History | View | Annotate | Download (62.1 kB)
Revert "Implementation of TLS-protected SPICE connections"
This reverts commit b6267745ede04b3c943bc02e004bdb9347e0f564.This commit will be readded on master.
Signed-off-by: Guido Trotter <ultrotter@google.com>Reviewed-by: Michael Hanselmann <hansmi@google.com>
Revert "Add tls_ciphers and use_vdagent options"
This reverts commit 3e40b5879fa0070d6dd0e689dcfc31f20198a5a8.This commit will be readded on master.
Migration: warn the user about hv version mismatch
Add tls_ciphers and use_vdagent options
Signed-off-by: Andrea Spadaccini <spadaccio@google.com>Reviewed-by: Michael Hanselmann <hansmi@google.com>
Implementation of TLS-protected SPICE connections
Added support for TLS-protected SPICE connections:
Added SPICE TLS option and related cert paths
Add SPICE compression and streaming options
Add the following SPICE audio/image compression and video streamingdetection hypervisor options:
Add SPICE support to gnt-instance console
Also update related unit tests.
Make KVM use the QXL vga driver with SPICE
Enable by default the QXL paravirtualized graphic card if SPICE isenabled. The QXL driver is VESA compatible, so it degrades gracefully ifthe guest OS does not have QXL drivers.
Signed-off-by: Andrea Spadaccini <spadaccio@google.com>...
Use a loop to check SPICE parameters dependency
Use a loop to check if the user specified any SPICE option and SPICEsupport is disabled.
Added password for SPICE sessions
Added an optional parameter called spice_password_file that allowsthe user to protect the SPICE login with the password contained inthe specified file.
Draft implementation of QMP connection
Basic implementation of the QMP connection and related tests.
PEP8 style fixes
Identified using the “pep8” utility.
Signed-off-by: Michael Hanselmann <hansmi@google.com>Reviewed-by: Iustin Pop <iustin@google.com>
Handle network interfaces without IPs
If the user specified a network interface with no IPs, he would receivean unhelpful "list index out of range" error. Fixed that.
Signed-off-by: Andrea Spadaccini <spadaccio@google.com>Signed-off-by: Guido Trotter <ultrotter@google.com>...
Fixed potential unreferenced variable usage
I noticed a path in the code that would use spice_ip_version even ifit was not initialized. This patch fixes it.
Added basic support for SPICE
Implemented the following parameters:- spice_bind- spice_ip_version
Fixed an error in the documentation of _GetKVMVersion
Fixed an epydoc compilation error that I introduced with last commit.
Removed code duplication for calls to _GetKVMVersion
Changed NET_PORT_CHECK to REQ_NET_PORT_CHECK, to improve consistency
I originally made this change because I needed the OPT_NET_PORT_CHECK,and I am committing it even if I don't need anymore OPT_NET_PORT_CHECKbecause IMO it improves the consistency of the name of the wrappers....
Add "reboot_behavior" hypervisor flag
During instance installations, you do not want the instance to rebootand start again with the same parameters, as that will most likelyre-start the install process. Therefore, when the instance requests areboot it should instead shutdown. This flag allows this to be...
Most boring patch ever
s/'/"/ in (hopefully) the right places.
Signed-off-by: Iustin Pop <iustin@google.com>Reviewed-by: Michael Hanselmann <hansmi@google.com>
Add support for KVM keymaps
Signed-off-by: Sébastien Bocahu <zecrazytux@zecrazytux.net>Signed-off-by: Michael Hanselmann <hansmi@google.com>Reviewed-by: Michael Hanselmann <hansmi@google.com>
Adding a wrapper around connecting to kvm console
The wrapper will connect to the console, and check in the background ifthe instance is paused, unpausing it as necessary.
Signed-off-by: Stephen Shirley <diamond@google.com>Reviewed-by: Michael Hanselmann <hansmi@google.com>
Merge branch 'devel-2.4'
Reverts the patch series about console wrappers
This reverts commits 030a9cb8022b83bf43ec14dfbafd943299bc01c4 andae082df0000a785b693b2f4aa434650a81a94bdf.
There are two problems:
- Makefile.am breakage, which is trivial to revert- unittest breakage, which honestly I'm not sure how to fix and how...
Add gnt-instance start --pause
Creates the instance, but pauses execution before booting. This combinedwith 'gnt-instance console' unpausing instances means that the entireboot process can be viewed and monitored.
Signed-off-by: Stephen Shirley <diamond@google.com>...
KVM: configure bridged NICs at migration start
Commit 5d9bfd870 moved tap interface handling from KVM to Ganeti, partlyto also solve the problem of routed interfaces getting configured tooearly during live migrations, causing network anomalies. In that...
