chore: Update harmony-inventory-agent binary as some fixes were introduced : port is 25000 now and nbd devices wont make the inventory crash

Reviewed-on: #185
Reviewed-by: johnride <jg@nationtech.io>

Cargo.lock

@@ -690,6 +690,23 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "brocade-switch"
+version = "0.1.0"
+dependencies = [
+ "async-trait",
+ "brocade",
+ "env_logger",
+ "harmony",
+ "harmony_cli",
+ "harmony_macros",
+ "harmony_types",
+ "log",
+ "serde",
+ "tokio",
+ "url",
+]
+
 [[package]]
 name = "brotli"
 version = "8.0.2"
@@ -2479,6 +2496,19 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "harmony_inventory_builder"
+version = "0.1.0"
+dependencies = [
+ "cidr",
+ "harmony",
+ "harmony_cli",
+ "harmony_macros",
+ "harmony_types",
+ "tokio",
+ "url",
+]
+
 [[package]]
 name = "harmony_macros"
 version = "0.1.0"
@@ -2544,6 +2574,7 @@ dependencies = [
 name = "harmony_types"
 version = "0.1.0"
 dependencies = [
+ "log",
  "rand 0.9.2",
  "serde",
  "url",

brocade/examples/main.rs

@@ -1,6 +1,6 @@
 use std::net::{IpAddr, Ipv4Addr};
 
-use brocade::BrocadeOptions;
+use brocade::{BrocadeOptions, ssh};
 use harmony_secret::{Secret, SecretManager};
 use harmony_types::switch::PortLocation;
 use serde::{Deserialize, Serialize};
@@ -16,23 +16,28 @@ async fn main() {
     env_logger::Builder::from_env(env_logger::Env::default().default_filter_or("info")).init();
 
     // let ip = IpAddr::V4(Ipv4Addr::new(10, 0, 0, 250)); // old brocade @ ianlet
-    let ip = IpAddr::V4(Ipv4Addr::new(192, 168, 55, 101)); // brocade @ sto1
+    let ip = IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1)); // brocade @ sto1
     // let ip = IpAddr::V4(Ipv4Addr::new(192, 168, 4, 11)); // brocade @ st
     let switch_addresses = vec![ip];
 
-    let config = SecretManager::get_or_prompt::<BrocadeSwitchAuth>()
-        .await
-        .unwrap();
+    // let config = SecretManager::get_or_prompt::<BrocadeSwitchAuth>()
+    //     .await
+    //     .unwrap();
 
     let brocade = brocade::init(
         &switch_addresses,
-        22,
-        &config.username,
-        &config.password,
-        Some(BrocadeOptions {
+        // &config.username,
+        // &config.password,
+        "admin",
+        "password",
+        BrocadeOptions {
             dry_run: true,
+            ssh: ssh::SshOptions {
+                port: 2222,
+                ..Default::default()
+            },
             ..Default::default()
-        }),
+        },
     )
     .await
     .expect("Brocade client failed to connect");
@@ -54,6 +59,7 @@ async fn main() {
     }
 
     println!("--------------");
+    todo!();
     let channel_name = "1";
     brocade.clear_port_channel(channel_name).await.unwrap();
 

brocade/src/fast_iron.rs

@@ -140,7 +140,7 @@ impl BrocadeClient for FastIronClient {
 
     async fn configure_interfaces(
         &self,
-        _interfaces: Vec<(String, PortOperatingMode)>,
+        _interfaces: &Vec<(String, PortOperatingMode)>,
     ) -> Result<(), Error> {
         todo!()
     }

brocade/src/lib.rs

@@ -14,11 +14,12 @@ use async_trait::async_trait;
 use harmony_types::net::MacAddress;
 use harmony_types::switch::{PortDeclaration, PortLocation};
 use regex::Regex;
+use serde::Serialize;
 
 mod fast_iron;
 mod network_operating_system;
 mod shell;
-mod ssh;
+pub mod ssh;
 
 #[derive(Default, Clone, Debug)]
 pub struct BrocadeOptions {
@@ -118,7 +119,7 @@ impl fmt::Display for InterfaceType {
 }
 
 /// Defines the primary configuration mode of a switch interface, representing mutually exclusive roles.
-#[derive(Debug, PartialEq, Eq, Clone)]
+#[derive(Debug, PartialEq, Eq, Clone, Serialize)]
 pub enum PortOperatingMode {
     /// The interface is explicitly configured for Brocade fabric roles (ISL or Trunk enabled).
     Fabric,
@@ -141,12 +142,11 @@ pub enum InterfaceStatus {
 
 pub async fn init(
     ip_addresses: &[IpAddr],
-    port: u16,
     username: &str,
     password: &str,
-    options: Option<BrocadeOptions>,
+    options: BrocadeOptions,
 ) -> Result<Box<dyn BrocadeClient + Send + Sync>, Error> {
-    let shell = BrocadeShell::init(ip_addresses, port, username, password, options).await?;
+    let shell = BrocadeShell::init(ip_addresses, username, password, options).await?;
 
     let version_info = shell
         .with_session(ExecutionMode::Regular, |session| {
@@ -208,7 +208,7 @@ pub trait BrocadeClient: std::fmt::Debug {
     /// Configures a set of interfaces to be operated with a specified mode (access ports, ISL, etc.).
     async fn configure_interfaces(
         &self,
-        interfaces: Vec<(String, PortOperatingMode)>,
+        interfaces: &Vec<(String, PortOperatingMode)>,
     ) -> Result<(), Error>;
 
     /// Scans the existing configuration to find the next available (unused)

brocade/src/network_operating_system.rs

@@ -187,7 +187,7 @@ impl BrocadeClient for NetworkOperatingSystemClient {
 
     async fn configure_interfaces(
         &self,
-        interfaces: Vec<(String, PortOperatingMode)>,
+        interfaces: &Vec<(String, PortOperatingMode)>,
     ) -> Result<(), Error> {
         info!("[Brocade] Configuring {} interface(s)...", interfaces.len());
 
@@ -204,9 +204,12 @@ impl BrocadeClient for NetworkOperatingSystemClient {
                 PortOperatingMode::Trunk => {
                     commands.push("switchport".into());
                     commands.push("switchport mode trunk".into());
-                    commands.push("no spanning-tree shutdown".into());
+                    commands.push("switchport trunk allowed vlan all".into());
+                    commands.push("no switchport trunk tag native-vlan".into());
+                    commands.push("spanning-tree shutdown".into());
                     commands.push("no fabric isl enable".into());
                     commands.push("no fabric trunk enable".into());
+                    commands.push("no shutdown".into());
                 }
                 PortOperatingMode::Access => {
                     commands.push("switchport".into());

brocade/src/shell.rs

@@ -16,7 +16,6 @@ use tokio::time::timeout;
 #[derive(Debug)]
 pub struct BrocadeShell {
     ip: IpAddr,
-    port: u16,
     username: String,
     password: String,
     options: BrocadeOptions,
@@ -27,33 +26,31 @@ pub struct BrocadeShell {
 impl BrocadeShell {
     pub async fn init(
         ip_addresses: &[IpAddr],
-        port: u16,
         username: &str,
         password: &str,
-        options: Option<BrocadeOptions>,
+        options: BrocadeOptions,
     ) -> Result<Self, Error> {
         let ip = ip_addresses
             .first()
             .ok_or_else(|| Error::ConfigurationError("No IP addresses provided".to_string()))?;
 
-        let base_options = options.unwrap_or_default();
-        let options = ssh::try_init_client(username, password, ip, base_options).await?;
+        let brocade_ssh_client_options =
+            ssh::try_init_client(username, password, ip, options).await?;
 
         Ok(Self {
             ip: *ip,
-            port,
             username: username.to_string(),
             password: password.to_string(),
             before_all_commands: vec![],
             after_all_commands: vec![],
-            options,
+            options: brocade_ssh_client_options,
         })
     }
 
     pub async fn open_session(&self, mode: ExecutionMode) -> Result<BrocadeSession, Error> {
         BrocadeSession::open(
             self.ip,
-            self.port,
+            self.options.ssh.port,
             &self.username,
             &self.password,
             self.options.clone(),

brocade/src/ssh.rs

@@ -2,6 +2,7 @@ use std::borrow::Cow;
 use std::sync::Arc;
 
 use async_trait::async_trait;
+use log::debug;
 use russh::client::Handler;
 use russh::kex::DH_G1_SHA1;
 use russh::kex::ECDH_SHA2_NISTP256;
@@ -10,29 +11,43 @@ use russh_keys::key::SSH_RSA;
 use super::BrocadeOptions;
 use super::Error;
 
-#[derive(Default, Clone, Debug)]
+#[derive(Clone, Debug)]
 pub struct SshOptions {
     pub preferred_algorithms: russh::Preferred,
+    pub port: u16,
+}
+
+impl Default for SshOptions {
+    fn default() -> Self {
+        Self {
+            preferred_algorithms: Default::default(),
+            port: 22,
+        }
+    }
 }
 
 impl SshOptions {
-    fn ecdhsa_sha2_nistp256() -> Self {
+    fn ecdhsa_sha2_nistp256(port: u16) -> Self {
         Self {
             preferred_algorithms: russh::Preferred {
                 kex: Cow::Borrowed(&[ECDH_SHA2_NISTP256]),
                 key: Cow::Borrowed(&[SSH_RSA]),
                 ..Default::default()
             },
+            port,
+            ..Default::default()
         }
     }
 
-    fn legacy() -> Self {
+    fn legacy(port: u16) -> Self {
         Self {
             preferred_algorithms: russh::Preferred {
                 kex: Cow::Borrowed(&[DH_G1_SHA1]),
                 key: Cow::Borrowed(&[SSH_RSA]),
                 ..Default::default()
             },
+            port,
+            ..Default::default()
         }
     }
 }
@@ -57,18 +72,21 @@ pub async fn try_init_client(
     ip: &std::net::IpAddr,
     base_options: BrocadeOptions,
 ) -> Result<BrocadeOptions, Error> {
+    let mut default = SshOptions::default();
+    default.port = base_options.ssh.port;
     let ssh_options = vec![
-        SshOptions::default(),
-        SshOptions::ecdhsa_sha2_nistp256(),
-        SshOptions::legacy(),
+        default,
+        SshOptions::ecdhsa_sha2_nistp256(base_options.ssh.port),
+        SshOptions::legacy(base_options.ssh.port),
     ];
 
     for ssh in ssh_options {
         let opts = BrocadeOptions {
-            ssh,
+            ssh: ssh.clone(),
             ..base_options.clone()
         };
-        let client = create_client(*ip, 22, username, password, &opts).await;
+        debug!("Creating client {ip}:{} {username}", ssh.port);
+        let client = create_client(*ip, ssh.port, username, password, &opts).await;
 
         match client {
             Ok(_) => {

examples/brocade_switch/Cargo.toml

@@ -1,5 +1,5 @@
 [package]
-name = "example-opnsense-node-exporter"
+name = "brocade-switch"
 edition = "2024"
 version.workspace = true
 readme.workspace = true
@@ -8,14 +8,12 @@ license.workspace = true
 [dependencies]
 harmony = { path = "../../harmony" }
 harmony_cli = { path = "../../harmony_cli" }
-harmony_types = { path = "../../harmony_types" }
-harmony_secret = { path = "../../harmony_secret" }
-harmony_secret_derive = { path = "../../harmony_secret_derive" }
-cidr = { workspace = true }
-tokio = { workspace = true }
 harmony_macros = { path = "../../harmony_macros" }
-log = { workspace = true }
-env_logger = { workspace = true }
-url = { workspace = true }
-serde.workspace = true
+harmony_types = { path = "../../harmony_types" }
+tokio.workspace = true
+url.workspace = true
 async-trait.workspace = true
+serde.workspace = true
+log.workspace = true
+env_logger.workspace = true
+brocade = { path = "../../brocade" }

examples/brocade_switch/src/main.rs

@@ -0,0 +1,157 @@
+use std::str::FromStr;
+
+use async_trait::async_trait;
+use brocade::{BrocadeOptions, PortOperatingMode};
+use harmony::{
+    data::Version,
+    infra::brocade::BrocadeSwitchClient,
+    interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome},
+    inventory::Inventory,
+    score::Score,
+    topology::{
+        HostNetworkConfig, PortConfig, PreparationError, PreparationOutcome, Switch, SwitchClient,
+        SwitchError, Topology,
+    },
+};
+use harmony_macros::ip;
+use harmony_types::{id::Id, net::MacAddress, switch::PortLocation};
+use log::{debug, info};
+use serde::Serialize;
+
+#[tokio::main]
+async fn main() {
+    let switch_score = BrocadeSwitchScore {
+        port_channels_to_clear: vec![
+            Id::from_str("17").unwrap(),
+            Id::from_str("19").unwrap(),
+            Id::from_str("18").unwrap(),
+        ],
+        ports_to_configure: vec![
+            (PortLocation(2, 0, 17), PortOperatingMode::Trunk),
+            (PortLocation(2, 0, 19), PortOperatingMode::Trunk),
+            (PortLocation(1, 0, 18), PortOperatingMode::Trunk),
+        ],
+    };
+    harmony_cli::run(
+        Inventory::autoload(),
+        SwitchTopology::new().await,
+        vec![Box::new(switch_score)],
+        None,
+    )
+    .await
+    .unwrap();
+}
+
+#[derive(Clone, Debug, Serialize)]
+struct BrocadeSwitchScore {
+    port_channels_to_clear: Vec<Id>,
+    ports_to_configure: Vec<PortConfig>,
+}
+
+impl<T: Topology + Switch> Score<T> for BrocadeSwitchScore {
+    fn name(&self) -> String {
+        "BrocadeSwitchScore".to_string()
+    }
+
+    #[doc(hidden)]
+    fn create_interpret(&self) -> Box<dyn Interpret<T>> {
+        Box::new(BrocadeSwitchInterpret {
+            score: self.clone(),
+        })
+    }
+}
+
+#[derive(Debug)]
+struct BrocadeSwitchInterpret {
+    score: BrocadeSwitchScore,
+}
+
+#[async_trait]
+impl<T: Topology + Switch> Interpret<T> for BrocadeSwitchInterpret {
+    async fn execute(
+        &self,
+        _inventory: &Inventory,
+        topology: &T,
+    ) -> Result<Outcome, InterpretError> {
+        info!("Applying switch configuration {:?}", self.score);
+        debug!(
+            "Clearing port channel {:?}",
+            self.score.port_channels_to_clear
+        );
+        topology
+            .clear_port_channel(&self.score.port_channels_to_clear)
+            .await
+            .map_err(|e| InterpretError::new(e.to_string()))?;
+        debug!("Configuring interfaces {:?}", self.score.ports_to_configure);
+        topology
+            .configure_interface(&self.score.ports_to_configure)
+            .await
+            .map_err(|e| InterpretError::new(e.to_string()))?;
+        Ok(Outcome::success("switch configured".to_string()))
+    }
+    fn get_name(&self) -> InterpretName {
+        InterpretName::Custom("BrocadeSwitchInterpret")
+    }
+    fn get_version(&self) -> Version {
+        todo!()
+    }
+    fn get_status(&self) -> InterpretStatus {
+        todo!()
+    }
+    fn get_children(&self) -> Vec<Id> {
+        todo!()
+    }
+}
+
+struct SwitchTopology {
+    client: Box<dyn SwitchClient>,
+}
+
+#[async_trait]
+impl Topology for SwitchTopology {
+    fn name(&self) -> &str {
+        "SwitchTopology"
+    }
+
+    async fn ensure_ready(&self) -> Result<PreparationOutcome, PreparationError> {
+        Ok(PreparationOutcome::Noop)
+    }
+}
+
+impl SwitchTopology {
+    async fn new() -> Self {
+        let mut options = BrocadeOptions::default();
+        options.ssh.port = 2222;
+        let client =
+            BrocadeSwitchClient::init(&vec![ip!("127.0.0.1")], &"admin", &"password", options)
+                .await
+                .expect("Failed to connect to switch");
+
+        let client = Box::new(client);
+        Self { client }
+    }
+}
+
+#[async_trait]
+impl Switch for SwitchTopology {
+    async fn setup_switch(&self) -> Result<(), SwitchError> {
+        todo!()
+    }
+
+    async fn get_port_for_mac_address(
+        &self,
+        _mac_address: &MacAddress,
+    ) -> Result<Option<PortLocation>, SwitchError> {
+        todo!()
+    }
+
+    async fn configure_port_channel(&self, _config: &HostNetworkConfig) -> Result<(), SwitchError> {
+        todo!()
+    }
+    async fn clear_port_channel(&self, ids: &Vec<Id>) -> Result<(), SwitchError> {
+        self.client.clear_port_channel(ids).await
+    }
+    async fn configure_interface(&self, ports: &Vec<PortConfig>) -> Result<(), SwitchError> {
+        self.client.configure_interface(ports).await
+    }
+}

examples/cli/src/main.rs

@@ -2,7 +2,7 @@ use harmony::{
     inventory::Inventory,
     modules::{
         dummy::{ErrorScore, PanicScore, SuccessScore},
-        inventory::LaunchDiscoverInventoryAgentScore,
+        inventory::{HarmonyDiscoveryStrategy, LaunchDiscoverInventoryAgentScore},
     },
     topology::LocalhostTopology,
 };
@@ -18,6 +18,7 @@ async fn main() {
             Box::new(PanicScore {}),
             Box::new(LaunchDiscoverInventoryAgentScore {
                 discovery_timeout: Some(10),
+                discovery_strategy: HarmonyDiscoveryStrategy::MDNS,
             }),
         ],
         None,

examples/harmony_inventory_builder/Cargo.toml

@@ -0,0 +1,15 @@
+[package]
+name = "harmony_inventory_builder"
+edition = "2024"
+version.workspace = true
+readme.workspace = true
+license.workspace = true
+
+[dependencies]
+harmony = { path = "../../harmony" }
+harmony_cli = { path = "../../harmony_cli" }
+harmony_macros = { path = "../../harmony_macros" }
+harmony_types = { path = "../../harmony_types" }
+tokio.workspace = true
+url.workspace = true
+cidr.workspace = true

examples/harmony_inventory_builder/build_docker.sh

@@ -0,0 +1,11 @@
+cargo build -p harmony_inventory_builder --release --target x86_64-unknown-linux-musl
+
+SCRIPT_DIR="$(dirname ${0})"
+
+cd "${SCRIPT_DIR}/docker/"
+
+cp ../../../target/x86_64-unknown-linux-musl/release/harmony_inventory_builder .
+
+docker build . -t hub.nationtech.io/harmony/harmony_inventory_builder
+
+docker push hub.nationtech.io/harmony/harmony_inventory_builder

examples/harmony_inventory_builder/docker/Dockerfile

@@ -0,0 +1,10 @@
+FROM debian:12-slim
+
+RUN mkdir  /app
+WORKDIR /app/
+
+COPY harmony_inventory_builder /app/
+
+ENV RUST_LOG=info
+
+CMD ["sleep", "infinity"]

examples/harmony_inventory_builder/src/main.rs

@@ -0,0 +1,36 @@
+use harmony::{
+    inventory::{HostRole, Inventory},
+    modules::inventory::{DiscoverHostForRoleScore, HarmonyDiscoveryStrategy},
+    topology::LocalhostTopology,
+};
+use harmony_macros::cidrv4;
+
+#[tokio::main]
+async fn main() {
+    let discover_worker = DiscoverHostForRoleScore {
+        role: HostRole::Worker,
+        number_desired_hosts: 3,
+        discovery_strategy: HarmonyDiscoveryStrategy::SUBNET {
+            cidr: cidrv4!("192.168.0.1/25"),
+            port: 25000,
+        },
+    };
+
+    let discover_control_plane = DiscoverHostForRoleScore {
+        role: HostRole::ControlPlane,
+        number_desired_hosts: 3,
+        discovery_strategy: HarmonyDiscoveryStrategy::SUBNET {
+            cidr: cidrv4!("192.168.0.1/25"),
+            port: 25000,
+        },
+    };
+
+    harmony_cli::run(
+        Inventory::autoload(),
+        LocalhostTopology::new(),
+        vec![Box::new(discover_worker), Box::new(discover_control_plane)],
+        None,
+    )
+    .await
+    .unwrap();
+}

examples/nanodc/src/main.rs

@@ -1,6 +1,6 @@
 use std::{
     net::{IpAddr, Ipv4Addr},
-    sync::Arc,
+    sync::{Arc, OnceLock},
 };
 
 use brocade::BrocadeOptions;
@@ -39,10 +39,10 @@ async fn main() {
         .expect("Failed to get credentials");
 
     let switches: Vec<IpAddr> = vec![ip!("192.168.33.101")];
-    let brocade_options = Some(BrocadeOptions {
+    let brocade_options = BrocadeOptions {
         dry_run: *harmony::config::DRY_RUN,
         ..Default::default()
-    });
+    };
     let switch_client = BrocadeSwitchClient::init(
         &switches,
         &switch_auth.username,
@@ -106,8 +106,8 @@ async fn main() {
                 name: "wk2".to_string(),
             },
         ],
-        node_exporter: opnsense.clone(),
         switch_client: switch_client.clone(),
+        network_manager: OnceLock::new(),
     };
 
     let inventory = Inventory {

examples/okd_installation/src/topology.rs

@@ -9,7 +9,10 @@ use harmony::{
 use harmony_macros::{ip, ipv4};
 use harmony_secret::{Secret, SecretManager};
 use serde::{Deserialize, Serialize};
-use std::{net::IpAddr, sync::Arc};
+use std::{
+    net::IpAddr,
+    sync::{Arc, OnceLock},
+};
 
