Skip to content

Conversation

@AmitSahastra
Copy link
Contributor

@AmitSahastra AmitSahastra commented Jul 23, 2025

LXD Initializer DaemonSet for Secure VM Host Provisioning

Overview

This PR introduces a Kubernetes DaemonSet approach for LXD initialization and VM host registration. This approach addresses a critical reviewer comment about direct LXD socket access from the CAPMaaS controller and improves security and scalability in distributed environments.

Key Changes

  • Added lxd-initializer DaemonSet that runs on each node to initialize LXD and register the node as a VM host with MAAS
  • Updated pkg/maas/lxd/host.go to use MAAS API exclusively for VM host operations
  • Enhanced pkg/maas/vmhosts package with comprehensive MAAS API client for VM host management
  • Removed all direct LXD socket access from the CAPMaaS controller
  • Added documentation for DaemonSet integration

Architecture

The new architecture separates concerns:

  1. LXD Initializer DaemonSet: Runs on each node to initialize LXD and register with MAAS
  2. CAPMaaS Controller: Uses MAAS API to create and manage VMs on registered VM hosts

This approach complements the existing LXD provisioning work by providing a secure and scalable method for LXD initialization while maintaining the comprehensive VM provisioning capabilities.

Benefits

  • Security: No direct LXD socket access from controller
  • Scalability: Works correctly in distributed environments
  • Separation of Concerns: Clear separation between node-side initialization and controller-side VM provisioning
  • API-Based: Uses MAAS API for all operations, no CLI commands

Testing

  • Tested LXD initialization on Ubuntu 22.04 with LXD 5.x
  • Verified VM host registration with MAAS API
  • Confirmed compatibility with existing VM provisioning workflow

Documentation

  • Added lxd-initializer/README.md with setup and usage instructions
  • Added lxd-initializer/integration.md with integration guide
  • Added lxd-initializer/SUMMARY.md with architectural overview

@AmitSahastra AmitSahastra marked this pull request as ready for review August 11, 2025 13:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant