Merge pull request #435 from cloudnull/Issue434
Creates a lxc-system-manage script for common operational tasks.
This commit is contained in:
Hugh Saunders
commit
82e65abbba
348
rpc_deployment/roles/lxc_common/files/lxc-system-manage
Normal file
348
rpc_deployment/roles/lxc_common/files/lxc-system-manage
Normal file
@ -0,0 +1,348 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
# Copyright 2014, Rackspace US, Inc.
|
||||||
|
#
|
||||||
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
# you may not use this file except in compliance with the License.
|
||||||
|
# You may obtain a copy of the License at
|
||||||
|
#
|
||||||
|
# http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
#
|
||||||
|
# Unless required by applicable law or agreed to in writing, software
|
||||||
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
# See the License for the specific language governing permissions and
|
||||||
|
# limitations under the License.
|
||||||
|
|
||||||
|
# This sciprt was built for the express purpose of managing LXC on a
|
||||||
|
# host. The functions within this script provide for common operations
|
||||||
|
# that may be required when working with LXC in production.
|
||||||
|
|
||||||
|
export USE_LXC_BRIDGE="true"
|
||||||
|
export LXC_BRIDGE="lxcbr0"
|
||||||
|
export LXC_ADDR="10.0.3.1"
|
||||||
|
export LXC_NETMASK="255.255.255.0"
|
||||||
|
export LXC_NETWORK="10.0.3.0/24"
|
||||||
|
export LXC_DHCP_RANGE="10.0.3.2,10.0.3.254"
|
||||||
|
export LXC_DHCP_MAX="253"
|
||||||
|
export LXC_DHCP_CONFILE=""
|
||||||
|
export VARRUN="/run/lxc"
|
||||||
|
export LXC_DOMAIN=""
|
||||||
|
|
||||||
|
function warn() {
|
||||||
|
echo -e "\e[0;35m${@}\e[0m"
|
||||||
|
}
|
||||||
|
|
||||||
|
function info() {
|
||||||
|
echo -e "\e[0;33m${@}\e[0m"
|
||||||
|
}
|
||||||
|
|
||||||
|
function success() {
|
||||||
|
echo -e "\e[0;32m${@}\e[0m"
|
||||||
|
}
|
||||||
|
|
||||||
|
function remove_rules() {
|
||||||
|
success "Removing LXC IPtables rules."
|
||||||
|
# Remove rules from the INPUT chain
|
||||||
|
iptables ${USE_IPTABLES_LOCK} -D INPUT -i "${LXC_BRIDGE}" -p udp --dport 67 -j ACCEPT
|
||||||
|
iptables ${USE_IPTABLES_LOCK} -D INPUT -i "${LXC_BRIDGE}" -p tcp --dport 67 -j ACCEPT
|
||||||
|
iptables ${USE_IPTABLES_LOCK} -D INPUT -i "${LXC_BRIDGE}" -p udp --dport 53 -j ACCEPT
|
||||||
|
iptables ${USE_IPTABLES_LOCK} -D INPUT -i "${LXC_BRIDGE}" -p tcp --dport 53 -j ACCEPT
|
||||||
|
|
||||||
|
# Remove rules from the FORWARDING chain
|
||||||
|
iptables ${USE_IPTABLES_LOCK} -D FORWARD -i "${LXC_BRIDGE}" -j ACCEPT
|
||||||
|
iptables ${USE_IPTABLES_LOCK} -D FORWARD -o "${LXC_BRIDGE}" -j ACCEPT
|
||||||
|
|
||||||
|
# Remove rules from the nat POSTROUTING chain
|
||||||
|
iptables ${USE_IPTABLES_LOCK} -t nat \
|
||||||
|
-D POSTROUTING \
|
||||||
|
-s "${LXC_NETWORK}" ! \
|
||||||
|
-d "${LXC_NETWORK}" \
|
||||||
|
-j MASQUERADE || true
|
||||||
|
|
||||||
|
# Remove rules from the mangle POSTROUTING chain
|
||||||
|
iptables ${USE_IPTABLES_LOCK} -t mangle \
|
||||||
|
-D POSTROUTING \
|
||||||
|
-o "${LXC_BRIDGE}" \
|
||||||
|
-p udp \
|
||||||
|
-m udp \
|
||||||
|
--dport 68 \
|
||||||
|
-j CHECKSUM \
|
||||||
|
--checksum-fill
|
||||||
|
}
|
||||||
|
|
||||||
|
function add_rules() {
|
||||||
|
success "Creating LXC IPtables rules."
