console doesn't work with VMware driver

[anton klyushkin]

Hi!

Openstack documentation for Yoga says that about mks console access with VMware backend:
--------
MKS¶
MKS is the protocol used for accessing the console of a virtual machine running on VMware vSphere. It is very similar to VNC. Due to the architecture of the VMware vSphere hypervisor, it is not necessary to run a console proxy service.

Configuration¶
To enable the MKS console service, only the nova-compute service must be configured. All options are defined in the mks group.

The nova-compute service requires the following options to configure MKS console support.

mks.enabled

mks.mksproxy_base_url

For example, to configure this via a nova.conf file:

[mks]
enabled = True
mksproxy_base_url = https://127.0.0.1:6090/

About nova-consoleauth¶
The now-removed nova-consoleauth service was previously used to provide a shared service to manage token authentication that the client proxies outlined below could leverage. Token authentication was moved to the database in 18.0.0 (Rocky) and the service was removed in 20.0.0 (Train).
-------

>>Due to the architecture of the VMware vSphere hypervisor, it is not necessary to run a console proxy service.

It seems like not true, or given information is not clear. How could it work without proxy?
vCenter mks architecture provides mks access directly to ESXi host.
https://vdc-download.vmware.com/vmwb-repository/dcr-public/8c1815ce-2f69-4b0b-a50c-ed8b305c22c0/e01e3448-99e8-4b7c-b26b-f0f02c45fb91/GUID-635B3A9F-C62E-4A97-9FAB-FBCAA3914FDA.html
and it is not acceptable for cloud solutions give an access for client to internal management networks.

I tried mksproxy module:
https://opendev.org/x/nova-mksproxy
But it was written 6y ago and still uses consoleauth which is deprecated and removed, and therefore doesn't work.
Looks like there is no working solution for VMware backend driver to work with console.
Am I missing something?

Thanks.

[melanie witt (melwitt)]

I know very little about VMware but based on some searching around [1][2][3], what you need is WebMKS proxy from VMware [2]:

"...WebMKS proxy which starts proxying between client and corresponding vCenter server where instance runs. In order to use the web based console access, WebMKS proxy should be installed and configured"

It was weirdly difficult to find docs about it but these [4][5] should give some clues.

Based on this, it looks like the doc you quoted meant that you will not run any console proxy provided by nova. But you will need *a* proxy.

I suspect that the only nova issue here is a lack of clarity in the nova docs and we can update that to remove ambiguity and give more information.

Please take a look at the various docs I linked and let us know if you still have problems after getting WebMKS up and running.

I'm going to mark this bug as Incomplete while we await feedback from you. When you reply you can set the bug to New again to alert us to your response.

[1] https://specs.openstack.org/openstack/nova-specs/specs/liberty/implemented/vmware-webmks-console.html
[2] https://docs.openstack.org/nova/latest/configuration/config.html#mks.mksproxy_base_url
[3] https://docs.openstack.org/api-ref/compute/?expanded=create-console-detail
[4] https://vdc-download.vmware.com/vmwb-repository/dcr-public/8c1815ce-2f69-4b0b-a50c-ed8b305c22c0/e01e3448-99e8-4b7c-b26b-f0f02c45fb91/GUID-632AC4ED-3292-4901-8CFC-1FAC4C37DA37.html
[5] https://developer.vmware.com/web/sdk/2.1.0/html-console

[anton klyushkin (aklyushkin)]

Hi, Melanie!

Thank you for you response.

regarding mks proxy, as I understand from VMware docs there is no mks proxy in vCenter.
It exists in vCloud Director, but not in vCenter.
Recently there was nova-mksproxy module in nova, but now it is removed. And old module looks like
incompatible with modern versions of nova.

I didn't find any solution for this problem. And if OpenStack is intends to be compatible with VMware, there should be a solution to provide web console access to VMs.

thank you.

[melanie witt (melwitt)]

OK, I think I understand what you are talking about now.

Looking at the nova-mksproxy you mentioned, I see it was authored by the same person who developed the MKS console support in nova.

I did not previously realize that nova-mksproxy == "WebMKS proxy" is what was referred to in the spec by, "WebMKS consoles will require deploying WebMKS proxy (similar to nova-novncproxy) that will connect compute service users to the corresponsing vCenter which provides console access to the given virtual machine."

I don't find that there was a nova-mksproxy in the nova repo, I think you might be thinking of the old nova-consoleauth service which was responsible for handling token auth for all of the various console types. Nowadays, token auth is done by accessing the nova database instead of in a separate service, and that is a change that would be needed in nova-mksproxy in order for it to work now.

I am not sure if there are any current contributors with VMware expertise who could work on that.

That aside, you should be able to use VNC console with VMware as an alternative. The VNC console is actively maintained in nova.

I'll start a convo with the nova team to discuss the MKS console situation and what action we will take.

[Launchpad Janitor (janitor)]

[Expired for OpenStack Compute (nova) because there has been no activity for 60 days.]