Merge branch 'develop' of git.tcpcloud.eu:saltstack-formulas/libvirt-formula
diff --git a/README.md b/README.md
deleted file mode 100644
index cc97817..0000000
--- a/README.md
+++ /dev/null
@@ -1,7 +0,0 @@
-
-
-## Sample pillar
-
- kvm:
- hostnode:
- enabled: true
\ No newline at end of file
diff --git a/README.rst b/README.rst
new file mode 100644
index 0000000..d0b1d61
--- /dev/null
+++ b/README.rst
@@ -0,0 +1,86 @@
+
+=======
+Libvirt
+=======
+
+Sample pillars
+==============
+
+simple libvirt server
+
+
+.. code-block:: yaml
+
+ libvirt:
+ server:
+ enabled: true
+ virtualizations:
+ - kvm
+ network:
+ default:
+ ensure: absent
+
+.. code-block:: yaml
+
+ libvirt:
+ server:
+ enabled: true
+ network:
+ default:
+ ensure: absent #present, running, stopped, absent
+ mydefault:
+ xml: |
+ <network>
+ <name>mydefault</name>
+ <bridge name="virbr0"/>
+ <forward/>
+ <ip address="192.168.122.1" netmask="255.255.255.0">
+ <dhcp>
+ <range start="192.168.122.2" end="192.168.122.254"/>
+ </dhcp>
+ </ip>
+ </network>
+ ovs-net:
+ autostart: False
+ xml: |
+ <network>
+ <name>ovs-net</name>
+ <forward mode='bridge'/>
+ <bridge name='ovsbr0'/>
+ <virtualport type='openvswitch'>
+ <parameters interfaceid='09b11c53-8b5c-4eeb-8f00-d84eaa0aaa4f'/>
+ </virtualport>
+ </network>
+
+.. code-block:: yaml
+
+ libvirt:
+ server:
+ enabled: true
+ pool:
+ virtimages:
+ type: dir
+ path: /var/lib/libvirt/images
+ xml: |
+ <pool type="dir">
+ <name>virtimages</name>
+ <target>
+ <path>/var/lib/libvirt/images</path>
+ </target>
+ </pool>
+ virtimages2:
+ ensure: absent
+ type: dir
+ path: /var/lib/libvirt/images2
+ xml: |
+ <pool type="dir">
+ <name>virtimages2</name>
+ <target>
+ <path>/var/lib/libvirt/images2</path>
+ </target>
+ </pool>
+
+Read more
+=========
+
+* https://github.com/bechtoldt/saltstack-libvirt-formula
\ No newline at end of file
diff --git a/hostnode.sls b/hostnode.sls
deleted file mode 100644
index 1838b72..0000000
--- a/hostnode.sls
+++ /dev/null
@@ -1,19 +0,0 @@
-
-{%- if pillar.kvm.hostnode.enabled %}
-
-kvm_packages:
- pkg.installed:
- - names:
- - qemu-kvm
- - libvirt-bin
- - ubuntu-vm-builder
- - bridge-utils
-
-kvm_dir:
- file.directory:
- - name: /srv/kvm
- - user: root
- - group: root
- - mode: 775
-
-{%- endif %}
\ No newline at end of file
diff --git a/init.sls b/init.sls
deleted file mode 100644
index e69de29..0000000
--- a/init.sls
+++ /dev/null
diff --git a/libvirt/files/libvirt-bin b/libvirt/files/libvirt-bin
new file mode 100644
index 0000000..b9ec04c
--- /dev/null
+++ b/libvirt/files/libvirt-bin
@@ -0,0 +1,11 @@
+# Defaults for libvirt-bin initscript (/etc/init.d/libvirt-bin)
+# This is a POSIX shell fragment
+
+# Start libvirtd to handle qemu/kvm:
+start_libvirtd="yes"
+
+# options passed to libvirtd, add "-l" to listen on tcp
+libvirtd_opts="-d -l"
+
+# pass in location of kerberos keytab
+#export KRB5_KTNAME=/etc/libvirt/libvirt.keytab
\ No newline at end of file
diff --git a/libvirt/files/libvirtd.conf.Debian b/libvirt/files/libvirtd.conf.Debian
new file mode 100644
index 0000000..25814b1
--- /dev/null
+++ b/libvirt/files/libvirtd.conf.Debian
@@ -0,0 +1,413 @@
+# Master libvirt daemon configuration file
+#
+# For further information consult http://libvirt.org/format.html
+#
+# NOTE: the tests/daemon-conf regression test script requires
+# that each "PARAMETER = VALUE" line in this file have the parameter
+# name just after a leading "#".
