[INFO] Création du rôle #1
152
README.md
152
README.md
@ -1,3 +1,151 @@
|
|||||||
# role_modele
|
# role_keepalived
|
||||||
|
|
||||||
Modèle
|
Rôle de déploiement de keepalived.
|
||||||
|
|
||||||
|
## Dépendance
|
||||||
|
|
||||||
|
Le rôle *users* est requis afin que l'utilisateur dédié exécutant les scripts définis via `keepalived_track_scripts` soit créé.
|
||||||
|
|
||||||
|
## Variables
|
||||||
|
|
||||||
|
### keepalived_uid
|
||||||
|
|
||||||
|
Identifiant unique permettant d'identifer les membres.
|
||||||
|
|
||||||
|
*<span style="text-decoration: underline">Valeur par défaut:</span> aucune*
|
||||||
|
|
||||||
|
### keepalived_priority
|
||||||
|
|
||||||
|
Priorité de la machine pour prendre l'IP de failover.<br>
|
||||||
|
Ce chiffre doit être différent sur chaque machine portant le même identifiant unique.
|
||||||
|
|
||||||
|
*<span style="text-decoration: underline">Valeur par défaut:</span> aucune*
|
||||||
|
|
||||||
|
### keepalived_interface
|
||||||
|
|
||||||
|
Interface sur laquelle l'IP de failover sera montée.
|
||||||
|
|
||||||
|
*<span style="text-decoration: underline">Valeur par défaut:</span> aucune*
|
||||||
|
|
||||||
|
### keepalived_mail_to
|
||||||
|
|
||||||
|
Adresse mail sur laquelle envoyer les alertes.
|
||||||
|
|
||||||
|
*<span style="text-decoration: underline">Valeur par défaut:</span> aucune*
|
||||||
|
|
||||||
|
### keepalived_mail_from
|
||||||
|
|
||||||
|
Adresse mail source depuis laquelle partent les alertes.<br>
|
||||||
|
Le serveur d'envoi (smtp) est défini par défaut sur localhost.
|
||||||
|
|
||||||
|
*<span style="text-decoration: underline">Valeur par défaut:</span> aucune*
|
||||||
|
|
||||||
|
### keepalived_ipv4
|
||||||
|
|
||||||
|
Adresse IPv4 de failover.
|
||||||
|
|
||||||
|
*<span style="text-decoration: underline">Valeur par défaut:</span> aucune*
|
||||||
|
|
||||||
|
### keepalived_ipv6: ""
|
||||||
|
|
||||||
|
Adresse IPv6 de failover.
|
||||||
|
|
||||||
|
*<span style="text-decoration: underline">Valeur par défaut:</span> aucune*
|
||||||
|
|
||||||
|
### keepalived_track_scripts
|
||||||
|
|
||||||
|
Liste de script dont le code retour doit être à zéro pour que le membre conserve ou puisse prendre l'IP de failover.
|
||||||
|
|
||||||
|
*<span style="text-decoration: underline">Valeur par défaut:</span> aucune*
|
||||||
|
|
||||||
|
### keepalived_track_processes
|
||||||
|
|
||||||
|
Liste de processus devant fonctionner pour que le membre conserve ou puisse prendre l'IP de failover.
|
||||||
|
|
||||||
|
*<span style="text-decoration: underline">Valeur par défaut:</span> aucune*
|
||||||
|
|
||||||
|
## Exemples
|
||||||
|
|
||||||
|
Dans les exemples ci-dessous, j'utilise aussi le rôle *nftables* afin d'installer et configurer le pare-feu logiciel éponyme.
