diff --git a/heartbeat/gcp-vpc-move-ip.in b/heartbeat/gcp-vpc-move-ip.in index 4a6c343a8..3b8d998b3 100755 --- a/heartbeat/gcp-vpc-move-ip.in +++ b/heartbeat/gcp-vpc-move-ip.in @@ -1,372 +1,374 @@ #!@BASH_SHELL@ # # # OCF resource agent to move an IP address within a VPC in GCP # # License: GNU General Public License (GPL) # Copyright (c) 2018 Hervé Werner (MFG Labs) # Based on code from Markus Guertler (aws-vpc-move-ip) # All Rights Reserved. # # This program is free software; you can redistribute it and/or modify # it under the terms of version 2 of the GNU General Public License as # published by the Free Software Foundation. # # This program is distributed in the hope that it would be useful, but # WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. # # Further, this software is distributed without any warranty that it is # free of the rightful claim of any third person regarding infringement # or the like. Any license provided herein, whether implied or # otherwise, applies only to this software file. Patent licenses, if # any, provided herein do not apply to combinations of this program with # other software, or any other product whatsoever. # # You should have received a copy of the GNU General Public License # along with this program; if not, write the Free Software Foundation, # Inc., 59 Temple Place - Suite 330, Boston MA 02111-1307, USA. # ####################################################################### # Initialization: : ${OCF_FUNCTIONS_DIR=${OCF_ROOT}/lib/heartbeat} . ${OCF_FUNCTIONS_DIR}/ocf-shellfuncs # Defaults OCF_RESKEY_gcloud_default="/usr/bin/gcloud" OCF_RESKEY_configuration_default="default" OCF_RESKEY_vpc_network_default="default" OCF_RESKEY_interface_default="eth0" OCF_RESKEY_route_name_default="ra-${__SCRIPT_NAME}" : ${OCF_RESKEY_gcloud=${OCF_RESKEY_gcloud_default}} : ${OCF_RESKEY_configuration=${OCF_RESKEY_configuration_default}} : ${OCF_RESKEY_vpc_network=${OCF_RESKEY_vpc_network_default}} : ${OCF_RESKEY_interface=${OCF_RESKEY_interface_default}} : ${OCF_RESKEY_route_name=${OCF_RESKEY_route_name_default}} gcp_api_url_prefix="https://www.googleapis.com/compute/v1" gcloud="${OCF_RESKEY_gcloud} --quiet --configuration=${OCF_RESKEY_configuration}" ####################################################################### USAGE="usage: $0 {start|stop|monitor|status|meta-data|validate-all}"; ############################################################################### ############################################################################### # # Functions # ############################################################################### metadata() { cat < 1.0 Resource Agent that can move a floating IP addresse within a GCP VPC by changing an entry in the routing table. This agent also configures the floating IP locally on the instance OS. Requirements : - IP forwarding must be enabled on all instances in order to be able to terminate the route - The floating IP address must be choosen so that it is outside all existing subnets in the VPC network - IAM permissions (see https://cloud.google.com/compute/docs/access/iam-permissions) : 1) compute.routes.delete, compute.routes.get and compute.routes.update on the route 2) compute.networks.updatePolicy on the network (to add a new route) 3) compute.networks.get on the network (to check the VPC network existence) 4) compute.routes.list on the project (to check conflicting routes) Move IP within a GCP VPC Path to command line tools for GCP Path to the gcloud tool Named configuration