Use ansible builtin modules for lxc and iptables, fixed IPs for containers

Author: Artur Orlov

.gitignore

@@ -1 +1,3 @@
 .vagrant
+.kitchen/
+.kitchen.local.yml

README.md

@@ -10,6 +10,10 @@ Role Variables
 # Basic settings for lxc networking
 lxc_domain_name: lxc
 lxc_ip_address: 10.0.3.1
+lxc_netmask: 255.255.0.0
+lxc_network: 10.10.0.0/16
+lxc_dhcp_range: 10.10.255.0,10.10.255.254
+lxc_dhcp_max: 253
 
 # containers to be used as a template
 lxc_containers:
@@ -23,12 +27,12 @@ lxc_containers:
 lxc_clones:
   - name: sample
     template: ubuntu.trusty
-    ip: 10.0.3.22
+    ip: 10.10.3.22
 
 # Expose ports from containers
-lxc_forwarded_ports: []
+lxc_forwarded_ports:
   - source: 80
-    target: 10.0.3.22:80
+    target: 10.10.3.22:80
 ```
 
 Example Playbook

defaults/main.yml

@@ -1,7 +1,12 @@
 ---
 # defaults file for lxc
 lxc_domain_name: lxc
-lxc_ip_address: 10.0.3.1
+lxc_ip_address: 10.10.0.1
+lxc_netmask: 255.255.0.0
+lxc_network: 10.10.0.0/16
+lxc_dhcp_range: 10.10.255.0,10.10.255.254
+lxc_dhcp_max: 253
+
 
 lxc_containers:
  - name: ubuntu.trusty

tasks/main.yml

@@ -1,83 +1,109 @@
 ---
 # tasks file for lxc
 
-- name: add ansible repo
+- name: lxc | add ansible repo
   apt_repository: repo=ppa:ansible/ansible
 
-- name: install system packages
+- name: lxc | install system packages
   apt: name={{item}} state=latest update_cache=yes
   with_items:
     - unzip
     - lxc
     - lxc-dev
+    - htop
     - dnsmasq
     - iptables-persistent
     - ansible
+    - python-pip
+    - python-dev
+    - gcc
 
-- name: create dnsmasq config file
+- name: lxc | install lxc-python
+  pip: name=lxc-python2 state=latest
+
+- name: lxc | save running containers
+  command: lxc-ls -1 --running
+  register: running_containers
+
+- name: lxc | ensure dnsmasq config file exists
   file: path=/etc/lxc/dnsmasq.conf state=touch
 
-- name: set lxc domain name
+- name: lxc | set fixed ips for containers
   lineinfile:
-    dest: /etc/default/lxc-net
-    regexp: "{{item.regexp}}"
-    line: "{{item.line}}"
-  with_items:
-    - regexp: ^LXC_DOMAIN=
-      line: LXC_DOMAIN="{{lxc_domain_name}}"
-    - regexp: ^LXC_DHCP_CONFILE=
-      line: LXC_DHCP_CONFILE=/etc/lxc/dnsmasq.conf
-  notify:
-    - restart lxc-net
-
-- name: setup lxc nameserver
+    dest: /etc/lxc/dnsmasq.conf
+    line: dhcp-host={{item.name}},{{item.ip}}
+  with_items: "{{lxc_clones}}"
+  register: lxc_net_hosts
+
+- name: lxc | configure lxc network
+  template: src=lxc-net.j2 dest=/etc/default/lxc-net
+  register: lxc_net_config
+
+- name: lxc | setup lxc nameserver
   lineinfile:
     dest: /etc/dnsmasq.d/lxc
     regexp: ^server=
     line: server=/lxc/{{lxc_ip_address}}
-  notify:
-    - restart lxc-net
-
-- name: create base container
-  command: >
-      lxc-create --name {{item.name}} -t {{item.template}} -- r {{item.release}}
-      --user {{item.user}} --password {{item.password}} --packages python2.7,python-pip
-      creates=/var/lib/lxc/{{item.name}}/config
-  with_items: "{{ lxc_containers }}"
+  register: lxc_dnsmasq
 
-- name: define cluster
-  lineinfile:
-    dest: /etc/lxc/dnsmasq.conf
-    line: dhcp-host={{item.name}}.{{lxc_domain_name}},{{item.ip}}
-  with_items: "{{lxc_clones}}"
+- name: lxc | stop running containers
+  lxc_container: name={{ item }} state=stopped
+  with_items: "{{ running_containers.stdout_lines }}"
+  when: lxc_net_config.changed or lxc_net_hosts.changed or lxc_dnsmasq.changed
 
-- name: restart lxc-net
-  service: name=lxc-net state=restarted
+- name: lxc | ensure lxc-net config changes applied
+  service: name={{ item }} state=restarted
+  with_items:
+      - lxc-net
+      - dnsmasq
+  when: lxc_net_config.changed or lxc_net_hosts.changed or lxc_dnsmasq.changed
 
-- name: restart dnsmasq
-  service: name=dnsmasq state=restarted
+- name: lxc | ensure lxc-net started
+  service: name=lxc-net state=started enabled=yes
 
-- name: create cluster nodes
-  command: >
-    lxc-clone -s {{item.template}} {{item.name}} creates=/var/lib/lxc/{{item.name}}/config
-  with_items: "{{lxc_clones}}"
+- name: lxc | restore running containers
+  lxc_container: name={{ item }} state=started
+  with_items: "{{ running_containers.stdout_lines }}"
+  when: lxc_net_config.changed or lxc_net_hosts.changed or lxc_dnsmasq.changed
 
-- name: start cluster
-  command: lxc-start -n {{item.name}} -d
-  with_items: "{{lxc_clones}}"
+- name: lxc | create base container
+  lxc_container:
+    name: "{{ item.name }}"
+    template: ubuntu
+    template_options: >
+        --release {{ item.release }}
+        --user {{ item.user }}
+        --password {{ item.password }}
+        --packages python2.7,python-pip
+    state: stopped
+    container_log: true
+  with_items: "{{ lxc_containers }}"
 
-- name: enable autostart of conatianers
-  lineinfile:
-    dest: /var/lib/lxc/{{item.name}}/config
-    line: lxc.start.auto = 1
-  with_items: "{{lxc_clones}}"
+- name: lxc | create clones
+  lxc_container:
+    name: "{{ item.template }}"
+    clone_name: "{{ item.name }}"
+    state: stopped
+  with_items: "{{ lxc_clones }}"
 
-- name: flush existing port forwarings
-  command: iptables -t nat -F PREROUTING
+- name: lxc | setup clones
+  lxc_container:
+    name: "{{ item.name }}"
+    container_config:
+      - "lxc.start.auto = 1"
+    state: restarted
+  with_items: "{{ lxc_clones }}"
 
-- name: forward ports to lxc machines
-  command: iptables -t nat -A PREROUTING -i eth1 -p tcp --dport {{item.source}} -j DNAT --to {{item.target}}
+- name: lxc | forward ports to lxc machines
+  iptables:
+    table: nat
+    chain: PREROUTING
+    in_interface: eth1
+    protocol: tcp
+    destination_port: "{{ item.source }}"
+    jump: DNAT
+    to_destination: "{{ item.target }}"
   with_items: "{{lxc_forwarded_ports}}"
 
-- name: save port forwardings
+- name: lxc | save port forwardings
   command: invoke-rc.d iptables-persistent save

vagrant/Vagrantfile

@@ -6,7 +6,7 @@ Vagrant.configure(2) do |config|
   config.ssh.insert_key = false
   config.ssh.private_key_path = "~/.vagrant.d/insecure_private_key"
 
-  config.vm.network "private_network", ip: "192.168.12.34"
+  config.vm.network "private_network", ip: "192.168.88.88"
   config.vm.provision "ansible" do |ansible|
     ansible.playbook = "test.yml"
     ansible.sudo = true

vagrant/test.yml

@@ -5,10 +5,17 @@
     lxc_clones:
       - name: sample
         template: ubuntu.trusty
-        ip: 10.0.3.3
+        ip: 10.10.3.3
+
+      - name: other
+        template: ubuntu.trusty
+        ip: 10.10.5.5
+
     lxc_forwarded_ports:
       - source: 2022
-        target: 10.0.3.3:22
+        target: 10.10.3.3:22
+
+      - source: 2055
+        target: 10.10.5.5:22
   roles:
     - lxc
-