Skip to content

Commit 1e2ad57

Browse files
ousleypousleyp
authored
Merge pull request #94416 from ousleyp/cnv-54829
CNV#54829: new default live migration permissions
2 parents 44fe9b2 + 523159f commit 1e2ad57

11 files changed

+163
-4
lines changed

‎modules/virt-about-live-migration-permissions.adoc

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * virt/live_migration/virt-about-live-migration.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="virt-about-live-migration-permissions_{context}"]
7+
= About live migration permissions
8+
9+
In {VirtProductName} 4.19 and later, live migration operations are restricted to users who are explicitly granted the `kubevirt.io:migrate` cluster role. Users with this role can create, delete, and update virtual machine (VM) live migration requests, which are represented by `VirtualMachineInstanceMigration` (VMIM) custom resources.
10+
11+
Cluster administrators can bind the `kubevirt.io:migrate` role to trusted users or groups at either the namespace or cluster level.
12+
13+
Before {VirtProductName} 4.19, namespace administrators had live migration permissions by default. This behavior changed in version 4.19 to prevent unintended or malicious disruptions to infrastructure-critical migration operations.
14+
15+
As a cluster administrator, you can preserve the old behavior by creating a temporary cluster role before updating. After assigning the new role to users, delete the temporary role to enforce the more restrictive permissions. If you have already updated, you can still revert to the old behavior by aggregating the `kubevirt.io:migrate` role into the `admin` cluster role.

‎modules/virt-canceling-vm-migration-cli.adoc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ Cancel the live migration of a virtual machine by deleting the
1212
.Prerequisites
1313

1414
* You have installed the {oc-first}.
15+
* You have the `kubevirt.io:migrate` RBAC role or you are a cluster administrator.
1516
1617
.Procedure
1718

‎modules/virt-canceling-vm-migration-web.adoc

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,10 @@
88

99
You can cancel the live migration of a virtual machine (VM) by using the {product-title} web console.
1010

11+
.Prerequisites
12+
13+
* You have the `kubevirt.io:migrate` RBAC role or you are a cluster administrator.
14+
1115
.Procedure
1216

1317
. Navigate to *Virtualization* -> *VirtualMachines* in the web console.

‎modules/virt-default-cluster-roles.adoc

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
[id="default-cluster-roles-for-virt_{context}"]
77
= Default cluster roles for {VirtProductName}
88

9-
By using cluster role aggregation, {VirtProductName} extends the default {product-title} cluster roles to include permissions for accessing virtualization objects.
9+
By using cluster role aggregation, {VirtProductName} extends the default {product-title} cluster roles to include permissions for accessing virtualization objects. Roles unique to {VirtProductName} are not aggregated with {product-title} roles.
1010

1111
.{VirtProductName} cluster roles
1212
[cols="1,1,4",options="header"]
@@ -26,4 +26,8 @@ By using cluster role aggregation, {VirtProductName} extends the default {produc
2626
.^| `admin`
2727
.^|`kubevirt.io:admin`
2828
| A user that has full permissions to all {VirtProductName} resources, including the ability to delete collections of resources. The user can also view and modify the {VirtProductName} runtime configuration, which is located in the `HyperConverged` custom resource in the `openshift-cnv` namespace.
29+
30+
.^| `N/A`
31+
.^|`kubevirt.io:migrate`
32+
| A user that can create, delete, and update VM live migration requests, which are represented by namespaced `VirtualMachineInstanceMigration` (VMIM) objects. This role is specific to {VirtProductName}.
2933
|===

‎modules/virt-granting-live-migration-permissions.adoc

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * virt/live_migration/virt-about-live-migration.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="virt-granting-live-migration-permissions_{context}"]
7+
= Granting live migration permissions
8+
9+
Grant trusted users or groups the ability to create, delete, and update live migration instances.
10+
11+
.Prerequisites
12+
13+
* The {product-title} CLI (`oc`) is installed.
14+
* You have cluster administrator permissions.
15+
16+
.Procedure
17+
18+
* (Optional) To change the default behavior so that namespace administrators always have permission to create, delete, and update live migrations, aggregate the `kubevirt.io:migrate` role into the `admin` cluster role by running the following command:
19+
+
20+
[source,terminal]
21+
----
22+
$ oc label --overwrite clusterrole kubevirt.io:migrate rbac.authorization.k8s.io/aggregate-to-admin=true
23+
----
24+
25+
* Bind the `kubevirt.io:migrate` cluster role to trusted users or groups by running one of the following commands, replacing `<namespace>`, `<first_user>`, `<second_user>`, and `<group_name>` with your own values.
26+
** To bind the role at the namespace level, run the following command:
27+
+
28+
[source,terminal]
29+
----
30+
$ oc create -n <namespace> rolebinding kvmigrate --clusterrole=kubevirt.io:migrate --user=<first_user> --user=<second_user> --group=<group_name>
31+
----
32+
** To bind the role at the cluster level, run the following command:
33+
+
34+
[source,terminal]
35+
----
36+
$ oc create clusterrolebinding kvmigrate --clusterrole=kubevirt.io:migrate --user=<first_user> --user=<second_user> --group=<group_name>
37+
----

‎modules/virt-initiating-vm-migration-cli.adoc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ You can initiate the live migration of a running virtual machine (VM) by using t
1111
.Prerequisites
1212

