Hooks, APIs, and idempotent automation

Automate through libvirt's API or declarative definitions. Treat hooks as a narrow integration boundary, not a hidden orchestration engine.

Desired-state loop

1. Read capabilities and current definitions.
2. Compute a reviewed desired state.
3. Validate XML before mutation.
4. Apply only the required delta.
5. Verify live and persistent state.
6. Emit an auditable result without secrets.

Hooks

Hook scripts execute on lifecycle boundaries and can block operations. Keep them deterministic, fast, timeout-aware, and safe when invoked more than once. Log correlation identifiers and outcomes, not credentials or full secret payloads.

find /etc/libvirt/hooks -maxdepth 2 -type f -ls
journalctl -u virtqemud -u libvirtd --since -30m

Avoid shell parsing when APIs exist

For applications, use maintained libvirt bindings and structured return values. Shelling out to virsh is reasonable for operator scripts but creates fragile parsing and error-handling boundaries at scale.