Fcm and firewall controller in lab

.gitignore

@@ -12,3 +12,5 @@ requirements.yaml
 .extra_vars.yaml
 sonic-vs.img
 *.bak
+server_pid.txt
+.kubeconfig_insecure

Makefile

@@ -21,15 +21,28 @@ MINI_LAB_SONIC_IMAGE := $(or $(MINI_LAB_SONIC_IMAGE),ghcr.io/metal-stack/mini-la
 MACHINE_OS=ubuntu-24.04
 MAX_RETRIES := 30
 
+
+HOSTNAME_IP := $(shell hostname -I | awk '{print $$1}')
+
+
+
+
 # Machine flavors
 ifeq ($(MINI_LAB_FLAVOR),cumulus)
 LAB_MACHINES=machine01,machine02
 LAB_TOPOLOGY=mini-lab.cumulus.yaml
 VRF=vrf20
+VM_ARGS=
 else ifeq ($(MINI_LAB_FLAVOR),sonic)
 LAB_MACHINES=machine01,machine02
 LAB_TOPOLOGY=mini-lab.sonic.yaml
 VRF=Vrf20
+VM_ARGS=
+else ifeq ($(MINI_LAB_FLAVOR),capms)
+LAB_MACHINES=machine01,machine02,machine03
+LAB_TOPOLOGY=mini-lab.capms.yaml
+VRF=Vrf20
+VM_ARGS=-e QEMU_MACHINE_CPU_CORES=2 -e QEMU_MACHINE_DISK_SIZE=20G
 else
 $(error Unknown flavor $(MINI_LAB_FLAVOR))
 endif
@@ -106,6 +119,69 @@ external_network:
 env:
 	@./env.sh
 
+configure-bgp:
+	@docker exec -it $$(docker ps -qf "name=inet") bash -c "\
+		vtysh -c 'configure terminal' \
+		      -c 'router bgp 4200000021' \
+		      -c 'network 172.17.0.0/16' \
+		      -c 'end' \
+		      -c 'write memory' \
+		      -c 'show run'"
+
+
+
+deploy-fc: configure-bgp _privatenet insecure-kubeconfig deploy-firewall-controller-manager build-firewall-controller create-firewall-image
+
+deploy-firewall-controller-manager:
+	@echo "Deploying firewall-controller-manager"
+	$(MAKE) -C ../firewall-controller-manager deploy
+
+build-firewall-controller:
+	@echo "Building firewall-controller docker image"
+	$(MAKE) -C ../firewall-controller docker
+
+firewall-metal-images:
+	@echo "Building firewall image in ../metal-images"
+	$(MAKE) -C ../metal-images firewall
+
+create-firewall-image: firewall-metal-images
+	@echo "Starting HTTP server in ../metal-images on port 8000"
+	@cd ../metal-images && python3 -m http.server 8000 &
+	@echo $$! > server_pid.txt
+	@sleep 5 # Wait for the server to start
+	@echo "Using URL: http://$(HOSTNAME_IP):8000/images/firewall/3.0-ubuntu/img.tar.lz4"
+	@metalctl image create \
+		--id firewall-ubuntu-4.0 \
+		--url http://$(HOSTNAME_IP):8000/images/firewall/3.0-ubuntu/img.tar.lz4 \
+		--features "firewall"
+
+start-server:
+	@echo "Starting HTTP server on port 8000"
+	@cd ../metal-images && python3 -m http.server 8000 & echo $$! > server_pid.txt
+	@echo "HTTP server started with PID: $$(cat server_pid.txt)"
+
+shut-down-server:
+	@if [ -f server_pid.txt ]; then \
+		PID=$$(cat server_pid.txt); \
+		if [ -n "$$PID" ] && ps -p $$PID > /dev/null 2>&1; then \
+			echo "Shutting down HTTP server with PID: $$PID"; \
+			kill $$PID && rm server_pid.txt; \
+		else \
+			echo "No running process found for PID: $$PID. Cleaning up."; \
+			rm -f server_pid.txt; \
+		fi; \
+	else \
+		echo "Error: server_pid.txt not found."; \
+	fi
+
+
+
+insecure-kubeconfig:
+	@sed -e 's/certificate-authority-data: .*/insecure-skip-tls-verify: true/' \
+	    -e 's/server: https:\/\/0.0.0.0:6443/server: https:\/\/172.17.0.1:6443/' \
+	    .kubeconfig > .kubeconfig_insecure
+	@echo "Exporting insecure kubeconfig into .kubeconfig_insecure"
+
 .PHONY: cleanup
 cleanup: cleanup-control-plane cleanup-partition
 
