mirror of https://github.com/ansible/ansible.git
René Moser
9 years ago
committed by
GitHub
commit
a99464f545
@ -0,0 +1,133 @@
|
||||
#!/usr/bin/python
|
||||
# -*- coding: utf-8 -*-
|
||||
|
||||
# (c) 2016, Hiroaki Nakamura <hnakamur@gmail.com>
|
||||
#
|
||||
# This file is part of Ansible
|
||||
#
|
||||
# Ansible is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Ansible is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Ansible. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
try:
|
||||
import json
|
||||
except ImportError:
|
||||
import simplejson as json
|
||||
|
||||
# httplib/http.client connection using unix domain socket
|
||||
import socket
|
||||
import ssl
|
||||
try:
|
||||
from httplib import HTTPConnection, HTTPSConnection
|
||||
except ImportError:
|
||||
# Python 3
|
||||
from http.client import HTTPConnection, HTTPSConnection
|
||||
|
||||
class UnixHTTPConnection(HTTPConnection):
|
||||
def __init__(self, path):
|
||||
HTTPConnection.__init__(self, 'localhost')
|
||||
self.path = path
|
||||
|
||||
def connect(self):
|
||||
sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
|
||||
sock.connect(self.path)
|
||||
self.sock = sock
|
||||
|
||||
from ansible.module_utils.urls import generic_urlparse
|
||||
try:
|
||||
from urlparse import urlparse
|
||||
except ImportError:
|
||||
# Python 3
|
||||
from url.parse import urlparse
|
||||
|
||||
class LXDClientException(Exception):
|
||||
def __init__(self, msg, **kwargs):
|
||||
self.msg = msg
|
||||
self.kwargs = kwargs
|
||||
|
||||
class LXDClient(object):
|
||||
def __init__(self, url, key_file=None, cert_file=None, debug=False):
|
||||
"""LXD Client.
|
||||
|
||||
:param url: The URL of the LXD server. (e.g. unix:/var/lib/lxd/unix.socket or https://127.0.0.1)
|
||||
:type url: ``str``
|
||||
:param key_file: The path of the client certificate key file.
|
||||
:type key_file: ``str``
|
||||
:param cert_file: The path of the client certificate file.
|
||||
:type cert_file: ``str``
|
||||
:param debug: The debug flag. The request and response are stored in logs when debug is true.
|
||||
:type debug: ``bool``
|
||||
"""
|
||||
self.url = url
|
||||
self.debug = debug
|
||||
self.logs = []
|
||||
if url.startswith('https:'):
|
||||
self.cert_file = cert_file
|
||||
self.key_file = key_file
|
||||
parts = generic_urlparse(urlparse(self.url))
|
||||
ctx = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
|
||||
ctx.load_cert_chain(cert_file, keyfile=key_file)
|
||||
self.connection = HTTPSConnection(parts.get('netloc'), context=ctx)
|
||||
elif url.startswith('unix:'):
|
||||
unix_socket_path = url[len('unix:'):]
|
||||
self.connection = UnixHTTPConnection(unix_socket_path)
|
||||
else:
|
||||
raise LXDClientException('URL scheme must be unix: or https:')
|
||||
|
||||
def do(self, method, url, body_json=None, ok_error_codes=None, timeout=None):
|
||||
resp_json = self._send_request(method, url, body_json=body_json, ok_error_codes=ok_error_codes, timeout=timeout)
|
||||
if resp_json['type'] == 'async':
|
||||
url = '{0}/wait'.format(resp_json['operation'])
|
||||
resp_json = self._send_request('GET', url)
|
||||
if resp_json['metadata']['status'] != 'Success':
|
||||
self._raise_err_from_json(resp_json)
|
||||
return resp_json
|
||||
|
||||
def authenticate(self, trust_password):
|
||||
body_json = {'type': 'client', 'password': trust_password}
|
||||
return self._send_request('POST', '/1.0/certificates', body_json=body_json)
|
||||
|
||||
def _send_request(self, method, url, body_json=None, ok_error_codes=None, timeout=None):
|
||||
try:
|
||||
body = json.dumps(body_json)
|
||||
self.connection.request(method, url, body=body)
|
||||
resp = self.connection.getresponse()
|
||||
resp_json = json.loads(resp.read())
|
||||
self.logs.append({
|
||||
'type': 'sent request',
|
||||
'request': {'method': method, 'url': url, 'json': body_json, 'timeout': timeout},
|
||||
'response': {'json': resp_json}
|
||||
})
|
||||
resp_type = resp_json.get('type', None)
|
||||
if resp_type == 'error':
|
||||
if ok_error_codes is not None and resp_json['error_code'] in ok_error_codes:
|
||||
return resp_json
|
||||
self._raise_err_from_json(resp_json)
|
||||
return resp_json
|
||||
except socket.error as e:
|
||||
raise LXDClientException('cannot connect to the LXD server', err=e)
|
||||
|
||||
def _raise_err_from_json(self, resp_json):
|
||||
err_params = {}
|
||||
if self.debug:
|
||||
err_params['logs'] = self.logs
|
||||
raise LXDClientException(self._get_err_from_resp_json(resp_json), **err_params)
|
||||
|
||||
@staticmethod
|
||||
def _get_err_from_resp_json(resp_json):
|
||||
err = None
|
||||
metadata = resp_json.get('metadata', None)
|
||||
if metadata is not None:
|
||||
err = metadata.get('err', None)
|
||||
if err is None:
|
||||
err = resp_json.get('error', None)
|
||||
return err
|
||||
@ -0,0 +1,610 @@
|
||||
#!/usr/bin/python
|
||||
# -*- coding: utf-8 -*-
|
||||
|
||||
# (c) 2016, Hiroaki Nakamura <hnakamur@gmail.com>
|
||||
#
|
||||
# This file is part of Ansible
|
||||
#
|
||||
# Ansible is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Ansible is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Ansible. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
|
||||
DOCUMENTATION = '''
|
||||
---
|
||||
module: lxd_container
|
||||
short_description: Manage LXD Containers
|
||||
version_added: 2.2.0
|
||||
description:
|
||||
- Management of LXD containers
|
||||
author: "Hiroaki Nakamura (@hnakamur)"
|
||||
options:
|
||||
name:
|
||||
description:
|
||||
- Name of a container.
