heat/vFW/base_vfw.yaml

   1 heat_template_version: 2013-05-23
   2
   3 description: Heat template to deploy vFirewall demo app for OpenECOMP
   4
   5 parameters:
   6   vfw_image_name:
   7     type: string
   8     label: Image name or ID
   9     description: Image to be used for compute instance
  10   vfw_flavor_name:
  11     type: string
  12     label: Flavor
  13     description: Type of instance (flavor) to be used
  14   public_net_id:
  15     type: string
  16     label: Public network name or ID
  17     description: Public network that enables remote connection to VNF
  18   unprotected_private_net_id:
  19     type: string
  20     label: Unprotected private network name or ID
  21     description: Private network that connects vPacketGenerator with vFirewall
  22   protected_private_net_id:
  23     type: string
  24     label: Protected private network name or ID
  25     description: Private network that connects vFirewall with vSink
  26   ecomp_private_net_id:
  27     type: string
  28     label: ECOMP management network name or ID
  29     description: Private network that connects ECOMP component and the VNF
  30   ecomp_private_subnet_id:
  31     type: string
  32     label: ECOMP management sub-network name or ID
  33     description: Private sub-network that connects ECOMP component and the VNF
  34   unprotected_private_net_cidr:
  35     type: string
  36     label: Unprotected private network CIDR
  37     description: The CIDR of the unprotected private network
  38   protected_private_net_cidr:
  39     type: string
  40     label: Protected private network CIDR
  41     description: The CIDR of the protected private network
  42   ecomp_private_net_cidr:
  43     type: string
  44     label: ECOMP private network CIDR
  45     description: The CIDR of the protected private network
  46   vfw_private_ip_0:
  47     type: string
  48     label: vFirewall private IP address towards the unprotected network
  49     description: Private IP address that is assigned to the vFirewall to communicate with the vPacketGenerator
  50   vfw_private_ip_1:
  51     type: string
  52     label: vFirewall private IP address towards the protected network
  53     description: Private IP address that is assigned to the vFirewall to communicate with the vSink
  54   vfw_private_ip_2:
  55     type: string
  56     label: vFirewall private IP address towards the ECOMP management network
  57     description: Private IP address that is assigned to the vFirewall to communicate with ECOMP components
  58   vpg_private_ip_0:
  59     type: string
  60     label: vPacketGenerator private IP address towards the unprotected network
  61     description: Private IP address that is assigned to the vPacketGenerator to communicate with the vFirewall
  62   vpg_private_ip_1:
  63     type: string
  64     label: vPacketGenerator private IP address towards the ECOMP management network
  65     description: Private IP address that is assigned to the vPacketGenerator to communicate with ECOMP components
  66   vsn_private_ip_0:
  67     type: string
  68     label: vSink private IP address towards the protected network
  69     description: Private IP address that is assigned to the vSink to communicate with the vFirewall
  70   vsn_private_ip_1:
  71     type: string
  72     label: vSink private IP address towards the ECOMP management network
  73     description: Private IP address that is assigned to the vSink to communicate with ECOMP components
  74   vfw_name_0:
  75     type: string
  76     label: vFirewall name
  77     description: Name of the vFirewall
  78   vpg_name_0:
  79     type: string
  80     label: vPacketGenerator name
  81     description: Name of the vPacketGenerator
  82   vsn_name_0:
  83     type: string
  84     label: vSink name
  85     description: Name of the vSink
  86   vnf_id:
  87     type: string
  88     label: VNF ID
  89     description: The VNF ID is provided by ECOMP
  90   vf_module_id:
  91     type: string
  92     label: vFirewall module ID
  93     description: The vFirewall Module ID is provided by ECOMP
  94   dcae_collector_ip:
  95     type: string
  96     label: DCAE collector IP address
  97     description: IP address of the DCAE collector
  98   dcae_collector_port:
  99     type: string
 100     label: DCAE collector port
 101     description: Port of the DCAE collector
 102   key_name:
 103     type: string
 104     label: Key pair name
 105     description: Public/Private key pair name
