[libvirt-users] How to migrate over TCP without certs
by Renich Bon Ciric
Hey guys,
I have a private network and I trust it! /me hides behind trees...
So, in order to exercise my trust, I wanna migrate guests over TCP;
with and without shared storage.
This is:
- I want to migrate from host1 to host2; which have shared storage;
over TCP without certs
- I want to migrate from host1 to host99, which don't have shared
storage, over TCP without certs
I am asking because, every time I try anythng, it complains:
error: Cannot read CA certificate '/etc/pki/CA/cacert.pem': No such
file or directory
If I need to setup this cacert, no problem; point me to it!
Anyway, thank you for taking the time to read this email.
Fedora 17 x86_64
libvirt-0.9.11.5-3.fc17.x86_64
qemu-kvm-1.0.1-1.fc17.x86_64
private network on vlan2, Dual 10 Gbps bonded (20, perhaps?)
--
It's hard to be free... but I love to struggle. Love isn't asked for;
it's just given. Respect isn't asked for; it's earned!
Renich Bon Ciric
http://www.woralelandia.com/
http://www.introbella.com/
11 years, 11 months
[libvirt-users] libvirt network without dns ?
by Scott Moser
Hey,
I've opened a bug against ubuntu at [1]. I realize this is probably not
a high priority, but I was just curious if it is possible to have libvirt
configure a network and *not* run a DNS server on it (dnsmasq). Perhaps I
could convince libvirt to run dnsmasq with '--port 0'?
For my explicit use case i was hoping/expecting to run my own dns and
dhcp servers, possibly a specific server bound only to that interface (as
dnsmasq does). I just wanted libvirt to create the bridge and setup NAT
(and automatically bring the network and any configured guests on it up on
boot).
Heres what I did.
$ BRIDGE="mybr0"; IP="192.168.123.1";
$ cat > $BRIDGE.xml <<EOF
<network>
<name>$BRIDGE</name>
<forward mode='nat'/>
<bridge name='$BRIDGE' stp='off' delay='0' />
<ip address='$IP' netmask='255.255.255.0'>
</ip>
</network>
EOF
$ sudo virsh -c qemu:///system net-define $BRIDGE.xml
$ sudo virsh -c qemu:///system net-start $BRIDGE
## See, after 'start' dnsmasq is running and usable on that interface.
$ ps axw | grep dnsm | grep $BRIDGE.pid
9888 ? S 0:00 /usr/sbin/dnsmasq -u libvirt-dnsmasq --strict-order
--bind-interfaces --pid-file=/var/run/libvirt/network/mybr0.pid
--conf-file= --except-interface lo --listen-address 192.168.123.1
$ dig +short @$IP www.ubuntu.com
91.189.90.41
--
[1] https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1053408
11 years, 11 months
[libvirt-users] libvirt and lxc and puppet
by erkan yanar
Hoi,
Im running some hosts with a lot of lxc-containers (lxc-execute).
Now Im going to have a look into libvirt. So I wonder:
Are there some docs about what lxc@libvirt is supporting?
Imho you have a subset of the lxc-capabilities with libvirt.
Anyone doing by any chance the same and using puppet to deploy
(application)containers?
So I could get a recommendation which module to use,
instead of writing ma own.
Regards
Erkan
--
über den grenzen muß die freiheit wohl wolkenlos sein
11 years, 11 months
[libvirt-users] libvirt 0.10 and cephx
by Andrey Korolyov
Hello,
Current version adding 'auth_supported=none' at the end of disk path
and failing to do an authentication with specified cephx key:
<source protocol='rbd'
name='rbd/vmxxxxxxxxx:id=qemukvm:key=[cut]==:auth_supported=cephx'>
<host name='10.0.0.13' port='6789'/>
<host name='10.0.0.10' port='6789'/>
<host name='10.0.0.17' port='6789'/>
</source>
results to:
0.10.1
-drive file=rbd:rbd/vmxxxxxxxxx-YSG:id=qemukvm:key=[cut]:auth_supported=cephx:auth_supported=none:mon_host=10.0.0.13\:6789\;10.0.0.10\:6789\;10.0.0.17\:6789,if=none,id=drive-virtio-disk0,format=raw,bps_rd=80000000,bps_wr=40000000,iops_rd=400,iops_wr=200
0.9.13
-drive file=rbd:rbd/vmxxxxxxxxx-YSG:id=qemukvm:key=[cut]:auth_supported=cephx:mon_host=10.0.0.13\:6789\;10.0.0.10\:6789\;10.0.0.17\:6789,if=none,id=drive-virtio-disk0,format=raw,bps_rd=80000000,bps_wr=40000000,iops_rd=400,iops_wr=200
In ceph-devel I have mentioned incorrectly that both strings are the
same due to incorrect grep statement, so all that needs to be fixed is
an wrong parameter at the end.
