Skip to content

Commit a4f0dcc

Browse files
markgoddardmarkgoddard
authored
Merge pull request #51 from stackhpc/libvirt-config
TCP/TLS, libvirtd.conf, qemu.conf, additional packages
2 parents 211b6e6 + 5211ff9 commit a4f0dcc

File tree

16 files changed

+307
-57
lines changed

16 files changed

+307
-57
lines changed

‎README.md‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,49 @@ daemon. Default is `true`.
103103
`libvirt_host_install_client`: Whether to install and enable the libvirt
104104
client. Default is `true`.
105105

106+
`libvirt_host_extra_daemon_packages`: List of additional packages to install on
107+
libvirt daemon hosts.
108+
109+
`libvirt_host_extra_client_packages`: List of additional packages to install on
110+
libvirt client hosts.
111+
112+
`libvirt_host_libvirtd_conf_enabled`: Whether to configure `libvirtd.conf`.
113+
Default is `true`.
114+
115+
`libvirt_host_libvirtd_conf`: Configuration for `libvirtd.conf`. Dict mapping
116+
option names to values. Default is an empty dict.
117+
118+
`libvirt_host_qemu_conf_enabled`: Whether to configure `qemu.conf`. Default is
119+
`true`.
120+
121+
`libvirt_host_qemu_conf`: Configuration for `qemu.conf`. Dict mapping option
122+
names to values. Default is an empty dict.
123+
124+
`libvirt_host_tcp_listen`: Whether to enable the systemd TCP socket unit.
125+
Default is `false`.
126+
127+
`libvirt_host_tcp_listen_address`: Systemd TCP socket ListenStream. See man
128+
systemd.socket for format. Default is unset.
129+
130+
`libvirt_host_tls_listen`: Whether to enable the systemd TLS socket unit.
131+
Default is `false`.
132+
133+
`libvirt_host_tls_listen_address`: Systemd TLS socket ListenStream. See man
134+
systemd.socket for format. Default is unset.
135+
136+
`libvirt_host_tls_server_cert`: TLS server certificate. Default is unset.
137+
138+
`libvirt_host_tls_server_key`: TLS server key. Default is unset.
139+
140+
`libvirt_host_tls_client_cert`: TLS client certificate. Default is unset.
141+
142+
`libvirt_host_tls_client_key`: TLS client key. Default is unset.
143+
144+
`libvirt_host_tls_cacert`: TLS CA certificate. Default is unset.
145+
146+
`libvirt_host_configure_apparmor`: Whether to configure AppArmor for directory
147+
storage pools.
148+
106149
Dependencies
107150
------------
108151

‎defaults/main.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,3 +73,38 @@ libvirt_host_install_daemon: true
7373

7474
# Whether to install and enable the libvirt client.
7575
libvirt_host_install_client: true
76+
77+
# List of additional packages to install on libvirt daemon hosts.
78+
libvirt_host_extra_daemon_packages: []
79+
80+
# List of additional packages to install on libvirt client hosts.
81+
libvirt_host_extra_client_packages: []
82+
83+
# Whether to configure libvirtd.conf.
84+
libvirt_host_libvirtd_conf_enabled: true
85+
# Configuration for libvirtd.conf. Dict mapping option names to values.
86+
libvirt_host_libvirtd_conf: {}
87+
88+
# Whether to configure qemu.conf.
89+
libvirt_host_qemu_conf_enabled: true
90+
# Configuration for qemu.conf. Dict mapping option names to values.
91+
libvirt_host_qemu_conf: {}
92+
93+
# Whether to enable the systemd TCP socket unit.
94+
libvirt_host_tcp_listen: false
95+
# Systemd TCP socket ListenStream. See man systemd.socket for format.
96+
libvirt_host_tcp_listen_address:
97+
98+
# Whether to enable the systemd TLS socket unit.
99+
libvirt_host_tls_listen: false
100+
# Systemd TLS socket ListenStream. See man systemd.socket for format.
101+
libvirt_host_tls_listen_address:
102+
# TLS server and client certificates.
103+
libvirt_host_tls_server_cert:
104+
libvirt_host_tls_server_key:
105+
libvirt_host_tls_client_cert:
106+
libvirt_host_tls_client_key:
107+
libvirt_host_tls_cacert:
108+
109+
# Whether to configure AppArmor for directory storage pools.
110+
libvirt_host_configure_apparmor: "{{ libvirt_host_install_daemon | bool }}"

‎handlers/main.yml‎

Lines changed: 27 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,34 @@
11
---
22

