Comment 8 for bug 1939869

Revision history for this message
Doug Szumski (dszumski) wrote :

Hopefully to clarify, the issue reported here isn't just limited to Charms, eg. we see it in Kolla Ansible environments. Specifically this part:

```
The source host FQDN is used probably the code relies on instance.host, and it's resolved as an IP address on the main network instead of the live-migration network. And the IP addresses on the main network are not on known_hosts so the key verification failed.
```

Rather than allowing `scp` over the 'main network' for some limited operations (fetching missing Glance image / copying config drive), we want /all/ migration traffic to stay on the migration network for security / QoS reasons. Ideally the existing config option `live_migration_inbound_addr` would be used to control this.

Sean helpfully pointed out that we can remove the config drive copy since the issue that addressed should now be fixed: https://review.opendev.org/c/openstack/nova/+/909122

That leaves just the corner case of copying Glance images, which are no longer available in Glance. That's at least easier to work around (by hiding instead of deleting images).

If there was interest, I could re-propose https://review.opendev.org/c/openstack/nova/+/906053 as a feature?