|
| 1 | +#!/bin/bash |
| 2 | + |
| 3 | +set -e |
| 4 | + |
| 5 | +# Fill in Array of openshift contexts |
| 6 | +declare -a CONTEXTS |
| 7 | +CONTEXTS=($(oc config get-contexts -o name)) |
| 8 | +# Check for three clusters |
| 9 | +if [ ${#CONTEXTS[@]} != 3 ] |
| 10 | +then |
| 11 | + echo "Need three clusters in kubeconfig to continue" |
| 12 | + exit 1 |
| 13 | +fi |
| 14 | +echo "+---+-----------------------+-----------+---------------+----------------------+" |
| 15 | +echo "+ I + VPC + REGION + CIDR + Security Group +" |
| 16 | +echo "+---+-----------------------+-----------+---------------+----------------------+" |
| 17 | +for i in 0 1 2 |
| 18 | +do |
| 19 | + OC="oc --context=${CONTEXTS[i]}" |
| 20 | + # Gather nodes from context |
| 21 | + NODES=($(${OC} get nodes -l 'node-role.kubernetes.io/worker' -o name)) |
| 22 | + # Read AWS region for first node |
| 23 | + REGIONS[$i]=$(${OC} get ${NODES[0]} -L 'failure-domain.beta.kubernetes.io/region' | tail -n 1 | awk '{print $6}') |
| 24 | + AWS="aws --region ${REGIONS[i]}" |
| 25 | + # Get AWS id of first node |
| 26 | + providerid=$(${OC} get ${NODES[0]} -o jsonpath='{.spec.providerID}') |
| 27 | + ID=$(basename ${providerid}) |
| 28 | + # Read AWS VPC id for this cluster (and strip quotes) |
| 29 | + VPCS[$i]=$(${AWS} ec2 describe-instances --instance-id $ID --query 'Reservations[0].Instances[0].VpcId' --output text) |
| 30 | + # Need CIDR for routing rules |
| 31 | + CIDRS[$i]=$(${AWS} ec2 describe-vpcs --vpc-id ${VPCS[i]} --query 'Vpcs[0].CidrBlock' --output text) |
| 32 | + # Need SG for worker nodes |
| 33 | + # Filter created in JSON because csv implies OR while JSON implies AND (seems a bug) |
| 34 | + FILTER='[{"Name": "vpc-id", "Values": ["'${VPCS[i]}'"]},{"Name": "tag:Name","Values": ["*worker*"]}]' |
| 35 | + SGS[$i]=$(${AWS} ec2 describe-security-groups --filters "${FILTER}" --query 'SecurityGroups[0].GroupId' --output text) |
| 36 | + |
| 37 | + echo "+ ${i} + ${VPCS[i]} + ${REGIONS[i]} + ${CIDRS[i]} + ${SGS[i]} +" |
| 38 | + echo "+---+-----------------------+-----------+---------------+----------------------+" |
| 39 | +done |
| 40 | + |
| 41 | +# create_sg_rules(index_from, index_to) |
| 42 | +# Adds rules for VPN connections to provided sg from provided peering |
| 43 | +create_sg_rules() { |
| 44 | + from=$1 |
| 45 | + to=$2 |
| 46 | + echo -n "Security group rules from $from to $to: " |
| 47 | + EXISTS=$(aws ec2 --region ${REGIONS[from]} describe-security-groups \ |
| 48 | + --group-id ${SGS[from]} \ |
| 49 | + --filter "Name=ip-permission.to-port,Values=4500,Name=ip-permission.cidr,Values=[${CIDRS[to]}]" \ |
| 50 | + --query "SecurityGroups[0].GroupId" \ |
| 51 | + --output text) |
| 52 | + if [ $EXISTS == "None" ] |
| 53 | + then |
