Make VPN Network configurable #78
Conversation
Previously we checked for `IP_FAMILIES==IPv4` so we shouldn't switch to checking `IP_FAMILIES==IPv6` in if/else, which is different. This commit goes back to the previous `IP_FAMILIES=IPv4` check but keeps the inverted logic of first checking the IP family and then the HA config. It also simplifies calculation of the first three VPN network octets.
It also simplifies calculation of the first three VPN network octets.
It removes the `IP_BASE` env var in favor of `VPN_NETWORK`. The `IP_BASE` env var was not set in this repo or in gardener/gardener. Hence, it is dropped so that no duplicated configuration is needed.
timebertt
requested review from
DockToFuture,
marwinski,
ScheererJ and
axel7born
as code owners
|
Thank you @timebertt for your contribution. Before I can start building your PR, a member of the organization must set the required label(s) {'reviewed/ok-to-test'}. Once started, you can check the build status in the PR checks section below. |
|
@timebertt Thank you for your contribution. |
gardener-robot
added
the
size/m
|
@axel7born I finished verifying this PR as far as I could in a local setup (see PR description for the cases I tested). Next, I will finish gardener/gardener#8991, which requires this PR and a release including it. |
|
@axel7born, @DockToFuture, @ScheererJ, @marwinski You have pull request review open invite, please check |
|
/assign |
|
/ok-to-test |
gardener-robot
added
the
needs/ok-to-test
axel7born
added
reviewed/ok-to-test
gardener-robot-ci-3
added
needs/ok-to-test
|
/lgtm |
gardener-robot
added
reviewed/lgtm
gardener-robot-ci-1
added
the
reviewed/ok-to-test
gardener-robot
added
the
status/closed
What this PR does / why we need it:
This PR introduces the
VPN_NETWORKenv var in both seed-server and shoot-client that allows configuring a custom VPN CIDR.If unset, it defaults to the current hard-coded values (
192.168.123.0/24andfd8f:6d53:b97a:1::/120respectively).This PR introduces some changes to both the seed-server and the shoot-client components to fulfill these requirements.
Which issue(s) this PR fixes:
Part of gardener/gardener#8987
Special notes for your reviewer:
The PR builds upon #64. It rebases the existing commits and adds a few more commits to address the remaining issues.
Images for testing:
ghcr.io/timebertt/dev-images/vpn-seed-server:0.23.0-31-g96cad9eghcr.io/timebertt/dev-images/vpn-shoot-client:0.23.0-31-g96cad9eTODOs:
VPN_NETWORK(backward-compatibility): must result in the same VPN configs, IP addresses, and routesIPv6(IPv6 setup in g/g is currently broken)VPN_NETWORK(manually configured)IPv6(IPv6 setup in g/g is currently broken)Release note: