tip:蓝色部分为在rhle7上运行的runlist
1 部署vpn-server，并生成client配置和证书
1.1 编写并上传cookbook
# knife upload <cookbook_name>
1.2 客户在draas平台配置参数
proto: udp
port: 1194
subnet: 10.0.11.0 //桥接网络
shared: False // or True
1.3 形成environmentAttributes
{
"openvpn": {
"port": "1194",
"proto": "udp",
"shared": "False",
"netmask": "255.255.255.0", //用户定义的subnet的子网掩码
"lowaddr": "10.0.11.3", //用户定义的subnet的主机号范围
"highaddr": "10.0.11.253",
"ip": "", //虚机内网ip地址，暂时为空
"broadcast": "10.0.1.255", //subnet的广播地址
"gateway": "", //虚机公网ip地址，暂时为空
"routes": ["route 10.0.1.0 255.255.255.0","route 10.0.2.0 255.255.255.0"], //列入该租户所有子网信息
"client": ["client4","client5","client6"], //client证书名
}
}
1.4 创建虚机，返回内网ip地址填入"ip"字段，floating ip填入"gateway"字段
1.5 把虚机纳入管理（bootstrap）
# knife bootstrap -N <node_name> <node_ip> -p <port> -x <username> -P <password>
// bootStrapByPassWord(nodeName vm-vpn,nodeIp 10.0.11.111,nodeRootName root,nodePassWord Passw0rd)
// bootStrapByKey
1.6 编辑runlist，创建environment
设置runlist为openvpn cookbook中recipes中的stop.rb，default.rb和users.rb：
# knife node run_list set vpnserver "recipe[openvpn::stop]" "recipe[openvpn]" "recipe[openvpn::users]"
# knife node run_list set vpnserver "recipe[openvpn::stop_7]" "recipe[openvpn::default_7]" "recipe[openvpn::users]"
# knife environment create <env_name> -d
# knife environment from file vpn.json -d
# knife node environment_set <node_name> <env_name>
// CreateNodeAndRun(nodeName vm-vpn,runList ["recipe[openvpn::stop]","recipe[openvpn]","recipe[openvpn::users]"],environmentAttributes)
// CreateNodeAndRun(nodeName vm-vpn,runList ["recipe[openvpn::stop_7]","recipe[openvpn::default_7]","recipe[openvpn::users]"],environmentAttributes)
1.7 执行chef-client：
# knife ssh 172.21.0.41 ‘sudo chef-client‘ -p 12345 -u root -P 000000 -m
// autoRunByPassword(nodeName vm-vpn)
2 修改vpn-server
2.1 编写并上传cookbook
2.2 形成environmentAttributes
{
"openvpn": {
"port": "1194",
"proto": "udp",
"shared": "False",
"type": "server-bridge", //默认桥接
"netmask": "255.255.255.0", //用户定义的subnet的子网掩码
"lowaddr": "10.0.11.3", //用户定义的subnet的主机号范围
"highaddr": "10.0.11.253",
"ip": "10.0.11.126",
"broadcast": "10.0.1.255", //subnet的广播地址
"gateway": "10.0.11.126", //虚机浮动ip地址
"routes": ["route 10.0.1.0 255.255.255.0","route 10.0.2.0 255.255.255.0"], //列入该租户所有子网信息
}
}
2.3 编辑runlist,更新environment
设置runlist为openvpn cookbook中recipes中的stop.rb和default.rb：
# knife node run_list set vpnserver "recipe[openvpn::stop]" "recipe[openvpn]"
# knife node run_list set vpnserver "recipe[openvpn::stop_7]" "recipe[openvpn::default_7]"
// CreateNodeAndRun(nodeName vm-vpn,runList ["recipe[openvpn::stop]","recipe[openvpn]","recipe[openvpn::users]"],environmentAttributes)
// CreateNodeAndRun(nodeName vm-vpn,runList ["recipe[openvpn::stop_7]","recipe[openvpn::default_7]","recipe[openvpn::users]"],environmentAttributes)
2.4 执行chef-client
3 删除vpn-server
关闭vpn服务，吊销所有证书，包括根证书，服务器证书以及所有客户端证书
3.1 编写并上传cookbook
3.2 编辑runlist,更新environment：
设置runlist为openvpn cookbook中recipes中的delete.rb：
# knife node run_list set vpnserver "recipe[openvpn::delete]"
3.3 执行chef-client
4 新增vpn-client
4.1 编写并上传cookbook
4.2 形成environmentAttributes：
{
"openvpn": {
"client": ["client7","client8","client9"] //客户证书信息
}
}
4.3 编辑runlist,更新environment：
设置runlist为openvpn cookbook中recipes中的users.rb：
# knife node run_list set vpnserver "recipe[openvpn::users]"
// CreateNodeAndRun(nodeName vm-vpn,runList ["recipe[openvpn::users]",environmentAttributes)
4.4 执行chef-client
5 吊销vpn-client
5.1 编写并上传cookbook
5.2 形成environmentAttributes：
{
"openvpn": {
"revoke": ["client8","client9"] //要吊销的证书名
}
}
5.3 编辑runlist,更新environment：
设置runlist为openvpn cookbook中recipes中的revoke.rb：
# knife node run_list set vpnserver "recipe[openvpn::revoke]"
# knife node run_list set vpnserver "recipe[openvpn::revoke_7]"
// CreateNodeAndRun(nodeName vm-vpn,runList ["recipe[openvpn::revoke]",environmentAttributes)
// CreateNodeAndRun(nodeName vm-vpn,runList ["recipe[openvpn::revoke_7]",environmentAttributes)