[GitHub] rhtyd commented on a change in pull request #2505: CLOUDSTACK-10333: Secure Live VM Migration for KVM

[GitBox <gi...@apache.org>]

rhtyd commented on a change in pull request #2505: CLOUDSTACK-10333: Secure Live VM Migration for KVM
URL: https://github.com/apache/cloudstack/pull/2505#discussion_r176992386
 
 

 ##########
 File path: debian/cloudstack-agent.postinst
 ##########
 @@ -50,6 +50,13 @@ case "$1" in
             mkdir /etc/libvirt/hooks
         fi
         cp -a /usr/share/cloudstack-agent/lib/libvirtqemuhook /etc/libvirt/hooks/qemu
+
+        # Enable TLS enabled VM migration for libvirtd
+        if ! iptables-save | grep -- "-A INPUT -p tcp -m tcp --dport 16514 -j ACCEPT" > /dev/null; then
+            iptables -t filter -A INPUT -p tcp -m tcp --dport 16514 -j ACCEPT
+            iptables-save > /etc/iptables/rules.v4
+        fi
+
 
 Review comment:
   The `cloudstack-setup-agent` reconfigures libvirtd config and also adds iptables rules for several ports, the post-install script (both rpm+deb) does a test if expected iptables rules are in place and adds the ACCEPT rule only if needed.
   
   Given not all users may use a config mgmt system such as chef/puppet/ansible, running the commands as part of post-install script will save the additional work they may need to do themselves (manually or automated). @wido I'm okay to advise users via release/admin docs, but I don't see any negative/side-effects with the change.

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services