two/main/exploitation/configuration.html
2026-09-09 22:07:27 +00:00

670 lines
No EOL
36 KiB
HTML
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

<!DOCTYPE html>
<html lang="fr" data-content_root="../" >
<head>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
<title>Configuration &#8212; Documentation two 0.1.0</title>
<script data-cfasync="false">
document.documentElement.dataset.mode = localStorage.getItem("mode") || "";
document.documentElement.dataset.theme = localStorage.getItem("theme") || "";
</script>
<!--
this give us a css class that will be invisible only if js is disabled
-->
<noscript>
<style>
.pst-js-only { display: none !important; }
</style>
</noscript>
<!-- Loaded before other Sphinx assets -->
<link href="../_static/styles/theme.css?digest=8878045cc6db502f8baf" rel="stylesheet" />
<link href="../_static/styles/pydata-sphinx-theme.css?digest=8878045cc6db502f8baf" rel="stylesheet" />
<link rel="stylesheet" type="text/css" href="../_static/pygments.css?v=8f2a1f02" />
<link rel="stylesheet" type="text/css" href="../_static/styles/sphinx-book-theme.css?v=3c74b3bc" />
<!-- So that users can add custom icons -->
<script src="../_static/scripts/fontawesome.js?digest=8878045cc6db502f8baf"></script>
<!-- Pre-loaded scripts that we'll load fully later -->
<link rel="preload" as="script" href="../_static/scripts/bootstrap.js?digest=8878045cc6db502f8baf" />
<link rel="preload" as="script" href="../_static/scripts/pydata-sphinx-theme.js?digest=8878045cc6db502f8baf" />
<script src="../_static/documentation_options.js?v=57395fb6"></script>
<script src="../_static/doctools.js?v=fd6eb6e6"></script>
<script src="../_static/sphinx_highlight.js?v=6ffebe34"></script>
<script src="../_static/scripts/sphinx-book-theme.js?v=fab101a9"></script>
<script src="../_static/translations.js?v=e6b791cb"></script>
<script>DOCUMENTATION_OPTIONS.pagename = 'exploitation/configuration';</script>
<script>
DOCUMENTATION_OPTIONS.theme_version = '0.16.1';
DOCUMENTATION_OPTIONS.theme_switcher_json_url = '../switcher.json';
DOCUMENTATION_OPTIONS.theme_switcher_version_match = 'main';
DOCUMENTATION_OPTIONS.show_version_warning_banner =
false;
</script>
<link rel="index" title="Index" href="../genindex.html" />
<link rel="search" title="Recherche" href="../search.html" />
<link rel="next" title="Services systemd" href="services.html" />
<link rel="prev" title="Exploitation" href="index.html" />
<meta name="viewport" content="width=device-width, initial-scale=1"/>
<meta name="docsearch:language" content="fr"/>
<meta name="docsearch:version" content="0.1" />
</head>
<body data-bs-spy="scroll" data-bs-target=".bd-toc-nav" data-offset="180" data-bs-root-margin="0px 0px -60%" data-default-mode="">
<div id="pst-skip-link" class="skip-link d-print-none"><a href="#main-content">Passer au contenu principal</a></div>
<div id="pst-scroll-pixel-helper"></div>
<button type="button" class="btn rounded-pill" id="pst-back-to-top">
<i class="fa-solid fa-arrow-up"></i>Haut de page</button>
<dialog id="pst-search-dialog">
<form class="bd-search d-flex align-items-center"
action="../search.html"
method="get">
<i class="fa-solid fa-magnifying-glass"></i>
<input type="search"
class="form-control"
name="q"
placeholder="Search..."
aria-label="Search..."
