Bug 1301025

Summary: [OSP16][RFE][Deployment][TestOnly] Secure data transport between QEMU servers for migration
Product: Red Hat OpenStack Reporter: Daniel Berrangé <berrange>
Component: openstack-tripleo-heat-templatesAssignee: Martin Schuppert <mschuppe>
Status: CLOSED ERRATA QA Contact: Paras Babbar <pbabbar>
Severity: high Docs Contact:
Priority: high    
Version: 7.0 (Kilo)CC: amodi, ccopello, dasmith, egallen, eglynn, fduthill, jhakimra, kchamart, lyarwood, mbooth, mburns, mschuppe, nlevinki, nwolf, owalsh, sbauza, scohen, sgordon, srevivo, vromanso
Target Milestone: Upstream M2Keywords: FutureFeature, TestOnly, Triaged, ZStream
Target Release: 16.0 (Train on RHEL 8.1)   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: openstack-tripleo-heat-templates-11.3.1-0.20191022072831.698e7db.el8ost puppet-nova-15.4.1-0.20191014175323.e6628d6.el8ost puppet-tripleo-11.3.1-0.20191022051220.c97dbd1.el8ost Doc Type: Enhancement
Doc Text:
Story Points: ---
Clone Of:
: 1625597 1665042 (view as bug list) Environment:
Last Closed: 2020-02-06 14:37:21 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1300769, 1300772, 1544869, 1625597, 1771807    
Bug Blocks: 1414999, 1415007, 1664790, 1769732    

Description Daniel Berrangé 2016-01-22 11:12:25 UTC 
Description of problem:
The default QEMU migration transport runs a clear text TCP connection between the two QEMU servers. It is possible to tunnel the migration connection over libvirtd's secure connection but this imposes a significant performance penalty. It is also not possible to tunnel the NBD connection use for block migration at all.

As a step towards securing the management network we need to have Nova configure QEMU to use native TLS support on its migration and NBD data transports, without any tunnelling.
Comment 4 Kashyap Chamarthy 2018-04-05 16:45:20 UTC 
This depends on the libvirt support for TLS encryption for NBD disks.  Refer the following libvirt RFE bug in-progress:

https://bugzilla.redhat.com/show_bug.cgi?id=1544869 -- RFE: add support for 
native TLS encryption for NBD disk access
Comment 7 Martin Schuppert 2019-01-10 14:51:02 UTC 
*** Bug 1415007 has been marked as a duplicate of this bug. ***
Comment 10 Erwan Gallen 2019-05-17 09:34:50 UTC 
*** Bug 1625597 has been marked as a duplicate of this bug. ***
Comment 16 errata-xmlrpc 2020-02-06 14:37:21 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2020:0283