Skip to content

Commit 26e4384

Browse files
author
Tong Li
committed
[CE-494] Connection profile use public IP
Currently ansible agent setup components in the same k8s cluster, using the componment names to communicate is fine. However when a fabric network uses multiple clusters, use the component names in the connection profile won't work. This patch fixed that problem. Change-Id: I1a7220fea9389fbb0d398be46934c450db65e34d Signed-off-by: Tong Li <litong01@us.ibm.com>
1 parent b4d3f53 commit 26e4384

File tree

6 files changed

+241
-2
lines changed

6 files changed

+241
-2
lines changed

‎src/agent/ansible/roles/deploy_compose/certsetup/templates/configtx.j2‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -130,8 +130,8 @@ Application: &ApplicationDefaults
130130
Rule: "MAJORITY Admins"
131131
{% endif %}
132132
{% if project_version is version_compare('1.1.0','>=') or 'stable' in project_version or project_version == 'latest' %}
133-
Capabilities:
134-
<<: *ApplicationCapabilities
133+
Capabilities:
134+
<<: *ApplicationCapabilities
135135
{% endif %}
136136

137137
{% if project_version is version_compare('1.2.0','>=') or 'stable' in project_version or project_version == 'latest' %}

‎src/agent/ansible/roles/deploy_k8s/plays.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,18 @@
3333
- include_tasks: "fabricsetup/tasks/{{ mode }}.yml"
3434
tags: "fabricsetup"
3535

36+
- name: Generate connection profile using public IPs
37+
hosts: cloud
38+
connection: local
39+
become: true
40+
become_user: root
41+
vars_files:
42+
- "./../../vars/{{ env }}.yml"
43+
tasks:
44+
- include_tasks: "pubconn/tasks/{{ mode }}.yml"
45+
when: fabric.k8s.exposeserviceport == True
46+
tags: "conngen"
47+
3648
- name: setup composer
3749
hosts: cloud
3850
connection: local

‎src/agent/ansible/roles/deploy_k8s/pubconn/tasks/apply.yml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
---
2+
- name: Reuse common code
3+
include_tasks: "{{ playbook_dir }}/../common/config_apply.yml"
4+
5+
- name: Ensure certificate directory exist
6+
file:
7+
path: "{{ fabricworkdir }}/keyfiles"
8+
state: "{{ item }}"
9+
with_items:
10+
- "directory"
11+
12+
- name: Query node public ip address
13+
command: >-
14+
./kubectl --kubeconfig kubeconfig get nodes -o
15+
jsonpath={.items[*].status.addresses[?\(@.type==\'ExternalIP\'\)].address}
16+
register: ips
17+
args:
18+
chdir: "{{ playbook_dir }}/../../vars/"
19+
20+
- name: Query service ports
21+
shell: >-
22+
kubectl --kubeconfig kubeconfig get services
23+
| grep NodePort | awk '{print $1, $5}'
24+
register: ports
25+
args:
26+
chdir: "{{ playbook_dir }}/../../vars/"
27+
28+
- debug:
29+
var: ports.stdout_lines
30+
31+
- set_fact:
32+
allips: "{{ ips.stdout.split(' ') }}"
33+
k8sports: []
34+
sports: {}
35+
36+
- set_fact:
37+
k8sports: >-
38+
{{ k8sports +
39+
[{ 'name':item.split(' ')[0], 'value':(item.split(' ')[1]|replace('/TCP','')).split(',') }] }}
40+
with_items: "{{ ports.stdout_lines }}"
41+
42+
- set_fact:
43+
sports: >-
44+
{{ k8sports | subelements('value', skip_missing=True) }}
45+
46+
- set_fact:
47+
k8sports: {}
48+
49+
- set_fact:
50+
k8sports: >-
51+
{{ k8sports|combine( {item[0].name+':'+item[1].split(':')[0]:item[1].split(':')[1]} ) }}
52+
with_items: "{{ [sports] }}"
53+
54+
- debug:
55+
var: k8sports
56+
57+
- name: Create connection profiles
58+
template:
59+
src: "{{ playbook_dir }}/../deploy_k8s/pubconn/templates/connection.j2"
60+
dest: "{{ fabricworkdir }}/keyfiles/{{ item }}/connection.json"
61+
with_items: "{{ allorgs }}"
62+
63+
- name: Create yaml connection profiles
64+
template:
65+
src: "{{ playbook_dir }}/../deploy_k8s/pubconn/templates/connyaml.j2"
66+
dest: "{{ fabricworkdir }}/keyfiles/{{ item }}/connection.yml"
67+
with_items: "{{ allorgs }}"
68+
69+
- name: Create a zip file of all certificates
70+
archive:
71+
path: "{{ fabricworkdir }}/keyfiles"
72+
dest: "{{ fabricworkdir }}/certs.tgz"