 #[derive(Secret, Serialize, Deserialize, Debug, PartialEq)]
 struct OPNSenseFirewallConfig {
@@ -28,10 +31,10 @@ pub async fn get_topology() -> HAClusterTopology {
         .expect("Failed to get credentials");
 
     let switches: Vec<IpAddr> = vec![ip!("192.168.1.101")]; // TODO: Adjust me
-    let brocade_options = Some(BrocadeOptions {
+    let brocade_options = BrocadeOptions {
         dry_run: *harmony::config::DRY_RUN,
         ..Default::default()
-    });
+    };
     let switch_client = BrocadeSwitchClient::init(
         &switches,
         &switch_auth.username,
@@ -80,8 +83,8 @@ pub async fn get_topology() -> HAClusterTopology {
             name: "bootstrap".to_string(),
         },
         workers: vec![],
-        node_exporter: opnsense.clone(),
         switch_client: switch_client.clone(),
+        network_manager: OnceLock::new(),
     }
 }
 

examples/okd_pxe/src/topology.rs

@@ -10,7 +10,10 @@ use harmony::{
 use harmony_macros::{ip, ipv4};
 use harmony_secret::{Secret, SecretManager};
 use serde::{Deserialize, Serialize};
-use std::{net::IpAddr, sync::Arc};
+use std::{
+    net::IpAddr,
+    sync::{Arc, OnceLock},
+};
 
 pub async fn get_topology() -> HAClusterTopology {
     let firewall = harmony::topology::LogicalHost {
@@ -23,10 +26,10 @@ pub async fn get_topology() -> HAClusterTopology {
         .expect("Failed to get credentials");
 
     let switches: Vec<IpAddr> = vec![ip!("192.168.1.101")]; // TODO: Adjust me
-    let brocade_options = Some(BrocadeOptions {
+    let brocade_options = BrocadeOptions {
         dry_run: *harmony::config::DRY_RUN,
         ..Default::default()
-    });
+    };
     let switch_client = BrocadeSwitchClient::init(
         &switches,
         &switch_auth.username,
@@ -75,8 +78,8 @@ pub async fn get_topology() -> HAClusterTopology {
             name: "cp0".to_string(),
         },
         workers: vec![],
-        node_exporter: opnsense.clone(),
         switch_client: switch_client.clone(),
+        network_manager: OnceLock::new(),
     }
 }
 

examples/opnsense/src/main.rs

@@ -1,6 +1,6 @@
 use std::{
     net::{IpAddr, Ipv4Addr},
-    sync::Arc,
+    sync::{Arc, OnceLock},
 };
 
 use brocade::BrocadeOptions;
@@ -35,10 +35,10 @@ async fn main() {
         .expect("Failed to get credentials");
 
     let switches: Vec<IpAddr> = vec![ip!("192.168.5.101")]; // TODO: Adjust me
-    let brocade_options = Some(BrocadeOptions {
+    let brocade_options = BrocadeOptions {
         dry_run: *harmony::config::DRY_RUN,
         ..Default::default()
-    });
+    };
     let switch_client = BrocadeSwitchClient::init(
         &switches,
         &switch_auth.username,
@@ -78,8 +78,8 @@ async fn main() {
             name: "cp0".to_string(),
         },
         workers: vec![],
-        node_exporter: opnsense.clone(),
         switch_client: switch_client.clone(),
+        network_manager: OnceLock::new(),
     };
 
     let inventory = Inventory {

examples/opnsense_node_exporter/src/main.rs

@@ -1,79 +0,0 @@
-use std::{
-    net::{IpAddr, Ipv4Addr},
-    sync::Arc,
-};
-
-use async_trait::async_trait;
-use cidr::Ipv4Cidr;
-use harmony::{
-    executors::ExecutorError,
-    hardware::{HostCategory, Location, PhysicalHost, SwitchGroup},
-    infra::opnsense::OPNSenseManagementInterface,
-    inventory::Inventory,
-    modules::opnsense::node_exporter::NodeExporterScore,
-    topology::{
-        HAClusterTopology, LogicalHost, PreparationError, PreparationOutcome, Topology,
-        UnmanagedRouter, node_exporter::NodeExporter,
-    },
-};
-use harmony_macros::{ip, ipv4, mac_address};
-
-struct OpnSenseTopology {
-    node_exporter: Arc<dyn NodeExporter>,
-}
-
-#[async_trait]
-impl Topology for OpnSenseTopology {
-    async fn ensure_ready(&self) -> Result<PreparationOutcome, PreparationError> {
-        Ok(PreparationOutcome::Success {
-            details: "Success".to_string(),
-        })
-    }
-    fn name(&self) -> &str {
-        "OpnsenseTopology"
-    }
-}
-
-#[async_trait]
-impl NodeExporter for OpnSenseTopology {
-    async fn ensure_initialized(&self) -> Result<(), ExecutorError> {
-        self.node_exporter.ensure_initialized().await
-    }
-
-    async fn commit_config(&self) -> Result<(), ExecutorError> {
-        self.node_exporter.commit_config().await
-    }
-
-    async fn reload_restart(&self) -> Result<(), ExecutorError> {
-        self.node_exporter.reload_restart().await
-    }
-}
-
-#[tokio::main]
-async fn main() {
-    let firewall = harmony::topology::LogicalHost {
-        ip: ip!("192.168.1.1"),
-        name: String::from("fw0"),
-    };
-
-    let opnsense = Arc::new(
-        harmony::infra::opnsense::OPNSenseFirewall::new(firewall, None, "root", "opnsense").await,
-    );
-
-    let topology = OpnSenseTopology {
-        node_exporter: opnsense.clone(),
-    };
-
-    let inventory = Inventory::empty();
-
-    let node_exporter_score = NodeExporterScore {};
-
-    harmony_cli::run(
-        inventory,
-        topology,
-        vec![Box::new(node_exporter_score)],
-        None,
-    )
-    .await
-    .unwrap();
-}

harmony/src/domain/hardware/mod.rs

@@ -152,10 +152,10 @@ impl PhysicalHost {
     pub fn parts_list(&self) -> String {
         let PhysicalHost {
             id,
-            category,
+            category: _,
             network,
             storage,
-            labels,
+            labels: _,
             memory_modules,
             cpus,
         } = self;
@@ -226,8 +226,8 @@ impl PhysicalHost {
                 speed_mhz,
                 manufacturer,
                 part_number,
-                serial_number,
-                rank,
+                serial_number: _,
+                rank: _,
             } = mem;
             parts_list.push_str(&format!(
                 "\n{}Gb, {}Mhz, Manufacturer ({}), Part Number ({})",

harmony/src/domain/interpret/mod.rs

@@ -4,6 +4,8 @@ use std::error::Error;
 use async_trait::async_trait;
 use derive_new::new;
 
+use crate::inventory::HostRole;
+
 use super::{
     data::Version, executors::ExecutorError, inventory::Inventory, topology::PreparationError,
 };

harmony/src/domain/topology/ha_cluster.rs

@@ -1,32 +1,26 @@
 use async_trait::async_trait;
+use brocade::PortOperatingMode;
 use harmony_macros::ip;
 use harmony_types::{
+    id::Id,
     net::{MacAddress, Url},
     switch::PortLocation,
 };
-use kube::api::ObjectMeta;
 use log::debug;
 use log::info;
 
+use crate::{infra::network_manager::OpenShiftNmStateNetworkManager, topology::PortConfig};
 use crate::topology::PxeOptions;
-use crate::{data::FileContent, modules::okd::crd::nmstate::NMState};
-use crate::{
-    executors::ExecutorError, modules::okd::crd::nmstate::NodeNetworkConfigurationPolicySpec,
-};
-use crate::{
-    modules::okd::crd::nmstate::{self, NodeNetworkConfigurationPolicy},
-    topology::node_exporter::NodeExporter,
-};
+use crate::{data::FileContent, executors::ExecutorError};
 
 use super::{
     DHCPStaticEntry, DhcpServer, DnsRecord, DnsRecordType, DnsServer, Firewall, HostNetworkConfig,
-    HttpServer, IpAddress, K8sclient, LoadBalancer, LoadBalancerService, LogicalHost,
-    PreparationError, PreparationOutcome, Router, Switch, SwitchClient, SwitchError, TftpServer,
-    Topology, k8s::K8sClient,
+    HttpServer, IpAddress, K8sclient, LoadBalancer, LoadBalancerService, LogicalHost, NetworkError,
+    NetworkManager, PreparationError, PreparationOutcome, Router, Switch, SwitchClient,
+    SwitchError, TftpServer, Topology, k8s::K8sClient,
 };
 
-use std::collections::BTreeMap;
-use std::sync::Arc;
+use std::sync::{Arc, OnceLock};
 
 #[derive(Debug, Clone)]
 pub struct HAClusterTopology {
@@ -38,12 +32,12 @@ pub struct HAClusterTopology {
     pub tftp_server: Arc<dyn TftpServer>,
     pub http_server: Arc<dyn HttpServer>,
     pub dns_server: Arc<dyn DnsServer>,
-    pub node_exporter: Arc<dyn NodeExporter>,
     pub switch_client: Arc<dyn SwitchClient>,
     pub bootstrap_host: LogicalHost,
     pub control_plane: Vec<LogicalHost>,
     pub workers: Vec<LogicalHost>,
     pub kubeconfig: Option<String>,
+    pub network_manager: OnceLock<Arc<dyn NetworkManager>>,
 }
 
 #[async_trait]
@@ -67,7 +61,7 @@ impl K8sclient for HAClusterTopology {
                 K8sClient::try_default().await.map_err(|e| e.to_string())?,
             )),
             Some(kubeconfig) => {
-                let Some(client) = K8sClient::from_kubeconfig(&kubeconfig).await else {
+                let Some(client) = K8sClient::from_kubeconfig(kubeconfig).await else {
                     return Err("Failed to create k8s client".to_string());
                 };
                 Ok(Arc::new(client))
@@ -97,191 +91,12 @@ impl HAClusterTopology {
             .to_string()
     }
 
-    async fn ensure_nmstate_operator_installed(&self) -> Result<(), String> {
-        let k8s_client = self.k8s_client().await?;
+    pub async fn network_manager(&self) -> &dyn NetworkManager {
+        let k8s_client = self.k8s_client().await.unwrap();
 
-        debug!("Installing NMState controller...");
-        k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/nmstate.io_nmstates.yaml
-").unwrap(), Some("nmstate"))
-            .await
-            .map_err(|e| e.to_string())?;
-
-        debug!("Creating NMState namespace...");
-        k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/namespace.yaml
-").unwrap(), Some("nmstate"))
-            .await
-            .map_err(|e| e.to_string())?;
-
-        debug!("Creating NMState service account...");
-        k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/service_account.yaml
-").unwrap(), Some("nmstate"))
-            .await
-            .map_err(|e| e.to_string())?;
-
-        debug!("Creating NMState role...");
-        k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/role.yaml
-").unwrap(), Some("nmstate"))
-            .await
-            .map_err(|e| e.to_string())?;
-
-        debug!("Creating NMState role binding...");
-        k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/role_binding.yaml
-").unwrap(), Some("nmstate"))
-            .await
-            .map_err(|e| e.to_string())?;
-
-        debug!("Creating NMState operator...");
-        k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/operator.yaml
-").unwrap(), Some("nmstate"))
-            .await
-            .map_err(|e| e.to_string())?;
-
-        k8s_client
-            .wait_until_deployment_ready("nmstate-operator", Some("nmstate"), None)
-            .await?;
-
-        let nmstate = NMState {
-            metadata: ObjectMeta {
-                name: Some("nmstate".to_string()),
-                ..Default::default()
-            },
-            ..Default::default()
-        };
-        debug!("Creating NMState: {nmstate:#?}");
-        k8s_client
-            .apply(&nmstate, None)
-            .await
-            .map_err(|e| e.to_string())?;
-
-        Ok(())
-    }
-
-    fn get_next_bond_id(&self) -> u8 {
-        42 // FIXME: Find a better way to declare the bond id
-    }
-
-    async fn configure_bond(&self, config: &HostNetworkConfig) -> Result<(), SwitchError> {
-        self.ensure_nmstate_operator_installed()
-            .await
-            .map_err(|e| {
-                SwitchError::new(format!(
-                    "Can't configure bond, NMState operator not available: {e}"
-                ))
-            })?;
-
-        let bond_config = self.create_bond_configuration(config);
-        debug!(
-            "Applying NMState bond config for host {}: {bond_config:#?}",
-            config.host_id
-        );
-        self.k8s_client()
-            .await
-            .unwrap()
-            .apply(&bond_config, None)
-            .await
-            .map_err(|e| SwitchError::new(format!("Failed to configure bond: {e}")))?;
-
-        Ok(())
-    }
-
-    fn create_bond_configuration(
-        &self,
-        config: &HostNetworkConfig,
-    ) -> NodeNetworkConfigurationPolicy {
-        let host_name = &config.host_id;
-        let bond_id = self.get_next_bond_id();
-        let bond_name = format!("bond{bond_id}");
-
-        info!("Configuring bond '{bond_name}' for host '{host_name}'...");
-
-        let mut bond_mtu: Option<u32> = None;
-        let mut copy_mac_from: Option<String> = None;
-        let mut bond_ports = Vec::new();
-        let mut interfaces: Vec<nmstate::InterfaceSpec> = Vec::new();
-
-        for switch_port in &config.switch_ports {
-            let interface_name = switch_port.interface.name.clone();
-
-            interfaces.push(nmstate::InterfaceSpec {
-                name: interface_name.clone(),
-                description: Some(format!("Member of bond {bond_name}")),
-                r#type: "ethernet".to_string(),
-                state: "up".to_string(),
-                mtu: Some(switch_port.interface.mtu),
-                mac_address: Some(switch_port.interface.mac_address.to_string()),
-                ipv4: Some(nmstate::IpStackSpec {
-                    enabled: Some(false),
-                    ..Default::default()
-                }),
-                ipv6: Some(nmstate::IpStackSpec {
-                    enabled: Some(false),
-                    ..Default::default()
-                }),
-                link_aggregation: None,
-                ..Default::default()
-            });
-
-            bond_ports.push(interface_name.clone());
-
-            // Use the first port's details for the bond mtu and mac address
-            if bond_mtu.is_none() {
-                bond_mtu = Some(switch_port.interface.mtu);
-            }
-            if copy_mac_from.is_none() {
-                copy_mac_from = Some(interface_name);
-            }
-        }
-
-        interfaces.push(nmstate::InterfaceSpec {
-            name: bond_name.clone(),
-            description: Some(format!("Network bond for host {host_name}")),
-            r#type: "bond".to_string(),
-            state: "up".to_string(),
-            copy_mac_from,
-            ipv4: Some(nmstate::IpStackSpec {
-                dhcp: Some(true),
-                enabled: Some(true),
-                ..Default::default()
-            }),
-            ipv6: Some(nmstate::IpStackSpec {
-                dhcp: Some(true),
-                autoconf: Some(true),
-                enabled: Some(true),
-                ..Default::default()
-            }),
-            link_aggregation: Some(nmstate::BondSpec {
-                mode: "802.3ad".to_string(),
-                ports: bond_ports,
-                ..Default::default()
-            }),
-            ..Default::default()
-        });
-
-        NodeNetworkConfigurationPolicy {
-            metadata: ObjectMeta {
-                name: Some(format!("{host_name}-bond-config")),
-                ..Default::default()
-            },
-            spec: NodeNetworkConfigurationPolicySpec {
-                node_selector: Some(BTreeMap::from([(
-                    "kubernetes.io/hostname".to_string(),
-                    host_name.to_string(),
-                )])),
-                desired_state: nmstate::DesiredStateSpec { interfaces },
-            },
-        }
-    }
-
-    async fn configure_port_channel(&self, config: &HostNetworkConfig) -> Result<(), SwitchError> {
-        debug!("Configuring port channel: {config:#?}");
-        let switch_ports = config.switch_ports.iter().map(|s| s.port.clone()).collect();
-
-        self.switch_client
-            .configure_port_channel(&format!("Harmony_{}", config.host_id), switch_ports)
-            .await
-            .map_err(|e| SwitchError::new(format!("Failed to configure switch: {e}")))?;
-
-        Ok(())
+        self.network_manager
+            .get_or_init(|| Arc::new(OpenShiftNmStateNetworkManager::new(k8s_client.clone())))
+            .as_ref()
     }
 
     pub fn autoload() -> Self {
@@ -301,11 +116,11 @@ impl HAClusterTopology {
             tftp_server: dummy_infra.clone(),
             http_server: dummy_infra.clone(),
             dns_server: dummy_infra.clone(),
-            node_exporter: dummy_infra.clone(),
             switch_client: dummy_infra.clone(),
             bootstrap_host: dummy_host,
             control_plane: vec![],
             workers: vec![],
+            network_manager: OnceLock::new(),
         }
     }
 }
@@ -463,38 +278,50 @@ impl HttpServer for HAClusterTopology {
 #[async_trait]
 impl Switch for HAClusterTopology {
     async fn setup_switch(&self) -> Result<(), SwitchError> {
-        self.switch_client.setup().await?;
-        Ok(())
+        self.switch_client.setup().await.map(|_| ())
     }
 
     async fn get_port_for_mac_address(
         &self,
         mac_address: &MacAddress,
     ) -> Result<Option<PortLocation>, SwitchError> {
-        let port = self.switch_client.find_port(mac_address).await?;
-        Ok(port)
+        self.switch_client.find_port(mac_address).await
     }
 
-    async fn configure_host_network(&self, config: &HostNetworkConfig) -> Result<(), SwitchError> {
-        self.configure_bond(config).await?;
-        self.configure_port_channel(config).await
+    async fn configure_port_channel(&self, config: &HostNetworkConfig) -> Result<(), SwitchError> {
+        debug!("Configuring port channel: {config:#?}");
+        let switch_ports = config.switch_ports.iter().map(|s| s.port.clone()).collect();
+
+        self.switch_client
+            .configure_port_channel(&format!("Harmony_{}", config.host_id), switch_ports)
+            .await
+            .map_err(|e| SwitchError::new(format!("Failed to configure port-channel: {e}")))?;
+
+        Ok(())
     }
 
