Merge branch 'role_nftables'

kubernetes/tasks/install/agent/install_k3s.yml

@@ -1,13 +1,12 @@
 - name: Install K3s agent
   command: /root/k3s_install.sh {{ type }}
   register: command
-  changed_when: "'No change detected' in command.stdout"
+  changed_when: "'No change detected' not in command.stdout"
   until: "command is not failed"
   retries: 2
   delay: 10
 
-- name: Restart when config changed, but install already done
+- name: Make sure service is started / restarted on config change
   service:
-    name: k3s
-    status: restarted
-  when: "inventory_hostname != groups['kubernetes'][0] and not command.changed and config.changed"
+    name: k3s-agent
+    state: "{{ 'restarted' if not command.changed and config.changed else 'started' }}"

kubernetes/tasks/install/server/install_k3s.yml

@@ -2,13 +2,13 @@
   command: /root/k3s_install.sh {{ type }}
   when: "inventory_hostname == groups['kubernetes'][0]"
   register: command
-  changed_when: "'No change detected' in command.stdout"
+  changed_when: "'No change detected' not in command.stdout"
 
-- name: Restart when config changed, but install already done
+- name: Make sure service is started / restarted on config change
   service:
     name: k3s
-    status: restarted
-  when: "inventory_hostname == groups['kubernetes'][0] and not command.changed and config.changed"
+    state: "{{ 'restarted' if not command.changed and config.changed else 'started' }}"
+  when: "inventory_hostname == groups['kubernetes'][0]"
 
 - name: Waiting for K3s-server to accept connections
   ansible.builtin.wait_for:
@@ -21,16 +21,16 @@
   command: /root/k3s_install.sh {{ type }}
   when: "inventory_hostname != groups['kubernetes'][0]"
   register: command
-  changed_when: "'No change detected' in command.stdout"
+  changed_when: "'No change detected' not in command.stdout"
   until: "command is not failed"
   retries: 2
   delay: 10
 
-- name: Restart when config changed, but install already done
+- name: Make sure service is started / restarted on config change
   service:
     name: k3s
-    status: restarted
-  when: "inventory_hostname != groups['kubernetes'][0] and not command.changed and config.changed"
+    state: "{{ 'restarted' if not command.changed and config.changed else 'started' }}"
+  when: "inventory_hostname != groups['kubernetes'][0]"
 
 - name: Waiting for K3s-server to accept connections on other nodes
   ansible.builtin.wait_for:

kubernetes/tasks/install/server/network-plugin/deploy_calico.yml

@@ -3,6 +3,8 @@
   register: command
   changed_when: "'created' in command.stdout"
   run_once: true
+  failed_when:
+  - "command.rc == 1 and 'AlreadyExists' not in command.stderr"
 
 - name: Deploy calico ressource template
   ansible.builtin.template:

kubernetes/templates/k3s/agent/config.yaml.jinja2

@@ -1,11 +1,8 @@
-server: https://{{ kubernetes.control_plane.dns_name }}:6443
+server: https://{{ hostvars[groups['kubernetes'][0]]['nodeip_ipv4'] }}:6443
 token: '{{ kubernetes.token }}'
 
 {% if nodeip_ipv6 != "" and kubernetes.ipPool.ipv6 is defined %}
 node-ip: {{ nodeip_ipv4 }},{{ nodeip_ipv6 }} 
-
-# FIXME: Workaround for bug in Kubernetes 1.24/1.25 ignoring node IPv6 addresses
-kubelet-arg: "--node-ip=0.0.0.0"
 {% else %}
 node-ip: {{ nodeip_ipv4 }}
 {% endif %}

kubernetes/templates/k3s/server/config.yaml.jinja2

@@ -15,9 +15,6 @@ tls-san:
 node-ip: {{ nodeip_ipv4 }},{{ nodeip_ipv6 }}
 cluster-cidr: {{ kubernetes.ipPool.ipv4.cluster_cidr }},{{ kubernetes.ipPool.ipv6.cluster_cidr }}
 service-cidr: {{ kubernetes.ipPool.ipv4.service_cidr }},{{ kubernetes.ipPool.ipv6.service_cidr }}  
-
-# FIXME: Workaround for bug in Kubernetes 1.24/1.25 ignoring node IPv6 addresses
-kubelet-arg: "--node-ip=0.0.0.0"
 {% else %}
 node-ip: {{ nodeip_ipv4 }}
 cluster-cidr: {{ kubernetes.ipPool.ipv4.cluster_cidr }}
@@ -27,7 +24,7 @@ service-cidr: {{ kubernetes.ipPool.ipv4.service_cidr }}
 egress-selector-mode: disabled
 
 # Network-plugin
-{% if kubernetes.network_plugin == "flannel" %}
+{% if kubernetes.network.plugin == "flannel" %}
 flannel-backend: vxlan
 {% else %}
 disable-network-policy: true

nftables/defaults/nftables.yml

@@ -0,0 +1,29 @@
+nftables:
+  # Rules to add
+  #  Handled as templates
+  #  Creates separate files for each entry.
+  # The identifier is necessary for ansible to be able to merge the keys (when 'hash_behaviour = merge')
+  #  rule-ids have to be unique across files and raw
+  rules:
+    # Files with Rules to add
+    files:
+      #'<group_identifier>': '<relative-location>'
+      #'<group_identifier>':
+      #  main: <relative-location>
+      #  '<identifier>': '<relative-location>'
+
+    # Rules to add
+    raw:
+      #'<group_identifier>': '<content>'
+      #'<group_identifier>':
+      #  main: <content>
+      #  '<identifier>': '<content>'
+
+  # Decides if /etc/nftables.conf is applied or separate files which have changed
+  #  Separate changes require the files to be self-tyding to not end up with duplicate rules
+  #  e.g.
+  #   table ip mytable
+  #   flush table ip mytable
+  #   delete table ip mytable
+  #   table ip mytable {} ...
+  apply_global: false

nftables/tasks/apply-files.yml

@@ -0,0 +1,8 @@
+- name: Load group rules
+  command: "nft -f /etc/nftables/ansible-managed/{{ item }}.nft"
+  loop: "{{ combined_rules | list }}"
+  when: not nftables.apply_global
+
+- name: Load global rule file
+  command: "nft -f /etc/nftables.nft"
+  when: nftables.apply_global

nftables/tasks/deploy-rules/main.yml

@@ -0,0 +1,11 @@
+- name: Deploying group files
+  include_tasks: ./per-group-template-file.yml
+  with_items:
+    - "{{ nftables.rules.files | list }}"
+
+- name: Deploying group raw-files
+  include_tasks: ./per-group-template.yml
+  with_items:
+    - "{{ nftables.rules.raw | list }}"
+
+- include_tasks: ./remove-files.yml

nftables/tasks/deploy-rules/per-group-template-file.yml

@@ -0,0 +1,51 @@
+- set_fact:
+    group_identifier: "{{ item }}"
+    value: "{{ nftables.rules.files[item] }}"
+  when: "item is defined"
+
+  #'<group_identifier>': '<relative-location>'
+- block:
+  - name: Create main rule file
+    template:
+      src: "{{ value }}"
+      dest: "/etc/nftables/ansible-managed/{{ group_identifier }}.nft"
+  when: value is string
+
+  #'<group_identifier>':
+  #  main: <relative-location>
+  #  '<identifier>': '<relative-location>'
+- block:
+  - set_fact:
+      items: "{{ nftables.rules.files[item] }}"
+    
+  - block:
+    - name: Create main rule file
+      template:
+        src: "{{ items['main'] }}"
+        dest: "/etc/nftables/ansible-managed/{{ group_identifier }}.nft"
+
+    - name: Include rule files
+      lineinfile:
+        path: "/etc/nftables/ansible-managed/{{ group_identifier }}.nft"
+        regexp: "include\\s+(\"|')\\/etc\\/nftables\\/ansible-managed\\/{{ group_identifier }}\\/.*$"
+        line: 'include "/etc/nftables/ansible-managed/{{ group_identifier }}/*.nft"'
+    when: items['main'] is defined
+
+  - name: Create group folder
+    file:
+      path: "/etc/nftables/ansible-managed/{{ group_identifier }}/"
+      state: directory
+    when: items|length > 0
+
+  - set_fact:
+      test: "{{ items | dict2items | selectattr('key', 'ne', 'main') }}"
+
+  - name: Create included rule files
+    template:
+      src: "{{ fileItem.value }}"
+      dest: "/etc/nftables/ansible-managed/{{ group_identifier }}/{{ fileItem.key }}.nft"
+    loop: "{{ items | dict2items | selectattr('key', 'ne', 'main') }}"
+    loop_control:
+      loop_var: fileItem
+
+  when: value is mapping

