From Fedora Project Wiki

< FWN‎ | Beats

m (→‎Secure Guest Migration Between Hosts: s/authenication/authentication)
m (→‎Secure Guest Migration Between Hosts: s/concensus/consensus/)
Line 146: Line 146:


==== Secure Guest Migration Between Hosts ====
==== Secure Guest Migration Between Hosts ====
Chris Lalancette posted<ref>http://www.redhat.com/archives/libvir-list/2009-March/msg00094.html</ref> a request for comments on secure migration with an initial focus on <code>Qemu</code>. The proposal included two options. One leveraged existing RPC while the second created a new well known port to handle the migration. Using RPC adds a layer of authentication which may possibly be avoided in the second option by simply opening a new port in a firewall.  
Chris Lalancette posted<ref>http://www.redhat.com/archives/libvir-list/2009-March/msg00094.html</ref> a request for comments on secure migration with an initial focus on <code>Qemu</code>. The proposal included two options. One leveraged existing RPC while the second created a new well known port to handle the migration. Using RPC adds a layer of authenitcation which may possibly be avoided in the second option by simply opening a new port in a firewall.  


Sticking with existing RPC and enhancing<ref>http://www.redhat.com/archives/libvir-list/2009-March/msg00148.html</ref> the authentication system for migration seemed to be the consensus.
Sticking with existing RPC and enhancing<ref>http://www.redhat.com/archives/libvir-list/2009-March/msg00148.html</ref> the authentication system for migration seemed to be the consensus.

Revision as of 14:50, 9 March 2009


Virtualization

In this section, we cover discussion on the @et-mgmnt-tools-list, @fedora-xen-list, @libvirt-list and @ovirt-devel-list of Fedora virtualization technologies.

Contributing Writer: Dale Bewley

Enterprise Management Tools List

This section contains the discussion happening on the et-mgmt-tools list

Managing Guest OS Types

Cole Robinson created[1] a patch to provide a --list-os-options option to virt-install and virt-convert. Output from this option would be used to help users determine the appropriate argument for --os-type. The --os-type option is used to "Optimize the guest configuration for a type of operating system. This will attempt to pick the most suitable ACPI & APIC settings, optimally supported mouse drivers and generally accommodate other operating system quirks."

This touched off a discussion[2] of how such information is managed. Daniel P. Berrange pointed out shortcomings in the current approach and perscribed the following fixes, and supplied an example XML file.

  • An XML schema for defining all the information wrt to guest OS distros that is relevant to virt management tools.
  • A C library for querying the information in the XML file(s).
  • Bindings of the C library into Python/Ruby etc as needed
  • Ability for local admins to extend / override the information either by editing the XML files directly, or a pretty GUI

Cole later dropped[3] his patch and automated[4] the creation of the OS list in the virt-install man page instead.

virt-manager Storage Removal

A patch[1] from Cole Robinson "adds a storage aware delete dialog to virt-manager. When deleting a VM, we are presented with a list of storage attached to it, with an option to remove individual disks as part of the delete process."

virt-install Host Device Assignment Support

Cole Robinson added[1] "support for host device assignment to virtinst and virt-install. This adds a --host-device[2] command to "Attach a physical host device to the guest. HOSTDEV is a node device name as used by libvirt (as shown by 'virsh nodedev-list')."

Daniel P. Berrange described[3] the management options for host devices.

  • "If 'managed=yes' then libvirt will automatically detach the device from the host driver."
  • "If 'managed=no' then libvirt expects that the caller has already ensured the device is detached from the host before *ALL* attempts to start the guest, now & in the future."

This change supports the KVM PCI Device Assignment feature[4] in Fedora 11.

Fedora Virtualization List

This section contains the discussion happening on the fedora-virt list.

User Interface Makeover for virt-manager

Daniel P. Berrange pointed[1] out "there's a significant redesign of Package-x-generic-16.pngvirt-manager in progress" and brought attention to Cole Robinson's 'New VM' wizard makeover[2]. Daniel added "Many more design improvements are targetted for the next few virt-manager releases, impacting nearly every area of the UI, so keep an eye out for more UI review postings during F12 timeframe too."