|
||||||
|
set -e
|
||||||
|
# Set ip_prwarding
|
||||||
|
sysctl -w net.ipv4.ip_forward=1 > /dev/null 2>&1
|
||||||
|
|
||||||
|
# Add rules from the INPUT chain
|
||||||
|
iptables ${USE_IPTABLES_LOCK} -I INPUT -i "${LXC_BRIDGE}" -p udp --dport 67 -j ACCEPT
|
||||||
|
iptables ${USE_IPTABLES_LOCK} -I INPUT -i "${LXC_BRIDGE}" -p tcp --dport 67 -j ACCEPT
|
||||||
|
iptables ${USE_IPTABLES_LOCK} -I INPUT -i "${LXC_BRIDGE}" -p udp --dport 53 -j ACCEPT
|
||||||
|
iptables ${USE_IPTABLES_LOCK} -I INPUT -i "${LXC_BRIDGE}" -p tcp --dport 53 -j ACCEPT
|
||||||
|
|
||||||
|
# Add rules from the FORWARDING chain
|
||||||
|
iptables ${USE_IPTABLES_LOCK} -I FORWARD -i "${LXC_BRIDGE}" -j ACCEPT
|
||||||
|
iptables ${USE_IPTABLES_LOCK} -I FORWARD -o "${LXC_BRIDGE}" -j ACCEPT
|
||||||
|
|
||||||
|
# Add rules from the nat POSTROUTING chain
|
||||||
|
iptables ${USE_IPTABLES_LOCK} -t nat \
|
||||||
|
-A POSTROUTING \
|
||||||
|
-s "${LXC_NETWORK}" ! \
|
||||||
|
-d "${LXC_NETWORK}" \
|
||||||
|
-j MASQUERADE
|
||||||
|
|
||||||
|
# Add rules from the mangle POSTROUTING chain
|
||||||
|
iptables ${USE_IPTABLES_LOCK} -t mangle \
|
||||||
|
-A POSTROUTING \
|
||||||
|
-o "${LXC_BRIDGE}" \
|
||||||
|
-p udp \
|
||||||
|
-m udp \
|
||||||
|
--dport 68 \
|
||||||
|
-j CHECKSUM \
|
||||||
|
--checksum-fill
|
||||||
|
}
|
||||||
|
|
||||||
|
function cleanup() {
|
||||||
|
# Clean up everything
|
||||||
|
remove_rules
|
||||||
|
|
||||||
|
# Set the lxc bridge interface down
|
||||||
|
ip link set "${LXC_BRIDGE}" down || true
|
||||||
|
|
||||||
|
# Remove the lxc bridge interface
|
||||||
|
brctl delbr "${LXC_BRIDGE}" || true
|
||||||
|
}
|
||||||
|
|
||||||
|
function pre_up() {
|
||||||
|
# Create the run directory if needed.
|
||||||
|
if [[ ! -d "${VARRUN}" ]];then
|
||||||
|
mkdir -p "${VARRUN}"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Source the lxc defaults
|
||||||
|
if [[ -f "/etc/default/lxc" ]]; then
|
||||||
|
source "/etc/default/lxc"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Set the lock type where applicable
|
||||||
|
use_iptables_lock="-w"
|
||||||
|
iptables -w -L -n > /dev/null 2>&1 || use_iptables_lock=""
|
||||||
|
}
|
||||||
|
|
||||||
|
function start_dnsmasq() {
|
||||||
|
set -e
|
||||||
|
success "Starting LXC dnsmasq."
|
||||||
|
dnsmasq "${LXC_DOMAIN_ARG}" -u lxc-dnsmasq \
|
||||||
|
--strict-order \
|
||||||
|
--bind-interfaces \
|
||||||
|
--pid-file="${VARRUN}/dnsmasq.pid" \
|
||||||
|
--conf-file="${LXC_DHCP_CONFILE}" \
|
||||||
|
--listen-address "${LXC_ADDR}" \
|
||||||
|
--dhcp-range "${LXC_DHCP_RANGE}" \
|
||||||
|
--dhcp-lease-max="${LXC_DHCP_MAX}" \
|
||||||
|
--dhcp-no-override \
|
||||||
|
--except-interface="lo" \
|
||||||
|
--interface="${LXC_BRIDGE}" \
|
||||||
|
--dhcp-leasefile="${DHCP_LEASE_FILE}" \
|
||||||
|
--dhcp-authoritative
|
||||||
|
}
|
||||||
|
|
||||||
|
function start_containers_nicely() {
|
||||||
|
set -e
|
||||||
|
# Stop all containers on a host
|
||||||
|
success "Starting all containers."
|
||||||
|
for container in $(lxc-ls); do lxc-start -d -n "${container}"; done
|
||||||
|
}
|
||||||
|
|
||||||
|
function stop_containers_nicely() {
|
||||||
|
# Stop all containers on a host
|
||||||
|
warn "Stopping all containers."