|
||||
required: true
|
||||
architecture:
|
||||
description:
|
||||
- The archiecture for the container (e.g. "x86_64" or "i686").
|
||||
See U(https://github.com/lxc/lxd/blob/master/doc/rest-api.md#post-1)
|
||||
required: false
|
||||
config:
|
||||
description:
|
||||
- 'The config for the container (e.g. {"limits.cpu": "2"}).
|
||||
See U(https://github.com/lxc/lxd/blob/master/doc/rest-api.md#post-1)'
|
||||
- If the container already exists and its "config" value in metadata
|
||||
obtained from
|
||||
GET /1.0/containers/<name>
|
||||
U(https://github.com/lxc/lxd/blob/master/doc/rest-api.md#10containersname)
|
||||
are different, they this module tries to apply the configurations.
|
||||
- The key starts with 'volatile.' are ignored for this comparison.
|
||||
- Not all config values are supported to apply the existing container.
|
||||
Maybe you need to delete and recreate a container.
|
||||
required: false
|
||||
devices:
|
||||
description:
|
||||
- 'The devices for the container
|
||||
(e.g. { "rootfs": { "path": "/dev/kvm", "type": "unix-char" }).
|
||||
See U(https://github.com/lxc/lxd/blob/master/doc/rest-api.md#post-1)'
|
||||
required: false
|
||||
ephemeral:
|
||||
description:
|
||||
- Whether or not the container is ephemeral (e.g. true or false).
|
||||
See U(https://github.com/lxc/lxd/blob/master/doc/rest-api.md#post-1)
|
||||
required: false
|
||||
source:
|
||||
description:
|
||||
- 'The source for the container
|
||||
(e.g. { "type": "image",
|
||||
"mode": "pull",
|
||||
"server": "https://images.linuxcontainers.org",
|
||||
"protocol": "lxd",
|
||||
"alias": "ubuntu/xenial/amd64" }).
|
||||
See U(https://github.com/lxc/lxd/blob/master/doc/rest-api.md#post-1)'
|
||||
required: false
|
||||
state:
|
||||
choices:
|
||||
- started
|
||||
- stopped
|
||||
- restarted
|
||||
- absent
|
||||
- frozen
|
||||
description:
|
||||
- Define the state of a container.
|
||||
required: false
|
||||
default: started
|
||||
timeout:
|
||||
description:
|
||||
- A timeout for changing the state of the container.
|
||||
- This is also used as a timeout for waiting until IPv4 addresses
|
||||
are set to the all network interfaces in the container after
|
||||
starting or restarting.
|
||||
required: false
|
||||
default: 30
|
||||
wait_for_ipv4_addresses:
|
||||
description:
|
||||
- If this is true, the M(lxd_container) waits until IPv4 addresses
|
||||
are set to the all network interfaces in the container after
|
||||
starting or restarting.
|
||||
required: false
|
||||
default: false
|
||||
force_stop:
|
||||
description:
|
||||
- If this is true, the M(lxd_container) forces to stop the container
|
||||
when it stops or restarts the container.
|
||||
required: false
|
||||
default: false
|
||||
url:
|
||||
description:
|
||||
- The unix domain socket path or the https URL for the LXD server.
|
||||
required: false
|
||||
default: unix:/var/lib/lxd/unix.socket
|
||||
key_file:
|
||||
description:
|
||||
- The client certificate key file path.
|
||||
required: false
|
||||
default: '"{}/.config/lxc/client.key" .format(os.environ["HOME"])'
|
||||
cert_file:
|
||||
description:
|
||||
- The client certificate file path.
|
||||
required: false
|
||||
default: '"{}/.config/lxc/client.crt" .format(os.environ["HOME"])'
|
||||
trust_password:
|
||||
description:
|
||||
- The client trusted password.
|
||||
- You need to set this password on the LXD server before
|
||||
running this module using the following command.
|
||||
lxc config set core.trust_password <some random password>
|
||||
See U(https://www.stgraber.org/2016/04/18/lxd-api-direct-interaction/)
|
||||
- If trust_password is set, this module send a request for
|
||||
authentication before sending any requests.
|
||||
required: false
|
||||
notes:
|
||||
- Containers must have a unique name. If you attempt to create a container
|
||||
with a name that already existed in the users namespace the module will
|
||||
simply return as "unchanged".