3-
- name: restart libvirt
3+
- name: reload systemd
4+
systemd:
5+
daemon_reload: true
6+
become: true
7+
8+
# The socket units cannot be stopped or started if libvirt is running.
9+
- name: stop libvirt
10+
service:
11+
name: libvirtd
12+
state: stopped
13+
become: true
14+
listen:
15+
- restart libvirt
16+
17+
- name: start libvirtd sockets
18+
service:
19+
name: "{{ item.service }}"
20+
state: "{{ item.enabled | bool | ternary('started', 'stopped') }}"
21+
become: true
22+
loop: "{{ _libvirt_socket_services }}"
23+
loop_control:
24+
label: "{{ item.service }}"
25+
listen:
26+
- restart libvirt
27+
28+
- name: start libvirt
429
service:
530
name: libvirtd
6-
state: restarted
31+
state: started
732
become: true
833

934
- name: reload libvirt qemu apparmor profile template

‎tasks/config.yml‎

Lines changed: 108 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,6 @@
11
---
22
# Configure services - runs after the install stage
33

4-
- name: Set socket directory in libvirtd.conf
5-
lineinfile:
6-
path: /etc/libvirt/libvirtd.conf
7-
insertafter: '^#unix_sock_dir ='
8-
regexp: '^unix_sock_dir ='
9-
line: unix_sock_dir = "{{ libvirt_host_socket_dir }}"
10-
become: true
11-
when: libvirt_host_socket_dir | length > 0
12-
notify: restart libvirt
13-
144
- name: Create directory for libvirt socket
155
file:
166
state: directory
@@ -31,12 +21,117 @@
3121
notify:
3222
- restart libvirt
3323

24+
- name: Ensure configuration files exist
25+
template:
26+
src: "{{ item.src }}"
27+
dest: "{{ item.dest }}"
28+
owner: root
29+
group: root
30+
mode: 0644
31+
become: true
32+
loop: "{{ _libvirt_config_files | selectattr('enabled') }}"
33+
loop_control:
34+
label: "{{ item.dest | basename }}"
35+
vars:
36+
_libvirt_config_files:
37+
- src: libvirtd.conf.j2
38+
dest: /etc/libvirt/libvirtd.conf
39+
enabled: "{{ libvirt_host_libvirtd_conf_enabled | bool }}"
40+
- src: qemu.conf.j2
41+
dest: /etc/libvirt/qemu.conf
42+
enabled: "{{ libvirt_host_qemu_conf_enabled | bool }}"
43+
notify:
44+
- restart libvirt
45+
46+
- name: Create systemd drop-in directory for socket listen address
47+
file:
48+
path: "/etc/systemd/system/{{ item.service }}.d"
49+
state: directory
50+
owner: root
51+
group: root
52+
mode: 0755
53+
become: true
54+
loop: "{{ _libvirt_socket_services | selectattr('enabled') }}"
55+
when:
56+
- item.listen_address is not none
57+
- item.listen_address | length > 0
58+
loop_control:
59+
label: "{{ item.service }}"
60+
vars:
61+
_libvirt_listen_stream: "{{ item.listen_address }}"
62+
63+
- name: Configure socket listen address
64+
template:
65+
src: socket.j2
66+
dest: "/etc/systemd/system/{{ item.service }}.d/listen-address.conf"
67+
owner: root
68+
group: root
69+
mode: 0644
70+
become: true
71+
loop: "{{ _libvirt_socket_services | selectattr('enabled') }}"
72+
when:
73+
- item.listen_address is not none
74+
- item.listen_address | length > 0
75+
loop_control:
76+
label: "{{ item.service }}"
77+
vars:
78+
_libvirt_listen_stream: "{{ item.listen_address }}"
79+
notify:
80+
- reload systemd
81+
- restart libvirt
82+
83+
- name: Create directory for TLS certificates and keys
84+
file:
85+
path: "{{ item }}"
86+
state: directory
87+
owner: root
88+
group: root
89+
mode: 0700
90+
become: true
91+
loop: >-
92+
{{ _libvirt_tls_certs.values() |
93+
selectattr('content') |
94+
map(attribute='dest') |
95+
map('dirname') |
96+
unique }}
97+
when:
98+
- libvirt_host_tls_listen | bool
99+
100+
- name: Copy TLS certificates and keys
101+
copy:
102+
content: "{{ _libvirt_loop_item.content }}"
103+
dest: "{{ _libvirt_loop_item.dest }}"
104+
owner: root
105+
group: root
106+
mode: "{{ _libvirt_loop_item.mode }}"
107+
become: true
108+
# NOTE: Loop over keys of _libvirt_tls_certs to avoid leaking the key
109+
# contents.
110+
loop: "{{ _libvirt_tls_certs.keys() }}"
111+
when:
112+
- libvirt_host_tls_listen | bool
113+
- _libvirt_loop_item.content
114+
vars:
115+
_libvirt_loop_item: "{{ _libvirt_tls_certs[item] }}"
116+
notify: restart libvirt
117+
34118
- name: Flush handlers
35119
meta: flush_handlers
36120