autocomplete="off"
autocorrect="off"
autocapitalize="off"
spellcheck="false"/>
<span class="search-button__kbd-shortcut"><kbd class="kbd-shortcut__modifier">Ctrl</kbd>+<kbd>K</kbd></span>
</form>
</dialog>
<div class="pst-async-banner-revealer d-none">
<aside id="bd-header-version-warning" class="d-none d-print-none" aria-label="Alerte de version"></aside>
</div>
<header class="bd-header navbar navbar-expand-lg bd-navbar d-print-none">
</header>
<div class="bd-container">
<div class="bd-container__inner bd-page-width">
<dialog id="pst-primary-sidebar-modal"></dialog>
<div id="pst-primary-sidebar" class="bd-sidebar-primary bd-sidebar">
<div class="sidebar-header-items sidebar-primary__section">
</div>
<div class="sidebar-primary-items__start sidebar-primary__section">
<div class="sidebar-primary-item">
<a class="navbar-brand logo" href="../index.html">
<p class="title logo__title">Documentation two 0.1.0</p>
</a></div>
<div class="sidebar-primary-item"><ul class="navbar-icon-links"
aria-label="Icon Links">
<li class="nav-item">
<a href="https://git.g3e.fr/syonad/two" title="Dépôt" class="nav-link pst-navbar-icon" rel="noopener" target="_blank" data-bs-toggle="tooltip" data-bs-placement="bottom"><i class="fa-solid fa-code-branch fa-lg" aria-hidden="true"></i>
<span class="sr-only">Dépôt</span></a>
</li>
</ul></div>
<div class="sidebar-primary-item">
<div class="version-switcher__container dropdown pst-js-only">
<button id="pst-version-switcher-button-2"
type="button"
class="version-switcher__button btn btn-sm dropdown-toggle"
data-bs-toggle="dropdown"
aria-haspopup="listbox"
aria-controls="pst-version-switcher-list-2"
aria-label="Version switcher list"
>
Choose version <!-- this text may get changed later by javascript -->
<span class="caret"></span>
</button>
<div id="pst-version-switcher-list-2"
class="version-switcher__menu dropdown-menu list-group-flush py-0"
role="listbox" aria-labelledby="pst-version-switcher-button-2">
<!-- dropdown will be populated by javascript on page load -->
</div>
</div></div>
<div class="sidebar-primary-item">
<button class="btn search-button-field search-button__button pst-js-only" title="Recherche" aria-label="Recherche" data-bs-placement="bottom" data-bs-toggle="tooltip">
<i class="fa-solid fa-magnifying-glass"></i>
<span class="search-button__default-text">Recherche</span>
<span class="search-button__kbd-shortcut"><kbd class="kbd-shortcut__modifier">Ctrl</kbd>+<kbd class="kbd-shortcut__modifier">K</kbd></span>
</button></div>
<div class="sidebar-primary-item"><nav class="bd-links bd-docs-nav" aria-label="Main">
<div class="bd-toc-item navbar-nav active">
<ul class="nav bd-sidenav bd-sidenav__home-link">
<li class="toctree-l1">
<a class="reference internal" href="../index.html">
two
</a>
</li>
</ul>
<p aria-level="2" class="caption" role="heading"><span class="caption-text">Mise en œuvre</span></p>
<ul class="nav bd-sidenav">
<li class="toctree-l1 has-children"><a class="reference internal" href="../demarrage/index.html">Démarrage</a><details><summary><span class="toctree-toggle" role="presentation"><i class="fa-solid fa-chevron-down"></i></span></summary><ul>
<li class="toctree-l2"><a class="reference internal" href="../demarrage/installation.html">Installation d’un hyperviseur</a></li>
<li class="toctree-l2"><a class="reference internal" href="../demarrage/premier-vpc.html">Premier VPC, premier subnet, première VM</a></li>
</ul>
</details></li>
<li class="toctree-l1 has-children"><a class="reference internal" href="../deploiement/index.html">Déploiement d’un cluster</a><details><summary><span class="toctree-toggle" role="presentation"><i class="fa-solid fa-chevron-down"></i></span></summary><ul>
<li class="toctree-l2"><a class="reference internal" href="../deploiement/architecture-cluster.html">Architecture du cluster</a></li>
<li class="toctree-l2"><a class="reference internal" href="../deploiement/image-qcow2.html">Construction de l’image qcow2</a></li>
<li class="toctree-l2"><a class="reference internal" href="../deploiement/routeurs.html">Routeurs</a></li>
<li class="toctree-l2"><a class="reference internal" href="../deploiement/premier-hyperviseur.html">Premier hyperviseur</a></li>
<li class="toctree-l2"><a class="reference internal" href="../deploiement/route-reflector.html">VM route reflector</a></li>
</ul>
</details></li>
</ul>
<p aria-level="2" class="caption" role="heading"><span class="caption-text">Exploitation</span></p>
<ul class="current nav bd-sidenav">
<li class="toctree-l1 current active has-children"><a class="reference internal" href="index.html">Exploitation</a><details open="open"><summary><span class="toctree-toggle" role="presentation"><i class="fa-solid fa-chevron-down"></i></span></summary><ul class="current">
<li class="toctree-l2 current active"><a class="current reference internal" href="#">Configuration</a></li>
<li class="toctree-l2"><a class="reference internal" href="services.html">Services systemd</a></li>
<li class="toctree-l2 has-children"><a class="reference internal" href="api-agent/index.html">API de l’agent</a><details><summary><span class="toctree-toggle" role="presentation"><i class="fa-solid fa-chevron-down"></i></span></summary><ul>
<li class="toctree-l3"><a class="reference internal" href="api-agent/asynchronisme.html">Modèle asynchrone et codes de retour</a></li>
<li class="toctree-l3"><a class="reference internal" href="api-agent/reference.html">Référence</a></li>
</ul>
</details></li>
<li class="toctree-l2"><a class="reference internal" href="observabilite.html">Observabilité</a></li>
<li class="toctree-l2"><a class="reference internal" href="diagnostic.html">Diagnostic</a></li>
</ul>
</details></li>
</ul>
<p aria-level="2" class="caption" role="heading"><span class="caption-text">Interne</span></p>
<ul class="nav bd-sidenav">
<li class="toctree-l1 has-children"><a class="reference internal" href="../concepts/index.html">Concepts</a><details><summary><span class="toctree-toggle" role="presentation"><i class="fa-solid fa-chevron-down"></i></span></summary><ul>
<li class="toctree-l2"><a class="reference internal" href="../concepts/vpc-subnet-vm.html">VPC, subnet et VM</a></li>
<li class="toctree-l2"><a class="reference internal" href="../concepts/modes-reseau.html">Modes réseau</a></li>
<li class="toctree-l2"><a class="reference internal" href="../concepts/cycle-de-vie.html">Cycle de vie des ressources</a></li>
<li class="toctree-l2"><a class="reference internal" href="../concepts/metadata-cloud-init.html">Metadata et cloud-init</a></li>
</ul>
</details></li>
<li class="toctree-l1 has-children"><a class="reference internal" href="../architecture/index.html">Architecture</a><details><summary><span class="toctree-toggle" role="presentation"><i class="fa-solid fa-chevron-down"></i></span></summary><ul>
<li class="toctree-l2"><a class="reference internal" href="../architecture/vue-densemble.html">Vue d’ensemble</a></li>
<li class="toctree-l2"><a class="reference internal" href="../architecture/stockage.html">Schéma des clés</a></li>
<li class="toctree-l2"><a class="reference internal" href="../architecture/contraintes.html">Invariants et pièges</a></li>
</ul>
</details></li>
<li class="toctree-l1 has-children"><a class="reference internal" href="../versions/index.html">Versions</a><details><summary><span class="toctree-toggle" role="presentation"><i class="fa-solid fa-chevron-down"></i></span></summary><ul>
<li class="toctree-l2"><a class="reference internal" href="../versions/0.2.0.html">Bael</a></li>
<li class="toctree-l2"><a class="reference internal" href="../versions/0.1.0.html">Michael</a></li>
</ul>
</details></li>
</ul>
</div>
</nav></div>
</div>
<div class="sidebar-primary-items__end sidebar-primary__section">
<div class="sidebar-primary-item">
<div id="ethical-ad-placement"
class="flat"
data-ea-publisher="readthedocs"
data-ea-type="readthedocs-sidebar"
data-ea-manual="true">
</div></div>
</div>
</div>
<main id="main-content" class="bd-main" role="main">
<div class="sbt-scroll-pixel-helper"></div>
<div class="bd-content">
<div class="bd-article-container">
<div class="bd-header-article d-print-none">
<div class="header-article-items header-article__inner">
<div class="header-article-items__start">
<div class="header-article-item"><button class="sidebar-toggle primary-toggle btn btn-sm" title="Toggle primary sidebar" data-bs-placement="bottom" data-bs-toggle="tooltip">
<span class="fa-solid fa-bars"></span>
</button></div>
</div>
<div class="header-article-items__end">
<div class="header-article-item">
<div class="article-header-buttons">
<button onclick="toggleFullScreen()"
class="btn btn-sm btn-fullscreen-button pst-navbar-icon"