 106   pub_key:
 107     type: string
 108     label: Public key
 109     description: Public key to be installed on the compute instance
 110   repo_url_blob:
 111     type: string
 112     label: Repository URL
 113     description: URL of the repository that hosts the demo packages
 114   repo_url_artifacts:
 115     type: string
 116     label: Repository URL
 117     description: URL of the repository that hosts the demo packages
 118   demo_artifacts_version:
 119     type: string
 120     label: Artifacts version used in demo vnfs
 121     description: Artifacts (jar, tar.gz) version used in demo vnfs
 122
 123 resources:
 124
 125   random-str:
 126     type: OS::Heat::RandomString
 127     properties:
 128       length: 4
 129
 130   my_keypair:
 131     type: OS::Nova::KeyPair
 132     properties:
 133       name:
 134         str_replace:
 135           template: base_rand
 136           params:
 137             base: { get_param: key_name }
 138             rand: { get_resource: random-str }
 139       public_key: { get_param: pub_key }
 140       save_private_key: false
 141
 142   unprotected_private_network:
 143     type: OS::Neutron::Net
 144     properties:
 145       name: { get_param: unprotected_private_net_id }
 146
 147   protected_private_network:
 148     type: OS::Neutron::Net
 149     properties:
 150       name: { get_param: protected_private_net_id }
 151
 152   unprotected_private_subnet:
 153     type: OS::Neutron::Subnet
 154     properties:
 155       network_id: { get_resource: unprotected_private_network }
 156       cidr: { get_param: unprotected_private_net_cidr }
 157
 158   protected_private_subnet:
 159     type: OS::Neutron::Subnet
 160     properties:
 161       network_id: { get_resource: protected_private_network }
 162       cidr: { get_param: protected_private_net_cidr }
 163
 164   vfw_0:
 165     type: OS::Nova::Server
 166     properties:
 167       image: { get_param: vfw_image_name }
 168       flavor: { get_param: vfw_flavor_name }
 169       name: { get_param: vfw_name_0 }
 170       key_name: { get_resource: my_keypair }
 171       networks:
 172         - network: { get_param: public_net_id }
 173         - port: { get_resource: vfw_private_0_port }
 174         - port: { get_resource: vfw_private_1_port }
 175         - port: { get_resource: vfw_private_2_port }
 176       metadata: {vnf_id: { get_param: vnf_id }, vf_module_id: { get_param: vf_module_id }}
 177       user_data_format: RAW
 178       user_data:
 179         str_replace:
 180           params:
 181             __dcae_collector_ip__ : { get_param: dcae_collector_ip }
 182             __dcae_collector_port__ : { get_param: dcae_collector_port }
 183             __repo_url_blob__ : { get_param: repo_url_blob }
 184             __repo_url_artifacts__ : { get_param: repo_url_artifacts }
 185             __demo_artifacts_version__ : { get_param: demo_artifacts_version }
 186           template: |
 187             #!/bin/bash
 188
 189             DCAE_COLLECTOR_IP=__dcae_collector_ip__
 190             DCAE_COLLECTOR_PORT=__dcae_collector_port__
 191             REPO_URL_BLOB=__repo_url_blob__
 192             REPO_URL_ARTIFACTS=__repo_url_artifacts__
 193             DEMO_ARTIFACTS_VERSION=__demo_artifacts_version__
 194
 195             # Download required dependencies
 196             add-apt-repository -y ppa:openjdk-r/ppa
 197             apt-get update
 198             apt-get install -y make wget openjdk-8-jdk gcc libcurl4-openssl-dev python-pip bridge-utils apt-transport-https ca-certificates
 199             apt-get install -y maven
 200             pip install jsonschema
 201
 202             # Download vFirewall code for virtual firewall
 203             mkdir /opt/config
 204             mkdir /opt/honeycomb
 205             cd /opt
 206             wget $REPO_URL_BLOB/org.openecomp.demo/vnfs/vfw/$DEMO_ARTIFACTS_VERSION/v_firewall_init.sh
 207             wget $REPO_URL_BLOB/org.openecomp.demo/vnfs/vfw/$DEMO_ARTIFACTS_VERSION/vfirewall.sh
 208
 209             mvn org.apache.maven.plugins:maven-dependency-plugin:2.10:get -DremoteRepositories=$REPO_URL_ARTIFACTS -Dartifact=org.openecomp.demo.vnf:sample-distribution:$DEMO_ARTIFACTS_VERSION:tar.gz:hc -Dtransitive=false -Ddest=.
 210             mvn org.apache.maven.plugins:maven-dependency-plugin:2.10:get -DremoteRepositories=$REPO_URL_ARTIFACTS -Dartifact=org.openecomp.demo.vnf.ves:ves:$DEMO_ARTIFACTS_VERSION:tar.gz:demo -Dtransitive=false -Ddest=.
