Bug 1301025 - [OSP16][RFE][Deployment][TestOnly] Secure data transport between QEMU servers for migration
Summary: [OSP16][RFE][Deployment][TestOnly] Secure data transport between QEMU servers...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-tripleo-heat-templates
Version: 7.0 (Kilo)
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: Upstream M2
: 16.0 (Train on RHEL 8.1)
Assignee: Martin Schuppert
QA Contact: Paras Babbar
URL:
Whiteboard:
: ospd_block_based_live_migration 1625597 (view as bug list)
Depends On: 1300769 1300772 1544869 1625597 1771807
Blocks: 1414999 ospd_block_based_live_migration, ospd_block_based_live_migration 1664790 1769732
TreeView+ depends on / blocked
 
Reported: 2016-01-22 11:12 UTC by Daniel Berrangé
Modified: 2020-02-06 14:39 UTC (History)
20 users (show)

Fixed In Version: openstack-tripleo-heat-templates-11.3.1-0.20191022072831.698e7db.el8ost puppet-nova-15.4.1-0.20191014175323.e6628d6.el8ost puppet-tripleo-11.3.1-0.20191022051220.c97dbd1.el8ost
Doc Type: Enhancement
Doc Text:
Clone Of:
: 1625597 1665042 (view as bug list)
Environment:
Last Closed: 2020-02-06 14:37:21 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Launchpad 1793093 0 None None None 2018-09-18 08:28:05 UTC
OpenStack gerrit 603334 0 'None' MERGED Add support for native TLS encryption on NBD for disk migration 2021-01-18 07:23:53 UTC
OpenStack gerrit 603341 0 'None' MERGED Add support for native TLS encryption on NBD for disk migration 2021-01-18 07:23:53 UTC
OpenStack gerrit 603343 0 'None' MERGED Add support for native TLS encryption on NBD for disk migration 2021-01-18 07:24:33 UTC
OpenStack gerrit 629481 0 'None' MERGED libvirt: Support native TLS for migration and disks over NBD 2021-01-18 07:23:53 UTC
Red Hat Product Errata RHEA-2020:0283 0 None None None 2020-02-06 14:39:51 UTC

Description Daniel Berrangé 2016-01-22 11:12:25 UTC 
Description of problem:
The default QEMU migration transport runs a clear text TCP connection between the two QEMU servers. It is possible to tunnel the migration connection over libvirtd's secure connection but this imposes a significant performance penalty. It is also not possible to tunnel the NBD connection use for block migration at all.

As a step towards securing the management network we need to have Nova configure QEMU to use native TLS support on its migration and NBD data transports, without any tunnelling.
Comment 4 Kashyap Chamarthy 2018-04-05 16:45:20 UTC 
This depends on the libvirt support for TLS encryption for NBD disks.  Refer the following libvirt RFE bug in-progress:

https://bugzilla.redhat.com/show_bug.cgi?id=1544869 -- RFE: add support for 
native TLS encryption for NBD disk access
Comment 7 Martin Schuppert 2019-01-10 14:51:02 UTC 
*** Bug 1415007 has been marked as a duplicate of this bug. ***
Comment 10 Erwan Gallen 2019-05-17 09:34:50 UTC 
*** Bug 1625597 has been marked as a duplicate of this bug. ***
Comment 16 errata-xmlrpc 2020-02-06 14:37:21 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2020:0283
Note You need to log in before you can comment on or make changes to this bug.