mcevik0
commented
4 years ago Ansible playbook : https://github.com/RENCI-NRIG/exogeni/tree/master/infrastructure/exogeni/exogeni-deployment/ansible
INVENTORY="atlanticwavesdx"
PLAYBOOK="atlanticwavesdxnodes.yml"
ansible atlanticwave_sdx -i ${INVENTORY} -m command -a "uname -a" -o -u root
ansible-playbook -i ${INVENTORY} ${PLAYBOOK} --limit atlanticwave_sdx --tags "common"
ansible-playbook -i ${INVENTORY} ${PLAYBOOK} --limit atlanticwave_sdx --tags "chrony"
ansible-playbook -i ${INVENTORY} ${PLAYBOOK} --limit atlanticwave_sdx --tags "fail2ban"
#ansible-playbook -i ${INVENTORY} ${PLAYBOOK} --limit atlanticwave_sdx --tags "sssd"
ansible-playbook -i ${INVENTORY} ${PLAYBOOK} --limit atlanticwave_sdx --tags "sshd"
ansible-playbook -i ${INVENTORY} ${PLAYBOOK} --limit atlanticwave_sdx --tags "docker"
ansible-playbook -i ${INVENTORY} ${PLAYBOOK} --limit atlanticwave_sdx --tags "check-mk-agent"
ansible-playbook -i ${INVENTORY} ${PLAYBOOK} --limit atlanticwave_sdx --tags "docker_users"VMs are dual-homed with one public and one private interface on BEN Management network. VMs accept SSH connections through both public and private interfaces.
152.54.3.142 192.168.201.207 aw-sdx-monitor.renci.org
152.54.3.143 192.168.201.203 aw-sdx-controller.renci.org
152.54.3.144 192.168.201.204 aw-sdx-lc-1.renci.org
152.54.3.145 192.168.201.205 aw-sdx-lc-2.renci.org
152.54.3.146 192.168.201.206 aw-sdx-lc-3.renci.orgI also added port forwarding rules to the BEN gateway, however, routing this traffic will require a few more configurations. At this time, it can be easier to create the jenkins nodes with individual public IP addresses above.
SSH Port mappings
* tcp/20022 ---> tcp/22 on 192.168.201.203
* tcp/20122 ---> tcp/22 on 192.168.201.204
* tcp/20222 ---> tcp/22 on 192.168.201.205
* tcp/20322 ---> tcp/22 on 192.168.201.206Firewall implemented via script (ansible role partially completed)
INTERFACE_PUBLIC="ens192"
INTERFACE_PRIVATE="ens224"
cat << EOF >> /etc/sysconfig/network-scripts/ifcfg-${INTERFACE_PUBLIC}
ZONE=public
EOF
cat << EOF >> /etc/sysconfig/network-scripts/ifcfg-${INTERFACE_PRIVATE}
ZONE=internal
EOF
systemctl restart network
systemctl status firewalld
firewall-cmd --permanent --zone=public --remove-service=ssh
firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="152.54.0.0/16" port protocol="tcp" port="22" accept'
firewall-cmd --reload
firewall-cmd --zone=public --list-all
# Allow all traffic on internal zone
for i in $(firewall-cmd --zone=internal --list-services); do
echo "--- Service: ${i}";
firewall-cmd --zone=internal --permanent --remove-service=${i};
done
firewall-cmd --permanent --zone=internal --set-target=ACCEPT
firewall-cmd --reload
firewall-cmd --list-all --zone=public
firewall-cmd --list-all --zone=internal
# Bind interfaces to the zones
firewall-cmd --permanent --zone=internal --add-interface=${INTERFACE_PRIVATE}
firewall-cmd --permanent --zone=public --add-interface=${INTERFACE_PUBLIC}
firewall-cmd --reload
cat << EOF >> /etc/sysconfig/network-scripts/route-${INTERFACE_PRIVATE}
192.168.0.0/16 via 192.168.100.1 dev ${INTERFACE_PRIVATE}
EOF
systemctl restart network
systemctl status firewalld
systemctl restart firewalldnrig-service account created on the VMs, sdx-ci public key injected.
[nrig-service@sdx-ci ~]$ ssh nrig-service@aw-sdx-controller.renci.org
The authenticity of host 'aw-sdx-controller.renci.org (152.54.3.143)' can't be established.
ECDSA key fingerprint is SHA256:PerE4/r4paJXXgOQUepspcemKbte7KfzcHgd5k8Hbjs.
ECDSA key fingerprint is MD5:2e:b9:b3:ca:31:5c:f4:1b:b0:a1:ee:86:c9:a8:f6:7e.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'aw-sdx-controller.renci.org,152.54.3.143' (ECDSA) to the list of known hosts.
Last login: Fri May 22 07:33:24 2020
[nrig-service@aw-sdx-controller ~]$ 
jab1982
We will run the controllers for production switches (FIU, SoX, Chile) at RENCI and provision VMs. This will require some work to bring the in-band management VLAN all the way to RENCI, but if it does not work well, this setup will still be useful for the monitoring part and testing the automation.
VM specs:
VMs are created (as templates) on the VMware Cluster with the IP addresses below.