update documentation
This commit is contained in:
bruzzechesse
parent
021fb84765
commit
41570d2840
|
|
@ -4,6 +4,18 @@ This module allows for the creation of a NVA (Network Virtual Appliance) to be u
|
|||
|
||||
This NVA can be used to interconnect up to 8 VPCs.
|
||||
|
||||
Please be aware that the NVA is running [COS](https://cloud.google.com/container-optimized-os/docs).
|
||||
Container-Optimized OS (COS) is a Linux-based operating system designed for running containers. By default, COS allows outgoing connections and accepts incoming connections only through the SSH service. To see the exact host firewall configuration, run the following command:
|
||||
|
||||
```sh
|
||||
sudo iptables -L -v
|
||||
```
|
||||
on a VM instance running COS. More information available in the [official](https://cloud.google.com/container-optimized-os/docs/how-to/firewall) documentation.
|
||||
|
||||
To configure the host firewall on COS, you can either pass a custom bash script with iptables commands or use the [optional_firewall_open_ports](variables.tf#L90) variable. The *optional_firewall_open_ports* variable is a list of ports to open on the local firewall for both TCP and UDP protocols.
|
||||
|
||||
The recommended solution for more fine-grained control is to pass a custom bash script with iptables commands. This will allow you to open specific ports for specific protocols and interfaces on the host firewall. The [optional_firewall_open_ports](variables.tf#L90) variable is a more convenient option, but you can only specify a list of ports to be opened for both TCP and UDP protocols on all the network interfaces with no further filtering capabilities.
|
||||
|
||||
## Examples
|
||||
|
||||
### Simple example
|
||||
|
|
@ -67,8 +79,24 @@ module "vm" {
|
|||
|
||||
### Example with advanced routing capabilities
|
||||
|
||||
Find below a sample terraform example for bootstrapping a simple NVA powered by [COS](https://cloud.google.com/container-optimized-os/docs) and running [FRRouting](https://frrouting.org/) container.
|
||||
Please find below a sample frr.conf file based on the documentation available [here](https://docs.frrouting.org/en/latest/basic.html) for hosting a BGP service with ASN 65001 on FRR container establishing a BGP session with a remote neighbor with IP address 10.128.0.2 and ASN 65002.
|
||||
Find below a sample terraform example for bootstrapping a simple NVA powered by [COS](https://cloud.google.com/container-optimized-os/docs) and running [FRRouting](https://frrouting.org/) container. FRR container is managed as a systemd service named frr. For stopping, starting or restarting the container please use the following commands:
|
||||
|
||||
```sh
|
||||
sudo systemctl stop frr
|
||||
sudo systemctl start frr
|
||||
sudo systemctl restart frr
|
||||
```
|
||||
|
||||
Being a fork of [Quagga](https://en.wikipedia.org/wiki/Quagga_(software)), FRR offers the same VTY shell named vtysh to deal with all the running daemons. It is possible to access the vtysh on the container via the following procedure:
|
||||
1. issue a `sudo docker container ls` to get the container ID
|
||||
2. execute `docker exec -it ${CONTAINER_ID} vtysh` to get a VTYSH shell running on the container and manage frr software
|
||||
|
||||
In order to check FRR running configuration you can issue the `show running-config` from vtysh. Please always refer to the official documentation for more information how to deal with vtysh and useful commands.
|
||||
|
||||
Please find below a sample frr.conf file based on the documentation available [here](https://docs.frrouting.org/en/latest/basic.html) for hosting a BGP service with ASN 65001 on FRR container establishing a BGP session with a remote neighbor with IP address 10.128.0.2 and ASN 65002.
|
||||
In order to check BGP status for the bootstrapped NVA you can issue 'show bgp summary' from vtysh.
|
||||
|
||||
When configuring FRR, this module automatically configures the local firewall to accept inbound connections for well known protocols enabled in the daemons_enabled parameter of the [frr_config](variables.tf#L39) variable. For example, when configuring BGP, the local firewall will be automatically configured to accept connections on port 179.
