Re: Unable to migrate instance to new host

[Rohit Yadav <ro...@shapeblue.com>]

Hi Jevgeni,


After upgrading to 4.11.1.0, by default we require that hosts are secured using a new CA framework. To do that you can run provisionCertificate API against all your KVM hosts and CPVM/SSVM hosts which will secure and onboard them to use CloudStack issued x509 certificates.


By default all new KVM hosts added after one upgrades to 4.11.x will use the CA framework, however the security will not be enforced (you can still have unsecured hosts and it will still work). Only in case of VM migration, live migration of VM will not be supposed between non-homogenous hosts (i.e. when either src/target KVM host is secured but other is not).


You can read more about this here: http://docs.cloudstack.apache.org/en/4.11.1.0/adminguide/hosts.html#security


- Rohit

<https://cloudstack.apache.org>



________________________________
From: Jevgeni Zolotarjov <j....@gmail.com>
Sent: Tuesday, September 18, 2018 9:40:09 PM
To: users@cloudstack.apache.org
Subject: Unable to migrate instance to new host

We were running cloudstack 4.11.1 with 1 host.
Now we added another identical host.

The procedure completed successfully.

But the attempt to migrate instance to this new host fails with error
message:

Migration was refused connection to destination: qemu+tcp://A.B.C.D/system.
Please check libvirt configuration compatibility and firewall rules on the
source and destination hosts.

iptables configuration on both hosts is the one suggested here
http://docs.cloudstack.apache.org/projects/archived-cloudstack-installation/en/4.11/hypervisor/kvm.html#configuring-the-firewall

Please help.

rohit.yadav@shapeblue.com 
www.shapeblue.com
Amadeus House, Floral Street, London  WC2E 9DPUK
@shapeblue