Templates to launch fully functional CVP clusters in GCP.
-
- 2.1. terraform
- 2.2. Google Cloud SDK
- 2.3. ansible
-
- 6.1. Using a
.tfvarsfile - 6.2. Using command-line variables:
- 6.1. Using a
Install terraform, ansible, gcloud SDK and use one of the provided .tfvars examples.
This module is tested with terraform 1.0.1, but should work with any terraform newer than the version shown below. You can download it from the official website.
Terraform is distributed as a single binary. Install Terraform by unzipping it and moving it to a directory included in your system's PATH.
| Name | Version |
|---|---|
| terraform | >= 0.14 |
| Name | Version |
|---|---|
| 3.74.0 | |
| local | 2.1.0 |
| random | 3.1.0 |
| tls | 3.1.0 |
| Name | Source | Version |
|---|---|---|
| cvp_cluster | ./modules/cvp-cluster | n/a |
| cvp_provision_nodes | git::https://github.com/arista-netdevops-community/cvp-ansible-provisioning.git | v3.0.6 |
You must have the Google Cloud SDK installed and authenticated. For installation details please see here. If asked Optional. Use the install script to add Cloud SDK tools to your PATH reply Yes
We suggest that you create a profile and authenticate the cli using these steps. Feel free to change cvp-profile to whatever profile name you prefer:
- Initialize your gcloud profile
$ gcloud config configurations create cvp-profile
$ gcloud config configurations activate cvp-profile
$ gcloud init- Choose [1] Re-initialize this configuration [arista-cvp] with new settings
- Select an existing project from the list or create a new project if desired. Clusters will be launched in this project. If you're trying to create a project and receives an error saying
No permission to create project in organizationyou'll need to check your permissions with your cloud administrator or use an existing project. - Choose
Ywhen asked whether to configure a default Compute Region and Zone - You can select any region. For this guide, we'll use option
8(us-central1-a)
- Get API credentials for terraform
$ gcloud auth application-default loginYou must have ansible installed for provisioning to work. You can check installation instructions here.
With the new ansible releases (ansible-core) the community.general and ansible.posix collections have to be installed separately as well:
ansible-galaxy collection install community.general
ansible-galaxy collection install ansible.posix
These steps assume that you created a profile following the steps in the gcloud client section. You must also be in the project's directory (cvp-in-gcp):
- Activate the profile:
$ gcloud config configurations activate cvp-profile- Initialize Terraform (only needed on the first run):
$ terraform init- Edit the
examples/one-node-cvp-deployment.tfvarsfile and replace with the desired values.
$ vi examples/one-node-cvp-deployment.tfvars
- Plan your full provisioning run:
$ terraform plan -out=plan.out -var-file=examples/one-node-cvp-deployment.tfvars- Review your plan
- Apply the generated plan:
terraform apply plan.out- Go have a coffee. At this point, CVP should be starting in your instance and may take some time to finish bringing all services up. You can ssh into your cvp instances with the displayed
cvp_cluster_ssh_userandcvp_cluster_nodes_ipsto check progress.
If devices are in a network that can't be reached by CVP they need to be added by configuring TerminAttr on the devices themselves (similar to any setup behind NAT). At the end of the
terraform run a suggested TerminAttr configuration line will be displayed containing the appropriate cvaddr and cvauth parameters:
Provisioning complete. To add devices use the following TerminAttr configuration:
exec /usr/bin/TerminAttr -cvaddr=34.71.81.254:9910 -cvcompression=gzip -cvauth=key,JkqAGsEyGPmUZ3X0 -smashexcludes=ale,flexCounter,hardware,kni,pulse,strata -ingestexclude=/Sysdb/cell/1/agent,/Sysdb/cell/2/agent -cvvrf=default -taillogs
The exec configuration can be copy-pasted and should be usable in most scenarios.
Note It is highly recommended to use device authentication via certificates. In case of CVP behind NAT the onboarding token would have to be manually generated. This can be done on the UI starting from 2021.2.0. In older CVP versions the token can be generated from the CLI.