|
||||
|
||||
```
|
||||
# tftest-file id=frr_conf path=./frr.conf
|
||||
|
|
@ -145,6 +173,7 @@ module "vm" {
|
|||
| [enable_health_checks](variables.tf#L23) | Configures routing to enable responses to health check probes. | <code>bool</code> | | <code>false</code> |
|
||||
| [files](variables.tf#L29) | Map of extra files to create on the instance, path as key. Owner and permissions will use defaults if null. | <code title="map(object({ content = string owner = string permissions = string }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [frr_config](variables.tf#L39) | FRR configuration for container running on the NVA. | <code title="object({ config_file = string daemons_enabled = optional(list(string)) })">object({…})</code> | | <code>null</code> |
|
||||
| [optional_firewall_open_ports](variables.tf#L90) | Optional Ports to be opened on the local firewall. | <code>list(string)</code> | | <code>[]</code> |
|
||||
| [optional_run_cmds](variables.tf#L84) | Optional Cloud Init run commands to execute. | <code>list(string)</code> | | <code>[]</code> |
|
||||
|
||||
## Outputs
|
||||
|
|
|
|||
|
|
@ -54,9 +54,10 @@ write_files:
|
|||
%{ for route in interface.routes ~}
|
||||
ip route add ${route} via `curl http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/${interface.number}/gateway -H "Metadata-Flavor:Google"` dev ${interface.name}
|
||||
%{ endfor ~}
|
||||
%{ for port in firewall_open_ports ~}
|
||||
iptables -A INPUT -p all --dport ${port} -j ACCEPT
|
||||
%{ endfor ~}
|
||||
%{ for port in firewall_open_ports ~}
|
||||
iptables -A INPUT -p tcp --dport ${port} -j ACCEPT
|
||||
iptables -A INPUT -p udp --dport ${port} -j ACCEPT
|
||||
%{ endfor ~}
|
||||
|
||||
bootcmd:
|
||||
|
|
|
|||
|
|
@ -68,23 +68,23 @@ locals {
|
|||
)
|
||||
|
||||
_frr_daemons = {
|
||||
"zebra": []
|
||||
"bgpd": ["179"]
|
||||
"ospfd": []
|
||||
"ospf6d": []
|
||||
"ripd": ["520"]
|
||||
"ripngd": ["521"]
|
||||
"isisd": []
|
||||
"pimd": []
|
||||
"ldpd": ["646"]
|
||||
"nhrpd": []
|
||||
"zebra" : []
|
||||
"bgpd" : ["179"]
|
||||
"ospfd" : []
|
||||
"ospf6d" : []
|
||||
"ripd" : ["520"]
|
||||
"ripngd" : ["521"]
|
||||
"isisd" : []
|
||||
"pimd" : []
|
||||
"ldpd" : ["646"]
|
||||
"nhrpd" : []
|
||||
"eigrpd" : []
|
||||
"babeld": []
|
||||
"sharpd": []
|
||||
"staticd": []
|
||||
"pbrd": []
|
||||
"bfdd": ["3784"]
|
||||
"fabricd": []
|
||||
"babeld" : []
|
||||
"sharpd" : []
|
||||
"staticd" : []
|
||||
"pbrd" : []
|
||||
"bfdd" : ["3784"]
|
||||
"fabricd" : []
|
||||
}
|
||||
|
||||
_frr_daemons_enabled = try(
|
||||
|
|
@ -96,7 +96,7 @@ locals {
|
|||
_frr_required_ports = try(
|
||||
[
|
||||
for daemon, ports in local._frr_daemons : contains(var.frr_config.daemons_enabled, daemon) ? ports : []
|
||||
], [])
|
||||
], [])
|
||||
|
||||
_local_firewall_ports = concat(var.optional_firewall_open_ports, flatten(local._frr_required_ports))
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue