heat/vFW/base_vfw.yaml

   1 heat_template_version: 2013-05-23
   2
   3 description: Heat template to deploy vFirewall demo app for OpenECOMP
   4
   5 parameters:
   6   vfw_image_name:
   7     type: string
   8     label: Image name or ID
   9     description: Image to be used for compute instance
  10   vfw_flavor_name:
  11     type: string
  12     label: Flavor
  13     description: Type of instance (flavor) to be used
  14   public_net_id:
  15     type: string
  16     label: Public network name or ID
  17     description: Public network that enables remote connection to VNF
  18   unprotected_private_net_id:
  19     type: string
  20     label: Unprotected private network name or ID
  21     description: Private network that connects vPacketGenerator with vFirewall
  22   protected_private_net_id:
  23     type: string
  24     label: Protected private network name or ID
  25     description: Private network that connects vFirewall with vSink
  26   ecomp_private_net_id:
  27     type: string
  28     label: ECOMP management network name or ID
  29     description: Private network that connects ECOMP component and the VNF
  30   ecomp_private_subnet_id:
  31     type: string
  32     label: ECOMP management sub-network name or ID
  33     description: Private sub-network that connects ECOMP component and the VNF
  34   unprotected_private_net_cidr:
  35     type: string
  36     label: Unprotected private network CIDR
  37     description: The CIDR of the unprotected private network
  38   protected_private_net_cidr:
  39     type: string
  40     label: Protected private network CIDR
  41     description: The CIDR of the protected private network
  42   ecomp_private_net_cidr:
  43     type: string
  44     label: ECOMP private network CIDR
  45     description: The CIDR of the protected private network
  46   vfw_private_ip_0:
  47     type: string
  48     label: vFirewall private IP address towards the unprotected network
  49     description: Private IP address that is assigned to the vFirewall to communicate with the vPacketGenerator
  50   vfw_private_ip_1:
  51     type: string
  52     label: vFirewall private IP address towards the protected network
  53     description: Private IP address that is assigned to the vFirewall to communicate with the vSink
  54   vfw_private_ip_2:
  55     type: string
  56     label: vFirewall private IP address towards the ECOMP management network
  57     description: Private IP address that is assigned to the vFirewall to communicate with ECOMP components
  58   vpg_private_ip_0:
  59     type: string
  60     label: vPacketGenerator private IP address towards the unprotected network
  61     description: Private IP address that is assigned to the vPacketGenerator to communicate with the vFirewall
  62   vpg_private_ip_1:
  63     type: string
  64     label: vPacketGenerator private IP address towards the ECOMP management network
  65     description: Private IP address that is assigned to the vPacketGenerator to communicate with ECOMP components
  66   vsn_private_ip_0:
  67     type: string
  68     label: vSink private IP address towards the protected network
  69     description: Private IP address that is assigned to the vSink to communicate with the vFirewall
  70   vsn_private_ip_1:
  71     type: string
  72     label: vSink private IP address towards the ECOMP management network
  73     description: Private IP address that is assigned to the vSink to communicate with ECOMP components
  74   vfw_name_0:
  75     type: string
  76     label: vFirewall name
  77     description: Name of the vFirewall
  78   vpg_name_0:
  79     type: string
  80     label: vPacketGenerator name
  81     description: Name of the vPacketGenerator
  82   vsn_name_0:
  83     type: string
  84     label: vSink name
  85     description: Name of the vSink
  86   vnf_id:
  87     type: string
  88     label: VNF ID
  89     description: The VNF ID is provided by ECOMP
  90   vf_module_id:
  91     type: string
  92     label: vFirewall module ID
  93     description: The vFirewall Module ID is provided by ECOMP
  94   dcae_collector_ip:
  95     type: string
  96     label: DCAE collector IP address
  97     description: IP address of the DCAE collector
  98   dcae_collector_port:
  99     type: string
 100     label: DCAE collector port
 101     description: Port of the DCAE collector
 102   key_name:
 103     type: string
 104     label: Key pair name
 105     description: Public/Private key pair name