‎src/agent/ansible/roles/deploy_k8s/pubconn/tasks/destroy.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
---

‎src/agent/ansible/roles/deploy_k8s/pubconn/templates/connection.j2‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
{
2+
"name": "{{ item }}-network",
3+
"x-type": "hlfv1",
4+
"version": "1.0.0",
5+
"client": {
6+
"organization": "{{ item }}",
7+
"connection": {
8+
"timeout": {
9+
"peer": { "endorser": "300", "eventHub": "300", "eventReg": "300"},
10+
"orderer": "300"
11+
}
12+
}
13+
},
14+
"channels": {
15+
"firstchannel": {
16+
"orderers": [
17+
{% for orderer in allorderers %}
18+
"{{ orderer.name }}"{{ '' if loop.last else ',' }}
19+
{% endfor %}
20+
],
21+
"peers": {
22+
{% for peer in allpeers %}
23+
"{{ peer.name }}": {
24+
"endorsingPeer": true, "chaincodeQuery": true, "eventSource": true
25+
}{{ '' if loop.last else ',' }}
26+
{% endfor %}
27+
}
28+
}
29+
},
30+
"organizations": {
31+
{% for org in allorgs %}
32+
"{{ org }}": {
33+
"mspid": "{{ org }}",
34+
"peers": [
35+
{% for peer in allpeers|selectattr('org', 'equalto', org)|list %}
36+
"{{ peer.name }}"{{ '' if loop.last else ',' }}
37+
{% endfor %}
38+
],
39+
"certificateAuthorities": [
40+
{% for ca in allcas|selectattr('org', 'equalto', org)|list %}
41+
"{{ ca.name }}"{{ '' if loop.last else ',' }}
42+
{% endfor %}
43+
]
44+
}{{ '' if loop.last else ',' }}
45+
{% endfor %}
46+
},
47+
"orderers": {
48+
{% for orderer in allorderers %}
49+
"{{ orderer.name }}": {
50+
"url": "{{ tls|ternary('grpcs','grpc') }}://{{ allips|random }}:{{ k8sports[orderer.name+':7050'] }}",
51+
"grpcOptions": {
52+
"ssl-target-name-override": "{{ orderer.name }}"
53+
},
54+
"tlsCACerts": {
55+
"pem": "{{ fabricworkdir+'/run/keyfiles/'+orderer.org+'/orderers/'+orderer.name+'.'+orderer.org+'/tls/ca.crt' }}"
56+
}
57+
}{{ '' if loop.last else ',' }}
58+
{% endfor %}
59+
},
60+
"peers": {
61+
{% for peer in allpeers|selectattr('org', 'equalto', item)|list %}
62+
"{{ peer.name }}": {
63+
"url": "{{ tls|ternary('grpcs','grpc') }}://{{ allips|random }}:{{ k8sports[peer.name+':7051'] }}",
64+
"eventUrl": "{{ tls|ternary('grpcs','grpc') }}://{{ allips|random }}:{{ k8sports[peer.name+':7053'] }}",
65+
"grpcOptions": {
66+
"ssl-target-name-override": "{{ peer.name }}"
67+
},
68+
"tlsCACerts": {
69+
"pem": "{{ fabricworkdir+'/run/keyfiles/'+peer.org+'/tlsca/tlsca.'+peer.org+'-cert.pem' }}"
70+
}
71+
}{{ '' if loop.last else ',' }}
72+
{% endfor %}
73+
},
74+
"certificateAuthorities": {
75+
{% for ca in allcas|selectattr('org', 'equalto', item)|list %}
76+
"{{ ca.name }}": {
77+
"url": "{{ tls|ternary('https','http') }}://{{ allips|random }}:{{ k8sports[ca.name+':7054'] }}",
78+
"caName": "{{ ca.name }}",
79+
"httpOptions": {"verify": false}
80+
}{{ '' if loop.last else ',' }}
81+
{% endfor %}
82+
}
83+
}

