Oracle-virtualization farm (OLVM) on 4 servers — Terraform + Ansible

Deploys and manages an Oracle Linux Virtualization Manager (OLVM, KVM/oVirt-based) cluster across a fixed farm of 4 physical servers, and provisions virtual machines on it as code.

Full spec/plan/tasks: specs/001-oracle-virtualization-farm/.

Architecture at a glance

Concern	Owned by	Why
OS prep, Self-Hosted Engine	ansible/playbooks/prepare-hosts.yml, deploy-hosted-engine.yml	Terraform can't bootstrap bare metal or run the interactive hosted-engine --deploy
Datacenter, Cluster, 4 Hosts, Storage domain, Network	ansible/playbooks/provision-cluster.yml (ovirt.ovirt collection)	The real ovirt/ovirt Terraform provider has no resources for these — verified empirically, see specs/.../research.md §8
Per-VM HA flag	ansible/playbooks/set-vm-ha.yml	The provider's ovirt_vm resource has no HA attribute
Safe host removal	ansible/playbooks/decommission-host.yml	Refuses to remove a host with running VMs — the equivalent Terraform-side safeguard was lost when the olvm-hosts module was deleted (research.md §8); re-implemented here
VMs, disks, NICs	terraform/modules/olvm-vm + terraform/environments/farm	This is exactly what the ovirt/ovirt provider is built for
Change audit trail	.github/workflows/terraform-apply.yml (Terraform layer) + ansible/ansible.cfg log_path (Ansible layer)	FR-008/SC-003 — every real apply is tied to a commit SHA with archived plan/apply output; every Ansible run is logged
Drift detection	.github/workflows/terraform-drift-detect.yml	Daily terraform plan -detailed-exitcode, fails the job if the live farm no longer matches this repo (SC-003, spec.md Edge Case)

Run order: ansible/ (Stages A, in the order listed in ansible/README.md) → terraform/ (terraform/README.md). Full walkthrough with expected outcomes: specs/001-oracle-virtualization-farm/quickstart.md.

Security

• Credentials: Engine admin password, HE appliance password, and any SSH keys are supplied via ansible-vault (ansible/inventory/vault.yml, never committed) or CI secrets — never hardcoded in playbooks/.tfvars.
• Terraform state: uses a remote backend with locking (terraform/environments/farm/backend.tf); state can contain sensitive attribute values, so the backend (S3 bucket / Terraform Cloud workspace) MUST be access-restricted and encrypted at rest.
• TLS: ovirt_insecure_tls / olvm_insecure_tls default to false; only set true in throwaway test environments, never against the real farm.
• .gitignore / .terraformignore: exclude *.tfvars (except *.tfvars.example), *.tfstate*, and vault files by default — double check git status before committing if you ever touch these patterns.
• Static analysis (tests/contract/checkov.yaml) hard-fails CI on CRITICAL/HIGH findings; MEDIUM/LOW are soft-fail (tracked, not blocking).

Known limitations / deferred items

All findings from the two /speckit-analyze passes over spec/plan/tasks (specs/001-oracle-virtualization-farm/) have been addressed. None currently open.

provision-cluster.yml supports all three storage domain types named in FR-007 — NFS (default), iSCSI, and Fibre Channel (olvm_storage_type: fc, olvm_storage_fc_lun_ids) — since FC HBA/SAN hardware is confirmed present on the 4 farm servers.