|
||||||
|
for container in $(lxc-ls); do lxc-stop -n "${container}"; done
|
||||||
|
}
|
||||||
|
|
||||||
|
function stop_containers_with_fire() {
|
||||||
|
# Stop all containers on a host
|
||||||
|
warn "Stopping all containers with fire."
|
||||||
|
for container in $(lxc-ls); do lxc-stop -k -n "${container}"; done
|
||||||
|
}
|
||||||
|
|
||||||
|
function start_networks() {
|
||||||
|
set -e
|
||||||
|
success "Building the LXC container network."
|
||||||
|
|
||||||
|
# Create lxc bridge
|
||||||
|
brctl addbr "${LXC_BRIDGE}"
|
||||||
|
|
||||||
|
# Set the lxc bridge up
|
||||||
|
ip link set "${LXC_BRIDGE}" up || true
|
||||||
|
|
||||||
|
# Assign an address to the lxc bridge
|
||||||
|
ip addr add "${LXC_ADDR}"/"${LXC_NETMASK}" dev "${LXC_BRIDGE}"
|
||||||
|
|
||||||
|
add_rules
|
||||||
|
|
||||||
|
LXC_DOMAIN_ARG=""
|
||||||
|
if [ -n "$LXC_DOMAIN" ]; then
|
||||||
|
LXC_DOMAIN_ARG="-s $LXC_DOMAIN -S /$LXC_DOMAIN/"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Start DNS mask
|
||||||
|
DHCP_LEASE_FILE="/var/lib/misc/dnsmasq.${LXC_BRIDGE}.leases"
|
||||||
|
start_dnsmasq
|
||||||
|
}
|
||||||
|
|
||||||
|
function stop_dnsmasq() {
|
||||||
|
if [[ -f "${VARRUN}/dnsmasq.pid" ]];then
|
||||||
|
PID="$(cat ${VARRUN}/dnsmasq.pid)"
|
||||||
|
if [[ "${PID}" ]];then
|
||||||
|
warn "Stopping LXC dnsmasq."
|
||||||
|
kill -9 "${PID}" || true
|
||||||
|
fi
|
||||||
|
rm -f "${VARRUN}/dnsmasq.pid"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
function stop_networks() {
|
||||||
|
warn "Destroying the LXC container network."
|
||||||
|
cleanup
|
||||||
|
stop_dnsmasq
|
||||||
|
}
|
||||||
|
|
||||||
|
function remove_down_veth() {
|
||||||
|
info "Getting a list of all DOWN veth interfaces"
|
||||||
|
VETHPAIRS="$(ip link list | grep veth | grep "state DOWN" | awk '/veth/ {print $2}' | sed 's/\://g')"
|
||||||
|
if [[ "$VETHPAIRS" ]];then
|
||||||
|
warn "Removing all DOWN veth interfaces"
|
||||||
|
for veth in $VETHPAIRS; do ip link delete dev "${veth}"; done
|
||||||
|
else
|
||||||
|
success "No DOWN veth interfaces to remove"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
function flush_cache() {
|
||||||
|
warn "Flushing network cache"
|
||||||
|
ip -s -s neigh flush all
|
||||||
|
}
|
||||||
|
|
||||||
|
# Run through the base app setup
|
||||||
|
pre_up
|
||||||
|
|
||||||
|
# Check function
|
||||||
|
case "$1" in
|
||||||
|
containers-start)
|
||||||
|
start_containers_nicely
|
||||||
|
;;
|
||||||
|
containers-stop)
|
||||||
|
stop_containers_nicely
|
||||||
|
;;
|
||||||
|
containers-force-stop)
|
||||||
|
stop_containers_with_fire
|
||||||
|
;;
|
||||||
|
containers-restart)
|
||||||
|
stop_containers_nicely
|
||||||
|
start_containers_nicely
|
||||||
|
;;
|
||||||
|
containers-force-restart)
|
||||||
|
stop_containers_with_fire
|
||||||
|
start_containers_nicely
|
||||||
|
;;
|
||||||
|
system-tear-down)
|
||||||
|
stop_containers_nicely
|
||||||
|
remove_down_veth
|
||||||
|
stop_networks
|
||||||
|
flush_cache
|
||||||
|
;;
|
||||||
|
system-force-tear-down)
|
||||||
|
stop_containers_with_fire
|
||||||
|
remove_down_veth
|
||||||
|
stop_networks
|
||||||
|
flush_cache
|
||||||
|
;;
|
||||||
|
system-start-up)
|
||||||
|
start_networks
|
||||||
|
start_containers_nicely
|
||||||
|
;;
|
||||||
|
system-rebuild)
|
||||||
|
stop_containers_nicely
|
||||||
|
remove_down_veth
|
||||||
|
stop_networks
|
||||||
|
flush_cache
|
||||||
|
start_networks
|
||||||
|
start_containers_nicely