 106   pub_key:
 107     type: string
 108     label: Public key
 109     description: Public key to be installed on the compute instance
 110   repo_url_blob:
 111     type: string
 112     label: Repository URL
 113     description: URL of the repository that hosts the demo packages
 114   repo_url_artifacts:
 115     type: string
 116     label: Repository URL
 117     description: URL of the repository that hosts the demo packages
 118   demo_artifacts_version:
 119     type: string
 120     label: Artifacts version used in demo vnfs
 121     description: Artifacts (jar, tar.gz) version used in demo vnfs
 122
 123 resources:
 124
 125   random-str:
 126     type: OS::Heat::RandomString
 127     properties:
 128       length: 4
 129
 130   my_keypair:
 131     type: OS::Nova::KeyPair
 132     properties:
 133       name:
 134         str_replace:
 135           template: base_rand
 136           params:
 137             base: { get_param: key_name }
 138             rand: { get_resource: random-str }
 139       public_key: { get_param: pub_key }
 140       save_private_key: false
 141
 142   unprotected_private_network:
 143     type: OS::Neutron::Net
 144     properties:
 145       name: { get_param: unprotected_private_net_id }
 146
 147   protected_private_network:
 148     type: OS::Neutron::Net
 149     properties:
 150       name: { get_param: protected_private_net_id }
 151
 152   unprotected_private_subnet:
 153     type: OS::Neutron::Subnet
 154     properties:
 155       network_id: { get_resource: unprotected_private_network }
 156       cidr: { get_param: unprotected_private_net_cidr }
 157
 158   protected_private_subnet:
 159     type: OS::Neutron::Subnet
 160     properties:
 161       network_id: { get_resource: protected_private_network }
 162       cidr: { get_param: protected_private_net_cidr }
 163
 164   vfw_0:
 165     type: OS::Nova::Server
 166     properties:
 167       image: { get_param: vfw_image_name }
 168       flavor: { get_param: vfw_flavor_name }
 169       name: { get_param: vfw_name_0 }
 170       key_name: { get_resource: my_keypair }
 171       networks:
 172         - network: { get_param: public_net_id }
 173         - port: { get_resource: vfw_private_0_port }
 174         - port: { get_resource: vfw_private_1_port }
 175         - port: { get_resource: vfw_private_2_port }
 176       metadata: {vnf_id: { get_param: vnf_id }, vf_module_id: { get_param: vf_module_id }}
 177       user_data_format: RAW
 178       user_data:
 179         str_replace:
 180           params:
 181             __dcae_collector_ip__ : { get_param: dcae_collector_ip }
 182             __dcae_collector_port__ : { get_param: dcae_collector_port }
 183             __repo_url_blob__ : { get_param: repo_url_blob }
 184             __repo_url_artifacts__ : { get_param: repo_url_artifacts }
 185             __demo_artifacts_version__ : { get_param: demo_artifacts_version }
 186           template: |
 187             #!/bin/bash
 188
 189             DCAE_COLLECTOR_IP=__dcae_collector_ip__
 190             DCAE_COLLECTOR_PORT=__dcae_collector_port__
 191             REPO_URL_BLOB=__repo_url_blob__
 192             REPO_URL_ARTIFACTS=__repo_url_artifacts__
 193             DEMO_ARTIFACTS_VERSION=__demo_artifacts_version__
 194
 195             # Download required dependencies
 196             add-apt-repository -y ppa:openjdk-r/ppa
 197             apt-get update
 198             apt-get install -y make wget openjdk-8-jdk gcc libcurl4-openssl-dev python-pip bridge-utils apt-transport-https ca-certificates
 199             apt-get install -y maven
 200             pip install jsonschema
 201
 202             # Download vFirewall code for virtual firewall
 203             mkdir /opt/config
 204             mkdir /opt/honeycomb
 205             cd /opt
 206             wget $REPO_URL_BLOB/org.openecomp.demo/vnfs/vfw/$DEMO_ARTIFACTS_VERSION/v_firewall_init.sh
 207             wget $REPO_URL_BLOB/org.openecomp.demo/vnfs/vfw/$DEMO_ARTIFACTS_VERSION/vfirewall.sh
 208
 209             mvn org.apache.maven.plugins:maven-dependency-plugin:2.10:get -DremoteRepositories=$REPO_URL_ARTIFACTS -Dartifact=org.openecomp.demo.vnf:sample-distribution:$DEMO_ARTIFACTS_VERSION:tar.gz:hc -Dtransitive=false -Ddest=.
 210             mvn org.apache.maven.plugins:maven-dependency-plugin:2.10:get -DremoteRepositories=$REPO_URL_ARTIFACTS -Dartifact=org.openecomp.demo.vnf.ves:ves:$DEMO_ARTIFACTS_VERSION:tar.gz:demo -Dtransitive=false -Ddest=.