 211             mvn org.apache.maven.plugins:maven-dependency-plugin:2.10:get -DremoteRepositories=$REPO_URL_ARTIFACTS -Dartifact=org.openecomp.demo.vnf.ves:ves_vfw_reporting:$DEMO_ARTIFACTS_VERSION:tar.gz:demo -Dtransitive=false -Ddest=.
 212
 213             tar -zxvf ves-$DEMO_ARTIFACTS_VERSION-demo.tar.gz
 214             mv ves-$DEMO_ARTIFACTS_VERSION VES
 215             tar -zxvf ves_vfw_reporting-$DEMO_ARTIFACTS_VERSION-demo.tar.gz
 216             mv ves_vfw_reporting-$DEMO_ARTIFACTS_VERSION VESreporting_vFW
 217             tar -zxvf sample-distribution-$DEMO_ARTIFACTS_VERSION-hc.tar.gz
 218             mv sample-distribution-$DEMO_ARTIFACTS_VERSION honeycomb
 219             sed -i 's/"restconf-binding-address": "127.0.0.1",/"restconf-binding-address": "0.0.0.0",/g' honeycomb/sample-distribution-$DEMO_ARTIFACTS_VERSION/config/honeycomb.json
 220             mv VESreporting_vFW /opt/VES/code/evel_training/VESreporting
 221             rm *.tar.gz
 222             chmod +x v_firewall_init.sh
 223             chmod +x vfirewall.sh
 224             echo $DCAE_COLLECTOR_IP > config/dcae_collector_ip.txt
 225             echo $DCAE_COLLECTOR_PORT > config/dcae_collector_port.txt
 226             echo $DEMO_ARTIFACTS_VERSION > config/artifacts_version.txt
 227
 228             # Install VPP
 229             export UBUNTU="trusty"
 230             export RELEASE=".stable.1609"
 231             rm /etc/apt/sources.list.d/99fd.io.list
 232             echo "deb [trusted=yes] https://nexus.fd.io/content/repositories/fd.io$RELEASE.ubuntu.$UBUNTU.main/ ./" | sudo tee -a /etc/apt/sources.list.d/99fd.io.list
 233             apt-get update
 234             apt-get install -y vpp vpp-dpdk-dkms vpp-lib vpp-dbg vpp-plugins vpp-dev
 235             sleep 1
 236
 237             # Install VES
 238             cd /opt/VES/bldjobs/
 239             make clean
 240             make
 241             sleep 1
 242
 243             # Run instantiation script
 244             cd /opt
 245             mv vfirewall.sh /etc/init.d
 246             update-rc.d vfirewall.sh defaults
 247             ./v_firewall_init.sh
 248
 249   vfw_private_0_port:
 250     type: OS::Neutron::Port
 251     properties:
 252       network: { get_resource: unprotected_private_network }
 253       fixed_ips: [{"subnet": { get_resource: unprotected_private_subnet }, "ip_address": { get_param: vfw_private_ip_0 }}]
 254
 255   vfw_private_1_port:
 256     type: OS::Neutron::Port
 257     properties:
 258       network: { get_resource: protected_private_network }
 259       fixed_ips: [{"subnet": { get_resource: protected_private_subnet }, "ip_address": { get_param: vfw_private_ip_1 }}]
 260
 261   vfw_private_2_port:
 262     type: OS::Neutron::Port
 263     properties:
 264       network: { get_param: ecomp_private_net_id }
 265       fixed_ips: [{"subnet": { get_param: ecomp_private_subnet_id }, "ip_address": { get_param: vfw_private_ip_2 }}]
 266
 267   vpg_0:
 268     type: OS::Nova::Server
 269     properties:
 270       image: { get_param: vfw_image_name }
 271       flavor: { get_param: vfw_flavor_name }
 272       name: { get_param: vpg_name_0 }
 273       key_name: { get_resource: my_keypair }
 274       networks:
 275         - network: { get_param: public_net_id }
 276         - port: { get_resource: vpg_private_0_port }
 277         - port: { get_resource: vpg_private_1_port }
 278       metadata: {vnf_id: { get_param: vnf_id }, vf_module_id: { get_param: vf_module_id }}
 279       user_data_format: RAW
 280       user_data:
 281         str_replace:
 282           params:
 283             __fw_ipaddr__: { get_param: vfw_private_ip_0 }