nftables/tasks/deploy-rules/per-group-template.yml

@@ -0,0 +1,48 @@
+- set_fact:
+    group_identifier: "{{ item }}"
+    value: "{{ nftables.rules.raw[item] }}"
+  when: "item is defined"
+
+  #'<group_identifier>': '<content>'
+- block:
+  - name: Create main rule file
+    copy:
+      content: "{{ value }}"
+      dest: "/etc/nftables/ansible-managed/{{ group_identifier }}.nft"
+  when: value is string
+
+  #'<group_identifier>':
+  #  main: <content>
+  #  '<identifier>': '<content>'
+- block:
+  - set_fact:
+      items: "{{ nftables.rules.raw[item] }}"
+  
+  - block:
+    - name: Create main rule file
+      copy:
+        content: "{{ items['main'] }}"
+        dest: "/etc/nftables/ansible-managed/{{ group_identifier }}.nft"
+
+    - name: Include rule files
+      lineinfile:
+        path: "/etc/nftables/ansible-managed/{{ group_identifier }}.nft"
+        regexp: "include\\s+(\"|')\\/etc\\/nftables\\/ansible-managed\\/{{ group_identifier }}\\/.*$"
+        line: 'include "/etc/nftables/ansible-managed/{{ group_identifier }}/*.nft"'
+    when: items['main'] is defined
+
+  - name: Create group folder
+    file:
+      path: "/etc/nftables/ansible-managed/{{ group_identifier }}/"
+      state: directory
+    when: items|length > 0
+
+  - name: Create included rule files
+    copy:
+      content: "{{ included_item.value }}"
+      dest: "/etc/nftables/ansible-managed/{{ group_identifier }}/{{ included_item.key }}.nft"
+    loop: "{{ items | dict2items | selectattr('key', 'ne', 'main') }}"
+    loop_control:
+      loop_var: included_item
+
+  when: value is mapping

nftables/tasks/install-package.yml

@@ -0,0 +1,4 @@
+- name: Install Packages
+  package:
+    name:
+      - nftables

nftables/tasks/main.yml

@@ -0,0 +1,7 @@
+- import_tasks: ./prerequisites.yml
+
+- import_tasks: ./setup-packages.yml
+
+- import_tasks: ./deploy-rules/main.yml
+
+- import_tasks: ./apply-files.yml

nftables/tasks/prerequisites.yml

@@ -0,0 +1,13 @@
+# Defaults if missing
+- name: Set defaults if missing
+  set_fact:
+    nftables:
+      rules:
+        files: "{{ nftables.rules.files | default({}) | combine({}) }}"
+        raw: "{{ nftables.rules.raw | default({}) | combine({}) }}"
+    combined_rules: "{{ nftables.rules.raw | combine(nftables.rules.files, recursive=true) }}"
+
+#- name: Check items for consistency
+#  assert:
+#    that: "{{ nftables.rules.files.values() | length }} + {{ nftables.rules.raw.values() | length }} == {{ combined_rules.values() | length }}"
+#    fail_msg: "files and raw rules share the same identifier"

nftables/tasks/remove-files.yml

@@ -0,0 +1,21 @@
+- name: Handle removed group files
+  block:
+  - find:
+      paths: /etc/nftables/ansible-managed/
+      file_type: 'any'
+      excludes: '{% for item in combined_rules %}{{ item }},{{ item }}.nft,{% endfor %}'
+      depth: 1
+    register: removeFiles
+
+  - file:
+      path: "{{ fileItem.path }}"
+      state: absent
+    loop: "{{ removeFiles.files }}"
+    loop_control:
+      label: "{{ fileItem.path }}"
+      loop_var: fileItem
+
+- name: Handle removed included files per group
+  include_tasks: ./remove-per-group.yml
+  with_items:
+  - "{{ combined_rules | list }}"

nftables/tasks/remove-per-group.yml

@@ -0,0 +1,20 @@
+- set_fact:
+    group_identifier: "{{ item }}"
+    group_items: "{{ combined_rules[item] }}"
+
+- block:
+  - find:
+      paths: "/etc/nftables/ansible-managed/{{ group_identifier }}/"
+      file_type: 'any'
+      excludes: '{% for item in group_items %}{{ item }}.nft,{% endfor %}'
+    register: removeFiles
+
+  - file:
+      path: "{{ fileItem.path }}"
+      state: absent
+    loop: "{{ removeFiles.files }}"
+    loop_control:
+      label: "{{ fileItem.path }}"
+      loop_var: fileItem
+
+  when: group_items is mapping

