471 lines
14 KiB
CFEngine3
471 lines
14 KiB
CFEngine3
# example lxc_host.cfg
|
|
# cfg data => '
|
|
# {
|
|
# "bridge": "lxcbr0",
|
|
# "netmask": "255.255.255.0",
|
|
# "network": "10.0.1.0/24",
|
|
# "addr": "10.0.1.1",
|
|
# "dhcp_range": "10.0.1.200,10.0.1.254"
|
|
# "dhcp_max": 253,
|
|
# }';
|
|
|
|
bundle agent lxc_host( cfg )
|
|
{
|
|
vars:
|
|
# var ip wird in mergedata verwendet, und mergedata mag keine flachen Variablen,
|
|
# sondern braucht Arrays auf die eine oder andere Weise
|
|
'ip[thirdoctet]' string => format( "%02x", nth( splitstring( $(cfg[addr]), '\.', 4 ), 2 ) );
|
|
"cfg_ip" data => mergedata( cfg, ip );
|
|
|
|
debian|ubuntu::
|
|
'lxc_path' string => '/etc/lxc';
|
|
'lxc_net_path' string => '/etc/default/lxc-net';
|
|
'lxc_net_tmpl' string => 'debian.lxc-net.mustache';
|
|
'lxc_default_path' string => '$(lxc_path)/default.conf';
|
|
'lxc_default_tmpl' string => 'default.conf.mustache';
|
|
'lxc_hosts_d' string => '$(lxc_path)/hosts.d';
|
|
debian::
|
|
'pkg_list' slist => { 'lxc','lxc-templates','debian-archive-keyring' };
|
|
'lxc_nft_path' string => '/usr/local/bin';
|
|
'lxc_down_nft' string => '$(sys.workdir)/inputs/$(def.wmde_libdir)/templates/lxc_host/lxc-net-down.nft.txt';
|
|
'lxc_net_override' string => '$(sys.workdir)/inputs/$(def.wmde_libdir)/templates/lxc_host/lxc-net.override.conf';
|
|
debian_11::
|
|
'lxc_up_nft' string => '$(sys.workdir)/inputs/$(def.wmde_libdir)/templates/lxc_host/debian11.lxc-net-up.nft.txt';
|
|
'lxc_hook_net' string => '$(sys.workdir)/inputs/$(def.wmde_libdir)/scripts/lxc_host/debian11.lxc-hook-net.sh';
|
|
debian_12|debian_13::
|
|
'lxc_up_nft' string => '$(sys.workdir)/inputs/$(def.wmde_libdir)/templates/lxc_host/debian12.lxc-net-up.nft.txt';
|
|
'lxc_hook_net' string => '$(sys.workdir)/inputs/$(def.wmde_libdir)/scripts/lxc_host/debian12.lxc-hook-net.sh';
|
|
ubuntu::
|
|
'pkg_list' slist => { 'lxc','lxc-templates','ubuntu-archive-keyring' };
|
|
fedora|centos|redhat::
|
|
'lxc_net_path' string => '/etc/lxc-net';
|
|
|
|
methods:
|
|
'Ensure the packages required for LXC are installed'
|
|
usebundle => wmde_install_packages(@(pkg_list),'lxc'),
|
|
comment => "The packages to install are defined in var `pkg_list`.",
|
|
handle => "lxc_installed";
|
|
|
|
reports:
|
|
"The agent $(default:def.agent_name) has been prepared as a host for lx containers.";
|
|
"The host provides the network on $(cfg[bridge]) with address $(cfg[addr]).";
|
|
"It will configure LXC via DHCP in the range $(cfg[dhcp_range]).";
|
|
"Static mappings are in /etc/lxc/hosts.d.";
|
|
"This is the third octet: $(ip[thirdoctet]).";
|
|
|
|
files:
|
|
"$(lxc_path)/."
|
|
acl => lxc_dnsmasq,
|
|
depends_on => { "lxc_installed" };
|
|
"$(lxc_path)/dnsmasq.conf"
|
|
perms => mog('644','root','root'),
|
|
content => "dhcp-hostsdir=$(lxc_hosts_d)",
|
|
depends_on => { "lxc_installed" };
|
|
"$(lxc_hosts_d)/."