-    //TODO add snmp here
+    async fn clear_port_channel(&self, ids: &Vec<Id>) -> Result<(), SwitchError> {
+        todo!()
+    }
+    async fn configure_interface(
+        &self,
+        ports: &Vec<PortConfig>,
+    ) -> Result<(), SwitchError> {
+        todo!()
+    }
 }
 
 #[async_trait]
-impl NodeExporter for HAClusterTopology {
-    async fn ensure_initialized(&self) -> Result<(), ExecutorError> {
-        self.node_exporter.ensure_initialized().await
+impl NetworkManager for HAClusterTopology {
+    async fn ensure_network_manager_installed(&self) -> Result<(), NetworkError> {
+        self.network_manager()
+            .await
+            .ensure_network_manager_installed()
+            .await
     }
 
-    async fn commit_config(&self) -> Result<(), ExecutorError> {
-        self.node_exporter.commit_config().await
-    }
-
-    async fn reload_restart(&self) -> Result<(), ExecutorError> {
-        self.node_exporter.reload_restart().await
+    async fn configure_bond(&self, config: &HostNetworkConfig) -> Result<(), NetworkError> {
+        self.network_manager().await.configure_bond(config).await
     }
 }
 
@@ -685,21 +512,6 @@ impl DnsServer for DummyInfra {
     }
 }
 
-#[async_trait]
-impl NodeExporter for DummyInfra {
-    async fn ensure_initialized(&self) -> Result<(), ExecutorError> {
-        unimplemented!("{}", UNIMPLEMENTED_DUMMY_INFRA)
-    }
-
-    async fn commit_config(&self) -> Result<(), ExecutorError> {
-        unimplemented!("{}", UNIMPLEMENTED_DUMMY_INFRA)
-    }
-
-    async fn reload_restart(&self) -> Result<(), ExecutorError> {
-        unimplemented!("{}", UNIMPLEMENTED_DUMMY_INFRA)
-    }
-}
-
 #[async_trait]
 impl SwitchClient for DummyInfra {
     async fn setup(&self) -> Result<(), SwitchError> {
@@ -720,4 +532,6 @@ impl SwitchClient for DummyInfra {
     ) -> Result<u8, SwitchError> {
         unimplemented!("{}", UNIMPLEMENTED_DUMMY_INFRA)
     }
+    async fn clear_port_channel(&self, ids: &Vec<Id>) -> Result<(), SwitchError> {todo!()}
+    async fn configure_interface(&self, ports: &Vec<PortConfig>) -> Result<(), SwitchError> {todo!()}
 }

harmony/src/domain/topology/k8s.rs

@@ -5,13 +5,15 @@ use k8s_openapi::{
     ClusterResourceScope, NamespaceResourceScope,
     api::{
         apps::v1::Deployment,
-        core::v1::{Pod, ServiceAccount},
+        core::v1::{Node, Pod, ServiceAccount},
     },
     apimachinery::pkg::version::Info,
 };
 use kube::{
     Client, Config, Discovery, Error, Resource,
-    api::{Api, AttachParams, DeleteParams, ListParams, Patch, PatchParams, ResourceExt},
+    api::{
+        Api, AttachParams, DeleteParams, ListParams, ObjectList, Patch, PatchParams, ResourceExt,
+    },
     config::{KubeConfigOptions, Kubeconfig},
     core::ErrorResponse,
     discovery::{ApiCapabilities, Scope},
@@ -23,7 +25,7 @@ use kube::{
     api::{ApiResource, GroupVersionKind},
     runtime::wait::await_condition,
 };
-use log::{debug, error, info, trace, warn};
+use log::{debug, error, trace, warn};
 use serde::{Serialize, de::DeserializeOwned};
 use serde_json::json;
 use similar::TextDiff;
@@ -564,7 +566,58 @@ impl K8sClient {
         Ok(())
     }
 
-    pub(crate) async fn from_kubeconfig(path: &str) -> Option<K8sClient> {
+    /// Gets a single named resource of a specific type `K`.
+    ///
+    /// This function uses the `ApplyStrategy` trait to correctly determine
+    /// whether to look in a specific namespace or in the entire cluster.
+    ///
+    /// Returns `Ok(None)` if the resource is not found (404).
+    pub async fn get_resource<K>(
+        &self,
+        name: &str,
+        namespace: Option<&str>,
+    ) -> Result<Option<K>, Error>
+    where
+        K: Resource + Clone + std::fmt::Debug + DeserializeOwned,
+        <K as Resource>::Scope: ApplyStrategy<K>,
+        <K as kube::Resource>::DynamicType: Default,
+    {
+        let api: Api<K> =
+            <<K as Resource>::Scope as ApplyStrategy<K>>::get_api(&self.client, namespace);
+
+        api.get_opt(name).await
+    }
+
+    /// Lists all resources of a specific type `K`.
+    ///
+    /// This function uses the `ApplyStrategy` trait to correctly determine
+    /// whether to list from a specific namespace or from the entire cluster.
+    pub async fn list_resources<K>(
+        &self,
+        namespace: Option<&str>,
+        list_params: Option<ListParams>,
+    ) -> Result<ObjectList<K>, Error>
+    where
+        K: Resource + Clone + std::fmt::Debug + DeserializeOwned,
+        <K as Resource>::Scope: ApplyStrategy<K>,
+        <K as kube::Resource>::DynamicType: Default,
+    {
+        let api: Api<K> =
+            <<K as Resource>::Scope as ApplyStrategy<K>>::get_api(&self.client, namespace);
+
+        let list_params = list_params.unwrap_or_default();
+        api.list(&list_params).await
+    }
+
+    /// Fetches a list of all Nodes in the cluster.
+    pub async fn get_nodes(
+        &self,
+        list_params: Option<ListParams>,
+    ) -> Result<ObjectList<Node>, Error> {
+        self.list_resources(None, list_params).await
+    }
+
+    pub async fn from_kubeconfig(path: &str) -> Option<K8sClient> {
         let k = match Kubeconfig::read_from(path) {
             Ok(k) => k,
             Err(e) => {

harmony/src/domain/topology/mod.rs

@@ -1,6 +1,5 @@
 mod ha_cluster;
 pub mod ingress;
-pub mod node_exporter;
 use harmony_types::net::IpAddress;
 mod host_binding;
 mod http;

harmony/src/domain/topology/network.rs

@@ -7,6 +7,7 @@ use std::{
 };
 
 use async_trait::async_trait;
+use brocade::PortOperatingMode;
 use derive_new::new;
 use harmony_types::{
     id::Id,
@@ -15,7 +16,7 @@ use harmony_types::{
 };
 use serde::Serialize;
 
-use crate::{executors::ExecutorError, hardware::PhysicalHost};
+use crate::executors::ExecutorError;
 
 use super::{LogicalHost, k8s::K8sClient};
 
@@ -183,6 +184,39 @@ impl FromStr for DnsRecordType {
     }
 }
 
+#[async_trait]
+pub trait NetworkManager: Debug + Send + Sync {
+    async fn ensure_network_manager_installed(&self) -> Result<(), NetworkError>;
+    async fn configure_bond(&self, config: &HostNetworkConfig) -> Result<(), NetworkError>;
+}
+
+#[derive(Debug, Clone, new)]
+pub struct NetworkError {
+    msg: String,
+}
+
+impl fmt::Display for NetworkError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(&self.msg)
+    }
+}
+
+impl Error for NetworkError {}
+
+impl From<kube::Error> for NetworkError {
+    fn from(value: kube::Error) -> Self {
+        NetworkError::new(value.to_string())
+    }
+}
+
+impl From<String> for NetworkError {
+    fn from(value: String) -> Self {
+        NetworkError::new(value)
+    }
+}
+
+pub type PortConfig = (PortLocation, PortOperatingMode);
+
 #[async_trait]
 pub trait Switch: Send + Sync {
     async fn setup_switch(&self) -> Result<(), SwitchError>;
@@ -192,7 +226,9 @@ pub trait Switch: Send + Sync {
         mac_address: &MacAddress,
     ) -> Result<Option<PortLocation>, SwitchError>;
 
-    async fn configure_host_network(&self, config: &HostNetworkConfig) -> Result<(), SwitchError>;
+    async fn configure_port_channel(&self, config: &HostNetworkConfig) -> Result<(), SwitchError>;
+    async fn clear_port_channel(&self, ids: &Vec<Id>) -> Result<(), SwitchError>;
+    async fn configure_interface(&self, ports: &Vec<PortConfig>) -> Result<(), SwitchError>;
 }
 
 #[derive(Clone, Debug, PartialEq)]
@@ -252,6 +288,9 @@ pub trait SwitchClient: Debug + Send + Sync {
         channel_name: &str,
         switch_ports: Vec<PortLocation>,
     ) -> Result<u8, SwitchError>;
+
+    async fn clear_port_channel(&self, ids: &Vec<Id>) -> Result<(), SwitchError>;
+    async fn configure_interface(&self, ports: &Vec<PortConfig>) -> Result<(), SwitchError>;
 }
 
 #[cfg(test)]

harmony/src/domain/topology/node_exporter.rs

@@ -1,17 +0,0 @@
-use async_trait::async_trait;
-
-use crate::executors::ExecutorError;
-
-#[async_trait]
-pub trait NodeExporter: Send + Sync {
-    async fn ensure_initialized(&self) -> Result<(), ExecutorError>;
-    async fn commit_config(&self) -> Result<(), ExecutorError>;
-    async fn reload_restart(&self) -> Result<(), ExecutorError>;
-}
-
-//TODO complete this impl
-impl std::fmt::Debug for dyn NodeExporter {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.write_fmt(format_args!("NodeExporter ",))
-    }
-}

harmony/src/domain/topology/tenant/k8s.rs

@@ -14,7 +14,7 @@ use k8s_openapi::{
     },
     apimachinery::pkg::util::intstr::IntOrString,
 };
-use kube::Resource;
+use kube::{Resource, api::DynamicObject};
 use log::debug;
 use serde::de::DeserializeOwned;
 use serde_json::json;

harmony/src/infra/brocade.rs

@@ -1,12 +1,13 @@
 use async_trait::async_trait;
 use brocade::{BrocadeClient, BrocadeOptions, InterSwitchLink, InterfaceStatus, PortOperatingMode};
 use harmony_types::{
+    id::Id,
     net::{IpAddress, MacAddress},
     switch::{PortDeclaration, PortLocation},
 };
 use option_ext::OptionExt;
 
-use crate::topology::{SwitchClient, SwitchError};
+use crate::topology::{PortConfig, SwitchClient, SwitchError};
 
 #[derive(Debug)]
 pub struct BrocadeSwitchClient {
@@ -18,9 +19,9 @@ impl BrocadeSwitchClient {
         ip_addresses: &[IpAddress],
         username: &str,
         password: &str,
-        options: Option<BrocadeOptions>,
+        options: BrocadeOptions,
     ) -> Result<Self, brocade::Error> {
-        let brocade = brocade::init(ip_addresses, 22, username, password, options).await?;
+        let brocade = brocade::init(ip_addresses, username, password, options).await?;
         Ok(Self { brocade })
     }
 }
@@ -59,7 +60,7 @@ impl SwitchClient for BrocadeSwitchClient {
         }
 
         self.brocade
-            .configure_interfaces(interfaces)
+            .configure_interfaces(&interfaces)
             .await
             .map_err(|e| SwitchError::new(e.to_string()))?;
 
@@ -111,6 +112,24 @@ impl SwitchClient for BrocadeSwitchClient {
 
         Ok(channel_id)
     }
+    async fn clear_port_channel(&self, ids: &Vec<Id>) -> Result<(), SwitchError> {
+        for i in ids {
+            self.brocade
+                .clear_port_channel(&i.to_string())
+                .await
+                .map_err(|e| SwitchError::new(e.to_string()))?;
+        }
+        Ok(())
+    }
+    async fn configure_interface(&self, ports: &Vec<PortConfig>) -> Result<(), SwitchError> {
+        // FIXME hardcoded TenGigabitEthernet = bad
+        let ports = ports.iter().map(|p| (format!("TenGigabitEthernet {}", p.0), p.1.clone())).collect();
+        self.brocade
+            .configure_interfaces(&ports)
+            .await
+            .map_err(|e| SwitchError::new(e.to_string()))?;
+        Ok(())
+    }
 }
 
 #[cfg(test)]
@@ -147,8 +166,8 @@ mod tests {
 
         let configured_interfaces = brocade.configured_interfaces.lock().unwrap();
         assert_that!(*configured_interfaces).contains_exactly(vec![
-            (first_interface.name.clone(), PortOperatingMode::Access),
-            (second_interface.name.clone(), PortOperatingMode::Access),
+            (first_interface.port_location, PortOperatingMode::Access),
+            (second_interface.port_location, PortOperatingMode::Access),
         ]);
     }
 
@@ -255,10 +274,10 @@ mod tests {
 
         async fn configure_interfaces(
             &self,
-            interfaces: Vec<(String, PortOperatingMode)>,
+            interfaces: &Vec<(String, PortOperatingMode)>,
         ) -> Result<(), Error> {
             let mut configured_interfaces = self.configured_interfaces.lock().unwrap();
-            *configured_interfaces = interfaces;
+            *configured_interfaces = interfaces.clone();
 
             Ok(())
         }

harmony/src/infra/kube.rs

@@ -0,0 +1,182 @@
+use k8s_openapi::Resource as K8sResource;
+use kube::api::{ApiResource, DynamicObject, GroupVersionKind};
+use kube::core::TypeMeta;
+use serde::Serialize;
+use serde::de::DeserializeOwned;
+use serde_json::Value;
+
+/// Convert a typed Kubernetes resource `K` into a `DynamicObject`.
+///
+/// Requirements:
+/// - `K` must be a k8s_openapi resource (provides static GVK via `Resource`).
+/// - `K` must have standard Kubernetes shape (metadata + payload fields).
+///
+/// Notes:
+/// - We set `types` (apiVersion/kind) and copy `metadata`.
+/// - We place the remaining top-level fields into `obj.data` as JSON.
+/// - Scope is not encoded on the object itself; you still need the corresponding
+///   `DynamicResource` (derived from K::group/version/kind) when constructing an Api.
+///
+/// Example usage:
+///   let dyn_obj = kube_resource_to_dynamic(secret)?;
+///   let api: Api<DynamicObject> = Api::namespaced_with(client, "ns", &dr);
+///   api.patch(&dyn_obj.name_any(), &PatchParams::apply("mgr"), &Patch::Apply(dyn_obj)).await?;
+pub fn kube_resource_to_dynamic<K>(res: &K) -> Result<DynamicObject, String>
+where
+    K: K8sResource + Serialize + DeserializeOwned,
+{
+    // Serialize the typed resource to JSON so we can split metadata and payload
+    let mut v = serde_json::to_value(res).map_err(|e| format!("Failed to serialize : {e}"))?;
+    let obj = v
+        .as_object_mut()
+        .ok_or_else(|| "expected object JSON".to_string())?;
+
+    // Extract and parse metadata into kube::core::ObjectMeta
+    let metadata_value = obj
+        .remove("metadata")
+        .ok_or_else(|| "missing metadata".to_string())?;
+    let metadata: kube::core::ObjectMeta = serde_json::from_value(metadata_value)
+        .map_err(|e| format!("Failed to deserialize : {e}"))?;
+
+    // Name is required for DynamicObject::new; prefer metadata.name
+    let name = metadata
+        .name
+        .clone()
+        .ok_or_else(|| "metadata.name is required".to_string())?;
+
+    // Remaining fields (spec/status/data/etc.) become the dynamic payload
+    let payload = Value::Object(obj.clone());
+
+    // Construct the DynamicObject
+    let mut dyn_obj = DynamicObject::new(
+        &name,
+        &ApiResource::from_gvk(&GroupVersionKind::gvk(K::GROUP, K::VERSION, K::KIND)),
+    );
+    dyn_obj.types = Some(TypeMeta {
+        api_version: api_version_for::<K>(),
+        kind: K::KIND.into(),
+    });
+
+    // Preserve namespace/labels/annotations/etc.
+    dyn_obj.metadata = metadata;
+
+    // Attach payload
+    dyn_obj.data = payload;
+
+    Ok(dyn_obj)
+}
+
+/// Helper: compute apiVersion string ("group/version" or "v1" for core).
+fn api_version_for<K>() -> String
+where
+    K: K8sResource,
+{
+    let group = K::GROUP;
+    let version = K::VERSION;
+    if group.is_empty() {
+        version.to_string() // core/v1 => "v1"
+    } else {
+        format!("{}/{}", group, version)
+    }
+}
+#[cfg(test)]
+mod test {
+    use super::*;
+    use k8s_openapi::api::{
+        apps::v1::{Deployment, DeploymentSpec},
+        core::v1::{PodTemplateSpec, Secret},
+    };
+    use kube::api::ObjectMeta;
+    use pretty_assertions::assert_eq;
+
+    #[test]
+    fn secret_to_dynamic_roundtrip() {
+        // Create a sample Secret resource
+        let mut secret = Secret {
+            metadata: ObjectMeta {
+                name: Some("my-secret".to_string()),
+                ..Default::default()
+            },
+            type_: Some("kubernetes.io/service-account-token".to_string()),
+            ..Default::default()
+        };
+
+        // Convert to DynamicResource
+        let dynamic: DynamicObject =
+            kube_resource_to_dynamic(&secret).expect("Failed to convert Secret to DynamicResource");
+
+        // Serialize both the original and dynamic resources to Value
+        let original_value = serde_json::to_value(&secret).expect("Failed to serialize Secret");
+        let dynamic_value =
+            serde_json::to_value(&dynamic).expect("Failed to serialize DynamicResource");
+
+        // Assert that they are identical
+        assert_eq!(original_value, dynamic_value);
+
+        secret.metadata.namespace = Some("false".to_string());
+        let modified_value = serde_json::to_value(&secret).expect("Failed to serialize Secret");
+        assert_ne!(modified_value, dynamic_value);
+    }
+
+    #[test]
+    fn deployment_to_dynamic_roundtrip() {
+        // Create a sample Deployment with nested structures
+        let deployment = Deployment {
+            metadata: ObjectMeta {
+                name: Some("my-deployment".to_string()),
+                labels: Some({
+                    let mut map = std::collections::BTreeMap::new();
+                    map.insert("app".to_string(), "nginx".to_string());
+                    map
+                }),
+                ..Default::default()
+            },
+            spec: Some(DeploymentSpec {
+                replicas: Some(3),
+                selector: Default::default(),
+                template: PodTemplateSpec {
+                    metadata: Some(ObjectMeta {
+                        labels: Some({
+                            let mut map = std::collections::BTreeMap::new();
+                            map.insert("app".to_string(), "nginx".to_string());
+                            map
+                        }),
+                        ..Default::default()
+                    }),
+                    spec: Some(Default::default()), // PodSpec with empty containers for simplicity
+                },
+                ..Default::default()
+            }),
+            ..Default::default()
+        };
+
+        let dynamic = kube_resource_to_dynamic(&deployment).expect("Failed to convert Deployment");
+
+        let original_value = serde_json::to_value(&deployment).unwrap();
+        let dynamic_value = serde_json::to_value(&dynamic).unwrap();
+
+        assert_eq!(original_value, dynamic_value);
+
+        assert_eq!(
+            dynamic.data.get("spec").unwrap().get("replicas").unwrap(),
+            3
+        );
+        assert_eq!(
+            dynamic
+                .data
+                .get("spec")
+                .unwrap()
+                .get("template")
+                .unwrap()
+                .get("metadata")
+                .unwrap()
+                .get("labels")
+                .unwrap()
+                .get("app")
+                .unwrap()
+                .as_str()
+                .unwrap(),
+            "nginx".to_string()
+        );
+    }
+}

