OpenNebula

The security model we have adopted for our environment does not permit ssh connectivity between the hosts in our VM cluster. All operations are initiated from the OpenNebula server. The idea here is that a compromise on one host does not lead to a compromise of the entire cluster.

This model works fine with the stock libvirt tools. For example:

virsh -c qemu+ssh://host0/system migrate --live guest0 qemu+ssh://host1/system

This will contact host0 over ssh and host1 over ssh, which will then talk to each other over a TCP channel selected by KVM.

This doesn't work with OpenNebula out of the box, because the "migrate" action is unilaterally initiated on the source host (host0 in the above example), which will then try to contact host1 over ssh. The attached patch introduces the "--local" (-L) option to one_vmm_ssh.rb, which accepts a comma-delimited list of actions that should be initiated on the OpenNebula server via local_action() rather than on a remote system via remotes_action(). This logic is currently implemented for the 'poll' and 'migrate' actions.

The patch does not modify the default behavior of OpenNebula.

The patch also introduces the "migrate_local" command to handle the local migrate action.

These changes are against "release-2.2" in the git tree.

With this patch in place, our VMM_MAD definition in oned.conf looks like this:

VM_MAD = [
name = "vmm_kvm",
executable = "one_vmm_ssh",
arguments = "-t 15 -r 0 -L migrate kvm",
default = "vmm_ssh/vmm_ssh_kvm.conf",
type = "kvm" ]

And the hosts only accept ssh connections originating from the OpenNebula server.