+
+#################################################################
+#
+# Network connectivity controls
+#
+
+# Flag listening for secure TLS connections on the public TCP/IP port.
+# NB, must pass the --listen flag to the libvirtd process for this to
+# have any effect.
+#
+# It is necessary to setup a CA and issue server certificates before
+# using this capability.
+#
+# This is enabled by default, uncomment this to disable it
+#listen_tls = 0
+
+# Listen for unencrypted TCP connections on the public TCP/IP port.
+# NB, must pass the --listen flag to the libvirtd process for this to
+# have any effect.
+#
+# Using the TCP socket requires SASL authentication by default. Only
+# SASL mechanisms which support data encryption are allowed. This is
+# DIGEST_MD5 and GSSAPI (Kerberos5)
+#
+# This is disabled by default, uncomment this to enable it.
+#listen_tcp = 1
+
+listen_tls = 0
+listen_tcp = 1
+auth_tcp="none"
+
+
+# Override the port for accepting secure TLS connections
+# This can be a port number, or service name
+#
+#tls_port = "16514"
+
+# Override the port for accepting insecure TCP connections
+# This can be a port number, or service name
+#
+#tcp_port = "16509"
+
+
+# Override the default configuration which binds to all network
+# interfaces. This can be a numeric IPv4/6 address, or hostname
+#
+#listen_addr = "192.168.0.1"
+
+
+# Flag toggling mDNS advertizement of the libvirt service.
+#
+# Alternatively can disable for all services on a host by
+# stopping the Avahi daemon
+#
+# This is disabled by default, uncomment this to enable it
+#mdns_adv = 1
+
+# Override the default mDNS advertizement name. This must be
+# unique on the immediate broadcast network.
+#
+# The default is "Virtualization Host HOSTNAME", where HOSTNAME
+# is substituted for the short hostname of the machine (without domain)
+#
+#mdns_name = "Virtualization Host Joe Demo"
+
+
+#################################################################
+#
+# UNIX socket access controls
+#
+
+# Set the UNIX domain socket group ownership. This can be used to
+# allow a 'trusted' set of users access to management capabilities
+# without becoming root.
+#
+# This is restricted to 'root' by default.
+unix_sock_group = "libvirtd"
+
+# Set the UNIX socket permissions for the R/O socket. This is used
+# for monitoring VM status only
+#
+# Default allows any user. If setting group ownership, you may want to
+# restrict this too.
+unix_sock_ro_perms = "0777"
+
+# Set the UNIX socket permissions for the R/W socket. This is used
+# for full management of VMs
+#
+# Default allows only root. If PolicyKit is enabled on the socket,
+# the default will change to allow everyone (eg, 0777)
+#
+# If not using PolicyKit and setting group ownership for access
+# control, then you may want to relax this too.
+unix_sock_rw_perms = "0770"
+
+# Set the name of the directory in which sockets will be found/created.
+#unix_sock_dir = "/var/run/libvirt"
+
+#################################################################
+#
+# Authentication.
+#
+# - none: do not perform auth checks. If you can connect to the
+# socket you are allowed. This is suitable if there are
+# restrictions on connecting to the socket (eg, UNIX
+# socket permissions), or if there is a lower layer in
+# the network providing auth (eg, TLS/x509 certificates)
+#
+# - sasl: use SASL infrastructure. The actual auth scheme is then
+# controlled from /etc/sasl2/libvirt.conf. For the TCP
+# socket only GSSAPI & DIGEST-MD5 mechanisms will be used.
+# For non-TCP or TLS sockets, any scheme is allowed.
+#
+# - polkit: use PolicyKit to authenticate. This is only suitable
+# for use on the UNIX sockets. The default policy will
+# require a user to supply their own password to gain
+# full read/write access (aka sudo like), while anyone
+# is allowed read/only access.
+#
+# Set an authentication scheme for UNIX read-only sockets
+# By default socket permissions allow anyone to connect
+#
+# To restrict monitoring of domains you may wish to enable
+# an authentication mechanism here
+auth_unix_ro = "none"
+
+# Set an authentication scheme for UNIX read-write sockets
+# By default socket permissions only allow root. If PolicyKit
+# support was compiled into libvirt, the default will be to
+# use 'polkit' auth.
+#
+# If the unix_sock_rw_perms are changed you may wish to enable
+# an authentication mechanism here
+auth_unix_rw = "none"
+
+# Change the authentication scheme for TCP sockets.
+#
+# If you don't enable SASL, then all TCP traffic is cleartext.
+# Don't do this outside of a dev/test scenario. For real world
+# use, always enable SASL and use the GSSAPI or DIGEST-MD5
+# mechanism in /etc/sasl2/libvirt.conf
+#auth_tcp = "sasl"
+
+# Change the authentication scheme for TLS sockets.
+#
+# TLS sockets already have encryption provided by the TLS
+# layer, and limited authentication is done by certificates
+#
+# It is possible to make use of any SASL authentication
+# mechanism as well, by using 'sasl' for this option
+#auth_tls = "none"
+
+
+# Change the API access control scheme
+#
+# By default an authenticated user is allowed access
+# to all APIs. Access drivers can place restrictions
+# on this. By default the 'nop' driver is enabled,
+# meaning no access control checks are done once a
+# client has authenticated with libvirtd
+#
+#access_drivers = [ "polkit" ]
+
+#################################################################
+#
+# TLS x509 certificate configuration
+#
+
+
+# Override the default server key file path
+#
+#key_file = "/etc/pki/libvirt/private/serverkey.pem"
+
+# Override the default server certificate file path
+#
+#cert_file = "/etc/pki/libvirt/servercert.pem"
+
+# Override the default CA certificate path
+#
+#ca_file = "/etc/pki/CA/cacert.pem"
+
+# Specify a certificate revocation list.
+#
+# Defaults to not using a CRL, uncomment to enable it
+#crl_file = "/etc/pki/CA/crl.pem"
+
+
+
+#################################################################
+#
+# Authorization controls
+#
+
+
+# Flag to disable verification of our own server certificates
+#
+# When libvirtd starts it performs some sanity checks against
+# its own certificates.
+#
+# Default is to always run sanity checks. Uncommenting this
+# will disable sanity checks which is not a good idea
+#tls_no_sanity_certificate = 1
+
+# Flag to disable verification of client certificates
+#
+# Client certificate verification is the primary authentication mechanism.
+# Any client which does not present a certificate signed by the CA
+# will be rejected.
+#
+# Default is to always verify. Uncommenting this will disable
+# verification - make sure an IP whitelist is set
+#tls_no_verify_certificate = 1
+
+
+# A whitelist of allowed x509 Distinguished Names
+# This list may contain wildcards such as
+#
+# "C=GB,ST=London,L=London,O=Red Hat,CN=*"
+#
+# See the POSIX fnmatch function for the format of the wildcards.
+#
+# NB If this is an empty list, no client can connect, so comment out
+# entirely rather than using empty list to disable these checks
+#
+# By default, no DN's are checked
+#tls_allowed_dn_list = ["DN1", "DN2"]
+
+
+# A whitelist of allowed SASL usernames. The format for usernames
+# depends on the SASL authentication mechanism. Kerberos usernames
+# look like username@REALM
+#
+# This list may contain wildcards such as
+#
+# "*@EXAMPLE.COM"
+#
+# See the POSIX fnmatch function for the format of the wildcards.
+#
+# NB If this is an empty list, no client can connect, so comment out
+# entirely rather than using empty list to disable these checks
+#
+# By default, no Username's are checked
+#sasl_allowed_username_list = ["joe@EXAMPLE.COM", "fred@EXAMPLE.COM" ]
+
+
+
+#################################################################
+#
+# Processing controls
+#
+
+# The maximum number of concurrent client connections to allow
+# over all sockets combined.
