Attachment 5543 Details for Bug 33006

A not so earnest proposal ...

33006_network-issue.txt (text/plain), 5.61 KB, created by Philipp Hahn on 2013-10-30 19:31 CET

(hide)

Description:

Filename:

MIME Type:

Creator: Philipp Hahn

Created: 2013-10-30 19:31 CET

Size: 5.61 KB

patch

obsolete

>ucr set umc/modules/setup/network="Sorry, your network configuration is incompatible with the new way to configure network bridges through Univention Configuration Registry variables introduced with UCS-3.1 and graphically configurable through the Univention Management Console since UCS-3.2. The Xen community invented some clever scripts, which were later copied by us (Univention) for QEMU/KVM as well to automatically create a network bridge on hosts used for virtualization. Network bridges are is required to connect virtual machines to the outside world through the interface of the host. This was previously achieved by renaming the physical (most likely Ethernet) interface 'ethX' to 'pethX' and creating a network bridge 'ethX' instead, into which the original physical interface now named 'pethX' is plugged in. Since this is done independently and after the normal network configuration configured through the file '/etc/network/interfaces', this is somehow outside the scope of what can now be configured through Univention Coniguration Registry Variables, since they are only used to generate that named file. On the other hand the backend of Univention Management Console runs after the renaming and sees the already renamed interfaces and would create a configuration for 'pethX', which would break on the next reboot, since the Linux Kernel (or more exactly 'ifup') would not then find said interface 'pethX' and would fail to configure any network interface, leaving this host stranded without any working network configuration. Since Univention considers an automatic migration of the previous network configuration and all the virtual machines to the new configuration too error prone, the network re-configuration page is now completely disabled to protect you from harm. To resolve this situation the script doing the network bridge renaming must be disabled and the server should be rebooted, since the scripts are fragile and it is completely untested if they can undo the renaming. Removing the bridge also disconnects all running virtual machines, so they must be migrated to another host or be shutdown before doing any network re-configuration. For Xen the script is disabled by setting the Univention Configuration variable 'xen/bridge/interface=none'. For QEMU/KVM the script is disabled by setting the Univention Configuration Variable 'uvmm/kvm/bridge/autostart=false'. In addition to that the Univention Configuration Variable 'umc/modules/setup/network' should be unset after that to hide this nag screen and re-enable the network configuration dialog in the Univention Management Console module 'Basis setting'. After that the server must be rebooted. Setting the Univention Configuration variables can be done through the Univention Management Console module for the Univention Configuration Registry, or alternatively on the command line using 'ucr' or 'univention-config-registry'. Please note that the name of the network bridge is stored in the description of all virtual machines and in the profile information used by the Univention Virtual Machine Manager, which is used when creating new virtual machines. The virtual machines will no longer start when the bridge no longer exists. Since there is currently no way to rename a network interface, the behavior of the scripts can not be reproduced and all virtual machine descriptions must be added by hand and by doing at least 5 mouse clicks plus some text-typing in the Univention Management Console for each virtual machine. As an alternative the on QEMU/KVM the XML description files of the virtual machines in '/etc/libvirt/qemu/*.xml' could be updated by some clever regular expression magix, but this is highly dangerous and totally unsupported by libvirt and Univention. The same goes for XEN, where the virtual machine descriptions are stored in an even more obscure file format (called S-Expressions) in '/var/lib/xend/domains/'. In all cases any running virtual machine, the 'libvirtd' daemon, the 'xend' daemon and any other service touching those files must be stopped or otherwise the you risk sever data corruption. For updating the Univention Virtual Machine Manager profiles there is a known command to update all profiles automatically, which is given in <http://docs.univention.de/computers-3.2.html#uvmm> and looks like 'udm uvmm/profile list --filter interface=eth0 | sed -ne s/^DN:\ //p | xargs -r -n 1 -d \\n udm uvmm/profile modify --set interface=br0 --dn' (you have to replace 'eth0' and 'br0' withe the names used in your environment). This is only slightly tested, so it is better to backup your LDAP before doing the modification. And there is one more major problem not mentioned so far: you will no longer be able to live-migrate virtual machines between old and new virtualization servers, as they now use different names for their bridges. So you must shutdown each virtual machine on the old host and restart them on the new host."
>
>Oh, and lets introduce a "umc/modules/setup/network/de" UCVR as well...
>
>And as the text is already quiet long, lets encode it in HTML as new-lines can't be stored in UCR and there's no other way to break long lines and make it more readable ...
>
>As you hopefully now understand, the issue is complex enough and I fear that there will be other yet undiscovered issues which will force us to disable the network page.
>
>Or add a hidden-flag to UCRVs to hide them from normal interactive UCR usages.
>
>Or add something like "This UCRV is used internally to communicate issues with the network configuration between different components of UCS and should not be modified by users." (which by the way is wrong, since the user would need to unset it.)
>
>Too many options, not enough time ...

Actions: View

Attachments on bug 33006: 5543