nftables/tasks/setup-packages.yml

@@ -0,0 +1,15 @@
+- name: Install nftables
+  package:
+    name:
+      - nftables
+
+- name: Create /etc/nftables/ansible-managed
+  file:
+    path: /etc/nftables/ansible-managed
+    state: directory
+
+- name: Include files in /etc/nftables/ansible-managed/ from /etc/nftables.conf
+  blockinfile:
+    path: /etc/nftables.conf
+    marker: "# {mark} ANSIBLE MANAGED BLOCK - nftables"
+    content: 'include "/etc/nftables/ansible-managed/*.nft"'

wireguard-ipv6-converter/defaults/wireguard-ipv6-converter.yml

@@ -0,0 +1,12 @@
+wireguard_ipv6_converter:
+  version: latest
+
+  # see https://github.com/Ruakij/wg-ipv6-converter#31-environment
+  setup:
+    interface: wg0
+    #ipv6_format: fc12::%02x%02x:%02x%02x/%d
+    #filter_prefix: 100.100
+    #recheck_interval: 60s
+
+  service:
+    #bindTo: netbird.service

wireguard-ipv6-converter/tasks/deploy.yml

@@ -0,0 +1,11 @@
+- name: Get architecture
+  set_fact:
+    arch: "{{ 'amd64' if ansible_architecture == 'x86_64' else 'arm64' }}"
+    versionUri: "{% if wireguard_ipv6_converter.version == 'latest' %}latest/download{% else %}download/{{ wireguard_ipv6_converter.version }}{% endif %}"
+
+- name: Download binary
+  get_url:
+    url: https://github.com/Ruakij/wg-ipv6-converter/releases/{{ versionUri }}/wg-ipv6-converter_{{ arch }}
+    dest: /usr/local/bin/wg-ipv6-converter
+    mode: "744"
+  register: deployDownload

wireguard-ipv6-converter/tasks/main.yml

@@ -0,0 +1,3 @@
+- import_tasks: ./deploy.yml
+
+- import_tasks: ./setup-service.yml

wireguard-ipv6-converter/tasks/setup-service.yml

@@ -0,0 +1,27 @@
+- name: Deploy service
+  ansible.builtin.template:
+    src: wg-ipv6-conv.service.jinja2
+    dest: /etc/systemd/system/wg-ipv6-converter_{{ wireguard_ipv6_converter.setup.interface }}.service
+  register: serviceFile
+
+- name: Enable service
+  ansible.builtin.service:
+    name: wg-ipv6-converter_{{ wireguard_ipv6_converter.setup.interface }}
+    daemon-reload: true
+    enabled: true
+
+- name: Start service if interface exists already
+  ansible.builtin.service:
+    name: wg-ipv6-converter_{{ wireguard_ipv6_converter.setup.interface }}
+    state: "{{ 'restarted' if deployDownload.changed or serviceFile.changed else 'started' }}"
+  register: service
+  when: "wireguard_ipv6_converter.setup.interface in ansible_interfaces"
+
+- name: Pause for 5s to wait for program to have run
+  ansible.builtin.pause:
+    seconds: 5
+  when: "service.changed"
+
+- name: Gather facts to get changes
+  ansible.builtin.gather_facts:
+  when: "service.changed"

wireguard-ipv6-converter/templates/wg-ipv6-conv.service.jinja2

@@ -0,0 +1,29 @@
+[Unit]
+Description=WireGuard IPv6 converter for {{ wireguard_ipv6_converter.setup.interface }}
+{% if wireguard_ipv6_converter.service.bindTo is defined %}
+BindsTo={{ wireguard_ipv6_converter.service.bindTo }}
+After={{ wireguard_ipv6_converter.service.bindTo }}
+{% endif %}
+
+[Service]
+Type=simple
+{% if wireguard_ipv6_converter.service.bindTo is defined %}
+ExecStartPre=/bin/sleep 10
+{% endif %}
+ExecStart=/usr/local/bin/wg-ipv6-converter
+Restart=always
+RestartSec=30
+
+Environment="INTERFACE={{ wireguard_ipv6_converter.setup.interface }}"
+{% if wireguard_ipv6_converter.setup.ipv6_format is defined %}
+Environment="IPV6_FORMAT={{ wireguard_ipv6_converter.setup.ipv6_format }}"
+{% endif %}
+{% if wireguard_ipv6_converter.setup.filter_prefix is defined %}
+Environment="FILTER_PREFIX={{ wireguard_ipv6_converter.setup.filter_prefix }}"
+{% endif %}
+{% if wireguard_ipv6_converter.setup.recheck_interval is defined %}
+Environment="RECHECK_INTERVAL={{ wireguard_ipv6_converter.setup.recheck_interval }}"
+{% endif %}
+
+[Install]
+WantedBy=multi-user.target