- KVM module with connection configuration (local/SSH)
- VM lifecycle management (create/start/stop/destroy/delete)
- Network management (create/delete isolated virtual networks)
- Volume management (create/delete storage volumes)
- Example: OKD HA cluster deployment with OPNsense firewall
- All VMs configured for PXE boot with isolated network

The KVM module uses virsh command-line tools for management and is fully integrated with Harmony's architecture. It provides a clean Rust API for defining VMs, networks, and volumes. The example demonstrates deploying a complete OKD high-availability cluster (3 control planes, 3 workers) plus OPNsense firewall on an isolated network.

@@ -0,0 +1,140 @@
+#!/bin/bash

@@ -0,0 +176,4 @@
+    }
+
+    async fn list_static_mappings(&self) -> Vec<(MacAddress, IpAddress)> {
+        // Return primary's view — both should be identical

@@ -33,0 +39,4 @@
+    ///
+    /// Default implementation is a no-op for topologies that don't manage
+    /// firewall rules (e.g., cloud environments with security groups).
+    async fn ensure_wan_access(&self, _port: u16) -> Result<(), ExecutorError> {

@@ -90,2 +113,2 @@
-        None => return vec![],
-    };
+fn haproxy_service_to_harmony(svc: &HaproxyService) -> Option<LoadBalancerService> {
+    let listening_port = svc.bind.parse().unwrap_or_else(|_| {

@@ -0,0 +10,4 @@
+    /// Device model (e.g. "virtio")
+    pub model: String,
+    /// MAC address
+    pub mac: String,

@@ -0,0 +19,4 @@
+    /// Local hypervisor via UNIX socket. Equivalent to `qemu:///system`.
+    Local,
+    /// Remote hypervisor over SSH. Equivalent to `qemu+ssh://user@host/system`.
+    RemoteSsh { host: String, username: String },

@@ -60,6 +66,11 @@ impl<T: Topology + LoadBalancer> Interpret<T> for LoadBalancerInterpret {
             load_balancer.ensure_initialized().await?
         );
 
+        for port in &self.score.wan_firewall_ports {

@@ -332,0 +351,4 @@
+        inventory: &Inventory,
+    ) -> Result<(), InterpretError> {
+        info!("[Stage 02/Bootstrap] Waiting for bootstrap to complete...");
+        info!("[Stage 02/Bootstrap] Running: openshift-install wait-for bootstrap-complete");

@@ -0,0 +143,4 @@
+
+fn keys_dir() -> PathBuf {
+    directories::BaseDirs::new()
+        .map(|dirs| dirs.data_dir().join("harmony").join("openbao"))

@@ -0,0 +199,4 @@
+                Err(e) => !e.contains("not initialized"),
+            };
+
+            if is_initialized {

@@ -0,0 +358,4 @@
+            self.bao(
+                k8s,
+                root_token,
+                &[

@@ -0,0 +390,4 @@
+            None => return Ok(()),
+        };
+
+        let _ = self