From c5ea15721f85f2e62b77ef2ed64e3e01efa179da Mon Sep 17 00:00:00 2001 From: cinnaboot Date: Sun, 25 Apr 2021 12:55:58 -0400 Subject: [PATCH] fix/workaround for setting container static IP --- roles/lxd_host/tasks/container_install.yml | 115 ++++++++++----------- roles/lxd_host/tasks/lxd_host.yml | 2 +- 2 files changed, 53 insertions(+), 64 deletions(-) diff --git a/roles/lxd_host/tasks/container_install.yml b/roles/lxd_host/tasks/container_install.yml index 1e99f0d..d97eaf8 100644 --- a/roles/lxd_host/tasks/container_install.yml +++ b/roles/lxd_host/tasks/container_install.yml @@ -12,79 +12,68 @@ container_present: true when: command_return.rc == 0 -# -# TODO: static ip not working -# the eth0 device is added, and ipv4.address is set, but the device -# is not attached to the bridge as per -# https://discuss.linuxcontainers.org/t/using-static-ips-with-lxd/1291/6 -# could add some more tasks to do it manually :( -# -- name: "install container {{ container_name }}" - community.general.lxd_container: - name: "{{ container_name }}" - state: started - profiles: default - wait_for_ipv4_addresses: true - source: - type: image - mode: pull - server: "{{ img_server }}" - protocol: simplestreams - alias: "{{ alp_img_alias }}" - devices: - eth0: - type: nic - nictype: bridged - parent: "{{ lxd_bridge }}" - ipv4.address: "{{ container_ip }}" - when: not container_present +- when: not container_present + block: + - name: "install container {{ container_name }}" + community.general.lxd_container: + name: "{{ container_name }}" + state: stopped + profiles: default + wait_for_ipv4_addresses: true + source: + type: image + mode: pull + server: "{{ img_server }}" + protocol: simplestreams + alias: "{{ alp_img_alias }}" -- name: update container packages - command: "{{ lxc_cmd }} exec {{ container_name }} -- apk upgrade -U" - when: not container_present + - name: manually attach eth0 to lxd bridge interface + block: + - command: "{{ lxc_cmd }} network attach {{ lxd_bridge }} \ + {{ container_name }} eth0 eth0" + - command: "{{ lxc_cmd }} config device set {{ container_name }} eth0 \ + ipv4.address {{ container_ip }}" + - community.general.lxd_container: + name: "{{ container_name }}" + state: started -- name: install common packages in containers - command: "{{ lxc_cmd }} exec {{ container_name }} -- \ - apk add python3 openssh rsync shadow tar" - when: not container_present + - name: install common packages in containers + command: "{{ lxc_cmd }} exec {{ container_name }} -- apk upgrade -U" + - command: "{{ lxc_cmd }} exec {{ container_name }} -- \ + apk add python3 openssh rsync shadow tar" -- name: "copy container sshd_config for {{ container_name }} to lxd host" - template: - src: templates/sshd_config.j2 - dest: "{{ tmp_sshd_config }}" - when: not container_present + - name: "copy container sshd_config for {{ container_name }} to lxd host" + template: + src: templates/sshd_config.j2 + dest: "{{ tmp_sshd_config }}" -- name: use lxc file push to get sshd_config into container - command: "{{ lxc_cmd }} file push {{ tmp_sshd_config}} \ - {{ container_name }}/etc/ssh/sshd_config" - when: not container_present + - name: use lxc file push to get sshd_config into container + command: "{{ lxc_cmd }} file push {{ tmp_sshd_config}} \ + {{ container_name }}/etc/ssh/sshd_config" -- name: mkdir /root/.ssh in {{ container_name }} - command: "{{ lxc_cmd }} exec {{ container_name }} -- mkdir -p /root/.ssh" - when: not container_present + - name: mkdir /root/.ssh in {{ container_name }} + command: "{{ lxc_cmd }} exec {{ container_name }} -- mkdir -p /root/.ssh" -- name: add controller public key to {{ container_name }} authorized keys - command: "{{ lxc_cmd }} file push {{ tmp_pubkey }} \ - {{ container_name }}/root/.ssh/authorized_keys \ - --gid 0 --uid 0 --mode 600" - when: not container_present + - name: add controller public key to {{ container_name }} authorized keys + command: "{{ lxc_cmd }} file push {{ tmp_pubkey }} \ + {{ container_name }}/root/.ssh/authorized_keys \ + --gid 0 --uid 0 --mode 600" -- name: make hash of a random password - set_fact: - root_pass: "{{ lookup('password', '/dev/null length=15 chars=ascii_letters') | password_hash('sha512') }}" - when: not container_present + - name: make hash of a random password + set_fact: + root_pass: "{{ lookup('password', + '/dev/null length=15 chars=ascii_letters') + | password_hash('sha512') }}" -- name: "set password to unlock root account (NOTE: still using pubkey only)" - shell: '{{ lxc_cmd }} exec {{ container_name }} -- usermod -p {{ root_pass }} root' - when: not container_present + - name: "set password to unlock root account (NOTE: still using pubkey only)" + shell: '{{ lxc_cmd }} exec {{ container_name }} -- \ + usermod -p {{ root_pass }} root' -- name: ensure sshd service is enabled - command: "{{ lxc_cmd }} exec {{ container_name }} -- rc-update add sshd" - when: not container_present + - name: ensure sshd service is enabled + command: "{{ lxc_cmd }} exec {{ container_name }} -- rc-update add sshd" -- name: ensure sshd service is started - command: "{{ lxc_cmd }} exec {{ container_name }} -- rc-service sshd start" - when: not container_present + - name: ensure sshd service is started + command: "{{ lxc_cmd }} exec {{ container_name }} -- rc-service sshd start" - set_fact: container_present: false diff --git a/roles/lxd_host/tasks/lxd_host.yml b/roles/lxd_host/tasks/lxd_host.yml index b50c80e..0c46a5a 100644 --- a/roles/lxd_host/tasks/lxd_host.yml +++ b/roles/lxd_host/tasks/lxd_host.yml @@ -7,7 +7,7 @@ # TODO: might make sense to add a cache redirect for alpine packages - include_tasks: tasks/container_install.yml - tags: containers + tags: container_install vars: container_name: "{{ item }}" container_sshd_port: "{{ hostvars[item]['ansible_port'] }}"