f-50: lab: arguments QEMU et seeds cloud-init des VM #50
Signed-off-by: GnomeZworc <nicolas.boufidjeline@g3e.fr>
This commit is contained in:
parent
a706e24b1c
commit
99ecb59aad
GPG key ID:
4406BBBF8845D632
9 changed files with 1132 additions and 10 deletions
54
internal/lab/render/qemu.go
Normal file
54
internal/lab/render/qemu.go
Normal file
|
|
@ -0,0 +1,54 @@
|
|||
package render
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"path/filepath"
|
||||
"strconv"
|
||||
|
||||
"git.g3e.fr/syonad/two/internal/lab/topology"
|
||||
)
|
||||
|
||||
const loopback = "127.0.0.1"
|
||||
|
||||
func qemuArgs(p *topology.Plan, n topology.NodePlan, index int, dir string) []string {
|
||||
args := []string{
|
||||
"-name", n.Name,
|
||||
"-machine", "q35",
|
||||
"-accel", "kvm",
|
||||
"-cpu", "host",
|
||||
"-smp", strconv.Itoa(n.CPUs),
|
||||
"-m", strconv.Itoa(n.Memory),
|
||||
"-nodefaults",
|
||||
"-display", "none",
|
||||
"-serial", "file:" + filepath.Join(dir, ConsoleFile),
|
||||
"-qmp", "unix:" + filepath.Join(dir, QMPFile) + ",server=on,wait=off",
|
||||
"-pidfile", filepath.Join(dir, PIDFile),
|
||||
"-drive", "file=" + filepath.Join(dir, DiskFile) + ",if=virtio,format=qcow2",
|
||||
"-drive", "file=" + filepath.Join(dir, SeedFile) + ",media=cdrom,readonly=on",
|
||||
}
|
||||
|
||||
restrict := "on"
|
||||
if n.Role == topology.RoleSwitch {
|
||||
restrict = "off"
|
||||
}
|
||||
args = append(args,
|
||||
"-netdev", fmt.Sprintf("user,id=%s,restrict=%s,ipv6=off,hostfwd=tcp:%s:%d-:22", AdminInterface, restrict, loopback, n.SSHPort),
|
||||
"-device", fmt.Sprintf("virtio-net-pci,netdev=%s,mac=%s,romfile=", AdminInterface, adminMAC(index)),
|
||||
)
|
||||
|
||||
for _, c := range nodeCables(p, n.Name) {
|
||||
args = append(args, cable(c.NodeInterface, c.NodePort, c.SwitchPort, c.NodeMAC.String(), c.MTU)...)
|
||||
}
|
||||
for _, c := range switchCables(p, n.Name) {
|
||||
args = append(args, cable(c.SwitchInterface, c.SwitchPort, c.NodePort, c.SwitchMAC.String(), c.MTU)...)
|
||||
}
|
||||
return args
|
||||
}
|
||||
|
||||
func cable(id string, local, remote int, mac string, mtu int) []string {
|
||||
return []string{
|
||||
"-netdev", fmt.Sprintf("dgram,id=%s,local.type=inet,local.host=%s,local.port=%d,remote.type=inet,remote.host=%s,remote.port=%d",
|
||||
id, loopback, local, loopback, remote),
|
||||
"-device", fmt.Sprintf("virtio-net-pci,netdev=%s,mac=%s,host_mtu=%d,romfile=", id, mac, mtu),
|
||||
}
|
||||
}
|
||||
132
internal/lab/render/render.go
Normal file
132
internal/lab/render/render.go
Normal file
|
|
@ -0,0 +1,132 @@
|
|||
package render
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"net"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
|
||||
"git.g3e.fr/syonad/two/internal/lab/topology"
|
||||
)
|
||||
|
||||
const (
|
||||
QEMUBinary = "qemu-system-x86_64"
|
||||
|
||||
AdminInterface = topology.ReservedInterface
|
||||
AdminAddress = "10.0.2.15/24"
|
||||
AdminGateway = "10.0.2.2"
|
||||
AdminDNS = "10.0.2.3"
|
||||
|
||||
DiskFile = "disk.qcow2"
|
||||
SeedFile = "seed.iso"
|
||||
ConsoleFile = "console.log"
|
||||
QMPFile = "qmp.sock"
|
||||
PIDFile = "qemu.pid"
|
||||
)
|
||||
|
||||
var Nameservers = []string{"1.1.1.1", "8.8.8.8"}
|
||||
|
||||
type Options struct {
|
||||
RunDir string
|
||||
AuthorizedKeys []string
|
||||
}
|
||||
|
||||
type Node struct {
|
||||
Name string
|
||||
Dir string
|
||||
QEMU []string
|
||||
MetaData []byte
|
||||
UserData []byte
|
||||
NetworkConfig []byte
|
||||
}
|
||||
|
||||
func Render(p *topology.Plan, o Options) ([]Node, error) {
|
||||
if err := o.validate(); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
var nodes []Node
|
||||
for index, n := range p.Nodes {
|
||||
dir := filepath.Join(o.RunDir, n.Name)
|
||||
meta, err := metaData(p, n)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
user, err := userData(p, n, o.AuthorizedKeys)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
network, err := networkConfig(p, n, index)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
nodes = append(nodes, Node{
|
||||
Name: n.Name,
|
||||
Dir: dir,
|
||||
QEMU: qemuArgs(p, n, index, dir),
|
||||
MetaData: meta,
|
||||
UserData: user,
|
||||
NetworkConfig: network,
|
||||
})
|
||||
}
|
||||
return nodes, nil
|
||||
}
|
||||
|
||||
func (o Options) validate() error {
|
||||
var errs []error
|
||||
if !filepath.IsAbs(o.RunDir) {
|
||||
errs = append(errs, fmt.Errorf("run dir %q must be an absolute path", o.RunDir))
|
||||
}
|
||||
if len(o.AuthorizedKeys) == 0 {
|
||||
errs = append(errs, errors.New("at least one authorized ssh key is required"))
|
||||
}
|
||||
for i, k := range o.AuthorizedKeys {
|
||||
if strings.ContainsAny(k, "\r\n") {
|
||||
errs = append(errs, fmt.Errorf("authorized key %d spans several lines", i+1))
|
||||
continue
|
||||
}
|
||||
fields := strings.Fields(k)
|
||||
if len(fields) < 2 || !validKeyType(fields[0]) {
|
||||
errs = append(errs, fmt.Errorf("authorized key %d is not an ssh public key", i+1))
|
||||
}
|
||||
}
|
||||
return errors.Join(errs...)
|
||||
}
|
||||
|
||||
func validKeyType(t string) bool {
|
||||
return strings.HasPrefix(t, "ssh-") || strings.HasPrefix(t, "ecdsa-sha2-") || strings.HasPrefix(t, "sk-")
|
||||
}
|
||||
|
||||
func adminMAC(index int) net.HardwareAddr {
|
||||
return net.HardwareAddr{0x02, 0x4d, byte(index >> 8), byte(index), 0x00, 0x00}
|
||||
}
|
||||
|
||||
func nodeCables(p *topology.Plan, name string) []topology.Cable {
|
||||
var out []topology.Cable
|
||||
for _, c := range p.Cables {
|
||||
if c.Node == name {
|
||||
out = append(out, c)
|
||||
}
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
func switchCables(p *topology.Plan, name string) []topology.Cable {
|
||||
var out []topology.Cable
|
||||
for _, c := range p.Cables {
|
||||
if c.Switch == name {
|
||||
out = append(out, c)
|
||||
}
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
func switchSegments(p *topology.Plan, name string) []topology.SegmentPlan {
|
||||
var out []topology.SegmentPlan
|
||||
for _, s := range p.Segments {
|
||||
if s.Switch == name {
|
||||
out = append(out, s)
|
||||
}
|
||||
}
|
||||
return out
|
||||
}
|
||||
477
internal/lab/render/render_test.go
Normal file
477
internal/lab/render/render_test.go
Normal file
|
|
@ -0,0 +1,477 @@
|
|||
package render
|
||||
|
||||
import (
|
||||
"reflect"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"go.yaml.in/yaml/v3"
|
||||
|
||||
"git.g3e.fr/syonad/two/internal/lab/topology"
|
||||
)
|
||||
|
||||
const labKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFG/JMmjfko96WkJV8DiL6rip/H/q/R++y8s27Z+Cj6O two-lab-automation"
|
||||
|
||||
const twoHypervisors = `name: evpn-2hv
|
||||
images:
|
||||
deb:
|
||||
url: https://example.invalid/deb.qcow2
|
||||
sums: https://example.invalid/SHA512SUMS
|
||||
segments:
|
||||
underlay: { switch: sw1, cidr: 10.250.0.0/24, mtu: 9000 }
|
||||
nodes:
|
||||
sw1: { role: switch, image: deb, cpus: 2, memory: 1024 }
|
||||
rr1: { role: rr, image: deb, cpus: 1, memory: 1024, segments: [underlay] }
|
||||
hv1: { role: hypervisor, image: deb, cpus: 4, memory: 16384, segments: [underlay] }
|
||||
hv2: { role: hypervisor, image: deb, cpus: 4, memory: 16384, segments: [underlay] }
|
||||
`
|
||||
|
||||
const twoSegments = `name: two-seg
|
||||
images:
|
||||
deb:
|
||||
url: https://example.invalid/deb.qcow2
|
||||
sums: https://example.invalid/SHA512SUMS
|
||||
segments:
|
||||
red: { switch: sw, cidr: 10.1.0.0/24 }
|
||||
blue: { switch: sw, cidr: 10.2.0.0/24, mtu: 1500 }
|
||||
nodes:
|
||||
sw: { role: switch, image: deb, cpus: 1, memory: 512 }
|
||||
hv: { role: hypervisor, image: deb, cpus: 1, memory: 512, segments: [blue, red] }
|
||||
`
|
||||
|
||||
func plan(t *testing.T, doc string) *topology.Plan {
|
||||
t.Helper()
|
||||
topo, err := topology.Parse([]byte(doc))
|
||||
if err != nil {
|
||||
t.Fatalf("Parse: %v", err)
|
||||
}
|
||||
p, err := topology.Compute(topo)
|
||||
if err != nil {
|
||||
t.Fatalf("Compute: %v", err)
|
||||
}
|
||||
return p
|
||||
}
|
||||
|
||||
func renderAll(t *testing.T, doc string) map[string]Node {
|
||||
t.Helper()
|
||||
nodes, err := Render(plan(t, doc), Options{RunDir: "/srv/lab", AuthorizedKeys: []string{labKey}})
|
||||
if err != nil {
|
||||
t.Fatalf("Render: %v", err)
|
||||
}
|
||||
out := map[string]Node{}
|
||||
for _, n := range nodes {
|
||||
out[n.Name] = n
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
func nodeNamed(t *testing.T, nodes map[string]Node, name string) Node {
|
||||
t.Helper()
|
||||
n, ok := nodes[name]
|
||||
if !ok {
|
||||
t.Fatalf("no rendered node %s", name)
|
||||
}
|
||||
return n
|
||||
}
|
||||
|
||||
func value(t *testing.T, args []string, flag string) []string {
|
||||
t.Helper()
|
||||
var out []string
|
||||
for i := 0; i+1 < len(args); i++ {
|
||||
if args[i] == flag {
|
||||
out = append(out, args[i+1])
|
||||
}
|
||||
}
|
||||
if len(out) == 0 {
|
||||
t.Fatalf("no %s in %v", flag, args)
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
