100 lines
18 KiB
Plaintext
100 lines
18 KiB
Plaintext
|
§
|
|||
|
|
É_jž6 ã ó¢ — d Z ddlmZ ddlZddlmZ ddlmZ ddlm Z ddl
|
|||
|
|
m Z dd l m
|
|||
|
|
Z
|
|||
|
|
d#d „Zd#d
|
|||
|
|
„Zd$d„Zd%d„Zd&d„Zd'd„Zd(d „Zd)d „Zd*d"„ZdS )+a¶ STAGE 2-4: collecting existing Sprut objects, comparing/creating missing
|
|||
|
|
IKE/IPsec policies, endpoint groups and VPN services, and finally creating
|
|||
|
|
IPsec site connections.
|
|||
|
|
|
|||
|
|
STAGE 3's four compare_and_create_* functions each return a
|
|||
|
|
neutron_id -> sprut_id correspondence dict (replacing the bash originals'
|
|||
|
|
`declare -A neutron_to_sprut_*` globals). STAGE 4 looks these up by the
|
|||
|
|
raw connection's referenced IDs to build its request body.
|
|||
|
|
é )Ú annotationsNé )Úaudit)ÚMigrationState)Ú
|
|||
|
|
redact_psk)Ú SprutClient)Úprint_kv_tableÚreturnÚstrc ó. — t j | d¬¦ « S )Né )Úindent)ÚjsonÚdumps)Úobjs ú+/root/vkcloud/vpnaas/ipsec_migrator/sync.pyÚ_dumpr s € Ý Œ:�c !Ð $Ñ $Ô $Ð$ó c ó^ — | €dS t | t ¦ « r| rdndS t | ¦ « S )a3 Mirrors `jq -r`: a JSON null stringifies to the 4-char string "null"
|
|||
|
|
(not Python None/absence), a JSON boolean stringifies to lowercase
|
|||
|
|
"true"/"false" (not Python's "True"/"False" -- confirmed against a real
|
|||
|
|
tenant, where Neutron's ipsec site connection ".State" is a genuine JSON
|
|||
|
|
boolean), everything else via str(). STAGE 4's request body in the bash
|
|||
|
|
original is built entirely with `jq -n --arg`, which means every field
|
|||
|
|
-- even ones that look numeric/boolean -- is sent to Sprut as a JSON
|
|||
|
|
string. Do not "fix" this to native types.NÚnullÚtrueÚfalse)Ú
|
|||
|
|
isinstanceÚboolr )Úvalues r Ú _jq_r_strr s; € ð
|
|||
|
|
€}؈vÝ�%�Ñ Ô ð ,Ø Ð+ˆvˆv GÐ+Ý ˆu‰:Œ:Ðr Ú sprut_clientr Údictc óÎ — t d¦ « | d¦ « }t d¦ « t t |¦ « ¦ « t ¦ « t d¦ « | d¦ « }t d¦ « t t |¦ « ¦ « t ¦ « t d¦ « | d¦ « }t d ¦ « t t |¦ « ¦ « t ¦ « t d