Thanks!
11 years, 11 months
[libvirt-users] start failure with lxc
by Eric J Nelson
Hello,
I think I've done something to my machine, but I can't seem to figure out
what. I have now set up a very simple lxc setup to try and test this.
Here is the XML:
~> cat vm1GPU.xml
<domain type='lxc'>
<name>vm1GPU</name>
<memory>1020400</memory>
<os>
<type>exe</type>
<init>/bin/sh</init>
</os>
<vcpu>1</vcpu>
<clock offset='utc'/>
<on_poweroff>destroy</on_poweroff>
<on_reboot>restart</on_reboot>
<on_crash>destroy</on_crash>
<devices>
<emulator>/usr/libexec/libvirt_lxc</emulator>
<interface type='bridge'>
<source bridge='br0' />
</interface>
<filesystem type='mount'>
<source dir='/export/vm1gpu/root' />
<target dir='/' />
</filesystem>
<console type='pty'/>
</devices>
</domain>
Here is what I get when I try to start it.
>sudo virsh --connect lxc:// start vm1GPU
error: Failed to start domain vm1GPU
error: internal error guest failed to start: 2012-09-19 21:26:48.673+0000:
12702: info : libvirt version: 0.9.10, package: 21.el6_3.4 (CentOS
BuildSystem <http://bugs.centos.org>, 2012-08-23-18:28:26,
c6b9.bsys.dev.centos.org)
2012-09-19 21:26:48.673+0000: 12702: error : lxcControllerRun:1484 :
Failed to query file context on /export/vm1gpu/root: No data available
Now if change the target directory to something other than the root it
starts right up. Any help would be much appreciated. Thanks!
Eric
11 years, 11 months
[libvirt-users] nwfilter example for security
by Java
hi, libvirt folks,
I'm trying to use libvirt's nwfilter to achieve two goals:
1, by default all ports are closed, means that the virtual machine is
isolated.
2, only some selected ports are opened, for example, tcp 22 for ssh, tcp 80
for http web, udp 67 and 68 for dhcp.
Can somebody drop me a simple example how to do this in libvirt? I'm using
libvirt 0.10.1, the latest version.
thanks.
11 years, 11 months
[libvirt-users] Network inoperable with QEMU arm example image
by Larry Brown
I posted the following message a few days ago. Does anyone have a
minute to look at the output of the troubleshooting tools and advise
if they appear correct or if anything stands out as a problem? Or is
there another valid direction to go in to find out why the network fails?
I'm really stumped here and if there is no other direction to go in I'm
dead in the water.
So should I just start playing taps?
"I am running Fedora 16 64bit and installed libvirt. I have the VM
running with arm emulation with this one issue I can't figure out. I
used Virtual Machine Manager to manage the VM and can access its console
there. The Ethernet appears to be eth1 and the guest can set an IP on
it etc. However, I cannot see any traffic from the Host when dumping
any of the interfaces. I've tried several combinations of network
setups using the GUI and none appear to work. Optimally I'd like to
bridge to my primary interface (em1) and be able to pull an address and
talk directly to my network so I can download packages etc while in the
VM. I tried setting up networking in that fashion with:
Source Device : em1 with macvtap
Device Model: Hypervisor Default
Source Mode: Bridge
but alas I cannot pull dhcp nor can I set a static address and ping
other interfaces on the network.
It also appears that every time I start the VM it creates another vnetX
interface.