func hasValue(args []string, flag, want string) bool {
|
||||
for i := 0; i+1 < len(args); i++ {
|
||||
if args[i] == flag && args[i+1] == want {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
func network(t *testing.T, n Node) networkDoc {
|
||||
t.Helper()
|
||||
var doc networkDoc
|
||||
if err := yaml.Unmarshal(n.NetworkConfig, &doc); err != nil {
|
||||
t.Fatalf("network-config of %s is not yaml: %v", n.Name, err)
|
||||
}
|
||||
return doc
|
||||
}
|
||||
|
||||
func iface(t *testing.T, doc networkDoc, name string) ethernet {
|
||||
t.Helper()
|
||||
e, ok := doc.Ethernets[name]
|
||||
if !ok {
|
||||
t.Fatalf("no interface %s in %v", name, doc.Ethernets)
|
||||
}
|
||||
return e
|
||||
}
|
||||
|
||||
func user(t *testing.T, n Node) cloudConfig {
|
||||
t.Helper()
|
||||
if !strings.HasPrefix(string(n.UserData), "#cloud-config\n") {
|
||||
t.Fatalf("user-data of %s does not start with #cloud-config", n.Name)
|
||||
}
|
||||
var cfg cloudConfig
|
||||
if err := yaml.Unmarshal(n.UserData, &cfg); err != nil {
|
||||
t.Fatalf("user-data of %s is not yaml: %v", n.Name, err)
|
||||
}
|
||||
return cfg
|
||||
}
|
||||
|
||||
func fileAt(t *testing.T, cfg cloudConfig, path string) writeFile {
|
||||
t.Helper()
|
||||
for _, f := range cfg.WriteFiles {
|
||||
if f.Path == path {
|
||||
return f
|
||||
}
|
||||
}
|
||||
t.Fatalf("no write_files entry %s", path)
|
||||
return writeFile{}
|
||||
}
|
||||
|
||||
func TestQEMU_HypervisorArguments(t *testing.T) {
|
||||
hv := nodeNamed(t, renderAll(t, twoHypervisors), "hv1")
|
||||
for flag, want := range map[string]string{
|
||||
"-name": "hv1",
|
||||
"-machine": "q35",
|
||||
"-accel": "kvm",
|
||||
"-cpu": "host",
|
||||
"-smp": "4",
|
||||
"-m": "16384",
|
||||
"-display": "none",
|
||||
"-serial": "file:/srv/lab/hv1/console.log",
|
||||
"-qmp": "unix:/srv/lab/hv1/qmp.sock,server=on,wait=off",
|
||||
"-pidfile": "/srv/lab/hv1/qemu.pid",
|
||||
} {
|
||||
if !hasValue(hv.QEMU, flag, want) {
|
||||
t.Errorf("%s %s missing from %v", flag, want, hv.QEMU)
|
||||
}
|
||||
}
|
||||
for _, want := range []string{
|
||||
"file=/srv/lab/hv1/disk.qcow2,if=virtio,format=qcow2",
|
||||
"file=/srv/lab/hv1/seed.iso,media=cdrom,readonly=on",
|
||||
} {
|
||||
if !hasValue(hv.QEMU, "-drive", want) {
|
||||
t.Errorf("-drive %s missing", want)
|
||||
}
|
||||
}
|
||||
if hv.Dir != "/srv/lab/hv1" {
|
||||
t.Errorf("Dir = %s", hv.Dir)
|
||||
}
|
||||
nodefaults := 0
|
||||
for _, a := range hv.QEMU {
|
||||
if a == "-nodefaults" {
|
||||
nodefaults++
|
||||
}
|
||||
}
|
||||
if nodefaults != 1 {
|
||||
t.Errorf("-nodefaults appears %d times", nodefaults)
|
||||
}
|
||||
}
|
||||
|
||||
func TestQEMU_HypervisorNetwork(t *testing.T) {
|
||||
hv := nodeNamed(t, renderAll(t, twoHypervisors), "hv1")
|
||||
wantNetdevs := []string{
|
||||
"user,id=mgmt0,restrict=on,ipv6=off,hostfwd=tcp:127.0.0.1:2202-:22",
|
||||
"dgram,id=underlay,local.type=inet,local.host=127.0.0.1,local.port=20002,remote.type=inet,remote.host=127.0.0.1,remote.port=20003",
|
||||
}
|
||||
wantDevices := []string{
|
||||
"virtio-net-pci,netdev=mgmt0,mac=02:4d:00:02:00:00,romfile=",
|
||||
"virtio-net-pci,netdev=underlay,mac=02:4c:00:02:00:00,host_mtu=9000,romfile=",
|
||||
}
|
||||
if got := value(t, hv.QEMU, "-netdev"); !reflect.DeepEqual(got, wantNetdevs) {
|
||||
t.Errorf("netdevs = %v\nwant %v", got, wantNetdevs)
|
||||
}
|
||||
if got := value(t, hv.QEMU, "-device"); !reflect.DeepEqual(got, wantDevices) {
|
||||
t.Errorf("devices = %v\nwant %v", got, wantDevices)
|
||||
}
|
||||
}
|
||||
|
||||
func TestQEMU_SwitchNetwork(t *testing.T) {
|
||||
sw := nodeNamed(t, renderAll(t, twoHypervisors), "sw1")
|
||||
wantNetdevs := []string{
|
||||
"user,id=mgmt0,restrict=off,ipv6=off,hostfwd=tcp:127.0.0.1:2200-:22",
|
||||
"dgram,id=p0,local.type=inet,local.host=127.0.0.1,local.port=20001,remote.type=inet,remote.host=127.0.0.1,remote.port=20000",
|
||||
