Skip to content

Commit 4ae60f5

Browse files
zolfariotzolfariot
committed
roles/lxc_guest: improved syntax and upgrades
Debian version upgraded to buster. New templates compatibile with stable versions of LXC provided with debian. Cleaner syntax using `ssh_lxc.py` connection plugin. Now we don't user `lxc-attach -n ...` in the `shell` module on the host anymore, but we delegate to `{{ vm_name }}` with `connection: ssh_lxc`, using suitable Ansible module to do operation directly on the container before it is online and SSH accessible. We added an option to force an LVM VG name: if the default naming convention is not used the vg name can be overriden with the `vg_name` variable. The `xfs` filesystem seems to be broken in this release, so we used `ext4` as default for new container. This point needs further investigation.
1 parent 69e68b8 commit 4ae60f5

6 files changed

Lines changed: 60 additions & 39 deletions

File tree

‎MIGRATION.md‎

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -18,17 +18,18 @@ On the hosts:
1818

1919
## Roles
2020

21-
| Role name | Modified? | Tested? | Production? | Notes |
22-
|--------------------|:---------:|:--------:|:-----------:|----------------------------------------------------------------------|
23-
|`roles/service` | **YES** | **YES** | NO | New `apt` module style for packages. |
24-
|`roles/ssh_server` | **YES** | **YES** | NO | `lxc_ssh.py` --> `ssh_lxc.py`, multi-key support. |
25-
|`roles/ca` | **YES** | ReadNote | NO | New `apt` module style for pacakges. Works with this [ca_manager]. |
26-
|`prepare_host.yaml` | **YES** | **YES** | NO | Migrate Debian release to Buster and Python 2 to 3. |
27-
|`roles/ldap` | NO | NO | NO | |
28-
|`roles/nginx` | NO | NO | NO | |
29-
|`roles/projects` | NO | NO | NO | |
30-
|`roles/dns_record` | NO | NO | NO | |
31-
|`roles/openvpn` | NO | NO | NO | |
21+
| Role name | Modified? | Tested? | Production? | Notes |
22+
|----------------------|:---------:|:--------:|:-----------:|----------------------------------------------------------------------|
23+
|`roles/service` | **YES** | **YES** | NO | New `apt` module style for packages. |
24+
|`roles/ssh_server` | **YES** | **YES** | NO | `lxc_ssh.py` --> `ssh_lxc.py`, multi-key support. |
25+
|`roles/ca` | **YES** | ReadNote | NO | New `apt` module style for pacakges. Works with this [ca_manager]. |
26+
|`prepare_host.yaml` | **YES** | **YES** | NO | Migrate Debian release to Buster and Python 2 to 3. |
27+
|`roles/lxc_guest.yaml`| **YES** | **YES** | NO | Updated Debian and LXC. `xfs` ***broken***, `ext4` working. |
28+
|`roles/ldap` | NO | NO | NO | |
29+
|`roles/nginx` | NO | NO | NO | |
30+
|`roles/projects` | NO | NO | NO | |
31+
|`roles/dns_record` | NO | NO | NO | |
32+
|`roles/openvpn` | NO | NO | NO | |
3233

3334

3435
## Plugins and Modules

‎roles/lxc_guest/defaults/main.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
22
auto_start: true
33
container_state: started
4-
distro: stretch
4+
distro: buster
55
vm_size: 5G

‎roles/lxc_guest/files/interfaces‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
auto lo
2+
iface lo inet loopback
3+
4+
auto eth0
5+
iface eth0 inet manual

‎roles/lxc_guest/tasks/main.yaml‎

Lines changed: 27 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111

1212
- name: Check debian release
1313
assert:
14-
that: distro in [ 'stretch', 'sid', 'buster' ]
14+
that: distro in [ 'bullseye', 'sid', 'buster' ]
1515
msg: "release {{ distro }} not supported by debian template"
1616

1717
- block:
@@ -20,12 +20,12 @@
2020
name: "{{ vm_name }}"
2121
backing_store: lvm
2222
fs_size: "{{ vm_size }}"
23-
vg_name: "{{ inventory_hostname }}vg"
23+
vg_name: "{{ vg_name | default(inventory_hostname+'vg') }}"
2424
lv_name: "vm_{{ vm_name }}"
25-
fs_type: xfs
25+
fs_type: ext4
2626
container_log: true
2727
template: debian
28-
template_options: --release {{ distro }} --packages=ssh,python
28+
template_options: --release {{ distro }} --packages=ssh,python3
2929
state: stopped
3030
# suppress messages related to file descriptors
3131
# leaking when lvm is invoked
@@ -58,30 +58,39 @@
5858
register: container_running_state
5959