| 54 | + aws ec2 --region ${REGIONS[from]} authorize-security-group-ingress \ |
| 55 | + --group-id ${SGS[from]} \ |
| 56 | + --ip-permissions \ |
| 57 | + IpProtocol=udp,FromPort=500,ToPort=500,IpRanges="[{CidrIp=${CIDRS[to]}}]" \ |
| 58 | + IpProtocol=udp,FromPort=4500,ToPort=4500,IpRanges="[{CidrIp=${CIDRS[to]}}]" \ |
| 59 | + IpProtocol=50,IpRanges="[{CidrIp=${CIDRS[to]}}]" \ |
| 60 | + IpProtocol=51,IpRanges="[{CidrIp=${CIDRS[to]}}]" |
| 61 | + echo "Created" |
| 62 | + else |
| 63 | + echo "Exists" |
| 64 | + fi |
| 65 | +} |
| 66 | + |
| 67 | +# create_routes(index_from, index_to, vpc_peering_connection) |
| 68 | +# Creates route entries in all the zones' route tables |
| 69 | +create_routes() { |
| 70 | + from=$1 |
| 71 | + to=$2 |
| 72 | + # Enumerate route tables in FROM sg |
| 73 | + RTS=$(aws ec2 --region ${REGIONS[from]} describe-route-tables --filter "Name=vpc-id,Values=${VPCS[from]}" --query 'RouteTables[*].RouteTableId' --output text) |
| 74 | + for rt in $RTS |
| 75 | + do |
| 76 | + echo -n "Route ${REGIONS[from]} to ${CIDRS[to]}: " |
| 77 | + # Check for existence (idempotency) |
| 78 | + EXISTS=$(aws ec2 --region ${REGIONS[from]} describe-route-tables \ |
| 79 | + --route-table-id ${rt} \ |
| 80 | + --filter Name=route.destination-cidr-block,Values=${CIDRS[to]} \ |
| 81 | + --query 'RouteTables[0].RouteTableId' --output text) |
| 82 | + if [ $EXISTS == "None" ] |
| 83 | + then |
| 84 | + aws ec2 --region ${REGIONS[from]} create-route \ |
| 85 | + --route-table-id ${rt} \ |
| 86 | + --destination-cidr-block ${CIDRS[to]} \ |
| 87 | + --vpc-peering-connection-id $3 |
| 88 | + echo "Created" |
| 89 | + else |
| 90 | + echo "Exists" |
| 91 | + fi |
| 92 | + done |
| 93 | +} |
| 94 | + |
| 95 | +# create_and_accept_peer (index_from, index_to) |
| 96 | +create_and_accept_peer() { |
| 97 | + from=$1 |
| 98 | + to=$2 |
| 99 | + VPCPEER=$(aws ec2 --region ${REGIONS[from]} create-vpc-peering-connection \ |
| 100 | + --vpc-id ${VPCS[from]} \ |
| 101 | + --peer-vpc-id ${VPCS[to]} \ |
| 102 | + --peer-region ${REGIONS[to]} \ |
| 103 | + --query 'VpcPeeringConnection.VpcPeeringConnectionId' \ |
| 104 | + --output text) |
| 105 | + echo $VPCPEER |
| 106 | + |
| 107 | + # Give connection time to create TODO: Add check not just sleep |
| 108 | + sleep 5 |
| 109 | + |
| 110 | + aws ec2 --region ${REGIONS[to]} accept-vpc-peering-connection \ |
| 111 | + --vpc-peering-connection-id ${VPCPEER} >& /dev/null |
| 112 | + |
| 113 | + create_routes $from $to $VPCPEER |
| 114 | + create_routes $to $from $VPCPEER |
| 115 | + |
| 116 | + create_sg_rules $from $to |
| 117 | + create_sg_rules $to $from |
| 118 | +} |
| 119 | + |
| 120 | + |
| 121 | +create_and_accept_peer 0 1 |
| 122 | +create_and_accept_peer 0 2 |
| 123 | +create_and_accept_peer 1 2 |
0 commit comments