hostvars[groups.oo_first_master.0].openshift.master.sdn_cluster_network_cidr }} -j ACCEPT -m comment --comment "nuage-underlay-overlay"
+  when: "'nuage-underlay-overlay' not in iptablesrules.stdout"
+  notify:
+    - save iptable rules
+
+- name: Allow docker daemon traffic from underlay to overlay
+  command: /sbin/iptables -t nat -A POSTROUTING ! -s {{ hostvars[groups.oo_first_master.0].openshift.master.sdn_cluster_network_cidr }} -o svc-pat-tap -j MASQUERADE -m comment --comment "nuage-docker-underlay-overlay"
+  when: "'nuage-docker-underlay-overlay' not in iptablesrules.stdout"
+  notify:
+    - save iptable rules
diff --git a/roles/nuage_node/tasks/main.yaml b/roles/nuage_node/tasks/main.yaml
new file mode 100644
index 000000000..9db9dbb6a
--- /dev/null
+++ b/roles/nuage_node/tasks/main.yaml
@@ -0,0 +1,51 @@
+---
+- name: Set the Nuage plugin openshift directory fact for Atomic hosts
+  set_fact:
+    vsp_openshift_dir: /var/usr/share/vsp-openshift
+  when: openshift.common.is_atomic | bool
+
+- name: Set the Nuage CNI binary directory fact for Atomic hosts
+  set_fact:
+    cni_bin_dir: /var/opt/cni/bin/
+  when: openshift.common.is_atomic | bool
+
+- name: Set the Nuage plugin certs directory fact for Atomic hosts
+  set_fact:
+    nuage_plugin_crt_dir: /var/usr/share/vsp-openshift
+  when: openshift.common.is_atomic | bool
+
+- name: Assure CNI conf dir exists
+  become: yes
+  file: path="{{ cni_conf_dir }}" state=directory
+
+- name: Assures Openshift CNI bin dir exists
+  become: yes
+  file: path="{{ cni_bin_dir }}" state=directory
+
+- name: Copy the certificates and keys
+  become: yes
+  copy: src="/tmp/{{ item }}" dest="{{ vsp_openshift_dir }}/{{ item }}"
+  with_items:
+    - ca.crt
+    - nuage.crt
+    - nuage.key
+    - nuage.kubeconfig
+
+- include: certificates.yml
+
+- name: Add additional Docker mounts for Nuage for atomic hosts
+  become: yes
+  lineinfile: dest="{{ openshift_atomic_node_config_file }}" line="{{ nuage_atomic_docker_additional_mounts }}"
+  when: openshift.common.is_atomic | bool
+
+- name: Restart node services
+  command: /bin/true
+  notify:
+    - restart node
+  ignore_errors: true
+
+- include: iptables.yml
+
+- name: setup firewall
+  include: firewall.yml
+  static: yes