blob: ee5a718e0f52d50b37241b9ed1c4da5b5177e262 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
|
---
- name: VPNaaS | Init ENV
ansible.builtin.include_tasks: init_env.yml
- name: VPNaaS | Check if VPN agents are alive and reporting
ansible.builtin.shell: |
set -o pipefail
{{ ovn_vpnaas_activate }}
openstack network agent list -f value -c Binary -c Alive | grep "vpn-agent" | awk '{print $2}'
args:
executable: /bin/bash
register: vpn_agents_alive
until:
- vpn_agents_alive.stdout != ""
- "'False' not in vpn_agents_alive.stdout"
retries: 10
delay: 5
environment: "{{ os_auth_env }}"
changed_when: false
- name: VPNaaS | Create IKE and IPsec Policies
ansible.builtin.shell: |
{{ ovn_vpnaas_activate }}
openstack vpn ike policy create ikepolicy --ike-version v2 --auth-algorithm sha256 --encryption-algorithm aes-256 --pfs group14 || true
openstack vpn ipsec policy create ipsecpolicy --auth-algorithm sha256 --encryption-algorithm aes-256 --pfs group14 || true
environment: "{{ os_auth_env }}"
changed_when: false
- name: VPNaaS | Setup Network Infrastructure
ansible.builtin.include_tasks: setup_site.yml
vars:
site_name: "{{ item.name }}"
site_cidr: "{{ item.cidr }}"
peer_cidr: "{{ item.peer }}"
loop:
- { name: 'west', cidr: "{{ ovn_vpnaas_west_cidr }}", peer: "{{ ovn_vpnaas_east_cidr }}" }
- { name: 'east', cidr: "{{ ovn_vpnaas_east_cidr }}", peer: "{{ ovn_vpnaas_west_cidr }}" }
- name: VPNaaS | Wait for OVN Agent to settle
ansible.builtin.pause:
minutes: 2
- name: VPNaaS | Check if VPN service west exists
ansible.builtin.shell: |
set -o pipefail
{{ ovn_vpnaas_activate }}
openstack vpn service list -f value -c ID -c Name | awk '$2=="vpn_west" {print $1}' | head -n 1
args:
executable: /bin/bash
environment: "{{ os_auth_env }}"
register: check_vpn_west
changed_when: false
- name: VPNaaS | Create VPN service | west
ansible.builtin.shell: |
{{ ovn_vpnaas_activate }}
openstack vpn service create --router "router_west" "vpn_west"
environment: "{{ os_auth_env }}"
when: check_vpn_west.stdout | trim == ""
failed_when: false
changed_when: false
- name: VPNaaS | Settle database consistency before next service
ansible.builtin.pause:
seconds: 20
- name: VPNaaS | Ensure VPN service west exists and get ID
ansible.builtin.shell: |
set -o pipefail
{{ ovn_vpnaas_activate }}
openstack vpn service list -f value -c ID -c Name | awk '$2=="vpn_west" {print $1}' | head -n 1
args:
executable: /bin/bash
register: vpn_svc_west_out
until:
- vpn_svc_west_out.rc == 0
- vpn_svc_west_out.stdout | trim != ""
retries: 20
delay: 10
environment: "{{ os_auth_env }}"
changed_when: false
- name: VPNaaS | Check if VPN service east exists
ansible.builtin.shell: |
set -o pipefail
{{ ovn_vpnaas_activate }}
openstack vpn service list -f value -c ID -c Name | awk '$2=="vpn_east" {print $1}' | head -n 1
args:
executable: /bin/bash
environment: "{{ os_auth_env }}"
register: check_vpn_east
changed_when: false
- name: VPNaaS | Create VPN service | east
ansible.builtin.shell: |
{{ ovn_vpnaas_activate }}
openstack vpn service create --router "router_east" "vpn_east"
environment: "{{ os_auth_env }}"
when: check_vpn_east.stdout | trim == ""
failed_when: false
changed_when: false
- name: VPNaaS | Settle database consistency before next service
ansible.builtin.pause:
seconds: 20
- name: VPNaaS | Ensure VPN service east exists in DB
ansible.builtin.shell: |
set -o pipefail
{{ ovn_vpnaas_activate }}
openstack vpn service list -f value -c ID -c Name | awk '$2=="vpn_east" {print $1}' | head -n 1
args:
executable: /bin/bash
register: vpn_svc_east_out
until:
- vpn_svc_east_out.rc == 0
- vpn_svc_east_out.stdout | trim != ""
retries: 20
delay: 10
environment: "{{ os_auth_env }}"
changed_when: false
- name: VPNaaS | Create Endpoint Groups
ansible.builtin.shell: |
{{ ovn_vpnaas_activate }}
openstack vpn endpoint group create --type subnet --value "subnet_{{ item.name }}" "{{ item.name }}-local-epg" || true
openstack vpn endpoint group create --type cidr --value "{{ item.peer }}" "{{ item.name }}-peer-epg" || true
loop:
- { name: 'west', peer: "{{ ovn_vpnaas_east_cidr }}" }
- { name: 'east', peer: "{{ ovn_vpnaas_west_cidr }}" }
environment: "{{ os_auth_env }}"
changed_when: false
- name: VPNaaS | Get Public IPs
ansible.builtin.shell: |
{{ ovn_vpnaas_activate }}
openstack vpn service show "{{ item }}" -f value -c ext_v4_ip
register: vpn_ips
until:
- vpn_ips.stdout | trim != ""
- vpn_ips.stdout | trim != "None"
retries: 24
delay: 10
loop:
- "{{ vpn_svc_west_out.stdout.strip() }}"
- "{{ vpn_svc_east_out.stdout.strip() }}"
environment: "{{ os_auth_env }}"
changed_when: false
- name: VPNaaS | Establish Connections
ansible.builtin.shell: |
{{ ovn_vpnaas_activate }}
openstack vpn ipsec site connection create "conn_east" --vpnservice "{{ vpn_svc_east_out.stdout.strip() }}" --ikepolicy ikepolicy \
--ipsecpolicy ipsecpolicy --local-endpoint-group east-local-epg --peer-address "{{ vpn_ips.results[0].stdout.strip() }}" \
--peer-id "{{ vpn_ips.results[0].stdout.strip() }}" --peer-endpoint-group east-peer-epg --psk {{ ovn_vpnaas_psk }} || true
openstack vpn ipsec site connection create "conn_west" --vpnservice "{{ vpn_svc_west_out.stdout.strip() }}" --ikepolicy ikepolicy \
--ipsecpolicy ipsecpolicy --local-endpoint-group west-local-epg --peer-address "{{ vpn_ips.results[1].stdout.strip() }}" \
--peer-id "{{ vpn_ips.results[1].stdout.strip() }}" --peer-endpoint-group west-peer-epg --psk {{ ovn_vpnaas_psk }} || true
environment: "{{ os_auth_env }}"
changed_when: false
- name: VPNaaS | Wait for Tunnel to be ACTIVE
ansible.builtin.shell: |
{{ ovn_vpnaas_activate }}
openstack vpn ipsec site connection show "conn_{{ item }}" -f value -c status
register: tunnel_status
until: tunnel_status.stdout == "ACTIVE"
retries: "{{ ovn_vpnaas_tunnel_retries }}"
delay: "{{ ovn_vpnaas_tunnel_delay }}"
loop: ["west", "east"]
environment: "{{ os_auth_env }}"
changed_when: false
- name: VPNaaS | SHOW TUNNEL STATUS RESULT
ansible.builtin.debug:
msg:
- "************************************************************"
- "CONNECTION: conn_{{ item.item }}"
- "STATUS: {{ item.stdout }}"
- "RESULT: TUNNEL ESTABLISHED SUCCESSFULLY!"
- "************************************************************"
loop: "{{ tunnel_status.results }}"
loop_control:
label: "{{ item.item }}"
- name: VPNaaS | Show Full Connection Details
ansible.builtin.shell: |
{{ ovn_vpnaas_activate }}
openstack vpn ipsec site connection list
environment: "{{ os_auth_env }}"
register: final_list
changed_when: false
- name: VPNaaS | Print Connection List Table
ansible.builtin.debug:
var: final_list.stdout_lines
- name: VPNaaS | Final Cleanup
ansible.builtin.include_tasks: cleanup_site.yml
loop: ["west", "east"]
loop_control:
loop_var: site_to_clean
- name: VPNaaS | Cleanup | Global Policies
ansible.builtin.shell: |
{{ ovn_vpnaas_activate }}
openstack vpn ipsec policy delete ipsecpolicy || true
openstack vpn ike policy delete ikepolicy || true
environment: "{{ os_auth_env }}"
changed_when: false
|