|
|||
|
|
¦ « | d ¦ « }t d ¦ « t t |¦ « ¦ « t ¦ « t d
|
|||
|
|
¦ « | d¦ « }t d¦ « t t t |¦ « ¦ « ¦ « t ¦ « |||||dœS )Nz%Collecting IKE policies from Sprut...ú/vpn/ikepolicieszIKE policies collected:z'Collecting IPsec policies from Sprut...ú/vpn/ipsecpolicieszIPsec policies collected:z(Collecting Endpoint Groups from Sprut...ú/vpn/endpoint-groupszEndpoint Groups collected:z%Collecting VPN services from Sprut...ú/vpn/vpnserviceszVPN services collected:z/Collecting IPsec site connections from Sprut...ú/vpn/ipsec-site-connectionsz!IPsec site connections collected:)Ú ike_policiesÚipsec_policiesÚendpoint_groupsÚ vpn_servicesÚipsec_site_connections)ÚprintÚgetr r )r r% r& r' r( r) s r Úcollect_sprut_stater, - sÁ € Ý Ð
|
|||
|
|
1Ñ2Ô2Ð2Ø ×#Ò#Ð$6Ñ7Ô7€LÝ Ð
|
|||
|
|
#Ñ$Ô$Ð$Ý �%� Ñ
|
|||
|
|
Ô
|
|||
|
|
Ñ Ô Ð Ý �G„G€Gå Ð
|
|||
|
|
3Ñ4Ô4Ð4Ø!×%Ò%Ð&:Ñ;Ô;€NÝ Ð
|
|||
|
|
%Ñ&Ô&Ð&Ý �%�Ñ
|
|||
|
|
Ô
|
|||
|
|
Ñ Ô Ð Ý �G„G€Gå Ð
|
|||
|
|
4Ñ5Ô5Ð5Ø"×&Ò&Ð'=Ñ>Ô>€OÝ Ð
|
|||
|
|
&Ñ'Ô'Ð'Ý �%�Ñ
|
|||
|
|
Ô
|
|||
|
|
Ñ!Ô!Ð!Ý �G„G€Gå Ð
|
|||
|
|
1Ñ2Ô2Ð2Ø ×#Ò#Ð$6Ñ7Ô7€LÝ Ð
|
|||
|
|
#Ñ$Ô$Ð$Ý �%� Ñ
|
|||
|
|
Ô
|
|||
|
|
Ñ Ô Ð Ý �G„G€Gå Ð
|
|||
|
|
;Ñ<Ô<Ð<Ø )× -Ò -Ð.KÑ LÔ LÐÝ Ð
|
|||
|
|
-Ñ.Ô.Ð.Ý �%•
|
|||
|
|
Ð1Ñ2Ô2Ñ
|
|||
|
|
3Ô
|
|||
|
|
3Ñ4Ô4Ð4Ý �G„G€Gð %Ø(Ø*Ø$Ø"8ð ð ð r Ústater Úsprut_ike_policiesúdict[str, str]c óâ ‡ — i }| j D �]b}| j | }| d¦ « Š t ˆ fd„| dg ¦ « D ¦ « d ¦ « }|sót d‰ › d�¦ « d| d¦ « | d¦ « | d¦ « | d ¦ « | d
|
|||
|
|
¦ « | d ¦ « | d ¦ « d
|
|||
|
|
œi}| d|¦ « }| d¦ « pi d¦ « }|j r|sd|› �}nt d‰ › d�¦ « |||< �Œd|S )NÚnamec 3 ót •K — | ]2}| d ¦ « ‰k ¯| d¦ « V — Œ3dS ©r1 ÚidN©r+ ©Ú.0Úpr1 s €r ú <genexpr>z2compare_and_create_ike_policies.<locals>.<genexpr>b sC øè è € Ð eÐ e˜QÈqÏuÊuÐU[É}Ì}Ð`dÒOdÐOdˆQ�UŠU�4‰[Œ[ÐOdÐOdÐOdÐOdÐ eÐ er Ú ikepolicieszCreating IKE policy 'ú
|
|||
|
|
