|
| 1 | +--- |
| 2 | +- name: Ensure the libvirt daemon is configured |
| 3 | + hosts: compute |
| 4 | + tags: |
| 5 | + - libvirt-host |
| 6 | + tasks: |
| 7 | + - name: Ensure Ceph package repository is available |
| 8 | + package: |
| 9 | + name: "centos-release-ceph-{{ compute_libvirt_ceph_repo_release }}" |
| 10 | + state: present |
| 11 | + when: |
| 12 | + - compute_libvirt_enabled | bool |
| 13 | + - ansible_facts.distribution in ['CentOS', 'Rocky'] |
| 14 | + - compute_libvirt_ceph_repo_install | bool |
| 15 | + become: true |
| 16 | + |
| 17 | + - name: Include stackhpc.libvirt-host role |
| 18 | + include_role: |
| 19 | + name: stackhpc.libvirt-host |
| 20 | + vars: |
| 21 | + libvirt_host_libvirtd_conf: "{{ compute_libvirt_conf }}" |
| 22 | + libvirt_host_qemu_conf: "{{ compute_qemu_conf }}" |
| 23 | + libvirt_host_enable_sasl_support: "{{ compute_libvirt_enable_sasl | bool }}" |
| 24 | + libvirt_host_sasl_authname: nova |
| 25 | + libvirt_host_sasl_password: "{{ compute_libvirt_sasl_password }}" |
| 26 | + libvirt_host_tcp_listen: "{{ not compute_libvirt_enable_tls | bool }}" |
| 27 | + libvirt_host_tcp_listen_address: "{{ internal_net_name | net_ip }}:16509" |
| 28 | + libvirt_host_tls_listen: "{{ compute_libvirt_enable_tls | bool }}" |
| 29 | + libvirt_host_tls_listen_address: "{{ internal_net_name | net_ip }}:16514" |
| 30 | + # TLS server and client certificates. |
| 31 | + libvirt_host_tls_server_cert: >- |
| 32 | + {{ lookup('file', lookup('first_found', lookup_params | combine({'files': ['servercert.pem']}))) |
| 33 | + if libvirt_host_tls_listen | default(False) | bool else '' }} |
| 34 | + libvirt_host_tls_server_key: >- |
| 35 | + {{ lookup('file', lookup('first_found', lookup_params | combine({'files': ['serverkey.pem']}))) |
| 36 | + if libvirt_host_tls_listen | default(False) | bool else '' }} |
| 37 | + libvirt_host_tls_client_cert: >- |
| 38 | + {{ lookup('file', lookup('first_found', lookup_params | combine({'files': ['clientcert.pem']}))) |
| 39 | + if libvirt_host_tls_listen | default(False) | bool else '' }} |
| 40 | + libvirt_host_tls_client_key: >- |
| 41 | + {{ lookup('file', lookup('first_found', lookup_params | combine({'files': ['clientkey.pem']}))) |
| 42 | + if libvirt_host_tls_listen | default(False) | bool else '' }} |
| 43 | + libvirt_host_tls_cacert: >- |
| 44 | + {{ lookup('file', lookup('first_found', lookup_params | combine({'files': ['cacert.pem']}))) |
| 45 | + if libvirt_host_tls_listen | default(False) | bool else '' }} |
| 46 | + lookup_params: |
| 47 | + paths: "{{ libvirt_tls_cert_paths }}" |
| 48 | + skip: true |
| 49 | + # Support loading libvirt TLS certificates & keys from per-host and |
| 50 | + # global locations. |
| 51 | + libvirt_tls_cert_paths: >- |
| 52 | + {{ (libvirt_tls_cert_dirs | unique | product([inventory_hostname]) | map('path_join') | list + |
| 53 | + libvirt_tls_cert_dirs | unique | list) | list }} |
| 54 | + libvirt_tls_cert_dirs: |
| 55 | + - "{{ kayobe_env_config_path }}/certificates/libvirt" |
| 56 | + - "{{ kayobe_config_path }}/certificates/libvirt" |
| 57 | + libvirt_host_enable_efi_support: true |
| 58 | + when: |
| 59 | + - compute_libvirt_enabled | bool |
0 commit comments