harmony/src/infra/mod.rs

@@ -3,5 +3,7 @@ pub mod executors;
 pub mod hp_ilo;
 pub mod intel_amt;
 pub mod inventory;
+pub mod kube;
+pub mod network_manager;
 pub mod opnsense;
 mod sqlx;

harmony/src/infra/network_manager.rs

@@ -0,0 +1,259 @@
+use std::{
+    collections::{BTreeMap, HashSet},
+    sync::Arc,
+};
+
+use async_trait::async_trait;
+use harmony_types::id::Id;
+use k8s_openapi::api::core::v1::Node;
+use kube::{
+    ResourceExt,
+    api::{ObjectList, ObjectMeta},
+};
+use log::{debug, info};
+
+use crate::{
+    modules::okd::crd::nmstate,
+    topology::{HostNetworkConfig, NetworkError, NetworkManager, k8s::K8sClient},
+};
+
+pub struct OpenShiftNmStateNetworkManager {
+    k8s_client: Arc<K8sClient>,
+}
+
+impl std::fmt::Debug for OpenShiftNmStateNetworkManager {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("OpenShiftNmStateNetworkManager").finish()
+    }
+}
+
+#[async_trait]
+impl NetworkManager for OpenShiftNmStateNetworkManager {
+    async fn ensure_network_manager_installed(&self) -> Result<(), NetworkError> {
+        debug!("Installing NMState controller...");
+        self.k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/nmstate.io_nmstates.yaml
+").unwrap(), Some("nmstate"))
+            .await?;
+
+        debug!("Creating NMState namespace...");
+        self.k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/namespace.yaml
+").unwrap(), Some("nmstate"))
+            .await?;
+
+        debug!("Creating NMState service account...");
+        self.k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/service_account.yaml
+").unwrap(), Some("nmstate"))
+            .await?;
+
+        debug!("Creating NMState role...");
+        self.k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/role.yaml
+").unwrap(), Some("nmstate"))
+            .await?;
+
+        debug!("Creating NMState role binding...");
+        self.k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/role_binding.yaml
+").unwrap(), Some("nmstate"))
+            .await?;
+
+        debug!("Creating NMState operator...");
+        self.k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/operator.yaml
+").unwrap(), Some("nmstate"))
+            .await?;
+
+        self.k8s_client
+            .wait_until_deployment_ready("nmstate-operator", Some("nmstate"), None)
+            .await?;
+
+        let nmstate = nmstate::NMState {
+            metadata: ObjectMeta {
+                name: Some("nmstate".to_string()),
+                ..Default::default()
+            },
+            ..Default::default()
+        };
+        debug!(
+            "Creating NMState:\n{}",
+            serde_yaml::to_string(&nmstate).unwrap()
+        );
+        self.k8s_client.apply(&nmstate, None).await?;
+
+        Ok(())
+    }
+
+    async fn configure_bond(&self, config: &HostNetworkConfig) -> Result<(), NetworkError> {
+        let hostname = self.get_hostname(&config.host_id).await.map_err(|e| {
+            NetworkError::new(format!(
+                "Can't configure bond, can't get hostname for host '{}': {e}",
+                config.host_id
+            ))
+        })?;
+        let bond_id = self.get_next_bond_id(&hostname).await.map_err(|e| {
+            NetworkError::new(format!(
+                "Can't configure bond, can't get an available bond id for host '{}': {e}",
+                config.host_id
+            ))
+        })?;
+        let bond_config = self.create_bond_configuration(&hostname, &bond_id, config);
+
+        debug!(
+            "Applying NMState bond config for host {}:\n{}",
+            config.host_id,
+            serde_yaml::to_string(&bond_config).unwrap(),
+        );
+        self.k8s_client
+            .apply(&bond_config, None)
+            .await
+            .map_err(|e| NetworkError::new(format!("Failed to configure bond: {e}")))?;
+
+        Ok(())
+    }
+}
+
+impl OpenShiftNmStateNetworkManager {
+    pub fn new(k8s_client: Arc<K8sClient>) -> Self {
+        Self { k8s_client }
+    }
+
+    fn create_bond_configuration(
+        &self,
+        host: &str,
+        bond_name: &str,
+        config: &HostNetworkConfig,
+    ) -> nmstate::NodeNetworkConfigurationPolicy {
+        info!("Configuring bond '{bond_name}' for host '{host}'...");
+
+        let mut bond_mtu: Option<u32> = None;
+        let mut copy_mac_from: Option<String> = None;
+        let mut bond_ports = Vec::new();
+        let mut interfaces: Vec<nmstate::Interface> = Vec::new();
+
+        for switch_port in &config.switch_ports {
+            let interface_name = switch_port.interface.name.clone();
+
+            interfaces.push(nmstate::Interface {
+                name: interface_name.clone(),
+                description: Some(format!("Member of bond {bond_name}")),
+                r#type: nmstate::InterfaceType::Ethernet,
+                state: "up".to_string(),
+                mtu: Some(switch_port.interface.mtu),
+                mac_address: Some(switch_port.interface.mac_address.to_string()),
+                ipv4: Some(nmstate::IpStackSpec {
+                    enabled: Some(false),
+                    ..Default::default()
+                }),
+                ipv6: Some(nmstate::IpStackSpec {
+                    enabled: Some(false),
+                    ..Default::default()
+                }),
+                link_aggregation: None,
+                ..Default::default()
+            });
+
+            bond_ports.push(interface_name.clone());
+
+            // Use the first port's details for the bond mtu and mac address
+            if bond_mtu.is_none() {
+                bond_mtu = Some(switch_port.interface.mtu);
+            }
+            if copy_mac_from.is_none() {
+                copy_mac_from = Some(interface_name);
+            }
+        }
+
+        interfaces.push(nmstate::Interface {
+            name: bond_name.to_string(),
+            description: Some(format!("Network bond for host {host}")),
+            r#type: nmstate::InterfaceType::Bond,
+            state: "up".to_string(),
+            copy_mac_from,
+            ipv4: Some(nmstate::IpStackSpec {
+                dhcp: Some(true),
+                enabled: Some(true),
+                ..Default::default()
+            }),
+            ipv6: Some(nmstate::IpStackSpec {
+                dhcp: Some(true),
+                autoconf: Some(true),
+                enabled: Some(true),
+                ..Default::default()
+            }),
+            link_aggregation: Some(nmstate::BondSpec {
+                mode: "802.3ad".to_string(),
+                ports: bond_ports,
+                ..Default::default()
+            }),
+            ..Default::default()
+        });
+
+        nmstate::NodeNetworkConfigurationPolicy {
+            metadata: ObjectMeta {
+                name: Some(format!("{host}-bond-config")),
+                ..Default::default()
+            },
+            spec: nmstate::NodeNetworkConfigurationPolicySpec {
+                node_selector: Some(BTreeMap::from([(
+                    "kubernetes.io/hostname".to_string(),
+                    host.to_string(),
+                )])),
+                desired_state: nmstate::NetworkState {
+                    interfaces,
+                    ..Default::default()
+                },
+            },
+        }
+    }
+
+    async fn get_hostname(&self, host_id: &Id) -> Result<String, String> {
+        let nodes: ObjectList<Node> = self
+            .k8s_client
+            .list_resources(None, None)
+            .await
+            .map_err(|e| format!("Failed to list nodes: {e}"))?;
+
+        let Some(node) = nodes.iter().find(|n| {
+            n.status
+                .as_ref()
+                .and_then(|s| s.node_info.as_ref())
+                .map(|i| i.system_uuid == host_id.to_string())
+                .unwrap_or(false)
+        }) else {
+            return Err(format!("No node found for host '{host_id}'"));
+        };
+
+        node.labels()
+            .get("kubernetes.io/hostname")
+            .ok_or(format!(
+                "Node '{host_id}' has no kubernetes.io/hostname label"
+            ))
+            .cloned()
+    }
+
+    async fn get_next_bond_id(&self, hostname: &str) -> Result<String, String> {
+        let network_state: Option<nmstate::NodeNetworkState> = self
+            .k8s_client
+            .get_resource(hostname, None)
+            .await
+            .map_err(|e| format!("Failed to list nodes: {e}"))?;
+
+        let interfaces = vec![];
+        let existing_bonds: Vec<&nmstate::Interface> = network_state
+            .as_ref()
+            .and_then(|network_state| network_state.status.current_state.as_ref())
+            .map_or(&interfaces, |current_state| &current_state.interfaces)
+            .iter()
+            .filter(|i| i.r#type == nmstate::InterfaceType::Bond)
+            .collect();
+
+        let used_ids: HashSet<u32> = existing_bonds
+            .iter()
+            .filter_map(|i| {
+                i.name
+                    .strip_prefix("bond")
+                    .and_then(|id| id.parse::<u32>().ok())
+            })
+            .collect();
+
+        let next_id = (0..).find(|id| !used_ids.contains(id)).unwrap();
+        Ok(format!("bond{next_id}"))
+    }
+}

harmony/src/infra/opnsense/mod.rs

@@ -4,12 +4,10 @@ mod firewall;
 mod http;
 mod load_balancer;
 mod management;
-pub mod node_exporter;
 mod tftp;
 use std::sync::Arc;
 
 pub use management::*;
-use opnsense_config_xml::Host;
 use tokio::sync::RwLock;
 
 use crate::{executors::ExecutorError, topology::LogicalHost};

harmony/src/infra/opnsense/node_exporter.rs

@@ -1,47 +0,0 @@
-use async_trait::async_trait;
-use log::debug;
-
-use crate::{
-    executors::ExecutorError, infra::opnsense::OPNSenseFirewall,
-    topology::node_exporter::NodeExporter,
-};
-
-#[async_trait]
-impl NodeExporter for OPNSenseFirewall {
-    async fn ensure_initialized(&self) -> Result<(), ExecutorError> {
-        let mut config = self.opnsense_config.write().await;
-        let node_exporter = config.node_exporter();
-        if let Some(config) = node_exporter.get_full_config() {
-            debug!(
-                "Node exporter available in opnsense config, assuming it is already installed. {config:?}"
-            );
-        } else {
-            config
-                .install_package("os-node_exporter")
-                .await
-                .map_err(|e| {
-                        ExecutorError::UnexpectedError(format!("Executor failed when trying to install os-node_exporter package with error {e:?}"
-                                ))
-                    })?;
-        }
-
-        config
-            .node_exporter()
-            .enable(true)
-            .map_err(|e| ExecutorError::UnexpectedError(e.to_string()))?;
-        Ok(())
-    }
-    async fn commit_config(&self) -> Result<(), ExecutorError> {
-        OPNSenseFirewall::commit_config(self).await
-    }
-
-    async fn reload_restart(&self) -> Result<(), ExecutorError> {
-        self.opnsense_config
-            .write()
-            .await
-            .node_exporter()
-            .reload_restart()
-            .await
-            .map_err(|e| ExecutorError::UnexpectedError(e.to_string()))
-    }
-}

harmony/src/modules/dhcp.rs

@@ -19,8 +19,11 @@ pub struct DhcpScore {
     pub host_binding: Vec<HostBinding>,
     pub next_server: Option<IpAddress>,
     pub boot_filename: Option<String>,
+    /// Boot filename to be provided to PXE clients identifying as BIOS
     pub filename: Option<String>,
+    /// Boot filename to be provided to PXE clients identifying as uefi but NOT iPXE
     pub filename64: Option<String>,
+    /// Boot filename to be provided to PXE clients identifying as iPXE
     pub filenameipxe: Option<String>,
     pub dhcp_range: (IpAddress, IpAddress),
     pub domain: Option<String>,

harmony/src/modules/inventory/discovery.rs

@@ -5,11 +5,10 @@ use serde::{Deserialize, Serialize};
 
 use crate::{
     data::Version,
-    hardware::PhysicalHost,
     infra::inventory::InventoryRepositoryFactory,
     interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome},
     inventory::{HostRole, Inventory},
-    modules::inventory::LaunchDiscoverInventoryAgentScore,
+    modules::inventory::{HarmonyDiscoveryStrategy, LaunchDiscoverInventoryAgentScore},
     score::Score,
     topology::Topology,
 };
@@ -17,11 +16,13 @@ use crate::{
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct DiscoverHostForRoleScore {
     pub role: HostRole,
+    pub number_desired_hosts: i16,
+    pub discovery_strategy : HarmonyDiscoveryStrategy,
 }
 
 impl<T: Topology> Score<T> for DiscoverHostForRoleScore {
     fn name(&self) -> String {
-        "DiscoverInventoryAgentScore".to_string()
+        format!("DiscoverHostForRoleScore({:?})", self.role)
     }
 
     fn create_interpret(&self) -> Box<dyn Interpret<T>> {
@@ -48,13 +49,15 @@ impl<T: Topology> Interpret<T> for DiscoverHostForRoleInterpret {
         );
         LaunchDiscoverInventoryAgentScore {
             discovery_timeout: None,
+            discovery_strategy: self.score.discovery_strategy.clone(),
         }
         .interpret(inventory, topology)
         .await?;
 
-        let host: PhysicalHost;
+        let mut chosen_hosts = vec![];
         let host_repo = InventoryRepositoryFactory::build().await?;
 
+        let mut assigned_hosts = 0;
         loop {
             let all_hosts = host_repo.get_all_hosts().await?;
 
@@ -74,12 +77,25 @@ impl<T: Topology> Interpret<T> for DiscoverHostForRoleInterpret {
 
             match ans {
                 Ok(choice) => {
-                    info!("Selected {} as the bootstrap node.", choice.summary());
+                    info!(
+                        "Assigned role {:?} for node {}",
+                        self.score.role,
+                        choice.summary()
+                    );
                     host_repo
                         .save_role_mapping(&self.score.role, &choice)
                         .await?;
-                    host = choice;
-                    break;
+                    chosen_hosts.push(choice);
+                    assigned_hosts += 1;
+
+                    info!(
+                        "Found {assigned_hosts} hosts for role {:?}",
+                        self.score.role
+                    );
+
+                    if assigned_hosts == self.score.number_desired_hosts {
+                        break;
+                    }
                 }
                 Err(inquire::InquireError::OperationCanceled) => {
                     info!("Refresh requested. Fetching list of discovered hosts again...");
@@ -90,17 +106,19 @@ impl<T: Topology> Interpret<T> for DiscoverHostForRoleInterpret {
                         "Failed to select node for role {:?} : {}",
                         self.score.role, e
                     );
-                    return Err(InterpretError::new(format!(
-                        "Could not select host : {}",
-                        e.to_string()
-                    )));
+                    return Err(InterpretError::new(format!("Could not select host : {e}")));
                 }
             }
         }
 
         Ok(Outcome::success(format!(
-            "Successfully discovered host {} for role {:?}",
-            host.summary(),
+            "Successfully discovered {} hosts {} for role {:?}",
+            self.score.number_desired_hosts,
+            chosen_hosts
+                .iter()
+                .map(|h| h.summary())
+                .collect::<Vec<String>>()
+                .join(", "),
             self.score.role
         )))
     }

harmony/src/modules/inventory/mod.rs

@@ -1,6 +1,10 @@
 mod discovery;
 pub mod inspect;
+use std::net::Ipv4Addr;
+
+use cidr::{Ipv4Cidr, Ipv4Inet};
 pub use discovery::*;
+use tokio::time::{Duration, timeout};
 
 use async_trait::async_trait;
 use harmony_inventory_agent::local_presence::DiscoveryEvent;
@@ -24,6 +28,7 @@ use harmony_types::id::Id;
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct LaunchDiscoverInventoryAgentScore {
     pub discovery_timeout: Option<u64>,
+    pub discovery_strategy: HarmonyDiscoveryStrategy,
 }
 
 impl<T: Topology> Score<T> for LaunchDiscoverInventoryAgentScore {
@@ -43,6 +48,12 @@ struct DiscoverInventoryAgentInterpret {
     score: LaunchDiscoverInventoryAgentScore,
 }
 
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub enum HarmonyDiscoveryStrategy {
+    MDNS,
+    SUBNET { cidr: cidr::Ipv4Cidr, port: u16 },
+}
+
 #[async_trait]
 impl<T: Topology> Interpret<T> for DiscoverInventoryAgentInterpret {
     async fn execute(
@@ -57,6 +68,37 @@ impl<T: Topology> Interpret<T> for DiscoverInventoryAgentInterpret {
             ),
         };
 
+        match self.score.discovery_strategy {
+            HarmonyDiscoveryStrategy::MDNS => self.launch_mdns_discovery().await,
+            HarmonyDiscoveryStrategy::SUBNET { cidr, port } => {
+                self.launch_cidr_discovery(&cidr, port).await
+            }
+        };
+
+        Ok(Outcome::success(
+            "Discovery process completed successfully".to_string(),
+        ))
+    }
+
+    fn get_name(&self) -> InterpretName {
+        InterpretName::DiscoverInventoryAgent
+    }
+
+    fn get_version(&self) -> Version {
+        todo!()
+    }
+
+    fn get_status(&self) -> InterpretStatus {
+        todo!()
+    }
+
+    fn get_children(&self) -> Vec<Id> {
+        todo!()
+    }
+}
+
+impl DiscoverInventoryAgentInterpret {
+    async fn launch_mdns_discovery(&self) {
         harmony_inventory_agent::local_presence::discover_agents(
             self.score.discovery_timeout,
             |event: DiscoveryEvent| -> Result<(), String> {
@@ -112,6 +154,8 @@ impl<T: Topology> Interpret<T> for DiscoverInventoryAgentInterpret {
                                 cpus,
                             };
 
+                            // FIXME only save the host when it is new or something changed in it.
+                            // we currently are saving the host every time it is discovered.
                             let repo = InventoryRepositoryFactory::build()
                                 .await
                                 .map_err(|e| format!("Could not build repository : {e}"))
@@ -132,25 +176,111 @@ impl<T: Topology> Interpret<T> for DiscoverInventoryAgentInterpret {
                 Ok(())
             },
         )
-        .await;
-        Ok(Outcome::success(
-            "Discovery process completed successfully".to_string(),
-        ))
+        .await
     }
 
-    fn get_name(&self) -> InterpretName {
-        InterpretName::DiscoverInventoryAgent
-    }
+    // async fn launch_cidr_discovery(&self, cidr : &Ipv4Cidr, port: u16) {
+    //     todo!("launnch cidr discovery for {cidr} : {port}
+    //         - Iterate over all possible addresses in cidr
+    //         - make calls in batches of 20 attempting to reach harmony inventory agent on <addr, port> using same as above harmony_inventory_agent::client::get_host_inventory(&address, port)
+    //         - Log warn when response is 404, it means the port was used by something else unexpected
+    //         - Log error when response is 5xx
+    //         - Log debug when no response (timeout 15 seconds)
+    //         - Log info when found and response is 2xx
+    //         ");
+    // }
+    async fn launch_cidr_discovery(&self, cidr: &Ipv4Cidr, port: u16) {
+        let addrs: Vec<Ipv4Inet> = cidr.iter().collect();
+        let total = addrs.len();
+        info!(
+            "Starting CIDR discovery for {} hosts on {}/{} (port {})",
+            total,
+            cidr.network_length(),
+            cidr,
+            port
+        );
 
-    fn get_version(&self) -> Version {
-        todo!()
-    }
+        let batch_size: usize = 20;
+        let timeout_secs = 5;
+        let request_timeout = Duration::from_secs(timeout_secs);
 
-    fn get_status(&self) -> InterpretStatus {
-        todo!()
-    }
+        let mut current_batch = 0;
+        let num_batches = addrs.len() / batch_size;
 