|
||||||
|
|
||||||
|
### host_vars/infra-gw-2315a.nyx.ykn.local.yml
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
---
|
||||||
|
|
||||||
|
# BEGIN role_ifupdown
|
||||||
|
ifupdown_interfaces:
|
||||||
|
- interface: eth0
|
||||||
|
ipv4:
|
||||||
|
inet: static
|
||||||
|
address: 192.168.50.250
|
||||||
|
mask: 24
|
||||||
|
dns: 192.168.50.11 192.168.50.16
|
||||||
|
ipv6:
|
||||||
|
inet: static
|
||||||
|
address: fd00:ff50::d250
|
||||||
|
mask: 64
|
||||||
|
dns: fd00:ff50::d011 fd00:ff50::d016
|
||||||
|
- interface: eth1
|
||||||
|
ipv4:
|
||||||
|
inet: static
|
||||||
|
address: 192.168.1.51
|
||||||
|
mask: 24
|
||||||
|
dns: 192.168.1.254
|
||||||
|
ipv6:
|
||||||
|
inet: auto
|
||||||
|
# END role_ifupdown
|
||||||
|
```
|
||||||
|
|
||||||
|
### group_vars/gw.yml
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
---
|
||||||
|
|
||||||
|
# BEGIN role_users
|
||||||
|
users:
|
||||||
|
- name: keepalived_script
|
||||||
|
comment: "Dedicated user for keepalived script"
|
||||||
|
update_password: on_create
|
||||||
|
password_lock: true
|
||||||
|
shell: /bin/bash
|
||||||
|
# END role_users
|
||||||
|
|
||||||
|
# BEGIN role_nftables
|
||||||
|
nftables_rules:
|
||||||
|
- filename: keepalived
|
||||||
|
rules:
|
||||||
|
- ip saddr 192.168.50.250 accept
|
||||||
|
- ip saddr 192.168.50.251 accept
|
||||||
|
- ip saddr 192.168.50.252 accept
|
||||||
|
# END role_nftables
|
||||||
|
|
||||||
|
# BEGIN role_keepalived
|
||||||
|
keepalived_ipv4: 192.168.50.254/24
|
||||||
|
keepalived_ipv6: fd00:ff50::d254/64
|
||||||
|
|
||||||
|
keepalived_uid: "{{ keepalived_ipv4 | split('.') | last | split('/') | first }}"
|
||||||
|
|
||||||
|
keepalived_track_scripts:
|
||||||
|
- name: check_nftables_service
|
||||||
|
interval: 5
|
||||||
|
command: /usr/bin/systemctl is-active nftables.service
|
||||||
|
# END role_keepalived
|
||||||
|
```
|
||||||
|
|
||||||
|
### playbook.yml
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
---
|
||||||
|
|
||||||
|
- name: Déployer les passerelles réseau
|
||||||
|
hosts: gateways
|
||||||
|
vars:
|
||||||
|
primary_interface: "{{ ifupdown_interfaces | first }}"
|
||||||
|
keepalived_priority: "{{ 255 - (primary_interface.ipv4.address | split('.') | last | int) }}"
|
||||||
|
keepalived_interface: "{{ primary_interface.interface }}"
|
||||||
|
roles:
|
||||||
|
- name: users
|
||||||
|
- name: nftables
|
||||||
|
- name: keepalived
|
||||||
|
```
|
||||||
|
25
defaults/main.yml
Normal file
25
defaults/main.yml
Normal file
@ -0,0 +1,25 @@
|
|||||||
|
---
|
||||||
|
# defaults file for role_keepalived
|
||||||
|
|
||||||
|
keepalived_uid: ""
|
||||||
|
keepalived_priority: ""
|
||||||
|
keepalived_interface: ""
|
||||||
|
|
||||||
|
keepalived_mail_to: ""
|
||||||
|
keepalived_mail_from: ""
|
||||||
|
|
||||||
|
keepalived_ipv4: ""
|
||||||
|
keepalived_ipv6: ""
|
||||||
|
|
||||||
|
keepalived_track_scripts: []
|
||||||
|
# Exemple:
|
||||||
|
# - name: check_haproxy_8080
|
||||||
|
# command: /usr/bin/nc -zv 127.0.0.1 8080
|
||||||
|
# - name: check_haproxy_8081
|
||||||
|
# command: /usr/bin/nc -zv 127.0.0.1 8081
|
||||||
|
|
||||||
|
keepalived_track_processes: []
|
||||||
|
# Exemple:
|
||||||
|
# - name: check_haproxy
|
||||||
|
# search: /usr/sbin/haproxy
|
||||||
|
# quorum: 2
|
8
handlers/main.yml
Normal file
8
handlers/main.yml
Normal file
@ -0,0 +1,8 @@
|
|||||||
|
---
|
||||||
|
# handlers file for network
|
||||||
|
|
||||||
|
- name: Redémarrer keepalived.service
|
||||||
|
become: true