 211             mvn org.apache.maven.plugins:maven-dependency-plugin:2.10:get -DremoteRepositories=$REPO_URL_ARTIFACTS -Dartifact=org.openecomp.demo.vnf.ves:ves_vfw_reporting:$DEMO_ARTIFACTS_VERSION:tar.gz:demo -Dtransitive=false -Ddest=.
 212
 213
 214             tar -zxvf ves-$DEMO_ARTIFACTS_VERSION-demo.tar.gz
 215             mv ves-$DEMO_ARTIFACTS_VERSION VES
 216             tar -zxvf ves_vfw_reporting-$DEMO_ARTIFACTS_VERSION-demo.tar.gz
 217             mv ves_vfw_reporting-$DEMO_ARTIFACTS_VERSION VESreporting_vFW
 218             tar -zxvf sample-distribution-$DEMO_ARTIFACTS_VERSION-hc.tar.gz
 219             mv sample-distribution-$DEMO_ARTIFACTS_VERSION honeycomb
 220             sed -i 's/"restconf-binding-address": "127.0.0.1",/"restconf-binding-address": "0.0.0.0",/g' honeycomb/sample-distribution-$DEMO_ARTIFACTS_VERSION/config/honeycomb.json
 221             mv VESreporting_vFW /opt/VES/code/evel_training/VESreporting
 222             rm *.tar.gz
 223             chmod +x v_firewall_init.sh
 224             chmod +x vfirewall.sh
 225             echo $DCAE_COLLECTOR_IP > config/dcae_collector_ip.txt
 226             echo $DCAE_COLLECTOR_PORT > config/dcae_collector_port.txt
 227             echo $DEMO_ARTIFACTS_VERSION > config/artifacts_version.txt
 228
 229             # Install VPP
 230             export UBUNTU="trusty"
 231             export RELEASE=".stable.1609"
 232             rm /etc/apt/sources.list.d/99fd.io.list
 233             echo "deb [trusted=yes] https://nexus.fd.io/content/repositories/fd.io$RELEASE.ubuntu.$UBUNTU.main/ ./" | sudo tee -a /etc/apt/sources.list.d/99fd.io.list
 234             apt-get update
 235             apt-get install -y vpp vpp-dpdk-dkms vpp-lib vpp-dbg vpp-plugins vpp-dev
 236             sleep 1
 237
 238             # Install VES
 239             cd /opt/VES/bldjobs/
 240             make clean
 241             make
 242             sleep 1
 243
 244             # Run instantiation script
 245             cd /opt
 246             mv vfirewall.sh /etc/init.d
 247             update-rc.d vfirewall.sh defaults
 248             ./v_firewall_init.sh
 249
 250   vfw_private_0_port:
 251     type: OS::Neutron::Port
 252     properties:
 253       network: { get_resource: unprotected_private_network }
 254       fixed_ips: [{"subnet": { get_resource: unprotected_private_subnet }, "ip_address": { get_param: vfw_private_ip_0 }}]
 255
 256   vfw_private_1_port:
 257     type: OS::Neutron::Port
 258     properties:
 259       network: { get_resource: protected_private_network }
 260       fixed_ips: [{"subnet": { get_resource: protected_private_subnet }, "ip_address": { get_param: vfw_private_ip_1 }}]
 261
 262   vfw_private_2_port:
 263     type: OS::Neutron::Port
 264     properties:
 265       network: { get_param: ecomp_private_net_id }
 266       fixed_ips: [{"subnet": { get_param: ecomp_private_subnet_id }, "ip_address": { get_param: vfw_private_ip_2 }}]
 267
 268   vpg_0:
 269     type: OS::Nova::Server
 270     properties:
 271       image: { get_param: vfw_image_name }
 272       flavor: { get_param: vfw_flavor_name }
 273       name: { get_param: vpg_name_0 }
 274       key_name: { get_resource: my_keypair }
 275       networks:
 276         - network: { get_param: public_net_id }
 277         - port: { get_resource: vpg_private_0_port }
 278         - port: { get_resource: vpg_private_1_port }
 279       metadata: {vnf_id: { get_param: vnf_id }, vf_module_id: { get_param: vf_module_id }}
 280       user_data_format: RAW
 281       user_data:
 282         str_replace:
 283           params:
 284             __fw_ipaddr__: { get_param: vfw_private_ip_0 }