"dgram,id=p1,local.type=inet,local.host=127.0.0.1,local.port=20003,remote.type=inet,remote.host=127.0.0.1,remote.port=20002",
|
||||
"dgram,id=p2,local.type=inet,local.host=127.0.0.1,local.port=20005,remote.type=inet,remote.host=127.0.0.1,remote.port=20004",
|
||||
}
|
||||
if got := value(t, sw.QEMU, "-netdev"); !reflect.DeepEqual(got, wantNetdevs) {
|
||||
t.Errorf("netdevs = %v\nwant %v", got, wantNetdevs)
|
||||
}
|
||||
if !hasValue(sw.QEMU, "-device", "virtio-net-pci,netdev=p2,mac=02:4c:00:03:00:01,host_mtu=9000,romfile=") {
|
||||
t.Errorf("p2 device missing: %v", sw.QEMU)
|
||||
}
|
||||
}
|
||||
|
||||
func TestQEMU_OnlyTheSwitchReachesTheOutsideThroughAdministration(t *testing.T) {
|
||||
for name, n := range renderAll(t, twoHypervisors) {
|
||||
admin := value(t, n.QEMU, "-netdev")[0]
|
||||
wantRestrict := "restrict=on"
|
||||
if name == "sw1" {
|
||||
wantRestrict = "restrict=off"
|
||||
}
|
||||
if !strings.Contains(admin, ","+wantRestrict+",") {
|
||||
t.Errorf("%s admin netdev %q, want %s", name, admin, wantRestrict)
|
||||
}
|
||||
if !strings.Contains(admin, "hostfwd=tcp:127.0.0.1:") {
|
||||
t.Errorf("%s ssh forward not bound to loopback: %q", name, admin)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestQEMU_EveryCableEndsMatch(t *testing.T) {
|
||||
ends := map[string]int{}
|
||||
for _, n := range renderAll(t, twoHypervisors) {
|
||||
for _, nd := range value(t, n.QEMU, "-netdev") {
|
||||
if !strings.HasPrefix(nd, "dgram,") {
|
||||
continue
|
||||
}
|
||||
var local, remote string
|
||||
for _, kv := range strings.Split(nd, ",") {
|
||||
if v, ok := strings.CutPrefix(kv, "local.port="); ok {
|
||||
local = v
|
||||
}
|
||||
if v, ok := strings.CutPrefix(kv, "remote.port="); ok {
|
||||
remote = v
|
||||
}
|
||||
}
|
||||
ends[local+">"+remote]++
|
||||
}
|
||||
}
|
||||
for pair, count := range ends {
|
||||
local, remote, _ := strings.Cut(pair, ">")
|
||||
if count != 1 || ends[remote+">"+local] != 1 {
|
||||
t.Errorf("cable end %s has no single matching end", pair)
|
||||
}
|
||||
}
|
||||
if len(ends) != 6 {
|
||||
t.Errorf("%d cable ends, want 6", len(ends))
|
||||
}
|
||||
}
|
||||
|
||||
func TestNetworkConfig_Hypervisor(t *testing.T) {
|
||||
doc := network(t, nodeNamed(t, renderAll(t, twoHypervisors), "hv1"))
|
||||
if doc.Version != 2 || len(doc.Ethernets) != 2 {
|
||||
t.Fatalf("network-config = %+v", doc)
|
||||
}
|
||||
admin := iface(t, doc, "mgmt0")
|
||||
if admin.Match.MACAddress != "02:4d:00:02:00:00" || admin.SetName != "mgmt0" ||
|
||||
!reflect.DeepEqual(admin.Addresses, []string{"10.0.2.15/24"}) || len(admin.Routes) != 0 || admin.Nameservers != nil {
|
||||
t.Errorf("mgmt0 = %+v", admin)
|
||||
}
|
||||
under := iface(t, doc, "underlay")
|
||||
if under.Match.MACAddress != "02:4c:00:02:00:00" || under.SetName != "underlay" || under.MTU != 9000 ||
|
||||
!reflect.DeepEqual(under.Addresses, []string{"10.250.0.3/24"}) {
|
||||
t.Errorf("underlay = %+v", under)
|
||||
}
|
||||
if !reflect.DeepEqual(under.Routes, []route{{To: "0.0.0.0/0", Via: "10.250.0.1"}}) {
|
||||
t.Errorf("underlay routes = %+v", under.Routes)
|
||||
}
|
||||
if under.Nameservers == nil || !reflect.DeepEqual(under.Nameservers.Addresses, []string{"1.1.1.1", "8.8.8.8"}) {
|
||||
t.Errorf("underlay nameservers = %+v", under.Nameservers)
|
||||
}
|
||||
}
|
||||
|
||||
func TestNetworkConfig_DHCPIsExplicitlyOffEverywhere(t *testing.T) {
|
||||
for name, n := range renderAll(t, twoHypervisors) {
|
||||
if c := strings.Count(string(n.NetworkConfig), "dhcp4: false"); c != len(network(t, n).Ethernets) {
|
||||
t.Errorf("%s: %d explicit dhcp4: false for %d interfaces", name, c, len(network(t, n).Ethernets))
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestNetworkConfig_Switch(t *testing.T) {
|
||||
doc := network(t, nodeNamed(t, renderAll(t, twoHypervisors), "sw1"))
|
||||
admin := iface(t, doc, "mgmt0")
|
||||
if !reflect.DeepEqual(admin.Routes, []route{{To: "0.0.0.0/0", Via: "10.0.2.2"}}) ||