Conflicts: lib/cmdlib.py - use RequireSharedFileStorage there
Signed-off-by: Guido Trotter <ultrotter@google.com>...
Don't add ",boot=on" to disks on kvm >= 0.14
Under newer kvm this prevents the vm from starting.Ah, change!
KVM: fix per-instance stored UID value
When using the pool security model, ExecuteKVMRuntime was storing theinstance's UID using str(uid), which would result in storing theLockedUid._repr__() result:
$ cat /var/run/ganeti/kvm-hypervisor/uid/xxxxxxxxxxxxx...
Use floppy disk and a second CDROM on KVM
Hi all,this patch will add 3 new KVM parameters and a new option.
New Parameters: - floppy_image_path = "" -> Specify the floppy image to load asfloppy disk. - cdrom2_image_path = "" -> Specify a second cdrom image to load on...
KVM: use cache=none for shared disk templates
Disable host cache for externally mirrored disks to avoid cache incoherency.Without this, migrations between the same two nodes may end up in diskcorruption.
This is a runtime override of cluster defaults, mostly a workaround....
KVM: Add auxiliary functions to handle tap devices
Add two new functions, _OpenTap and _ProbeTapVnetHdr, tohypervisors.hv_kvm.
_ProbeTapVnetHdr checks if the host kernel supports the virtio net header(IFF_VNET_HDR) feature. This feature allows KVM to ask the the host kernel to...
KVM: Perform network configuration in Ganeti
This patch introduces network configuration for KVM in Ganeti.
There are three problems with having KVM perform network configuration via ifupscripts: a) Ganeti never gets to know the tap interface that is associated with an...
KVM: don't fail removing non-existing nic path
This shouldn't normally happen, but if it does no need to fail.
Use new console information in hypervisor abstraction
This makes use of the new way of returning console information from themaster daemon. Unittests are included.
Signed-off-by: Michael Hanselmann <hansmi@google.com>Reviewed-by: René Nussbaumer <rn@google.com>
hv_kvm.py: fix some lint issues introduced in 4b784cf
In particular:
- break as couple lines that were longer than 80 characters - fix a couple "comma not followed by a space" - fix an unused variable warning
Signed-off-by: Adeodato Simo <dato@google.com>...
kvm: Make _GetKVMVersion() return integers
The current code returns the major, minor and rev portions of the version ofKVM as strings. Returning them as integers makes it easier to compare.
Signed-off-by: Miguel Di Ciurcio Filho <miguel.filho@gmail.com>...
kvm: Improve network syntax and tests
The current syntax when defining a NIC uses a pair of arguments, like this:
-net tap,vlan=0 -net nic,vlan=0,model=virtio
When using this pair, internally KVM will create a VLANState structure to sendethernet frames between the guest NIC and the host tap device. This is...
Merge branch 'devel-2.2'
kvm: collapse two consecutive extend calls
Signed-off-by: Guido Trotter <ultrotter@google.com>Reviewed-by: Iustin Pop <iustin@google.com>
kvm: Introduce support for -mem-path
Using hugepages, KVM instances can get a good performance boost. Toactivate that, we need to pass the -mem-path argument to KVM along withthe mount point of the hugetlbfs file system on the node.
For the sake of memory availability computation, we use the -mem-prealloc...
KVM: Add function to check the hypervisor version
Fix migration on new KVMs
New KVMs (0.12.1.2-el6 and 0.13.5 tested) exit immediately afterunsuccessful network connection when they are in "-incoming" mode. Thesimple check netutils.TcpPing causes remote kvm to exit so the migrationwill always fail. This check is also redundant by the way as if the...
Merge branch 'devel-2.1' into devel-2.2
Conflicts: man/gnt-instance.sgml...
Introduce new IPAddress classes
This patch unifies the netutils functions dealing with IP addresses tothree classes:- IPAddress: Common IP address functionality- IPv4Address: IPv4 specific functionality- IPv6address: IPv6-specific functionality
Furthermore it adds methods to check whether an address is a loopback...
Restore 'tablet mouse on vnc' behavior
We needed to revert commit 5b062a58ac76b39c2dc6a7e1543affdf43dc7ee7because it was in conflict with the usb_mouse hv parameter. Here wereintroduce its functionality only when usb_mouse is not specified.
Revert "Add -usbdevice tablet to KVM when using vnc"
This reverts commit 5b062a58ac76b39c2dc6a7e1543affdf43dc7ee7.This fixes issue 109. The mouse type can be set with the usb_mousehv parameter.
