Run puppet-lint

Needed if taking over packets for a connection that was established via
another node.

global/overlay/etc/puppet/modules/cdn/manifests/l4lb.pp

@@ -20,24 +20,38 @@ class cdn::l4lb(
   package {'bird2': ensure => installed }
 
   file { '/opt/sunet-cdn':
-    ensure  => directory,
+    ensure => directory,
-    owner   => 'root',
+    owner  => 'root',
-    group   => 'root',
+    group  => 'root',
-    mode    => '0640',
+    mode   => '0640',
   }
 
+  $sysctl_file = '/etc/sysctl.d/99-cdn-l4lb.conf'
+    file { $sysctl_file:
+      ensure  => file,
+      owner   => 'root',
+      group   => 'root',
+      mode    => '0644',
+      content => template('cdn/l4lb/sysctl.erb'),
+    }
+    # Load the sysctl file if it has changed
+    exec { "sysctl -p ${sysctl_file}":
+      subscribe   => File[$sysctl_file],
+      refreshonly => true,
+    }
+
   file { '/opt/sunet-cdn/l4lb':
-    ensure  => directory,
+    ensure => directory,
-    owner   => 'root',
+    owner  => 'root',
-    group   => 'root',
+    group  => 'root',
-    mode    => '0640',
+    mode   => '0640',
   }
 
   file { '/opt/sunet-cdn/l4lb/conf':
-    ensure  => directory,
+    ensure => directory,
-    owner   => 'root',
+    owner  => 'root',
-    group   => 'root',
+    group  => 'root',
-    mode    => '0640',
+    mode   => '0640',
   }
 
   file { '/opt/sunet-cdn/l4lb/conf/netns.json':
@@ -65,10 +79,10 @@ class cdn::l4lb(
   }
 
   file { '/etc/systemd/system/bird.service.d':
-    ensure  => directory,
+    ensure => directory,
-    owner   => 'root',
+    owner  => 'root',
-    group   => 'root',
+    group  => 'root',
-    mode    => '0755',
+    mode   => '0755',
   }
 
   file { '/etc/systemd/system/bird.service.d/override.conf':
@@ -77,7 +91,7 @@ class cdn::l4lb(
     group   => 'root',
     mode    => '0644',
     content => template('cdn/l4lb/bird-override.conf.erb'),
-    notify => [Class['sunet::systemd_reload']]
+    notify  => [Class['sunet::systemd_reload']]
   }
 
   file { '/etc/bird/bird.conf':

global/overlay/etc/puppet/modules/cdn/templates/l4lb/sysctl.erb

@@ -0,0 +1,5 @@
+# Allow non-SYN packets to be accepted for a IPVS service.
+# Needed if another l4lb has been taken down and routers are now sending us
+# packets for existing connections that was previously handled by the other
+# node.
+net.ipv4.vs.sloppy_tcp=1