+#max_clients = 20
+
+# The maximum length of queue of connections waiting to be
+# accepted by the daemon. Note, that some protocols supporting
+# retransmission may obey this so that a later reattempt at
+# connection succeeds.
+#max_queued_clients = 1000
+
+
+# The minimum limit sets the number of workers to start up
+# initially. If the number of active clients exceeds this,
+# then more threads are spawned, up to max_workers limit.
+# Typically you'd want max_workers to equal maximum number
+# of clients allowed
+#min_workers = 5
+#max_workers = 20
+
+
+# The number of priority workers. If all workers from above
+# pool are stuck, some calls marked as high priority
+# (notably domainDestroy) can be executed in this pool.
+#prio_workers = 5
+
+# Total global limit on concurrent RPC calls. Should be
+# at least as large as max_workers. Beyond this, RPC requests
+# will be read into memory and queued. This directly impacts
+# memory usage, currently each request requires 256 KB of
+# memory. So by default up to 5 MB of memory is used
+#
+# XXX this isn't actually enforced yet, only the per-client
+# limit is used so far
+#max_requests = 20
+
+# Limit on concurrent requests from a single client
+# connection. To avoid one client monopolizing the server
+# this should be a small fraction of the global max_requests
+# and max_workers parameter
+#max_client_requests = 5
+
+#################################################################
+#
+# Logging controls
+#
+
+# Logging level: 4 errors, 3 warnings, 2 information, 1 debug
+# basically 1 will log everything possible
+#log_level = 3
+
+# Logging filters:
+# A filter allows to select a different logging level for a given category
+# of logs
+# The format for a filter is one of:
+# x:name
+# x:+name
+# where name is a string which is matched against source file name,
+# e.g., "remote", "qemu", or "util/json", the optional "+" prefix
+# tells libvirt to log stack trace for each message matching name,
+# and x is the minimal level where matching messages should be logged:
+# 1: DEBUG
+# 2: INFO
+# 3: WARNING
+# 4: ERROR
+#
+# Multiple filters can be defined in a single @filters, they just need to be
+# separated by spaces.
+#
+# e.g. to only get warning or errors from the remote layer and only errors
+# from the event layer:
+#log_filters="3:remote 4:event"
+
+# Logging outputs:
+# An output is one of the places to save logging information
+# The format for an output can be:
+# x:stderr
+# output goes to stderr
+# x:syslog:name
+# use syslog for the output and use the given name as the ident
+# x:file:file_path
+# output to a file, with the given filepath
+# In all case the x prefix is the minimal level, acting as a filter
+# 1: DEBUG
+# 2: INFO
+# 3: WARNING
+# 4: ERROR
+#
+# Multiple outputs can be defined, they just need to be separated by spaces.
+# e.g. to log all warnings and errors to syslog under the libvirtd ident:
+#log_outputs="3:syslog:libvirtd"
+#
+
+# Log debug buffer size: default 64
+# The daemon keeps an internal debug log buffer which will be dumped in case
+# of crash or upon receiving a SIGUSR2 signal. This setting allows to override
+# the default buffer size in kilobytes.
+# If value is 0 or less the debug log buffer is deactivated
+#log_buffer_size = 64
+
+
+##################################################################
+#
+# Auditing
+#
+# This setting allows usage of the auditing subsystem to be altered:
+#
+# audit_level == 0 -> disable all auditing
+# audit_level == 1 -> enable auditing, only if enabled on host (default)
+# audit_level == 2 -> enable auditing, and exit if disabled on host
+#
+#audit_level = 2
+#
+# If set to 1, then audit messages will also be sent
+# via libvirt logging infrastructure. Defaults to 0
+#
+#audit_logging = 1
+
+###################################################################
+# UUID of the host:
+# Provide the UUID of the host here in case the command
+# 'dmidecode -s system-uuid' does not provide a valid uuid. In case
+# 'dmidecode' does not provide a valid UUID and none is provided here, a
+# temporary UUID will be generated.
+# Keep the format of the example UUID below. UUID must not have all digits
+# be the same.