Rename migration type to migration mode
This is in preparation for the rename of the opcode 'live' parameter to'mode'.
Signed-off-by: Iustin Pop <iustin@google.com>Reviewed-by: René Nussbaumer <rn@google.com>
Add a migration type global hypervisor parameter
Since migration live/non-live is more stable (e.g.) for Xen-PVM versusXen-HVM, we introduce a new parameter for what mode we should use bydefault (if not overridden by the user, in the opcode).
The meaning of the opcode 'live' field changes from boolean to either...
KVM hypervisor: Use utils.ShellWriter for network script
This patch converts hv_kvm to use utils.ShellWriter for writingthe network script. It also adds a few unittests (the firstfor any hypervisor modules).
Signed-off-by: Michael Hanselmann <hansmi@google.com>...
Introduce lib/netutils.py
This patch moves network utility functions to a dedicated module.
Signed-off-by: Manuel Franceschini <livewire@google.com>Reviewed-by: Iustin Pop <iustin@google.com>
Introduce utils.IsValidIP{4,6}()
This patch introduces functions to check for valid IPv4 and IPv6addresses and converts IsValidIP() to return True if it is either a IPv4or a IPv6 address.
For now we do not change the functional behavior and replace IsValidIP...
Replace '0.0.0.0' with constant
Signed-off-by: Manuel Franceschini <livewire@google.com>Reviewed-by: Guido Trotter <ultrotter@google.com>
_ExecuteKVMRuntime: fix hv parameter fun
When executing the kvm runtime we were currently accessing a mix of theparameters as configured currently on the instance and the ones it wasstarted with. We were doing it without a precise criteria, but quite by...
Update FinalizeMigration docstring
This is used not only for aborted migrations, so the docstring shouldreflect that.
Add KVM chroot feature
This patch adds a new boolean hypervisor parameter to the KVM hypervisor,named 'use_chroot'.If it's turned on for an instance, than KVM is started in "chroot mode":Ganeti creates an empty directory for the instance and passes the path...
KVM: Migration bandwidth and downtime control
Introduce 2 new hypervisor options, migration_bandwidth and migration_downtimeand implement KVM migration bandwidth and downtime control.
migration_bandwidth controls KVM's maximal bandwidth during migration, in...
KVM: vhost net acceleration support
This will only work on patched or newer (>= 2.6.34) kernels and with apatched version of qemu-kvm.
Convert some ReadFile calls to ReadOneLineFile
For passwords we require strict oneliners, we're a bit more lax with pidand uid files.
KVM: only export instance tags if present
Currently non-tagged instances fail starting with a TypeError.
Signed-off-by: Guido Trotter <ultrotter@google.com>Reviewed-by: Iustin Pop <iustin@google.com>Reviewed-by: Balazs Lecz <leczb@google.com>
KVM: make tags available in KVM_NET_SCRIPT
Make instance tags available as a space-separated list during the execution ofthe network setup script. This allows tag-based control of things like firewallrules and/or networking setup.
Add a hypervisor constant for migration support
This variable can be used by other tools to determine in a generic waywhether a given hypervisor supports migration or not.
Fix indentation error
Commit 9cf4321fc39ec36359d9c90b22b36d33b6adc2f4 indented some lines by4 spaces rather than 2, and was git-amed without noticing. Fixing.
Add -usbdevice tablet to KVM when using vnc
When using VNC, it is recommended to use a tablet-styleinput device instead of a mouse. This allows most VNC viewersto send proper mouse coordinates to the virtual machine's desktopresulting in perfectly aligned guest and host mouse pointers....
Only use boot=on on non-ide disks only (KVM)
boot=on implies that KVM boots using extboot. This is only requiredto boot non-IDE disks and has the side-effect that there is at mostone bootable device. This behaviour breaks some operating systems,most notably the windows installer that tries to chainload the hard-disk...
KVM: fix a bug in _TryReadUidFile
If the uid pool is not in use _TryReadUidFile will try to return "uid" even if it hasn't tried to read it at all.
KVM: implement the HT_SM_POOL security model
In order not to complicate to much the _ExecuteKVMRuntime function withnested try/except/finally/else constructs we move the actualruncmd+check call in a separate _RunKVMCmd function.
KVM: add an instance uid file concept
If this file exists, for an instance, we release the uid containedinside back to the uid pool, at instance shutdown.
KVM: move post-shutdown cleanup operations
Currently putting the cleanup just after the actual shutdown ensuresthat it never gets called, due to how the retry/shutdown cycle works.So we move those cleanups to their new dedicated place.
kvm_flag hypervisor parameter
Move the runas user at execution time
Everything still works the same way, but the user is calculated eachtime we start kvm, rather than stored in the config file. This makes iteasier to implement the "pool" security model.
