Terraform Provider Libvirt

Sun, 13 Nov 2022 11:38:50 -0500

dmacvicar’s libvirt provider is already in the official registry. Yet, I indend to contribute functionalities, which I would like to use in my homelab. This post is the progressive summary of the process.

Development setup

Set the environment:

1
2

mkdir -p ~/GitRepos
mkdir -p ~/terraform.d/plugins/local-registry/cbugk/libvirt/0.7.0/linux_amd64

For installing terrraform and the initial provider test Fabian Lee’s introduction was followed. His main.tf file:

terraform {
  required_version = ">= 1.0.1"
  required_providers {
    libvirt = {
      source = "dmacvicar/libvirt"
      version = "0.6.10"
    }
  }
}

provider "libvirt" {
  uri = "qemu:///system"
}

resource "libvirt_domain" "terraform_test" {
  name = "terraform_test"
}

Compilation from source, which can be done by simply runing make. terraform-provider-libvirt binary will be output in repository’s root. For more info checkout provider’s Github repository, version 0.7.0 was used.

# Clone repository
$ mkdir -p ~/GitRepos
$ git clone https://github.com/dmacvicar/terraform-provider-libvirt.git
$ cd terraform-provider-libvirt
# Compile
$ make
# Move provider binary to registry
$mv terraform-provider-libvirt ~/.terraform.d/plugins/local-registry/cbugk/libvirt/0.7.0/linux_amd64/

For using a local copy of provider filesystem_mirror property was set under ~/.terraformrc (file was not present). Sources: Sam Debruyn’s blog post, tnom’s SO answer, terraform docs.

1
2

$ ls -la ~/.terraform.d/plugins/local-registry/cbugk/libvirt/0.7.0/linux_amd64/terraform-provider-libvirt
-rwxr-xr-x. 1 cbugk cbugk 24139069 Nov 13 09:41 /home/cbugk/.terraform.d/plugins/local-registry/cbugk/libvirt/0.7.0/linux_amd64/terraform-provider-libvirt

Note that due to location ~/.terraform.d/plugins being a default implicit override directory, creating rc file is not required. However, here is the respective configuration. ~/.terraformrc modified:

KVM Guest Network Isolation

Wed, 29 Jun 2022 18:38:00 +0300

Edited: 2022-06-30, added capability to block multiple subnets.

First things first!

1
2

mkdir -p ~/Bench/libvirt-nwfilter-test
cd ~/Bench/libvirt-nwfilter-test

Preface

Until I learn how to tame VXLAN for a virtualization cluster, I need a dirty way of seperating infrastructure network and the VM network.

The solution presented in this post is to apply libvirt’s network filters (nwfilter) to drop packages from and to the “uplink”, namely home LAN (10.0.0.0/18), for any guest connected to the NAT (192.168.123.0/24). This approach is analogous to setting firewall rules on a router, it just is virtual. Remember to adjust your subnets!

Libvirt on cbugk's blog

Terraform Provider Libvirt

Development setup

KVM Guest Network Isolation

Preface