37121
- name: Ensure the libvirt daemon is started and enabled
38122
service:
39-
name: libvirtd
40-
state: started
41-
enabled: yes
123+
name: "{{ item.service }}"
124+
state: "{{ item.enabled | bool | ternary('started', 'stopped') }}"
125+
enabled: "{{ item.enabled | bool }}"
42126
become: True
127+
loop: "{{ _libvirt_services }}"
128+
loop_control:
129+
label: "{{ item.service }}"
130+
vars:
131+
_libvirt_services:
132+
- service: libvirtd-tcp.socket
133+
enabled: "{{ libvirt_host_tcp_listen | bool }}"
134+
- service: libvirtd-tls.socket
135+
enabled: "{{ libvirt_host_tls_listen | bool }}"
136+
- service: libvirtd
137+
enabled: true

‎tasks/install-client.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
- name: Ensure libvirt client packages are installed
33
package:
4-
name: "{{ libvirt_host_libvirt_packages_client }}"
4+
name: "{{ libvirt_host_libvirt_packages_client | select | list }}"
55
state: present
66
register: result
77
until: result is success

‎tasks/install-daemon.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
retries: 3
2222
become: True
2323

24-
# NOTE: QEMU emulators are available in EPEL.
24+
# NOTE: QEMU emulators are available in EPEL on CentOS 7.
2525
- name: Ensure the EPEL repository is enabled
2626
yum:
2727
name: epel-release
@@ -32,6 +32,7 @@
3232
become: True
3333
when:
3434
- ansible_facts.os_family == "RedHat"
35+
- ansible_facts.distribution_major_version | int == 7
3536
- libvirt_host_qemu_emulators | length > 0
3637

3738
- name: Ensure QEMU emulator packages are installed

‎tasks/main.yml‎

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,29 @@
11
---
2-
- include: prelude.yml
3-
- include: validate.yml
4-
- include: install-daemon.yml
2+
- import_tasks: prelude.yml
3+
- import_tasks: validate.yml
4+
- name: Include install-daemon.yml
5+
include_tasks: install-daemon.yml
56
when: libvirt_host_install_daemon | bool
6-
- include: install-client.yml
7+
- name: Include install-client.yml
8+
include_tasks: install-client.yml
79
when:
810
- not libvirt_host_install_daemon | bool
911
- libvirt_host_install_client | bool
1012
- name: Run post-install stage
11-
include: "{{ post_install_path }}"
13+
include_tasks: "{{ post_install_path }}"
1214
with_first_found:
1315
- files:
1416
- post-install-{{ ansible_facts.distribution }}.yml
1517
- post-install-{{ ansible_facts.os_family }}.yml
1618
skip: true
1719
loop_control:
1820
loop_var: post_install_path
19-
- include: config.yml
21+
- name: Include config.yml
22+
include_tasks: config.yml
2023
when: libvirt_host_install_daemon | bool
21-
- include: pools.yml
22-
- include: networks.yml
24+
- name: Include pools.yml
25+
include_tasks: pools.yml
26+
when: libvirt_host_pools | length > 0
27+
- name: Include networks.yml
28+
include_tasks: networks.yml
29+
when: libvirt_host_networks | length > 0

‎tasks/pools.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,8 @@
77
loop: "{{ libvirt_host_pools | flatten(levels=1) }}"
88
become: True
99

10-
- include_tasks:
10+
- name: include rbd.yml
11+
include_tasks:
1112
file: rbd.yml
1213
apply:
1314
become: True

‎tasks/post-install-Debian.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@
3333
line: " {{ item.path }}/** rwk,"
3434
become: true
3535
when:
36-
- libvirt_host_install_daemon | bool
36+
- libvirt_host_configure_apparmor | bool
3737
- ansible_facts.apparmor.status | default == 'enabled'
3838
- item.type == "dir"
3939
loop: "{{ libvirt_host_pools | flatten(levels=1) }}"

‎templates/libvirtd.conf.j2‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# {{ ansible_managed }}
2+
{% if libvirt_host_socket_dir | length > 0 %}
3+
unix_sock_dir = "{{ libvirt_host_socket_dir }}"
4+
{% endif %}
5+
{% for key, value in libvirt_host_libvirtd_conf.items() %}
6+
{# While the value is not JSON formatted, it is close enough - strings need to be double quoted. #}
7+
{{ key }} = {{ value | to_json }}
8+
{% endfor %}

0 commit comments

Comments
 (0)