[pve-devel] pve-firewall : vm live migration: rules applied only after vm config file move

Alexandre DERUMIER aderumier at odiso.com
Tue Feb 12 00:05:45 CET 2019


Hi,

Currently pve-firewall only applied vm rules,
for vms where config are local to the node.


That mean that when we do a live migration,
the rules are not apply until the config file is moved. (and vm resume just after).

So, we can have some seconds where the rules are not yet applied.


I'm not sure how we could handle this correctly ?

1) force rules update after the config move but before the resume.(but maybe for complex/big iptables this will give us some seconds of timeout for the vm)

2) update rules during live migration (maybe simply detect if vm process is running (pid ? systemd scope ?), or if vmbrfw device exist ?





More information about the pve-devel mailing list