6060
- name: Read container DNS configuration
61-
container_file_read:
62-
name: "{{ vm_name }}"
63-
path: /etc/resolv.conf
61+
slurp:
62+
src: /etc/resolv.conf
63+
delegate_to: "{{ vm_name }}"
64+
connection: ssh_lxc
6465
register: vm_resolv_conf
6566

6667
- debug:
67-
var: vm_resolv_conf
68+
msg: "{{ vm_resolv_conf['content'] | b64decode }}"
6869
verbosity: 2
6970

7071
- name: update container DNS configuration
71-
shell: lxc-attach -n {{ vm_name }} --clear-env -e -- bash -c "grep -Pz1 'domain lilik.it\nnameserver {{ hostvars | ip_from_inventory('vm_gateway') }}' /etc/resolv.conf || echo -e 'domain lilik.it\nnameserver {{ hostvars | ip_from_inventory('vm_gateway') }}' > /etc/resolv.conf"
72-
register: container_dns_configuration
73-
changed_when: container_dns_configuration.stdout != "domain lilik.it\nnameserver {{ hostvars | ip_from_inventory('vm_gateway') }}\n\u0000"
72+
template:
73+
src: resolv.conf.j2
74+
dest: /etc/resolv.conf
75+
delegate_to: "{{ vm_name }}"
76+
connection: ssh_lxc
7477

7578
- name: update container network configuration
76-
shell: lxc-attach -n {{ vm_name }} --clear-env -e -- bash -c "grep -F 'iface eth0 inet manual' /etc/network/interfaces || sed -i 's/iface eth0 inet dhcp/iface eth0 inet manual/' /etc/network/interfaces"
77-
register: container_network
78-
changed_when: "container_network.stdout != 'iface eth0 inet manual'"
79+
copy:
80+
src: interfaces
81+
dest: /etc/network/interfaces
82+
delegate_to: "{{ vm_name }}"
83+
connection: ssh_lxc
7984
notify: restart container
8085

8186
- name: install packages
82-
shell: lxc-attach -n {{ vm_name }} --clear-env -e -- bash -c "apt-get update && apt-get install python ssh -y"
83-
register: install_packages
84-
changed_when: "install_packages.stdout.find('0 newly installed') == -1"
87+
apt:
88+
pkg:
89+
- python3
90+
- ssh
91+
state: present
92+
update_cache: yes
93+
cache_valid_time: 3600
8594
notify: restart container
8695

8796
# Restart container when one in
@@ -94,6 +103,6 @@
94103

95104
- name: add monitoring facts
96105
set_fact:
97-
monitoring_host: "{{monitoring_host| default([]) }} + [ '{{ vm_name }}' ]"
106+
monitoring_host: "{{ monitoring_host | default([]) }} + [ '{{ vm_name }}' ]"
98107
delegate_facts: True
99108
delegate_to: status

‎roles/lxc_guest/templates/config.j2‎

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,19 @@
11
lxc.include = /usr/share/lxc/config/debian.common.conf
22

3-
lxc.utsname = {{ vm_name }}
4-
lxc.rootfs = /dev/{{ inventory_hostname }}vg/vm_{{ vm_name }}
3+
lxc.uts.name = {{ vm_name }}
4+
lxc.rootfs.path = lvm:/dev/{{ vg_name | default(inventory_hostname+'vg') }}/vm_{{ vm_name }}
55

6-
lxc.tty = 4
6+
lxc.apparmor.profile = generated
7+
lxc.apparmor.allow_nesting = 1
8+
9+
lxc.tty.max = 4
710
lxc.arch = amd64
11+
lxc.pty.max = 1024
812

9-
lxc.network.type = veth
10-
lxc.network.flags = up
11-
lxc.network.link = br0
12-
lxc.network.name = eth0
13-
lxc.network.ipv4 = {{ hostvars | ip_from_inventory(vm_name) }}/24
14-
lxc.network.ipv4.gateway = {{ hostvars | ip_from_inventory('vm_gateway') }}
13+
lxc.net.0.type = veth
14+
lxc.net.0.flags = up
15+
lxc.net.0.link = br0
16+
lxc.net.0.name = eth0
17+
lxc.net.0.ipv4.address = {{ hostvars | ip_from_inventory(vm_name) }}/24
18+
lxc.net.0.ipv4.gateway = {{ hostvars | ip_from_inventory('vm_gateway') }}
1519
lxc.start.auto = {% if auto_start %}1{% else %}0{% endif %}

‎roles/lxc_guest/templates/resolv.conf.j2‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
domain dmz.lilik.it
2+
nameserver {{ hostvars | ip_from_inventory('vm_gateway') }}

0 commit comments

Comments
 (0)