is it still true that vncserver_listen must be set to 0.0.0.0 for live migration to work?

Bug #1660099 reported by Daniel RJ Rooke on 2017-01-29
12
This bug affects 1 person
Affects Status Importance Assigned to Milestone
puppet-nova
High
Emilien Macchi
tripleo
High
Juan Antonio Osorio Robles

Bug Description

On a redhat osp9 (liberty) openstack deployment, we have routable mgmt ips in the compute nodes. Setting vncserver_listen allows unproxied access to vnc consoles. We would like to set to the internal api network, but found this code in puppet-nova/spec/classes/nova_compute_libvirt_spec.rb

 raise_error(Puppet::Error, /For migration support to work, you MUST set vncserver_listen to '0.0.0.0' or '::0'/) }

Is this true anymore? I was able to set vncserver_listen to the internalapi ip on two compute hosts and could still live migrate between the two. The vnc listen address was updated during the migration process to the ip for the destination compute host.

Could this be an outdated assumption?

Changed in puppet-nova:
status: New → Triaged
importance: Undecided → High
assignee: nobody → Emilien Macchi (emilienm)
assignee: Emilien Macchi (emilienm) → nobody
Daniel Berrange (berrange) wrote :

> raise_error(Puppet::Error, /For migration support to work, you MUST set vncserver_listen to '0.0.0.0' or '::0'/) }

This message is very outdated. The restriction was fixed in nova years ago with

commit ea7da5152cdca7ba674e2137c3899909995e2287
Author: Solly Ross <email address hidden>
Date: Tue Feb 4 14:27:51 2014 -0500

    Change listen address on libvirt live-migration

    Previously, in order for libvirt live migration to work,
    the graphics listen addresses (VNC and/or Spice) had to be
    set on both machines to be 0.0.0.0 or ::. This was because libvirt
    would try to rebind to the source address on the destination
    machine, but would fail due to the source machine already having
    that address (this would not happen for 0.0.0.0 or ::, however).

    Now, a modified copy of the instance's XML is passed to libvirt's
    migrate function, such that the listen addresses are that of the
    destination machine. The addresses are stashed in the pre-migration
    data by the destination pre-migration method.

    Note that this functionality will only work on versions of libvirt
    with the VIR_DOMAIN_XML_MIGRATABLE flag. If the flag is not detected
    (anything vanilla libvirt less than 1.0.0), the live migration code
    will fall back to the old method.

    Fixes: bug #1279563

    Change-Id: I6c9500283027193179c11d18ad4242e165a9ad6e

Changed in puppet-nova:
assignee: nobody → Emilien Macchi (emilienm)
status: Triaged → In Progress

Reviewed: https://review.openstack.org/426812
Committed: https://git.openstack.org/cgit/openstack/puppet-nova/commit/?id=14129857431f78d5c25dbd71b5682c9cd789ae1a
Submitter: Jenkins
Branch: master

commit 14129857431f78d5c25dbd71b5682c9cd789ae1a
Author: Emilien Macchi <email address hidden>
Date: Mon Jan 30 10:33:21 2017 -0500

    libvirt: allow any binding for vncserver_listen

    This change in Nova:
    https://review.openstack.org/#/c/73428/

    ... means that we no longer need to restrict vncserver_listen parameter
    to be configured on a certain binding.

    Remove this restriction so deployments can set the compute IP instead of
    0.0.0.0.

    Closes-Bug: #1660099
    Change-Id: I3fa050f94f9c95221bb71e16c70ad9128f8684dc

Changed in puppet-nova:
status: In Progress → Fix Released
Daniel RJ Rooke (rjrooke) wrote :

There's a related section in different project: puppet-tripleo/.../libvirt.pp

 # TODO(emilien): Some work needs to be done in puppet-nova to separate nova-compute config
    # when running libvirt and libvirt itself, so we allow micro-services deployments.
    if str2bool(hiera('nova::use_ipv6', false)) {
      $vncserver_listen = '::0'
    } else {
      $vncserver_listen = '0.0.0.0'
}

should I open an additional bug on that project?

thx

Emilien Macchi (emilienm) wrote :

Yes please open a bug to tripleo project.

Reviewed: https://review.openstack.org/426898
Committed: https://git.openstack.org/cgit/openstack/puppet-nova/commit/?id=3d31b1a1049b3639ce4b828414df0debae3bf9a8
Submitter: Jenkins
Branch: stable/newton

commit 3d31b1a1049b3639ce4b828414df0debae3bf9a8
Author: Emilien Macchi <email address hidden>
Date: Mon Jan 30 10:33:21 2017 -0500

    libvirt: allow any binding for vncserver_listen

    This change in Nova:
    https://review.openstack.org/#/c/73428/

    ... means that we no longer need to restrict vncserver_listen parameter
    to be configured on a certain binding.

    Remove this restriction so deployments can set the compute IP instead of
    0.0.0.0.

