Bug 1476332 - Live migration of instance with config disk fails in nova-migration-wrapper
Live migration of instance with config disk fails in nova-migration-wrapper
Status: ON_DEV
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-nova (Show other bugs)
10.0 (Newton)
Unspecified Unspecified
high Severity high
: ---
: 7.0 (Kilo)
Assigned To: Ollie Walsh
Joe H. Rahme
: Regression, Triaged, ZStream
Depends On:
Blocks: 1481397 1481400 1481402 1481404
  Show dependency treegraph
 
Reported: 2017-07-28 12:16 EDT by Matthew Booth
Modified: 2017-08-14 16:04 EDT (History)
11 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 1481397 1481400 1481402 1481404 (view as bug list)
Environment:
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Matthew Booth 2017-07-28 12:16:44 EDT
When live migrating an instance with a config disk, the destination copies the config disk from the source over scp. This is denied by nova-migration-wrapper with:

Jul 28 11:34:51 localhost nova_migration_wrapper: Denying connection='172.17.1.19 
33100 172.17.1.17 22' command=['scp', '-r', '-f', '/var/lib/nova/instances/2979904
7-9dfd-4bfd-80fe-54115897b353/disk.config']

Note that the scp command has '-f' in place of '-t'. I believe this is because this is a remote to local copy, not a local to remote copy:

https://github.com/openssh/openssh-portable/blob/master/scp.c#L713

We also do remote to local copies during both cold and live migration when a backing file is missing because an image has been deleted from glance. In this case the destination host side-loads the file from the image cache of the source host. I suspect this issue means that this case is also broken.
Comment 1 Matthew Booth 2017-07-28 12:52:20 EDT
Fix:

/bin/nova-migration-wrapper gets:

  cold_migration_cmds = [
      ['mkdir', '-p'],
      ['rm', '-rf'],
      ['touch'],
      ['rm'],
      ['scp', '-r', '-t'],
+     ['scp', '-r', '-f'],
  ]

/etc/nova/migration/rootwrap.d/cold_migration.filters gets:

  copy_file: PathFilter, /usr/bin/scp, nova, -r, -t, /var/lib/nova/instances/
+ copy_file: PathFilter, /usr/bin/scp, nova, -r, -f, /var/lib/nova/instances/

Note You need to log in before you can comment on or make changes to this bug.