title="Mode plein écran"
data-bs-placement="bottom" data-bs-toggle="tooltip"
>
<span class="btn__icon-container">
<i class="fas fa-expand"></i>
</span>
</button>
<button class="btn btn-sm nav-link pst-navbar-icon theme-switch-button pst-js-only" aria-label="Thème" data-bs-title="Thème" data-bs-placement="bottom" data-bs-toggle="tooltip">
<i class="theme-switch fa-solid fa-sun fa-lg" data-mode="light" title="Clair"></i>
<i class="theme-switch fa-solid fa-moon fa-lg" data-mode="dark" title="Sombre"></i>
<i class="theme-switch fa-solid fa-circle-half-stroke fa-lg" data-mode="auto" title="Paramètres système"></i>
</button>
<button class="btn btn-sm pst-navbar-icon search-button search-button__button pst-js-only" title="Recherche" aria-label="Recherche" data-bs-placement="bottom" data-bs-toggle="tooltip">
<i class="fa-solid fa-magnifying-glass fa-lg"></i>
</button>
<button class="sidebar-toggle secondary-toggle btn btn-sm pst-navbar-icon" title="Toggle secondary sidebar" data-bs-placement="bottom" data-bs-toggle="tooltip">
<span class="fa-solid fa-list"></span>
</button>
</div></div>
</div>
</div>
</div>
<div id="jb-print-docs-body" class="onlyprint">
<h1>Configuration</h1>
<!-- Table of contents -->
<div id="print-main-content">
<div id="jb-print-toc">
<div>
<h2> Contenu </h2>
</div>
<nav aria-label="Page">
<ul class="visible nav section-nav flex-column">
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#base-de-donnees">Base de données</a></li>
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#serveurs">Serveurs</a></li>
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#execution-des-commandes">Exécution des commandes</a></li>
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#correspondance-des-interfaces">Correspondance des interfaces</a></li>
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#metadata-et-qemu">Metadata et QEMU</a></li>
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#backend-dhcp">Backend DHCP</a><ul class="nav section-nav flex-column">
<li class="toc-h3 nav-item toc-entry"><a class="reference internal nav-link" href="#bascule-d-un-backend-a-l-autre">Bascule d’un backend à l’autre</a></li>
</ul>
</li>
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#watchdog">Watchdog</a></li>
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#journalisation">Journalisation</a></li>
</ul>
</nav>
</div>
</div>
</div>
<div id="searchbox"></div>
<article class="bd-article">
<section id="configuration">
<h1>Configuration<a class="headerlink" href="#configuration" title="Lien vers cette rubrique">#</a></h1>
<p>Un seul fichier, <code class="docutils literal notranslate"><span class="pre">/etc/two/agent.yml</span></code>, partagé par les quatre binaires : <code class="docutils literal notranslate"><span class="pre">agent</span> <span class="pre">-config</span></code>,
<code class="docutils literal notranslate"><span class="pre">metadata</span> <span class="pre">-conf</span></code>, <code class="docutils literal notranslate"><span class="pre">db</span> <span class="pre">-conf</span></code> et <code class="docutils literal notranslate"><span class="pre">dhcp</span> <span class="pre">-conf</span></code>. Le fichier de référence commenté est
<code class="docutils literal notranslate"><span class="pre">conf/agent/config.exemple.yml</span></code> dans le dépôt.</p>
<p>Le chargement se fait par <strong>viper</strong> : les clés sont celles ci-dessous, en YAML.</p>
<div class="admonition warning">
<p class="admonition-title">Avertissement</p>
<p>Un fichier <strong>absent</strong> est toléré : toutes les valeurs par défaut s’appliquent. Un fichier
<strong>présent mais invalide</strong> fait en revanche échouer le démarrage, volontairement — jusqu’à
la version 0.1.0 il était ignoré en silence, et l’agent tournait alors entièrement sur les
défauts sans le dire. Une tabulation d’indentation ou un <code class="docutils literal notranslate"><span class="pre">--</span></code> égaré suffisent.</p>
</div>
<div class="admonition danger">
<p class="admonition-title">Danger</p>
<p><strong>L’API de l’agent n’a aucune authentification.</strong> L’exemple livré écoute sur
<code class="docutils literal notranslate"><span class="pre">0.0.0.0:8080</span></code> : quiconque atteint ce port peut créer et détruire des VM et des réseaux sur