‎src/agent/ansible/roles/deploy_k8s/pubconn/templates/connyaml.j2‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
---
2+
name: "{{ item }}-network"
3+
x-type: "hlfv1"
4+
version: "1.0.0"
5+
client:
6+
organization: "{{ item }}"
7+
cryptoconfig:
8+
path: "/fabric/keyfiles"
9+
connection:
10+
timeout:
11+
peer:
12+
endorser: 300
13+
eventHub: 300
14+
eventReg: 300
15+
orderer: 300
16+
channels:
17+
firstchannel:
18+
orderers:
19+
{% for orderer in allorderers %}
20+
- {{ orderer.name }}
21+
{% endfor %}
22+
peers:
23+
{% for peer in allpeers %}
24+
{{ peer.name }}:
25+
endorsingPeer: true
26+
chaincodeQuery: true
27+
eventSource: true
28+
{% endfor %}
29+
organizations:
30+
{% for org in allorgs %}
31+
{{ org }}:
32+
mspid: "{{ org }}"
33+
cryptoPath: "{{ org }}/users/{username}@{{ org}}/msp"
34+
peers:
35+
{% for peer in allpeers|selectattr('org', 'equalto', org)|list %}
36+
- {{ peer.name }}
37+
{% endfor %}
38+
certificateAuthorities:
39+
{% for ca in allcas|selectattr('org', 'equalto', org)|list %}
40+
- {{ ca.name }}
41+
{% endfor %}
42+
{% endfor %}
43+
orderers:
44+
{% for orderer in allorderers %}
45+
{{ orderer.name }}:
46+
url: "{{ tls|ternary('grpcs','grpc') }}://{{ allips|random }}:{{ k8sports[orderer.name+':7050'] }}"
47+
grpcOptions:
48+
ssl-target-name-override: "{{ orderer.name }}"
49+
tlsCACerts:
50+
path: "{{ '/fabric/keyfiles/'+orderer.org+'/orderers/'+orderer.name+'.'+orderer.org+'/tls/ca.crt' }}"
51+
{% endfor %}
52+
peers:
53+
{% for peer in allpeers|selectattr('org', 'equalto', item)|list %}
54+
{{ peer.name }}:
55+
url: "{{ tls|ternary('grpcs','grpc') }}://{{ allips|random }}:{{ k8sports[peer.name+':7051'] }}"
56+
eventUrl: "{{ tls|ternary('grpcs','grpc') }}://{{ allips|random }}:{{ k8sports[peer.name+':7053'] }}"
57+
grpcOptions:
58+
ssl-target-name-override: "{{ peer.name }}"
59+
tlsCACerts:
60+
path: "{{ '/fabric/keyfiles/'+peer.org+'/tlsca/tlsca.'+peer.org+'-cert.pem' }}"
61+
{% endfor %}
62+
certificateAuthorities:
63+
{% for ca in allcas|selectattr('org', 'equalto', item)|list %}
64+
{{ ca.name }}:
65+
url: "{{ tls|ternary('https','http') }}://{{ allips|random }}:{{ k8sports[ca.name+':7054'] }}"
66+
caName: "{{ ca.name }}"
67+
httpOptions:
68+
verify: false
69+
tlsCACerts:
70+
path: "{{ '/fabric/keyfiles/'+ca.org+'/tlsca/tlsca.'+ca.org+'-cert.pem' }}"
71+
{% endfor %}

0 commit comments

Comments
 (0)