Start from the previous Proxmox Puppet module:
https://git.101010.fr/puppet/proxmox
This commit is contained in:
commit
703241117f
|
|
@ -0,0 +1,133 @@
|
|||
|
||||
---------------------------------------
|
||||
|
||||
### 0.2.4
|
||||
|
||||
##### Features
|
||||
* Latest release for Proxmox 3.x. Please be careful with the next release!
|
||||
|
||||
##### Changes
|
||||
* Upgrade pve-kernel-3.10.0-13-pve and pve-kernel-2.6.32-43 to the last version.
|
||||
|
||||
---------------------------------------
|
||||
|
||||
### 0.2.3 - 2015/06/01
|
||||
|
||||
##### Features
|
||||
* New fact is_pve_kernel check if the running kernel is a PVE.
|
||||
|
||||
##### Changes
|
||||
* Some installation's instructions only run if running a PVE kernel (test the new is_pve_kernel fact).
|
||||
* Use the stdlib function 'ensure_packages' to install recommended packages instead of 'if ! defined'.
|
||||
* Upgrade pve-kernel-3.10.0-9-pve and pve-kernel-2.6.32-39 to the last version.
|
||||
* Correct puppet-lint warnings.
|
||||
|
||||
##### Bugfixes
|
||||
* #14 The module no longer automatically reboot nodes after kernel upgrade, show a warning message instead.
|
||||
|
||||
---------------------------------------
|
||||
|
||||
### 0.2.2 - 2015/03/25
|
||||
|
||||
##### Features
|
||||
* A new subclass to automates the creation of a cluster from the master and join from other nodes.
|
||||
|
||||
##### Changes
|
||||
* Update README.md.
|
||||
* Upgrade pve-kernel-3.10.0-8-pve and pve-kernel-2.6.32-37 to the last version.
|
||||
* Puppet-lint
|
||||
* Add a case for 'kvm' VM doesn't do anything right now, wait for specific (packages, config, …).
|
||||
|
||||
##### Bugfixes
|
||||
* (#11) Add a new fact to get a valid netmask for OpenVZ's virtual interfaces (venet).
|
||||
* (#11) Use the new fact vznetmask_venet0_0 to add the route in interfaces.tail file.
|
||||
|
||||
---------------------------------------
|
||||
### 0.2.1 - 2015/02/03
|
||||
|
||||
##### Features
|
||||
* Manage the main OpenVZ's configuration file (/etc/vz/vz.conf).
|
||||
* Add vz service management.
|
||||
|
||||
##### Changes
|
||||
* The network management for an OpenVZ CT now works for all Debian family and not only Debian >=7.
|
||||
* Modification in OpenVZ's configuration file notify the 'vz' service.
|
||||
* Set an option to manage iptables modules in OpenVZ configuration.
|
||||
* Correct puppet-lint warnings.
|
||||
|
||||
---------------------------------------
|
||||
### 0.2.0 - 2015/01/27
|
||||
|
||||
#### Summary
|
||||
This release introduce a new subclasse for OpenVZ CT (network management):
|
||||
|
||||
include proxmox::vm
|
||||
|
||||
It's also provide a array of kernel modules added at the boot start.
|
||||
|
||||
##### Features
|
||||
* (#2) Add an array and a file to load additionnal modules.
|
||||
* (#9) Add a puppetlabs-firewall rule.
|
||||
* (#3) Add a new class and subclass: proxmox::vm::openvz to manage OpenVZ CT.
|
||||
* (#3) Add a new fact to calculate venet's network with /24 instead of /32.)
|
||||
* Add many modules (mainly for iptables) to load at startup (sea README.md).
|
||||
|
||||
##### Bugfixes
|
||||
* Correct module's dependencies.
|
||||
* Run the proxmox::hypervisor::group only if PVE is installed.
|
||||
|
||||
##### Changes
|
||||
* README.md: Add examples, a table of contents, information about proxmox::vm::openvz (#3).
|
||||
* Correct indentation, double quote, ...
|
||||
|
||||
---------------------------------------
|
||||
|
||||
### 0.1.0 - 2015/01/15
|
||||
|
||||
This release introduce new defined types:
|
||||
|
||||
proxmox::hypervisor::group { 'sysadmin':
|
||||
role => 'Administrator',
|
||||
users => [ 'root@pam', 'test@pve' ],
|
||||
}
|
||||
|
||||
proxmox::hypervisor::user { 'toto@pve':
|
||||
group => 'sysadmin',
|
||||
}
|
||||
|
||||
And also directly jump to 0.1.0, the module allow to manage a simple Proxmox hypervisor right now.
|
||||
|
||||
##### Changes
|
||||
* Add a variable to choose to keep PVE enterprise repo for the subscribers.
|
||||
* (#4) Add an access control list for PveProxy.
|
||||
* (#4) Add a new class to manage Proxmox's service (proxmox::hypervisor::service).
|
||||
* (#6) Add a new defined type to manage groups for PVE WebGUI.
|
||||
* (#7) Add a new defined type to manage users for PVE WebGUI.
|
||||
* Update the README.md file for (#6) group and (#7) user defined types.
|
||||
* Add a test for (#6) group and (#7) user defined types.
|
||||
|
||||
---------------------------------------
|
||||
|
||||
### 0.0.2 - 2015/01/08
|
||||
|
||||
New functionality release, Proxmox installation now working :)
|
||||
|
||||
##### Changes
|
||||
* (#1) Possibility to choose between newer kernel that only supports KVM or a ~2.6.32 that supports both KVM and OpenVZ.
|
||||
* (#1) Install the Virtual Environment and it's works with 2 puppet run.
|
||||
* Add new test (hypervisor_kvm_only).
|
||||
* Add a fact to check if Proxmox is "available".
|
||||
* Add a new class: proxmox::hypervisor::config for some tiny configurations.
|
||||
* Remove the subscription message in the web gui.
|
||||
* Add operatingsystem_support information in the metadata.json (to correct the error in Metadata Quality).
|
||||
* Correct wtfpl into WTFPL to be recognized by SPDX (Metadata Quality).
|
||||
* Correct indentation, double quote, ...
|
||||
|
||||
---------------------------------------
|
||||
|
||||
### 0.0.1 - 2015/01/07
|
||||
|
||||
Initial release.
|
||||
|
||||
##### Changes
|
||||
* Only prepare the system for Proxmox installation (proxmox::hypervisor::preconfig)
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
source 'https://rubygems.org'
|
||||
|
||||
puppetversion = ENV.key?('PUPPET_VERSION') ? "= #{ENV['PUPPET_VERSION']}" : ['>= 3.3']
|
||||
gem 'puppet', puppetversion
|
||||
gem 'puppetlabs_spec_helper', '>= 0.1.0'
|
||||
gem 'puppet-lint', '>= 0.3.2'
|
||||
gem 'facter', '>= 1.7.0'
|
||||
|
|
@ -0,0 +1,278 @@
|
|||
# proxmox
|
||||
|
||||
#### Table of Contents
|
||||
|
||||
1. [Overview](#overview)
|
||||
2. [Module Description](#module-description)
|
||||
3. [Setup](#setup)
|
||||
* [What Proxmox affects](#what-proxmox-affects)
|
||||
* [Beginning with Proxmox](#beginning-with-proxmox)
|
||||
4. [Usage](#usage)
|
||||
* [Hypervisor](#hypervisor)
|
||||
* [VM](#vm)
|
||||
5. [Reference](#reference)
|
||||
* [Classes](#classes)
|
||||
* [Defined types](#defined-types)
|
||||
* [Parameters](#parameters)
|
||||
6. [Other notes](#other-notes)
|
||||
7. [Limitations](#limitations)
|
||||
8. [Development](#development)
|
||||
9. [License](#license)
|
||||
|
||||
## Overview
|
||||
|
||||
The proxmox module provide a simple way to manage Proxmox hypervisor and OpenVZ network's configuration with Puppet.
|
||||
|
||||
## Module Description
|
||||
|
||||
The proxmox module automates installing Proxmox on Debian systems.
|
||||
|
||||
## Setup
|
||||
|
||||
### What Proxmox affects:
|
||||
|
||||
* Package/service/configuration files for Proxmox.
|
||||
* A new `sources.list` file for Proxmox.
|
||||
* Proxmox's cluster (master and nodes).
|
||||
* System repository
|
||||
* The static table lookup for hostnames `hosts`.
|
||||
* Users and group permissions for WebGUI.
