Revert "Make libvirt safe again"
This reverts commit 53a64cb871eb6889571a09e69c787681ba83e41c.
This commit was based on a wrong assumption that the default port
is not used during live migration.
In fact, while libvirt can use another range of port during
live migration for copying disks and memory,
the main control channel still happens over connection
to the port 16509 (default in /etc/libvirt/libvirtd.conf).
Blocking this port manifests as
Live Migration failure: operation failed:
Failed to connect to remote libvirt URI
qemu+tcp://cmp02/system: unable to connect
to server at 'cmp02:16509': Connection timed out
error in nova-compute log when attempting to perform a live migration.
Change-Id: I336a36cc5acc3c07cef3964bd889623b24324ce2
Related-Issue: PROD-15929
diff --git a/nova/compute/cluster.yml b/nova/compute/cluster.yml
index e8b29cc..5d0e6a1 100644
--- a/nova/compute/cluster.yml
+++ b/nova/compute/cluster.yml
@@ -1,6 +1,5 @@
classes:
- service.nova.compute.kvm
-- service.iptables.server
parameters:
_param:
nova_vncproxy_url: https://${_param:cluster_public_host}:6080
@@ -95,15 +94,3 @@
public_key: ${_param:nova_compute_ssh_public}
private_key: ${_param:nova_compute_ssh_private}
my_ip: ${_param:single_address}
- libvirt:
- uri: qemu+unix:///system?socket=/var/run/libvirt/libvirt-sock
- iptables:
- service:
- enabled: true
- chain:
- INPUT:
- rules:
- # deny any connections to libvirt port
- - destination_port: 16509
- protocol: tcp
- jump: DROP
\ No newline at end of file
diff --git a/nova/compute/single.yml b/nova/compute/single.yml
index d5126df..b915145 100644
--- a/nova/compute/single.yml
+++ b/nova/compute/single.yml
@@ -2,7 +2,6 @@
- nova
classes:
- service.nova.compute.kvm
-- service.iptables.server
parameters:
_param:
nova_vncproxy_url: https://${_param:cluster_public_host}:6080
@@ -91,15 +90,3 @@
public_key: ${_param:nova_compute_ssh_public}
private_key: ${_param:nova_compute_ssh_private}
my_ip: ${_param:single_address}
- libvirt:
- uri: qemu+unix:///system?socket=/var/run/libvirt/libvirt-sock
- iptables:
- service:
- enabled: true
- chain:
- INPUT:
- rules:
- # deny any connections to libvirt port
- - destination_port: 16509
- protocol: tcp
- jump: DROP
\ No newline at end of file