 285             __protected_net_cidr__: { get_param: protected_private_net_cidr }
 286             __sink_ipaddr__: { get_param: vsn_private_ip_0 }
 287             __repo_url_blob__ : { get_param: repo_url_blob }
 288             __repo_url_artifacts__ : { get_param: repo_url_artifacts }
 289             __demo_artifacts_version__ : { get_param: demo_artifacts_version }
 290           template: |
 291             #!/bin/bash
 292
 293             FW_IPADDR=__fw_ipaddr__
 294             PROTECTED_NET_CIDR=__protected_net_cidr__
 295             SINK_IPADDR=__sink_ipaddr__
 296             REPO_URL_BLOB=__repo_url_blob__
 297             REPO_URL_ARTIFACTS=__repo_url_artifacts__
 298             DEMO_ARTIFACTS_VERSION=__demo_artifacts_version__
 299
 300             # Download required dependencies
 301             add-apt-repository -y ppa:openjdk-r/ppa
 302             apt-get update
 303             apt-get install -y make wget openjdk-8-jdk gcc libcurl4-openssl-dev python-pip bridge-utils apt-transport-https ca-certificates
 304             apt-get install -y maven
 305             pip install jsonschema
 306
 307             # Download vFirewall demo code for packet generator
 308             mkdir /opt/config
 309             mkdir /opt/honeycomb
 310             cd /opt
 311
 312             wget $REPO_URL_BLOB/org.openecomp.demo/vnfs/vfw/$DEMO_ARTIFACTS_VERSION/v_packetgen_init.sh
 313             wget $REPO_URL_BLOB/org.openecomp.demo/vnfs/vfw/$DEMO_ARTIFACTS_VERSION/vpacketgen.sh
 314             wget $REPO_URL_BLOB/org.openecomp.demo/vnfs/vfw/$DEMO_ARTIFACTS_VERSION/run_traffic_fw_demo.sh
 315
 316             mvn org.apache.maven.plugins:maven-dependency-plugin:2.10:get -DremoteRepositories=$REPO_URL_ARTIFACTS -Dartifact=org.openecomp.demo.vnf:sample-distribution:$DEMO_ARTIFACTS_VERSION:tar.gz:hc -Dtransitive=false -Ddest=.
 317             mvn org.apache.maven.plugins:maven-dependency-plugin:2.10:get -DremoteRepositories=$REPO_URL_ARTIFACTS -Dartifact=org.openecomp.demo.vnf.vfw:vfw_pg_streams:$DEMO_ARTIFACTS_VERSION:tar.gz:demo -Dtransitive=false -Ddest=.
 318
 319
 320             tar -zxvf sample-distribution-$DEMO_ARTIFACTS_VERSION-hc.tar.gz
 321             tar -zxvf vfw_pg_streams-$DEMO_ARTIFACTS_VERSION-demo.tar.gz
 322             mv vfw_pg_streams-$DEMO_ARTIFACTS_VERSION pg_streams
 323             mv sample-distribution-$DEMO_ARTIFACTS_VERSION honeycomb
 324             sed -i 's/"restconf-binding-address": "127.0.0.1",/"restconf-binding-address": "0.0.0.0",/g' honeycomb/sample-distribution-$DEMO_ARTIFACTS_VERSION/config/honeycomb.json
 325             rm *.tar.gz
 326             chmod +x v_packetgen_init.sh
 327             chmod +x vpacketgen.sh
 328             echo $FW_IPADDR > config/fw_ipaddr.txt
 329             echo $PROTECTED_NET_CIDR > config/protected_net_cidr.txt
 330             echo $SINK_IPADDR > config/sink_ipaddr.txt
 331             echo $DEMO_ARTIFACTS_VERSION > config/artifacts_version.txt
 332
 333             # Install VPP
 334             export UBUNTU="trusty"
 335             export RELEASE=".stable.1609"
 336             rm /etc/apt/sources.list.d/99fd.io.list
 337             echo "deb [trusted=yes] https://nexus.fd.io/content/repositories/fd.io$RELEASE.ubuntu.$UBUNTU.main/ ./" | sudo tee -a /etc/apt/sources.list.d/99fd.io.list
 338             apt-get update
 339             apt-get install -y vpp vpp-dpdk-dkms vpp-lib vpp-dbg vpp-plugins vpp-dev
 340             sleep 1
 341
 342             # Run instantiation script
 343             cd /opt
 344             mv vpacketgen.sh /etc/init.d
 345             update-rc.d vpacketgen.sh defaults