|
||||
admin.Nameservers == nil || !reflect.DeepEqual(admin.Nameservers.Addresses, []string{"10.0.2.3"}) {
|
||||
t.Errorf("switch mgmt0 = %+v", admin)
|
||||
}
|
||||
for port, mac := range map[string]string{"p0": "02:4c:00:01:00:01", "p1": "02:4c:00:02:00:01", "p2": "02:4c:00:03:00:01"} {
|
||||
e := iface(t, doc, port)
|
||||
if e.Match.MACAddress != mac || e.SetName != port || e.MTU != 9000 || len(e.Addresses) != 0 || len(e.Routes) != 0 {
|
||||
t.Errorf("%s = %+v", port, e)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestNetworkConfig_DefaultRouteOnlyOnFirstSegment(t *testing.T) {
|
||||
doc := network(t, nodeNamed(t, renderAll(t, twoSegments), "hv"))
|
||||
red, blue := iface(t, doc, "red"), iface(t, doc, "blue")
|
||||
if !reflect.DeepEqual(red.Routes, []route{{To: "0.0.0.0/0", Via: "10.1.0.1"}}) || red.Nameservers == nil {
|
||||
t.Errorf("red = %+v", red)
|
||||
}
|
||||
if len(blue.Routes) != 0 || blue.Nameservers != nil || blue.MTU != 1500 {
|
||||
t.Errorf("blue = %+v", blue)
|
||||
}
|
||||
}
|
||||
|
||||
func TestUserData_Hypervisor(t *testing.T) {
|
||||
cfg := user(t, nodeNamed(t, renderAll(t, twoHypervisors), "hv1"))
|
||||
if cfg.Hostname != "hv1" || !cfg.DisableRoot || len(cfg.WriteFiles) != 0 || len(cfg.Runcmd) != 0 || len(cfg.Packages) != 0 {
|
||||
t.Errorf("hv1 user-data = %+v", cfg)
|
||||
}
|
||||
if !reflect.DeepEqual(cfg.SSHAuthorizedKeys, []string{labKey}) {
|
||||
t.Errorf("keys = %v", cfg.SSHAuthorizedKeys)
|
||||
}
|
||||
}
|
||||
|
||||
func TestUserData_PasswordLoginIsExplicitlyOff(t *testing.T) {
|
||||
for name, n := range renderAll(t, twoHypervisors) {
|
||||
if !strings.Contains(string(n.UserData), "\nssh_pwauth: false\n") || !strings.Contains(string(n.UserData), "\ndisable_root: true\n") {
|
||||
t.Errorf("%s user-data:\n%s", name, n.UserData)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestUserData_SwitchBuildsBridgeGatewayAndNAT(t *testing.T) {
|
||||
cfg := user(t, nodeNamed(t, renderAll(t, twoHypervisors), "sw1"))
|
||||
if !reflect.DeepEqual(cfg.Packages, []string{"nftables"}) {
|
||||
t.Errorf("packages = %v", cfg.Packages)
|
||||
}
|
||||
script := fileAt(t, cfg, "/usr/local/sbin/lab-switch")
|
||||
if script.Permissions != "0755" {
|
||||
t.Errorf("script permissions = %s", script.Permissions)
|
||||
}
|
||||
wantScript := `#!/bin/sh
|
||||
set -eu
|
||||
sysctl -qw net.ipv4.ip_forward=1
|
||||
ip link add br-underlay type bridge stp_state 0 2>/dev/null || true
|
||||
ip link set dev p0 master br-underlay
|
||||
ip link set dev p0 up
|
||||
ip link set dev p1 master br-underlay
|
||||
ip link set dev p1 up
|
||||
ip link set dev p2 master br-underlay
|
||||
ip link set dev p2 up
|
||||
ip link set dev br-underlay mtu 9000
|
||||
ip addr replace 10.250.0.1/24 dev br-underlay
|
||||
ip link set dev br-underlay up
|
||||
nft -f /etc/lab-switch.nft
|
||||
`
|
||||
if script.Content != wantScript {
|
||||
t.Errorf("script:\n%s\nwant:\n%s", script.Content, wantScript)
|
||||
}
|
||||
nft := fileAt(t, cfg, "/etc/lab-switch.nft").Content
|
||||
for _, want := range []string{
|
||||
"add table ip lab_nat\ndelete table ip lab_nat\n",
|
||||
"type nat hook postrouting priority srcnat;",
|
||||
`ip saddr { 10.250.0.0/24 } oifname "mgmt0" masquerade`,
|
||||
} {
|
||||
if !strings.Contains(nft, want) {
|
||||
t.Errorf("nft rules miss %q:\n%s", want, nft)
|
||||
}
|
||||
}
|
||||
unit := fileAt(t, cfg, "/etc/systemd/system/lab-switch.service").Content
|
||||
for _, want := range []string{"Type=oneshot", "RemainAfterExit=yes", "ExecStart=/usr/local/sbin/lab-switch", "After=network-online.target", "WantedBy=multi-user.target"} {
|
||||
if !strings.Contains(unit, want) {
|
||||
t.Errorf("unit misses %q", want)
|
||||
}
|
||||
}
|
||||
if !reflect.DeepEqual(cfg.Runcmd, [][]string{{"systemctl", "daemon-reload"}, {"systemctl", "enable", "--now", "lab-switch.service"}}) {
|
||||
t.Errorf("runcmd = %v", cfg.Runcmd)