 284             __protected_net_cidr__: { get_param: protected_private_net_cidr }
 285             __sink_ipaddr__: { get_param: vsn_private_ip_0 }
 286             __repo_url_blob__ : { get_param: repo_url_blob }
 287             __repo_url_artifacts__ : { get_param: repo_url_artifacts }
 288             __demo_artifacts_version__ : { get_param: demo_artifacts_version }
 289           template: |
 290             #!/bin/bash
 291
 292             FW_IPADDR=__fw_ipaddr__
 293             PROTECTED_NET_CIDR=__protected_net_cidr__
 294             SINK_IPADDR=__sink_ipaddr__
 295             REPO_URL_BLOB=__repo_url_blob__
 296             REPO_URL_ARTIFACTS=__repo_url_artifacts__
 297             DEMO_ARTIFACTS_VERSION=__demo_artifacts_version__
 298
 299             # Download required dependencies
 300             add-apt-repository -y ppa:openjdk-r/ppa
 301             apt-get update
 302             apt-get install -y make wget openjdk-8-jdk gcc libcurl4-openssl-dev python-pip bridge-utils apt-transport-https ca-certificates
 303             apt-get install -y maven
 304             pip install jsonschema
 305
 306             # Download vFirewall demo code for packet generator
 307             mkdir /opt/config
 308             mkdir /opt/honeycomb
 309             cd /opt
 310
 311             wget $REPO_URL_BLOB/org.openecomp.demo/vnfs/vfw/$DEMO_ARTIFACTS_VERSION/v_packetgen_init.sh
 312             wget $REPO_URL_BLOB/org.openecomp.demo/vnfs/vfw/$DEMO_ARTIFACTS_VERSION/vpacketgen.sh
 313             wget $REPO_URL_BLOB/org.openecomp.demo/vnfs/vfw/$DEMO_ARTIFACTS_VERSION/run_traffic_fw_demo.sh
 314
 315             mvn org.apache.maven.plugins:maven-dependency-plugin:2.10:get -DremoteRepositories=$REPO_URL_ARTIFACTS -Dartifact=org.openecomp.demo.vnf:sample-distribution:$DEMO_ARTIFACTS_VERSION:tar.gz:hc -Dtransitive=false -Ddest=.
 316             mvn org.apache.maven.plugins:maven-dependency-plugin:2.10:get -DremoteRepositories=$REPO_URL_ARTIFACTS -Dartifact=org.openecomp.demo.vnf.vfw:vfw_pg_streams:$DEMO_ARTIFACTS_VERSION:tar.gz:demo -Dtransitive=false -Ddest=.
 317
 318
 319             tar -zxvf sample-distribution-$DEMO_ARTIFACTS_VERSION-hc.tar.gz
 320             tar -zxvf vfw_pg_streams-$DEMO_ARTIFACTS_VERSION-demo.tar.gz
 321             mv vfw_pg_streams-$DEMO_ARTIFACTS_VERSION pg_streams
 322             mv sample-distribution-$DEMO_ARTIFACTS_VERSION honeycomb
 323             sed -i 's/"restconf-binding-address": "127.0.0.1",/"restconf-binding-address": "0.0.0.0",/g' honeycomb/sample-distribution-$DEMO_ARTIFACTS_VERSION/config/honeycomb.json
 324             rm *.tar.gz
 325             chmod +x v_packetgen_init.sh
 326             chmod +x vpacketgen.sh
 327             echo $FW_IPADDR > config/fw_ipaddr.txt
 328             echo $PROTECTED_NET_CIDR > config/protected_net_cidr.txt
 329             echo $SINK_IPADDR > config/sink_ipaddr.txt
 330             echo $DEMO_ARTIFACTS_VERSION > config/artifacts_version.txt
 331
 332             # Install VPP
 333             export UBUNTU="trusty"
 334             export RELEASE=".stable.1609"
 335             rm /etc/apt/sources.list.d/99fd.io.list
 336             echo "deb [trusted=yes] https://nexus.fd.io/content/repositories/fd.io$RELEASE.ubuntu.$UBUNTU.main/ ./" | sudo tee -a /etc/apt/sources.list.d/99fd.io.list
 337             apt-get update
 338             apt-get install -y vpp vpp-dpdk-dkms vpp-lib vpp-dbg vpp-plugins vpp-dev
 339             sleep 1
 340
 341             # Run instantiation script
 342             cd /opt
 343             mv vpacketgen.sh /etc/init.d
 344             update-rc.d vpacketgen.sh defaults
 345             ./v_packetgen_init.sh
