How would I automate (VM/LXC)-agnostic templates in Proxmox without creating golden images?

For context: I want to automatically enable Intel SGX for every VM and LXC in Proxmox, but it doesn't seem like there's a way to do it using APIs AFAIK (so Terraform is out of the question unless I've missed something) other than editing the template for the individual LXC/VM.

I'd like to know if there's a tool that can automate this. I could potentially write a shell script but I'd like to know if there's something that's mature software before I go do this. I have been reading about Packer, Vagrant and cloud-init but I don't think this is something in their scope of usage.

Thanks!

vegetaaaaaaa ,
@vegetaaaaaaa@lemmy.world avatar

I would check enabling it from cloud-init and/or during an initial provisioning step using ansible

MigratingtoLemmy OP ,

I will probably have to run cloud-init/ansible on the PVE host for this to work. I'd probably go with Ansible, but I would have liked for this to be possible directly through Terraform. I don't know if it's the developer of the provider who didn't include this.

With that said, we do have AppArmour support for VMs, which is a secure enclave too (if I understand correctly). Don't quite know if switching on and using both SGX and AppArmour would be a good choice - would you happen to know about this?

vegetaaaaaaa ,
@vegetaaaaaaa@lemmy.world avatar

I would have liked for this to be possible directly through Terraform

Is it this proxmox provider? It does allow specifying cloud-init settings: https://registry.terraform.io/providers/Telmate/proxmox/latest/docs/resources/cloud_init_disk. So you can use runcmd or similar to do whatever is needed inside the host to enable Intel SGX, during the terraform provisioning step.

AppArmour support for VMs, which is a secure enclave too (if I understand correctly).

Nope, Apparmor is a Mandatory Access Control (MAC)) framework [1], similar to SELinux. It complements traditional Linux permissions (DAC, Discretionary Access Control). Apparmor is already enabled by default on Debian derivatives/Ubuntu.

MigratingtoLemmy OP ,

I was under the impression that cloud-init could only really be used to run commands inside the guest? Well, I could technically use Ansible and edit the file every time I provision something - this was just an example of however much the community tries, there might be something missing in the provider because proxmox doesn't take this on directly.

I should have worded that better. In using MAC, AppArmor effectively reduces access to files that would be essential for the VM to run. That is the sense in which I mentioned "security enclave" but I can see now that that isn't quite correct.

Either way, that is my philosophical reasoning for complaining this much. Ansible is pretty decent and has decent Proxmox integration, but Terraform is, in my opinion, superior when it comes to deploying infrastructure. That might be a bias from my side, of course. For now, I'm also going through the OpenStack documentation to see if the things I want to achieve can be done there, because they have an official Ansible project alongside their version of Cloudformation - Heat.

Thanks

vegetaaaaaaa ,
@vegetaaaaaaa@lemmy.world avatar

I was under the impression that cloud-init could only really be used to run commands inside the guest?

Yes that's correct, I didn't realize you had something to do outside the guest to enable it. What exactly? How do you solve it manually for now?

MigratingtoLemmy OP ,

Intel SGX requires for me to set a CPU flag in the .conf file. For now, it's a shell script and I can do it with Ansible, but I'd like to not have to do such half-baked measures

vegetaaaaaaa ,
@vegetaaaaaaa@lemmy.world avatar

I see, agree with you that it should be supported by the terraform provider if it is at the VM .conf level... maybe a new attribute in https://registry.terraform.io/providers/Telmate/proxmox/latest/docs/resources/vm_qemu#smbios-block? I would start by requesting this feature in https://github.com/Telmate/terraform-provider-proxmox/issues, and maybe try to add it yourself? (scratch your own itch, fix it for everyone in the process). Good luck

lupec ,

I don't have much actual experience with it but you can run arbitrary shell commands in at least cloud-init, the others should be able to do the same. Maybe that could work? Definitely better than manually running scripts, at least.

MigratingtoLemmy OP ,

Can't cloud-init only really run scripts in the guest and not on the host?

lupec ,

Yeah, you're probably right. I didn't connect the dots that's what you'd need here, my bad.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • random
  • selfhosted@lemmy.world
  • test
  • worldmews
  • mews
  • All magazines
    •