@@ -77,13 +77,33 @@ def openClusterJson():
7777def insert (args ):
7878 try :
7979 # Network Filter 적용
80- subprocess .run (["virsh" , "nwfilter-define" , "--file" , "/usr/local/sbin/nwfilter-allow-all.xml" ], stdout = subprocess .DEVNULL , stderr = subprocess .DEVNULL )
81- subprocess .run (["modprobe" , "br_netfilter" ], stdout = subprocess .DEVNULL , stderr = subprocess .DEVNULL )
82- with open ("/etc/sysctl.conf" , "a" ) as sysctl_file :
83- sysctl_file .write ("\n net.bridge.bridge-nf-call-arptables=1" )
84- sysctl_file .write ("\n net.bridge.bridge-nf-call-iptables=1" )
85- sysctl_file .write ("\n net.bridge.bridge-nf-call-ip6tables=1" )
80+ # 1. virsh nwfilter 확인 후 정의
81+ result = subprocess .run (["virsh" , "nwfilter-list" ], capture_output = True , text = True )
82+ if "allow-all" not in result .stdout :
83+ subprocess .run (["virsh" , "nwfilter-define" , "--file" , "/usr/local/sbin/nwfilter-allow-all.xml" ], stdout = subprocess .DEVNULL , stderr = subprocess .DEVNULL )
84+
85+ # 2. br_netfilter 모듈이 로드되지 않았으면 로드
86+ lsmod_result = subprocess .run (["lsmod" ], capture_output = True , text = True )
87+ if "br_netfilter" not in lsmod_result .stdout :
88+ subprocess .run (["modprobe" , "br_netfilter" ], stdout = subprocess .DEVNULL , stderr = subprocess .DEVNULL )
89+
90+ # 3. sysctl.conf에 설정이 없을 때만 추가
91+ settings = [
92+ "net.bridge.bridge-nf-call-arptables=1" ,
93+ "net.bridge.bridge-nf-call-iptables=1" ,
94+ "net.bridge.bridge-nf-call-ip6tables=1"
95+ ]
96+
97+ try :
98+ with open ("/etc/sysctl.conf" , "r" ) as f :
99+ existing_lines = f .read ()
100+ except FileNotFoundError :
101+ existing_lines = ""
86102
103+ with open ("/etc/sysctl.conf" , "a" ) as sysctl_file :
104+ for line in settings :
105+ if line not in existing_lines :
106+ sysctl_file .write (f"\n { line } " )
87107 subprocess .run (["sysctl" , "-p" ], stdout = subprocess .DEVNULL , stderr = subprocess .DEVNULL )
88108
89109 # 수정할 cluster.json 파일 읽어오
0 commit comments