 346
 347   vpg_private_0_port:
 348     type: OS::Neutron::Port
 349     properties:
 350       network: { get_resource: unprotected_private_network }
 351       fixed_ips: [{"subnet": { get_resource: unprotected_private_subnet }, "ip_address": { get_param: vpg_private_ip_0 }}]
 352
 353   vpg_private_1_port:
 354     type: OS::Neutron::Port
 355     properties:
 356       network: { get_param: ecomp_private_net_id }
 357       fixed_ips: [{"subnet": { get_param: ecomp_private_subnet_id }, "ip_address": { get_param: vpg_private_ip_1 }}]
 358
 359   vsn_0:
 360     type: OS::Nova::Server
 361     properties:
 362       image: { get_param: vfw_image_name }
 363       flavor: { get_param: vfw_flavor_name }
 364       name: { get_param: vsn_name_0 }
 365       key_name: { get_resource: my_keypair }
 366       networks:
 367         - network: { get_param: public_net_id }
 368         - port: { get_resource: vsn_private_0_port }
 369         - port: { get_resource: vsn_private_1_port }
 370       metadata: {vnf_id: { get_param: vnf_id }, vf_module_id: { get_param: vf_module_id }}
 371       user_data_format: RAW
 372       user_data:
 373         str_replace:
 374           params:
 375             __protected_net_gw__: { get_param: vfw_private_ip_1 }
 376             __unprotected_net__: { get_param: unprotected_private_net_cidr }
 377             __repo_url_blob__ : { get_param: repo_url_blob }
 378             __repo_url_artifacts__ : { get_param: repo_url_artifacts }
 379             __demo_artifacts_version__ : { get_param: demo_artifacts_version }
 380           template: |
 381             #!/bin/bash
 382
 383             PROTECTED_NET_GW=__protected_net_gw__
 384             UNPROTECTED_NET=__unprotected_net__
 385             UNPROTECTED_NET=$(echo $UNPROTECTED_NET | cut -d'/' -f1)
 386             REPO_URL_BLOB=__repo_url_blob__
 387             REPO_URL_ARTIFACTS=__repo_url_artifacts__
 388             DEMO_ARTIFACTS_VERSION=__demo_artifacts_version__
 389
 390             # Download required dependencies
 391             add-apt-repository -y ppa:openjdk-r/ppa
 392             apt-get update
 393             apt-get install -y make wget openjdk-8-jdk apt-transport-https ca-certificates darkstat
 394
 395             # Configure and run darkstat
 396             sed -i "s/START_DARKSTAT=.*/START_DARKSTAT=yes/g" /etc/darkstat/init.cfg
 397             sed -i "s/INTERFACE=.*/INTERFACE=\"-i eth1\"/g" /etc/darkstat/init.cfg
 398             /etc/init.d/darkstat start
 399
 400             mkdir /opt/config
 401             cd /opt
 402             wget $REPO_URL_BLOB/org.openecomp.demo/vnfs/vfw/$DEMO_ARTIFACTS_VERSION/v_sink_init.sh
 403             wget $REPO_URL_BLOB/org.openecomp.demo/vnfs/vfw/$DEMO_ARTIFACTS_VERSION/vsink.sh
 404             chmod +x v_sink_init.sh
 405             chmod +x vsink.sh
 406             echo $PROTECTED_NET_GW > config/protected_net_gw.txt
 407             echo $UNPROTECTED_NET > config/unprotected_net.txt
 408             mv vsink.sh /etc/init.d
 409             update-rc.d vsink.sh defaults
 410             ./v_sink_init.sh
 411
 412   vsn_private_0_port:
 413     type: OS::Neutron::Port
 414     properties:
 415       network: { get_resource: protected_private_network }
 416       fixed_ips: [{"subnet": { get_resource: protected_private_subnet }, "ip_address": { get_param: vsn_private_ip_0 }}]
 417
 418   vsn_private_1_port:
 419     type: OS::Neutron::Port
 420     properties:
 421       network: { get_param: ecomp_private_net_id }
 422       fixed_ips: [{"subnet": { get_param: ecomp_private_subnet_id }, "ip_address": { get_param: vsn_private_ip_1 }}]