-    fn get_children(&self) -> Vec<Id> {
-        todo!()
+        for batch in addrs.chunks(batch_size) {
+            current_batch += 1;
+            info!("Starting query batch {current_batch} of {num_batches}, timeout {timeout_secs}");
+            let mut tasks = Vec::with_capacity(batch.len());
+
+            for addr in batch {
+                let addr = addr.address().to_string();
+                let port = port;
+
+                let task = tokio::spawn(async move {
+                    match timeout(
+                        request_timeout,
+                        harmony_inventory_agent::client::get_host_inventory(&addr, port),
+                    )
+                    .await
+                    {
+                        Ok(Ok(host)) => {
+                            info!("Found and response is 2xx for {addr}:{port}");
+
+                            // Reuse the same conversion to PhysicalHost as MDNS flow
+                            let harmony_inventory_agent::hwinfo::PhysicalHost {
+                                storage_drives,
+                                storage_controller,
+                                memory_modules,
+                                cpus,
+                                chipset,
+                                network_interfaces,
+                                management_interface,
+                                host_uuid,
+                            } = host;
+
+                            let host = PhysicalHost {
+                                id: Id::from(host_uuid),
+                                category: HostCategory::Server,
+                                network: network_interfaces,
+                                storage: storage_drives,
+                                labels: vec![Label {
+                                    name: "discovered-by".to_string(),
+                                    value: "harmony-inventory-agent".to_string(),
+                                }],
+                                memory_modules,
+                                cpus,
+                            };
+
+                            // Save host to inventory
+                            let repo = InventoryRepositoryFactory::build()
+                                .await
+                                .map_err(|e| format!("Could not build repository : {e}"))
+                                .unwrap();
+                            if let Err(e) = repo.save(&host).await {
+                                log::debug!("Failed to save host {}: {e}", host.id);
+                            } else {
+                                info!("Saved host id {}, summary : {}", host.id, host.summary());
+                            }
+                        }
+                        Ok(Err(e)) => {
+                            log::info!("Error querying inventory agent on {addr}:{port} : {e}");
+                        }
+                        Err(_) => {
+                            // Timeout for this host
+                            log::debug!("No response (timeout) for {addr}:{port}");
+                        }
+                    }
+                });
+
+                tasks.push(task);
+            }
+
+            // Wait for this batch to complete
+            for t in tasks {
+                let _ = t.await;
+            }
+        }
+
+        info!("CIDR discovery completed");
     }
 }

harmony/src/modules/okd/bootstrap_01_prepare.rs

@@ -4,7 +4,7 @@ use crate::{
     infra::inventory::InventoryRepositoryFactory,
     interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome},
     inventory::{HostRole, Inventory},
-    modules::inventory::DiscoverHostForRoleScore,
+    modules::inventory::{DiscoverHostForRoleScore, HarmonyDiscoveryStrategy},
     score::Score,
     topology::HAClusterTopology,
 };
@@ -104,6 +104,8 @@ When you can dig them, confirm to continue.
             bootstrap_host = hosts.into_iter().next().to_owned();
             DiscoverHostForRoleScore {
                 role: HostRole::Bootstrap,
+                number_desired_hosts: 1,
+                discovery_strategy: HarmonyDiscoveryStrategy::MDNS,
             }
             .interpret(inventory, topology)
             .await?;

harmony/src/modules/okd/bootstrap_03_control_plane.rs

@@ -6,7 +6,7 @@ use crate::{
     inventory::{HostRole, Inventory},
     modules::{
         dhcp::DhcpHostBindingScore, http::IPxeMacBootFileScore,
-        inventory::DiscoverHostForRoleScore, okd::templates::BootstrapIpxeTpl,
+        inventory::{DiscoverHostForRoleScore, HarmonyDiscoveryStrategy}, okd::templates::BootstrapIpxeTpl,
     },
     score::Score,
     topology::{HAClusterTopology, HostBinding},
@@ -58,38 +58,39 @@ impl OKDSetup03ControlPlaneInterpret {
         inventory: &Inventory,
         topology: &HAClusterTopology,
     ) -> Result<Vec<PhysicalHost>, InterpretError> {
-        const REQUIRED_HOSTS: usize = 3;
+        const REQUIRED_HOSTS: i16 = 3;
         let repo = InventoryRepositoryFactory::build().await?;
-        let mut control_plane_hosts = repo.get_host_for_role(&HostRole::ControlPlane).await?;
+        let control_plane_hosts = repo.get_host_for_role(&HostRole::ControlPlane).await?;
 
-        while control_plane_hosts.len() < REQUIRED_HOSTS {
-            info!(
-                "Discovery of {} control plane hosts in progress, current number {}",
-                REQUIRED_HOSTS,
-                control_plane_hosts.len()
-            );
-            // This score triggers the discovery agent for a specific role.
-            DiscoverHostForRoleScore {
-                role: HostRole::ControlPlane,
-            }
-            .interpret(inventory, topology)
-            .await?;
-            control_plane_hosts = repo.get_host_for_role(&HostRole::ControlPlane).await?;
+        info!(
+            "Discovery of {} control plane hosts in progress, current number {}",
+            REQUIRED_HOSTS,
+            control_plane_hosts.len()
+        );
+        // This score triggers the discovery agent for a specific role.
+        DiscoverHostForRoleScore {
+            role: HostRole::ControlPlane,
+            number_desired_hosts: REQUIRED_HOSTS,
+            discovery_strategy: HarmonyDiscoveryStrategy::MDNS,
         }
+        .interpret(inventory, topology)
+        .await?;
 
-        if control_plane_hosts.len() < REQUIRED_HOSTS {
-            Err(InterpretError::new(format!(
+        let control_plane_hosts = repo.get_host_for_role(&HostRole::ControlPlane).await?;
+
+        if control_plane_hosts.len() < REQUIRED_HOSTS as usize {
+            return Err(InterpretError::new(format!(
                 "OKD Requires at least {} control plane hosts, but only found {}. Cannot proceed.",
                 REQUIRED_HOSTS,
                 control_plane_hosts.len()
-            )))
-        } else {
-            // Take exactly the number of required hosts to ensure consistency.
-            Ok(control_plane_hosts
-                .into_iter()
-                .take(REQUIRED_HOSTS)
-                .collect())
+            )));
         }
+
+        // Take exactly the number of required hosts to ensure consistency.
+        Ok(control_plane_hosts
+            .into_iter()
+            .take(REQUIRED_HOSTS as usize)
+            .collect())
     }
 
     /// Configures DHCP host bindings for all control plane nodes.

harmony/src/modules/okd/crd/nmstate.rs

@@ -1,6 +1,7 @@
 use std::collections::BTreeMap;
 
-use kube::CustomResource;
+use k8s_openapi::{ClusterResourceScope, Resource};
+use kube::{CustomResource, api::ObjectMeta};
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
@@ -47,28 +48,223 @@ pub struct ProbeDns {
     group = "nmstate.io",
     version = "v1",
     kind = "NodeNetworkConfigurationPolicy",
-    namespaced
+    namespaced = false
 )]
 #[serde(rename_all = "camelCase")]
 pub struct NodeNetworkConfigurationPolicySpec {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub node_selector: Option<BTreeMap<String, String>>,
-    pub desired_state: DesiredStateSpec,
+    pub desired_state: NetworkState,
+}
+
+// Currently, kube-rs derive doesn't support resources without a `spec` field, so we have
+// to implement it ourselves.
+//
+// Ref:
+// - https://github.com/kube-rs/kube/issues/1763
+// - https://github.com/kube-rs/kube/discussions/1762
+#[derive(Deserialize, Serialize, Clone, Debug)]
+#[serde(rename_all = "camelCase")]
+pub struct NodeNetworkState {
+    metadata: ObjectMeta,
+    pub status: NodeNetworkStateStatus,
+}
+
+impl Resource for NodeNetworkState {
+    const API_VERSION: &'static str = "nmstate.io/v1beta1";
+    const GROUP: &'static str = "nmstate.io";
+    const VERSION: &'static str = "v1beta1";
+    const KIND: &'static str = "NodeNetworkState";
+    const URL_PATH_SEGMENT: &'static str = "nodenetworkstates";
+    type Scope = ClusterResourceScope;
+}
+
+impl k8s_openapi::Metadata for NodeNetworkState {
+    type Ty = ObjectMeta;
+
+    fn metadata(&self) -> &Self::Ty {
+        &self.metadata
+    }
+
+    fn metadata_mut(&mut self) -> &mut Self::Ty {
+        &mut self.metadata
+    }
 }
 
 #[derive(Deserialize, Serialize, Clone, Debug, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct NodeNetworkStateStatus {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub current_state: Option<NetworkState>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub handler_nmstate_version: Option<String>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub host_network_manager_version: Option<String>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub last_successful_update_time: Option<String>,
+}
+
+/// The NetworkState is the top-level struct, representing the entire
+/// desired or current network state.
+#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
 #[serde(rename_all = "kebab-case")]
-pub struct DesiredStateSpec {
-    pub interfaces: Vec<InterfaceSpec>,
+#[serde(deny_unknown_fields)]
+pub struct NetworkState {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub hostname: Option<HostNameState>,
+    #[serde(rename = "dns-resolver", skip_serializing_if = "Option::is_none")]
+    pub dns: Option<DnsState>,
+    #[serde(rename = "route-rules", skip_serializing_if = "Option::is_none")]
+    pub rules: Option<RouteRuleState>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub routes: Option<RouteState>,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub interfaces: Vec<Interface>,
+    #[serde(rename = "ovs-db", skip_serializing_if = "Option::is_none")]
+    pub ovsdb: Option<OvsDbGlobalConfig>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub ovn: Option<OvnConfiguration>,
 }
 
 #[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
 #[serde(rename_all = "kebab-case")]
-pub struct InterfaceSpec {
+pub struct HostNameState {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub running: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub config: Option<String>,
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
+#[serde(rename_all = "kebab-case")]
+pub struct DnsState {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub running: Option<DnsResolverConfig>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub config: Option<DnsResolverConfig>,
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
+#[serde(rename_all = "kebab-case")]
+pub struct DnsResolverConfig {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub search: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub server: Option<Vec<String>>,
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
+#[serde(rename_all = "kebab-case")]
+pub struct RouteRuleState {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub config: Option<Vec<RouteRule>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub running: Option<Vec<RouteRule>>,
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
+#[serde(rename_all = "kebab-case")]
+pub struct RouteState {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub config: Option<Vec<Route>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub running: Option<Vec<Route>>,
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
+#[serde(rename_all = "kebab-case")]
+pub struct RouteRule {
+    #[serde(rename = "ip-from", skip_serializing_if = "Option::is_none")]
+    pub ip_from: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub priority: Option<u32>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub route_table: Option<u32>,
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
+#[serde(rename_all = "kebab-case")]
+pub struct Route {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub destination: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub metric: Option<u32>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub next_hop_address: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub next_hop_interface: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub table_id: Option<u32>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub mtu: Option<u32>,
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
+#[serde(rename_all = "kebab-case")]
+pub struct OvsDbGlobalConfig {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub external_ids: Option<BTreeMap<String, String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub other_config: Option<BTreeMap<String, String>>,
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
+#[serde(rename_all = "kebab-case")]
+pub struct OvnConfiguration {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub bridge_mappings: Option<Vec<OvnBridgeMapping>>,
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
+#[serde(rename_all = "kebab-case")]
+pub struct OvnBridgeMapping {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub localnet: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub bridge: Option<String>,
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug, JsonSchema)]
+#[serde(untagged)]
+#[serde(rename_all = "kebab-case")]
+pub enum StpSpec {
+    Bool(bool),
+    Options(StpOptions),
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug, JsonSchema)]
+#[serde(rename_all = "kebab-case")]
+pub struct LldpState {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub enabled: Option<bool>,
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug, JsonSchema)]
+#[serde(rename_all = "kebab-case")]
+pub struct OvsDb {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub external_ids: Option<BTreeMap<String, String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub other_config: Option<BTreeMap<String, String>>,
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug, JsonSchema)]
+#[serde(rename_all = "kebab-case")]
+pub struct PatchState {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub peer: Option<String>,
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
+#[serde(rename_all = "kebab-case")]
+pub struct Interface {
     pub name: String,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub description: Option<String>,
-    pub r#type: String,
+    pub r#type: InterfaceType,
     pub state: String,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub mac_address: Option<String>,
@@ -99,9 +295,81 @@ pub struct InterfaceSpec {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub linux_bridge: Option<LinuxBridgeSpec>,
     #[serde(skip_serializing_if = "Option::is_none")]
+    #[serde(alias = "bridge")]
     pub ovs_bridge: Option<OvsBridgeSpec>,
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub ethtool: Option<EthtoolSpec>,
+    pub ethtool: Option<Value>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub accept_all_mac_addresses: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub identifier: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub lldp: Option<LldpState>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub permanent_mac_address: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_mtu: Option<u32>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub min_mtu: Option<u32>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub mptcp: Option<Value>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub profile_name: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub wait_ip: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub ovs_db: Option<OvsDb>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub driver: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub patch: Option<PatchState>,
+}
+
+#[derive(Deserialize, Serialize, Clone, PartialEq, Eq, PartialOrd, Ord, Debug, JsonSchema)]
+#[serde(rename_all = "kebab-case")]
+pub enum InterfaceType {
+    #[serde(rename = "unknown")]
+    Unknown,
+    #[serde(rename = "dummy")]
+    Dummy,
+    #[serde(rename = "loopback")]
+    Loopback,
+    #[serde(rename = "linux-bridge")]
+    LinuxBridge,
+    #[serde(rename = "ovs-bridge")]
+    OvsBridge,
+    #[serde(rename = "ovs-interface")]
+    OvsInterface,
+    #[serde(rename = "bond")]
+    Bond,
+    #[serde(rename = "ipvlan")]
+    IpVlan,
+    #[serde(rename = "vlan")]
+    Vlan,
+    #[serde(rename = "vxlan")]
+    Vxlan,
+    #[serde(rename = "mac-vlan")]
+    Macvlan,
+    #[serde(rename = "mac-vtap")]
+    Macvtap,
+    #[serde(rename = "ethernet")]
+    Ethernet,
+    #[serde(rename = "infiniband")]
+    Infiniband,
+    #[serde(rename = "vrf")]
+    Vrf,
+    #[serde(rename = "veth")]
+    Veth,
+    #[serde(rename = "ipsec")]
+    Ipsec,
+    #[serde(rename = "hsr")]
+    Hrs,
+}
+
+impl Default for InterfaceType {
+    fn default() -> Self {
+        Self::Loopback
+    }
 }
 
 #[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
@@ -287,11 +555,15 @@ pub struct OvsBridgeSpec {
 #[serde(rename_all = "kebab-case")]
 pub struct OvsBridgeOptions {
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub stp: Option<bool>,
+    pub stp: Option<StpSpec>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub rstp: Option<bool>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub mcast_snooping_enable: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub datapath: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub fail_mode: Option<String>,
 }
 
 #[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
@@ -305,18 +577,3 @@ pub struct OvsPortSpec {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub r#type: Option<String>,
 }
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct EthtoolSpec {
-    // TODO: Properly describe this spec (https://nmstate.io/devel/yaml_api.html#ethtool)
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct EthtoolFecSpec {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub auto: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub mode: Option<String>,
-}

harmony/src/modules/okd/host_network.rs

@@ -1,6 +1,6 @@
 use async_trait::async_trait;
 use harmony_types::id::Id;
-use log::{debug, info};
+use log::{info, warn};
 use serde::Serialize;
 
 use crate::{
@@ -9,7 +9,7 @@ use crate::{
     interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome},
     inventory::Inventory,
     score::Score,
-    topology::{HostNetworkConfig, NetworkInterface, Switch, SwitchPort, Topology},
+    topology::{HostNetworkConfig, NetworkInterface, NetworkManager, Switch, SwitchPort, Topology},
 };
 
 #[derive(Debug, Clone, Serialize)]
@@ -17,7 +17,7 @@ pub struct HostNetworkConfigurationScore {
     pub hosts: Vec<PhysicalHost>,
 }
 
-impl<T: Topology + Switch> Score<T> for HostNetworkConfigurationScore {
+impl<T: Topology + NetworkManager + Switch> Score<T> for HostNetworkConfigurationScore {
     fn name(&self) -> String {
         "HostNetworkConfigurationScore".into()
     }
@@ -35,7 +35,7 @@ pub struct HostNetworkConfigurationInterpret {
 }
 
 impl HostNetworkConfigurationInterpret {
-    async fn configure_network_for_host<T: Topology + Switch>(
+    async fn configure_network_for_host<T: Topology + NetworkManager + Switch>(
         &self,
         topology: &T,
         host: &PhysicalHost,
@@ -49,6 +49,13 @@ impl HostNetworkConfigurationInterpret {
                 switch_ports: vec![],
             });
         }
+        if host.network.len() == 1 {
+            info!("[Host {current_host}/{total_hosts}] Only one interface to configure, skipping");
+            return Ok(HostNetworkConfig {
+                host_id: host.id.clone(),
+                switch_ports: vec![],
+            });
+        }
 
         let switch_ports = self
             .collect_switch_ports_for_host(topology, host, current_host, total_hosts)
@@ -59,7 +66,7 @@ impl HostNetworkConfigurationInterpret {
             switch_ports,
         };
 
-        if !config.switch_ports.is_empty() {
+        if config.switch_ports.len() > 1 {
             info!(
                 "[Host {current_host}/{total_hosts}] Found {} ports for {} interfaces",
                 config.switch_ports.len(),
@@ -67,15 +74,25 @@ impl HostNetworkConfigurationInterpret {
             );
 
             info!("[Host {current_host}/{total_hosts}] Configuring host network...");
+            topology.configure_bond(&config).await.map_err(|e| {
+                InterpretError::new(format!("Failed to configure host network: {e}"))
+            })?;
             topology
-                .configure_host_network(&config)
+                .configure_port_channel(&config)
                 .await
-                .map_err(|e| InterpretError::new(format!("Failed to configure host: {e}")))?;
-        } else {
+                .map_err(|e| {
+                    InterpretError::new(format!("Failed to configure host network: {e}"))
+                })?;
+        } else if config.switch_ports.is_empty() {
             info!(
                 "[Host {current_host}/{total_hosts}] No ports found for {} interfaces, skipping",
                 host.network.len()
             );
+        } else {
+            warn!(
+                "[Host {current_host}/{total_hosts}] Found a single port for {} interfaces, skipping",
+                host.network.len()
+            );
         }
 
         Ok(config)
@@ -113,7 +130,7 @@ impl HostNetworkConfigurationInterpret {
                         port,
                     });
                 }
-                Ok(None) => debug!("No port found for '{mac_address}', skipping"),
+                Ok(None) => {}
                 Err(e) => {
                     return Err(InterpretError::new(format!(
                         "Failed to get port for host '{}': {}",
@@ -133,15 +150,6 @@ impl HostNetworkConfigurationInterpret {
         ];
 
         for config in configs {
-            let host = self
-                .score
-                .hosts
-                .iter()
-                .find(|h| h.id == config.host_id)
-                .unwrap();
-
-            println!("[Host] {host}");
-
             if config.switch_ports.is_empty() {
                 report.push(format!(
                     "⏭️ Host {}: SKIPPED (No matching switch ports found)",
@@ -169,7 +177,7 @@ impl HostNetworkConfigurationInterpret {
 }
 
 #[async_trait]
-impl<T: Topology + Switch> Interpret<T> for HostNetworkConfigurationInterpret {
+impl<T: Topology + NetworkManager + Switch> Interpret<T> for HostNetworkConfigurationInterpret {
     fn get_name(&self) -> InterpretName {
         InterpretName::Custom("HostNetworkConfigurationInterpret")
     }
@@ -198,6 +206,12 @@ impl<T: Topology + Switch> Interpret<T> for HostNetworkConfigurationInterpret {
         let host_count = self.score.hosts.len();
         info!("Started network configuration for {host_count} host(s)...",);
 