|
||||
* WebGUI's service (pveproxy).
|
||||
* Kernel modules loaded at the boot time.
|
||||
* OpenVZ's configuration file.
|
||||
* OpenVZ's service.
|
||||
* OpenVZ CT network's configuration.
|
||||
|
||||
### Beginning with Proxmox
|
||||
|
||||
To begin using proxmox module with default parameters, declare the hypervisor's class with `include proxmox::hypervisor`.
|
||||
|
||||
## Usage
|
||||
|
||||
### Hypervisor
|
||||
|
||||
```
|
||||
include proxmox::hypervisor
|
||||
```
|
||||
**Note**: The module will NOT automatically reboot the system on the PVE Kernel. You will need to reboot it manually and start again the puppet agent.
|
||||
|
||||
#### KVM only
|
||||
|
||||
If you will use only KVM you can have a most recent kernel with:
|
||||
```
|
||||
class { 'proxmox::hypervisor':
|
||||
kvm_only => true,
|
||||
}
|
||||
```
|
||||
|
||||
#### Disable additionnal modules
|
||||
Disable all additionnal modules load at the boot time:
|
||||
```
|
||||
class { 'proxmox::hypervisor':
|
||||
pve_modules_list => [ '' ],
|
||||
}
|
||||
```
|
||||
|
||||
#### Create a cluster full KVM (for Ceph)
|
||||
```
|
||||
node "pve_node" {
|
||||
# Install an hypervisor full KVM
|
||||
class { 'proxmox::hypervisor':
|
||||
pveproxy_allow => '127.0.0.1,192.168.0.0/24',
|
||||
kvm_only => true,
|
||||
cluster_master_ip => '192.168.0.201',
|
||||
cluster_name => 'DeepThought',
|
||||
}
|
||||
# Access to PVE Webgui
|
||||
proxmox::hypervisor::group { 'sysadmin': role => "Administrator", users => [ 'marvin@pam', 'arthur@pam' ] }
|
||||
|
||||
# SSH authorized keys between all nodes without passphrase (the module generate a key if not present)
|
||||
ssh_authorized_key { 'hyper01':
|
||||
ensure => present,
|
||||
key => 'AAAAB3NzaC1yc2EAAAADAQABAAABAQDQxnLaBlnujnByt3V7YLZv1+PTjREJ3hphZFdCVNs9ebED55/kEAPmtJzcq2OL7qk8PajvhpB7efuZAatKeCdhILpFBKRrCo/q3MsQUSyaHbrGKs8Kkpz0EBHp1Tgpd8i1+kF1EzVPqT/euNcI6cA3fyMrvdgTI25BwFt93A6bBpf4We7A0l0Ba2nCAs5ekWyKKLh54GO7KBHlMmIzboYpxwgnFcbb9UhuyUz2J6PSC0K+P+hdMXY4dFk/lPMEXLgve/TTPYpgDxgxWMUaobCanwBWcXkZ4MdJw2Qs6TQ0v+cOxX3ogr78w69naGB3joJ4ll31WA+Uo0mcZU3ylFj3',
|
||||
type => 'ssh-rsa',
|
||||
user => 'root',
|
||||
options => 'from="192.168.0.201"',
|
||||
}
|
||||
ssh_authorized_key { 'hyper02':
|
||||
ensure => present,
|
||||
key => 'AAAAB3NzaC1yc2EAAAADAQABAAABAQCxJeQ1R1rhPoig4jZLA8/Haru3nhVMgvDgO7nIqpwuPkDrheINVHOAd+DyQF0I2MtAjzg9gKfyix/cJ0cWMbd6/FdSVJ39dGYtNG9/YwTBcQiYwT0xS4NgJHzKrYE9PH2HEmjTmzcDeZ/u+IZjhO3Kyy9yZKcOhwV6fD+mzjQb4S2zsy67R/aoySbZjuoZYHrBrfjc66WbPbLtsFXIXuk46N376Y5sX37Bj17HhDEdP/lc9v939SswW1RZ2t1mVAjsMdsyBULDZk5av6Uj//YT1KuZBmBWkp7nPp1yt2ANPPGAnEW3oYjzXJd56Xtf3d0nbHOdHvMmIiV9fZyRUATd',
|
||||
type => 'ssh-rsa',
|
||||
user => 'root',
|
||||
options => 'from="192.168.0.202"',
|
||||
}
|
||||
|
||||
# Verify the authenticity of each hosts (/etc/ssh/ssh_host_{rsa,ecdsa}_key.pub)
|
||||
sshkey { 'hyper01':
|
||||
ensure => present,
|
||||
host_aliases => [ 'hyper01.domain.org', '192.168.42.201' ],
|
||||
key => 'AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ3TC6B3+eVbohjk662FwM/1YUCjMwMT9lmZcNcfllF9Vm082lMXtKix20elUCK9yJDpPWvzFiqdyhgqPAeCNt4=',
|
||||
target => '/root/.ssh/known_hosts',
|
||||
type => 'ecdsa-sha2-nistp256',
|
||||
}
|
||||
sshkey { 'hyper02':
|
||||
ensure => present,
|
||||
host_aliases => [ 'hyper02.domain.org', '192.168.42.202' ],
|
||||
key => 'AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEqUpnig3DIQVZEr3LxJCVEF/fl4n1s8LNuUUaLRueCW2ygzNBOv2m7O42K/Ok7aa4kjGaXbnneYXMw3wBULJ1U='
|
||||
target => '/root/.ssh/known_hosts',
|
||||
type => 'ecdsa-sha2-nistp256',
|
||||
}
|
||||
|
||||
# If you don't have a DNS service, i recommend to have an entry for each nodes in the hosts file
|
||||
host { 'hyper01':
|
||||
name => "hyper01.${::domain}",
|
||||
ensure => present,
|
||||
ip => '192.168.42.201',
|
||||
host_aliases => 'hyper01',
|
||||
}
|
||||
host { 'hyper02':
|
||||
name => "hyper02.${::domain}",
|
||||
ensure => present,
|
||||
ip => '192.168.42.202',
|
||||
host_aliases => 'hyper02',
|
||||
}
|
||||
}
|
||||
|
||||
node /hyper0[12]/ inherits "pve_node" {
|
||||
|
||||
}
|
||||
|
||||
```
|
||||
Will create a Cluster Proxmox with name "Deepthought", the master will be "hyper01". You also can manage all ssh ressources (and host) manually on each nodes.
|
||||
|
||||
### VM
|
||||
|
||||
Only OpenVZ is supported right now but the vm's class will check-it by it self:
|
||||
```
|
||||
include proxmox::vm
|
||||
```
|
||||
|
||||
#### proxmox::vm::openvz
|
||||
|
||||
Automatically call by the `proxmox::vm` class, it will manage network configuration, but only few configurations are possible:
|
||||
* Only one Virtual Ethernet device (aka veth) and it will work with **DHCP**.
|
||||
* If a veth is available, it will be the main network's interface (set the default gateway throught eth0).
|
||||
* If a veth is available, only one Virtual Network device (aka venet) as chance to work (the first one), because all others routes will be flushed.
|
||||
* If there are only venet: no changes.
|
||||
|
||||
## Reference
|
||||
|
||||
### Classes
|
||||
|
||||
* `proxmox`: Main class, do nothing right now.
|
||||
|
||||
* `proxmox::hypervisor`: Install the Proxmox hypervisor on the system.
|
||||
|
||||
* `proxmox::vm`: Manage virtual machines and containers.
|
||||
|
||||
### Defined types
|
||||
|
||||
* `proxmox::hypervisor::group`: Manage groups for Proxmox WebGUI and set permissions.
|
||||
|
||||
```
|
||||
proxmox::hypervisor::group { 'sysadmin':
|
||||
role => "Administrator",
|
||||
users => [ 'user1@pam', 'toto@pve' ],
|
||||
}
|
||||
```
|
||||
|
||||
* `proxmox::hypervisor::user`: Manage user for Proxmox WebGUI.
|
||||
|
||||
```
|
||||
proxmox::hypervisor::user { 'marvin':
|
||||
group => 'sysadmin',
|
||||
}
|
||||
```
|
||||
|
||||
Mainly used by the `proxmox::hypervisor::group` defined type to create the group, permissions and also create/add the users to a group. Because to add a user to a group via this defined type, the group should already exist.