l’host KVM, c’est-à-dire en prendre le contrôle.</p>
<p>Sur tout déploiement réel : restreindre <code class="docutils literal notranslate"><span class="pre">api.address</span></code> à une adresse d’administration, ou
filtrer le port en amont (pare-feu, réseau dédié). Traiter l’ouverture de ce port comme une
décision d’architecture, pas comme un réglage.</p>
</div>
<section id="base-de-donnees">
<h2>Base de données<a class="headerlink" href="#base-de-donnees" title="Lien vers cette rubrique">#</a></h2>
<div class="highlight-yaml notranslate"><div class="highlight"><pre><span></span><span class="nt">database</span><span class="p">:</span>
<span class="w"> </span><span class="nt">path</span><span class="p">:</span><span class="w"> </span><span class="s">"/var/lib/two/data/"</span>
</pre></div>
</div>
<p>Répertoire de la base clé-valeur Badger. <strong>Un seul processus l’ouvre</strong> : l’agent. Ni le serveur
de metadata ni aucun autre outil ne doit être configuré pour ouvrir le même répertoire pendant
que l’agent tourne.</p>
</section>
<section id="serveurs">
<h2>Serveurs<a class="headerlink" href="#serveurs" title="Lien vers cette rubrique">#</a></h2>
<div class="highlight-yaml notranslate"><div class="highlight"><pre><span></span><span class="nt">api</span><span class="p">:</span>
<span class="w"> </span><span class="nt">address</span><span class="p">:</span><span class="w"> </span><span class="s">"0.0.0.0"</span>
<span class="w"> </span><span class="nt">port</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">8080</span>
<span class="nt">prometheus</span><span class="p">:</span>
<span class="w"> </span><span class="nt">address</span><span class="p">:</span><span class="w"> </span><span class="s">"0.0.0.0"</span>
<span class="w"> </span><span class="nt">port</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">9090</span>
<span class="nt">admin</span><span class="p">:</span>
<span class="w"> </span><span class="nt">enabled</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">false</span>
<span class="w"> </span><span class="nt">address</span><span class="p">:</span><span class="w"> </span><span class="s">"127.0.0.1"</span>
<span class="w"> </span><span class="nt">port</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">9091</span>
</pre></div>
</div>
<p><code class="docutils literal notranslate"><span class="pre">admin</span></code> expose une inspection en lecture seule de la base (<code class="docutils literal notranslate"><span class="pre">/db?prefix=…</span></code>). Elle est
désactivée par défaut et prévue pour la boucle locale uniquement.</p>
<div class="admonition warning">
<p class="admonition-title">Avertissement</p>
<p>Le contenu de la base inclut <code class="docutils literal notranslate"><span class="pre">vm/&lt;name&gt;/password</span></code>, qui est un hash de mot de passe.
L’activation de l’API d’administration rend ces valeurs lisibles par tout ce qui atteint le
port. Ne pas l’exposer hors de la boucle locale.</p>
</div>
</section>
<section id="execution-des-commandes">
<h2>Exécution des commandes<a class="headerlink" href="#execution-des-commandes" title="Lien vers cette rubrique">#</a></h2>
<div class="highlight-yaml notranslate"><div class="highlight"><pre><span></span><span class="nt">worker</span><span class="p">:</span>
<span class="w"> </span><span class="nt">count</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">4</span>
<span class="w"> </span><span class="nt">buffer_size</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">100</span>
<span class="nt">dispatcher</span><span class="p">:</span>
<span class="w"> </span><span class="nt">timeout_seconds</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">300</span>
<span class="w"> </span><span class="nt">poll_seconds</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">2</span>
</pre></div>
</div>
<p><code class="docutils literal notranslate"><span class="pre">worker.count</span></code> est le nombre de goroutines qui exécutent les commandes ; <code class="docutils literal notranslate"><span class="pre">buffer_size</span></code> le
nombre de commandes en attente au-delà duquel <code class="docutils literal notranslate"><span class="pre">Dispatch</span></code> bloque.</p>