|
||||||
|
ansible.builtin.systemd:
|
||||||
|
state: restarted
|
||||||
|
name: keepalived.service
|
@ -1,7 +1,7 @@
|
|||||||
galaxy_info:
|
galaxy_info:
|
||||||
namespace: ykn
|
namespace: ykn
|
||||||
author: pulsar89.5
|
author: pulsar89.5
|
||||||
description: Rôle modèle
|
description: Rôle de déploiement de keepalived
|
||||||
|
|
||||||
license: GPL-3.0-or-later
|
license: GPL-3.0-or-later
|
||||||
|
|
||||||
@ -12,4 +12,5 @@ galaxy_info:
|
|||||||
versions:
|
versions:
|
||||||
- all
|
- all
|
||||||
|
|
||||||
dependencies: []
|
dependencies:
|
||||||
|
- role: users
|
||||||
|
17
tasks/main.yml
Normal file
17
tasks/main.yml
Normal file
@ -0,0 +1,17 @@
|
|||||||
|
---
|
||||||
|
# tasks file for keepalived
|
||||||
|
|
||||||
|
- name: Installer keepalived
|
||||||
|
ansible.builtin.apt:
|
||||||
|
name: keepalived
|
||||||
|
become: true
|
||||||
|
|
||||||
|
- name: Déployer la configuration
|
||||||
|
ansible.builtin.template:
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: u=rw,g=r,o=r
|
||||||
|
src: keepalived.j2
|
||||||
|
dest: /etc/keepalived/keepalived.conf
|
||||||
|
become: true
|
||||||
|
notify: Redémarrer keepalived.service
|
70
templates/keepalived.j2
Normal file
70
templates/keepalived.j2
Normal file
@ -0,0 +1,70 @@
|
|||||||
|
# {{ ansible_managed }}
|
||||||
|
|
||||||
|
global_defs {
|
||||||
|
{% if keepalived_mail_to | length > 0 %}
|
||||||
|
notification_email {
|
||||||
|
{{ keepalived_mail_to }}
|
||||||
|
}
|
||||||
|
{% endif %}
|
||||||
|
|
||||||
|
{% if keepalived_mail_from | length > 0 %}
|
||||||
|
notification_email_from {{ keepalived_mail_from }}
|
||||||
|
smtp_server 127.0.0.1
|
||||||
|
smtp_connect_timeout 30
|
||||||
|
{% endif %}
|
||||||
|
|
||||||
|
enable_script_security
|
||||||
|
max_auto_priority 50
|
||||||
|
}
|
||||||
|
|
||||||
|
{% for script in keepalived_track_scripts %}
|
||||||
|
vrrp_script {{ script.name }} {
|
||||||
|
script {{ script.command }}
|
||||||
|
interval {{ script.interval }}
|
||||||
|
}
|
||||||
|
{% endfor %}
|
||||||
|
|
||||||
|
{% for process in keepalived_track_processes %}
|
||||||
|
vrrp_track_process {{ process.name }} {
|
||||||
|
process "{{ process.search }}"
|
||||||
|
quorum {{ process.quorum }}
|
||||||
|
}
|
||||||
|
{% endfor %}
|
||||||
|
|
||||||
|
vrrp_instance VIP_{{ keepalived_uid }} {
|
||||||
|
state BACKUP
|
||||||
|
priority {{ keepalived_priority }}
|
||||||
|
nopreempt
|
||||||
|
|
||||||
|
interface {{ keepalived_interface }}
|
||||||
|
virtual_router_id {{ keepalived_uid }}
|
||||||
|
advert_int 1
|
||||||
|
|
||||||
|
{% if keepalived_ipv4 | length > 0 %}
|
||||||
|
virtual_ipaddress {
|
||||||
|
{{ keepalived_ipv4 }} dev {{ keepalived_interface }} scope global
|
||||||
|
}
|
||||||
|
{% endif %}
|
||||||
|
|
||||||
|
{% if keepalived_ipv6 | length > 0 %}
|
||||||
|
virtual_ipaddress_excluded {
|
||||||
|
{{ keepalived_ipv6 }} dev {{ keepalived_interface }} scope global
|
||||||
|
}
|
||||||
|
{% endif %}
|
||||||
|
|
||||||
|
{% if keepalived_track_scripts | length > 0 %}
|
||||||
|
track_script {
|
||||||
|
{% for script in keepalived_track_scripts %}
|
||||||
|
{{ script.name }}
|
||||||
|
{% endfor%}
|
||||||
|
}
|
||||||
|
{% endif %}
|
||||||
|
|
||||||
|
{% if keepalived_track_processes | length > 0 %}
|
||||||
|
track_process {
|
||||||
|
{% for process in keepalived_track_processes %}
|
||||||
|
{{ process.name }}
|
||||||
|
{% endfor %}
|
||||||
|
}
|
||||||
|
{% endif %}
|
||||||
|
}
|
Loading…
Reference in New Issue
Block a user