vpcnat Cookbook

This cookbook configures your AWS instances to enable NAT and installs heartbeat script to monitor NAT instances each other.

Requirements

• Chef (11.10 or higher)
• Berkshelf
• jq - JSON processor

AWS Credentials

In order to manage AWS components, authentication credentials need to be available to the node. There are 2 way to handle this:

1. explicitly pass credentials parameter to the resource
2. or let the resource pick up credentials from the IAM role assigned to the instance

(see : http://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html#cli-installing-credentials)

Recipes

vpcnat::default

• execute all of recipes below.

Attributes

needs all of recipe's attributes.

vpcnat::disable-source-dest-check

• disable Source/dest. check.

Attributes

nothing.

vpcnat::setup-ip-masquerading

• set '1' to net.ipv4.ip_forward using sysctl
• configure iptables and enable IP Masquerading
  • If you use this recipe on Ubuntu/Debian distribution, DO NOT install iptables-persistent package.
    /etc/init.d/iptables-persistent will overwrite the iptables rules created by this recipe.

Attributes

Key	Type	Description	Example
["vpcnat"]["ipmasq_src"]	String	IP Masquerading Source which will be allowed by iptables	10.0.0.0/16

vpcnat::setup-heartbeat-script

• install heartbeat script

Attributes

• 'subject instance' means the instance that set up by this cookbook.
• 'opposite instance' means the NAT instance to monitor heartbeat by subject instance.
• 'azname' means name of availability zone like 'us-east-1a'. These attributes are applied only when subject instance is belongs to this AZ.

Key	Type	Description	Example
['vpcnat']['az'][azname]['enabled']	Boolean (0/1)	whether to enable running heartbeat script	1
['vpcnat']['az'][azname]['opposite_primary_nat_id']	String	the ID of opposite instance	i-1234abcd
['vpcnat']['az'][azname]['opposite_rtb']	String	the ID of the route table handled by opposite instance	rtb-1234abcd
['vpcnat']['az'][azname]['target_via_checking_nat']	String	target ip which is used for monitoring heartbeat.	8.8.8.8
['vpcnat']['az'][azname]['target_via_inetgw']	String	target address which is used for testing the internet connection.	google.co.jp

Usage

Just include vpcnat in your node's run_list:

{
  "name":"my_node",
  "run_list": [
    "recipe[vpcnat]"
  ]
}

Contributing

1. Fork this repository on Github
2. Write your change (and fix my poor English!)
3. Submit a Pull Request using Github

License and Authors

• Author:: Yuki Takei (yuki@weseek.co.jp)

Copyright 2014 WESEEK, Inc.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.