' in SprutÚ ikepolicyÚphase1_negotiation_modeÚauth_algorithmÚencryption_algorithmÚpfsÚlifetimeÚ ike_version)r1 r= r> r? r@ rA rB r r4 úDRY-RUN-z IKE policy 'ú' already exists in Sprut)Úin_scope_ike_policy_idsÚneutron_ike_policy_by_idr+ Únextr* ÚpostÚdry_run)
|
|||
|
|
r- r r. ÚmappingÚ
|
|||
|
|
neutron_idÚneutron_policyÚsprut_idÚ request_bodyÚresponser1 s
|
|||
|
|
@r Ú compare_and_create_ike_policiesrP Y s± ø€ ð !€GØÔ3ð 'ñ 'ˆ
|
|||
|
|
Ø Ô7¸
|
|||
|
|
ÔCˆØ ×!Ò! &Ñ)Ô)ˆåØ eÐ eÐ eÐ eÐ"4×"8Ò"8¸ ÈÑ"KÔ"KÐ eÑ eÔ eØ ñ
|
|||
|
|
ô
|
|||
|
|
ˆð
|
|||
|
|
ð BÝ Ð:¨$Ð:Ð:Ð:Ñ ;Ô ;Ð ;àØ *× .Ò .¨vÑ 6Ô 6Ø/=×/AÒ/AÐB[Ñ/\Ô/\Ø&4×&8Ò&8Ð9IÑ&JÔ&JØ,:×,>Ò,>Ð?UÑ,VÔ,VØ)×-Ò-¨eÑ4Ô4Ø .× 2Ò 2°:Ñ >Ô >Ø#1×#5Ò#5°mÑ#DÔ#Dð ð ð
|
|||
|
|
ˆLð $×(Ò(Ð);¸\ÑJÔJˆHØ Ÿ š [Ñ1Ô1Ð7°R×<Ò<¸TÑBÔBˆHØÔ#ð
|
|||
|
|
3¨Hð
|
|||
|
|
3Ø2 jÐ2Ð2�øå Ð@ Ð@Ð@Ð@Ñ AÔ AÐ Aà &ˆ�
|
|||
|
|
ÑÑØ €Nr Úsprut_ipsec_policiesc óâ ‡ — i }| j D �]b}| j | }| d¦ « Š t ˆ fd„| dg ¦ « D ¦ « d ¦ « }|sót d‰ › d�¦ « d| d¦ « | d¦ « | d¦ « | d ¦ « | d
|
|||
|
|
¦ « | d ¦ « | d ¦ « d
|
|||
|
|
œi}| d|¦ « }| d¦ « pi d¦ « }|j r|sd|› �}nt d‰ › d�¦ « |||< �Œd|S )Nr1 c 3 ót •K — | ]2}| d ¦ « ‰k ¯| d¦ « V — Œ3dS r3 r5 r6 s €r r9 z4compare_and_create_ipsec_policies.<locals>.<genexpr>‡ sH øè è € Ð iÐ i˜QÐST×SXÒSXÐY_ÑS`ÔS`ÐdhÒShÐShˆQ�UŠU�4‰[Œ[ÐShÐShÐShÐShÐ iÐ ir Ú
|
|||
|
|
ipsecpolicieszCreating IPsec policy 'r; Ú ipsecpolicyÚtransform_protocolr> r? Úencapsulation_moder@ rA )r1 rV r> r? rW r@ rA r! r4 rC zIPsec policy 'rD )Úin_scope_ipsec_policy_idsÚneutron_ipsec_policy_by_idr+ rG r* rH rI )
|
|||
|
|
r- r rQ rJ rK rL rM rN rO r1 s
|
|||
|
|
@r Ú!compare_and_create_ipsec_policiesrZ ~ s² ø€ ð !€GØÔ5ð 'ñ 'ˆ
|
|||
|
|
Ø Ô9¸*ÔEˆØ ×!Ò! &Ñ)Ô)ˆåØ iÐ iÐ iÐ iÐ"6×":Ò":¸?ÈBÑ"OÔ"OÐ iÑ iÔ iØ ñ
|
|||
|
|
ô
|
|||
|
|
ˆð
|
|||
|
|
ð DÝ Ð<¨DÐ<Ð<Ð<Ñ =Ô =Ð =à Ø *× .Ò .¨vÑ 6Ô 6Ø*8×*<Ò*<Ð=QÑ*RÔ*RØ&4×&8Ò&8Ð9IÑ&JÔ&JØ,:×,>Ò,>Ð?UÑ,VÔ,VØ*8×*<Ò*<Ð=QÑ*RÔ*RØ)×-Ò-¨eÑ4Ô4Ø .× 2Ò 2°:Ñ >Ô >ð ð ð
|
|||
|
|
ˆLð $×(Ò(Ð)=¸|ÑLÔLˆHØ Ÿ š ]Ñ3Ô3Ð9°r×>Ò>¸tÑDÔDˆHØÔ#ð
|
|||
|
|
3¨Hð
|
|||
|
|
