sam
6fc92541e9
Adds the real-router BMP extension code and a redesign doc capturing
what changed in the test's intent.
scripts/router_bmp.py push/dry-run/remove `bmp server 2`
on all 18 lab routers via paramiko
SSH shell. Inventory + cred pattern
lifted from obmp-rib-poller/poller.py.
Activation scope: bmp-activate server 2
on the existing BMP-MONITORED
neighbor-group -- mirrors production.
terraform/router_bmp.tf terraform_data resource with two-step
safety (dry-run first, apply on
confirm), triggers_replace on action
change, destroy provisioner calls
`remove` (idempotent, on_failure=
continue so a stuck router doesn't
block VM teardown).
terraform/terraform.tfvars enable_router_bmp / confirm_router_push
both default false (dormant).
docs/redesign-real-routers.md captures the pivot from v1 "prove
deploy.sh works" to v2 "canary
collector receiving real router BMP".
Documents that v1 store VM OOM'd at
4 GB under the internal --profile
test feed alone, proposes 32 GB /
8 vCPU for v2 and dropping --profile
test so the collector receives ONLY
real router BMP.
State on prox940 as of this commit:
- v1 VMs (9001 store, 9002 bmpgen) destroyed via PVE API
(terraform destroy hung on the OOM'd guest agent)
- Terraform state cleaned
- Cached Ubuntu image kept for a fast next apply
- Lab routers untouched (extension code dormant)
Not yet done, awaiting user input:
- v2 sizing landed in terraform.tfvars
- Compose scope decision (add --no-feeders to deploy.sh vs
workaround in cloud-init)
- Re-apply
- Router extension dry-run + confirm
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
40 lines
1.2 KiB
HCL
40 lines
1.2 KiB
HCL
terraform {
|
|
required_version = ">= 1.5.0"
|
|
|
|
required_providers {
|
|
proxmox = {
|
|
source = "bpg/proxmox"
|
|
version = "~> 0.60"
|
|
}
|
|
random = {
|
|
source = "hashicorp/random"
|
|
version = "~> 3.6"
|
|
}
|
|
}
|
|
}
|
|
|
|
# Provider config. Endpoint and token can come from PROXMOX_VE_ENDPOINT and
|
|
# PROXMOX_VE_API_TOKEN environment variables instead of tfvars -- preferred
|
|
# for CI / shared workstations. `insecure` should be true only for a lab PVE
|
|
# that presents a self-signed cert.
|
|
provider "proxmox" {
|
|
endpoint = var.pve_endpoint
|
|
api_token = var.pve_api_token
|
|
insecure = var.pve_insecure
|
|
|
|
# SSH is used by the provider for snippet uploads (SCP, not the API --
|
|
# a known bpg quirk). Point it at the same address as the API endpoint
|
|
# rather than letting the provider guess from cluster metadata (which
|
|
# may return a bridge address that's unreachable from here).
|
|
ssh {
|
|
agent = false
|
|
username = var.pve_ssh_username
|
|
private_key = file(var.pve_ssh_private_key_path)
|
|
|
|
node {
|
|
name = var.pve_node
|
|
address = var.pve_ssh_address != "" ? var.pve_ssh_address : replace(replace(var.pve_endpoint, "https://", ""), ":8006/", "")
|
|
}
|
|
}
|
|
}
|