|
||||
|
||||
### Parameters
|
||||
|
||||
#### proxmox::hypervisor
|
||||
|
||||
* `ve_pkg_ensure`: What to set the Virtual Environnment package to. Can be 'present', 'absent' or 'version'. Defaults to 'present'.
|
||||
* `ve_pkg_name`: The list of VirtualEnvironnment packages. Can be an array [ 'proxmox-ve-2.6.32', 'ksm-control-daemon', 'vzprocps', 'open-iscsi', 'bootlogd', 'pve-firmware' ].
|
||||
* `kvm_only`: If set to 'true', Puppet will install a newer kernel compatible only with KVM. Accepts 'true' or 'false'. Defaults to 'false'.
|
||||
* `kernel_kvm_pkg_name`: The list of packages to install the newer kernel. Can be an array [ 'pve-kernel-3.10.0-13-pve', '...' ].
|
||||
* `kernel_pkg_name`: The list of packages to install a kernel compatible with both KVM and OpenVZ. Can be an array [ 'pve-kernel-2.6.32-43-pve', '...' ].
|
||||
* `rec_pkg_name`: The list of recommended and usefull packages for Proxmox. Can be an array [ 'ntp', 'ssh', 'lvm2', 'bridge-utils' ].
|
||||
* `old_pkg_ensure`: What to set useless packages (non recommended, previous kernel, ...). Can be 'present' or 'absent'. Defaults to 'absent'.
|
||||
* `old_pkg_name`: The list of useless packages. Can be an array [ 'acpid', 'linux-image-amd64', 'linux-base', 'linux-image-3.2.0-4-amd64' ].
|
||||
* `pve_enterprise_repo_ensure`: Choose to keep the PVE enterprise repository. Can be 'present' or 'absent'. Defaults to 'absent'.
|
||||
* `pveproxy_default_path`: Path of the configuration file read by the PveProxy service. Defaults to '/etc/default/pveproxy'.
|
||||
* `pveproxy_default_content`: Template file use to generate the previous configuration file. Default to 'proxmox/hypervisor/pveproxy_default.erb'.
|
||||
* `pveproxy_allow`: Can be ip addresses, range or network; separated by a comma (example: '192.168.0.0/24,10.10.0.1-10.10.0.5'). Defaults to '127.0.0.1'.
|
||||
* `pveproxy_deny`: Unauthorized IP addresses. Can be 'all' or ip addresses, range or network; separated by a comma. Defaults to 'all'.
|
||||
* `pveproxy_policy`: The policy access. Can be 'allow' or 'deny'. Defaults to 'deny'.
|
||||
* `pveproxy_service_name`: WebGUI's service name (replace Apache2 since v3.0). Defaults to 'pveproxy'.
|
||||
* `pveproxy_service_manage`: If set to 'true', Puppet will manage the WebGUI's service. Can be 'true' or 'false'. Defaults to 'true'.
|
||||
* `pveproxy_service_enabled`: If set to 'true', Puppet will ensure the WebGUI's service is running. Can be 'true' or 'false'. Defaults to 'true'.
|
||||
* `pve_modules_list`: The list of additionnal modules to load at boot time.
|
||||
* `pve_modules_file_path`: The configuration file that will contain the modules list. Defaults to '/etc/modules-load.d/proxmox.conf'.
|
||||
* `pve_modules_file_content`: Template file used to generate the previous configuration file. Defaults to 'proxmox/hypervisor/proxmox_modules.conf.erb'.
|
||||
* `vz_config_file_path`: Path of the main OpenVZ's configuration file. Defaults to '/etc/vz/vz.conf'.
|
||||
* `vz_config_file_tpl`: Template file use to generate the OpenVZ's configuration file. Defaults to 'proxmox/hypervisor/vz.conf.erb'.
|
||||
* `vz_iptables_modules`: If set to 'true', OpenVZ will share a list of iptables modules to the containers. Can be 'true' or 'false'. Defaults to 'true'.
|
||||
* `vz_service_name`: The OpenVZ's service name. Defaults to 'vz'.
|
||||
* `vz_service_manage`: If set to 'true', Puppet will manage the OpenVZ's service. Can be 'true' or 'false'. Defaults to 'true'.
|
||||
* `vz_service_enabled`: If set to 'true', Puppet will ensure the OpenVZ's service is running. Can be 'true' or 'false'. Defaults to 'true'.
|
||||
* `labs_firewall_rule`: If set to 'true', Puppet will set a iptable rule to allow WebGUI and VNC's port access. Can be 'true' or 'false'. Defaults to 'false'.
|
||||
* `cluster_master_ip`: The ip address of the "master" node that will create the cluster. Must be an IP address. Defaults to 'undef'.
|
||||
* `cluster_name`: The cluster's name. Defaults to 'undef'.
|
||||
|
||||
#### proxmox::vm
|
||||
* `vm_interfaces_path`: The main network configuration's file. Defaults to '/etc/network/interfaces'.
|
||||
* `vm_interfaces_content`: Template file used to generate the previous configuration file. Defaults to 'proxmox/vm/openvz_interfaces.erb'.
|
||||
* `vm_interfaces_tail_path`: A second network configuration file that will be concatenated in the main. Defaults to '/etc/network/interfaces.tail'.
|
||||
* `vm_interfaces_tail_content`: Template file used to generate the previous configuration file. Defaults to 'proxmox/vm/openzv_interfaces.tail.erb'.
|
||||
* `network_service_name`: Network's service name. Defaults to 'networking'.
|
||||
* `network_service_manage`: If set to 'true', Puppet will manage the network's service. Can be 'true' or 'false'. Defaults to 'true'.
|
||||
* `network_service_enabled`: If set to 'true', Puppet will ensure the network's service is running. Can be 'true' or 'false'. Defaults to 'true'.
|
||||
|
||||
Other notes
|
||||
-----------
|
||||
By default `proxmox::hypervisor` comes with several modules kernel load at boot time. Mainly iptables's modules to allow it in the OpenVZ CT.
|
||||
|
||||
The default modules list:
|
||||
* `iptable_filter`
|
||||
* `iptable_mangle`
|
||||
* `iptable_nat`
|
||||
* `ipt_length` (=xt_length)
|
||||
* `ipt_limit` (=xt_limit)
|
||||
* `ipt_LOG`
|
||||
* `ipt_MASQUERADE`
|
||||
* `ipt_multiport` (=xt_multiport)
|
||||
* `ipt_owner` (=xt_owner)
|
||||
* `ipt_recent` (=xt_recent)
|
||||
* `ipt_REDIRECT`
|
||||
* `ipt_REJECT`
|
||||
* `ipt_state` (=xt_state)
|
||||
* `ipt_TCPMSS` (=xt_TCPMSS)
|
||||
* `ipt_tcpmss` (=xt_tcpmss)
|
||||
* `ipt_TOS`
|
||||
* `ipt_tos`
|
||||
* `ip_conntrack` (=nf_conntrack)
|
||||
* `ip_nat_ftp` (=nf_nat_ftp)
|
||||
* `xt_iprange`
|
||||
* `xt_comment`
|
||||
* `ip6table_filter`
|
||||
* `ip6table_mangle`
|
||||
* `ip6t_REJECT' `
|
||||
|
||||
See [hypervisor usage](#hypervisor) if you want to disable it or [parameters](#parameters) if you want to edit this list.
|
||||
|
||||
Limitations
|
||||
-----------
|
||||
|
||||
This module will only work on Debian 7.x versions.
|
||||
|
||||
Development
|
||||
-----------
|
||||
|
||||
Free to send contributions, fork it, ...