One of the troubleshooting pages I came across listed all the tools but
nothing about what to look for:
1) virsh net-list --all
Name State Autostart
-----------------------------------------
default active yes
2) brctl show
bridge name bridge id STP enabled interfaces
virbr0 8000.52540029e6c7 yes virbr0-nic
vnet0
vnet1
vnet2
vnet3
vnet4
3) sysctl net.bridge.bridge-nf-call-iptables
sysctl net.bridge.bridge-nf-call-iptables = 1
4) iptables -L -v -n
Chain INPUT (policy ACCEPT 767K packets, 189M bytes)
pkts bytes target prot opt in out source
destination
0 0 ACCEPT udp -- virbr0 * 0.0.0.0/0
0.0.0.0/0 udp dpt:53
0 0 ACCEPT tcp -- virbr0 * 0.0.0.0/0
0.0.0.0/0 tcp dpt:53
0 0 ACCEPT udp -- virbr0 * 0.0.0.0/0
0.0.0.0/0 udp dpt:67
0 0 ACCEPT tcp -- virbr0 * 0.0.0.0/0
0.0.0.0/0 tcp dpt:67
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
0 0 ACCEPT all -- * virbr0 0.0.0.0/0
192.168.122.0/24 state RELATED,ESTABLISHED
0 0 ACCEPT all -- virbr0 * 192.168.122.0/24
0.0.0.0/0
0 0 ACCEPT all -- virbr0 virbr0 0.0.0.0/0
0.0.0.0/0
0 0 REJECT all -- * virbr0 0.0.0.0/0
0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- virbr0 * 0.0.0.0/0
0.0.0.0/0 reject-with icmp-port-unreachable
Chain OUTPUT (policy ACCEPT 532K packets, 79M bytes)
pkts bytes target prot opt in out source
destination
5) ps -ef | grep dnsmasq
nobody 12382 1 0 Sep11 ? 00:00:00 /usr/sbin/dnsmasq
--strict-order --bind-interfaces
--pid-file=/var/run/libvirt/network/default.pid --conf-file=
--except-interface lo --listen-address 192.168.122.1 --dhcp-range
192.168.122.2,192.168.122.254
--dhcp-leasefile=/var/lib/libvirt/dnsmasq/default.leases
--dhcp-lease-max=253 --dhcp-no-override
6) ifconfig -a
em1 Link encap:Ethernet HWaddr 00:19:B9:48:2B:BA
inet addr:10.45.212.46 Bcast:10.45.212.255
Mask:255.255.255.0
inet6 addr: fe80::219:b9ff:fe48:2bba/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:19048593 errors:95686 dropped:154 overruns:0
frame:98437
TX packets:10619346 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:12559170813 (11.6 GiB) TX bytes:1700214519 (1.5 GiB)
Interrupt:16
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:2978074 errors:0 dropped:0 overruns:0 frame:0
TX packets:2978074 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:847201395 (807.9 MiB) TX bytes:847201395 (807.9 MiB)
macvtap0 Link encap:Ethernet HWaddr 52:54:00:AC:7F:0C
inet6 addr: fe80::5054:ff:feac:7f0c/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:294814 errors:0 dropped:0 overruns:0 frame:0
TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:500
RX bytes:42804350 (40.8 MiB) TX bytes:468 (468.0 b)
virbr0 Link encap:Ethernet HWaddr 52:54:00:29:E6:C7
inet addr:192.168.122.1 Bcast:192.168.122.255
Mask:255.255.255.0
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:621 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 b) TX bytes:43217 (42.2 KiB)
virbr0-nic Link encap:Ethernet HWaddr 52:54:00:29:E6:C7
BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:500
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
vnet0 Link encap:Ethernet HWaddr FE:54:00:AC:7F:0C
BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:38159 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:500
RX bytes:0 (0.0 b) TX bytes:1995337 (1.9 MiB)
vnet1 Link encap:Ethernet HWaddr FE:54:00:AC:7F:0C
BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:37299 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:500
RX bytes:0 (0.0 b) TX bytes:1949439 (1.8 MiB)
vnet2 Link encap:Ethernet HWaddr FE:54:00:AC:7F:0C
BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:36154 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:500
RX bytes:0 (0.0 b) TX bytes:1888745 (1.8 MiB)
vnet3 Link encap:Ethernet HWaddr FE:54:00:AC:7F:0C
BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:35068 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:500
RX bytes:0 (0.0 b) TX bytes:1832375 (1.7 MiB)
vnet4 Link encap:Ethernet HWaddr FE:54:00:AC:7F:0C
BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:207 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:500
RX bytes:0 (0.0 b) TX bytes:10896 (10.6 KiB)
7) cat /proc/sys/net/ipv4/ip_forward
1
Any help I can get to resolve this would be greatly appreciated. Very
frustrating...
Larry
11 years, 11 months
[libvirt-users] network comanline to xml
by basti
hello,
i start a kvm guest with the following comand line:
kvm -hda myimage.img -m 1024 -smp 2 \
-net nic -net tap,ifname=tap0,script=no
now a plan to start this via libvirt.
I have try to set nat via the libvirt-manager but this doesn't connect
to network.
So i try to use bridge network via the GUI and get a "non supported"
error when i use tap0 as "bridge device".
How can i "convert" the "-net nic -net tap,ifname=tap0,script=no" to a
valid libvirt-xml file?
The following example is also buggy:
<interface type='network'>
<mac address='52:54:00:46:3e:70'/>
<source network='default'/>
<target dev='tap0'/>
<model type='virtio'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'$
</interface>
thanks
11 years, 11 months
