terraform.tfvars

os_user = "foo"
psk = "pass1234"
fritzbox_wan_ip = "1.2.3.4"
fritzbox_cidr = "192.168.178.0/24"

terraform.tf

variable "os_user" {
  type = string
}

variable "psk" {
  type = string
}

variable "fritzbox_wan_ip" {
  type = string
}

variable "fritzbox_cidr" {
  type = string
}

data "openstack_networking_network_v2" "networking_network_1" {
  name = "${var.os_user}-net"
}

data "openstack_networking_subnet_v2" "networking_subnet_1" {
  name = "${var.os_user}-subnet"
  network_id = data.openstack_networking_network_v2.networking_network_1.id
}

data "openstack_networking_router_v2" "router_1" {
  name = "${var.os_user}-router"
}

resource "openstack_vpnaas_ike_policy_v2" "vpnaas_ike_policy_1" {
  name = "${var.os_user}-ike-aes256-sha512"
  encryption_algorithm = "aes-256"
  auth_algorithm = "sha512"
  pfs = "group2"
}

resource "openstack_vpnaas_ipsec_policy_v2" "vpnaas_ipsec_policy_1" {
  name = "${var.os_user}-ipsec-aes256-sha512"
  encryption_algorithm = "aes-256"
  auth_algorithm = "sha512"
  pfs = "group2"  
}

resource "openstack_vpnaas_service_v2" "vpnaas_service_1" {
  name = "${var.os_user}-vpn-service1"
  router_id = data.openstack_networking_router_v2.router_1.id
}

resource "openstack_vpnaas_endpoint_group_v2" "vpnaas_endpoint_group_subnet_1" {
  name = "${var.os_user}-vpn-ep-subnet"
  type = "subnet"
  endpoints = toset([data.openstack_networking_subnet_v2.networking_subnet_1.id])
}

resource "openstack_vpnaas_endpoint_group_v2" "vpnaas_endpoint_group_cidr_1" {
  name = "${var.os_user}-vpn-ep-cidr"
  type = "cidr"
  endpoints = toset([var.fritzbox_cidr])
}

resource "openstack_vpnaas_site_connection_v2" "vpnaas_site_connection" {
  name = "${var.os_user}-vpn-conn1"
  ikepolicy_id = openstack_vpnaas_ike_policy_v2.vpnaas_ike_policy_1.id
  ipsecpolicy_id = openstack_vpnaas_ipsec_policy_v2.vpnaas_ipsec_policy_1.id
  vpnservice_id = openstack_vpnaas_service_v2.vpnaas_service_1.id
  psk = var.psk
  peer_address = var.fritzbox_wan_ip
  peer_id = var.fritzbox_wan_ip
  local_ep_group_id = openstack_vpnaas_endpoint_group_v2.vpnaas_endpoint_group_subnet_1.id
  peer_ep_group_id  = openstack_vpnaas_endpoint_group_v2.vpnaas_endpoint_group_cidr_1.id
}

data "openstack_networking_secgroup_v2" "networking_secgroup_1" {
  name = "${var.os_user}-sec"
}

resource "openstack_networking_secgroup_rule_v2" "networking_secgroup_rule_1" {
  direction = "ingress"
  ethertype = "IPv4"
  protocol = "tcp"
  port_range_min = 22
  port_range_max = 22
  remote_ip_prefix = var.fritzbox_cidr
  security_group_id = data.openstack_networking_secgroup_v2.networking_secgroup_1.id
}

output "vpnaas_service_external_v4_ip" {
  value = openstack_vpnaas_service_v2.vpnaas_service_1.external_v4_ip
}

Configure connnection

terraform 0.13upgrade -yes .
terraform init
terraform plan
terraform apply -auto-approve

Fix / import already existing security group rule

Define variables for OpenStack VPN configuration

FRITZBOX_EXTERNAL_IP=x.x.x.x                    # curl ipinfo.io/ip
FRITZBOX_NETWORK=192.168.178.0/24               # Heimnetz > Netzwerk > Netzwerkeinstellungen > IPv4-Einstellungen
PASSWORD='xxxxxxxx'                             # apg -m 32
OPENSTACK_SUBNET_ID=$(openstack subnet list -c ID -f value)
OPENSTACK_ROUTER_ID=$(openstack router list -c ID -f value)

Define variables

# Create ike v1 policy
openstack vpn ike policy create vpn_ike_1 \
  --ike-version v1 \
  --encryption-algorithm aes-256 \
  --auth-algorithm sha256 \
  --pfs group14

