9 files changed, 239 insertions, 0 deletions
diff --git a/roles/nuage_node/README.md b/roles/nuage_node/README.md
new file mode 100644
index 000000000..75a75ca6b
--- /dev/null
+++ b/roles/nuage_node/README.md
@@ -0,0 +1,10 @@
+Nuage Node
+==========
+
+Setup Nuage VRS (Virtual Routing Switching) on the Openshift Node
+
+Requirements
+------------
+
+* Ansible 2.2
+* This role assumes it has been deployed on RHEL/Fedora
diff --git a/roles/nuage_node/defaults/main.yml b/roles/nuage_node/defaults/main.yml
new file mode 100644
index 000000000..9a2e34387
--- /dev/null
+++ b/roles/nuage_node/defaults/main.yml
@@ -0,0 +1,12 @@
+---
+r_nuage_node_firewall_enabled: "{{ os_firewall_enabled | default(True) }}"
+r_nuage_node_use_firewalld: "{{ os_firewall_use_firewalld | default(False) }}"
+
+nuage_mon_rest_server_port: '9443'
+
+r_nuage_node_os_firewall_deny: []
+r_nuage_node_os_firewall_allow:
+- service: vxlan
+  port: 4789/udp
+- service: nuage-monitor
+  port: "{{ nuage_mon_rest_server_port }}/tcp"
diff --git a/roles/nuage_node/handlers/main.yaml b/roles/nuage_node/handlers/main.yaml
new file mode 100644
index 000000000..e68ae74bd
--- /dev/null
+++ b/roles/nuage_node/handlers/main.yaml
@@ -0,0 +1,8 @@
+---
+- name: restart node
+  become: yes
+  systemd: name={{ openshift.common.service_type }}-node daemon-reload=yes state=restarted
+
+- name: save iptable rules
+  become: yes
+  command: iptables-save
diff --git a/roles/nuage_node/meta/main.yml b/roles/nuage_node/meta/main.yml
new file mode 100644
index 000000000..9b0315054
--- /dev/null
+++ b/roles/nuage_node/meta/main.yml
@@ -0,0 +1,18 @@
+---
+galaxy_info:
+  author: Vishal Patil
+  description:
+  company: Nuage Networks
+  license: Apache License, Version 2.0
+  min_ansible_version: 2.2
+  platforms:
+  - name: EL
+    versions:
+    - 7
+  categories:
+  - cloud
+  - system
+dependencies:
+- role: nuage_common
+- role: nuage_ca
+- role: lib_os_firewall
diff --git a/roles/nuage_node/tasks/certificates.yml b/roles/nuage_node/tasks/certificates.yml
new file mode 100644
index 000000000..d1c8bf59a
--- /dev/null
+++ b/roles/nuage_node/tasks/certificates.yml
@@ -0,0 +1,50 @@
+---
+- name: Create a directory to hold the certificates
+  file: path="{{ nuage_plugin_rest_client_crt_dir }}" state=directory
+  delegate_to: "{{ nuage_ca_master }}"
+
+- name: Create the key
+  command: >
+    openssl genrsa -out "{{ nuage_ca_master_plugin_key }}" 4096
+  delegate_to: "{{ nuage_ca_master }}"
+
+- name: Create the req file
+  command: >
+    openssl req -key "{{ nuage_ca_master_plugin_key }}" -new -out "{{ nuage_plugin_rest_client_crt_dir }}/restClient.req" -subj "/CN=nuage-client"
+  delegate_to: "{{ nuage_ca_master }}"
+
+- name: Generate the crt file
+  command: >
+    openssl x509 -req -in "{{ nuage_plugin_rest_client_crt_dir }}/restClient.req" -CA "{{ nuage_ca_crt }}" -CAkey "{{ nuage_ca_key }}" -CAserial "{{ nuage_ca_serial }}"  -out "{{ nuage_ca_master_plugin_crt }}" -extensions clientauth -extfile "{{ nuage_ca_dir }}"/openssl.cnf -days {{ nuage_mon_cert_validity_period }}
+  delegate_to: "{{ nuage_ca_master }}"
+
+- name: Remove the req file
+  file: path="{{ nuage_plugin_rest_client_crt_dir }}/restClient.req" state=absent
+  delegate_to: "{{ nuage_ca_master }}"
+
+- name: Copy nuage CA crt
+  shell: cp "{{ nuage_ca_crt }}" "{{ nuage_plugin_rest_client_crt_dir }}"
+  delegate_to: "{{ nuage_ca_master }}"
+
+- name: Archive the certificate dir
+  shell: "cd {{ nuage_plugin_rest_client_crt_dir }} && tar -czvf /tmp/{{ ansible_nodename }}.tgz *"
+  delegate_to: "{{ nuage_ca_master }}"