|
||||
}
|
||||
}
|
||||
|
||||
func TestUserData_SwitchWithTwoSegments(t *testing.T) {
|
||||
cfg := user(t, nodeNamed(t, renderAll(t, twoSegments), "sw"))
|
||||
script := fileAt(t, cfg, "/usr/local/sbin/lab-switch").Content
|
||||
for _, want := range []string{
|
||||
"ip link set dev p0 master br-red\n",
|
||||
"ip link set dev p1 master br-blue\n",
|
||||
"ip link set dev br-blue mtu 1500\n",
|
||||
"ip addr replace 10.2.0.1/24 dev br-blue\n",
|
||||
} {
|
||||
if !strings.Contains(script, want) {
|
||||
t.Errorf("script misses %q:\n%s", want, script)
|
||||
}
|
||||
}
|
||||
if strings.Contains(script, "p1 master br-red") || strings.Contains(script, "p0 master br-blue") {
|
||||
t.Errorf("port bridged on the wrong segment:\n%s", script)
|
||||
}
|
||||
if nft := fileAt(t, cfg, "/etc/lab-switch.nft").Content; !strings.Contains(nft, "ip saddr { 10.1.0.0/24, 10.2.0.0/24 }") {
|
||||
t.Errorf("nft:\n%s", nft)
|
||||
}
|
||||
}
|
||||
|
||||
func TestMetaData(t *testing.T) {
|
||||
var doc metaDoc
|
||||
if err := yaml.Unmarshal(nodeNamed(t, renderAll(t, twoHypervisors), "hv2").MetaData, &doc); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if doc.InstanceID != "evpn-2hv-hv2" || doc.LocalHostname != "hv2" {
|
||||
t.Errorf("meta-data = %+v", doc)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRender_AdminMacsAreUniqueAndApartFromCableMacs(t *testing.T) {
|
||||
seen := map[string]string{}
|
||||
for name, n := range renderAll(t, twoHypervisors) {
|
||||
for _, d := range value(t, n.QEMU, "-device") {
|
||||
for _, kv := range strings.Split(d, ",") {
|
||||
if mac, ok := strings.CutPrefix(kv, "mac="); ok {
|
||||
if other, dup := seen[mac]; dup {
|
||||
t.Errorf("mac %s used by %s and %s", mac, other, name)
|
||||
}
|
||||
seen[mac] = name
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
if len(seen) != 10 {
|
||||
t.Errorf("%d distinct macs, want 10", len(seen))
|
||||
}
|
||||
}
|
||||
|
||||
func TestRender_IsStable(t *testing.T) {
|
||||
first := renderAll(t, twoHypervisors)
|
||||
for i := 0; i < 20; i++ {
|
||||
if again := renderAll(t, twoHypervisors); !reflect.DeepEqual(first, again) {
|
||||
t.Fatalf("render differs on run %d", i)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestRender_RejectsBadOptions(t *testing.T) {
|
||||
p := plan(t, twoHypervisors)
|
||||
cases := []struct {
|
||||
name string
|
||||
opts Options
|
||||
want string
|
||||
}{
|
||||
{"relative run dir", Options{RunDir: "lab", AuthorizedKeys: []string{labKey}}, `run dir "lab" must be an absolute path`},
|
||||
{"no key", Options{RunDir: "/srv/lab"}, "at least one authorized ssh key"},
|
||||
{"multi-line key", Options{RunDir: "/srv/lab", AuthorizedKeys: []string{labKey + "\nssh-rsa AAAA x"}}, "authorized key 1 spans several lines"},
|
||||
{"not a key", Options{RunDir: "/srv/lab", AuthorizedKeys: []string{"hello world"}}, "authorized key 1 is not an ssh public key"},
|
||||
{"type only", Options{RunDir: "/srv/lab", AuthorizedKeys: []string{"ssh-ed25519"}}, "authorized key 1 is not an ssh public key"},
|
||||
}
|
||||
for _, c := range cases {
|
||||
t.Run(c.name, func(t *testing.T) {
|
||||
_, err := Render(p, c.opts)
|
||||
if err == nil || !strings.Contains(err.Error(), c.want) {
|
||||
t.Fatalf("err = %v, want %q", err, c.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestRender_AcceptsUsualKeyTypes(t *testing.T) {
|
||||
p := plan(t, twoHypervisors)
|
||||
for _, k := range []string{
|
||||
"ssh-rsa AAAAB3NzaC1yc2E user",
|
||||
"ecdsa-sha2-nistp256 AAAAE2VjZHNh user",
|
||||
"sk-ssh-ed25519@openssh.com AAAAGnNr user",
|
||||
} {
|
||||
if _, err := Render(p, Options{RunDir: "/srv/lab", AuthorizedKeys: []string{k}}); err != nil {
|
||||
t.Errorf("%s rejected: %v", strings.Fields(k)[0], err)
|
||||
}
|
||||
}
|
||||
}
|
||||
192
internal/lab/render/seed.go
Normal file
192
internal/lab/render/seed.go
Normal file
|
|
@ -0,0 +1,192 @@
|
|||
package render
