openstack-ansible-os_nova/templates/libvirtd.conf.j2
James Gibson ad8bda5f64 Enable TLS for live migrations
Instead of using SSH to live migrate VM's use TLS as this is more
secure and SSH migrations are deprecated.
https://docs.openstack.org/nova/xena/admin/secure-live-migration-with-qemu-native-tls.html
A pre-existing PKI (Public Key Infrastruture) setup is required.

TLS live migrations require that all compute hosts can communcate
with each other on port 16514 and port range 49152 to 49261.

To enable TLS live migrations, both libvirt and QEMU require server
and client certificates, the server certicicates is used to verify
servers and the client cert is used by servers to authenticate
clients. A single cert is created by the pki role, that can be
used by both libvirt and QEMU for both client and server auth.

The client, server and CA certifcates need to installed in a
number of locations on each compute host:
* For Libvirt https://libvirt.org/tlscerts.html
* For QEMU https://github.com/libvirt/libvirt/blob/master/src/qemu/qemu.conf

Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/815007
Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/815849
Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/816857

Change-Id: Iddbe8764bb6d3cd3eaee122b2d5ddc02fa3f7662
2021-11-09 09:11:24 +00:00

23 lines
837 B
Django/Jinja

# {{ ansible_managed }}
{% if debug | bool %}
# enabling debug mode according to http://wiki.libvirt.org/page/DebugLogs
log_level = 1
log_filters="{{ nova_libvirtd_debug_log_filters }}"
log_outputs="1:file:/var/log/libvirt/libvirtd.log"
{% endif %}
# Flag listening for secure TLS connections on the public TCP/IP port.
# NB, must pass the --listen flag to the libvirtd process for this to
# have any effect.
listen_tls = {{ nova_libvirtd_listen_tls }}
# Listen for unencrypted TCP connections on the public TCP/IP port.
# NB, must pass the --listen flag to the libvirtd process for this to
# have any effect.
listen_tcp = {{ nova_libvirtd_listen_tcp }}
unix_sock_group = "{{ libvirt_group }}"
unix_sock_ro_perms = "0777"
unix_sock_rw_perms = "0770"
auth_unix_ro = "none"
auth_unix_rw = "none"
auth_tcp = "{{ nova_libvirtd_auth_tcp }}"