sjat/boma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
boma/roles/integration_test
History
sjat d1941c987e feat(integration_test): Ansible-manage virbr-boma nftables input allow 
Adds a nftables drop-in (10-libvirt-boma.nft) to base's drop-in dir that
allows traffic on iifname "virbr-boma" in the inet filter input chain.
Fixes DHCP/DNS being dropped by base's default-deny INPUT policy for VMs
on the libvirt integration bridge. Mirrors docker_host's drop-in pattern.

Molecule scenario updated to exercise only the firewall tasks (package
install unavailable in the no-internet Docker container) via include_role
tasks_from; verify asserts the drop-in renders the virbr-boma accept rule.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-19 22:29:45 +02:00
..
defaults feat(integration_test): Ansible-manage virbr-boma nftables input allow 2026-06-19 22:29:45 +02:00
handlers feat(integration_test): Ansible-manage virbr-boma nftables input allow 2026-06-19 22:29:45 +02:00
meta feat(integration_test): KVM/libvirt substrate role on the control node 2026-06-18 12:09:35 +02:00
molecule/default feat(integration_test): Ansible-manage virbr-boma nftables input allow 2026-06-19 22:29:45 +02:00
tasks feat(integration_test): Ansible-manage virbr-boma nftables input allow 2026-06-19 22:29:45 +02:00
templates feat(integration_test): Ansible-manage virbr-boma nftables input allow 2026-06-19 22:29:45 +02:00
README.md fix: address final whole-branch review findings 2026-06-18 21:52:28 +02:00

README.md

integration_test

Installs the KVM/libvirt substrate on the control node (ubongo) so the agent can boot throwaway Debian VMs for local integration testing (ADR-025).

This is a non-service role — no SECURITY/VERIFY/ACCESS/BACKUP files are required. It does not make ubongo a production hypervisor; it only provides the tooling needed to spin up short-lived test VMs (see ADR-015).

Target group

control (i.e. ubongo)

What it does

  1. Installs QEMU/KVM, libvirt daemon + clients, virt-install, and cloud-image tools (cloud-image-utils, genisoimage).
  2. Enables and starts libvirtd.
  3. Adds the configured users (sjat, claude) to the libvirt and kvm groups so VMs can be managed without sudo.
  4. Creates /var/lib/boma-integration (owned root:libvirt, mode 2775) as the cache directory for golden images and overlays.

Defaults

Variable Default Purpose
integration_test__packages see defaults/main.yml APT packages to install
integration_test__users [sjat, claude] Users granted libvirt/kvm access
integration_test__cache_dir /var/lib/boma-integration Image/overlay cache directory

Related decisions

  • ADR-025 — local VM integration testing
  • ADR-015 — control host scope (ubongo is not a hypervisor)