Set up Open vSwitch 3.3 for advanced virtual machine networking with VLAN and bridge configuration

#!/usr/bin/env bash
set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Usage function
usage() {
    echo "Usage: $0 [options]"
    echo "Options:"
    echo "  --bridge-ip IP/CIDR    IP address for main bridge (default: 203.0.113.1/24)"
    echo "  --physical-int NAME    Physical interface to add to bridge (default: auto-detect)"
    echo "  --skip-physical        Skip adding physical interface to bridge"
    echo "  -h, --help            Show this help message"
    exit 1
}

# Default values
BRIDGE_IP="203.0.113.1/24"
PHYSICAL_INT=""
SKIP_PHYSICAL=false

# Parse arguments
while [[ $# -gt 0 ]]; do
    case $1 in
        --bridge-ip)
            BRIDGE_IP="$2"
            shift 2
            ;;
        --physical-int)
            PHYSICAL_INT="$2"
            shift 2
            ;;
        --skip-physical)
            SKIP_PHYSICAL=true
            shift
            ;;
        -h|--help)
            usage
            ;;
        *)
            echo -e "${RED}Unknown option: $1${NC}"
            usage
            ;;
    esac
done

# Cleanup function for rollback
cleanup() {
    echo -e "${RED}Installation failed. Cleaning up...${NC}"
    systemctl stop openvswitch-switch ovs-vswitchd ovsdb-server 2>/dev/null || true
    ovs-vsctl del-br br0 2>/dev/null || true
    ovs-vsctl del-br br-vlan 2>/dev/null || true
}

trap cleanup ERR

# Check prerequisites
if [[ $EUID -ne 0 ]]; then
    echo -e "${RED}This script must be run as root${NC}"
    exit 1
fi

# Auto-detect distribution
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            PKG_UPDATE="apt update && apt upgrade -y"
            OVS_SERVICE="openvswitch-switch"
            OVS_PACKAGES="openvswitch-switch openvswitch-common bridge-utils net-tools"
            ;;
        almalinux|rocky|centos|rhel|ol)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf update -y"
            OVS_SERVICE="openvswitch"
            OVS_PACKAGES="openvswitch bridge-utils net-tools"
            ;;
        fedora)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf update -y"
            OVS_SERVICE="openvswitch"
            OVS_PACKAGES="openvswitch bridge-utils net-tools"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            PKG_UPDATE="yum update -y"
            OVS_SERVICE="openvswitch"
            OVS_PACKAGES="openvswitch bridge-utils net-tools"
            ;;
        *)
            echo -e "${RED}Unsupported distribution: $ID${NC}"
            exit 1
            ;;
    esac
else
    echo -e "${RED}Cannot detect distribution${NC}"
    exit 1
fi

echo -e "${GREEN}Installing Open vSwitch 3.3 for VM networking${NC}"

# Step 1: Update system packages
echo -e "${YELLOW}[1/8] Updating system packages...${NC}"
$PKG_UPDATE

# Step 2: Install Open vSwitch and dependencies
echo -e "${YELLOW}[2/8] Installing Open vSwitch and dependencies...${NC}"
$PKG_INSTALL $OVS_PACKAGES

# Step 3: Enable and start Open vSwitch services
echo -e "${YELLOW}[3/8] Enabling and starting Open vSwitch services...${NC}"
systemctl enable --now $OVS_SERVICE
systemctl enable --now ovsdb-server
systemctl enable --now ovs-vswitchd

# Wait for services to be ready
sleep 2

# Step 4: Initialize Open vSwitch database
echo -e "${YELLOW}[4/8] Initializing Open vSwitch database...${NC}"
ovs-vsctl --may-exist init

# Step 5: Create virtual bridges and ports
echo -e "${YELLOW}[5/8] Creating virtual bridges...${NC}"

# Create primary bridge for VM networking
ovs-vsctl add-br br0
ovs-vsctl set bridge br0 protocols=OpenFlow10,OpenFlow13
ip link set br0 up

# Create VLAN-aware bridge
ovs-vsctl add-br br-vlan
ovs-vsctl set bridge br-vlan protocols=OpenFlow10,OpenFlow13
ip link set br-vlan up

# Auto-detect physical interface if not specified
if [[ -z "$PHYSICAL_INT" ]] && [[ "$SKIP_PHYSICAL" = false ]]; then
    PHYSICAL_INT=$(ip route | grep default | awk '{print $5}' | head -n1)
    echo -e "${YELLOW}Auto-detected physical interface: $PHYSICAL_INT${NC}"
fi

# Add physical interface to bridge if specified and not skipped
if [[ -n "$PHYSICAL_INT" ]] && [[ "$SKIP_PHYSICAL" = false ]]; then
    echo -e "${YELLOW}Adding physical interface $PHYSICAL_INT to bridge...${NC}"
    echo -e "${RED}WARNING: This may cause temporary network connectivity loss${NC}"
    sleep 3
    
    # Store current IP configuration
    CURRENT_IP=$(ip addr show $PHYSICAL_INT | grep 'inet ' | awk '{print $2}' | head -n1 || echo "")
    CURRENT_GW=$(ip route | grep default | awk '{print $3}' | head -n1 || echo "")
    
    ovs-vsctl add-port br0 $PHYSICAL_INT
    ip link set $PHYSICAL_INT up
    
    # Restore IP configuration to bridge if it existed
    if [[ -n "$CURRENT_IP" ]] && [[ -n "$CURRENT_GW" ]]; then
        ip addr flush dev $PHYSICAL_INT
        ip addr add $CURRENT_IP dev br0
        ip route add default via $CURRENT_GW dev br0
    fi
else
    # Configure bridge with specified IP
    ip addr add $BRIDGE_IP dev br0
fi

# Step 6: Configure VLAN tagging and trunking
echo -e "${YELLOW}[6/8] Configuring VLAN tagging and trunking...${NC}"

# Create VLAN access ports
ovs-vsctl add-port br-vlan vlan100 -- set port vlan100 tag=100
ovs-vsctl add-port br-vlan vlan200 -- set port vlan200 tag=200
ovs-vsctl add-port br-vlan vlan300 -- set port vlan300 tag=300

# Create VLAN trunk port
ovs-vsctl add-port br-vlan trunk0 -- set port trunk0 trunks=100,200,300,400
ovs-vsctl set port trunk0 vlan_mode=trunk

# Configure internal VLAN interfaces
ovs-vsctl add-port br-vlan vlan100-int -- set interface vlan100-int type=internal
ovs-vsctl set port vlan100-int tag=100
ip link set vlan100-int up
ip addr add 192.168.100.1/24 dev vlan100-int

ovs-vsctl add-port br-vlan vlan200-int -- set interface vlan200-int type=internal
ovs-vsctl set port vlan200-int tag=200
ip link set vlan200-int up
ip addr add 192.168.200.1/24 dev vlan200-int

# Configure VLAN native port
ovs-vsctl add-port br-vlan native100 -- set port native100 tag=100
ovs-vsctl set port native100 vlan_mode=access

# Step 7: Set up VM network integration
echo -e "${YELLOW}[7/8] Setting up VM tap interfaces...${NC}"

# Create sample TAP interfaces for VM connectivity
ip tuntap add vm1-tap0 mode tap
ovs-vsctl add-port br0 vm1-tap0
ip link set vm1-tap0 up

ip tuntap add vm2-tap0 mode tap
ovs-vsctl add-port br-vlan vm2-tap0 -- set port vm2-tap0 tag=100
ip link set vm2-tap0 up

# Step 8: Verify installation and configuration
echo -e "${YELLOW}[8/8] Verifying installation...${NC}"

# Check OVS services
if ! systemctl is-active --quiet $OVS_SERVICE ovsdb-server ovs-vswitchd; then
    echo -e "${RED}Some OVS services are not running${NC}"
    exit 1
fi

# Check bridges
if ! ovs-vsctl list-br | grep -q br0; then
    echo -e "${RED}Bridge br0 not found${NC}"
    exit 1
fi

if ! ovs-vsctl list-br | grep -q br-vlan; then
    echo -e "${RED}Bridge br-vlan not found${NC}"
    exit 1
fi

# Display configuration summary
echo -e "${GREEN}Installation completed successfully!${NC}"
echo ""
echo "Configuration Summary:"
echo "====================="
echo "Bridges created:"
ovs-vsctl list-br
echo ""
echo "Bridge br0 ports:"
ovs-vsctl list-ports br0
echo ""
echo "Bridge br-vlan ports:"
ovs-vsctl list-ports br-vlan
echo ""
echo "VLAN configuration:"
ovs-vsctl show | grep -A5 -B5 "tag\|trunk"
echo ""
echo -e "${GREEN}Open vSwitch is ready for VM networking with VLAN support${NC}"
echo -e "${YELLOW}Next steps:${NC}"
echo "1. Connect your VMs to the created tap interfaces"
echo "2. Configure VM network settings for appropriate VLANs"
echo "3. Set up routing between VLANs if needed"
echo "4. Configure firewall rules for your network topology"