|
|
create => "true",
|
|
perms => mog('755','root','root'),
|
|
handle => "lxchostsdir",
|
|
depends_on => { "lxc_installed" };
|
|
"/usr/local/bin/lxc-hooks"
|
|
perms => mog('700','root','root'),
|
|
copy_from => local_cp("$(sys.workdir)/inputs/wmdelib/scripts/lxc_host/lxc-hooks.sh"),
|
|
depends_on => { "lxc_installed" },
|
|
handle => "lxchookscript";
|
|
debian_11|debian_12|debian_13::
|
|
'$(lxc_nft_path)/lxc-net-up.nft'
|
|
perms => mog('700','root','root'),
|
|
copy_from => local_cp('$(lxc_up_nft)'),
|
|
depends_on => { 'lxc_installed' },
|
|
handle => 'lxc_up_nft_copied';
|
|
'$(lxc_nft_path)/lxc-net-down.nft'
|
|
perms => mog('700','root','root'),
|
|
copy_from => local_cp('$(lxc_down_nft)'),
|
|
depends_on => { 'lxc_installed' },
|
|
handle => 'lxc_down_nft_copied';
|
|
'/etc/systemd/system/lxc-net.service.d/.'
|
|
perms => mog('755','root','root'),
|
|
create => 'true',
|
|
depends_on => { 'lxc_installed' },
|
|
handle => 'lxc_net_override_dir';
|
|
'/etc/systemd/system/lxc-net.service.d/override.conf'
|
|
perms => mog('644','root','root'),
|
|
copy_from => local_cp('$(sys.workdir)/inputs/$(def.wmde_libdir)/templates/lxc_host/lxc-net.override.conf'),
|
|
depends_on => { 'lxc_installed' },
|
|
classes => results('namespace','lxc_net'),
|
|
handle => 'lxc_net_override';
|
|
"/usr/local/bin/lxc-hook-net"
|
|
perms => mog('700','root','root'),
|
|
copy_from => local_cp("$(lxc_hook_net)"),
|
|
depends_on => { "lxc_installed", "lxchookscript" },
|
|
handle => "lxchooknet";
|
|
debian|ubuntu::
|
|
"$(lxc_net_path)"
|
|
perms => mog('644','root', 'root'),
|
|
template_data => @(cfg_ip),
|
|
template_method => 'mustache',
|
|
edit_template => "$(sys.workdir)/inputs/$(def.wmde_libdir)/templates/lxc_host/$(lxc_net_tmpl)",
|
|
depends_on => { "lxc_installed" };
|
|
"$(lxc_default_path)"
|
|
perms => mog('644','root', 'root'),
|
|
template_data => @(cfg_ip),
|
|
template_method => 'mustache',
|
|
edit_template => "$(sys.workdir)/inputs/$(def.wmde_libdir)/templates/lxc_host/$(lxc_default_tmpl)",
|
|
depends_on => { "lxc_installed" };
|
|
commands:
|
|
lxc_net_repaired::
|
|
"/usr/bin/systemctl"
|
|
args => "daemon-reload",
|
|
handle => "lxc_net_reloaded";
|
|
services:
|
|
lxc_net_repaired::
|
|
"lxc-net.service"
|
|
service_policy => "restart",
|
|
depends_on => { 'lxc_net_reloaded' };
|
|
}
|
|
|
|
body acl lxc_dnsmasq
|
|
{
|
|
acl_method => "append";
|
|
acl_type => "posix";
|
|
aces => {
|
|
"user:dnsmasq:rx:allow"
|
|
};
|
|
}
|
|
|
|
# example lxc.cfg
|
|
# cfg data => '
|
|
# {
|
|
# "name": "proxy",
|
|
# "dist": "debian",
|
|
# "release": "bookworm",
|
|
# "arch": "amd64",
|
|
# "bridge": "lxcbr0",
|
|
# "ip": "10.0.11.80",
|
|
# "group": "",
|
|
# "autostart": true,
|
|
# "policy": "absent|present",
|
|
# "state": "stopped|running|manual",
|
|
# }';
|
|
# name
|
|
# lxc.container.conf:
|
|
# # Parameters passed to the template: --dist $(cfg[dist]) --arch $(cfg[arch]) --release $(cfg[release])
|
|
bundle agent lxc( cfg )
|
|
{
|
|
classes:
|
|
"cfg_array" expression => strcmp( type( "cfg", "true" ), "data array" );
|
|
|
|
vars:
|
|
cfg_array::
|
|
"index" slist => getindices( @(cfg) );
|
|
|
|
methods:
|
|
cfg_array::
|
|
"Iterate over config array: $(index)"
|
|
usebundle => _lxc( @(cfg[$(index)]) );
|
|
!cfg_array::
|
|
"Forward config to"
|
|
usebundle => _lxc( @(cfg) );
|
|
|
|
reports:
|
|
cfg_array::
|
|
"Iterated over cfg array.";