New Release virtinst 0.4.2

Cole Robinson announced[1] a new virtinst release, version 0.400.2.

Package-x-generic-16.pngpython-virtinst is a module that helps build and install libvirt based virtual machines. It currently supports KVM, QEmu and Xen virtual machines. Package includes several command line utilities, including virt-install (build and install new VMs) and virt-clone (clone an existing virtual machine).

New features:

  • New virt-clone option --original-xml, allows cloning a guest from an xml file, rather than require an existing, defined guest.
  • New virt-install option --import, allows creating a guest from an existing disk image, bypassing any OS install phase.
  • New virt-install option --host-device, for connecting a physical host device to the guest.
  • Allow specifying 'cache' value via virt-install's --disk options (Ben Kochie)
  • New virt-install option --nonetworks (John Levon)
  • Lots of backend cleanups and documentation improvements.

Fedora Xen List

This section contains the discussion happening on the fedora-xen list.

dom0 Kernel Inches Closer

Pasi Kärkkäinen walked[1] the bleeding edge while testing Xen dom0 host support. Using Fedora 10 with Xen 3.3.1-9 from Rawhide and a custom built 2.6.29-rc7 pv_ops dom0 kernel the system boots, but virt-install and virt-manager fail with the error "Unsupported virtualization type 'xen'".

It seems[2] that /sys/hypervisor/properties/capabilities is not present for some unknown reason.

Libvirt List

This section contains the discussion happening on the libvir-list.

New Release libvirt 0.6.1

Daniel Veillard announced[1] a new Package-x-generic-16.pnglibvirt release, version 0.6.1.

Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes).

New features:

  • new APIs for Node device detach reattach and reset (Mark McLoughlin)
  • sVirt[2] mandatory access control support (James Morris and Dan Walsh)

Improvements:

  • don't hardcode ssh port (Guido Gunther)
  • new test cases and testing infrastructure (Jim Meyering)
  • improve the SExpr parser (John Levon)
  • proper error reporting on xend shutdown command (John Levon)
  • proper handling of errors when saving QEmu domains state (Guido Gunther)
  • revamp of the internal error memory APIs (John Levon)
  • better virsh error reporting (John Levon)
  • more daemon options to allow running multiple daemons (Jim Meyering)
  • error handling when creating a QEmu domain (Guido Gunther)
  • fix timeouts in QEmu log reading (Guido Gunther)
  • migration with xend 3.3 fixes (John Levon)
  • virsh XML dump flags cleanup (Cole Robinson)
  • fix build with loadable drivers (Maximilian Wilhelm)
  • internal XML APIs to read long long and hexa values (Mark McLoughlin)
  • function to parse node device XML descriptions and associated test (Mark McLoughlin)
  • generate network bridge names if not provided (Cole Robinson)
  • recognize ejectable media in hostdev hal driver (Cole Robinson)
  • integration of sVirt (Daniel Berrange)

There were also dozens of cleanups, documentation enhancements, portability and bug fixes.

With about five weeks since the release of 0.6.0[3], Daniel added "So quite a bit of changes happened in one month of development, so it's getting clear we aren't really slowing down and keeping a relatively fast release cycle is needed. So expect 0.6.2 in a month or so."

sVirt Support Committed

Daniel P. Berrange applied[1] the sVirt[2] patches to enable selinux support in libvirt.

Secure Guest Migration Between Hosts

Chris Lalancette posted[1] a request for comments on secure migration with an initial focus on Qemu. The proposal included two options. One leveraged existing RPC while the second created a new well known port to handle the migration. Using RPC adds a layer of authenitcation which may possibly be avoided in the second option by simply opening a new port in a firewall.

Sticking with existing RPC and enhancing[2] the authentication system for migration seemed to be the consensus.

Hynesim Project Interest in Libvirt

Florian Vichot of the Hynesim[1] project was interested[2] in replacing their wrappers around KVM, VirtualBox, and OpenVZ with libvirt, and so asked about support for a number of features including auxiliary TAP devices in the host to correspond with ethernet devices in the guest.