# Create ipsec policy
openstack vpn ipsec policy create vpn_ipsec_1 \
  --encryption-algorithm aes-256 \
  --auth-algorithm sha256 \
  --pfs group14

# Create service
openstack vpn service create vpn_service_1 \
  --router ${OPENSTACK_ROUTER_ID} 

# Create local endpoint group
openstack vpn endpoint group create vpn_endpoint_openstack \
  --type subnet \
  --value ${OPENSTACK_SUBNET_ID}

# Create peer endpoint group
openstack vpn endpoint group create vpn_endpoint_fritzbox \
  --type cidr \
  --value ${FRITZBOX_NETWORK}

# Create connection
openstack vpn ipsec site connection create vpn_connection_1 \
  --vpnservice vpn_service_1 \
  --ikepolicy vpn_ike_1 \
  --ipsecpolicy vpn_ipsec_1 \
  --peer-address ${FRITZBOX_EXTERNAL_IP} \
  --peer-id ${FRITZBOX_EXTERNAL_IP} \
  --psk ${PASSWORD} \
  --local-endpoint-group vpn_endpoint_openstack \
  --peer-endpoint-group vpn_endpoint_fritzbox

Define variables for Frtizbox VPN configuration

PROJECT_ID=xxxxxxxxxxxxxxxx

# List all (except for LB, keypairs, secrets) objects in a project
openstack role add --user admin --project ${PROJECT_ID} admin
openstack project cleanup --dry-run --project ${PROJECT_ID}

# List / delete user keypair
openstack keypair list --user $(openstack role assignment list --project ${PROJECT_ID} -c user -f value | grep -v YOUR_ADMIN_UUID | sort -u) -c name -f value
# openstack keypair delete --user ${OS_USER_ID} ${OS_USER_KEYPAIR_NAME}

# List / delete loadbalancer
openstack loadbalancer list --project ${PROJECT_ID}
# openstack loadbalancer list --project ${PROJECT_ID} -c id -f value | xargs openstack loadbalancer delete --cascade

# List / delete secrets
openstack --os-project-id $PROJECT_ID secret list
openstack --os-project-id $PROJECT_ID secret list -c "Secret href" -f value | xargs -n1 openstack --os-project-id $PROJECT_ID secret delete


# Delete remaining objects in the project (run twice to remove all objects)
openstack project cleanup --project ${PROJECT_ID} --auto-approve
openstack project cleanup --project ${PROJECT_ID} --auto-approve

OLD

Find the VPN server and the relevant router UUID

# get VPN connection ID
openstack vpn ipsec site connection list | grep foo
openstack vpn ipsec site connection list --long | grep 

VPN_CONNECTION_ID=142dc25f-13bb-4fda-b093-edf13df98ed8
openstack vpn ipsec site connection show ${VPN_CONNECTION_ID}

VPN_SERVICE_ID=$(openstack vpn ipsec site connection show ${VPN_CONNECTION_ID} -c 'VPN Service' -f value)
openstack vpn service show ${VPN_SERVICE_ID}

# get router ID
ROUTER_ID=$(openstack vpn service show ${VPN_SERVICE_ID} -c Router -f value)
echo "ROUTER_ID=${ROUTER_ID}"

Find the ctl Node where the active router is running

ROUTER_PORT_ID=$(openstack port list --device-owner network:router_gateway -f value -c id --router ${ROUTER_ID})
CONTROL_NODE=$(openstack port show ${ROUTER_PORT_ID} -c binding_host_id -f value)
echo "CONTROL_NODE: ${CONTROL_NODE}"

echo "ssh ${CONTROL_NODE} sudo ip netns exec qrouter-${ROUTER_ID} ip a s"

Connect to that ctl node and "jump" in its neutron-l3-agent docker container

ssh ${CONTROL_NODE}
docker exec -u root -ti neutron_l3_agent bash

Enable file logging in strongswan configuration

Documentation
https://docs.openstack.org/python-openstackclient/latest/cli/command-objects/quota.html

Decommision control node
https://review.opendev.org/plugins/gitiles/openstack/kolla-ansible/+/refs/changes/85/758085/1/doc/source/user/adding-and-removing-hosts.rst