|
||||
- There are two ways to can run commands in containers, using the command
|
||||
module or using the ansible lxd connection plugin bundled in Ansible >=
|
||||
2.1, the later requires python to be installed in the container which can
|
||||
be done with the command module.
|
||||
- You can copy a file from the host to the container
|
||||
with the Ansible M(copy) and M(templater) module and the `lxd` connection plugin.
|
||||
See the example below.
|
||||
- You can copy a file in the creatd container to the localhost
|
||||
with `command=lxc file pull container_name/dir/filename filename`.
|
||||
See the first example below.
|
||||
'''
|
||||
|
||||
EXAMPLES = '''
|
||||
# An example for creating a Ubuntu container and install python
|
||||
- hosts: localhost
|
||||
connection: local
|
||||
tasks:
|
||||
- name: Create a started container
|
||||
lxd_container:
|
||||
name: mycontainer
|
||||
state: started
|
||||
source:
|
||||
type: image
|
||||
mode: pull
|
||||
server: https://images.linuxcontainers.org
|
||||
protocol: lxd
|
||||
alias: ubuntu/xenial/amd64
|
||||
profiles: ["default"]
|
||||
wait_for_ipv4_addresses: true
|
||||
timeout: 600
|
||||
|
||||
- name: check python is installed in container
|
||||
delegate_to: mycontainer
|
||||
raw: dpkg -s python
|
||||
register: python_install_check
|
||||
failed_when: python_install_check.rc not in [0, 1]
|
||||
changed_when: false
|
||||
|
||||
- name: install python in container
|
||||
delegate_to: mycontainer
|
||||
raw: apt-get install -y python
|
||||
when: python_install_check.rc == 1
|
||||
|
||||
# An example for deleting a container
|
||||
- hosts: localhost
|
||||
connection: local
|
||||
tasks:
|
||||
- name: Restart a container
|
||||
lxd_container:
|
||||
name: mycontainer
|
||||
state: restarted
|
||||
|
||||
# An example for restarting a container
|
||||
- hosts: localhost
|
||||
connection: local
|
||||
tasks:
|
||||
- name: Restart a container
|
||||
lxd_container:
|
||||
name: mycontainer
|
||||
state: restarted
|
||||
|
||||
# An example for restarting a container using https to connect to the LXD server
|
||||
- hosts: localhost
|
||||
connection: local
|
||||
tasks:
|
||||
- name: Restart a container
|
||||
lxd_container:
|
||||
url: https://127.0.0.1:8443
|
||||
# These cert_file and key_file values are equal to the default values.
|
||||
#cert_file: "{{ lookup('env', 'HOME') }}/.config/lxc/client.crt"
|
||||
#key_file: "{{ lookup('env', 'HOME') }}/.config/lxc/client.key"
|
||||
trust_password: mypassword
|
||||
name: mycontainer
|
||||
state: restarted
|
||||
|
||||
# Note your container must be in the inventory for the below example.
|
||||
#
|
||||
# [containers]
|
||||
# mycontainer ansible_connection=lxd
|
||||
#
|
||||
- hosts:
|
||||
- mycontainer
|
||||
tasks:
|
||||
- name: copy /etc/hosts in the created container to localhost with name "mycontainer-hosts"
|
||||
fetch:
|
||||
src: /etc/hosts
|
||||
dest: /tmp/mycontainer-hosts
|
||||
flat: true
|
||||
'''
|
||||
|
||||
RETURN='''
|
||||
addresses:
|
||||
description: Mapping from the network device name to a list of IPv4 addresses in the container
|
||||
returned: when state is started or restarted
|
||||
type: object
|
||||
sample: {"eth0": ["10.155.92.191"]}
|
||||
old_state:
|
||||
description: The old state of the container
|
||||
returned: when state is started or restarted
|
||||
type: string
|
||||
sample: "stopped"
|
||||
logs:
|
||||
description: The logs of requests and responses.
|
||||
returned: when ansible-playbook is invoked with -vvvv.
|
||||
type: list
|
||||
sample: "(too long to be placed here)"
|
||||
actions:
|
||||
description: List of actions performed for the container.
|
||||
returned: success
|
||||
type: list
|
||||
sample: '["create", "start"]'
|
||||
'''
|
||||
|
||||
import os
|
||||
from ansible.modules.extras.cloud.lxd import LXDClient, LXDClientException
|
||||
|
||||
# LXD_ANSIBLE_STATES is a map of states that contain values of methods used
|
||||
# when a particular state is evoked.
|
||||
LXD_ANSIBLE_STATES = {
|
||||
'started': '_started',
|
||||
'stopped': '_stopped',
|
||||
'restarted': '_restarted',
|
||||
'absent': '_destroyed',
|
||||
'frozen': '_frozen'
|
||||
}
|
||||
|
||||
# ANSIBLE_LXD_STATES is a map of states of lxd containers to the Ansible
|
||||
# lxc_container module state parameter value.
|
||||
ANSIBLE_LXD_STATES = {
|
||||
'Running': 'started',
|
||||
'Stopped': 'stopped',
|
||||
'Frozen': 'frozen',
|
||||
}
|
||||
|
||||
# CONFIG_PARAMS is a list of config attribute names.
|
||||
CONFIG_PARAMS = [
|
||||
'architecture', 'config', 'devices', 'ephemeral', 'profiles', 'source'
|
||||
]
|
||||
|
||||
try:
|
||||
callable(all)
|
||||
except NameError:
|
||||
# For python <2.5
|
||||
# This definition is copied from https://docs.python.org/2/library/functions.html#all
|
||||
def all(iterable):
|
||||
for element in iterable:
|
||||
if not element:
|
||||
return False
|
||||
return True
|
||||
|
||||
class LXDContainerManagement(object):
|
||||
def __init__(self, module):
|
||||
"""Management of LXC containers via Ansible.
