Nik Afiq
7eb7072ec5
Some checks failed
validate / lint (push) Failing after 1s
Creates enp1s0.50 on nik-debian (no L3 address, VLAN 40/node IP/default route untouched) for Multus to later attach macvlan/ipvlan workloads to. Verified live: enp1s0.50 is up with no IPv4 address (only the automatic IPv6 link-local, which is expected and harmless), default route unchanged. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
75 lines
2.7 KiB
YAML
75 lines
2.7 KiB
YAML
---
|
|
# Part of role: vlan50-parent
|
|
# Called by: ansible/playbooks/vlan50-parent.yaml
|
|
# Description: Creates nik-debian's persistent tagged VLAN 50 subinterface
|
|
# ({{ vlan50_subinterface }}) without touching its existing untagged
|
|
# VLAN 40 config (node IP, default route, k3s identity, host DNS). See
|
|
# this role's defaults/main.yaml for the switch-readiness precondition.
|
|
|
|
- name: Install the vlan package (ifupdown VLAN support)
|
|
ansible.builtin.apt:
|
|
name: vlan
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Load the 8021q kernel module now
|
|
community.general.modprobe:
|
|
name: 8021q
|
|
state: present
|
|
|
|
- name: Persist the 8021q kernel module across reboots
|
|
ansible.builtin.copy:
|
|
dest: /etc/modules-load.d/8021q.conf
|
|
content: |
|
|
# Managed by Ansible (role: vlan50-parent).
|
|
8021q
|
|
mode: "0644"
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Write the VLAN 50 subinterface definition
|
|
ansible.builtin.template:
|
|
src: vlan50.interface.j2
|
|
dest: "/etc/network/interfaces.d/{{ vlan50_subinterface }}"
|
|
mode: "0644"
|
|
owner: root
|
|
group: root
|
|
register: vlan50_iface_file
|
|
|
|
- name: Check whether the subinterface is already up
|
|
ansible.builtin.command: "ip link show {{ vlan50_subinterface }}"
|
|
register: vlan50_iface_check
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Bring up the VLAN 50 subinterface
|
|
ansible.builtin.command: "ifup {{ vlan50_subinterface }}"
|
|
when: vlan50_iface_check.rc != 0 or vlan50_iface_file is changed
|
|
|
|
- name: Confirm the subinterface is up with no L3 address
|
|
ansible.builtin.command: "ip -brief addr show {{ vlan50_subinterface }}"
|
|
register: vlan50_iface_state
|
|
changed_when: false
|
|
|
|
- name: Assert VLAN 50 parent is UP and carries no IPv4/IPv6 address
|
|
ansible.builtin.assert:
|
|
that:
|
|
- "'UP' in vlan50_iface_state.stdout or 'UNKNOWN' in vlan50_iface_state.stdout"
|
|
- vlan50_iface_state.stdout.split() | select('match', '^[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+/') | list | length == 0
|
|
fail_msg: "{{ vlan50_subinterface }} is either down or unexpectedly carries an IPv4 address: {{ vlan50_iface_state.stdout }}"
|
|
|
|
- name: Read current default route
|
|
ansible.builtin.command: ip -4 route show default
|
|
register: vlan50_current_default_route
|
|
changed_when: false
|
|
|
|
- name: Assert the host default route is still the untagged VLAN 40 interface
|
|
ansible.builtin.assert:
|
|
that:
|
|
- vlan50_current_default_route.stdout is search('dev ' + vlan50_parent_interface + '(\s|$)')
|
|
- not (vlan50_current_default_route.stdout is search('dev ' + vlan50_subinterface + '(\s|$)'))
|
|
fail_msg: >-
|
|
nik-debian's default route is not via {{ vlan50_parent_interface }}
|
|
({{ vlan50_current_default_route.stdout }}) — VLAN 50 must never
|
|
become the host default route.
|