diff --git a/ansible/physical-network.yml b/ansible/physical-network.yml index c9e411f11..9cdc4de6d 100644 --- a/ansible/physical-network.yml +++ b/ansible/physical-network.yml @@ -28,6 +28,7 @@ physical_network_display: False # List of supported values for the 'switch_type' variable. supported_switch_types: + - alliedware-plus - arista - cisco-nxos - dellos6 @@ -110,6 +111,22 @@ debug: var: switch_interface_config +- name: Ensure AlliedWare Plus physical switches are configured + hosts: switches_of_type_alliedware-plus:&switches_in_display_mode_False + gather_facts: no + max_fail_percentage: >- + {{ physical_network_max_fail_percentage | + default(kayobe_max_fail_percentage) | + default(100) }} + roles: + - role: ssh-known-host + when: not switch_skip_keyscan | bool + + - role: alliedware-plus-switch + alliedware_plus_switch_config: "{{ switch_config }}" + alliedware_plus_switch_interface_config: "{{ switch_interface_config }}" + alliedware_plus_switch_save: "{{ switch_config_save }}" + - name: Ensure Arista physical switches are configured hosts: switches_of_type_arista:&switches_in_display_mode_False gather_facts: no diff --git a/ansible/roles/alliedware-plus-switch/README.md b/ansible/roles/alliedware-plus-switch/README.md new file mode 100644 index 000000000..4b5290336 --- /dev/null +++ b/ansible/roles/alliedware-plus-switch/README.md @@ -0,0 +1,79 @@ +AlliedWare Plus Switch +====================== + +This role configures AlliedWare Plus switches using the +`alliedtelesis.awplus.awplus_config` Ansible module. It provides a fairly +minimal abstraction of the configuration interface provided by the +`awplus_config` module, allowing for application of arbitrary switch +configuration options. + +Requirements +------------ + +The switches should be configured to allow SSH access. + +The `alliedtelesis.awplus` Ansible collection must be installed. + +Role Variables +-------------- + +`alliedware_plus_switch_config` is a list of configuration lines to apply to +the switch, and defaults to an empty list. + +`alliedware_plus_switch_interface_config` contains interface configuration. It +is a dict mapping switch interface names to configuration dicts, and defaults +to an empty dict. Each dict may contain the following items: + +- `description` - an optional description to apply to the interface. +- `config` - a list of per-interface configuration commands. + +`alliedware_plus_switch_save` controls whether the running configuration is +saved to the startup configuration when they differ, including any previously +unsaved changes. Defaults to `false`. + +Dependencies +------------ + +None + +Example Playbook +---------------- + +The following playbook configures hosts in the `alliedware-plus-switches` +group. It assumes host variables for each switch holding the host and SSH +credentials. + + --- + - name: Ensure AlliedWare Plus switches are configured + hosts: alliedware-plus-switches + gather_facts: no + vars: + ansible_connection: ansible.netcommon.network_cli + ansible_network_os: alliedtelesis.awplus.awplus + roles: + - role: alliedware-plus-switch + alliedware_plus_switch_config: + - "vlan database" + - " vlan 1000,1001 state enable" + alliedware_plus_switch_interface_config: + port1.0.1: + description: server-1 + config: + - "no shutdown" + - "switchport" + - "switchport mode trunk" + - "switchport trunk native vlan 1000" + - "switchport trunk allowed vlan add 1001" + port1.0.2: + description: server-2 + config: + - "no shutdown" + - "switchport" + - "switchport mode trunk" + - "switchport trunk native vlan 1000" + - "switchport trunk allowed vlan add 1001" + +Author Information +------------------ + +- Pierre Riteau () diff --git a/ansible/roles/alliedware-plus-switch/defaults/main.yml b/ansible/roles/alliedware-plus-switch/defaults/main.yml new file mode 100644 index 000000000..3a1e6556c --- /dev/null +++ b/ansible/roles/alliedware-plus-switch/defaults/main.yml @@ -0,0 +1,11 @@ +--- +# List of configuration lines to apply to the switch. +alliedware_plus_switch_config: [] + +# Interface configuration. Dict mapping switch interface names to configuration +# dicts. Each dict contains an optional 'description' item and a 'config' item +# which should contain a list of per-interface configuration. +alliedware_plus_switch_interface_config: {} + +# Whether to save the configuration. +alliedware_plus_switch_save: false diff --git a/ansible/roles/alliedware-plus-switch/tasks/main.yml b/ansible/roles/alliedware-plus-switch/tasks/main.yml new file mode 100644 index 000000000..ceb0d434c --- /dev/null +++ b/ansible/roles/alliedware-plus-switch/tasks/main.yml @@ -0,0 +1,6 @@ +--- +- name: Ensure AlliedWare Plus switches are configured + alliedtelesis.awplus.awplus_config: + lines: "{{ lookup('template', 'alliedware-plus-config.j2') }}" + save_when: >- + {{ alliedware_plus_switch_save | bool | ternary('modified', 'never') }} diff --git a/ansible/roles/alliedware-plus-switch/templates/alliedware-plus-config.j2 b/ansible/roles/alliedware-plus-switch/templates/alliedware-plus-config.j2 new file mode 100644 index 000000000..e1138bb9e --- /dev/null +++ b/ansible/roles/alliedware-plus-switch/templates/alliedware-plus-config.j2 @@ -0,0 +1,15 @@ +#jinja2: trim_blocks: True,lstrip_blocks: True + +{% for line in alliedware_plus_switch_config %} +{{ line }} +{% endfor %} + +{% for interface, config in alliedware_plus_switch_interface_config.items() %} +interface {{ interface }} +{% if config.description is defined %} + description {{ config.description }} +{% endif %} +{% for line in config.config %} + {{ line }} +{% endfor %} +{% endfor %} diff --git a/ansible/roles/firewalld/tasks/enabled.yml b/ansible/roles/firewalld/tasks/enabled.yml index 048645169..656632242 100644 --- a/ansible/roles/firewalld/tasks/enabled.yml +++ b/ansible/roles/firewalld/tasks/enabled.yml @@ -13,6 +13,23 @@ state: started become: true +# NOTE: The firewalld Ansible module decides whether to use online or offline +# (on-disk only) operations when it is imported, based on whether the firewalld +# D-Bus interface is available. Starting the service does not guarantee that +# the interface is ready yet, so if the first zone is created too early it is +# written to disk only and is not loaded into the running daemon. A subsequent +# attempt to assign an interface to that zone then fails with +# 'INVALID_ZONE'. Wait until firewalld can be queried before configuring it. +- name: Wait for firewalld to be ready + command: + cmd: firewall-cmd --state + register: firewalld_state + until: firewalld_state.rc == 0 + retries: 30 + delay: 1 + changed_when: false + become: true + - block: - name: Get firewalld current default zone command: diff --git a/doc/source/configuration/reference/physical-network.rst b/doc/source/configuration/reference/physical-network.rst index 2cd3815bf..bfc2c1273 100644 --- a/doc/source/configuration/reference/physical-network.rst +++ b/doc/source/configuration/reference/physical-network.rst @@ -14,6 +14,7 @@ configure`` command. See :ref:`physical-network` for details. The following switch operating systems are currently supported: +* AlliedWare Plus * Arista EOS * Cisco NX-OS * Cumulus Linux (via `Network Command Line Utility (NCLU) @@ -197,6 +198,28 @@ hosts file on the Ansible control host will need to be populated manually. Device-specific Configuration Variables ======================================= +AlliedWare Plus +--------------- + +Configuration for these devices is applied using the ``alliedware-plus-switch`` +Ansible role in Kayobe. The role configures AlliedWare Plus switches using the +``alliedtelesis.awplus`` Ansible modules. + +``switch_type`` should be set to ``alliedware-plus``. + + +``switch_config_save`` may be set to ``true`` to save the running configuration +to the startup configuration when they differ, including any previously unsaved +changes. + +* ``ansible_host`` is the hostname or IP address. Optional. +* ``ansible_user`` is the SSH username. +* ``ansible_ssh_pass`` is the SSH password. +* ``ansible_connection`` should be ``ansible.netcommon.network_cli``. +* ``ansible_network_os`` should be ``alliedtelesis.awplus.awplus``. +* ``ansible_become`` should be ``true``. +* ``ansible_become_method`` should be ``enable``. + Arista EOS ---------- diff --git a/releasenotes/notes/alliedware-plus-switch-75625ad2e5d61241.yaml b/releasenotes/notes/alliedware-plus-switch-75625ad2e5d61241.yaml new file mode 100644 index 000000000..1dd97cd60 --- /dev/null +++ b/releasenotes/notes/alliedware-plus-switch-75625ad2e5d61241.yaml @@ -0,0 +1,5 @@ +--- +features: + - | + Adds support for configuration of AlliedWare Plus switches. This is + integrated with the ``kayobe physical network configure`` command. diff --git a/releasenotes/notes/firewalld-wait-ready-7a1c2d9e4f6b8a30.yaml b/releasenotes/notes/firewalld-wait-ready-7a1c2d9e4f6b8a30.yaml new file mode 100644 index 000000000..76b0bcba0 --- /dev/null +++ b/releasenotes/notes/firewalld-wait-ready-7a1c2d9e4f6b8a30.yaml @@ -0,0 +1,9 @@ +--- +fixes: + - | + Fixes a race when configuring firewalld that could cause host + configuration to fail with ``INVALID_ZONE`` for a zone that was created + while firewalld was still starting up. The firewalld role now waits until + the firewalld D-Bus interface is ready before creating zones, ensuring + that they are applied to the running daemon rather than only to the + on-disk configuration. diff --git a/requirements.yml b/requirements.yml index af248635b..c359cc623 100644 --- a/requirements.yml +++ b/requirements.yml @@ -1,5 +1,7 @@ --- collections: + - name: alliedtelesis.awplus + version: 1.3.0 - name: https://github.com/openstack/ansible-collection-kolla type: git version: stable/2025.1