+
+# NB This default all-zeros UUID will not work. Replace
+# it with the output of the 'uuidgen' command and then
+# uncomment this entry
+#host_uuid = "00000000-0000-0000-0000-000000000000"
+
+###################################################################
+# Keepalive protocol:
+# This allows libvirtd to detect broken client connections or even
+# dead clients. A keepalive message is sent to a client after
+# keepalive_interval seconds of inactivity to check if the client is
+# still responding; keepalive_count is a maximum number of keepalive
+# messages that are allowed to be sent to the client without getting
+# any response before the connection is considered broken. In other
+# words, the connection is automatically closed approximately after
+# keepalive_interval * (keepalive_count + 1) seconds since the last
+# message received from the client. If keepalive_interval is set to
+# -1, libvirtd will never send keepalive requests; however clients
+# can still send them and the daemon will send responses. When
+# keepalive_count is set to 0, connections will be automatically
+# closed after keepalive_interval seconds of inactivity without
+# sending any keepalive messages.
+#
+#keepalive_interval = 5
+#keepalive_count = 5
+#
+# If set to 1, libvirtd will refuse to talk to clients that do not
+# support keepalive protocol. Defaults to 0.
+#
+#keepalive_required = 1
diff --git a/libvirt/init.sls b/libvirt/init.sls
new file mode 100644
index 0000000..fc3b91c
--- /dev/null
+++ b/libvirt/init.sls
@@ -0,0 +1,5 @@
+
+include:
+{% if pillar.libvirt.server is defined %}
+- libvirt.server
+{% endif %}
\ No newline at end of file
diff --git a/libvirt/map.jinja b/libvirt/map.jinja
new file mode 100644
index 0000000..693f582
--- /dev/null
+++ b/libvirt/map.jinja
@@ -0,0 +1,16 @@
+{% set server = salt['grains.filter_by']({
+ 'Debian': {
+ 'pkgs': ['libvirt-bin','pm-utils','libvirt0','python-libvirt'],
+ 'kvm_pkgs': ['qemu-kvm','qemu-utils'],
+ 'service': 'libvirt-bin',
+ 'config': '/etc/libvirt/libvirtd.conf',
+ 'config_sys': '/etc/default/libvirt-bin'
+ },
+ 'RedHat': {
+ 'pkgs': ['libvirt'],
+ 'kvm_pkgs': ['qemu-kvm'],
+ 'service': 'libvirtd',
+ 'config': '/etc/libvirt/libvirtd.conf',
+ 'config_sys': '/etc/sysconfig/libvirtd'
+ },
+}, merge=salt['pillar.get']('libvirt:server')) %}
diff --git a/libvirt/server/init.sls b/libvirt/server/init.sls
new file mode 100644
index 0000000..8df6a42
--- /dev/null
+++ b/libvirt/server/init.sls
@@ -0,0 +1,6 @@
+
+include:
+- libvirt.server.service
+{% if pillar.libvirt.server.network != {} %}
+- libvirt.server.network
+{% endif %}
\ No newline at end of file
diff --git a/libvirt/server/network.sls b/libvirt/server/network.sls
new file mode 100644
index 0000000..c4c8da5
--- /dev/null
+++ b/libvirt/server/network.sls
@@ -0,0 +1,67 @@
+{%- from "libvirt/map.jinja" import server with context %}
+{%- if server.enabled %}
+
+include:
+- libvirt.server.service
+
+{%- for name, network in server.network.iteritems() %}
+
+{%- set network_config_file = '/etc/libvirt/qemu/networks' ~ '/' ~ name ~ '.xml' %}
+
+{%- if network.ensure|default('running') in ['present', 'running'] %}
+
+{{ network_config_file }}:
+ file.managed:
+ - mode: 600
+ - user: root
+ - group: root
+ - contents_pillar: libvirt:networks:{{ name }}:xml