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"strings"
|
||||
|
||||
"go.yaml.in/yaml/v3"
|
||||
|
||||
"git.g3e.fr/syonad/two/internal/lab/topology"
|
||||
)
|
||||
|
||||
const (
|
||||
SwitchScript = "/usr/local/sbin/lab-switch"
|
||||
SwitchNFT = "/etc/lab-switch.nft"
|
||||
SwitchUnit = "/etc/systemd/system/lab-switch.service"
|
||||
)
|
||||
|
||||
type metaDoc struct {
|
||||
InstanceID string `yaml:"instance-id"`
|
||||
LocalHostname string `yaml:"local-hostname"`
|
||||
}
|
||||
|
||||
type writeFile struct {
|
||||
Path string `yaml:"path"`
|
||||
Permissions string `yaml:"permissions"`
|
||||
Content string `yaml:"content"`
|
||||
}
|
||||
|
||||
type cloudConfig struct {
|
||||
Hostname string `yaml:"hostname"`
|
||||
SSHPwauth bool `yaml:"ssh_pwauth"`
|
||||
DisableRoot bool `yaml:"disable_root"`
|
||||
SSHAuthorizedKeys []string `yaml:"ssh_authorized_keys"`
|
||||
Packages []string `yaml:"packages,omitempty"`
|
||||
WriteFiles []writeFile `yaml:"write_files,omitempty"`
|
||||
Runcmd [][]string `yaml:"runcmd,omitempty"`
|
||||
}
|
||||
|
||||
type match struct {
|
||||
MACAddress string `yaml:"macaddress"`
|
||||
}
|
||||
|
||||
type route struct {
|
||||
To string `yaml:"to"`
|
||||
Via string `yaml:"via"`
|
||||
}
|
||||
|
||||
type nameservers struct {
|
||||
Addresses []string `yaml:"addresses"`
|
||||
}
|
||||
|
||||
type ethernet struct {
|
||||
Match match `yaml:"match"`
|
||||
SetName string `yaml:"set-name"`
|
||||
DHCP4 bool `yaml:"dhcp4"`
|
||||
MTU int `yaml:"mtu,omitempty"`
|
||||
Addresses []string `yaml:"addresses,omitempty"`
|
||||
Routes []route `yaml:"routes,omitempty"`
|
||||
Nameservers *nameservers `yaml:"nameservers,omitempty"`
|
||||
}
|
||||
|
||||
type networkDoc struct {
|
||||
Version int `yaml:"version"`
|
||||
Ethernets map[string]ethernet `yaml:"ethernets"`
|
||||
}
|
||||
|
||||
func metaData(p *topology.Plan, n topology.NodePlan) ([]byte, error) {
|
||||
return yaml.Marshal(metaDoc{InstanceID: p.Name + "-" + n.Name, LocalHostname: n.Name})
|
||||
}
|
||||
|
||||
func userData(p *topology.Plan, n topology.NodePlan, keys []string) ([]byte, error) {
|
||||
cfg := cloudConfig{
|
||||
Hostname: n.Name,
|
||||
SSHPwauth: false,
|
||||
DisableRoot: true,
|
||||
SSHAuthorizedKeys: keys,
|
||||
}
|
||||
if n.Role == topology.RoleSwitch {
|
||||
cfg.Packages = []string{"nftables"}
|
||||
cfg.WriteFiles = []writeFile{
|
||||
{Path: SwitchScript, Permissions: "0755", Content: switchScript(p, n.Name)},
|
||||
{Path: SwitchNFT, Permissions: "0644", Content: switchNFT(p, n.Name)},
|
||||
{Path: SwitchUnit, Permissions: "0644", Content: switchUnit()},
|
||||
}
|
||||
cfg.Runcmd = [][]string{
|
||||
{"systemctl", "daemon-reload"},
|
||||
{"systemctl", "enable", "--now", "lab-switch.service"},
|
||||
}
|
||||
}
|
||||
body, err := yaml.Marshal(cfg)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return append([]byte("#cloud-config\n"), body...), nil
|
||||
}
|
||||
|
||||
func networkConfig(p *topology.Plan, n topology.NodePlan, index int) ([]byte, error) {
|
||||
doc := networkDoc{Version: 2, Ethernets: map[string]ethernet{}}
|
||||
admin := ethernet{
|
||||
Match: match{MACAddress: adminMAC(index).String()},
|
||||
SetName: AdminInterface,
|
||||
Addresses: []string{AdminAddress},
|
||||
}
|
||||
if n.Role == topology.RoleSwitch {
|
||||
admin.Routes = []route{{To: "0.0.0.0/0", Via: AdminGateway}}
|
||||
admin.Nameservers = &nameservers{Addresses: []string{AdminDNS}}
|
||||
for _, c := range switchCables(p, n.Name) {
|
||||
doc.Ethernets[c.SwitchInterface] = ethernet{
|
||||
Match: match{MACAddress: c.SwitchMAC.String()},
|
||||
SetName: c.SwitchInterface,
|
||||
MTU: c.MTU,
|
||||
}
|
||||
}
|
||||
}
|
||||
doc.Ethernets[AdminInterface] = admin
|
||||
|
||||
for i, c := range nodeCables(p, n.Name) {
|
||||
e := ethernet{
|
||||
Match: match{MACAddress: c.NodeMAC.String()},
|
||||
SetName: c.NodeInterface,
|
||||
MTU: c.MTU,
|
||||
