|
 |
d42a06 |
From 4bc84bccec88abcd9bd0b840532b23ed0934c0d4 Mon Sep 17 00:00:00 2001
|
|
|
d42a06 |
From: Jason McCloskey <jamscclo@amazon.com>
|
|
|
d42a06 |
Date: Mon, 10 Feb 2020 15:18:30 -0800
|
|
|
d42a06 |
Subject: [PATCH] Allow user to specify role with which to query/update route
|
|
|
d42a06 |
table
|
|
|
d42a06 |
|
|
|
d42a06 |
Allow user to specify role with which to query/update route table
|
|
|
d42a06 |
|
|
|
d42a06 |
Allow user to specify role with which to query/update route table
|
|
|
d42a06 |
---
|
|
|
d42a06 |
heartbeat/aws-vpc-move-ip | 40 +++++++++++++++++++++++++++++++++------
|
|
|
d42a06 |
1 file changed, 34 insertions(+), 6 deletions(-)
|
|
|
d42a06 |
|
|
|
d42a06 |
diff --git a/heartbeat/aws-vpc-move-ip b/heartbeat/aws-vpc-move-ip
|
|
|
d42a06 |
index b27d0bfcd..23eec18cc 100755
|
|
|
d42a06 |
--- a/heartbeat/aws-vpc-move-ip
|
|
|
d42a06 |
+++ b/heartbeat/aws-vpc-move-ip
|
|
|
d42a06 |
@@ -145,6 +145,24 @@ Enable enhanced monitoring using AWS API calls to check route table entry
|
|
|
d42a06 |
END
|
|
|
d42a06 |
}
|
|
|
d42a06 |
|
|
|
d42a06 |
+
|
|
|
d42a06 |
+execute_cmd_as_role(){
|
|
|
d42a06 |
+ cmd=$1
|
|
|
d42a06 |
+ role=$2
|
|
|
d42a06 |
+ output="$(aws sts assume-role --role-arn $role --role-session-name AWSCLI-RouteTableUpdate --profile $OCF_RESKEY_profile --output=text)"
|
|
|
d42a06 |
+ export AWS_ACCESS_KEY_ID="$(echo $output | awk -F" " '$4=="CREDENTIALS" {print $5}')"
|
|
|
d42a06 |
+ export AWS_SECRET_ACCESS_KEY="$(echo $output | awk -F" " '$4=="CREDENTIALS" {print $7}')"
|
|
|
d42a06 |
+ export AWS_SESSION_TOKEN="$(echo $output | awk -F" " '$4=="CREDENTIALS" {print $8}')"
|
|
|
d42a06 |
+
|
|
|
d42a06 |
+ #Execute command
|
|
|
d42a06 |
+ ocf_log debug "Assumed Role ${role}"
|
|
|
d42a06 |
+ ocf_log debug "$(aws sts get-caller-identity)"
|
|
|
d42a06 |
+ ocf_log debug "executing command: $cmd"
|
|
|
d42a06 |
+ response="$($cmd)"
|
|
|
d42a06 |
+ unset output AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN
|
|
|
d42a06 |
+ echo $response
|
|
|
d42a06 |
+}
|
|
|
d42a06 |
+
|
|
|
d42a06 |
ec2ip_set_address_param_compat(){
|
|
|
d42a06 |
# Include backward compatibility for the deprecated address parameter
|
|
|
d42a06 |
if [ -z "$OCF_RESKEY_ip" ] && [ -n "$OCF_RESKEY_address" ]; then
|
|
|
d42a06 |
@@ -177,9 +195,14 @@ ec2ip_monitor() {
|
|
|
d42a06 |
if ocf_is_true ${OCF_RESKEY_monapi} || [ "$__OCF_ACTION" = "start" ] || ocf_is_probe; then
|
|
|
d42a06 |
for rtb in $(echo $OCF_RESKEY_routing_table | sed -e 's/,/ /g'); do
|
|
|
d42a06 |
ocf_log info "monitor: check routing table (API call) - $rtb"
|
|
|
d42a06 |
- cmd="$OCF_RESKEY_awscli --profile $OCF_RESKEY_profile --output text ec2 describe-route-tables --route-table-ids $rtb --query RouteTables[*].Routes[?DestinationCidrBlock=='$OCF_RESKEY_ip/32'].InstanceId"
|
|
|
d42a06 |
- ocf_log debug "executing command: $cmd"
|
|
|
d42a06 |
- ROUTE_TO_INSTANCE="$($cmd)"
|
|
|
d42a06 |
+ if [[ -z "${OCF_RESKEY_routing_table_role}" ]]; then
|
|
|
d42a06 |
+ cmd="$OCF_RESKEY_awscli --profile $OCF_RESKEY_profile --output text ec2 describe-route-tables --route-table-ids $rtb --query RouteTables[*].Routes[?DestinationCidrBlock=='$OCF_RESKEY_ip/32'].InstanceId"
|
|
|
d42a06 |
+ ocf_log debug "executing command: $cmd"
|
|
|
d42a06 |
+ ROUTE_TO_INSTANCE="$($cmd)"
|
|
|
d42a06 |
+ else
|
|
|
d42a06 |
+ cmd="$OCF_RESKEY_awscli --output text ec2 describe-route-tables --route-table-ids $rtb --query RouteTables[*].Routes[?DestinationCidrBlock=='$OCF_RESKEY_ip/32'].InstanceId"
|
|
|
d42a06 |
+ ROUTE_TO_INSTANCE="$(execute_cmd_as_role "$cmd" $OCF_RESKEY_routing_table_role)"
|
|
|
d42a06 |
+ fi
|
|
|
d42a06 |
ocf_log debug "Overlay IP is currently routed to ${ROUTE_TO_INSTANCE}"
|
|
|
d42a06 |
if [ -z "$ROUTE_TO_INSTANCE" ]; then
|
|
|
d42a06 |
ROUTE_TO_INSTANCE="<unknown>"
|
|
|
d42a06 |
@@ -253,9 +276,14 @@ ec2ip_get_and_configure() {
|
|
|
d42a06 |
ocf_log debug "network interface id associated MAC address ${MAC_ADDR}: ${EC2_NETWORK_INTERFACE_ID}"
|
|
|
d42a06 |
|
|
|
d42a06 |
for rtb in $(echo $OCF_RESKEY_routing_table | sed -e 's/,/ /g'); do
|
|
|
d42a06 |
- cmd="$OCF_RESKEY_awscli --profile $OCF_RESKEY_profile --output text ec2 replace-route --route-table-id $rtb --destination-cidr-block ${OCF_RESKEY_ip}/32 --network-interface-id $EC2_NETWORK_INTERFACE_ID"
|
|
|
d42a06 |
- ocf_log debug "executing command: $cmd"
|
|
|
d42a06 |
- $cmd
|
|
|
d42a06 |
+ if [[ -z "${OCF_RESKEY_routing_table_role}" ]]; then
|
|
|
d42a06 |
+ cmd="$OCF_RESKEY_awscli --profile $OCF_RESKEY_profile --output text ec2 replace-route --route-table-id $rtb --destination-cidr-block ${OCF_RESKEY_ip}/32 --network-interface-id $EC2_NETWORK_INTERFACE_ID"
|
|
|
d42a06 |
+ ocf_log debug "executing command: $cmd"
|
|
|
d42a06 |
+ $cmd
|
|
|
d42a06 |
+ else
|
|
|
d42a06 |
+ cmd="$OCF_RESKEY_awscli --output text ec2 replace-route --route-table-id $rtb --destination-cidr-block ${OCF_RESKEY_ip}/32 --network-interface-id $EC2_NETWORK_INTERFACE_ID"
|
|
|
d42a06 |
+ update_response="$(execute_cmd_as_role "$cmd" $OCF_RESKEY_routing_table_role)"
|
|
|
d42a06 |
+ fi
|
|
|
d42a06 |
rc=$?
|
|
|
d42a06 |
if [ "$rc" != 0 ]; then
|
|
|
d42a06 |
ocf_log warn "command failed, rc: $rc"
|