    Closes-Bug: #1660099
    Change-Id: I3fa050f94f9c95221bb71e16c70ad9128f8684dc
    (cherry picked from commit 14129857431f78d5c25dbd71b5682c9cd789ae1a)

tags: added: in-stable-newton

Reviewed: https://review.openstack.org/426899
Committed: https://git.openstack.org/cgit/openstack/puppet-nova/commit/?id=52c14a97b73a9f7c4a6d1475f12dbbcc77581d8a
Submitter: Jenkins
Branch: stable/mitaka

commit 52c14a97b73a9f7c4a6d1475f12dbbcc77581d8a
Author: Emilien Macchi <email address hidden>
Date: Mon Jan 30 10:33:21 2017 -0500

    libvirt: allow any binding for vncserver_listen

    This change in Nova:
    https://review.openstack.org/#/c/73428/

    ... means that we no longer need to restrict vncserver_listen parameter
    to be configured on a certain binding.

    Remove this restriction so deployments can set the compute IP instead of
    0.0.0.0.

    Closes-Bug: #1660099
    Change-Id: I3fa050f94f9c95221bb71e16c70ad9128f8684dc
    (cherry picked from commit 14129857431f78d5c25dbd71b5682c9cd789ae1a)

tags: added: in-stable-mitaka
Changed in tripleo:
importance: Undecided → High
status: New → Triaged
assignee: nobody → Emilien Macchi (emilienm)
milestone: none → ocata-rc1

Fix proposed to branch: master
Review: https://review.openstack.org/427339

Changed in tripleo:
status: Triaged → In Progress
Changed in tripleo:
assignee: Emilien Macchi (emilienm) → Juan Antonio Osorio Robles (juan-osorio-robles)

Reviewed: https://review.openstack.org/427908
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=064f7d6b444d909636c2fc0f97fa4215d96381f2
Submitter: Jenkins
Branch: master

commit 064f7d6b444d909636c2fc0f97fa4215d96381f2
Author: Juan Antonio Osorio Robles <email address hidden>
Date: Wed Feb 1 22:35:42 2017 +0200

    Configure VNC Server listen address through t-h-t

    This adds an entry for libvirt (which is used by the VNC server) on
    which we can tell it via t-h-t on which IP address to listen on.

    Change-Id: Ie377c09734e9f6170daa519aed69c53fc67c366b
    Related-Bug: #1660099

Reviewed: https://review.openstack.org/427339
Committed: https://git.openstack.org/cgit/openstack/puppet-tripleo/commit/?id=6556123395c14f21de31e844426e541c141ffaaa
Submitter: Jenkins
Branch: master

commit 6556123395c14f21de31e844426e541c141ffaaa
Author: Emilien Macchi <email address hidden>
Date: Tue Jan 31 13:20:51 2017 -0500

    nova/libvirt: switch vnc server binding

    On compute nodes, instead of binding vnc server on 0.0.0.0, use the IP
    address provided by libvirt's t-h-t profile (hiera).

    Co-Authored-By: Juan Antonio Osorio Robles <email address hidden>
    Depends-On: Ie377c09734e9f6170daa519aed69c53fc67c366b
    Change-Id: If6b116b238a52144aad5e76c9edc7df6aa15313c
    Closes-Bug: #1660099

Changed in tripleo:
status: In Progress → Fix Released

This issue was fixed in the openstack/puppet-nova 10.3.0 release.

This issue was fixed in the openstack/puppet-tripleo 6.2.0 release.

Reviewed: https://review.openstack.org/442093
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=b020a128426d47a72dec3a88c54093f43752f571
Submitter: Jenkins
Branch: stable/newton

commit b020a128426d47a72dec3a88c54093f43752f571
Author: Juan Antonio Osorio Robles <email address hidden>
Date: Wed Feb 1 22:35:42 2017 +0200

    Configure VNC Server listen address through t-h-t

    This adds an entry for libvirt (which is used by the VNC server) on
    which we can tell it via t-h-t on which IP address to listen on.

    (cherry picked from commit 064f7d6b444d909636c2fc0f97fa4215d96381f2)
    Change-Id: Ie377c09734e9f6170daa519aed69c53fc67c366b
    Related-Bug: #1660099

Reviewed: https://review.openstack.org/442092
Committed: https://git.openstack.org/cgit/openstack/puppet-tripleo/commit/?id=1639496b0c002b1cf513351f9f1955b6d26d98ea
Submitter: Jenkins
Branch: stable/newton

commit 1639496b0c002b1cf513351f9f1955b6d26d98ea
Author: Emilien Macchi <email address hidden>
Date: Tue Jan 31 13:20:51 2017 -0500

    nova/libvirt: switch vnc server binding

    On compute nodes, instead of binding vnc server on 0.0.0.0, use the IP
    address provided by libvirt's t-h-t profile (hiera).

    Co-Authored-By: Juan Antonio Osorio Robles <email address hidden>
    Depends-On: Ie377c09734e9f6170daa519aed69c53fc67c366b
    Closes-Bug: #1660099
    (cherry picked from commit 6556123395c14f21de31e844426e541c141ffaaa)
    Change-Id: If6b116b238a52144aad5e76c9edc7df6aa15313c

This issue was fixed in the openstack/puppet-tripleo 5.6.0 release.

This issue was fixed in the openstack/puppet-nova 9.5.1 release.

To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Duplicates of this bug

Other bug subscribers