Nova doesn't update vnc listen address during migration with libvirt

[Dmitry Borodaenko]

Nova should update VNC listen address in libvirt.xml to the destination node's vncserver_listen setting on completing migration. Without that, the only way to make VMs accessible over VNC after migration is to set vncserver_listen to 0.0.0.0 as recommended in:

http://docs.openstack.org/havana/config-reference/content/configuring-openstack-compute-basics.html#section_configuring-compute-migrations

which is a suboptimal solution from security standpoint.

[wangpan (hzwangpan)]

you may config vncserver_listen=127.0.0.1 to solve this issue.

[Dmitry Borodaenko (angdraug)]

vncserver_listen=127.0.0.1 by itself is not sufficient, you have to have something running on all compute nodes and forwarding vnc connections from the management network to local loopback. It is a way to make things work, but it's even less efficient than setting vncserver_listen=0.0.0.0 and firewalling off non-management networks with iptables. Fixing this in Nova would allow to get rid of such unnecessarily complex workarounds.

[Solly Ross (sross-7)]

This is a duplicate of https://bugs.launchpad.net/nova/+bug/1279563.

[Dmitry Borodaenko (angdraug)]

How is this a duplicate of a bug that was raised 2 months after this bug was raised?

[Solly Ross (sross-7)]

I apologize. I just got the order of the bugs wrong. One is a duplicate of the other. I didn't notice that this was created earlier.

[Dmitry Borodaenko (angdraug)]

No problem, thanks for picking this up!

[Sachi King (nakato)]

Work on the patch was linked against the duplicate bug, the status of this is now "fix committed".

As such I'm going to update the status to that here.

https://bugs.launchpad.net/nova/+bug/1279563

[hpcre (hpcre1)]

Does this last update mean the fix has been committed to Juno release. Or not yet ?