Re: [libvirt] [PATCH v1 00/11] Rework storage migration

On Tue, Nov 27, 2012 at 07:49:54PM +0100, Michal Privoznik wrote: > This patch set re-implements migration with storage for enough new qemu. > Currently, you can migrate a domain to a host without need for shared storage. > This is done by setting 'blk' or 'inc' attribute (representing > VIR_MIGRATE_NON_SHARED_DISK and VIR_MIGRATE_NON_SHARED_INC flags respectively) > of 'migrate' monitor command. However, the qemu implementation is > buggy and applications are advised to switch to new impementation > which, moreover, offers some nice features, like migrating only explicitly > specified disks. > > The new functionality is controlled via 'nbd-server-*' and 'drive-mirror' > commands. The flow is meant to look like this: > > 1) User invokes libvirt's migrate functionality. > > 2) libvirt checks that no block jobs are active on the source. > > 3) libvirt starts the destination QEMU and sets up the NBD server using the > nbd-server-start and nbd-server-add commands. > > 4) libvirt starts drive-mirror with a destination pointing to the remote NBD > server, for example nbd:host:port:exportname=diskname (where diskname is the > -drive id specified on the destination). This is where I have a problem with automatically using the new impl. If we consider that we need to allow multiple concurrent migrations, We are introducing a requirement to open arbitrary number of ports in the firewall. This data stream is also cleartext without any encryption, even using an encrypted qcow2 disk won't help, since we're transferring the logical guest side blocks, not the physical host side blocks. What you have here is fine in the direct migration case, since we already require arbitrary open ports and non-encrypted data stream. If the user has requested TUNNELLED migration, we need follow up work done. We need the NBD server to be able to accept a pre-opened file descriptor to rather than listening on a TCP host/port, and then for libvirtd to tunnel the data stream somehow. Alternatively just use the old impl in the TUNNELLED case.