<p><code class="docutils literal notranslate"><span class="pre">dispatcher.timeout_seconds</span></code> borne les opérations qui attendent une transition d’état, dont
l’extinction d’une VM.</p>
<div class="admonition warning">
<p class="admonition-title">Avertissement</p>
<p>À l’expiration de ce délai, une VM qui ne s’est pas éteinte reçoit un <code class="docutils literal notranslate"><span class="pre">quit</span></code> QMP — un arrêt
<strong>brutal</strong>. Pour des charges dont l’extinction est lente (bases de données, construction
d’images), une valeur confortable évite un système de fichiers invité incohérent.</p>
</div>
</section>
<section id="correspondance-des-interfaces">
<h2>Correspondance des interfaces<a class="headerlink" href="#correspondance-des-interfaces" title="Lien vers cette rubrique">#</a></h2>
<div class="highlight-yaml notranslate"><div class="highlight"><pre><span></span><span class="nt">default_interface</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">br-000000</span>
<span class="nt">interfaces</span><span class="p">:</span>
<span class="w"> </span><span class="nt">vms</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">br-000000</span>
<span class="w"> </span><span class="nt">internet</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">br-000000</span>
<span class="w"> </span><span class="nt">admin</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">br-000000</span>
</pre></div>
</div>
<p>Traduit les clés logiques <code class="docutils literal notranslate"><span class="pre">iface_type</span></code> de l’API vers les bridges physiques de l’host. Une clé
inconnue ou omise retombe silencieusement sur <code class="docutils literal notranslate"><span class="pre">default_interface</span></code> — ce n’est pas une erreur,
mais c’est une source de subnets branchés au mauvais endroit sans le dire.</p>
</section>
<section id="metadata-et-qemu">
<h2>Metadata et QEMU<a class="headerlink" href="#metadata-et-qemu" title="Lien vers cette rubrique">#</a></h2>
<div class="highlight-yaml notranslate"><div class="highlight"><pre><span></span><span class="nt">metadata</span><span class="p">:</span>
<span class="w"> </span><span class="nt">run_dir</span><span class="p">:</span><span class="w"> </span><span class="s">"/run/two/metadata"</span>
<span class="nt">qemu</span><span class="p">:</span>
<span class="w"> </span><span class="nt">ovmf_code_path</span><span class="p">:</span><span class="w"> </span><span class="s">"/usr/share/OVMF/OVMF_CODE.fd"</span>
<span class="w"> </span><span class="nt">ovmf_vars_template</span><span class="p">:</span><span class="w"> </span><span class="s">"/usr/share/OVMF/OVMF_VARS.fd"</span>
<span class="w"> </span><span class="nt">uefi_vars_dir</span><span class="p">:</span><span class="w"> </span><span class="s">"/run/two/vms/efi"</span>
<span class="w"> </span><span class="nt">serial_dir</span><span class="p">:</span><span class="w"> </span><span class="s">"/run/two/vms/serial"</span>
<span class="w"> </span><span class="nt">monitor_dir</span><span class="p">:</span><span class="w"> </span><span class="s">"/run/two/vms/monitor"</span>
<span class="w"> </span><span class="nt">qmp_dir</span><span class="p">:</span><span class="w"> </span><span class="s">"/run/two/vms/qmp"</span>
</pre></div>
</div>
<p>Les chemins OVMF sont nécessaires aux VM démarrées avec <code class="docutils literal notranslate"><span class="pre">uefi:</span> <span class="pre">true</span></code> (paquet <code class="docutils literal notranslate"><span class="pre">ovmf</span></code> sur
Debian et Ubuntu). <code class="docutils literal notranslate"><span class="pre">uefi_vars_dir</span></code> reçoit une copie inscriptible des variables UEFI par VM,
créée au démarrage et supprimée à l’arrêt.</p>
</section>
<section id="backend-dhcp">
<h2>Backend DHCP<a class="headerlink" href="#backend-dhcp" title="Lien vers cette rubrique">#</a></h2>
<div class="highlight-yaml notranslate"><div class="highlight"><pre><span></span><span class="nt">dhcp</span><span class="p">:</span>
<span class="w"> </span><span class="nt">backend</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">dnsmasq</span><span class="w"> </span><span class="c1"># ou two</span>
</pre></div>
</div>
<p>Choisit qui sert le DHCP des subnets <strong>créés par cet agent</strong> :</p>
<div class="pst-scrollable-table-container"><table class="table">