|
||||||
|
;;
|
||||||
|
system-force-rebuild)
|
||||||
|
stop_containers_with_fire
|
||||||
|
remove_down_veth
|
||||||
|
stop_networks
|
||||||
|
flush_cache
|
||||||
|
start_networks
|
||||||
|
start_containers_nicely
|
||||||
|
;;
|
||||||
|
dnsmasq-start)
|
||||||
|
start_dnsmasq
|
||||||
|
;;
|
||||||
|
dnsmasq-stop)
|
||||||
|
stop_dnsmasq
|
||||||
|
;;
|
||||||
|
dnsmasq-restart)
|
||||||
|
stop_dnsmasq
|
||||||
|
start_dnsmasq
|
||||||
|
;;
|
||||||
|
iptables-create)
|
||||||
|
add_rules
|
||||||
|
;;
|
||||||
|
iptables-remove)
|
||||||
|
remove_rules
|
||||||
|
;;
|
||||||
|
iptables-recreate)
|
||||||
|
remove_rules
|
||||||
|
add_rules
|
||||||
|
;;
|
||||||
|
veth-cleanup)
|
||||||
|
remove_down_veth
|
||||||
|
;;
|
||||||
|
flush-net-cache)
|
||||||
|
flush_cache
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
info 'Management of internal LXC systems and processes:'
|
||||||
|
echo '
|
||||||
|
containers-start Start all containers.
|
||||||
|
containers-stop Stop all containers.
|
||||||
|
containers-restart Stop all containers and then Start them.
|
||||||
|
containers-force-stop Force Stop all containers.
|
||||||
|
containers-force-restart Force Stop all containers and then Start them.
|
||||||
|
system-start-up Start up everything that LXC needs to
|
||||||
|
operate, including the containers, dnsmasq,
|
||||||
|
LXC bridge, and IPtables.
|
||||||
|
system-tear-down Tear down everything LXC on this system.
|
||||||
|
This will remove all all IPtables rules, kill
|
||||||
|
dnsmasq, remove the LXC bridge, stops all
|
||||||
|
containers, removes DOWN veth interfaces,
|
||||||
|
and flushes the net cache.
|
||||||
|
system-force-tear-down Force tear down everything LXC on this system.
|
||||||
|
This will remove all all IPtables rules, kill
|
||||||
|
dnsmasq, remove the LXC bridge, stops all
|
||||||
|
containers, removes DOWN veth interfaces,
|
||||||
|
and flushes the net cache.
|
||||||
|
system-rebuild Rebuild the LXC network, IPtables, dnsmasq,
|
||||||
|
removes DOWN veth interfaces, flushes the
|
||||||
|
net cache, and restarts all conatiners.
|
||||||
|
system-force-rebuild Force rebuild the LXC network, IPtables, dnsmasq,
|
||||||
|
removes DOWN veth interfaces, flushes the
|
||||||
|
net cache, and restarts all conatiners.
|
||||||
|
dnsmasq-start Start the LXC dnsmasq process.
|
||||||
|
dnsmasq-stop Stop the LXC dnsmasq process.
|
||||||
|
dnsmasq-restart Restart the LXC dnsmasq process.
|
||||||
|
iptables-create Create the LXC IPtables rules.
|
||||||
|
iptables-remove Remove the LXC IPtables rules.
|
||||||
|
iptables-recreate Recreate the LXC IPtables rules.
|
||||||
|
veth-cleanup Remove all DOWN veth interfaces from a system.
|
||||||
|
flush-net-cache Flush the hosts network cache. This is usful if
|
||||||
|
IP addresses are being recycled on to containers
|
||||||
|
from other hosts.
|
||||||
|
'
|
||||||
|
;;
|
||||||
|
esac
|
||||||
@ -35,3 +35,11 @@
|
|||||||
|
|
||||||
# Ensure apparmor reindex runs before other things that may fail
|
# Ensure apparmor reindex runs before other things that may fail
|
||||||
- meta: flush_handlers
|
- meta: flush_handlers
|
||||||
|
|
||||||
|
- name: Drop lxc-system-manage script
|
||||||
|
copy:
|
||||||
|
src: "lxc-system-manage"
|
||||||
|
dest: "/usr/local/bin/lxc-system-manage"
|
||||||
|
owner: "root"
|
||||||
|
group: "root"
|
||||||
|
mode: "0755"
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user