Addresses: []string{c.NodeAddress.String()},
|
||||
}
|
||||
if i == 0 {
|
||||
e.Routes = []route{{To: "0.0.0.0/0", Via: gatewayOf(p, c.Segment)}}
|
||||
e.Nameservers = &nameservers{Addresses: Nameservers}
|
||||
}
|
||||
doc.Ethernets[c.NodeInterface] = e
|
||||
}
|
||||
return yaml.Marshal(doc)
|
||||
}
|
||||
|
||||
func gatewayOf(p *topology.Plan, segment string) string {
|
||||
for _, s := range p.Segments {
|
||||
if s.Name == segment {
|
||||
return s.Gateway.String()
|
||||
}
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
func switchScript(p *topology.Plan, name string) string {
|
||||
var b strings.Builder
|
||||
b.WriteString("#!/bin/sh\nset -eu\nsysctl -qw net.ipv4.ip_forward=1\n")
|
||||
for _, s := range switchSegments(p, name) {
|
||||
fmt.Fprintf(&b, "ip link add %s type bridge stp_state 0 2>/dev/null || true\n", s.Bridge)
|
||||
for _, c := range switchCables(p, name) {
|
||||
if c.Segment != s.Name {
|
||||
continue
|
||||
}
|
||||
fmt.Fprintf(&b, "ip link set dev %s master %s\n", c.SwitchInterface, s.Bridge)
|
||||
fmt.Fprintf(&b, "ip link set dev %s up\n", c.SwitchInterface)
|
||||
}
|
||||
fmt.Fprintf(&b, "ip link set dev %s mtu %d\n", s.Bridge, s.MTU)
|
||||
fmt.Fprintf(&b, "ip addr replace %s/%d dev %s\n", s.Gateway, s.Network.Bits(), s.Bridge)
|
||||
fmt.Fprintf(&b, "ip link set dev %s up\n", s.Bridge)
|
||||
}
|
||||
fmt.Fprintf(&b, "nft -f %s\n", SwitchNFT)
|
||||
return b.String()
|
||||
}
|
||||
|
||||
func switchNFT(p *topology.Plan, name string) string {
|
||||
var networks []string
|
||||
for _, s := range switchSegments(p, name) {
|
||||
networks = append(networks, s.Network.String())
|
||||
}
|
||||
return fmt.Sprintf(`add table ip lab_nat
|
||||
delete table ip lab_nat
|
||||
table ip lab_nat {
|
||||
chain postrouting {
|
||||
type nat hook postrouting priority srcnat; policy accept;
|
||||
ip saddr { %s } oifname "%s" masquerade
|
||||
}
|
||||
}
|
||||
`, strings.Join(networks, ", "), AdminInterface)
|
||||
}
|
||||
|
||||
func switchUnit() string {
|
||||
return fmt.Sprintf(`[Unit]
|
||||
Description=Lab switch: bridges, gateways and NAT
|
||||
Wants=network-online.target
|
||||
After=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
RemainAfterExit=yes
|
||||
ExecStart=%s
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
`, SwitchScript)
|
||||
}
|
||||
|
|
@ -133,6 +133,7 @@ func TestValidate_Rejections(t *testing.T) {
|
|||
{"segment switch unknown", strings.Replace(valid, "switch: sw, cidr", "switch: ghost, cidr", 1), "switch ghost is not a declared node"},
|
||||
{"segment switch not a switch", strings.Replace(valid, "switch: sw, cidr", "switch: rr, cidr", 1), "rr is a rr, not a switch"},
|
||||
{"segment name too long", strings.ReplaceAll(valid, "under", "underlayunder"), "segment underlayunder: name must match"},
|
||||
{"segment named like the admin interface", strings.ReplaceAll(valid, "under", "mgmt0"), "segment mgmt0: name is reserved"},
|
||||
{"segment name with dash", strings.ReplaceAll(valid, "under", "un-der"), "segment un-der: name must match"},
|
||||
{"mtu too high", strings.Replace(valid, "cidr: 10.0.0.0/24", "cidr: 10.0.0.0/24, mtu: 9001", 1), "mtu 9001 out of range"},
|
||||
{"mtu too low", strings.Replace(valid, "cidr: 10.0.0.0/24", "cidr: 10.0.0.0/24, mtu: 1279", 1), "mtu 1279 out of range"},
|
||||
|
|
|
|||
|
|
@ -15,6 +15,8 @@ const (
|
|||
MinMemory = 256
|
||||
MaxPrefix = 30
|
||||
MinPrefix = 8
|
||||
|
||||
ReservedInterface = "mgmt0"
|
||||
)
|
||||
|
||||
var (
|
||||
|
|
@ -63,6 +65,9 @@ func (t *Topology) Validate() error {
|
|||
if !segmentPattern.MatchString(s.Name) {
|
||||
add("segment %s: name must match %s", s.Name, segmentPattern)
|
||||
}
|
||||
if s.Name == ReservedInterface {
|
||||
add("segment %s: name is reserved for the administration interface", s.Name)
|
||||
}
|
||||
sw, ok := nodes[s.Switch]
|
||||
switch {
|
||||
case s.Switch == "":
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue