mcpcontrol: policy based routing for INSTALLER_IP

To bypass Docker 'bridge'-backed network isolation, we previously
added an extra routing hop, which broke access from inside the
'mcpcontrol' Docker network (typically 10.20.0.0/24) to its
bridge address (10.20.0.1), leading to DNS issues on Salt Master.

This change leverages policy based routing to only add the extra
routing hop for connections originating from the default Docker
bridge network ('docker0'). Note that other Docker networks
using the 'bridge' driver are still isolated from 'mcpcontrol'.

Fixes: d9b44acb

Change-Id: Ib92901c3278ae9b815f28f26d4c26f82bcadacd6
Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>

diff --git a/mcp/scripts/lib_jump_deploy.sh b/mcp/scripts/lib_jump_deploy.sh
index 8b7f6a5..b7fe4c7 100644 (file)
--- a/mcp/scripts/lib_jump_deploy.sh
+++ b/mcp/scripts/lib_jump_deploy.sh
@@ -329,7 +329,8 @@ function create_networks {
        ExecStart=/bin/sh -ec '\
          ${PREFIX}/brctl addif ${all_vnode_networks[0]} veth_mcp0 && \
          ${PREFIX}/brctl addif ${all_vnode_networks[1]} veth_mcp2 && \
-         ${PREFIX}/ip route add ${SALT_MASTER} dev ${all_vnode_networks[0]}'
+         ${PREFIX}/ip rule add to ${SALT_MASTER} iif docker0 table 200 && \
+         ${PREFIX}/ip route add ${SALT_MASTER} dev ${all_vnode_networks[0]} table 200'
        EOF
   sudo ln -sf "${FUEL_VETHC_SERVICE}" "/etc/systemd/system/multi-user.target.wants/"
   sudo ln -sf "${FUEL_VETHA_SERVICE}" "/etc/systemd/system/multi-user.target.wants/"