|
||||
|
||||
License
|
||||
-------
|
||||
|
||||
WTFPL (http://wtfpl.org/)
|
||||
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
require 'rubygems'
|
||||
require 'puppetlabs_spec_helper/rake_tasks'
|
||||
require 'puppet-lint/tasks/puppet-lint'
|
||||
PuppetLint.configuration.send('disable_80chars')
|
||||
PuppetLint.configuration.ignore_paths = ["spec/**/*.pp", "pkg/**/*.pp"]
|
||||
|
||||
desc "Validate manifests, templates, and ruby files"
|
||||
task :validate do
|
||||
Dir['manifests/**/*.pp'].each do |manifest|
|
||||
sh "puppet parser validate --noop #{manifest}"
|
||||
end
|
||||
Dir['spec/**/*.rb','lib/**/*.rb'].each do |ruby_file|
|
||||
sh "ruby -c #{ruby_file}" unless ruby_file =~ /spec\/fixtures/
|
||||
end
|
||||
Dir['templates/**/*.erb'].each do |template|
|
||||
sh "erb -P -x -T '-' #{template} | ruby -c"
|
||||
end
|
||||
end
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
#is_proxmox.rb
|
||||
|
||||
Facter.add("is_proxmox") do
|
||||
setcode do
|
||||
FileTest.exists?("/etc/pve/")
|
||||
end
|
||||
end
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
# Fact: is_pve_kernel
|
||||
#
|
||||
# Purpose: Returns true if the system runs a PVE kernel.
|
||||
#
|
||||
#
|
||||
require 'facter'
|
||||
|
||||
Facter.add(:is_pve_kernel) do
|
||||
setcode do
|
||||
|
||||
pve = if Facter.value(:kernelrelease) =~ /^*pve/
|
||||
'true'
|
||||
else
|
||||
'false'
|
||||
end
|
||||
|
||||
end
|
||||
|
||||
end
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
# Fact: vznetmask
|
||||
#
|
||||
# Purpose:
|
||||
# Get netmasks for Virtual Network aka venet in OpenVZ CT, for available
|
||||
# network networks
|
||||
#
|
||||
# Resolution:
|
||||
# Uses `facter/util/ip` to enumerate interfaces and return their information.
|
||||
#
|
||||
require 'facter/util/ip'
|
||||
require 'ipaddr'
|
||||
|
||||
Facter::Util::IP.get_interfaces.each do |interface|
|
||||
Facter.add("vznetmask_" + Facter::Util::IP.alphafy(interface)) do
|
||||
setcode do
|
||||
if interface =~ /^venet*/
|
||||
|
||||
netmask = Facter::Util::IP.get_interface_value(interface, "netmask")
|
||||
if netmask == "255.255.255.255"
|
||||
# It's not possible to modify the netmask from WebGUI, so it's mainly set to /32
|
||||
# http://openvz.org/Venet#Adding_IP_address_to_a_container
|
||||
netmask = "255.255.255.0"
|
||||
end
|
||||
|
||||
end
|
||||
netmask
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
@ -0,0 +1,35 @@
|
|||
# Fact: vznetwork
|
||||
#
|
||||
# Purpose:
|
||||
# Get networks for Virtual Network aka venet in OpenVZ CT, for available
|
||||
# network networks
|
||||
#
|
||||
# Resolution:
|
||||
# Uses `facter/util/ip` to enumerate interfaces and return their information.
|
||||
#
|
||||
require 'facter/util/ip'
|
||||
require 'ipaddr'
|
||||
|
||||
Facter::Util::IP.get_interfaces.each do |interface|
|
||||
Facter.add("vznetwork_" + Facter::Util::IP.alphafy(interface)) do
|
||||
setcode do
|
||||
if interface =~ /^venet*/
|
||||
|
||||
ipaddress = Facter::Util::IP.get_interface_value(interface, "ipaddress")
|
||||
netmask = Facter::Util::IP.get_interface_value(interface, "netmask")
|
||||
if netmask == "255.255.255.255"
|
||||
# It's not possible to modify the netmask from WebGUI, so it's mainly set to /32
|
||||
# http://openvz.org/Venet#Adding_IP_address_to_a_container
|
||||
netmask = "255.255.255.0"
|
||||
end
|
||||
|
||||
if ipaddress && netmask
|
||||
ip = IPAddr.new(ipaddress, Socket::AF_INET)
|
||||
subnet = IPAddr.new(netmask, Socket::AF_INET)
|
||||
ip.mask(subnet.to_s).to_s
|
||||
end
|
||||
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
@ -0,0 +1,82 @@
|
|||
# == Class: proxmox::hypervisor
|
||||
#
|
||||
# Manage the Proxmox hypervisor.
|
||||
#
|
||||
# === Parameters
|
||||
#
|
||||
# Document parameters here.
|
||||
#
|
||||
# [*sample_parameter*]
|
||||
# Explanation of what this parameter affects and what it defaults to.
|
||||
# e.g. "Specify one or more upstream ntp servers as an array."
|
||||
#
|
||||
# === Variables
|
||||
#
|
||||
# Here you should define a list of variables that this module would require.
|
||||
#
|
||||
# [*sample_variable*]
|
||||
# Explanation of how this variable affects the funtion of this class and if it
|
||||
# has a default. e.g. "The parameter enc_ntp_servers must be set by the
|
||||
# External Node Classifier as a comma separated list of hostnames." (Note,
|
||||
# global variables should not be used in preference to class parameters as of
|
||||
# Puppet 2.6.)
|
||||
#
|
||||
# === Examples
|
||||
#
|
||||
# class { '::proxmox::hypervisor':
|
||||
# kvm_only => true,
|
||||
# }
|
||||
#
|
||||
# === Authors
|
||||
#
|
||||
# Gardouille <gardouille@gmail.com>
|
||||
#
|
||||
# === Copyright
|
||||
#
|
||||
# WTFPL <http://wtfpl.org/>
|
||||
#
|
||||
class proxmox::hypervisor (
|
||||
$ve_pkg_ensure = $proxmox::params::ve_pkg_ensure,
|
||||
$ve_pkg_name = $proxmox::params::ve_pkg_name,
|
||||
$kvm_only = $proxmox::params::kvm_only,
|
||||
$kernel_kvm_pkg_name = $proxmox::params::kernel_kvm_pkg_name,
|
||||
$kernel_pkg_name = $proxmox::params::kernel_pkg_name,
|
||||
$rec_pkg_name = $proxmox::params::rec_pkg_name,
|
||||
$old_pkg_ensure = $proxmox::params::old_pkg_ensure,
|
||||
$old_pkg_name = $proxmox::params::old_pkg_name,
|
||||
$pve_enterprise_repo_ensure = $proxmox::params::pve_enterprise_repo_ensure,
|
||||
$pveproxy_default_path = $proxmox::params::pveproxy_default_path,
|
||||
$pveproxy_default_content = $proxmox::params::pveproxy_default_content,
|
||||
$pveproxy_allow = $proxmox::params::pveproxy_allow,
|
||||
$pveproxy_deny = $proxmox::params::pveproxy_deny,
|
||||
$pveproxy_policy = $proxmox::params::pveproxy_policy,
|
||||
$pveproxy_service_name = $proxmox::params::pveproxy_service_name,
|
||||
$pveproxy_service_manage = $proxmox::params::pveproxy_service_manage,
|
||||
$pveproxy_service_enabled = $proxmox::params::pveproxy_service_enabled,
|
||||
$pve_modules_list = $proxmox::params::pve_modules_list,
|
||||
$pve_modules_file_path = $proxmox::params::pve_modules_file_path,
|
||||
$pve_modules_file_content = $proxmox::params::pve_modules_file_content,
|
||||
$vz_config_file_path = $proxmox::params::vz_config_file_path,
|
||||
$vz_config_file_tpl = $proxmox::params::vz_config_file_tpl,
|
||||
$vz_iptables_modules = $proxmox::params::vz_iptables_modules,
|
||||
$vz_service_name = $proxmox::params::vz_service_name,
|
||||
$vz_service_manage = $proxmox::params::vz_service_manage,
|
||||
$vz_service_enabled = $proxmox::params::vz_service_enabled,
|
||||
$labs_firewall_rule = $proxmox::params::labs_firewall_rule,
|
||||
$cluster_master_ip = undef,
|
||||
$cluster_name = undef,
|
||||
) inherits proxmox::params {
|
||||
|
||||
include '::proxmox::hypervisor::preconfig'
|
||||
include '::proxmox::hypervisor::install'
|
||||
include '::proxmox::hypervisor::config'
|
||||
include '::proxmox::hypervisor::service'
|
||||
include '::proxmox::hypervisor::cluster'
|
||||
|
||||
Class['proxmox::hypervisor::preconfig'] ->
|
||||
Class['proxmox::hypervisor::install'] ->
|
||||
Class['proxmox::hypervisor::config'] ->
|
||||
Class['proxmox::hypervisor::service'] ->
|
||||
Class['proxmox::hypervisor::cluster']