|
||||
|
||||
:param module: Processed Ansible Module.
|
||||
:type module: ``object``
|
||||
"""
|
||||
self.module = module
|
||||
self.name = self.module.params['name']
|
||||
self._build_config()
|
||||
|
||||
self.state = self.module.params['state']
|
||||
|
||||
self.timeout = self.module.params['timeout']
|
||||
self.wait_for_ipv4_addresses = self.module.params['wait_for_ipv4_addresses']
|
||||
self.force_stop = self.module.params['force_stop']
|
||||
self.addresses = None
|
||||
|
||||
self.url = self.module.params['url']
|
||||
self.key_file = self.module.params.get('key_file', None)
|
||||
self.cert_file = self.module.params.get('cert_file', None)
|
||||
self.debug = self.module._verbosity >= 4
|
||||
try:
|
||||
self.client = LXDClient(
|
||||
self.url, key_file=self.key_file, cert_file=self.cert_file,
|
||||
debug=self.debug
|
||||
)
|
||||
except LXDClientException as e:
|
||||
self.module.fail_json(msg=e.msg)
|
||||
self.trust_password = self.module.params.get('trust_password', None)
|
||||
self.actions = []
|
||||
|
||||
def _build_config(self):
|
||||
self.config = {}
|
||||
for attr in CONFIG_PARAMS:
|
||||
param_val = self.module.params.get(attr, None)
|
||||
if param_val is not None:
|
||||
self.config[attr] = param_val
|
||||
|
||||
def _get_container_json(self):
|
||||
return self.client.do(
|
||||
'GET', '/1.0/containers/{0}'.format(self.name),
|
||||
ok_error_codes=[404]
|
||||
)
|
||||
|
||||
def _get_container_state_json(self):
|
||||
return self.client.do(
|
||||
'GET', '/1.0/containers/{0}/state'.format(self.name),
|
||||
ok_error_codes=[404]
|
||||
)
|
||||
|
||||
@staticmethod
|
||||
def _container_json_to_module_state(resp_json):
|
||||
if resp_json['type'] == 'error':
|
||||
return 'absent'
|
||||
return ANSIBLE_LXD_STATES[resp_json['metadata']['status']]
|
||||
|
||||
def _change_state(self, action, force_stop=False):
|
||||
body_json={'action': action, 'timeout': self.timeout}
|
||||
if force_stop:
|
||||
body_json['force'] = True
|
||||
return self.client.do('PUT', '/1.0/containers/{0}/state'.format(self.name), body_json=body_json)
|
||||
|
||||
def _create_container(self):
|
||||
config = self.config.copy()
|
||||
config['name'] = self.name
|
||||
self.client.do('POST', '/1.0/containers', config)
|
||||
self.actions.append('create')
|
||||
|
||||
def _start_container(self):
|
||||
self._change_state('start')
|
||||
self.actions.append('start')
|
||||
|
||||
def _stop_container(self):
|
||||
self._change_state('stop', self.force_stop)
|
||||
self.actions.append('stop')
|
||||
|
||||
def _restart_container(self):
|
||||
self._change_state('restart', self.force_stop)
|
||||
self.actions.append('restart')
|
||||
|
||||
def _delete_container(self):
|
||||
return self.client.do('DELETE', '/1.0/containers/{0}'.format(self.name))
|
||||
self.actions.append('delete')
|
||||
|
||||
def _freeze_container(self):
|
||||
self._change_state('freeze')
|
||||
self.actions.append('freeze')
|
||||
|
||||
def _unfreeze_container(self):
|
||||
self._change_state('unfreeze')
|
||||
self.actions.append('unfreez')
|
||||
|
||||
def _container_ipv4_addresses(self, ignore_devices=['lo']):
|
||||
resp_json = self._get_container_state_json()
|
||||
network = resp_json['metadata']['network'] or {}
|
||||
network = dict((k, v) for k, v in network.items() if k not in ignore_devices) or {}
|
||||
addresses = dict((k, [a['address'] for a in v['addresses'] if a['family'] == 'inet']) for k, v in network.items()) or {}
|
||||
return addresses
|
||||
|
||||
@staticmethod
|
||||
def _has_all_ipv4_addresses(addresses):
|
||||
return len(addresses) > 0 and all([len(v) > 0 for v in addresses.itervalues()])
|
||||
|
||||
def _get_addresses(self):
|
||||
try:
|
||||
due = datetime.datetime.now() + datetime.timedelta(seconds=self.timeout)
|
||||
while datetime.datetime.now() < due:
|
||||
time.sleep(1)
|
||||
addresses = self._container_ipv4_addresses()
|
||||
if self._has_all_ipv4_addresses(addresses):
|
||||
self.addresses = addresses
|
||||
return
|
||||
except LXDClientException as e:
|
||||
e.msg = 'timeout for getting IPv4 addresses'
|
||||
raise
|
||||
|
||||
def _started(self):
|
||||
if self.old_state == 'absent':
|
||||
self._create_container()
|
||||
self._start_container()
|
||||
else:
|
||||
if self.old_state == 'frozen':
|
||||
self._unfreeze_container()
|
||||
elif self.old_state == 'stopped':
|
||||
self._start_container()
|
||||
if self._needs_to_apply_container_configs():
|
||||
self._apply_container_configs()
|
||||
if self.wait_for_ipv4_addresses:
|
||||
self._get_addresses()
|
||||
|
||||