<colgroup>
<col style="width: 14.0%" />
<col style="width: 44.0%" />
<col style="width: 42.0%" />
</colgroup>
<thead>
<tr class="row-odd"><th class="head"><p>Valeur</p></th>
<th class="head"><p>Serveur</p></th>
<th class="head"><p>Unit</p></th>
</tr>
</thead>
<tbody>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">dnsmasq</span></code></p></td>
<td><p>dnsmasq, configuré par fichiers dans <code class="docutils literal notranslate"><span class="pre">/etc/dnsmasq.d</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">dnsmasq&#64;&lt;netns&gt;_&lt;bridge&gt;</span></code></p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">two</span></code></p></td>
<td><p>le binaire <code class="docutils literal notranslate"><span class="pre">dhcp</span></code>, piloté par socket Unix</p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">dhcp&#64;&lt;netns&gt;_&lt;bridge&gt;</span></code></p></td>
</tr>
</tbody>
</table>
</div>
<p>Le défaut est <code class="docutils literal notranslate"><span class="pre">dnsmasq</span></code> : un fichier de configuration de la 0.1.0, non modifié, se comporte
exactement comme avant. Toute autre valeur que <code class="docutils literal notranslate"><span class="pre">dnsmasq</span></code> ou <code class="docutils literal notranslate"><span class="pre">two</span></code> fait échouer le démarrage.</p>
<p>Le répertoire d’exécution du backend <code class="docutils literal notranslate"><span class="pre">two</span></code> — <code class="docutils literal notranslate"><span class="pre">/run/two/dhcp</span></code> — <strong>n’est pas configurable</strong> :
le script d’enrobage le code en dur, une clé que lui ignorerait serait un mensonge.</p>
<p>Ce que le backend <code class="docutils literal notranslate"><span class="pre">two</span></code> apporte : la configuration DHCP devient modifiable par VM et non plus
seulement par subnet, ce qui permet de n’annoncer la route par défaut que sur <strong>une</strong> interface
d’une VM multi-réseaux. Le watchdog peut en outre interroger le serveur et comparer ce qu’il sert
à ce que la base dit — voir <a class="reference internal" href="diagnostic.html"><span class="doc">Diagnostic</span></a>.</p>
<section id="bascule-d-un-backend-a-l-autre">
<h3>Bascule d’un backend à l’autre<a class="headerlink" href="#bascule-d-un-backend-a-l-autre" title="Lien vers cette rubrique">#</a></h3>
<div class="admonition warning">
<p class="admonition-title">Avertissement</p>
<p>L’option ne décide que du backend des <strong>nouveaux</strong> subnets. Elle ne migre rien : un subnet
déjà créé continue d’être servi par le serveur qui l’a été. Changer la valeur sans vider
l’hyperviseur laisse l’agent parler à un serveur qui ne tourne pas — les VM existantes
continuent, les nouvelles n’obtiennent pas d’adresse.</p>
</div>
<p>La bascule est <strong>manuelle</strong> et suppose un hyperviseur vide :</p>
<ol class="arabic">
<li><p>Supprimer toutes les VM, puis tous les subnets, puis les VPC.</p></li>
<li><p>Vérifier qu’il ne reste aucune unit DHCP active et aucun résidu :</p>
<div class="highlight-bash notranslate"><div class="highlight"><pre><span></span>systemctl<span class="w"> </span>list-units<span class="w"> </span><span class="s1">'dnsmasq@*'</span><span class="w"> </span><span class="s1">'dhcp@*'</span>
ls<span class="w"> </span>/etc/dnsmasq.d/<span class="w"> </span>/run/two/dhcp/
</pre></div>
</div>
</li>
<li><p>Modifier <code class="docutils literal notranslate"><span class="pre">dhcp.backend</span></code> dans <code class="docutils literal notranslate"><span class="pre">/etc/two/agent.yml</span></code>.</p></li>
<li><p><code class="docutils literal notranslate"><span class="pre">systemctl</span> <span class="pre">restart</span> <span class="pre">agent</span></code> — la valeur est lue au démarrage, pas à chaque commande.</p></li>
<li><p>Recréer VPC, subnets et VM.</p></li>
<li><p>Sur la première VM, vérifier l’adresse <strong>et les trois routes</strong> : la route par défaut, la
route vers le CIDR du VPC, et la route <code class="docutils literal notranslate"><span class="pre">/32</span></code> vers <code class="docutils literal notranslate"><span class="pre">169.254.169.254</span></code>. C’est cette
dernière qui conditionne le provisionnement cloud-init.</p></li>
</ol>