|
||||
|
||||
} # Public class: proxmox::hypervisor
|
||||
|
|
@ -0,0 +1,52 @@
|
|||
# == Class: proxmox::hypervisor::cluster
|
||||
#
|
||||
# Manage the Proxmox cluster.
|
||||
#
|
||||
class proxmox::hypervisor::cluster
|
||||
{
|
||||
|
||||
File {
|
||||
owner => root,
|
||||
group => root,
|
||||
mode => 644,
|
||||
}
|
||||
|
||||
Exec {
|
||||
path => [ '/bin', '/sbin', '/usr/bin', '/usr/sbin' ],
|
||||
logoutput => 'on_failure',
|
||||
}
|
||||
|
||||
## Quoted boolean value because can't return "true" boolean with personal fact
|
||||
if $::is_proxmox == 'true' and $proxmox::hypervisor::cluster_master_ip != undef and $proxmox::hypervisor::cluster_name != undef {
|
||||
# Ensure the root user got an ssh-key
|
||||
exec { 'create ssh-key for root':
|
||||
command => 'ssh-keygen -t rsa -f /root/.ssh/id_rsa -b 2048 -N "" -q',
|
||||
creates => '/root/.ssh/id_rsa.pub',
|
||||
}
|
||||
|
||||
# Test if this node should be the master or a node
|
||||
## has_interface_with needs double quoted string for the argument !
|
||||
if has_interface_with('ipaddress', "${proxmox::hypervisor::cluster_master_ip}") {
|
||||
|
||||
# Create the cluster on this node
|
||||
exec { "Create ${proxmox::hypervisor::cluster_name} cluster on ${proxmox::hypervisor::cluster_master_ip}":
|
||||
command => "pvecm create ${proxmox::hypervisor::cluster_name}",
|
||||
onlyif => 'uname -r | grep -- "-pve"',
|
||||
creates => '/etc/pve/cluster.conf',
|
||||
}
|
||||
}
|
||||
else {
|
||||
|
||||
# Connect this node to the cluster
|
||||
exec { "Connect to ${proxmox::hypervisor::cluster_name} cluster":
|
||||
command => "pvecm add ${proxmox::hypervisor::cluster_master_ip}",
|
||||
onlyif => 'uname -r | grep -- "-pve"',
|
||||
creates => '/etc/pve/cluster.conf',
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
#notify { "Master IP: ${proxmox::hypervisor::cluster_master_ip} and Cluster name: ${proxmox::hypervisor::cluster_name}": }
|
||||
|
||||
} # Private class: proxmox::hypervisor::cluster
|
||||
|
|
@ -0,0 +1,56 @@
|
|||
# == Class: proxmox::hypervisor::config
|
||||
#
|
||||
# Some tiny configurations for Proxmox
|
||||
#
|
||||
class proxmox::hypervisor::config {
|
||||
|
||||
File {
|
||||
owner => root,
|
||||
group => root,
|
||||
mode => 644,
|
||||
}
|
||||
|
||||
Exec {
|
||||
path => [ '/bin', '/sbin', '/usr/bin', '/usr/sbin' ],
|
||||
logoutput => 'on_failure',
|
||||
}
|
||||
|
||||
|
||||
## Quoted boolean value because can't return "true" boolean with personal fact
|
||||
if $::is_proxmox == 'true' {
|
||||
|
||||
# Pveproxy access control list
|
||||
file { $proxmox::hypervisor::pveproxy_default_path:
|
||||
ensure => present,
|
||||
content => template($proxmox::hypervisor::pveproxy_default_content),
|
||||
notify => Service[$proxmox::hypervisor::pveproxy_service_name],
|
||||
}
|
||||
->
|
||||
|
||||
# Remove the Subscription message
|
||||
exec { 'remove_subscription_message':
|
||||
command => 'rm -f /usr/share/pve-manager/ext4/pvemanagerlib.js.bak; sed -i".bak" -r -e "s/if \(data.status !== \'Active\'\) \{/if (false) {/" /usr/share/pve-manager/ext4/pvemanagerlib.js',
|
||||
onlyif => 'grep "if (data.status !== \'Active\') {" /usr/share/pve-manager/ext4/pvemanagerlib.js',
|
||||
}
|
||||
|
||||
## OpenVZ configuration
|
||||
file { $proxmox::hypervisor::vz_config_file_path:
|
||||
ensure => present,
|
||||
content => template($proxmox::hypervisor::vz_config_file_tpl),
|
||||
notify => Service[$proxmox::hypervisor::vz_service_name],
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
if $proxmox::hypervisor::labs_firewall_rule == true {
|
||||
|
||||
firewall { '100 accept proxmox':
|
||||
proto => 'tcp',
|
||||
action => 'accept',
|
||||
port => ['8006', '5900']
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
} # Private class: proxmox::hypervisor::config
|
||||
|
|
@ -0,0 +1,74 @@
|
|||
# == Define: proxmox::hypervisor::group
|
||||
#
|
||||
# Manage groups and permissions to access the PVE ressources
|
||||
#
|
||||
# === Parameters
|
||||
#
|
||||
# [*group*]
|
||||
# _default_: +$title+, the title/name of the ressource
|
||||
#
|
||||
# Is the group's name.
|
||||
#
|
||||
# [*role*]
|
||||
# _default_: +undef+
|
||||
#
|
||||
# [*acl_path*]
|
||||
# _default_: +/+
|
||||
#
|
||||
# The objects in Proxmox form a tree, virtual machines (/vms/$vmid), storage
|
||||
# (/storage/$storageid) or ressource (/pool/$poolname). The role for this
|
||||
# group will be applied on this path.
|
||||
#
|
||||
# [*permission_file*]
|
||||
# _default_: +/etc/pve/user.cfg+
|
||||
#
|
||||
# The file where group's informations are stored.
|
||||
#
|
||||
# [*users*]
|
||||
# _default_: +undef+
|
||||
#
|
||||
# The user list members of this group. A user will be created if not exist.
|
||||
#
|
||||
define proxmox::hypervisor::group ( $group = $title, $acl_path = '/', $permission_file = '/etc/pve/user.cfg', $users = '', $role ) {
|
||||
|
||||
File {
|
||||
owner => root,
|
||||
group => www-data,
|
||||
mode => 0640,
|
||||
}
|
||||
|
||||
Exec {
|
||||
path => ['/bin','/sbin','/usr/bin','/usr/sbin'],
|
||||
logoutput => 'on_failure',
|
||||
}
|
||||
|
||||
# Manage group only if Proxmox is available
|
||||
if $::is_proxmox == 'true' {
|
||||
|
||||
# Create the group in Proxmox
|
||||
exec { "create_${group}_group":
|
||||
command => "pveum groupadd ${group}",
|
||||
unless => "grep '^group:${group}' ${permission_file}",
|
||||
}
|
||||
->
|
||||
# Define the permission
|
||||
exec { "add_${group}_permission":
|
||||
command => "pveum aclmod ${acl_path} -group ${group} -role ${role}",
|
||||
unless => "grep '@${group}' ${permission_file}",
|
||||
}
|
||||
->
|
||||
# Create user(s) and add it to this group
|
||||
proxmox::hypervisor::user { $users:
|
||||
group => $group,
|
||||
}
|
||||
|
||||
# The permissions file
|
||||
if ! defined(File[$permission_file]) {
|
||||
file { $permission_file:
|
||||
ensure => present,
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
} # Public ressource: proxmox::hypervisor::group
|
||||
|
|
@ -0,0 +1,78 @@
|
|||
# == Class: proxmox::hypervisor::install
|
||||
#
|
||||
# Install Proxmox and inform the user he needs to reboot the system on the PVE kernel
|
||||
#
|
||||
class proxmox::hypervisor::install {
|
||||
|
||||
Exec {
|
||||
path => [ '/bin', '/sbin', '/usr/bin', '/usr/sbin' ],
|
||||
logoutput => 'on_failure',
|
||||
}
|
||||
|
||||
# If the system already run a PVE kernel
|
||||
## Quoted boolean value because can't return "true" boolean with personal fact
|
||||
if $::is_pve_kernel == 'true' {
|
||||
|
||||
# Installation of Virtual Environnment
|
||||
package { $proxmox::hypervisor::ve_pkg_name:
|
||||
ensure => $proxmox::hypervisor::ve_pkg_ensure,
|
||||
} ->
|
||||
|
||||
# Remove useless packages (such as the standard kernel, acpid, ...)
|
||||
package { $proxmox::hypervisor::old_pkg_name:
|
||||
ensure => $proxmox::hypervisor::old_pkg_ensure,
|
||||
notify => Exec['update_grub'],
|
||||
}
|
||||
|
||||
# Ensure that some recommended packages are present on the system
|
||||
ensure_packages( $proxmox::hypervisor::rec_pkg_name )
|
||||
|
||||
}
|
||||
else { # If the system run on a standard Debian Kernel
|
||||
|
||||
# To avoid unwanted reboot (kernel update for example), the PVE kernel is
|
||||
# installed only if the system run on a standard Debian.
|
||||
# You will need to update your PVE kernel manually.
|
||||
|
||||
# Installation of the PVE Kernel
|
||||
if $proxmox::hypervisor::kvm_only == true {
|
||||
notify { 'Please REBOOT':
|
||||
message => "Need to REBOOT the system on the new PVE kernel (${proxmox::hypervisor::kernel_kvm_pkg_name}) ...",
|
||||
loglevel => warning,
|
||||
}
|
||||
->
|
||||
package { $proxmox::hypervisor::kernel_kvm_pkg_name:
|
||||
ensure => $proxmox::hypervisor::ve_pkg_ensure,
|
||||
notify => Exec['update_grub'],
|
||||
}
|
||||
}
|
||||
else {
|
||||
notify { 'Please REBOOT':
|
||||
message => "Need to REBOOT the system on the new PVE kernel (${proxmox::hypervisor::kernel_pkg_name}) ...",
|
||||
loglevel => warning,
|
||||
}
|
||||
->
|
||||
package { $proxmox::hypervisor::kernel_pkg_name:
|
||||
ensure => $proxmox::hypervisor::ve_pkg_ensure,
|
||||
notify => Exec['update_grub','grub_reboot'],
|
||||
}
|
||||
# The kernel that allow KVM + OpenVZ is older than the standard Debian's
|
||||
# kernel, so grub reboot must be used
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
# Ensure the grub is update
|
||||
exec { 'update_grub':
|
||||
command => 'update-grub',
|
||||
refreshonly => true,
|
||||
}
|
||||
|
||||
# Choose a different line in the grub
|
||||
exec { 'grub_reboot':
|
||||
command => 'grub-reboot 2',
|
||||
refreshonly => true,
|
||||
}
|
||||
|
||||
|
||||
} # Private class: proxmox::hypervisor::install
|
||||
|
|
@ -0,0 +1,75 @@
|
|||
# == Class: proxmox::hypervisor::preconfig
|
||||
#
|
||||
# Before installing Proxmox some modifications have to be applied on the system
|
||||
#
|
||||
class proxmox::hypervisor::preconfig {
|
||||
|
||||
File {
|
||||
owner => root,
|
||||
group => root,
|
||||
mode => 644,
|
||||
}
|
||||
|
||||
# Hostname should be resolvable via /etc/hosts
|
||||
#/files/etc/hosts/2
|
||||
#/files/etc/hosts/2/ipaddr = '214.938.839.123'
|
||||
#/files/etc/hosts/2/canonical = 'hypervisor.domain.tld'
|
||||
#/files/etc/hosts/2/alias[1] = 'hypervisor'
|
||||
#/files/etc/hosts/1/ipaddr = '127.0.0.1'
|
||||
#/files/etc/hosts/1/canonical = 'localhost'
|
||||
augeas { $::fqdn:
|
||||
context => '/files/etc/hosts',
|
||||
changes => [
|
||||
#"ins ipaddr ${::ipaddress}",
|
||||
"set 02/ipaddr ${::ipaddress}",
|
||||
"set *[ipaddr = '${::ipaddress}']/canonical ${::fqdn}",
|
||||
"set *[ipaddr = '${::ipaddress}']/alias[1] ${::hostname}",
|
||||
"set *[ipaddr = '127.0.0.1']/canonical localhost",
|
||||
"rm *[ipaddr = '127.0.1.1']",
|
||||
],
|
||||
onlyif => "match *[ipaddr = '${::ipaddress}'] size == 0",
|
||||
}
|
||||
->
|
||||
# Remove Enterprise repository (need a subscription)
|
||||
file { '/etc/apt/sources.list.d/pve-enterprise.list':
|
||||
ensure => $proxmox::hypervisor::pve_enterprise_repo_ensure,
|
||||
notify => Exec[apt_update],
|
||||
}
|
||||
->
|
||||
# Add the standard repository (~community)
|
||||
apt::source {'proxmox':
|
||||
ensure => present,
|
||||
location => 'http://download.proxmox.com/debian',
|
||||
release => $::lsbdistcodename,
|
||||
repos => 'pve-no-subscription',
|
||||
include_src => false,
|
||||
key => '9887F95A',
|
||||
key_server => 'keyserver.ubuntu.com',
|
||||
}
|
||||
|
||||
# Set the grub default to saved to be able to use grub-set-default during
|
||||
# the installation
|
||||
if ! defined(Augeas['grub_default']) {
|
||||
augeas { 'grub_default':
|
||||
context => '/files/etc/default/grub',
|
||||
changes => [
|
||||
'set GRUB_DEFAULT saved',
|
||||
],
|
||||
}
|
||||
}
|
||||
|
||||
if ! defined(File['/etc/modules-load.d']) {
|
||||
file { '/etc/modules-load.d':
|
||||
ensure => directory,
|
||||
}
|
||||
}
|
||||
|
||||
$values = [ 'v1', 'v2' ]
|
||||
|
||||
file { $proxmox::hypervisor::pve_modules_file_path:
|
||||
ensure => present,
|
||||
content => template($proxmox::hypervisor::pve_modules_file_content),
|
||||
require => File['/etc/modules-load.d'],
|
||||
}
|
||||
|
||||
} # Private class: proxmox::hypervisor::preconfig
|
||||
|
|
@ -0,0 +1,45 @@
|
|||
# == Class: proxmox::hypervisor::service
|
||||
#
|
||||
# Manage Proxmox services
|
||||
#
|
||||
class proxmox::hypervisor::service {
|
||||
|
||||
|
||||
if $proxmox::hypervisor::pveproxy_service_enabled == true {
|
||||
$pveproxy_service_ensure = 'running'
|
||||
} else {
|
||||
$pveproxy_service_ensure = 'stopped'
|
||||
}
|
||||
|
||||
if $proxmox::hypervisor::vz_service_enabled == true {
|
||||
$vz_service_ensure = 'running'
|
||||
} else {
|
||||
$vz_service_ensure = 'stopped'
|
||||
}
|
||||
|
||||
|
||||
if $::is_proxmox == 'true' {
|
||||
|
||||
if $proxmox::hypervisor::pveproxy_service_manage == true {
|
||||
service { $proxmox::hypervisor::pveproxy_service_name:
|
||||
ensure => $pveproxy_service_ensure,
|
||||
enable => $proxmox::hypervisor::pveproxy_service_enabled,
|
||||
hasstatus => false,
|
||||
hasrestart => true,
|
||||
}
|
||||
}
|
||||
|
||||
if $proxmox::hypervisor::vz_service_manage == true {
|
||||
service { $proxmox::hypervisor::vz_service_name:
|
||||
ensure => $vz_service_ensure,
|
||||
enable => $proxmox::hypervisor::pveproxy_service_enabled,
|
||||
hasstatus => true,
|
||||
hasrestart => true,
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
|
||||
} # Private class: proxmox::hypervisor::service
|
||||
|
|
@ -0,0 +1,59 @@
|
|||
# == Define: proxmox::hypervisor::user
|
||||
#
|
||||
# Manage users allowed to WebGUI
|
||||
#
|
||||
# === Parameters
|
||||
#
|
||||
# [*user*]
|
||||
# _default_: +$title+, the title/name of the ressource
|
||||
#
|
||||
# Is the username.
|
||||
#
|
||||
# [*group*]
|
||||
# _default_: +undef+
|
||||
#
|
||||
# The group list for the user.
|
||||
#
|
||||
# [*permission_file*]
|
||||
# _default_: +/etc/pve/user.cfg+
|
||||
#
|
||||
# The file where group's informations are stored.
|
||||
#
|
||||
define proxmox::hypervisor::user ( $user = $title, $group = '', $permission_file = '/etc/pve/user.cfg' ) {
|
||||
|
||||
Exec {
|
||||
path => ['/bin','/sbin','/usr/bin','/usr/sbin'],
|
||||
logoutput => 'on_failure',
|
||||
}
|
||||
|
||||
# Manage user only if Proxmox is available
|
||||
if $::is_proxmox == 'true' {
|
||||
|
||||
## Work with an if/else test because the user must be create before adding
|
||||
# it to a group ...
|
||||
|
||||
# If a group was set
|
||||
if empty($group) == false {
|
||||
# Create the user in Proxmox
|
||||
exec { "add_${user}_user":
|
||||
command => "pveum useradd ${user}",
|
||||
unless => "grep '^user:${user}' ${permission_file}",
|
||||
}
|
||||
->
|
||||
# Then add this user to a group
|
||||
exec { "add_${user}_to_${group}":
|
||||
command => "pveum usermod ${user} -group ${group}",
|
||||
# The grep command should return 2 lines (minium) that match the pattern
|
||||
unless => "test `grep '${user}' -c ${permission_file}` -ge 2",
|
||||
}
|
||||
}
|
||||
else {
|
||||
# Create the user in Proxmox
|
||||
exec { "add_${user}_user":
|
||||
command => "pveum useradd ${user}",
|
||||
unless => "grep '^user:${user}' ${permission_file}",
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
} # Public ressource: proxmox::hypervisor::user
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
# == Class: proxmox
|
||||
#
|
||||
# This class do nothing right now.
|
||||
# Please use proxmox::hypervisor to manage proxmox.
|
||||
#
|
||||
# === Examples
|
||||
#
|
||||
# class { 'proxmox':
|
||||
# }
|
||||
#
|
||||
# === Authors
|
||||
#
|
||||
# Gardouille <gardouille@gmail.com>
|
||||
#
|
||||
# === Copyright
|
||||
#
|
||||
# WTFPL <http://wtfpl.org/>
|
||||
#
|
||||
class proxmox {
|
||||
|
||||
|
||||
|
||||
} # Public class: proxmox
|
||||
|
|
@ -0,0 +1,73 @@
|
|||
# == Class: proxmox::params
|
||||
#
|
||||
class proxmox::params {
|
||||
case $::osfamily {
|
||||
'Debian': {
|
||||
if $::operatingsystem == 'Debian' and versioncmp($::operatingsystemrelease, '7.0') >= 0 {
|
||||
# Virtual Environment packages
|
||||
$ve_pkg_ensure = 'present'
|
||||
$ve_pkg_name = [ 'proxmox-ve-2.6.32', 'ksm-control-daemon', 'vzprocps', 'open-iscsi', 'bootlogd', 'pve-firmware' ]
|
||||
|
||||
# PVE Kernel
|
||||
$kvm_only = false
|
||||
$kernel_kvm_pkg_name = [ 'pve-kernel-3.10.0-13-pve' ]
|
||||
$kernel_pkg_name = [ 'pve-kernel-2.6.32-43' ]
|
||||
|
||||
# Recommended packages
|
||||
$rec_pkg_name = [ 'ntp', 'ssh', 'lvm2', 'bridge-utils' ]
|
||||
|
||||
# Old useless packages
|
||||
$old_pkg_ensure = 'absent'
|
||||
$old_pkg_name = [ 'acpid', 'linux-image-amd64', 'linux-base', 'linux-image-3.2.0-4-amd64' ]
|
||||
|
||||
# Manage PVE Enterprise repository (need a subscription)
|
||||
$pve_enterprise_repo_ensure = 'absent'
|
||||
|
||||
# Pveproxy access restriction
|
||||
$pveproxy_default_path = '/etc/default/pveproxy'
|
||||
$pveproxy_default_content = 'proxmox/hypervisor/pveproxy_default.erb'
|
||||
$pveproxy_allow = '127.0.0.1'
|
||||
$pveproxy_deny = 'all'
|
||||
$pveproxy_policy = 'allow'
|
||||
$pveproxy_service_name = 'pveproxy'
|
||||
$pveproxy_service_manage = true
|
||||
$pveproxy_service_enabled = true
|
||||
|
||||
# Manage additionnals modules
|
||||
$pve_modules_list = [ 'iptable_filter', 'iptable_mangle', 'iptable_nat', 'ipt_length', 'ipt_limit', 'ipt_LOG', 'ipt_MASQUERADE', 'ipt_multiport', 'ipt_owner', 'ipt_recent', 'ipt_REDIRECT', 'ipt_REJECT', 'ipt_state', 'ipt_TCPMSS', 'ipt_tcpmss', 'ipt_TOS', 'ipt_tos', 'ip_conntrack', 'ip_nat_ftp', 'xt_iprange', 'xt_comment', 'ip6table_filter', 'ip6table_mangle', 'ip6t_REJECT' ]
|
||||
$pve_modules_file_path = '/etc/modules-load.d/proxmox.conf'
|
||||
$pve_modules_file_content = 'proxmox/hypervisor/proxmox_modules.conf.erb'
|
||||
|
||||
# OpenVZ configuration
|
||||
$vz_config_file_path = '/etc/vz/vz.conf'
|
||||
$vz_config_file_tpl = 'proxmox/hypervisor/vz.conf.erb'
|
||||
$vz_iptables_modules = true
|
||||
$vz_service_name = 'vz'
|
||||
$vz_service_manage = true
|
||||
$vz_service_enabled = true
|
||||
|
||||
# Firewall
|
||||
$labs_firewall_rule = false
|
||||
|
||||
}
|
||||
|
||||
## VM - OpenVZ
|
||||
# Network
|
||||
$vm_interfaces_path = '/etc/network/interfaces'
|
||||
$vm_interfaces_content = 'proxmox/vm/openzv_interfaces.erb'
|
||||
$vm_interfaces_tail_path = '/etc/network/interfaces.tail'
|
||||
$vm_interfaces_tail_content = 'proxmox/vm/openzv_interfaces.tail.erb'
|
||||
$network_service_name = 'networking'
|
||||
$network_service_manage = true
|
||||
$network_service_enabled = true
|
||||
|
||||
}
|
||||
default: {
|
||||
fail("Proxmox Virtual Environment only works with Debian system; And the OpenVZ configuration has been tested only with Debian family; So osfamily (${::osfamily}) or lsbdistid (${::lsbdistid}) is unsupported")
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
} # Private class: proxmox::params
|
||||
|
|
@ -0,0 +1,46 @@
|
|||
# == Class: proxmox::vm
|
||||
#
|
||||
# Manage Virtual Machines/VM (only OpenVZ right now)
|
||||
#
|
||||
# === Parameters
|
||||
#
|
||||
#
|
||||
#
|
||||
# === Variables
|
||||
#
|
||||
#
|
||||
# === Examples
|
||||
#
|
||||
# include proxmox::vm
|
||||
#
|
||||
# === Authors
|
||||
#
|
||||
# Gardouille <gardouille@gmail.com>
|
||||
#
|
||||
# Copyright
|
||||
#
|
||||
# WTFPL <http://wtfpl.org/>
|
||||
#
|
||||
class proxmox::vm (
|
||||
$vm_interfaces_path = $proxmox::params::vm_interfaces_path,
|
||||
$vm_interfaces_content = $proxmox::params::vm_interfaces_content,
|
||||
$vm_interfaces_tail_path = $proxmox::params::vm_interfaces_tail_path,
|
||||
$vm_interfaces_tail_content = $proxmox::params::vm_interfaces_tail_content,
|
||||
$network_service_name = $proxmox::params::network_service_name,
|
||||
$network_service_manage = $proxmox::params::network_service_manage,
|
||||
$network_service_enabled = $proxmox::params::network_service_enabled,
|
||||
) inherits proxmox::params {
|
||||
|
||||
case $::virtual {
|
||||
'openvz': {
|
||||
include proxmox::vm::openvz
|
||||
}
|
||||
'kvm': {
|
||||
}
|
||||
default: {
|
||||
fail(" => ${::virtual} <= virtual machines type is not yet supported.")
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
} # Public class: proxmox::vm
|
||||
|
|
@ -0,0 +1,41 @@
|
|||
# == Class: proxmox::vm::openvz
|
||||
#
|
||||
# Manage OpenVZ virtual machines (CT aka Containers)
|
||||
#
|
||||
class proxmox::vm::openvz {
|
||||
|
||||
File {
|
||||
owner => root,
|
||||
group => root,
|
||||
mode => 0644,
|
||||
}
|
||||
|
||||
# Test if a virtual interface is available
|
||||
## has_interface_with needs double quoted string for the argument !
|
||||
if has_interface_with("eth0") {
|
||||
|
||||
## has_interface_with needs double quoted string for the argument !
|
||||
if has_interface_with("venet0_0") { # Virtual network available too?
|
||||
|
||||
# Need to configure eth0 in an interfaces.tail file because
|
||||
# the main interfaces file is auto-generated by PVE (for venet config)
|
||||
file { $proxmox::vm::vm_interfaces_tail_path:
|
||||
ensure => present,
|
||||
content => template($proxmox::vm::vm_interfaces_tail_content),
|
||||
}
|
||||
|
||||
}
|
||||
else { # Only virtual interface is available
|
||||
|
||||
# If eth0 is the only interface, push it's configuration in the standard interfaces file
|
||||
file { $proxmox::vm::vm_interfaces_path:
|
||||
ensure => present,
|
||||
content => template($proxmox::vm::vm_interfaces_content),
|
||||
}
|
||||
|
||||
} # fi
|
||||
} # fi; don't need any additionnal network configuration
|
||||
|
||||
|
||||
|
||||
} # Private class: proxmox::vm::openvz
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
{
|
||||
"name": "gardouille-proxmox",
|
||||
"version": "0.2.3",
|
||||
"author": "Gardouille",
|
||||
"summary": "Manage Proxmox hypervisor and KVM virtual machines or OpenVZ containers.",
|
||||
"license": "WTFPL",
|
||||
"source": "https://git.101010.fr/puppet/proxmox",
|
||||
"project_page": "https://git.101010.fr/puppet/proxmox",
|
||||
"issues_url": "https://git.101010.fr/puppet/proxmox/issues",
|
||||
"description": "Proxmox module",
|
||||
"operatingsystem_support": [
|
||||
{
|
||||
"operatingsystem":"Debian"
|
||||
}
|
||||
],
|
||||
"dependencies": [
|
||||
{"name":"puppetlabs/stdlib","version_requirement":"4.x"},
|
||||
{"name":"puppetlabs/apt","version_requirement":">=1.1.0 <2.0.0"}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
require 'spec_helper'
|
||||
describe 'proxmox' do
|
||||
|
||||
context 'with defaults for all parameters' do
|
||||
it { should contain_class('proxmox') }
|
||||
end
|
||||
end
|
||||
|
|
@ -0,0 +1 @@
|
|||
require 'puppetlabs_spec_helper/module_spec_helper'
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
#file generated by puppet
|
||||
#Don't edit, please see https://forge.puppetlabs.com/gardouille/proxmox
|
||||
|
||||
## Load additonnal modules for Proxmox
|
||||
<% @pve_modules_list.each do |val| -%>
|
||||
<%= val %>
|
||||
<% end -%>
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
#file generated by puppet
|
||||
#Don't edit, please see https://forge.puppetlabs.com/gardouille/proxmox
|
||||
|
||||
# Access control list (Apache2 like)
|
||||
ALLOW_FROM="<%= scope.lookupvar('proxmox::hypervisor::pveproxy_allow') %>"
|
||||
DENY_FROM="<%= scope.lookupvar('proxmox::hypervisor::pveproxy_deny') %>"
|
||||
POLICY="<%= scope.lookupvar('proxmox::hypervisor::pveproxy_policy') %>"
|
||||
|
||||
|
|
@ -0,0 +1,56 @@
|
|||
## Global parameters
|
||||
VIRTUOZZO=yes
|
||||
LOCKDIR=/var/lib/vz/lock
|
||||
DUMPDIR=/var/lib/vz/dump
|
||||
VE0CPUUNITS=1000
|
||||
|
||||
## Logging parameters
|
||||
LOGGING=yes
|
||||
LOGFILE=/var/log/vzctl.log
|
||||
LOG_LEVEL=0
|
||||
VERBOSE=0
|
||||
|
||||
## Disk quota parameters
|
||||
DISK_QUOTA=yes
|
||||
VZFASTBOOT=no
|
||||
|
||||
# Disable module loading. If set, vz initscript does not load any modules.
|
||||
#MODULES_DISABLED=yes
|
||||
|
||||
# The name of the device whose IP address will be used as source IP for CT.
|
||||
# By default automatically assigned.
|
||||
#VE_ROUTE_SRC_DEV="eth0"
|
||||
|
||||
# Controls which interfaces to send ARP requests and modify ARP tables on.
|
||||
NEIGHBOUR_DEVS=detect
|
||||
|
||||
## Fail if there is another machine in the network with the same IP
|
||||
ERROR_ON_ARPFAIL="no"
|
||||
|
||||
## Template parameters
|
||||
TEMPLATE=/var/lib/vz/template
|
||||
|
||||
## Defaults for containers
|
||||
VE_ROOT=/var/lib/vz/root/$VEID
|
||||
VE_PRIVATE=/var/lib/vz/private/$VEID
|
||||
|
||||
## Filesystem layout for new CTs: either simfs (default) or ploop
|
||||
#VE_LAYOUT=ploop
|
||||
|
||||
## Load vzwdog module
|
||||
VZWDOG="no"
|
||||
|
||||
## IPv4 iptables kernel modules to be enabled in CTs by default
|
||||
<% if scope.lookupvar('proxmox::hypervisor::vz_iptables_modules') == true -%>
|
||||
IPTABLES="ipt_REJECT ipt_recent ipt_owner ipt_REDIRECT ipt_tos ipt_TOS ipt_LOG ip_conntrack ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length ipt_state iptable_nat ip_nat_ftp"
|
||||
<% else -%>
|
||||
IPTABLES=""
|
||||
<% end -%>
|
||||
## IPv4 iptables kernel modules to be loaded by init.d/vz script
|
||||
IPTABLES_MODULES="$IPTABLES"
|
||||
|
||||
## Enable IPv6
|
||||
IPV6="yes"
|
||||
|
||||
## IPv6 ip6tables kernel modules
|
||||
IP6TABLES="ip6_tables ip6table_filter ip6table_mangle ip6t_REJECT"
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
# file generated by puppet
|
||||
# Don't edit, please see https://forge.puppetlabs.com/gardouille/proxmox
|
||||
|
||||
# Auto generated lo interface
|
||||
auto lo
|
||||
iface lo inet loopback
|
||||
|
||||
# The main network interface
|
||||
auto eth0
|
||||
iface eth0 inet dhcp
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
# file generated by puppet
|
||||
# Don't edit, please see https://forge.puppetlabs.com/gardouille/proxmox
|
||||
|
||||
# The main network interface
|
||||
auto eth0
|
||||
iface eth0 inet dhcp
|
||||
# Need to delete routes creates for venet interfaces
|
||||
up ip route flush table main
|
||||
# Add the default gateway throught eth0
|
||||
# <%= scope.lookupvar('::ipaddress_eth0') %>
|
||||
up ip route add default dev eth0
|
||||
up ip route add <%= scope.lookupvar('::network_eth0') %>/<%= scope.lookupvar('::netmask_eth0') %> dev eth0 protocol kernel src <%= scope.lookupvar('::ipaddress_eth0') %>
|
||||
up ip route add <%= scope.lookupvar('::vznetwork_venet0_0') %>/<%= scope.lookupvar('::vznetmask_venet0_0') %> dev venet0
|
||||
down ip route del default dev eth0
|
||||
down ip route del <%= scope.lookupvar('::vznetwork_venet0_0') %>/<%= scope.lookupvar('::vznetmask_venet0_0') %> dev venet0
|
||||
|
|
@ -0,0 +1 @@
|
|||
proxmox::hypervisor::user { 'zaphod@pam': group => 'sysadmin', }
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
proxmox::hypervisor::group { 'sysadmin':
|
||||
role => 'Administrator',
|
||||
users => [ 'user1@pam', 'toto@pve' ],
|
||||
}
|
||||
proxmox::hypervisor::group { 'audit':
|
||||
role => 'PVEAuditor',
|
||||
users => [ 'user2@pam' ],
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
include proxmox::hypervisor
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
class { 'proxmox::hypervisor':
|
||||
kvm_only => true,
|
||||
}
|
||||
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
# The baseline for module testing used by Puppet Labs is that each manifest
|
||||
# should have a corresponding test manifest that declares that class or defined
|
||||
# type.
|
||||
#
|
||||
# Tests are then run by using puppet apply --noop (to check for compilation
|
||||
# errors and view a log of events) or by fully applying the test in a virtual
|
||||
# environment (to compare the resulting system state to the desired state).
|
||||
#
|
||||
# Learn more about module testing here:
|
||||
# http://docs.puppetlabs.com/guides/tests_smoke.html
|
||||
#
|
||||
include proxmox
|
||||
Loading…
Reference in New Issue