def _stopped(self):
|
||||
if self.old_state == 'absent':
|
||||
self._create_container()
|
||||
else:
|
||||
if self.old_state == 'stopped':
|
||||
if self._needs_to_apply_container_configs():
|
||||
self._start_container()
|
||||
self._apply_container_configs()
|
||||
self._stop_container()
|
||||
else:
|
||||
if self.old_state == 'frozen':
|
||||
self._unfreeze_container()
|
||||
if self._needs_to_apply_container_configs():
|
||||
self._apply_container_configs()
|
||||
self._stop_container()
|
||||
|
||||
def _restarted(self):
|
||||
if self.old_state == 'absent':
|
||||
self._create_container()
|
||||
self._start_container()
|
||||
else:
|
||||
if self.old_state == 'frozen':
|
||||
self._unfreeze_container()
|
||||
if self._needs_to_apply_container_configs():
|
||||
self._apply_container_configs()
|
||||
self._restart_container()
|
||||
if self.wait_for_ipv4_addresses:
|
||||
self._get_addresses()
|
||||
|
||||
def _destroyed(self):
|
||||
if self.old_state != 'absent':
|
||||
if self.old_state == 'frozen':
|
||||
self._unfreeze_container()
|
||||
self._stop_container()
|
||||
self._delete_container()
|
||||
|
||||
def _frozen(self):
|
||||
if self.old_state == 'absent':
|
||||
self._create_container()
|
||||
self._start_container()
|
||||
self._freeze_container()
|
||||
else:
|
||||
if self.old_state == 'stopped':
|
||||
self._start_container()
|
||||
if self._needs_to_apply_container_configs():
|
||||
self._apply_container_configs()
|
||||
self._freeze_container()
|
||||
|
||||
def _needs_to_change_container_config(self, key):
|
||||
if key not in self.config:
|
||||
return False
|
||||
if key == 'config':
|
||||
old_configs = dict((k, v) for k, v in self.old_container_json['metadata'][key].items() if not k.startswith('volatile.'))
|
||||
else:
|
||||
old_configs = self.old_container_json['metadata'][key]
|
||||
return self.config[key] != old_configs
|
||||
|
||||
def _needs_to_apply_container_configs(self):
|
||||
return (
|
||||
self._needs_to_change_container_config('architecture') or
|
||||
self._needs_to_change_container_config('config') or
|
||||
self._needs_to_change_container_config('ephemeral') or
|
||||
self._needs_to_change_container_config('devices') or
|
||||
self._needs_to_change_container_config('profiles')
|
||||
)
|
||||
|
||||
def _apply_container_configs(self):
|
||||
old_metadata = self.old_container_json['metadata']
|
||||
body_json = {
|
||||
'architecture': old_metadata['architecture'],
|
||||
'config': old_metadata['config'],
|
||||
'devices': old_metadata['devices'],
|
||||
'profiles': old_metadata['profiles']
|
||||
}
|
||||
if self._needs_to_change_container_config('architecture'):
|
||||
body_json['architecture'] = self.config['architecture']
|
||||
if self._needs_to_change_container_config('config'):
|
||||
for k, v in self.config['config'].items():
|
||||
body_json['config'][k] = v
|
||||
if self._needs_to_change_container_config('ephemeral'):
|
||||
body_json['ephemeral'] = self.config['ephemeral']
|
||||
if self._needs_to_change_container_config('devices'):
|
||||
body_json['devices'] = self.config['devices']
|
||||
if self._needs_to_change_container_config('profiles'):
|
||||
body_json['profiles'] = self.config['profiles']
|
||||
self.client.do('PUT', '/1.0/containers/{0}'.format(self.name), body_json=body_json)
|
||||
self.actions.append('apply_container_configs')
|
||||
|
||||
def run(self):
|
||||
"""Run the main method."""
|
||||
|
||||
try:
|
||||
if self.trust_password is not None:
|
||||
self.client.authenticate(self.trust_password)
|
||||
|
||||
self.old_container_json = self._get_container_json()
|
||||
self.old_state = self._container_json_to_module_state(self.old_container_json)
|
||||
action = getattr(self, LXD_ANSIBLE_STATES[self.state])
|
||||
action()
|
||||
|
||||
state_changed = len(self.actions) > 0
|
||||
result_json = {
|
||||
'log_verbosity': self.module._verbosity,
|
||||
'changed': state_changed,
|
||||
'old_state': self.old_state,
|
||||
'actions': self.actions
|
||||
}
|
||||
if self.client.debug:
|
||||
result_json['logs'] = self.client.logs
|
||||
if self.addresses is not None:
|
||||
result_json['addresses'] = self.addresses
|
||||
self.module.exit_json(**result_json)
|
||||
except LXDClientException as e:
|
||||
state_changed = len(self.actions) > 0
|
||||
fail_params = {
|
||||
'msg': e.msg,
|
||||
'changed': state_changed,
|
||||
'actions': self.actions
|
||||
}
|
||||
if self.client.debug:
|
||||
fail_params['logs'] = e.kwargs['logs']
|
||||
self.module.fail_json(**fail_params)
|
||||
|
||||
def main():
|
||||
"""Ansible Main module."""