|
|
}
|
|
|
|
# Although all attributes are passed in one data object there are
|
|
# qualitative differences. All need the name element.
|
|
# lxc-create needs dist, arch and release.
|
|
# lxc config file needs autostart and group
|
|
# dnsmasq needs the ip
|
|
bundle agent _lxc( cfg )
|
|
{
|
|
classes:
|
|
"lxc_exists" expression => returnszero( "/usr/bin/lxc-info $(cfg[name]) 2> /dev/null", "noshell" ), scope => "bundle";
|
|
"lxc_host_file_exists" expression => fileexists( "$(lxc_host_file)" ), scope => "bundle";
|
|
"lxc_policy_exists" expression => isvariable( "cfg[policy]" );
|
|
"lxc_state_exists" expression => isvariable( "cfg[state]" );
|
|
"lxc_ports_exists" expression => isvariable( "cfg[ports]" );
|
|
"lxc_raw_lines_exists" expression => isvariable( "cfg[raw_lines]" );
|
|
lxc_policy_exists::
|
|
"lxc_policy_valid" expression => regcmp( "(absent|present)", "$(cfg[policy])" );
|
|
lxc_policy_valid::
|
|
'present' expression => strcmp( "present", "$(cfg[policy])" );
|
|
!lxc_policy_exists::
|
|
'present';
|
|
lxc_state_exists::
|
|
"lxc_state_valid" expression => regcmp( "(stopped|running|manual)", "$(cfg[state])" );
|
|
lxc_state_valid::
|
|
'running' expression => strcmp( "running", "$(cfg[state])" );
|
|
lxc_state_valid::
|
|
'manual' expression => strcmp( "manual", "$(cfg[state])" );
|
|
!lxc_state_exists::
|
|
'running';
|
|
lxc_exists::
|
|
"lxc_correct_distribution" expression => regline( '^# Parameters passed to the template: --dist $(cfg[dist]) --arch $(cfg[arch]) --release $(cfg[release])$', "$(lxc_dir)/config" ), scope => "bundle";
|
|
lxc_ports_exists::
|
|
"ports_array" expression => strcmp( type( "cfg[ports]", "false" ), "data" );
|
|
|
|
vars:
|
|
"lxc_host_file" string => "$(lxc_host.lxc_hosts_d)/$(cfg[name])";
|
|
"lxc_dir" string => "/var/lib/lxc/$(cfg[name])";
|
|
"lxc_rootfs" string => "$(lxc_dir)/rootfs";
|
|
'autostart' string => $(cfg[autostart]);
|
|
'group' string => $(cfg[group]);
|
|
|
|
|
|
files:
|
|
ports_array::
|
|
"/var/lib/lxc/$(cfg[name])/ports"
|
|
edit_template => "$(sys.workdir)/inputs/$(def.wmde_libdir)/templates/lxc_host/port_forwarding.mustache",
|
|
template_data => @(cfg),
|
|
template_method => "mustache",
|
|
# depends_on => { "lxc_$(cfg[name])_created" },
|
|
handle => "$(cfg[name])_ports_created";
|
|
!lxc_exists & present::
|
|
"/var/lib/lxc/$(cfg[name])/config"
|
|
edit_line => lxc_config( "$(autostart)", "$(group)", @(cfg[raw_lines]) ),
|
|
depends_on => { "lxc_$(cfg[name])_created" },
|
|
handle => "$(cfg[name])_config_created";
|
|
methods:
|
|
!lxc_exists & present::
|
|
"Ensure existence of container ($(cfg[name]))"
|
|
usebundle => lxc_create( @(cfg) ),
|
|
handle => "lxc_$(cfg[name])_created";
|
|
"Ensure static mapping in dnsmasq"
|
|
usebundle => lxc_add_static_mapping( @(cfg) ),
|
|
depends_on => { "lxc_$(cfg[name])_created" },
|
|
handle => "lxc_$(cfg[name])_mapped_statically";
|
|
lxc_exists & !present::
|
|
"Ensure absence of container ($cfg[name])"
|
|
usebundle => lxc_destroy( @(cfg) ),
|
|
handle => "lxc_$(cfg[name])_destroyed";
|
|
"Ensure absence of static mapping"
|
|
usebundle => lxc_remove_static_mapping( @(cfg) ),
|
|
depends_on => { "lxc_$(cfg[name])_destroyed" },
|
|
handle => "lxc_$(cfg[name])_unmapped_statically";
|
|