+        info!("Setting up NetworkManager...",);
+        topology
+            .ensure_network_manager_installed()
+            .await
+            .map_err(|e| InterpretError::new(format!("NetworkManager setup failed: {e}")))?;
+
         info!("Setting up switch with sane defaults...");
         topology
             .setup_switch()
@@ -216,6 +230,7 @@ impl<T: Topology + Switch> Interpret<T> for HostNetworkConfigurationInterpret {
             host_configurations.push(host_configuration);
             current_host += 1;
         }
+
         if current_host > 1 {
             let details = self.format_host_configuration(host_configurations);
 
@@ -236,13 +251,14 @@ impl<T: Topology + Switch> Interpret<T> for HostNetworkConfigurationInterpret {
 #[cfg(test)]
 mod tests {
     use assertor::*;
+    use brocade::PortOperatingMode;
     use harmony_types::{net::MacAddress, switch::PortLocation};
     use lazy_static::lazy_static;
 
     use crate::{
         hardware::HostCategory,
         topology::{
-            HostNetworkConfig, PreparationError, PreparationOutcome, SwitchError, SwitchPort,
+            HostNetworkConfig, NetworkError, PortConfig, PreparationError, PreparationOutcome, SwitchError, SwitchPort
         },
     };
     use std::{
@@ -267,6 +283,18 @@ mod tests {
             speed_mbps: None,
             mtu: 1,
         };
+        pub static ref YET_ANOTHER_EXISTING_INTERFACE: NetworkInterface = NetworkInterface {
+            mac_address: MacAddress::try_from("AA:BB:CC:DD:EE:F3".to_string()).unwrap(),
+            name: "interface-3".into(),
+            speed_mbps: None,
+            mtu: 1,
+        };
+        pub static ref LAST_EXISTING_INTERFACE: NetworkInterface = NetworkInterface {
+            mac_address: MacAddress::try_from("AA:BB:CC:DD:EE:F4".to_string()).unwrap(),
+            name: "interface-4".into(),
+            speed_mbps: None,
+            mtu: 1,
+        };
         pub static ref UNKNOWN_INTERFACE: NetworkInterface = NetworkInterface {
             mac_address: MacAddress::try_from("11:22:33:44:55:61".to_string()).unwrap(),
             name: "unknown-interface".into(),
@@ -275,6 +303,8 @@ mod tests {
         };
         pub static ref PORT: PortLocation = PortLocation(1, 0, 42);
         pub static ref ANOTHER_PORT: PortLocation = PortLocation(2, 0, 42);
+        pub static ref YET_ANOTHER_PORT: PortLocation = PortLocation(1, 0, 45);
+        pub static ref LAST_PORT: PortLocation = PortLocation(2, 0, 45);
     }
 
     #[tokio::test]
@@ -290,28 +320,33 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn host_with_one_mac_address_should_create_bond_with_one_interface() {
+    async fn should_setup_network_manager() {
         let host = given_host(&HOST_ID, vec![EXISTING_INTERFACE.clone()]);
         let score = given_score(vec![host]);
         let topology = TopologyWithSwitch::new();
 
         let _ = score.interpret(&Inventory::empty(), &topology).await;
 
-        let configured_host_networks = topology.configured_host_networks.lock().unwrap();
-        assert_that!(*configured_host_networks).contains_exactly(vec![(
-            HOST_ID.clone(),
-            HostNetworkConfig {
-                host_id: HOST_ID.clone(),
-                switch_ports: vec![SwitchPort {
-                    interface: EXISTING_INTERFACE.clone(),
-                    port: PORT.clone(),
-                }],
-            },
-        )]);
+        let network_manager_setup = topology.network_manager_setup.lock().unwrap();
+        assert_that!(*network_manager_setup).is_true();
     }
 
     #[tokio::test]
-    async fn host_with_multiple_mac_addresses_should_create_one_bond_with_all_interfaces() {
+    async fn host_with_one_mac_address_should_skip_host_configuration() {
+        let host = given_host(&HOST_ID, vec![EXISTING_INTERFACE.clone()]);
+        let score = given_score(vec![host]);
+        let topology = TopologyWithSwitch::new();
+
+        let _ = score.interpret(&Inventory::empty(), &topology).await;
+
+        let config = topology.configured_bonds.lock().unwrap();
+        assert_that!(*config).is_empty();
+        let config = topology.configured_port_channels.lock().unwrap();
+        assert_that!(*config).is_empty();
+    }
+
+    #[tokio::test]
+    async fn host_with_multiple_mac_addresses_should_configure_one_bond_with_all_interfaces() {
         let score = given_score(vec![given_host(
             &HOST_ID,
             vec![
@@ -323,8 +358,8 @@ mod tests {
 
         let _ = score.interpret(&Inventory::empty(), &topology).await;
 
-        let configured_host_networks = topology.configured_host_networks.lock().unwrap();
-        assert_that!(*configured_host_networks).contains_exactly(vec![(
+        let config = topology.configured_bonds.lock().unwrap();
+        assert_that!(*config).contains_exactly(vec![(
             HOST_ID.clone(),
             HostNetworkConfig {
                 host_id: HOST_ID.clone(),
@@ -343,49 +378,183 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn multiple_hosts_should_create_one_bond_per_host() {
+    async fn host_with_multiple_mac_addresses_should_configure_one_port_channel_with_all_interfaces()
+     {
+        let score = given_score(vec![given_host(
+            &HOST_ID,
+            vec![
+                EXISTING_INTERFACE.clone(),
+                ANOTHER_EXISTING_INTERFACE.clone(),
+            ],
+        )]);
+        let topology = TopologyWithSwitch::new();
+
+        let _ = score.interpret(&Inventory::empty(), &topology).await;
+
+        let config = topology.configured_port_channels.lock().unwrap();
+        assert_that!(*config).contains_exactly(vec![(
+            HOST_ID.clone(),
+            HostNetworkConfig {
+                host_id: HOST_ID.clone(),
+                switch_ports: vec![
+                    SwitchPort {
+                        interface: EXISTING_INTERFACE.clone(),
+                        port: PORT.clone(),
+                    },
+                    SwitchPort {
+                        interface: ANOTHER_EXISTING_INTERFACE.clone(),
+                        port: ANOTHER_PORT.clone(),
+                    },
+                ],
+            },
+        )]);
+    }
+
+    #[tokio::test]
+    async fn multiple_hosts_should_configure_one_bond_per_host() {
         let score = given_score(vec![
-            given_host(&HOST_ID, vec![EXISTING_INTERFACE.clone()]),
-            given_host(&ANOTHER_HOST_ID, vec![ANOTHER_EXISTING_INTERFACE.clone()]),
+            given_host(
+                &HOST_ID,
+                vec![
+                    EXISTING_INTERFACE.clone(),
+                    ANOTHER_EXISTING_INTERFACE.clone(),
+                ],
+            ),
+            given_host(
+                &ANOTHER_HOST_ID,
+                vec![
+                    YET_ANOTHER_EXISTING_INTERFACE.clone(),
+                    LAST_EXISTING_INTERFACE.clone(),
+                ],
+            ),
         ]);
         let topology = TopologyWithSwitch::new();
 
         let _ = score.interpret(&Inventory::empty(), &topology).await;
 
-        let configured_host_networks = topology.configured_host_networks.lock().unwrap();
-        assert_that!(*configured_host_networks).contains_exactly(vec![
+        let config = topology.configured_bonds.lock().unwrap();
+        assert_that!(*config).contains_exactly(vec![
             (
                 HOST_ID.clone(),
                 HostNetworkConfig {
                     host_id: HOST_ID.clone(),
-                    switch_ports: vec![SwitchPort {
-                        interface: EXISTING_INTERFACE.clone(),
-                        port: PORT.clone(),
-                    }],
+                    switch_ports: vec![
+                        SwitchPort {
+                            interface: EXISTING_INTERFACE.clone(),
+                            port: PORT.clone(),
+                        },
+                        SwitchPort {
+                            interface: ANOTHER_EXISTING_INTERFACE.clone(),
+                            port: ANOTHER_PORT.clone(),
+                        },
+                    ],
                 },
             ),
             (
                 ANOTHER_HOST_ID.clone(),
                 HostNetworkConfig {
                     host_id: ANOTHER_HOST_ID.clone(),
-                    switch_ports: vec![SwitchPort {
-                        interface: ANOTHER_EXISTING_INTERFACE.clone(),
-                        port: ANOTHER_PORT.clone(),
-                    }],
+                    switch_ports: vec![
+                        SwitchPort {
+                            interface: YET_ANOTHER_EXISTING_INTERFACE.clone(),
+                            port: YET_ANOTHER_PORT.clone(),
+                        },
+                        SwitchPort {
+                            interface: LAST_EXISTING_INTERFACE.clone(),
+                            port: LAST_PORT.clone(),
+                        },
+                    ],
                 },
             ),
         ]);
     }
 
     #[tokio::test]
-    async fn port_not_found_for_mac_address_should_not_configure_interface() {
+    async fn multiple_hosts_should_configure_one_port_channel_per_host() {
+        let score = given_score(vec![
+            given_host(
+                &HOST_ID,
+                vec![
+                    EXISTING_INTERFACE.clone(),
+                    ANOTHER_EXISTING_INTERFACE.clone(),
+                ],
+            ),
+            given_host(
+                &ANOTHER_HOST_ID,
+                vec![
+                    YET_ANOTHER_EXISTING_INTERFACE.clone(),
+                    LAST_EXISTING_INTERFACE.clone(),
+                ],
+            ),
+        ]);
+        let topology = TopologyWithSwitch::new();
+
+        let _ = score.interpret(&Inventory::empty(), &topology).await;
+
+        let config = topology.configured_port_channels.lock().unwrap();
+        assert_that!(*config).contains_exactly(vec![
+            (
+                HOST_ID.clone(),
+                HostNetworkConfig {
+                    host_id: HOST_ID.clone(),
+                    switch_ports: vec![
+                        SwitchPort {
+                            interface: EXISTING_INTERFACE.clone(),
+                            port: PORT.clone(),
+                        },
+                        SwitchPort {
+                            interface: ANOTHER_EXISTING_INTERFACE.clone(),
+                            port: ANOTHER_PORT.clone(),
+                        },
+                    ],
+                },
+            ),
+            (
+                ANOTHER_HOST_ID.clone(),
+                HostNetworkConfig {
+                    host_id: ANOTHER_HOST_ID.clone(),
+                    switch_ports: vec![
+                        SwitchPort {
+                            interface: YET_ANOTHER_EXISTING_INTERFACE.clone(),
+                            port: YET_ANOTHER_PORT.clone(),
+                        },
+                        SwitchPort {
+                            interface: LAST_EXISTING_INTERFACE.clone(),
+                            port: LAST_PORT.clone(),
+                        },
+                    ],
+                },
+            ),
+        ]);
+    }
+
+    #[tokio::test]
+    async fn port_not_found_for_mac_address_should_not_configure_host() {
         let score = given_score(vec![given_host(&HOST_ID, vec![UNKNOWN_INTERFACE.clone()])]);
         let topology = TopologyWithSwitch::new_port_not_found();
 
         let _ = score.interpret(&Inventory::empty(), &topology).await;
 
-        let configured_host_networks = topology.configured_host_networks.lock().unwrap();
-        assert_that!(*configured_host_networks).is_empty();
+        let config = topology.configured_port_channels.lock().unwrap();
+        assert_that!(*config).is_empty();
+        let config = topology.configured_bonds.lock().unwrap();
+        assert_that!(*config).is_empty();
+    }
+
+    #[tokio::test]
+    async fn only_one_port_found_for_multiple_mac_addresses_should_not_configure_host() {
+        let score = given_score(vec![given_host(
+            &HOST_ID,
+            vec![EXISTING_INTERFACE.clone(), UNKNOWN_INTERFACE.clone()],
+        )]);
+        let topology = TopologyWithSwitch::new_single_port_found();
+
+        let _ = score.interpret(&Inventory::empty(), &topology).await;
+
+        let config = topology.configured_port_channels.lock().unwrap();
+        assert_that!(*config).is_empty();
+        let config = topology.configured_bonds.lock().unwrap();
+        assert_that!(*config).is_empty();
     }
 
     fn given_score(hosts: Vec<PhysicalHost>) -> HostNetworkConfigurationScore {
@@ -422,26 +591,48 @@ mod tests {
         }
     }
 
+    #[derive(Debug)]
     struct TopologyWithSwitch {
         available_ports: Arc<Mutex<Vec<PortLocation>>>,
-        configured_host_networks: Arc<Mutex<Vec<(Id, HostNetworkConfig)>>>,
+        configured_port_channels: Arc<Mutex<Vec<(Id, HostNetworkConfig)>>>,
         switch_setup: Arc<Mutex<bool>>,
+        network_manager_setup: Arc<Mutex<bool>>,
+        configured_bonds: Arc<Mutex<Vec<(Id, HostNetworkConfig)>>>,
     }
 
     impl TopologyWithSwitch {
         fn new() -> Self {
             Self {
-                available_ports: Arc::new(Mutex::new(vec![PORT.clone(), ANOTHER_PORT.clone()])),
-                configured_host_networks: Arc::new(Mutex::new(vec![])),
+                available_ports: Arc::new(Mutex::new(vec![
+                    PORT.clone(),
+                    ANOTHER_PORT.clone(),
+                    YET_ANOTHER_PORT.clone(),
+                    LAST_PORT.clone(),
+                ])),
+                configured_port_channels: Arc::new(Mutex::new(vec![])),
                 switch_setup: Arc::new(Mutex::new(false)),
+                network_manager_setup: Arc::new(Mutex::new(false)),
+                configured_bonds: Arc::new(Mutex::new(vec![])),
             }
         }
 
         fn new_port_not_found() -> Self {
             Self {
                 available_ports: Arc::new(Mutex::new(vec![])),
-                configured_host_networks: Arc::new(Mutex::new(vec![])),
+                configured_port_channels: Arc::new(Mutex::new(vec![])),
                 switch_setup: Arc::new(Mutex::new(false)),
+                network_manager_setup: Arc::new(Mutex::new(false)),
+                configured_bonds: Arc::new(Mutex::new(vec![])),
+            }
+        }
+
+        fn new_single_port_found() -> Self {
+            Self {
+                available_ports: Arc::new(Mutex::new(vec![PORT.clone()])),
+                configured_port_channels: Arc::new(Mutex::new(vec![])),
+                switch_setup: Arc::new(Mutex::new(false)),
+                network_manager_setup: Arc::new(Mutex::new(false)),
+                configured_bonds: Arc::new(Mutex::new(vec![])),
             }
         }
     }
@@ -457,6 +648,22 @@ mod tests {
         }
     }
 
+    #[async_trait]
+    impl NetworkManager for TopologyWithSwitch {
+        async fn ensure_network_manager_installed(&self) -> Result<(), NetworkError> {
+            let mut network_manager_installed = self.network_manager_setup.lock().unwrap();
+            *network_manager_installed = true;
+            Ok(())
+        }
+
+        async fn configure_bond(&self, config: &HostNetworkConfig) -> Result<(), NetworkError> {
+            let mut configured_bonds = self.configured_bonds.lock().unwrap();
+            configured_bonds.push((config.host_id.clone(), config.clone()));
+
+            Ok(())
+        }
+    }
+
     #[async_trait]
     impl Switch for TopologyWithSwitch {
         async fn setup_switch(&self) -> Result<(), SwitchError> {
@@ -476,14 +683,23 @@ mod tests {
             Ok(Some(ports.remove(0)))
         }
 
-        async fn configure_host_network(
+        async fn configure_port_channel(
             &self,
             config: &HostNetworkConfig,
         ) -> Result<(), SwitchError> {
-            let mut configured_host_networks = self.configured_host_networks.lock().unwrap();
-            configured_host_networks.push((config.host_id.clone(), config.clone()));
+            let mut configured_port_channels = self.configured_port_channels.lock().unwrap();
+            configured_port_channels.push((config.host_id.clone(), config.clone()));
 
             Ok(())
         }
+        async fn clear_port_channel(&self, ids: &Vec<Id>) -> Result<(), SwitchError> {
+            todo!()
+        }
+        async fn configure_interface(
+            &self,
+            port_config: &Vec<PortConfig>,
+        ) -> Result<(), SwitchError> {
+            todo!()
+        }
     }
 }

harmony/src/modules/opnsense/mod.rs

@@ -1,4 +1,3 @@
-pub mod node_exporter;
 mod shell;
 mod upgrade;
 pub use shell::*;

harmony/src/modules/opnsense/node_exporter.rs

@@ -1,70 +0,0 @@
-use async_trait::async_trait;
-use harmony_types::id::Id;
-use log::info;
-use serde::Serialize;
-
-use crate::{
-    data::Version,
-    interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome},
-    inventory::Inventory,
-    score::Score,
-    topology::{Topology, node_exporter::NodeExporter},
-};
-
-#[derive(Debug, Clone, Serialize)]
-pub struct NodeExporterScore {}
-
-impl<T: Topology + NodeExporter> Score<T> for NodeExporterScore {
-    fn name(&self) -> String {
-        "NodeExporterScore".to_string()
-    }
-
-    fn create_interpret(&self) -> Box<dyn Interpret<T>> {
-        Box::new(NodeExporterInterpret {})
-    }
-}
-
-#[derive(Debug)]
-pub struct NodeExporterInterpret {}
-
-#[async_trait]
-impl<T: Topology + NodeExporter> Interpret<T> for NodeExporterInterpret {
-    async fn execute(
-        &self,
-        _inventory: &Inventory,
-        node_exporter: &T,
-    ) -> Result<Outcome, InterpretError> {
-        info!(
-            "Making sure node exporter is initiailized: {:?}",
-            node_exporter.ensure_initialized().await?
-        );
-
-        info!("Applying Node Exporter configuration");
-
-        node_exporter.commit_config().await?;
-
-        info!("Reloading and restarting Node Exporter");
-
-        node_exporter.reload_restart().await?;
-
-        Ok(Outcome::success(format!(
-            "NodeExporter successfully configured"
-        )))
-    }
-
-    fn get_name(&self) -> InterpretName {
-        InterpretName::Custom("NodeExporter")
-    }
-
-    fn get_version(&self) -> Version {
-        todo!()
-    }
-
-    fn get_status(&self) -> InterpretStatus {
-        todo!()
-    }
-
-    fn get_children(&self) -> Vec<Id> {
-        todo!()
-    }
-}

harmony_inventory_agent/build_docker.sh

@@ -0,0 +1,11 @@
+cargo build -p harmony_inventory_agent --release --target x86_64-unknown-linux-musl
+
+SCRIPT_DIR="$(dirname ${0})"
+
+cd "${SCRIPT_DIR}/docker/"
+
+cp ../../target/x86_64-unknown-linux-musl/release/harmony_inventory_agent .
+
+docker build . -t hub.nationtech.io/harmony/harmony_inventory_agent
+
+docker push hub.nationtech.io/harmony/harmony_inventory_agent

harmony_inventory_agent/docker/.gitignore

@@ -0,0 +1 @@
+harmony_inventory_agent

harmony_inventory_agent/docker/Dockerfile

@@ -0,0 +1,17 @@
+FROM debian:12-slim
+
+# install packages required to make these commands available : lspci, lsmod, dmidecode, smartctl, ip
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends pciutils kmod dmidecode smartmontools iproute2 && \
+    rm -rf /var/lib/apt/lists/*
+
+
+RUN mkdir  /app
+WORKDIR /app/
+
+COPY harmony_inventory_agent /app/
+
+ENV RUST_LOG=info
+
+CMD [ "/app/harmony_inventory_agent" ]
+

harmony_inventory_agent/harmony-inventory-agent-daemonset.yaml

@@ -0,0 +1,117 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: harmony-inventory-agent
+  labels:
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/warn: privileged
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: harmony-inventory-agent
+  namespace: harmony-inventory-agent
+---
+# Grant the built-in "privileged" SCC to the SA
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: use-privileged-scc
+  namespace: harmony-inventory-agent
+rules:
+- apiGroups: ["security.openshift.io"]
+  resources: ["securitycontextconstraints"]
+  resourceNames: ["privileged"]
+  verbs: ["use"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: use-privileged-scc
+  namespace: harmony-inventory-agent
+subjects:
+- kind: ServiceAccount
+  name: harmony-inventory-agent
+  namespace: harmony-inventory-agent
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: use-privileged-scc
+---
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: harmony-inventory-agent
+  namespace: harmony-inventory-agent
+spec:
+  selector:
+    matchLabels:
+      app: harmony-inventory-agent
+  template:
+    metadata:
+      labels:
+        app: harmony-inventory-agent
+    spec:
+      serviceAccountName: harmony-inventory-agent
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+      tolerations:
+      - key: "node-role.kubernetes.io/master"
+        operator: "Exists"
+        effect: "NoSchedule"
+      containers:
+      - name: inventory-agent
+        image: hub.nationtech.io/harmony/harmony_inventory_agent
+        imagePullPolicy: Always
+        env:
+          - name: RUST_LOG
+            value: "harmony_inventory_agent=trace,info"
+        resources:
+          limits:
+            cpu: 200m
+            memory: 256Mi
+          requests:
+            cpu: 100m
+            memory: 128Mi
+        securityContext:
+          privileged: true
+          # optional: leave the rest unset since privileged SCC allows it
+          #
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: harmony-inventory-builder
+  namespace: harmony-inventory-agent
+spec:
+  replicas: 1
+  strategy: {}
+  selector:
+    matchLabels:
+      app: harmony-inventory-builder
+  template:
+    metadata:
+      labels:
+        app: harmony-inventory-builder
+    spec:
+      serviceAccountName: harmony-inventory-agent
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+      containers:
+      - name: inventory-agent
+        image: hub.nationtech.io/harmony/harmony_inventory_builder
+        imagePullPolicy: Always
+        env:
+          - name: RUST_LOG
+            value: "harmony_inventory_builder=trace,info"
+        resources:
+          limits:
+            cpu: 200m
+            memory: 256Mi
+          requests:
+            cpu: 100m
+            memory: 128Mi
+        securityContext:
+          privileged: true
+          # optional: leave the rest unset since privileged SCC allows it

harmony_inventory_agent/src/hwinfo.rs

@@ -1,5 +1,5 @@
 use harmony_types::net::MacAddress;
-use log::{debug, warn};
+use log::{debug, trace, warn};
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
 use std::fs;
@@ -121,20 +121,48 @@ pub struct ManagementInterface {
 
 impl PhysicalHost {
     pub fn gather() -> Result<Self, String> {
+        trace!("Start gathering physical host information");
         let mut sys = System::new_all();
+        trace!("System new_all called");
         sys.refresh_all();
+        trace!("System refresh_all called");
 
