Live migration set up
block based migration or leaving it with default
# /etc/nova/nova.conf
block_migration_flag=VIR_MIGRATE_UNDEFINE_SOURCE,VIR_MIGRATE_PEER2PEER,VIR_MIGRATE_LIVE,VIR_MIGRATE_TUNNELLED,VIR_MIGRATE_NON_SHARED_INC,VIR_MIGRATE_AUTO_CONVERGE
====TCP based======
/etc/nova/nova.conf
——————
..
[libvirt]
live_migration_uri = “qemu+tcp://%s/system”
..
/etc/libvirt/libvirtd.conf
——————
listen_tls = 0
listen_tcp = 1
unix_sock_group = “libvirt”
unix_sock_ro_perms = “0777”
unix_sock_rw
_perms = “0770”
auth_unix_ro = “none”
auth_unix_rw = “none”
auth_tcp = “none”
/etc/default/libvirtd
——————————
start_libvirtd=”yes”
libvirtd_opts=”-l”
*restart both libvirt-bin & nova-compute *
testing
virsh -c qemu+tcp://hostname_peer/system hostname
====TCP+SASL ======
install
apt update
apt install sasl2-bin
/etc/nova/nova.conf
——————
..
[libvirt]
live_migration_uri = “qemu+tcp://%s/system”
..
/etc/libvirt/libvirtd.conf
——————
listen_tls = 0
listen_tcp = 1
unix_sock_group = “libvirt”
unix_sock_ro_perms = “0777”
unix_sock_rw
_perms = “0770”
auth_unix_ro = “none”
auth_unix_rw = “none”
auth_tcp = “sasl”
/etc/default/libvirtd
——————————
start_libvirtd=”yes”
libvirtd_opts=”-l”
/etc/sasl2/libvirt.conf
—————————————
mech_list: digest-md5
sasldb_path: /etc/sasldb2
create user test and give nova as password
———
saslpasswd2 -a libvirt test
sasldblistusers2 -f /etc/sasldb2
enable libvirt client auto authenticate without prompt
——
/etc/libvirt/auth.conf
——————————
[credentials-defgrp]
authname=test
password=nova
[auth-libvirt-default]
credentials=defgrp
*restart both libvirt-bin & nova-compute *
test, should just work, with not prompt for user&password
virsh -c qemu+tcp://hostname_peer/system hostname
=====================
====TLS full validation ======
key tools
apt-get install gnutls-bin
/etc/nova/nova.conf
——————
..
[libvirt]
live_migration_uri = “qemu+tls://%s/system”
..
/etc/libvirt/libvirtd.conf
——————
listen_tls = 1
tls_no_verify_certificate = 0
tls_no_verify_address = 0
listen_tcp = 0
unix_sock_group = “libvirt”
unix_sock_ro_perms = “0777”
unix_sock_rw
_perms = “0770”
auth_unix_ro = “none”
auth_unix_rw = “none”
auth_tls = “none”
/etc/default/libvirtd
——————————
start_libvirtd=”yes”
libvirtd_opts=”-l”
generate key pairs & certs following
https://wiki.libvirt.org/page/TLSSetup
service nova-compute restart
virsh -c qemu+tls://venus-2/system hostname
virsh -c qemu+tls://venus-6/system hostname
*restart both libvirt-bin & nova-compute *
test, should just work
virsh -c qemu+tls://hostname_peer/system hostname
======================
===TLS no validation ======
key tools
apt-get install gnutls-bin
/etc/nova/nova.conf
——————
..
[libvirt]
live_migration_uri = “qemu+tls://%s/system”
..
/etc/libvirt/libvirtd.conf
——————
listen_tls = 1
tls_no_verify_certificate = 1
tls_no_verify_address = 1
listen_tcp = 0
unix_sock_group = “libvirt”
unix_sock_ro_perms = “0777”
unix_sock_rw
_perms = “0770”
auth_unix_ro = “none”
auth_unix_rw = “none”
auth_tls = “none”
/etc/default/libvirtd
——————————
start_libvirtd=”yes”
libvirtd_opts=”-l”
generate key pairs & certs following
https://wiki.libvirt.org/page/TLSSetup
service libvirt-bin restart
service nova-compute restart
virsh -c qemu+tls://host-1/system hostname
virsh -c qemu+tls://host-2/system hostname
*restart both libvirt-bin & nova-compute *
testing
virsh -c “qemu+tls://host-1/system?no_verify=1” hostname
virsh -c “qemu+tls://host-2/system?no_verify=1” hostname
========TLS no validation + SASL========
following TLS no validation
a few changes
/etc/libvirt/libvirtd.conf
——————
listen_tls = 1
tls_no_verify_certificate = 1
tls_no_verify_address = 1
listen_tcp = 0
unix_sock_group = “libvirt”
unix_sock_ro_perms = “0777”
unix_sock_rw
_perms = “0770”
auth_unix_ro = “none”
auth_unix_rw = “none”
auth_tls = “sasl”
/etc/sasl2/libvirt.conf
—————————————
mech_list: digest-md5
sasldb_path: /etc/sasldb2
- scram-sha-1 requires properly signed certs
create user test and give nova as password
———
saslpasswd2 -a libvirt test
sasldblistusers2 -f /etc/sasldb2
libvirt client auto authenticate without prompt
——
/etc/libvirt/auth.conf
——————————
[credentials-defgrp]
authname=test
password=nova
[auth-libvirt-default]
credentials=defgrp
*restart both libvirt-bin & nova-compute *
testing
virsh -c “qemu+tls://host-1/system?no_verify=1” hostname
====ssh tunneling ======
No libvirt change required
only nova.conf and generate keys for user nova
nova.conf
live_migration_uri = “qemu+ssh://nova@%s/system?no_verify=1&keyfile=/var/lib/nova/.ssh/id_rsa”
see user nova and path to its private key file is specified in the url
add public keys to authenticated hosts files.
Note: nova user login shell required.. further research required to limit set of binaries..