"Ensure dnsmasq picks up current lxc host configs"
|
|
usebundle => reload_dnsmasq,
|
|
depends_on => { "lxc_$(cfg[name])_unmapped_statically" },
|
|
handle => "reloaded_dnsmasq_for_$(cfg[name])";
|
|
present & running::
|
|
"Ensure running state of container ($(cfg[name]))"
|
|
usebundle => lxc_start( @(cfg[name]) ),
|
|
handle => "lxc_$(cfg[name])_started";
|
|
present & !(running | manual)::
|
|
"Ensure stopped state of container ($(cfg[name]))"
|
|
usebundle => lxc_stop( @(cfg[name]) ),
|
|
handle => "lxc_$(cfg[name])_stopped";
|
|
reports:
|
|
"_lxc: raw_lines_$(cfg[name]) [$(lxc_raw_type)] enthält $(cfg[raw_lines])";
|
|
"_lxc: raw_lines_arg_$(cfg[name]) [$(lxc_raw_type)] enthält ($-Notation) $(raw_lines_arg_$(cfg[name]))";
|
|
lxc_exists & lxc_correct_distribution::
|
|
"LX Container $(cfg[name]) already configured, nothing to do";
|
|
!lxc_exists & present::
|
|
"LXC $(cfg[name]) did not exist and should have been created.";
|
|
lxc_exists & !present::
|
|
"LXC $(cfg[name]) did exist and should have been destroyed.";
|
|
present & running::
|
|
"LXC $(cfg[name]) should now be in state RUNNING.";
|
|
present & !running::
|
|
"LXC $(cfg[name]) should now be in state STOPPED.";
|
|
}
|
|
|
|
bundle edit_line lxc_config( autostart, group, raw )
|
|
{
|
|
classes:
|
|
"autostart_true"
|
|
expression => some( $(autostart_lc), true_statements ),
|
|
depends_on => { "$(autostart)_lowercased" };
|
|
"group_provided"
|
|
expression => isgreaterthan( $(group_length), 0 ),
|
|
depends_on => { "group_length_measured" };
|
|
vars:
|
|
"autostart_lc"
|
|
string => string_downcase( $(autostart) ),
|
|
handle => "$(autostart)_lowercased";
|
|
"group_length"
|
|
int => string_length( $(group) ),
|
|
handle => "group_length_measured";
|
|
"true_statements"
|
|
slist => { "yes", "true", "on", "1" },
|
|
handle => "truth";
|
|
insert_lines:
|
|
"# This file is managed by CFEngine. Manual changes will be overwritten."
|
|
location => first_line,
|
|
handle => "warning";
|
|
"$(raw)"
|
|
depends_on => { "warning" };
|
|
autostart_true::
|
|
"lxc.start.auto = 1";
|
|
!autostart_true::
|
|
"lxc.start.auto = 0";
|
|
group_provided::
|
|
"lxc.group = $(group)";
|
|
reports:
|
|
"lxc_config 1: autostart ist $(autostart)";
|
|
"lxc_config 2: group ist $(group)";
|
|
"lxc_config 3: raw enthält $(raw)";
|
|
}
|
|
|
|
body location first_line
|
|
{
|
|
before_after => "before";
|
|
first_last => "first";
|
|
select_line_matching => ".*";
|
|
}
|
|
|
|
body location last_line
|
|
{
|
|
before_after => "after";
|
|
first_last => "last";
|
|
select_line_matching => ".*";
|
|
}
|
|
|
|
bundle agent lxc_add_static_mapping( cfg )
|
|
{
|
|
files:
|
|
"$(lxc_host.lxc_hosts_d)/$(cfg[name])"
|
|
perms => mog( '644', 'root', 'root' ),
|
|
content => "$(cfg[name]),$(cfg[ip])",
|
|
handle => "mapped_$(cfg[name])";
|
|
|
|
reports:
|
|
"mapped $(cfg[name]) to $(cfg[ip])"
|
|
depends_on => { "mapped_$(cfg[name])" };
|
|
}
|
|
|
|
bundle agent lxc_remove_static_mapping( cfg )
|
|
{
|
|
files:
|
|
"$(lxc_host.lxc_hosts_d)/$(cfg[name])"
|
|
delete => tidy,
|
|
classes => if_repaired(dnsmasq_reload);
|
|
|
|
reports:
|
|
dnsmasq_reload::
|
|
"mapped $(cfg[name]) to $(cfg[ip])";
|
|
}
|
|
|
|
bundle agent lxc_add_port_forwarding_rule_config( cfg )