+
+- name: Create a temp directory for the certificates
+  local_action: command mktemp -d "/tmp/openshift-{{ ansible_nodename }}-XXXXXXX"
+  register: mktemp
+
+- name: Download the certificates
+  fetch: src="/tmp/{{ ansible_nodename }}.tgz" dest="{{ mktemp.stdout }}/{{ ansible_nodename }}.tgz" flat=yes
+  delegate_to: "{{ nuage_ca_master }}"
+
+- name: Extract the certificates
+  unarchive: src="{{ mktemp.stdout }}/{{ ansible_nodename }}.tgz" dest={{ nuage_plugin_crt_dir }}
+
+- name: Delete the certificates after copy
+  file: path="{{ nuage_plugin_rest_client_crt_dir }}" state=absent
+  delegate_to: "{{ nuage_ca_master }}"
+
+- name: Delete the temp directory
+  file: path="{{ mktemp.stdout }}" state=absent
+  delegate_to: "{{ nuage_ca_master }}"
diff --git a/roles/nuage_node/tasks/firewall.yml b/roles/nuage_node/tasks/firewall.yml
new file mode 100644
index 000000000..baf600d57
--- /dev/null
+++ b/roles/nuage_node/tasks/firewall.yml
@@ -0,0 +1,40 @@
+---
+- when: r_nuage_node_firewall_enabled | bool and not r_nuage_node_use_firewalld | bool
+  block:
+  - name: Add iptables allow rules
+    os_firewall_manage_iptables:
+      name: "{{ item.service }}"
+      action: add
+      protocol: "{{ item.port.split('/')[1] }}"
+      port: "{{ item.port.split('/')[0] }}"
+    when: item.cond | default(True)
+    with_items: "{{ r_nuage_node_os_firewall_allow }}"
+
+  - name: Remove iptables rules
+    os_firewall_manage_iptables:
+      name: "{{ item.service }}"
+      action: remove
+      protocol: "{{ item.port.split('/')[1] }}"
+      port: "{{ item.port.split('/')[0] }}"
+    when: item.cond | default(True)
+    with_items: "{{ r_nuage_node_os_firewall_deny }}"
+
+- when: r_nuage_node_firewall_enabled | bool and r_nuage_node_use_firewalld | bool
+  block:
+  - name: Add firewalld allow rules
+    firewalld:
+      port: "{{ item.port }}"
+      permanent: true
+      immediate: true
+      state: enabled
+    when: item.cond | default(True)
+    with_items: "{{ r_nuage_node_os_firewall_allow }}"
+
+  - name: Remove firewalld allow rules
+    firewalld:
+      port: "{{ item.port }}"
+      permanent: true
+      immediate: true
+      state: disabled
+    when: item.cond | default(True)
+    with_items: "{{ r_nuage_node_os_firewall_deny }}"
diff --git a/roles/nuage_node/tasks/iptables.yml b/roles/nuage_node/tasks/iptables.yml
new file mode 100644
index 000000000..95ee8643a
--- /dev/null
+++ b/roles/nuage_node/tasks/iptables.yml
@@ -0,0 +1,23 @@
+---
+- name: IPtables | Get iptables rules
+  command: iptables -L --wait
+  register: iptablesrules
+  check_mode: no
+
+- name: Allow traffic from overlay to underlay
+  command: /sbin/iptables --wait -I FORWARD 1 -s {{ hostvars[groups.oo_first_master.0].openshift.master.sdn_cluster_network_cidr }} -j ACCEPT -m comment --comment "nuage-overlay-underlay"
+  when: "'nuage-overlay-underlay' not in iptablesrules.stdout"
+  notify:
+    - save iptable rules
+
+- name: Allow traffic from underlay to overlay
+  command: /sbin/iptables --wait -I FORWARD 1 -d {{ hostvars[groups.oo_first_master.0].openshift.master.sdn_cluster_network_cidr }} -j ACCEPT -m comment --comment "nuage-underlay-overlay"
+  when: "'nuage-underlay-overlay' not in iptablesrules.stdout"
+  notify:
+    - save iptable rules
+
+- name: Allow docker daemon traffic from underlay to overlay
+  command: /sbin/iptables -t nat -A POSTROUTING ! -s {{ hostvars[groups.oo_first_master.0].openshift.master.sdn_cluster_network_cidr }} -o svc-pat-tap -j MASQUERADE -m comment --comment "nuage-docker-underlay-overlay"
+  when: "'nuage-docker-underlay-overlay' not in iptablesrules.stdout"
+  notify:
+    - save iptable rules
diff --git a/roles/nuage_node/tasks/main.yaml b/roles/nuage_node/tasks/main.yaml
new file mode 100644
index 000000000..9db9dbb6a
--- /dev/null
+++ b/roles/nuage_node/tasks/main.yaml
@@ -0,0 +1,51 @@
+---
+- name: Set the Nuage plugin openshift directory fact for Atomic hosts
+  set_fact:
+    vsp_openshift_dir: /var/usr/share/vsp-openshift
+  when: openshift.common.is_atomic | bool
+
+- name: Set the Nuage CNI binary directory fact for Atomic hosts
+  set_fact:
+    cni_bin_dir: /var/opt/cni/bin/
+  when: openshift.common.is_atomic | bool
+
+- name: Set the Nuage plugin certs directory fact for Atomic hosts
+  set_fact:
+    nuage_plugin_crt_dir: /var/usr/share/vsp-openshift
+  when: openshift.common.is_atomic | bool
+
+- name: Assure CNI conf dir exists
+  become: yes
+  file: path="{{ cni_conf_dir }}" state=directory
+
+- name: Assures Openshift CNI bin dir exists
+  become: yes
+  file: path="{{ cni_bin_dir }}" state=directory
+
+- name: Copy the certificates and keys
+  become: yes
+  copy: src="/tmp/{{ item }}" dest="{{ vsp_openshift_dir }}/{{ item }}"
+  with_items:
+    - ca.crt
+    - nuage.crt
+    - nuage.key
+    - nuage.kubeconfig
+
+- include: certificates.yml
+
+- name: Add additional Docker mounts for Nuage for atomic hosts
+  become: yes
+  lineinfile: dest="{{ openshift_atomic_node_config_file }}" line="{{ nuage_atomic_docker_additional_mounts }}"
+  when: openshift.common.is_atomic | bool
+
+- name: Restart node services
+  command: /bin/true
+  notify:
+    - restart node
+  ignore_errors: true
+
+- include: iptables.yml
+
+- name: setup firewall
+  include: firewall.yml
+  static: yes
diff --git a/roles/nuage_node/vars/main.yaml b/roles/nuage_node/vars/main.yaml
new file mode 100644
index 000000000..fdf01b7c2
--- /dev/null
+++ b/roles/nuage_node/vars/main.yaml
@@ -0,0 +1,27 @@
+---
+vrs_config: /etc/default/openvswitch
+vsp_openshift_dir: /usr/share/vsp-openshift
+vsp_openshift_yaml: "{{ vsp_openshift_dir }}/vsp-openshift.yaml"
+client_cert: "{{ vsp_openshift_dir }}/nuage.crt"
+client_key: "{{ vsp_openshift_dir }}/nuage.key"
+ca_cert: "{{ vsp_openshift_dir }}/ca.crt"
+api_server: "{{ openshift_node_master_api_url }}"
+nuage_mon_rest_server_port: "{{ nuage_openshift_monitor_rest_server_port | default('9443') }}"
+nuage_mon_rest_server_url: "https://{{ openshift_master_cluster_hostname }}:{{ nuage_mon_rest_server_port }}"
+docker_bridge: "{{ nuage_docker_bridge | default('docker0') }}"
+rest_client_cert: "{{ vsp_openshift_dir }}/nuageMonClient.crt"
+rest_client_key: "{{ vsp_openshift_dir }}/nuageMonClient.key"
+rest_server_ca_cert: "{{ vsp_openshift_dir }}/nuageMonCA.crt"
+vport_mtu: "{{ nuage_interface_mtu | default('1460') }}"
+plugin_log_level: "{{ nuage_plugin_log_level | default('err') }}"
+
+nuage_plugin_rest_client_crt_dir: "{{ nuage_ca_master_crt_dir }}/{{ ansible_nodename }}"
+nuage_ca_master_plugin_key: "{{ nuage_plugin_rest_client_crt_dir }}/nuageMonClient.key"
+nuage_ca_master_plugin_crt: "{{ nuage_plugin_rest_client_crt_dir }}/nuageMonClient.crt"
+
+cni_conf_dir: "/etc/cni/net.d/"
+cni_bin_dir: "/opt/cni/bin/"
+
+nuage_plugin_crt_dir: /usr/share/vsp-openshift
+openshift_atomic_node_config_file: /etc/sysconfig/{{ openshift.common.service_type }}-node
+nuage_atomic_docker_additional_mounts: "NUAGE_ADDTL_BIND_MOUNTS=-v /var/usr/share/vsp-openshift:/var/usr/share/vsp-openshift -v /etc/default:/etc/default -v /var/run:/var/run -v /opt/cni/bin:/opt/cni/bin -v /etc/cni/net.d:/etc/cni/net.d"