3Ø2 jÐ2Ð2�øå ÐB 4ÐBÐBÐBÑ CÔ CÐ Cà &ˆ�
|
|||
|
|
ÑÑØ €Nr Úsprut_endpoint_groupsc óÄ ‡ — i }| j D �]Ó}| j | }| d¦ « }t j || j ¦ « Š t
|
|||
|
|
dd ‰ ¦ « › �¦ « t ˆ fd„| dg ¦ « D ¦ « d ¦ « }|r| d¦ « nd }t
|
|||
|
|
d|› dd ‰ ¦ « › �¦ « |r&t
|
|||
|
|
d | d
|
|||
|
|
¦ « › �¦ « nt
|
|||
|
|
d ¦ « |s t
|
|||
|
|
d |› d
|
|||
|
|
�¦ « d|‰ ddœi} t
|
|||
|
|
dt j
|
|||
|
|
| ¦ « › �¦ « | d| ¦ « }
|
|||
|
|
|
|
|||
|
|
d¦ « pi d¦ « }|j r|sd|› �}t
|
|||
|
|
d|› �¦ « nt
|
|||
|
|
d|› �¦ « |||< t
|
|||
|
|
¦ « �ŒÕ|S )Nr1 z$Total converted UUIDs in endpoints: z, c 3 óN •K — | ] }| d ¦ « ‰k ¯|V — Œ dS )Ú endpointsNr5 )r7 ÚgÚ converteds €r r9 z5compare_and_create_endpoint_groups.<locals>.<genexpr>¯ s; øè è € Ð lÐ l�1ÈAÏEÊEÐR]ÑL^ÔL^ÐbkÒLkÐLkˆQÐLkÐLkÐLkÐLkÐ lÐ lr r' r4 z"Comparing Neutron endpoint group 'z' with endpoints: z> -> Found corresponding Sprut endpoint group with endpoints: r^ zD -> No corresponding Sprut endpoint group found for these endpointszCreating Endpoint Group 'r; Úendpoint_groupÚcidr)r1 r^ ÚtypezRequest body: r" rC z Created Sprut Endpoint group: zGEndpoint Group with matching endpoints already exists in Sprut with id )
|
|||
|
|
Úin_scope_endpoint_group_idsÚ neutron_endpoint_group_by_idr+ r Úresolve_endpoint_addressesÚsubnet_id_to_subnet_addressr* ÚjoinrG r r rH rI ) r- r r[ rJ rK Ú
|
|||
|
|
neutron_groupr1 ÚmatchingrM rN rO r` s @r Ú"compare_and_create_endpoint_groupsrk £ s9 ø€ ð !€GØÔ7ð ñ ˆ
|
|||
|
|
Ø Ô:¸:ÔFˆ
|
|||
|
|
Ø × Ò Ñ(Ô(ˆåÔ4°]ÀEÔDeÑfÔfˆ Ý
|
|||
|
|
ÐK°T·Y²Y¸yÑ5IÔ5IÐKÐKÑLÔLÐLåØ lÐ lÐ lÐ lÐ-×1Ò1Ð2CÀRÑHÔHÐ lÑ lÔ lØ ñ
|
|||
|
|
ô
|
|||
|
|
ˆð *2Ð;�8—<’< Ñ%Ô%Ð%°tˆå
|
|||
|
|
Ða°4ÐaÐaÈ4Ï9Ê9ÐU^ÑK_ÔK_ÐaÐaÑbÔbÐbØ ð ZÝ ÐnÐS[×S_ÒS_Ð`kÑSlÔSlÐnÐnÑ oÔ oÐ oÐ oå ÐXÑ YÔ YÐ Yàð
|
|||
|
|
hÝ Ð>¨dÐ>Ð>Ð>Ñ ?Ô ?Ð ?Ø ,°tÈ)Ð]cÐ.dÐ.dÐeˆLÝ Ð=¥4¤:¨lÑ#;Ô#;Ð=Ð=Ñ >Ô >Ð >Ø#×(Ò(Ð)?À ÑNÔNˆHØ Ÿ š Ð%5Ñ6Ô6Ð<¸"×AÒAÀ$ÑGÔGˆHØÔ#ð
|
|||
|
|
3¨Hð
|
|||
|
|
3Ø2 jÐ2Ð2�Ý Ð=°8Ð=Ð=Ñ >Ô >Ð >Ð >å ÐfÐ\dÐfÐfÑ gÔ gÐ gà &ˆ�
|