|
|
{
|
|
|
|
}
|
|
|
|
# When files for static mappings are added dnsmasq automatically loads
|
|
# them. But dnsmasq doesn't remove them automatically again when the
|
|
# file gets removed.
|
|
bundle agent reload_dnsmasq
|
|
{
|
|
processes:
|
|
dnsmasq_reload::
|
|
"dnsmasq"
|
|
signals => { "hup" };
|
|
}
|
|
|
|
# DOWNLOAD_KEYSERVER="keyserver.ubuntu.com" lxc-create -n manual -t download -- -d debian -a amd64 -r bookworm
|
|
bundle agent lxc_create( cfg )
|
|
{
|
|
classes:
|
|
"lxc_dir_btrfs" expression => strcmp( execresult( "/usr/bin/stat -f -c %T /var/lib/lxc" , "noshell", "stdout" ), "btrfs" );
|
|
vars:
|
|
!lxc_dir_btrfs::
|
|
"create_args" slist => {
|
|
"-n",
|
|
$(cfg[name]),
|
|
"-t",
|
|
"download",
|
|
"--",
|
|
"-d",
|
|
$(cfg[dist]),
|
|
"-a",
|
|
$(cfg[arch]),
|
|
"-r",
|
|
$(cfg[release]),
|
|
};
|
|
lxc_dir_btrfs::
|
|
"create_args" slist => {
|
|
"-n",
|
|
$(cfg[name]),
|
|
"-t",
|
|
"download",
|
|
"-B",
|
|
"btrfs",
|
|
"--",
|
|
"-d",
|
|
$(cfg[dist]),
|
|
"-a",
|
|
$(cfg[arch]),
|
|
"-r",
|
|
$(cfg[release]),
|
|
};
|
|
commands:
|
|
"/usr/bin/lxc-create"
|
|
arglist => { @(create_args) },
|
|
contain => lxc_commands,
|
|
handle => "lxc_$(cfg[name])_created";
|
|
reports:
|
|
"LXC $(cfg[name]) has been created"
|
|
depends_on => { "lxc_$(cfg[name])_created" };
|
|
}
|
|
|
|
bundle agent lxc_destroy( cfg )
|
|
{
|
|
methods:
|
|
"Ensure LXC is stopped"
|
|
usebundle => lxc_stop( $(cfg[name]) ),
|
|
handle => "stopped_$(cfg[name])";
|
|
commands:
|
|
"/usr/bin/lxc-destroy"
|
|
arglist => {
|
|
"-n",
|
|
$(cfg[name])
|
|
},
|
|
depends_on => { "stopped_$(cfg[name])" },
|
|
handle => "destroyed_$(cfg[name])";
|
|
}
|
|
|
|
bundle agent lxc_start( name )
|
|
{
|
|
classes:
|
|
"lxc_running"
|
|
expression => strcmp( execresult( "/usr/bin/lxc-info -n $(name) -s -H", "noshell", "stdout" ), "RUNNING" ),
|
|
scope => "bundle";
|
|
commands:
|
|
!lxc_running::
|
|
"/usr/bin/lxc-start"
|
|
arglist => {
|
|
"-n",
|
|
$(name)
|
|
},
|
|
handle => "lxc_$(name)_started";
|
|
reports:
|
|
!lxc_running::
|
|
"$(name) has been started"
|
|
depends_on => { "lxc_$(name)_started" };
|
|
}
|
|
|
|
bundle agent lxc_stop( name )
|
|
{
|
|
classes:
|
|
"lxc_running"
|
|
expression => strcmp( execresult( "/usr/bin/lxc-info -n $(name) -s -H", "noshell", "stdout" ), "RUNNING" ),
|
|
scope => "bundle";
|
|
commands:
|
|
lxc_running::
|
|
"/usr/bin/lxc-stop"
|
|
arglist => {
|
|
"-n",
|
|
$(name)
|
|
},
|
|
handle => "lxc_$(name)_stopped";
|
|
reports:
|
|
lxc_running::
|
|
"$(name) has been stopped"
|
|
depends_on => { "lxc_$(name)_stopped" };
|
|
}
|
|
|
|
body contain lxc_commands
|
|
{
|
|
useshell => "noshell";
|
|
no_output => "true";
|
|
}
|