 346             ./v_packetgen_init.sh
 347
 348   vpg_private_0_port:
 349     type: OS::Neutron::Port
 350     properties:
 351       network: { get_resource: unprotected_private_network }
 352       fixed_ips: [{"subnet": { get_resource: unprotected_private_subnet }, "ip_address": { get_param: vpg_private_ip_0 }}]
 353
 354   vpg_private_1_port:
 355     type: OS::Neutron::Port
 356     properties:
 357       network: { get_param: ecomp_private_net_id }
 358       fixed_ips: [{"subnet": { get_param: ecomp_private_subnet_id }, "ip_address": { get_param: vpg_private_ip_1 }}]
 359
 360   vsn_0:
 361     type: OS::Nova::Server
 362     properties:
 363       image: { get_param: vfw_image_name }
 364       flavor: { get_param: vfw_flavor_name }
 365       name: { get_param: vsn_name_0 }
 366       key_name: { get_resource: my_keypair }
 367       networks:
 368         - network: { get_param: public_net_id }
 369         - port: { get_resource: vsn_private_0_port }
 370         - port: { get_resource: vsn_private_1_port }
 371       metadata: {vnf_id: { get_param: vnf_id }, vf_module_id: { get_param: vf_module_id }}
 372       user_data_format: RAW
 373       user_data:
 374         str_replace:
 375           params:
 376             __protected_net_gw__: { get_param: vfw_private_ip_1 }
 377             __unprotected_net__: { get_param: unprotected_private_net_cidr }
 378             __repo_url_blob__ : { get_param: repo_url_blob }
 379             __repo_url_artifacts__ : { get_param: repo_url_artifacts }
 380             __demo_artifacts_version__ : { get_param: demo_artifacts_version }
 381           template: |
 382             #!/bin/bash
 383
 384             PROTECTED_NET_GW=__protected_net_gw__
 385             UNPROTECTED_NET=__unprotected_net__
 386             UNPROTECTED_NET=$(echo $UNPROTECTED_NET | cut -d'/' -f1)
 387             REPO_URL_BLOB=__repo_url_blob__
 388             REPO_URL_ARTIFACTS=__repo_url_artifacts__
 389             DEMO_ARTIFACTS_VERSION=__demo_artifacts_version__
 390
 391             # Download required dependencies
 392             add-apt-repository -y ppa:openjdk-r/ppa
 393             apt-get update
 394             apt-get install -y make wget openjdk-8-jdk apt-transport-https ca-certificates darkstat
 395
 396             # Configure and run darkstat
 397             sed -i "s/START_DARKSTAT=.*/START_DARKSTAT=yes/g" /etc/darkstat/init.cfg
 398             sed -i "s/INTERFACE=.*/INTERFACE=\"-i eth1\"/g" /etc/darkstat/init.cfg
 399             /etc/init.d/darkstat start
 400
 401             mkdir /opt/config
 402             cd /opt
 403             wget $REPO_URL_BLOB/org.openecomp.demo/vnfs/vfw/$DEMO_ARTIFACTS_VERSION/v_sink_init.sh
 404             wget $REPO_URL_BLOB/org.openecomp.demo/vnfs/vfw/$DEMO_ARTIFACTS_VERSION/vsink.sh
 405             chmod +x v_sink_init.sh
 406             chmod +x vsink.sh
 407             echo $PROTECTED_NET_GW > config/protected_net_gw.txt
 408             echo $UNPROTECTED_NET > config/unprotected_net.txt
 409             mv vsink.sh /etc/init.d
 410             update-rc.d vsink.sh defaults
 411             ./v_sink_init.sh
 412
 413   vsn_private_0_port:
 414     type: OS::Neutron::Port
 415     properties:
 416       network: { get_resource: protected_private_network }
 417       fixed_ips: [{"subnet": { get_resource: protected_private_subnet }, "ip_address": { get_param: vsn_private_ip_0 }}]
 418
 419   vsn_private_1_port:
 420     type: OS::Neutron::Port
 421     properties:
 422       network: { get_param: ecomp_private_net_id }
 423       fixed_ips: [{"subnet": { get_param: ecomp_private_subnet_id }, "ip_address": { get_param: vsn_private_ip_1 }}]