         Self::all_tools_available()?;
 
+        trace!("All tools_available success");
+
+        let storage_drives = Self::gather_storage_drives()?;
+        trace!("got storage drives");
+
+        let storage_controller = Self::gather_storage_controller()?;
+        trace!("got storage controller");
+
+        let memory_modules = Self::gather_memory_modules()?;
+        trace!("got memory_modules");
+
+        let cpus = Self::gather_cpus(&sys)?;
+        trace!("got cpus");
+
+        let chipset = Self::gather_chipset()?;
+        trace!("got chipsets");
+
+        let network_interfaces = Self::gather_network_interfaces()?;
+        trace!("got network_interfaces");
+
+        let management_interface = Self::gather_management_interface()?;
+        trace!("got management_interface");
+
+        let host_uuid = Self::get_host_uuid()?;
+
         Ok(Self {
-            storage_drives: Self::gather_storage_drives()?,
-            storage_controller: Self::gather_storage_controller()?,
-            memory_modules: Self::gather_memory_modules()?,
-            cpus: Self::gather_cpus(&sys)?,
-            chipset: Self::gather_chipset()?,
-            network_interfaces: Self::gather_network_interfaces()?,
-            management_interface: Self::gather_management_interface()?,
-            host_uuid: Self::get_host_uuid()?,
+            storage_drives,
+            storage_controller,
+            memory_modules,
+            cpus,
+            chipset,
+            network_interfaces,
+            management_interface,
+            host_uuid,
         })
     }
 
@@ -208,6 +236,8 @@ impl PhysicalHost {
             ));
         }
 
+        debug!("All tools found!");
+
         Ok(())
     }
 
@@ -231,7 +261,10 @@ impl PhysicalHost {
     fn gather_storage_drives() -> Result<Vec<StorageDrive>, String> {
         let mut drives = Vec::new();
 
+        trace!("Starting storage drive discovery using lsblk");
+
         // Use lsblk with JSON output for robust parsing
+        trace!("Executing 'lsblk -d -o NAME,MODEL,SERIAL,SIZE,ROTA,WWN -n -e 7 --json'");
         let output = Command::new("lsblk")
             .args([
                 "-d",
@@ -245,13 +278,18 @@ impl PhysicalHost {
             .output()
             .map_err(|e| format!("Failed to execute lsblk: {}", e))?;
 
+        trace!(
+            "lsblk command executed successfully (status: {:?})",
+            output.status
+        );
+
         if !output.status.success() {
-            return Err(format!(
-                "lsblk command failed: {}",
-                String::from_utf8_lossy(&output.stderr)
-            ));
+            let stderr_str = String::from_utf8_lossy(&output.stderr);
+            debug!("lsblk command failed: {stderr_str}");
+            return Err(format!("lsblk command failed: {stderr_str}"));
         }
 
+        trace!("Parsing lsblk JSON output");
         let json: Value = serde_json::from_slice(&output.stdout)
             .map_err(|e| format!("Failed to parse lsblk JSON output: {}", e))?;
 
@@ -260,6 +298,8 @@ impl PhysicalHost {
             .and_then(|v| v.as_array())
             .ok_or("Invalid lsblk JSON: missing 'blockdevices' array")?;
 
+        trace!("Found {} blockdevices in lsblk output", blockdevices.len());
+
         for device in blockdevices {
             let name = device
                 .get("name")
@@ -268,52 +308,72 @@ impl PhysicalHost {
                 .to_string();
 
             if name.is_empty() {
+                trace!("Skipping unnamed device entry: {:?}", device);
                 continue;
             }
 
+            trace!("Inspecting block device: {name}");
+
+            // Extract metadata fields
             let model = device
                 .get("model")
                 .and_then(|v| v.as_str())
                 .map(|s| s.trim().to_string())
                 .unwrap_or_default();
+            trace!("Model for {name}: '{}'", model);
 
             let serial = device
                 .get("serial")
                 .and_then(|v| v.as_str())
                 .map(|s| s.trim().to_string())
                 .unwrap_or_default();
+            trace!("Serial for {name}: '{}'", serial);
 
             let size_str = device
                 .get("size")
                 .and_then(|v| v.as_str())
                 .ok_or("Missing 'size' in lsblk device")?;
+            trace!("Reported size for {name}: {}", size_str);
             let size_bytes = Self::parse_size(size_str)?;
+            trace!("Parsed size for {name}: {} bytes", size_bytes);
 
             let rotational = device
                 .get("rota")
                 .and_then(|v| v.as_bool())
                 .ok_or("Missing 'rota' in lsblk device")?;
+            trace!("Rotational flag for {name}: {}", rotational);
 
             let wwn = device
                 .get("wwn")
                 .and_then(|v| v.as_str())
                 .map(|s| s.trim().to_string())
                 .filter(|s| !s.is_empty() && s != "null");
+            trace!("WWN for {name}: {:?}", wwn);
 
             let device_path = Path::new("/sys/block").join(&name);
+            trace!("Sysfs path for {name}: {:?}", device_path);
 
+            trace!("Reading logical block size for {name}");
             let logical_block_size = Self::read_sysfs_u32(
                 &device_path.join("queue/logical_block_size"),
             )
             .map_err(|e| format!("Failed to read logical block size for {}: {}", name, e))?;
+            trace!("Logical block size for {name}: {}", logical_block_size);
 
+            trace!("Reading physical block size for {name}");
             let physical_block_size = Self::read_sysfs_u32(
                 &device_path.join("queue/physical_block_size"),
             )
             .map_err(|e| format!("Failed to read physical block size for {}: {}", name, e))?;
+            trace!("Physical block size for {name}: {}", physical_block_size);
 
+            trace!("Determining interface type for {name}");
             let interface_type = Self::get_interface_type(&name, &device_path)?;
+            trace!("Interface type for {name}: {}", interface_type);
+
+            trace!("Getting SMART status for {name}");
             let smart_status = Self::get_smart_status(&name)?;
+            trace!("SMART status for {name}: {:?}", smart_status);
 
             let mut drive = StorageDrive {
                 name: name.clone(),
@@ -330,19 +390,31 @@ impl PhysicalHost {
 
             // Enhance with additional sysfs info if available
             if device_path.exists() {
+                trace!("Enhancing drive {name} with extra sysfs metadata");
                 if drive.model.is_empty() {
+                    trace!("Reading model from sysfs for {name}");
                     drive.model = Self::read_sysfs_string(&device_path.join("device/model"))
-                        .unwrap_or(format!("Failed to read model for {}", name));
+                        .unwrap_or_else(|_| format!("Failed to read model for {}", name));
                 }
                 if drive.serial.is_empty() {
+                    trace!("Reading serial from sysfs for {name}");
                     drive.serial = Self::read_sysfs_string(&device_path.join("device/serial"))
-                        .unwrap_or(format!("Failed to read serial for {}", name));
+                        .unwrap_or_else(|_| format!("Failed to read serial for {}", name));
                 }
+            } else {
+                trace!(
+                    "Sysfs path {:?} not found for drive {name}, skipping extra metadata",
+                    device_path
+                );
             }
 
+            debug!("Discovered storage drive: {drive:?}");
             drives.push(drive);
         }
 
+        debug!("Discovered total {} storage drives", drives.len());
+        trace!("All discovered dives: {drives:?}");
+
         Ok(drives)
     }
 
@@ -418,6 +490,8 @@ impl PhysicalHost {
             }
         }
 
+        debug!("Found storage controller {controller:?}");
+
         Ok(controller)
     }
 
@@ -486,6 +560,7 @@ impl PhysicalHost {
             }
         }
 
+        debug!("Found memory modules {modules:?}");
         Ok(modules)
     }
 
@@ -501,22 +576,30 @@ impl PhysicalHost {
             frequency_mhz: global_cpu.frequency(),
         });
 
+        debug!("Found cpus {cpus:?}");
+
         Ok(cpus)
     }
 
     fn gather_chipset() -> Result<Chipset, String> {
-        Ok(Chipset {
+        let chipset = Chipset {
             name: Self::read_dmi("baseboard-product-name")?,
             vendor: Self::read_dmi("baseboard-manufacturer")?,
-        })
+        };
+
+        debug!("Found chipset {chipset:?}");
+
+        Ok(chipset)
     }
 
     fn gather_network_interfaces() -> Result<Vec<NetworkInterface>, String> {
         let mut interfaces = Vec::new();
         let sys_net_path = Path::new("/sys/class/net");
+        trace!("Reading /sys/class/net");
 
         let entries = fs::read_dir(sys_net_path)
             .map_err(|e| format!("Failed to read /sys/class/net: {}", e))?;
+        trace!("Got entries {entries:?}");
 
         for entry in entries {
             let entry = entry.map_err(|e| format!("Failed to read directory entry: {}", e))?;
@@ -525,6 +608,7 @@ impl PhysicalHost {
                 .into_string()
                 .map_err(|_| "Invalid UTF-8 in interface name")?;
             let iface_path = entry.path();
+            trace!("Inspecting interface {iface_name} path {iface_path:?}");
 
             // Skip virtual interfaces
             if iface_name.starts_with("lo")
@@ -535,70 +619,101 @@ impl PhysicalHost {
                 || iface_name.starts_with("tun")
                 || iface_name.starts_with("wg")
             {
+                trace!(
+                    "Skipping interface {iface_name} because it appears to be virtual/unsupported"
+                );
                 continue;
             }
 
             // Check if it's a physical interface by looking for device directory
             if !iface_path.join("device").exists() {
+                trace!(
+                    "Skipping interface {iface_name} since {iface_path:?}/device does not exist"
+                );
                 continue;
             }
 
+            trace!("Reading MAC address for {iface_name}");
             let mac_address = Self::read_sysfs_string(&iface_path.join("address"))
                 .map_err(|e| format!("Failed to read MAC address for {}: {}", iface_name, e))?;
             let mac_address = MacAddress::try_from(mac_address).map_err(|e| e.to_string())?;
+            trace!("MAC address for {iface_name}: {mac_address}");
 
-            let speed_mbps = if iface_path.join("speed").exists() {
-                match Self::read_sysfs_u32(&iface_path.join("speed")) {
-                    Ok(speed) => Some(speed),
+            let speed_path = iface_path.join("speed");
+            let speed_mbps = if speed_path.exists() {
+                trace!("Reading speed for {iface_name} from {:?}", speed_path);
+                match Self::read_sysfs_u32(&speed_path) {
+                    Ok(speed) => {
+                        trace!("Speed for {iface_name}: {speed} Mbps");
+                        Some(speed)
+                    }
                     Err(e) => {
                         debug!(
-                            "Failed to read speed for {}: {} . This is expected to fail on wifi interfaces.",
+                            "Failed to read speed for {}: {} (this may be expected on Wi‑Fi interfaces)",
                             iface_name, e
                         );
                         None
                     }
                 }
             } else {
+                trace!("Speed file not found for {iface_name}, skipping");
                 None
             };
 
+            trace!("Reading operstate for {iface_name}");
             let operstate = Self::read_sysfs_string(&iface_path.join("operstate"))
                 .map_err(|e| format!("Failed to read operstate for {}: {}", iface_name, e))?;
+            trace!("Operstate for {iface_name}: {operstate}");
 
+            trace!("Reading MTU for {iface_name}");
             let mtu = Self::read_sysfs_u32(&iface_path.join("mtu"))
                 .map_err(|e| format!("Failed to read MTU for {}: {}", iface_name, e))?;
+            trace!("MTU for {iface_name}: {mtu}");
 
+            trace!("Reading driver for {iface_name}");
             let driver =
                 Self::read_sysfs_symlink_basename(&iface_path.join("device/driver/module"))
                     .map_err(|e| format!("Failed to read driver for {}: {}", iface_name, e))?;
+            trace!("Driver for {iface_name}: {driver}");
 
+            trace!("Reading firmware version for {iface_name}");
             let firmware_version = Self::read_sysfs_opt_string(
                 &iface_path.join("device/firmware_version"),
             )
             .map_err(|e| format!("Failed to read firmware version for {}: {}", iface_name, e))?;
+            trace!("Firmware version for {iface_name}: {firmware_version:?}");
 
-            // Get IP addresses using ip command with JSON output
+            trace!("Fetching IP addresses for {iface_name}");
             let (ipv4_addresses, ipv6_addresses) = Self::get_interface_ips_json(&iface_name)
                 .map_err(|e| format!("Failed to get IP addresses for {}: {}", iface_name, e))?;
+            trace!("Interface {iface_name} has IPv4: {ipv4_addresses:?}, IPv6: {ipv6_addresses:?}");
 
-            interfaces.push(NetworkInterface {
-                name: iface_name,
+            let is_up = operstate == "up";
+            trace!("Constructing NetworkInterface for {iface_name} (is_up={is_up})");
+
+            let iface = NetworkInterface {
+                name: iface_name.clone(),
                 mac_address,
                 speed_mbps,
-                is_up: operstate == "up",
+                is_up,
                 mtu,
                 ipv4_addresses,
                 ipv6_addresses,
                 driver,
                 firmware_version,
-            });
+            };
+
+            debug!("Discovered interface: {iface:?}");
+            interfaces.push(iface);
         }
 
+        debug!("Discovered total {} network interfaces", interfaces.len());
+        trace!("Interfaces collected: {interfaces:?}");
         Ok(interfaces)
     }
 
     fn gather_management_interface() -> Result<Option<ManagementInterface>, String> {
-        if Path::new("/dev/ipmi0").exists() {
+        let mgmt = if Path::new("/dev/ipmi0").exists() {
             Ok(Some(ManagementInterface {
                 kind: "IPMI".to_string(),
                 address: None,
@@ -612,11 +727,16 @@ impl PhysicalHost {
             }))
         } else {
             Ok(None)
-        }
+        };
+
+        debug!("Found management interface {mgmt:?}");
+        mgmt
     }
 
     fn get_host_uuid() -> Result<String, String> {
-        Self::read_dmi("system-uuid")
+        let uuid = Self::read_dmi("system-uuid");
+        debug!("Found uuid {uuid:?}");
+        uuid
     }
 
     // Helper methods
@@ -709,7 +829,8 @@ impl PhysicalHost {
             Ok("Ramdisk".to_string())
         } else {
             // Try to determine from device path
-            let subsystem = Self::read_sysfs_string(&device_path.join("device/subsystem"))?;
+            let subsystem = Self::read_sysfs_string(&device_path.join("device/subsystem"))
+                .unwrap_or(String::new());
             Ok(subsystem
                 .split('/')
                 .next_back()
@@ -779,6 +900,8 @@ impl PhysicalHost {
         size.map(|s| s as u64)
     }
 
+    // FIXME when scanning an interface that is part of a bond/bridge we won't get an address on the
+    // interface, we should be looking at the bond/bridge device. For example, br-ex on k8s nodes.
     fn get_interface_ips_json(iface_name: &str) -> Result<(Vec<String>, Vec<String>), String> {
         let mut ipv4 = Vec::new();
         let mut ipv6 = Vec::new();

harmony_inventory_agent/src/local_presence/advertise.rs

@@ -1,4 +1,4 @@
-use log::{debug, error, info, warn};
+use log::{debug, error, info, trace, warn};
 use mdns_sd::{ServiceDaemon, ServiceInfo};
 use std::collections::HashMap;
 
@@ -12,6 +12,7 @@ use crate::{
 /// This function is synchronous and non-blocking. It spawns a background Tokio task
 /// to handle the mDNS advertisement for the lifetime of the application.
 pub fn advertise(service_port: u16) -> Result<(), PresenceError> {
+    trace!("starting advertisement process for port {service_port}");
     let host_id = match PhysicalHost::gather() {
         Ok(host) => Some(host.host_uuid),
         Err(e) => {
@@ -20,11 +21,15 @@ pub fn advertise(service_port: u16) -> Result<(), PresenceError> {
         }
     };
 
+    trace!("Found host id {host_id:?}");
+
     let instance_name = format!(
         "inventory-agent-{}",
         host_id.clone().unwrap_or("unknown".to_string())
     );
 
+    trace!("Found host id {host_id:?}, name : {instance_name}");
+
     let spawned_msg = format!("Spawned local presence advertisement task for '{instance_name}'.");
 
     tokio::spawn(async move {

harmony_inventory_agent/src/main.rs

@@ -28,7 +28,7 @@ async fn inventory() -> impl Responder {
 async fn main() -> std::io::Result<()> {
     env_logger::init();
 
-    let port = env::var("HARMONY_INVENTORY_AGENT_PORT").unwrap_or_else(|_| "8080".to_string());
+    let port = env::var("HARMONY_INVENTORY_AGENT_PORT").unwrap_or_else(|_| "25000".to_string());
     let port = port
         .parse::<u16>()
         .expect(&format!("Invalid port number, cannot parse to u16 {port}"));

harmony_types/Cargo.toml

@@ -9,3 +9,4 @@ license.workspace = true
 serde.workspace = true
 url.workspace = true
 rand.workspace = true
+log.workspace = true

harmony_types/src/switch.rs

@@ -1,4 +1,6 @@
 use std::{fmt, str::FromStr};
+use log::trace;
+use serde::Serialize;
 