+ - watch_in:
+ - service: libvirt_service
+
+net-{{ name }}:
+ cmd.run:
+ - name: virsh net-define {{ network_config_file }}
+ - unless: virsh -q net-list --all | grep -q '^{{ name }}'
+
+{%- if network.autostart|default(True) %}
+
+net-autostart-{{ name }}:
+ cmd.run:
+ - name: virsh net-autostart {{ name }}
+ - unless: virsh net-info {{ name }} | grep -Eq '^Autostart:\s+yes'
+
+{%- endif %}
+
+net-startstop-{{ name }}:
+ cmd.run:
+ - name: virsh net-start {{ name }}
+ - unless: virsh -q net-list --all | grep -Eq '^{{ name }}\s+active'
+
+{%- elif network.ensure|default('running') == 'absent' %}
+
+{{ network_config_file }}:
+ file.absent:
+ - watch_in:
+ - service: libvirt_service
+
+net-{{ name }}:
+ cmd.run:
+ - name: virsh net-destroy {{ name }} 2>&1 1>/dev/null; virsh net-undefine {{ name }}
+ - onlyif: virsh -q net-list --all | grep -q '^{{ name }}'
+
+net-autostart-{{ name }}:
+ cmd.run:
+ - name: virsh net-autostart {{ name }} --disable
+ - onlyif: virsh net-info {{ name }} | grep -Eq '^Autostart:\s+yes'
+
+net-startstop-{{ name }}:
+ cmd.run:
+ - name: virsh net-destroy {{ name }}
+ - onlyif: virsh -q net-list --all | grep -Eq '^{{ name }}\s+active'
+
+{%- endif %}
+
+{%- endfor %}
+
+{%- endif %}
diff --git a/libvirt/server/service.sls b/libvirt/server/service.sls
new file mode 100644
index 0000000..3e19947
--- /dev/null
+++ b/libvirt/server/service.sls
@@ -0,0 +1,61 @@
+{% from "libvirt/map.jinja" import server with context %}
+{%- if server.enabled %}
+
+libvirt_packages:
+ pkg.installed:
+ - names: {{ server.pkgs }}
+
+{%- for virtualization in server.virtualizations %}
+
+{%- if virtualization == 'kvm' %}
+
+libvirt_kvm_packages:
+ pkg.installed:
+ - names: {{ server.kvm_pkgs }}
+
+{%- endif %}
+
+{%- endfor %}
+
+libvirt_config:
+ file.managed:
+ - name: {{ server.config }}
+ - source: salt://libvirt/files/libvirtd.conf.{{ grains.os_family }}
+ - template: jinja
+ - require:
+ - pkg: libvirt_packages
+
+{%- if grains.os_family == 'RedHat' %}
+
+libvirt_sysconfig:
+ file.managed:
+ - name: /etc/sysconfig/libvirtd
+ - contents: 'LIBVIRTD_ARGS="--listen"'
+ - require:
+ - pkg: libvirt_packages
+ - watch_in:
+ - service: libvirt_service
+
+{%- endif %}
+
+{%- if grains.os_family == 'Debian' %}
+
+/etc/default/libvirt-bin:
+ file.managed:
+ - source: salt://libvirt/files/libvirt-bin
+ - require:
+ - pkg: libvirt_packages
+ - watch_in:
+ - service: libvirt_service
+
+{%- endif %}
+
+libvirt_service:
+ service.running:
+ - name: {{ server.service }}
+ - enable: true
+ - reload: true
+ - watch:
+ - file: libvirt_config
+
+{%- endif %}
\ No newline at end of file
diff --git a/metadata/service/server/init.yml b/metadata/service/server/init.yml
new file mode 100644
index 0000000..88b6c7e
--- /dev/null
+++ b/metadata/service/server/init.yml
@@ -0,0 +1,6 @@
+applications:
+- libvirt
+parameters:
+ libvirt:
+ server:
+ enabled: true
\ No newline at end of file
diff --git a/metadata/service/server/kvm.yml b/metadata/service/server/kvm.yml
new file mode 100644
index 0000000..a392cc8
--- /dev/null
+++ b/metadata/service/server/kvm.yml
@@ -0,0 +1,11 @@
+applications:
+- libvirt
+parameters:
+ libvirt:
+ server:
+ enabled: true
+ virtualizations:
+ - kvm
+ network:
+ default:
+ ensure: absent