Fix live migration under xl

Until now the only way to make live migration work in conjunction with
"xl" was to add ssh known_hosts keys for every node's secondary ip on
every other node.

With this command we remove the target key verification: this is not
worse than what we were doing before with "xm", and allows the migration
to happen under either toolstack, without extra manual work. Of course
the full security of ssh is not used by live migration, then.

Signed-off-by: Guido Trotter <ultrotter@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>

diff --git a/lib/constants.py b/lib/constants.py
index 02aa6f6..e1e7057 100644 (file)
--- a/lib/constants.py
+++ b/lib/constants.py
@@ -272,6 +272,15 @@ XEN_CMD_XM = "xm"
 XEN_CMD_XL = "xl"
 # FIXME: This will be made configurable using hvparams in Ganeti 2.7
 XEN_CMD = _autoconf.XEN_CMD
+# When the Xen toolstack used is "xl", live migration requires the source host
+# to connect to the target host via ssh (xl runs this command). We need to pass
+# the command xl runs some extra info so that it can use Ganeti's key
+# verification and not fail. Note that this string is incomplete: it must be
+# filled with the cluster name before being used.
+XL_SSH_CMD = ("ssh -l root -oGlobalKnownHostsFile=%s"
+              " -oUserKnownHostsFile=/dev/null"
+              " -oCheckHostIp=no -oStrictHostKeyChecking=yes"
+              " -oHostKeyAlias=%%s") % SSH_KNOWN_HOSTS_FILE
 
 KVM_PATH = _autoconf.KVM_PATH
 KVM_KERNEL = _autoconf.KVM_KERNEL

diff --git a/lib/hypervisor/hv_xen.py b/lib/hypervisor/hv_xen.py
index 6d55dbc..6e4e224 100644 (file)
--- a/lib/hypervisor/hv_xen.py
+++ b/lib/hypervisor/hv_xen.py
@@ -32,6 +32,7 @@ from ganeti import utils
 from ganeti.hypervisor import hv_base
 from ganeti import netutils
 from ganeti import objects
+from ganeti import ssconf
 
 
 XEND_CONFIG_FILE = "/etc/xen/xend-config.sxp"
@@ -546,6 +547,8 @@ class XenHypervisor(hv_base.BaseHypervisor):
       if live:
         args.append("-l")
     elif constants.XEN_CMD == constants.XEN_CMD_XL:
+      cluster_name = ssconf.SimpleStore().GetClusterName()
+      args.extend(["-s", constants.XL_SSH_CMD % cluster_name])
       args.extend(["-C", self._ConfigFileName(instance.name)])
     else:
       raise errors.HypervisorError("Unsupported xen command: %s" %