 /// Simple error type for port parsing failures.
 #[derive(Debug)]
@@ -21,7 +23,7 @@ impl fmt::Display for PortParseError {
 /// Represents the atomic, physical location of a switch port: `<Stack>/<Module>/<Port>`.
 ///
 /// Example: `1/1/1`
-#[derive(Debug, PartialEq, Eq, PartialOrd, Ord, Clone)]
+#[derive(Debug, PartialEq, Eq, PartialOrd, Ord, Clone, Serialize)]
 pub struct PortLocation(pub u8, pub u8, pub u8);
 
 impl fmt::Display for PortLocation {
@@ -70,6 +72,11 @@ impl FromStr for PortLocation {
 pub enum PortDeclaration {
     /// A single switch port defined by its location. Example: `PortDeclaration::Single(1/1/1)`
     Single(PortLocation),
+    /// A Named port, often used for virtual ports such as PortChannels. Example
+    /// ```rust
+    /// PortDeclaration::Named("1".to_string())
+    /// ```
+    Named(String),
     /// A strictly sequential range defined by two endpoints using the hyphen separator (`-`).
     /// All ports between the endpoints (inclusive) are implicitly included.
     /// Example: `PortDeclaration::Range(1/1/1, 1/1/4)`
@@ -130,8 +137,14 @@ impl PortDeclaration {
             return Ok(PortDeclaration::Set(start_port, end_port));
         }
 
-        let location = PortLocation::from_str(port_str)?;
-        Ok(PortDeclaration::Single(location))
+        match PortLocation::from_str(port_str) {
+            Ok(loc) => Ok(PortDeclaration::Single(loc)),
+            Err(e) => {
+                trace!("Failed to parse PortLocation {port_str} : {e}");
+                trace!("Falling back on named port");
+                Ok(PortDeclaration::Named(port_str.to_string()))
+            }
+        }
     }
 }
 
@@ -141,6 +154,7 @@ impl fmt::Display for PortDeclaration {
             PortDeclaration::Single(port) => write!(f, "{port}"),
             PortDeclaration::Range(start, end) => write!(f, "{start}-{end}"),
             PortDeclaration::Set(start, end) => write!(f, "{start}*{end}"),
+            PortDeclaration::Named(name) => write!(f, "{name}"),
         }
     }
 }

opnsense-config-xml/src/data/interfaces.rs

@@ -9,7 +9,7 @@ pub struct Interface {
     pub physical_interface_name: String,
     pub descr: Option<MaybeString>,
     pub mtu: Option<MaybeString>,
-    pub enable: MaybeString,
+    pub enable: Option<MaybeString>,
     pub lock: Option<MaybeString>,
     #[yaserde(rename = "spoofmac")]
     pub spoof_mac: Option<MaybeString>,
@@ -134,19 +134,15 @@ mod test {
   <interfaces>
     <paul>
       <if></if>
-      <enable/>
     </paul>
     <anotherpaul>
       <if></if>
-      <enable/>
     </anotherpaul>
     <thirdone>
       <if></if>
-      <enable/>
     </thirdone>
     <andgofor4>
       <if></if>
-      <enable/>
     </andgofor4>
   </interfaces>
   <bar>foo</bar>

opnsense-config-xml/src/data/opnsense.rs

@@ -17,7 +17,7 @@ pub struct OPNsense {
     pub interfaces: NamedList<Interface>,
     pub dhcpd: NamedList<DhcpInterface>,
     pub snmpd: Snmpd,
-    pub syslog: Option<Syslog>,
+    pub syslog: Syslog,
     pub nat: Nat,
     pub filter: Filters,
     pub load_balancer: Option<LoadBalancer>,
@@ -190,12 +190,12 @@ pub struct System {
     pub webgui: WebGui,
     pub usevirtualterminal: u8,
     pub disablenatreflection: Option<String>,
-    pub disableconsolemenu: Option<u8>,
+    pub disableconsolemenu: u8,
     pub disablevlanhwfilter: u8,
     pub disablechecksumoffloading: u8,
     pub disablesegmentationoffloading: u8,
     pub disablelargereceiveoffloading: u8,
-    pub ipv6allow: u8,
+    pub ipv6allow: Option<u8>,
     pub powerd_ac_mode: String,
     pub powerd_battery_mode: String,
     pub powerd_normal_mode: String,
@@ -216,7 +216,7 @@ pub struct System {
     pub maximumfrags: Option<MaybeString>,
     pub aliasesresolveinterval: Option<MaybeString>,
     pub maximumtableentries: Option<MaybeString>,
-    pub language: Option<String>,
+    pub language: String,
     pub dnsserver: Option<MaybeString>,
     pub dns1gw: Option<String>,
     pub dns2gw: Option<String>,
@@ -226,6 +226,7 @@ pub struct System {
     pub dns6gw: Option<String>,
     pub dns7gw: Option<String>,
     pub dns8gw: Option<String>,
+    pub prefer_ipv4: Option<String>,
     pub dnsallowoverride: u8,
     pub dnsallowoverride_exclude: Option<MaybeString>,
 }
@@ -233,16 +234,16 @@ pub struct System {
 #[derive(Default, PartialEq, Debug, YaSerialize, YaDeserialize)]
 pub struct Ssh {
     pub group: String,
-    pub noauto: Option<u8>,
-    pub interfaces: Option<MaybeString>,
-    pub kex: Option<MaybeString>,
-    pub ciphers: Option<MaybeString>,
-    pub macs: Option<MaybeString>,
-    pub keys: Option<MaybeString>,
-    pub enabled: Option<String>,
-    pub passwordauth: Option<u8>,
-    pub keysig: Option<MaybeString>,
-    pub permitrootlogin: Option<u8>,
+    pub noauto: u8,
+    pub interfaces: MaybeString,
+    pub kex: MaybeString,
+    pub ciphers: MaybeString,
+    pub macs: MaybeString,
+    pub keys: MaybeString,
+    pub enabled: String,
+    pub passwordauth: u8,
+    pub keysig: MaybeString,
+    pub permitrootlogin: u8,
     pub rekeylimit: Option<MaybeString>,
 }
 
@@ -306,11 +307,11 @@ pub struct WebGui {
     pub protocol: String,
     #[yaserde(rename = "ssl-certref")]
     pub ssl_certref: String,
-    pub port: Option<MaybeString>,
+    pub port: MaybeString,
     #[yaserde(rename = "ssl-ciphers")]
-    pub ssl_ciphers: Option<MaybeString>,
-    pub interfaces: Option<MaybeString>,
-    pub compression: Option<MaybeString>,
+    pub ssl_ciphers: MaybeString,
+    pub interfaces: MaybeString,
+    pub compression: MaybeString,
     pub nohttpreferercheck: Option<u8>,
 }
 
@@ -329,6 +330,7 @@ pub struct Range {
 pub struct StaticMap {
     pub mac: String,
     pub ipaddr: String,
+    pub cid: Option<MaybeString>,
     pub hostname: String,
     pub descr: Option<MaybeString>,
     pub winsserver: MaybeString,
@@ -433,7 +435,7 @@ pub struct OPNsenseXmlSection {
     #[yaserde(rename = "Interfaces")]
     pub interfaces: Option<ConfigInterfaces>,
     #[yaserde(rename = "NodeExporter")]
-    pub node_exporter: Option<NodeExporter>,
+    pub node_exporter: Option<RawXml>,
     #[yaserde(rename = "Kea")]
     pub kea: Option<RawXml>,
     pub monit: Option<Monit>,
@@ -764,9 +766,19 @@ pub struct Jobs {
 pub struct Job {
     #[yaserde(attribute = true)]
     pub uuid: MaybeString,
-    #[yaserde(rename = "name")]
-    pub name: MaybeString,
+    pub name: Option<MaybeString>,
     // Add other fields as needed
+    pub origin: Option<MaybeString>,
+    pub enabled: Option<MaybeString>,
+    pub minutes: Option<MaybeString>,
+    pub hours: Option<MaybeString>,
+    pub days: Option<MaybeString>,
+    pub months: Option<MaybeString>,
+    pub weekdays: Option<MaybeString>,
+    pub who: Option<MaybeString>,
+    pub command: Option<MaybeString>,
+    pub parameters: Option<MaybeString>,
+    pub description: Option<MaybeString>,
 }
 
 #[derive(Default, PartialEq, Debug, YaSerialize, YaDeserialize)]
@@ -895,28 +907,28 @@ pub struct Proxy {
 #[derive(Default, PartialEq, Debug, YaSerialize, YaDeserialize)]
 pub struct ProxyGeneral {
     pub enabled: i8,
-    pub error_pages: String,
+    pub error_pages: Option<MaybeString>,
     #[yaserde(rename = "icpPort")]
     pub icp_port: MaybeString,
     pub logging: Logging,
     #[yaserde(rename = "alternateDNSservers")]
     pub alternate_dns_servers: MaybeString,
     #[yaserde(rename = "dnsV4First")]
-    pub dns_v4_first: i8,
+    pub dns_v4_first: Option<MaybeString>,
     #[yaserde(rename = "forwardedForHandling")]
-    pub forwarded_for_handling: String,
+    pub forwarded_for_handling: Option<MaybeString>,
     #[yaserde(rename = "uriWhitespaceHandling")]
-    pub uri_whitespace_handling: String,
+    pub uri_whitespace_handling: Option<MaybeString>,
     #[yaserde(rename = "enablePinger")]
     pub enable_pinger: i8,
     #[yaserde(rename = "useViaHeader")]
-    pub use_via_header: i8,
+    pub use_via_header: Option<MaybeString>,
     #[yaserde(rename = "suppressVersion")]
-    pub suppress_version: i32,
+    pub suppress_version: Option<MaybeString>,
     #[yaserde(rename = "connecttimeout")]
-    pub connect_timeout: MaybeString,
+    pub connect_timeout: Option<MaybeString>,
     #[yaserde(rename = "VisibleEmail")]
-    pub visible_email: String,
+    pub visible_email: Option<MaybeString>,
     #[yaserde(rename = "VisibleHostname")]
     pub visible_hostname: MaybeString,
     pub cache: Cache,
@@ -953,7 +965,7 @@ pub struct LocalCache {
     pub cache_mem: i32,
     pub maximum_object_size: MaybeString,
     pub maximum_object_size_in_memory: MaybeString,
-    pub memory_cache_mode: String,
+    pub memory_cache_mode: MaybeString,
     pub size: i32,
     pub l1: i32,
     pub l2: i32,
@@ -965,13 +977,13 @@ pub struct LocalCache {
 pub struct Traffic {
     pub enabled: i32,
     #[yaserde(rename = "maxDownloadSize")]
-    pub max_download_size: i32,
+    pub max_download_size: MaybeString,
     #[yaserde(rename = "maxUploadSize")]
-    pub max_upload_size: i32,
+    pub max_upload_size: MaybeString,
     #[yaserde(rename = "OverallBandwidthTrotteling")]
-    pub overall_bandwidth_trotteling: i32,
+    pub overall_bandwidth_trotteling: MaybeString,
     #[yaserde(rename = "perHostTrotteling")]
-    pub per_host_trotteling: i32,
+    pub per_host_trotteling: MaybeString,
 }
 
 #[derive(Default, PartialEq, Debug, YaSerialize, YaDeserialize)]
@@ -988,7 +1000,7 @@ pub struct ParentProxy {
 
 #[derive(Default, PartialEq, Debug, YaSerialize, YaDeserialize)]
 pub struct Forward {
-    pub interfaces: String,
+    pub interfaces: MaybeString,
     pub port: i32,
     pub sslbumpport: i32,
     pub sslbump: i32,
@@ -1033,9 +1045,9 @@ pub struct Acl {
     pub google_apps: MaybeString,
     pub youtube: MaybeString,
     #[yaserde(rename = "safePorts")]
-    pub safe_ports: String,
+    pub safe_ports: MaybeString,
     #[yaserde(rename = "sslPorts")]
-    pub ssl_ports: String,
+    pub ssl_ports: MaybeString,
     #[yaserde(rename = "remoteACLs")]
     pub remote_acls: RemoteAcls,
 }
@@ -1051,9 +1063,9 @@ pub struct RemoteAcls {
 pub struct Icap {
     pub enable: i32,
     #[yaserde(rename = "RequestURL")]
-    pub request_url: String,
+    pub request_url: MaybeString,
     #[yaserde(rename = "ResponseURL")]
-    pub response_url: String,
+    pub response_url: MaybeString,
     #[yaserde(rename = "SendClientIP")]
     pub send_client_ip: i32,
     #[yaserde(rename = "SendUsername")]
@@ -1061,7 +1073,7 @@ pub struct Icap {
     #[yaserde(rename = "EncodeUsername")]
     pub encode_username: i32,
     #[yaserde(rename = "UsernameHeader")]
-    pub username_header: String,
+    pub username_header: MaybeString,
     #[yaserde(rename = "EnablePreview")]
     pub enable_preview: i32,
     #[yaserde(rename = "PreviewSize")]
@@ -1076,9 +1088,9 @@ pub struct Authentication {
     pub method: MaybeString,
     #[yaserde(rename = "authEnforceGroup")]
     pub auth_enforce_group: MaybeString,
-    pub realm: String,
-    pub credentialsttl: i32, // This field is already in snake_case
-    pub children: i32,
+    pub realm: MaybeString,
+    pub credentialsttl: MaybeString, // This field is already in snake_case
+    pub children: MaybeString,
 }
 
 #[derive(Default, PartialEq, Debug, YaSerialize, YaDeserialize)]
@@ -1293,6 +1305,7 @@ pub struct WireguardServerItem {
     pub peers: String,
     pub endpoint: MaybeString,
     pub peer_dns: MaybeString,
+    pub debug: Option<MaybeString>,
 }
 
 #[derive(Default, PartialEq, Debug, YaSerialize, YaDeserialize)]
@@ -1477,6 +1490,7 @@ pub struct Ppp {
     pub ports: Option<MaybeString>,
     pub username: Option<MaybeString>,
     pub password: Option<MaybeString>,
+    pub provider: Option<MaybeString>,
 }
 
 #[derive(Default, PartialEq, Debug, YaSerialize, YaDeserialize)]
@@ -1595,21 +1609,3 @@ pub struct Ifgroups {
     #[yaserde(attribute = true)]
     pub version: String,
 }
-
-#[derive(Default, PartialEq, Debug, YaSerialize, YaDeserialize)]
-pub struct NodeExporter {
-    pub enabled: u8,
-    pub listenaddress: Option<MaybeString>,
-    pub listenport: u16,
-    pub cpu: u8,
-    pub exec: u8,
-    pub filesystem: u8,
-    pub loadavg: u8,
-    pub meminfo: u8,
-    pub netdev: u8,
-    pub time: u8,
-    pub devstat: u8,
-    pub interrupts: u8,
-    pub ntp: u8,
-    pub zfs: u8,
-}

opnsense-config/src/config/config.rs

@@ -5,8 +5,7 @@ use crate::{
     error::Error,
     modules::{
         caddy::CaddyConfig, dhcp_legacy::DhcpConfigLegacyISC, dns::UnboundDnsConfig,
-        dnsmasq::DhcpConfigDnsMasq, load_balancer::LoadBalancerConfig,
-        node_exporter::NodeExporterConfig, tftp::TftpConfig,
+        dnsmasq::DhcpConfigDnsMasq, load_balancer::LoadBalancerConfig, tftp::TftpConfig,
     },
 };
 use log::{debug, info, trace, warn};
@@ -14,7 +13,6 @@ use opnsense_config_xml::OPNsense;
 use russh::client;
 use serde::Serialize;
 use sha2::Digest;
-use tokio::time::{sleep, Duration};
 
 use super::{ConfigManager, OPNsenseShell};
 
@@ -73,10 +71,6 @@ impl Config {
         LoadBalancerConfig::new(&mut self.opnsense, self.shell.clone())
     }
 
-    pub fn node_exporter(&mut self) -> NodeExporterConfig<'_> {
-        NodeExporterConfig::new(&mut self.opnsense, self.shell.clone())
-    }
-
     pub async fn upload_files(&self, source: &str, destination: &str) -> Result<String, Error> {
         self.shell.upload_folder(source, destination).await
     }
@@ -156,8 +150,7 @@ impl Config {
 
     async fn reload_config(&mut self) -> Result<(), Error> {
         info!("Reloading opnsense live config");
-        let (opnsense, _sha2) = Self::get_opnsense_instance(self.repository.clone()).await?;
-        self.opnsense = opnsense;
+        let (opnsense, sha2) = Self::get_opnsense_instance(self.repository.clone()).await?;
         Ok(())
     }
 

opnsense-config/src/modules/dhcp_legacy.rs

@@ -86,10 +86,7 @@ impl<'a> DhcpConfigLegacyISC<'a> {
             mac,
             ipaddr: ipaddr.to_string(),
             hostname,
-            descr: Default::default(),
-            winsserver: Default::default(),
-            dnsserver: Default::default(),
-            ntpserver: Default::default(),
+            ..Default::default()
         };
 
         existing_mappings.push(static_map);
@@ -126,9 +123,7 @@ impl<'a> DhcpConfigLegacyISC<'a> {
                 ipaddr: entry["ipaddr"].as_str().unwrap_or_default().to_string(),
                 hostname: entry["hostname"].as_str().unwrap_or_default().to_string(),
                 descr: entry["descr"].as_str().map(MaybeString::from),
-                winsserver: MaybeString::default(),
-                dnsserver: MaybeString::default(),
-                ntpserver: MaybeString::default(),
+                ..Default::default()
             })
             .collect();
 

opnsense-config/src/modules/mod.rs

@@ -4,5 +4,4 @@ pub mod dhcp_legacy;
 pub mod dns;
 pub mod dnsmasq;
 pub mod load_balancer;
-pub mod node_exporter;
 pub mod tftp;

opnsense-config/src/modules/node_exporter.rs

@@ -1,54 +0,0 @@
-use std::sync::Arc;
-
-use opnsense_config_xml::{NodeExporter, OPNsense};
-
-use crate::{config::OPNsenseShell, Error};
-
-pub struct NodeExporterConfig<'a> {
-    opnsense: &'a mut OPNsense,
-    opnsense_shell: Arc<dyn OPNsenseShell>,
-}
-
-impl<'a> NodeExporterConfig<'a> {
-    pub fn new(opnsense: &'a mut OPNsense, opnsense_shell: Arc<dyn OPNsenseShell>) -> Self {
-        Self {
-            opnsense,
-            opnsense_shell,
-        }
-    }
-
-    pub fn get_full_config(&self) -> &Option<NodeExporter> {
-        &self.opnsense.opnsense.node_exporter
-    }
-
-    fn with_node_exporter<F, R>(&mut self, f: F) -> Result<R, &'static str>
-    where
-        F: FnOnce(&mut NodeExporter) -> R,
-    {
-        match &mut self.opnsense.opnsense.node_exporter.as_mut() {
-            Some(node_exporter) => Ok(f(node_exporter)),
-            None => Err("node exporter is not yet installed"),
-        }
-    }
-
-    pub fn enable(&mut self, enabled: bool) -> Result<(), &'static str> {
-        self.with_node_exporter(|node_exporter| node_exporter.enabled = enabled as u8)
-            .map(|_| ())
-    }
-
-    pub async fn reload_restart(&self) -> Result<(), Error> {
-        self.opnsense_shell
-            .exec("configctl node_exporter stop")
-            .await?;
-        self.opnsense_shell
-            .exec("configctl template reload OPNsense/NodeExporter")
-            .await?;
-        self.opnsense_shell
-            .exec("configctl node_exporter configtest")
-            .await?;
-        self.opnsense_shell
-            .exec("configctl node_exporter start")
-            .await?;
-        Ok(())
-    }
-}