# Migrage VMs
SOURCE_NODE=ctl2-dev
openstack server list --all --host ${SOURCE_NODE}

# Disable DHCP agents
SOURCE_NODE=ctl2-dev
TARGET_NODE=ctl1-dev
SOURCE_DHCP_ID=$(openstack network agent list --host ${SOURCE_NODE} --agent-type dhcp -f value -c ID)
TARGET_SOURCE_DHCP_ID=$(openstack network agent list --host ${TARGET_NODE} --agent-type dhcp -f value -c ID)
openstack network list --agent $SOURCE_DHCP_ID -f value -c ID | while read network; do
    openstack network agent remove network $SOURCE_DHCP_ID $network --dhcp
    openstack network agent add network $TARGET_SOURCE_DHCP_ID $network --dhcp
done


# Network
openstack network agent list --host ${SOURCE_NODE} -c ID -f value | xargs -i openstack network agent set --disable {}
openstack network agent list --host ${SOURCE_NODE} -c ID -f value | xargs -i openstack network agent delete {}


# Compute
openstack compute service list --host ${SOURCE_NODE} -c ID -f value  | xargs -i openstack compute set --disable {}
openstack compute service list --host ${SOURCE_NODE} -c ID -f value  | xargs -i openstack compute service delete {}


# Volme
openstack volume service list --host ${SOURCE_NODE}
openstack volume service set --disable ${SOURCE_NODE} cinder-scheduler
openstack volume service set --disable ${SOURCE_NODE} cinder-backup
openstack volume service set --disable ${SOURCE_NODE} cinder-volume
openstack volume service set --disable ctl2-dev@ceph1-ec-1  cinder-volume


# ssh ${COMPUTE_HOST} docker exec -t neutron_openvswitch_agent neutron-ovs-cleanup

provider "openstack" {
  cloud = "lab-admin"
  use_octavia = true
}

# data "template_file" "user_data" {
#   template = file("user-data.txt")
# }

data "template_file" "user_data" {
  template = < /tmp/debug
EOF
}

variable "http_instance_names" {
  type = set(string)
  default = ["www1", "www2"]
}

resource "openstack_compute_instance_v2" "http" {
  for_each    = var.http_instance_names
  name        = each.key
 #name = "www${count.index + 1}"
 #count = 2
 image_name = "Ubuntu 20.04 minimal"
 flavor_name = "m1.small"
 key_pair = "lab-key"
 security_groups = ["default"]
 user_data = data.template_file.user_data.rendered

 network {
   name = "demo-net"
 }
}

data "openstack_networking_network_v2" "network_1" {
  name = "demo-net"
}

data "openstack_networking_subnet_v2" "subnet_1" {
  name = "demo-subnet"
  network_id = data.openstack_networking_network_v2.network_1.id
}

# Create loadbalancer
resource "openstack_lb_loadbalancer_v2" "http" {
  name          = "demo-lb1"
  vip_subnet_id = data.openstack_networking_subnet_v2.subnet_1.id
}

# Create listener
resource "openstack_lb_listener_v2" "http" {
  name            = "demo-lb1-http-listener"
  protocol        = "TCP"
  protocol_port   = 80
  loadbalancer_id = openstack_lb_loadbalancer_v2.http.id
  #depends_on      = [openstack_lb_loadbalancer_v2.http]

  insert_headers = {
    X-Forwarded-For = "true"
    X-Forwarded-Proto = "true"
  }
}

# Create pool
resource "openstack_lb_pool_v2" "http" {
  name        = "demo-lb1-http-pool1"
  protocol    = "TCP"
  lb_method   = "ROUND_ROBIN"
  listener_id = openstack_lb_listener_v2.http.id
  #depends_on  = [openstack_lb_listener_v2.http]
}

# Add member to pool
resource "openstack_lb_member_v2" "http1" {
  for_each      = var.http_instance_names
  address       = openstack_compute_instance_v2.http[each.key].access_ip_v4
  protocol_port = 80
  pool_id       = openstack_lb_pool_v2.http.id
  subnet_id     = data.openstack_networking_subnet_v2.subnet_1.id
  #depends_on    = [openstack_lb_pool_v2.http]
}

# Get floating IP
resource "openstack_networking_floatingip_v2" "floatingip_1" {
  pool = "public"
}

# Associate floating IP to LoadBalancer
resource "openstack_networking_floatingip_associate_v2" "floatip_1" {
  floating_ip = openstack_networking_floatingip_v2.floatingip_1.address
  port_id = openstack_lb_loadbalancer_v2.http.vip_port_id
}

output "LoadBalancer_IP" {
  value = "http://${openstack_networking_floatingip_v2.floatingip_1.address}"
}

TERMINATED_HTTPS loadbalancer