6285b6c638
This change adds the ability to effectively use the PrivateNetwork functionality systemd provides for services. Now, if enabled, services can be created in a network namespace which isolates it from the reset of the host. Additional options have been added allowing access into the network namespace over ephemeral devices as needed. Highlights: * Isolated private networking for services will sandbox using a stand alone namespace which has no access to anything via the network. * Access into a private namespace can be provided over a single network interface which can be IP'd via local DHCP + NAT or using an upstream DHCP server. * Tests have been added to exercise the new functionality. All of the funcality has been documented in the defaults of this role. Change-Id: I6751765131f32393a1605eb2100bec46199d980a Signed-off-by: Kevin Carter <kevin@cloudnull.com>
51 lines
2.4 KiB
Django/Jinja
51 lines
2.4 KiB
Django/Jinja
[Unit]
|
|
Description=Named network namespace %I
|
|
Documentation=https://github.com/openstack/ansible-role-systemd_service
|
|
After=syslog.target
|
|
After=network.target
|
|
After=systemd-netns@%i.service
|
|
After=%i.service
|
|
{% if not (systemd_PrivateNetworkIsolated | bool) %}
|
|
BoundBy=systemd-netns@%i.service
|
|
{% endif %}
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=true
|
|
|
|
# Start process
|
|
ExecStart=/usr/bin/env ip netns exec %I ip link set lo up
|
|
ExecStart=-/usr/bin/env ip link add mv-{{ systemd_PrivateNetworkInterface }} link {{ systemd_PrivateNetworkInterface }} type macvlan mode {{ systemd_PrivateNetworkMode }}
|
|
ExecStart=-/usr/bin/env ip link set mv-{{ systemd_PrivateNetworkInterface }} up
|
|
ExecStart=/usr/bin/env sysctl -w net.ipv4.ip_forward=1
|
|
{% if (systemd_PrivateNetworkLocalDHCP | bool) %}
|
|
{% if (systemd_version | int) <= 230 %}
|
|
ExecStart=-/usr/bin/env iptables -t nat -D POSTROUTING -s {{ systemd_PrivateNetworkLocalDHCPGateway}} -o {{ systemd_PrivateNetworkInterface }} -j MASQUERADE
|
|
ExecStart=/usr/bin/env iptables -t nat -A POSTROUTING -s {{ systemd_PrivateNetworkLocalDHCPGateway}} -o {{ systemd_PrivateNetworkInterface }} -j MASQUERADE
|
|
{% endif %}
|
|
ExecStartPre=-/usr/bin/env ip address add {{ systemd_PrivateNetworkLocalDHCPGateway }} dev mv-{{ systemd_PrivateNetworkInterface }}
|
|
{% endif %}
|
|
{% if not (systemd_PrivateNetworkIsolated | bool) %}
|
|
ExecStart=-/usr/bin/env ip link add mv-pivot link {{ systemd_PrivateNetworkInterface }} type macvlan mode {{ systemd_PrivateNetworkMode }}
|
|
ExecStart=/usr/bin/env ip link set mv-pivot netns %I name {{ systemd_PrivateNetworkInterface }}
|
|
ExecStart=/usr/bin/env ip netns exec %I ip link set dev {{ systemd_PrivateNetworkInterface }} up
|
|
{% if (systemd_PrivateNetworkDHCP | bool) %}
|
|
ExecStart=/usr/bin/env ip netns exec %I dhclient {{ systemd_PrivateNetworkInterface }} -v
|
|
{% endif %}
|
|
# Stop process
|
|
{% if (systemd_PrivateNetworkLocalDHCP | bool) %}
|
|
{% if (systemd_version | int) <= 230 %}
|
|
ExecStop=/usr/bin/env iptables -t nat -D POSTROUTING -s {{ systemd_PrivateNetworkLocalDHCPGateway}} -o {{ systemd_PrivateNetworkInterface }} -j MASQUERADE
|
|
{% endif %}
|
|
{% endif %}
|
|
{% if (systemd_PrivateNetworkLocalDHCP | bool) %}
|
|
{% if (systemd_version | int) <= 230 %}
|
|
ExecStop=/usr/bin/env iptables -t nat -D POSTROUTING -s {{ systemd_PrivateNetworkLocalDHCPGateway}} -o {{ systemd_PrivateNetworkInterface }} -j MASQUERADE
|
|
{% endif %}
|
|
{% endif %}
|
|
{% endif %}
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
WantedBy=network-online.target
|