|
||||
|
||||
module = AnsibleModule(
|
||||
argument_spec=dict(
|
||||
name=dict(
|
||||
type='str',
|
||||
required=True
|
||||
),
|
||||
architecture=dict(
|
||||
type='str',
|
||||
),
|
||||
config=dict(
|
||||
type='dict',
|
||||
),
|
||||
description=dict(
|
||||
type='str',
|
||||
),
|
||||
devices=dict(
|
||||
type='dict',
|
||||
),
|
||||
ephemeral=dict(
|
||||
type='bool',
|
||||
),
|
||||
profiles=dict(
|
||||
type='list',
|
||||
),
|
||||
source=dict(
|
||||
type='dict',
|
||||
),
|
||||
state=dict(
|
||||
choices=LXD_ANSIBLE_STATES.keys(),
|
||||
default='started'
|
||||
),
|
||||
timeout=dict(
|
||||
type='int',
|
||||
default=30
|
||||
),
|
||||
wait_for_ipv4_addresses=dict(
|
||||
type='bool',
|
||||
default=False
|
||||
),
|
||||
force_stop=dict(
|
||||
type='bool',
|
||||
default=False
|
||||
),
|
||||
url=dict(
|
||||
type='str',
|
||||
default='unix:/var/lib/lxd/unix.socket'
|
||||
),
|
||||
key_file=dict(
|
||||
type='str',
|
||||
default='{}/.config/lxc/client.key'.format(os.environ['HOME'])
|
||||
),
|
||||
cert_file=dict(
|
||||
type='str',
|
||||
default='{}/.config/lxc/client.crt'.format(os.environ['HOME'])
|
||||
),
|
||||
trust_password=dict(
|
||||
type='str',
|
||||
)
|
||||
),
|
||||
supports_check_mode=False,
|
||||
)
|
||||
|
||||
lxd_manage = LXDContainerManagement(module=module)
|
||||
lxd_manage.run()
|
||||
|
||||
# import module bits
|
||||
from ansible.module_utils.basic import *
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
@ -0,0 +1,374 @@
|
||||
#!/usr/bin/python
|
||||
# -*- coding: utf-8 -*-
|
||||
|
||||
# (c) 2016, Hiroaki Nakamura <hnakamur@gmail.com>
|
||||
#
|
||||
# This file is part of Ansible
|
||||
#
|
||||
# Ansible is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Ansible is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Ansible. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
|
||||
DOCUMENTATION = '''
|
||||
---
|
||||
module: lxd_profile
|
||||
short_description: Manage LXD profiles
|
||||
version_added: 2.2.0
|
||||
description:
|
||||
- Management of LXD profiles
|
||||
author: "Hiroaki Nakamura (@hnakamur)"
|
||||
options:
|
||||
name:
|
||||
description:
|
||||
- Name of a profile.
|
||||
required: true
|
||||
config:
|
||||
description:
|
||||
- 'The config for the container (e.g. {"limits.memory": "4GB"}).
|
||||
See U(https://github.com/lxc/lxd/blob/master/doc/rest-api.md#patch-3)'
|
||||
- If the profile already exists and its "config" value in metadata
|
||||
obtained from
|
||||
GET /1.0/profiles/<name>
|
||||
U(https://github.com/lxc/lxd/blob/master/doc/rest-api.md#get-19)
|
||||
are different, they this module tries to apply the configurations.
|
||||
- Not all config values are supported to apply the existing profile.
|
||||
Maybe you need to delete and recreate a profile.
|
||||
required: false
|
||||
devices:
|
||||
description:
|
||||
- 'The devices for the profile
|
||||
(e.g. {"rootfs": {"path": "/dev/kvm", "type": "unix-char"}).
|
||||
See U(https://github.com/lxc/lxd/blob/master/doc/rest-api.md#patch-3)'
|
||||
required: false
|
||||
new_name:
|
||||
description:
|
||||
- A new name of a profile.
|
||||
- If this parameter is specified a profile will be renamed to this name.
|
||||
See U(https://github.com/lxc/lxd/blob/master/doc/rest-api.md#post-11)
|
||||
required: false
|
||||
state:
|
||||
choices:
|
||||
- present
|
||||
- absent
|
||||
description:
|
||||
- Define the state of a profile.
|
||||
required: false
|
||||
default: present
|
||||
url:
|
||||
description:
|
||||
- The unix domain socket path or the https URL for the LXD server.
|
||||
required: false
|
||||
default: unix:/var/lib/lxd/unix.socket
|
||||
key_file:
|
||||
description:
|
||||
- The client certificate key file path.
|
||||
required: false
|
||||
default: '"{}/.config/lxc/client.key" .format(os.environ["HOME"])'
|
||||
cert_file:
|
||||
description:
|
||||
- The client certificate file path.
|
||||
required: false
|
||||
default: '"{}/.config/lxc/client.crt" .format(os.environ["HOME"])'
|
||||
trust_password:
|
||||
description:
|
||||
- The client trusted password.