Extend the hypervisor API with name-only shutdown
Currently the ShutdownInstance method of the hypervisors takes a fullinstance object. However, when doing instance shutdowns from the nodeonly, we don't have a full object, just the name.
To handle this use case, we add a new ‘name’ argument to the method,...
KVM: Check instances for actual liveness
Currently if we find a live process with the pid we saved we assume kvmis alive. What could happen, though, is that the pidfile has beenreused.
In order to avoid that we change the check to make sure, everywhere,...
KVM: improve GetInstanceInfo docstring
KVM: remove unused variable
We don't need the pwentry when checking if a username exists, just to besure the KeyError is not returned. Remove the variable, and thus shut uplint.
KVM: add security model and domain parameters
Initially we only support the "user" model (in which the user runningthe virtual machine can be specified as an additional parameter).
We use usernames rather than uids in this mode, because the kvm -runasflag doesn't support uids anyway, and we check the passed username for...
KVM: Remove boot restriction for paravirtual nics
Newer virtio can boot from the network perfectly well, so there's nopoint in keeping this restriction in place. This will still fail onolder kernels.
KVM: pass the instance name as the first kvm flag
This makes it the first argument show, for example under "ps".
KVM: Fix unintended qemu-level bridging of nics
Each nic should be connected to its own qemu vlan, to avoid them allbridging together.
Signed-off-by: Timothy Kuhlman <timkuhlman@gmail.com>Reviewed-by: Guido Trotter <ultrotter@google.com>Signed-off-by: Guido Trotter <ultrotter@google.com>...
hv_kvm: remove hard-coded path constructs
This switches hv_kvm to PathJoin. There are still a few cases of directpath construction, but those should be safe.
Avoid absolute path for privileged commands
Using absolute path for a privileged command is a bad idea as this path may vary.For example /usr/sbin/brctl in Debian and /sbin/brctl in ALTLinux. Using $PATH isa better idea.
Signed-off-by: Vitaly Kuznetsov <vitty@altlinux.ru>...
KVM: fix pylint warning
Specify string format arguments as logging function parameters
Signed-off-by: Guido Trotter <ultrotter@google.com>
KVM: be more resilient on broken migration answers
Before, when doing kvm live migrations we use to accept an "unknownstatus" but to reject anything that didn't match our regexp. Since we'veseen "info migrate" return a completely empty answer, we'll be more...
KVM: Abstract/rework instance up checks
This patch abstract the check "is instance stopped" into a separatefunction, and thus simplifies a couple of higher-level functions. Italso moves from manual read of the pidfile to use the (correctabstraction of) _InstancePidAlive....
KVM: Split out the pidfile computation
In some cases we only need the pidfile, but not the pid or the alivestatus.
Signed-off-by: Iustin Pop <iustin@google.com>Reviewed-by: Olivier Tharan <olive@google.com>
Remove many 'Unused variable' warnings
Note there are some cases left which need extra cleanup.
Fix use of the logging functions
The logging functions expand the arguments themselves, thus it's saferto let them do it rather than manual string formatting.
Also re-wraps one comment.
Add disk cache control parameter for KVM
This patch adds the 'cache' parameter for KVM; currently this is onlycustomisable at the hypervisor level, so it's the same for all drives(except any CDROM image, which gets the default).
Signed-off-by: Iustin Pop <iustin@google.com>...
KVM: fail when a routed nic has no ip
This shouldn't happen, but if it does it's better to fail at this level,rather than create a broken NIC script, which is hard to debug.
Fix and simplify socat escape detection
- Program paths should not be --with-… options (see Autoconf docs)- Simplify checks for escape functionality- Make SOCAT_USE_ESCAPE variable a bool
Signed-off-by: Michael Hanselmann <hansmi@google.com>Reviewed-by: Guido Trotter <ultrotter@google.com>
KVMHypervisor: fix broken error format string
Add use_localtime parameter for xen-hvm and kvm
Currently xen-hvm and kvm use different real time clock by default. Toreduce confusion, this patch adds an optional use_localtime parameter.
If the real time clock on the instance is set to local time, the...
kvm console: use socat raw mode with escape
If this is enabled at configure time, we pass in different parameters tothe socat console, making it a lot more manageable.
Migration: add check for listening target
This patch adds a check for listening on the remote port in Xen and KVMmigrations. This will be generating a single “load of migration failed”message for KVM, but otherwise not prevent the migration. For Xen (which...