for gcloud Named gcloud configuration Floating IP address. Note that this IP must be chosen outside of all existing subnet ranges Floating IP Name of the VPC network VPC network Name of the network interface Network interface name Route name Route name END } validate() { if ! ocf_is_root; then ocf_exit_reason "You must run this agent as root" exit $OCF_ERR_PERM fi for cmd in ${OCF_RESKEY_gcloud} ip curl; do check_binary "$cmd" done if [ -z "${OCF_RESKEY_ip}" ]; then ocf_exit_reason "Missing mandatory parameter" exit $OCF_ERR_CONFIGURED fi GCE_INSTANCE_NAME=$(curl -s -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/name") GCE_INSTANCE_ZONE=$(curl -s -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/zone" | awk -F '/' '{ print $NF }') GCE_INSTANCE_PROJECT=$(curl -s -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/project/project-id") if [ -z "${GCE_INSTANCE_NAME}" -o -z "${GCE_INSTANCE_ZONE}" -o -z "${GCE_INSTANCE_PROJECT}" ]; then ocf_exit_reason "Instance information not found. Is this a GCE instance ?" exit $OCF_ERR_GENERIC fi if ! ${OCF_RESKEY_gcloud} config configurations describe ${OCF_RESKEY_configuration} &>/dev/null; then ocf_exit_reason "Gcloud configuration not found" exit $OCF_ERR_CONFIGURED fi if ! ip link show ${OCF_RESKEY_interface} &> /dev/null; then ocf_exit_reason "Network interface not found" exit $OCF_ERR_CONFIGURED fi return $OCF_SUCCESS } check_conflicting_routes() { cmd="${gcloud} compute routes list \ --filter='destRange:${OCF_RESKEY_ip} AND \ network=(${gcp_api_url_prefix}/projects/${GCE_INSTANCE_PROJECT}/global/networks/${OCF_RESKEY_vpc_network}) AND \ NOT name=${OCF_RESKEY_route_name}' \ --format='value[terminator=\" \"](name)'" ocf_log debug "Executing command: $(echo $cmd)" route_list=$(eval ${cmd}) if [ $? -ne 0 ]; then exit $OCF_ERR_GENERIC fi if [ -n "${route_list}" ]; then ocf_exit_reason "Conflicting unnmanaged routes for destination ${OCF_RESKEY_ip}/32 in VPC ${OCF_RESKEY_vpc_network} found : ${route_list}" exit $OCF_ERR_CONFIGURED fi return $OCF_SUCCESS } route_monitor() { ocf_log info "GCP route monitor: checking route table" # Ensure that there is no route that we are not aware of that is also handling our IP check_conflicting_routes cmd="${gcloud} compute routes describe ${OCF_RESKEY_route_name} --format='get(nextHopInstance)'" ocf_log debug "Executing command: $cmd" # Also redirect stderr as we parse the output to use an appropriate exit code routed_to_instance=$(eval $cmd 2>&1) if [ $? -ne 0 ]; then if echo $routed_to_instance | grep -qi "Insufficient Permission" ; then ocf_exit_reason "Insufficient permissions to get route information" exit $OCF_ERR_PERM elif echo $routed_to_instance | grep -qi "Could not fetch resource"; then ocf_log debug "The route ${OCF_RESKEY_route_name} doesn't exist" return $OCF_NOT_RUNNING else ocf_exit_reason "Error : ${routed_to_instance}" exit $OCF_ERR_GENERIC fi fi if [ -z "${routed_to_instance}" ]; then routed_to_instance="" fi if [ "${routed_to_instance}" != "${gcp_api_url_prefix}/projects/${GCE_INSTANCE_PROJECT}/zones/${GCE_INSTANCE_ZONE}/instances/${GCE_INSTANCE_NAME}" ]; then ocf_log warn "The floating IP ${OCF_RESKEY_ip} is not routed to this instance (${GCE_INSTANCE_NAME}) but to instance ${routed_to_instance##*/}" return $OCF_NOT_RUNNING fi ocf_log debug "The floating IP ${OCF_RESKEY_ip} is correctly routed to this instance (${GCE_INSTANCE_NAME})" return $OCF_SUCCESS } ip_monitor() { ocf_log info "IP monitor: checking local network configuration" cmd="ip address show