<p>Le retour arrière suit la même procédure. Il n’y a pas de bascule à chaud, dans un sens ni dans
l’autre.</p>
</section>
</section>
<section id="watchdog">
<h2>Watchdog<a class="headerlink" href="#watchdog" title="Lien vers cette rubrique">#</a></h2>
<div class="highlight-yaml notranslate"><div class="highlight"><pre><span></span><span class="nt">watchdog</span><span class="p">:</span>
<span class="w"> </span><span class="nt">enabled</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">true</span>
<span class="w"> </span><span class="nt">interval_seconds</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">60</span>
</pre></div>
</div>
<p>Vérification périodique <strong>en lecture seule</strong> — voir <a class="reference internal" href="observabilite.html"><span class="doc">Observabilité</span></a>.</p>
</section>
<section id="journalisation">
<h2>Journalisation<a class="headerlink" href="#journalisation" title="Lien vers cette rubrique">#</a></h2>
<div class="highlight-yaml notranslate"><div class="highlight"><pre><span></span><span class="nt">logger</span><span class="p">:</span>
<span class="w"> </span><span class="nt">level</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">info</span><span class="w"> </span><span class="c1"># debug, info, warn, error</span>
<span class="w"> </span><span class="nt">debug</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">false</span><span class="w"> </span><span class="c1"># force le niveau debug quel que soit level</span>
</pre></div>
</div>
</section>
</section>
</article>
<footer class="prev-next-footer d-print-none">
<div class="prev-next-area">
<a class="left-prev"
href="index.html"
title="page précédente">
<i class="fa-solid fa-angle-left"></i>
<div class="prev-next-info">
<p class="prev-next-subtitle">précédent</p>
<p class="prev-next-title">Exploitation</p>
</div>
</a>
<a class="right-next"
href="services.html"
title="page suivante">
<div class="prev-next-info">
<p class="prev-next-subtitle">suivant</p>
<p class="prev-next-title">Services systemd</p>
</div>
<i class="fa-solid fa-angle-right"></i>
</a>
</div>
</footer>
</div>
<dialog id="pst-secondary-sidebar-modal"></dialog>
<div id="pst-secondary-sidebar" class="bd-sidebar-secondary bd-toc"><div class="sidebar-secondary-items sidebar-secondary__inner">
<div class="sidebar-secondary-item"><div
id="pst-page-navigation-heading-2"
class="page-toc tocsection onthispage">
<i class="fa-solid fa-list"></i> Contenu
</div>
<nav id="pst-page-toc-nav" class="page-toc" aria-labelledby="pst-page-navigation-heading-2">
<ul class="visible nav section-nav flex-column">
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#base-de-donnees">Base de données</a></li>
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#serveurs">Serveurs</a></li>
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#execution-des-commandes">Exécution des commandes</a></li>
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#correspondance-des-interfaces">Correspondance des interfaces</a></li>
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#metadata-et-qemu">Metadata et QEMU</a></li>
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#backend-dhcp">Backend DHCP</a><ul class="nav section-nav flex-column">
<li class="toc-h3 nav-item toc-entry"><a class="reference internal nav-link" href="#bascule-d-un-backend-a-l-autre">Bascule d’un backend à l’autre</a></li>
</ul>
</li>
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#watchdog">Watchdog</a></li>
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#journalisation">Journalisation</a></li>
</ul>
</nav></div>
</div></div>
</div>
<footer class="bd-footer-content">
<div class="bd-footer-content__inner container">
<div class="footer-item">
<p class="component-author">
Par Nicolas Boufidjeline
</p>
</div>
<div class="footer-item">
<p class="copyright">
© Copyright 2026, Nicolas Boufidjeline.
<br/>
</p>
</div>
<div class="footer-item">
</div>
<div class="footer-item">
</div>
</div>
</footer>
</main>
</div>
</div>
<!-- Scripts loaded after <body> so the DOM is not blocked -->
<script defer src="../_static/scripts/bootstrap.js?digest=8878045cc6db502f8baf"></script>
<script defer src="../_static/scripts/pydata-sphinx-theme.js?digest=8878045cc6db502f8baf"></script>
<footer class="bd-footer">
</footer>
</body>
</html>