|
||||
- You need to set this password on the LXD server before
|
||||
running this module using the following command.
|
||||
lxc config set core.trust_password <some random password>
|
||||
See U(https://www.stgraber.org/2016/04/18/lxd-api-direct-interaction/)
|
||||
- If trust_password is set, this module send a request for
|
||||
authentication before sending any requests.
|
||||
required: false
|
||||
notes:
|
||||
- Profiles must have a unique name. If you attempt to create a profile
|
||||
with a name that already existed in the users namespace the module will
|
||||
simply return as "unchanged".
|
||||
'''
|
||||
|
||||
EXAMPLES = '''
|
||||
# An example for creating a profile
|
||||
- hosts: localhost
|
||||
connection: local
|
||||
tasks:
|
||||
- name: Create a profile
|
||||
lxd_profile:
|
||||
name: macvlan
|
||||
state: present
|
||||
config: {}
|
||||
description: 'my macvlan profile'
|
||||
devices:
|
||||
eth0:
|
||||
nictype: macvlan
|
||||
parent: br0
|
||||
type: nic
|
||||
|
||||
# An example for creating a profile via http connection
|
||||
- hosts: localhost
|
||||
connection: local
|
||||
tasks:
|
||||
- name: create macvlan profile
|
||||
lxd_profile:
|
||||
url: https://127.0.0.1:8443
|
||||
# These cert_file and key_file values are equal to the default values.
|
||||
#cert_file: "{{ lookup('env', 'HOME') }}/.config/lxc/client.crt"
|
||||
#key_file: "{{ lookup('env', 'HOME') }}/.config/lxc/client.key"
|
||||
trust_password: mypassword
|
||||
name: macvlan
|
||||
state: present
|
||||
config: {}
|
||||
description: 'my macvlan profile'
|
||||
devices:
|
||||
eth0:
|
||||
nictype: macvlan
|
||||
parent: br0
|
||||
type: nic
|
||||
|
||||
# An example for deleting a profile
|
||||
- hosts: localhost
|
||||
connection: local
|
||||
tasks:
|
||||
- name: Delete a profile
|
||||
lxd_profile:
|
||||
name: macvlan
|
||||
state: absent
|
||||
|
||||
# An example for renaming a profile
|
||||
- hosts: localhost
|
||||
connection: local
|
||||
tasks:
|
||||
- name: Rename a profile
|
||||
lxd_profile:
|
||||
name: macvlan
|
||||
new_name: macvlan2
|
||||
state: present
|
||||
'''
|
||||
|
||||
RETURN='''
|
||||
old_state:
|
||||
description: The old state of the profile
|
||||
returned: success
|
||||
type: string
|
||||
sample: "absent"
|
||||
logs:
|
||||
description: The logs of requests and responses.
|
||||
returned: when ansible-playbook is invoked with -vvvv.
|
||||
type: list
|
||||
sample: "(too long to be placed here)"
|
||||
actions:
|
||||
description: List of actions performed for the profile.
|
||||
returned: success
|
||||
type: list
|
||||
sample: '["create"]'
|
||||
'''
|
||||
|
||||
import os
|
||||
from ansible.modules.extras.cloud.lxd import LXDClient, LXDClientException
|
||||
|
||||
# PROFILE_STATES is a list for states supported
|
||||
PROFILES_STATES = [
|
||||
'present', 'absent'
|
||||
]
|
||||
|
||||
# CONFIG_PARAMS is a list of config attribute names.
|
||||
CONFIG_PARAMS = [
|
||||
'config', 'description', 'devices'
|
||||
]
|
||||
|
||||
class LXDProfileManagement(object):
|
||||
def __init__(self, module):
|
||||
"""Management of LXC containers via Ansible.
|
||||
|
||||
:param module: Processed Ansible Module.
|
||||
:type module: ``object``
|
||||
"""
|
||||
self.module = module
|
||||
self.name = self.module.params['name']
|
||||
self._build_config()
|
||||
self.state = self.module.params['state']
|
||||
self.new_name = self.module.params.get('new_name', None)
|
||||
|
||||
self.url = self.module.params['url']
|
||||
self.key_file = self.module.params.get('key_file', None)
|
||||
self.cert_file = self.module.params.get('cert_file', None)
|
||||
self.debug = self.module._verbosity >= 4
|
||||
try:
|
||||
self.client = LXDClient(
|
||||
self.url, key_file=self.key_file, cert_file=self.cert_file,
|
||||
debug=self.debug
|
||||
)
|
||||
except LXDClientException as e:
|
||||
self.module.fail_json(msg=e.msg)
|
||||
self.trust_password = self.module.params.get('trust_password', None)
|
||||
self.actions = []
|
||||
|
||||
def _build_config(self):
|
||||
self.config = {}
|
||||
for attr in CONFIG_PARAMS:
|
||||
param_val = self.module.params.get(attr, None)
|
||||
if param_val is not None:
|
||||
self.config[attr] = param_val
|
||||
|
||||
def _get_profile_json(self):
|
||||
return self.client.do(
|
||||
'GET', '/1.0/profiles/{0}'.format(self.name),
|
||||
ok_error_codes=[404]
|
||||
)
|
||||
|
||||
@staticmethod
|
||||
def _profile_json_to_module_state(resp_json):
|
||||
if resp_json['type'] == 'error':
|
||||
return 'absent'
|
||||
return 'present'
|
||||
|
||||
def _update_profile(self):
|
||||
if self.state == 'present':
|
||||
if self.old_state == 'absent':
|
||||
if self.new_name is None:
|
||||
self._create_profile()
|
||||
else:
|
||||
self.module.fail_json(
|
||||
msg='new_name must not be set when the profile does not exist and the specified state is present',
|
||||
changed=False)
|
||||
else:
|
||||
if self.new_name is not None and self.new_name != self.name:
|
||||
self._rename_profile()
|
||||
if self._needs_to_apply_profile_configs():
|
||||
self._apply_profile_configs()
|
||||
elif self.state == 'absent':
|
||||
if self.old_state == 'present':
|
||||
if self.new_name is None:
|
||||
self._delete_profile()
|
||||
else:
|
||||
self.module.fail_json(
|
||||
msg='new_name must not be set when the profile exists and the specified state is absent',
|
||||
changed=False)
|
||||
|
||||
def _create_profile(self):
|
||||
config = self.config.copy()
|
||||
config['name'] = self.name
|
||||
self.client.do('POST', '/1.0/profiles', config)
|
||||
self.actions.append('create')
|
||||
|
||||
def _rename_profile(self):
|
||||
config = {'name': self.new_name}
|
||||
self.client.do('POST', '/1.0/profiles/{}'.format(self.name), config)
|
||||
self.actions.append('rename')
|
||||
self.name = self.new_name
|
||||
|
||||
def _needs_to_change_profile_config(self, key):
|
||||
if key not in self.config:
|
||||
return False
|
||||
old_configs = self.old_profile_json['metadata'].get(key, None)
|
||||
return self.config[key] != old_configs
|
||||
|
||||
def _needs_to_apply_profile_configs(self):
|
||||
return (
|
||||
self._needs_to_change_profile_config('config') or
|
||||
self._needs_to_change_profile_config('description') or
|
||||
self._needs_to_change_profile_config('devices')
|
||||
)
|
||||
|
||||
def _apply_profile_configs(self):
|
||||
config = self.old_profile_json.copy()
|
||||
for k, v in self.config.iteritems():
|
||||
config[k] = v
|
||||
self.client.do('PUT', '/1.0/profiles/{}'.format(self.name), config)
|
||||
self.actions.append('apply_profile_configs')
|
||||
|
||||
def _delete_profile(self):
|
||||
self.client.do('DELETE', '/1.0/profiles/{}'.format(self.name))
|
||||
self.actions.append('delete')
|
||||
|
||||
def run(self):
|
||||
"""Run the main method."""
|
||||
|
||||
try:
|
||||
if self.trust_password is not None:
|
||||
self.client.authenticate(self.trust_password)
|
||||
|
||||
self.old_profile_json = self._get_profile_json()
|
||||
self.old_state = self._profile_json_to_module_state(self.old_profile_json)
|
||||
self._update_profile()
|
||||
|
||||
state_changed = len(self.actions) > 0
|
||||
result_json = {
|
||||
'changed': state_changed,
|
||||
'old_state': self.old_state,
|
||||
'actions': self.actions
|
||||
}
|
||||
if self.client.debug:
|
||||
result_json['logs'] = self.client.logs
|
||||
self.module.exit_json(**result_json)
|
||||
except LXDClientException as e:
|
||||
state_changed = len(self.actions) > 0
|
||||
fail_params = {
|
||||
'msg': e.msg,
|
||||
'changed': state_changed,
|
||||
'actions': self.actions
|
||||
}
|
||||
if self.client.debug:
|
||||
fail_params['logs'] = e.kwargs['logs']
|
||||
self.module.fail_json(**fail_params)
|
||||
|
||||
|
||||
def main():
|
||||
"""Ansible Main module."""
|
||||
|
||||
module = AnsibleModule(
|
||||
argument_spec=dict(
|
||||
name=dict(
|
||||
type='str',
|
||||
required=True
|
||||
),
|
||||
new_name=dict(
|
||||
type='str',
|
||||
),
|
||||
config=dict(
|
||||
type='dict',
|
||||
),
|
||||
description=dict(
|
||||
type='str',
|
||||
),
|
||||
devices=dict(
|
||||
type='dict',
|
||||
),
|
||||
state=dict(
|
||||
choices=PROFILES_STATES,
|
||||
default='present'
|
||||
),
|
||||
url=dict(
|
||||
type='str',
|
||||
default='unix:/var/lib/lxd/unix.socket'
|
||||
),
|
||||
key_file=dict(
|
||||
type='str',
|
||||
default='{}/.config/lxc/client.key'.format(os.environ['HOME'])
|
||||
),
|
||||
cert_file=dict(
|
||||
type='str',
|
||||
default='{}/.config/lxc/client.crt'.format(os.environ['HOME'])
|
||||
),
|
||||
trust_password=dict(
|
||||
type='str',
|
||||
)
|
||||
),
|
||||
supports_check_mode=False,
|
||||
)
|
||||
|
||||
lxd_manage = LXDProfileManagement(module=module)
|
||||
lxd_manage.run()
|
||||
|
||||
# import module bits
|
||||
from ansible.module_utils.basic import *
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
Loading…
Reference in New Issue