@@ -120,6 +196,7 @@ cleanup-partition:
 	mkdir -p clab-mini-lab
 	sudo --preserve-env $(CONTAINERLAB) destroy --topo mini-lab.cumulus.yaml
 	sudo --preserve-env $(CONTAINERLAB) destroy --topo mini-lab.sonic.yaml
+	sudo --preserve-env $(CONTAINERLAB) destroy --topo mini-lab.capms.yaml
 	docker network rm --force mini_lab_ext
 
 .PHONY: _privatenet
@@ -169,19 +246,27 @@ ssh-leaf02:
 
 .PHONY: start-machines
 start-machines:
-	docker exec vms /mini-lab/manage_vms.py --names $(LAB_MACHINES) create
+	docker exec $(VM_ARGS) vms /mini-lab/manage_vms.py --names $(LAB_MACHINES) create
+
+.PHONY: kill-machines
+kill-machines:
+	docker exec $(VM_ARGS) vms /mini-lab/manage_vms.py --names $(LAB_MACHINES) kill
 
 .PHONY: _password
 _password: env
 	docker compose run $(DOCKER_COMPOSE_RUN_ARG) metalctl machine consolepassword $(MACHINE_UUID)
 
 .PHONY: password-machine01
 password-machine01:
-	@$(MAKE)	--no-print-directory	_password	MACHINE_UUID=e0ab02d2-27cd-5a5e-8efc-080ba80cf258
+	@$(MAKE) --no-print-directory _free-machine	MACHINE_NAME=machine01 MACHINE_UUID=00000000-0000-0000-0000-000000000001
 
 .PHONY: password-machine02
 password-machine02:
-	@$(MAKE)	--no-print-directory	_password	MACHINE_UUID=2294c949-88f6-5390-8154-fa53d93a3313
+	@$(MAKE) --no-print-directory _free-machine	MACHINE_NAME=machine02 MACHINE_UUID=00000000-0000-0000-0000-000000000002
+
+.PHONY: password-machine0%
+password-machine0%:
+	@$(MAKE) --no-print-directory _free-machine	MACHINE_NAME=machine0$* MACHINE_UUID=00000000-0000-0000-0000-00000000000$*
 
 .PHONY: _free-machine
 _free-machine: env
@@ -191,11 +276,15 @@ _free-machine: env
 
 .PHONY: free-machine01
 free-machine01:
-	@$(MAKE) --no-print-directory _free-machine	MACHINE_NAME=machine01 MACHINE_UUID=e0ab02d2-27cd-5a5e-8efc-080ba80cf258
+	@$(MAKE) --no-print-directory _free-machine	MACHINE_NAME=machine01 MACHINE_UUID=00000000-0000-0000-0000-000000000001
 
 .PHONY: free-machine02
 free-machine02:
-	@$(MAKE) --no-print-directory _free-machine	MACHINE_NAME=machine02 MACHINE_UUID=2294c949-88f6-5390-8154-fa53d93a3313
+	@$(MAKE) --no-print-directory _free-machine	MACHINE_NAME=machine02 MACHINE_UUID=00000000-0000-0000-0000-000000000002
+
+.PHONY: free-machine0%
+free-machine0%:
+	@$(MAKE) --no-print-directory _free-machine	MACHINE_NAME=machine0$* MACHINE_UUID=00000000-0000-0000-0000-00000000000$*
 
 .PHONY: _console-machine
 _console-machine:
@@ -204,11 +293,15 @@ _console-machine:
 
 .PHONY: console-machine01
 console-machine01:
-	@$(MAKE) --no-print-directory _console-machine	CONSOLE_PORT=4000
+	@$(MAKE) --no-print-directory _console-machine	CONSOLE_PORT=4001
 
 .PHONY: console-machine02
 console-machine02:
-	@$(MAKE) --no-print-directory _console-machine	CONSOLE_PORT=4001
+	@$(MAKE) --no-print-directory _console-machine	CONSOLE_PORT=4002
+
+.PHONY: console-machine0%
+console-machine0%:
+	@$(MAKE) --no-print-directory _console-machine	CONSOLE_PORT=400$*
 
 ## SSH TARGETS FOR MACHINES ##
 # Python code could be replaced by jq, but it is not preinstalled on Cumulus