To enroll with certificates the following steps can be used:
1. Generate the token on CVP CLI with curl -d '{"reenrollDevices":["*"]}' -k https://127.0.0.1:9911/cert/createtoken
2. Save the token on EOS to a file:
>enable
#copy terminal: file:/tmp/token
<paste the generated token here and press Ctrl+D>
3. Configure TerminAttr
daemon TerminAttr
exec /usr/bin/TerminAttr -cvaddr=34.71.81.254:9910 -cvcompression=gzip -cvauth=token,/tmp/token -smashexcludes=ale,flexCounter,hardware,kni,pulse,strata -ingestexclude=/Sysdb/cell/1/agent,/Sysdb/cell/2/agent -cvvrf=default -taillogs
no shutdownRequired variables are asked at runtime unless specified on the command line. Using a .tfvars file is recommended in most cases.
| Name | Description | Type | Default | Required |
|---|---|---|---|---|
| cvp_cluster_centos_version | The Centos version used by CVP instances. If not provided we'll try to choose the appropriate one based on the CVP version that's being installed. | string |
null |
no |
| cvp_cluster_name | The name of the CVP cluster. | string |
n/a | yes |
| cvp_cluster_public_eos_communication | Whether the ports used by EOS devices to communicate to CVP are publically accessible over the internet. | bool |
false |
no |
| cvp_cluster_public_management | Whether the cluster management interfaces (https/ssh) are publically accessible over the internet. | bool |
false |
no |
| cvp_cluster_size | The number of nodes in the CVP cluster. Must be 1 or 3 nodes. | number |
1 |
no |
| cvp_cluster_vm_admin_user | User that will be used to connect to CVP cluster instances. Should be used in conjunction with cvp_cluster_vm_key. | string |
"cvpsshadmin" |
no |
| cvp_cluster_vm_disk_size | The root disk size of the VMs. This must be increased to 40 if running 2021.2.0. | number |
35 |
no |
| cvp_cluster_vm_key | Public SSH key used to access instances in the CVP cluster. | string |
"~/.ssh/id_rsa.pub" |
no |
| cvp_cluster_vm_password | Password used to access instances in the CVP cluster. | string |
null |
no |
| cvp_cluster_vm_private_key | Private SSH key used to access instances in the CVP cluster. This should match the public key provided on the cvp_cluster_vm_key variable. | string |
"~/.ssh/id_rsa" |
no |
| cvp_cluster_vm_type | The type of instances used for CVP. | string |
"custom-10-20480" |
no |
| cvp_download_token | Arista Portal token used to download CVP. May be obtained on https://www.arista.com/en/users/profile under Portal Access. | string |
n/a | yes |
| cvp_enable_advanced_login_options | Whether to enable advanced login options on CVP. | bool |
false |
no |
| cvp_ingest_key | Key that will be used to authenticate devices to CVP. | string |
null |
no |
| cvp_install_size | CVP installation size. | string |
null |
no |
| cvp_k8s_cluster_network | Internal network that will be used inside the k8s cluster. Applies only to 2021.1.0+. | string |
"10.42.0.0/16" |
no |
| cvp_ntp | NTP server used to keep time synchronization between CVP nodes. | string |
"time.google.com" |
no |
| cvp_version | CVP version to install on the cluster. | string |
"2021.1.1" |
no |
| cvp_vm_image | Image used to launch VMs. The module will try to guess the best image based on the CVP version if not provided. | string |
null |
no |
| eos_ip_range | IP ranges used by EOS devices that will be managed by the CVP cluster. Should be set when cvp_cluster_public_eos_communication is set to false, otherwise, devices won't be able to communicate and stream to CVP. | list(any) |
[] |
no |
| gcp_credentials | JSON file containing GCP credentials. Leave blank to use gcloud authentication. | string |
null |
no |
| gcp_network | The network in which clusters will be launched. Leaving this blank will create a new network. | string |
null |
no |
| gcp_project_id | The name of the GCP Project where all resources will be launched. | string |
n/a | yes |
| gcp_region | The region in which all GCP resources will be launched. Must be a valid zone within the desired gcp_region. | string |
n/a | yes |
| gcp_zone | The zone in which all GCP resources will be launched. | string |
n/a | yes |
| Name | Description |
|---|---|
| cvp_instances_credentials | Public IP addresses and usernames of the cluster instances. |
| cvp_terminattr_instructions | Instructions to add EOS devices to the CVP cluster. |
Note: Before running this please replace the gcp_project_id variable in the provided example file with the correct name of your project and cvp_download_token with your Arista Portal token.
$ terraform apply -var-file=examples/one-node-cvp-deployment.tfvarsIn order to remove the environment you launched you can run the following command:
$ terraform destroy -var-file=examples/one-node-cvp-deployment.tfvarsThis command removes everything from the GCP project.
- Resizing clusters is not supported at this time.
- This module connects to the instance using the
rootuser instead of the declared user for provisioning due to limitations in the base image that's being used. If you know your way around terraform and understand what you're doing, this behavior can be changed by editing themodules/cvp-provision/main.tffile. - CVP installation size auto-discovery only works for custom instances at this time.