dev ${OCF_RESKEY_interface} to ${OCF_RESKEY_ip}/32" ocf_log debug "Executing command: $cmd" if [ -z "$($cmd)" ]; then ocf_log warn "The floating IP ${OCF_RESKEY_ip} is not locally configured on this instance (${GCE_INSTANCE_NAME})" return $OCF_NOT_RUNNING fi ocf_log debug "The floating IP ${OCF_RESKEY_ip} is correctly configured on this instance (${GCE_INSTANCE_NAME})" return $OCF_SUCCESS } ip_release() { cmd="ip address delete ${OCF_RESKEY_ip}/32 dev ${OCF_RESKEY_interface}" ocf_log debug "Executing command: $cmd" ocf_run $cmd || return $OCF_ERR_GENERIC return $OCF_SUCCESS } route_release() { cmd="${gcloud} compute routes delete ${OCF_RESKEY_route_name}" ocf_log debug "Executing command: $cmd" ocf_run $cmd || return $OCF_ERR_GENERIC return $OCF_SUCCESS } ip_and_route_start() { ocf_log info "Bringing up the floating IP ${OCF_RESKEY_ip}" # Add a new entry in the routing table # If the route entry exists and is pointing to another instance, take it over # Ensure that there is no route that we are not aware of that is also handling our IP check_conflicting_routes # There is no replace API, We need to first delete the existing route if any if ${gcloud} compute routes describe ${OCF_RESKEY_route_name} &>/dev/null; then route_release fi cmd="${gcloud} compute routes create ${OCF_RESKEY_route_name} \ --network=${OCF_RESKEY_vpc_network} --destination-range=${OCF_RESKEY_ip}/32 \ --next-hop-instance-zone=${GCE_INSTANCE_ZONE} --next-hop-instance=${GCE_INSTANCE_NAME}" ocf_log debug "Executing command: $(echo $cmd)" ocf_run $cmd if [ $? -ne $OCF_SUCCESS ]; then if ! ${gcloud} compute networks describe ${OCF_RESKEY_vpc_network} &>/dev/null; then ocf_exit_reason "VPC network not found" exit $OCF_ERR_CONFIGURED else return $OCF_ERR_GENERIC fi fi # Configure the IP address locally # We need to release the IP first ip_monitor &>/dev/null if [ $? -eq $OCF_SUCCESS ]; then ip_release fi cmd="ip address add ${OCF_RESKEY_ip}/32 dev ${OCF_RESKEY_interface}" ocf_log debug "Executing command: $cmd" ocf_run $cmd || return $OCF_ERR_GENERIC cmd="ip link set ${OCF_RESKEY_interface} up" ocf_log debug "Executing command: $cmd" ocf_run $cmd || return $OCF_ERR_GENERIC ocf_log info "Successfully brought up the floating IP ${OCF_RESKEY_ip}" return $OCF_SUCCESS } ip_and_route_stop() { ocf_log info "Bringing down the floating IP ${OCF_RESKEY_ip}" # Delete the route entry # If the route entry exists and is pointing to another instance, don't touch it route_monitor &>/dev/null if [ $? -eq $OCF_NOT_RUNNING ]; then ocf_log info "The floating IP ${OCF_RESKEY_ip} is already not routed to this instance (${GCE_INSTANCE_NAME})" else route_release fi # Delete the local IP address ip_monitor &>/dev/null if [ $? -eq $OCF_NOT_RUNNING ]; then ocf_log info "The floating IP ${OCF_RESKEY_ip} is already down" else ip_release fi ocf_log info "Successfully brought down the floating IP ${OCF_RESKEY_ip}" return $OCF_SUCCESS } ############################################################################### # # MAIN # ############################################################################### +ocf_log warn "gcp-vpc-move-ip is deprecated, prefer to use gcp-vpc-move-route instead" + case $__OCF_ACTION in meta-data) metadata exit $OCF_SUCCESS ;; usage|help) echo $USAGE exit $OCF_SUCCESS ;; esac validate || exit $? case $__OCF_ACTION in start) ip_and_route_start;; stop) ip_and_route_stop;; monitor|status) route_monitor || exit $? ip_monitor || exit $? ;; validate-all) ;; *) echo $USAGE exit $OCF_ERR_UNIMPLEMENTED ;; esac