Add new incus_server resource

[trunet]

Would be nice to have a way to set server configurations. In my use-case instances.placement.scriptlet.

I propose creating incus_config resource.

References:

• https://linuxcontainers.org/incus/docs/main/reference/manpages/incus/config/set/
• https://linuxcontainers.org/incus/docs/main/explanation/clustering/#instance-placement-scriptlet

[stgraber]

I'd probably have it be incus_server instead of incus_config so it doesn't get confusing with incus_instance and incus_profile.

This is one that will most likely need an import to be useful as most servers/clusters will have pre-existing configuration.

[maveonair]

So it would look like this:

incus_server {
  config = {
    " core.https_address" = "[::]:8443"
    // ...
  }
}

[maveonair]

I did some research and I'm not sure if we can configure this properly with a Terraform resource because of how Terraform works. That is, Terraform has the concept of resources that are created, updated or removed.

For an Incus server, there would only be updates and no other lifecycle methods, so the Terraform framework itself is not meant to do that. So I see the Terraform provider to manage the resources within an Incus server, but not the Incus server itself. That would more likely be done with Ansible?

[trunet]

you can create, update and remove. the config, will have to have everything.

my incus server config:

❯ curl -sk --cert ~/.config/incus/client.crt --key ~/.config/incus/client.key https://10.[REDACTED].68:8443/1.0 | jq '.metadata.config'
{
  "cluster.https_address": "10.[REDACTED].68:8443",
  "core.bgp_address": "10.[REDACTED].4:179",
  "core.bgp_asn": "[REDACTED]",
  "core.bgp_routerid": "10.[REDACTED].4",
  "core.https_address": "10.[REDACTED].68:8443",
  "network.ovn.northbound_connection": "tcp:10.[REDACTED].4:6641,tcp:10.[REDACTED].5:6641,tcp:10.[REDACTED].6:6641"
}

so, you can refresh, you can add and you can remove.

/1.0 endpoint, have PATCH, PUT to be able to do anything you want. delete will PUT an empty config key.

[maveonair]

you can create, update and remove. the config, will have to have everything.

my incus server config:

❯ curl -sk --cert ~/.config/incus/client.crt --key ~/.config/incus/client.key https://10.[REDACTED].68:8443/1.0 | jq '.metadata.config'
{
  "cluster.https_address": "10.[REDACTED].68:8443",
  "core.bgp_address": "10.[REDACTED].4:179",
  "core.bgp_asn": "[REDACTED]",
  "core.bgp_routerid": "10.[REDACTED].4",
  "core.https_address": "10.[REDACTED].68:8443",
  "network.ovn.northbound_connection": "tcp:10.[REDACTED].4:6641,tcp:10.[REDACTED].5:6641,tcp:10.[REDACTED].6:6641"
}

so, you can refresh, you can add and you can remove.

/1.0 endpoint, have PATCH, PUT to be able to do anything you want. delete will PUT an empty config key.

I think you have misunderstood me. It's not about the Incus API and whether it can be done with it, it's just about how Terraform works and this use case is not about creating, updating or removing a resource within Incus, it's about configuring Incus itself.

If we want to do this with Terraform, the resource definition would have to look like this, which I think is very far-fetched and not worth implementing:

 incus_config "http_address {
    key = "core.https_address"
    value = "[::]:8443"
}

For the configuration of the Incus server itself, I suggest that we use the Ansible playbooks: https://github.com/lxc/incus-deploy

[trunet]

In my opinion, this provider was created to manage everything inside incus. It's inside incus, and the provider should handle it.

It makes sense for ansible to configure ceph, ovn and install incus, configurations in the OS (like if there's an /etc/incus.conf) but not configure and maintain incus state inside incus itself. You're already connected to it through it's API. Terraform is way more powerful (and faster) than running ansible playbooks for this use-case.

It's fine to do a block config inside incus_server, like you proposed.

[stgraber]

I agree it's a bit of a weird one as you can only have one server config, you can't add more incus_server resources or delete any.

It's somewhat similar to what we have with the default profile situation, you can't create it, you can't delete it, you can only update it.

@trunet do you have an example of any other similar Terraform providers doing this?
I had a look at what's been done for VMware, Proxmox and OpenStack and all of them seem to be limited to creating and managing resources on top of the configured system rather than configuring the system itself.

[trunet]

I understand your point about the profile situation. we don't use default for this reason.

I found some cases which are similar to a "whole cluster config":
vsphere license: https://registry.terraform.io/providers/hashicorp/vsphere/latest/docs/resources/license
vsphere host: https://registry.terraform.io/providers/hashicorp/vsphere/latest/docs/resources/host
RHCS: https://registry.terraform.io/providers/terraform-redhat/rhcs/latest/docs/resources/tuning_config

Could we have some configs which could be done from terraform in the form of an attribute? We could start with incus_server resource with instance-placement-scriptlet attribute. Include others if there's a need.

Scriptlet is constantly evolving here, and is difficult to ansible-playbook all clusters/servers we have everytime there's a change in it.