Automate LXD Trust Configuration
Categories:
Projects:
c2platform/c2/ansible-inventory ,
c2platform.dev
Overview
This how-to explains the automation approach for
LXD trust configuration
which is part of
Ansible Desktop Role ( c2platform.dev.desktop).
Installing
LXD via snap is straightforward, but configuring trust
requires special handling. A script with passwordless sudo can manage trust
without a logout and login cycle to activate
LXD group membership.
An Ansible development environment is single-user and relies on virtualization with VirtualBox and LXD. The C2 Platform supports handing over a development desktop to another user, who can rerun the setup script or follow these steps. The how-to also covers potential conflicts, such as an existing trust created by another user.
Problem
After installing
LXD as a snap and activating the development environment,
running a command such as vagrant status c2d-rproxy1 produces an error
indicating that the trust has not been established. This occurs because the
environment is being set up for the first time, and using the Vagrant LXD
provider requires establishing the trust before interacting with LXD.
(c2) onknows@io1:~/git/gitlab/c2/ansible-c2d$ vagrant status c2d-rproxy1
The LXD provider could not authenticate to the daemon at https://127.0.0.1:8443.
You may need configure LXD to allow requests from this machine. The
easiest way to do this is to add your LXC client certificate to LXD's
list of trusted certificates. This can typically be done with the
following command:
$ lxc config trust add /home/onknows/.vagrant.d/data/lxd/client.crt
You can find more information about configuring LXD at:
https://documentation.ubuntu.com/lxd/en/latest/howto/initialize/
Direct LXD commands also fail without group membership:
(c2) onknows@io1:~/git/gitlab/c2/ansible-c2d$ lxc ls
Error: LXD unix socket "/var/snap/lxd/common/lxd/unix.socket" not accessible: permission denied
(c2) onknows@io1:~/git/gitlab/c2/ansible-c2d$ groups
onknows sudo
Solution Using Sudo
Passwordless sudo allows checking and managing trusts without requiring active LXD group membership. List existing trusts:
sudo lxc config trust ls
Example output showing a conflicting client.crt trust:
+--------+------------+---------------+--------------+-----------------------------+-----------------------------+
| TYPE | NAME | COMMON NAME | FINGERPRINT | ISSUE DATE | EXPIRY DATE |
+--------+------------+---------------+--------------+-----------------------------+-----------------------------+
| client | client.crt | bobtestc2@io1 | 85811f508645 | Aug 6, 2026 at 7:36am (UTC) | Aug 3, 2036 at 7:36am (UTC) |
+--------+------------+---------------+--------------+-----------------------------+-----------------------------+
Remove the conflicting trust by fingerprint:
sudo lxc config trust remove 85811f508645
Add the required trust:
sudo lxc config trust add /home/onknows/.vagrant.d/data/lxd/client.crt
Verify the updated trust list:
sudo lxc config trust ls
Example output:
+--------+------------+-------------+--------------+-----------------------------+-----------------------------+
| TYPE | NAME | COMMON NAME | FINGERPRINT | ISSUE DATE | EXPIRY DATE |
+--------+------------+-------------+--------------+-----------------------------+-----------------------------+
| client | client.crt | onknows@io1 | dc2f65e73a7d | Aug 7, 2026 at 5:37am (UTC) | Aug 4, 2036 at 5:37am (UTC) |
+--------+------------+-------------+--------------+-----------------------------+-----------------------------+
Verification
Check Vagrant status:
vagrant status c2d-rproxy1
Example output:
Current machine states:
c2d-rproxy1 not created (lxd)
The environment has not yet been created. Run `vagrant up` to
create the environment. If a machine is not created, only the
default provider will be shown. So if a provider is not listed,
then the machine is not created for that environment.
Bring up the machine:
vagrant up c2d-rproxy1
This succeeds without active LXD group membership in the session.
Additional Information
- LXD: LXD is an open-source, lightweight virtualization platform that combines the strengths of traditional virtual machines with the flexibility of Docker containers to efficiently manage virtualized environments.
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.