1313
* You have installed the {oc-first}.
14+
* You have the `kubevirt.io:migrate` RBAC role or you are a cluster administrator.
1415
1516
.Procedure
1617

‎modules/virt-initiating-vm-migration-web.adoc

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,9 @@ The *Migrate* action is visible to all users but only cluster administrators can
1515

1616
.Prerequisites
1717

18-
* The VM must be migratable.
19-
* If the VM is configured with a host model CPU, the cluster must have an available node that supports the CPU model.
18+
* You have the `kubevirt.io:migrate` RBAC role or you are a cluster administrator.
19+
* The VM is migratable.
20+
* If the VM is configured with a host model CPU, the cluster has an available node that supports the CPU model.
2021
2122
.Procedure
2223

‎modules/virt-preserving-lm-perms.adoc

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * virt/live_migration/virt-about-live-migration.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="virt-preserving-lm-perms_{context}"]
7+
= Preserving pre-4.19 live migration permissions during update
8+
9+
Before you update to {VirtProductName} {VirtVersion}, you can create a temporary cluster role to preserve the previous live migration permissions until you are ready for the more restrictive default permissions to take effect.
10+
11+
.Prerequisites
12+
13+
* The {product-title} CLI (`oc`) is installed.
14+
* You have cluster administrator permissions.
15+
16+
.Procedure
17+
18+
. Before updating to {VirtProductName} {VirtVersion}, create a temporary `ClusterRole` object. For example:
19+
+
20+
[source,yaml]
21+
----
22+
apiVersion: rbac.authorization.k8s.io/v1
23+
kind: ClusterRole
24+
metadata:
25+
labels:
26+
rbac.authorization.k8s.io/aggregate-to-admin=true #<1>
27+
name: kubevirt.io:upgrademigrate
28+
rules:
29+
- apiGroups:
30+
- subresources.kubevirt.io
31+
resources:
32+
- virtualmachines/migrate
33+
verbs:
34+
- update
35+
- apiGroups:
36+
- kubevirt.io
37+
resources:
38+
- virtualmachineinstancemigrations
39+
verbs:
40+
- get
41+
- delete
42+
- create
43+
- update
44+
- patch
45+
- list
46+
- watch
47+
- deletecollection
48+
----
49+
<1> This cluster role is aggregated into the `admin` role before you update {VirtProductName}. The update process does not modify it, ensuring the previous behavior is maintained.
50+
51+
. Add the cluster role manifest to the cluster by running the following command:
52+
+
53+
[source,terminal]
54+
----
55+
$ oc apply -f <cluster_role_file_name>.yaml
56+
----
57+
58+
. Update {VirtProductName} to version {VirtVersion}.
59+
60+
. Bind the `kubevirt.io:migrate` cluster role to trusted users or groups by running one of the following commands, replacing `<namespace>`, `<first_user>`, `<second_user>`, and `<group_name>` with your own values.
61+
** To bind the role at the namespace level, run the following command:
62+
+
63+
[source,terminal]
64+
----
65+
$ oc create -n <namespace> rolebinding kvmigrate --clusterrole=kubevirt.io:migrate --user=<first_user> --user=<second_user> --group=<group_name>
66+
----
67+
** To bind the role at the cluster level, run the following command:
68+
+
69+
[source,terminal]
70+
----
71+
$ oc create clusterrolebinding kvmigrate --clusterrole=kubevirt.io:migrate --user=<first_user> --user=<second_user> --group=<group_name>
72+
----
73+
74+
. When you have bound the `kubevirt.io:migrate` role to all necessary users, delete the temporary `ClusterRole` object by running the following command:
75+
+
76+
[source,terminal]
77+
----
78+
$ oc delete clusterrole kubevirt.io:upgrademigrate
79+
----
80+
+
81+
After you delete the temporary cluster role, only users with the `kubevirt.io:migrate` role can create, delete, and update live migration requests.

‎virt/live_migration/virt-about-live-migration.adoc

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,13 @@ The default number of migrations that can run in parallel in the cluster is 5.
3232
* If a VM uses a host model CPU, the nodes must support the CPU.
3333
* xref:../../virt/vm_networking/virt-dedicated-network-live-migration.adoc#virt-dedicated-network-live-migration[Configuring a dedicated Multus network] for live migration is highly recommended. A dedicated network minimizes the effects of network saturation on tenant workloads during migration.
3434

35+
include::modules/virt-about-live-migration-permissions.adoc[leveloffset=+1]
36+
37+
//TODO: Remove transition-to-lm-role module in 4.21; relevant in 4.20 due to EUS
38+
include::modules/virt-preserving-lm-perms.adoc[leveloffset=+1]
39+
40+
include::modules/virt-granting-live-migration-permissions.adoc[leveloffset=+1]
41+
3542
include::modules/virt-vm-migration-tuning.adoc[leveloffset=+1]
3643

3744
[id="common-live-migration-tasks_virt-about-live-migration"]
@@ -48,6 +55,7 @@ You can perform the following live migration tasks:
4855

4956
[id="additional-resources_virt-about-live-migration"]
5057
== Additional resources
58+
* xref:../../virt/about_virt/virt-security-policies.adoc#default-cluster-roles-for-virt_virt-security-policies[Default cluster roles for {VirtProductName}]
5159
* xref:../../virt/monitoring/virt-prometheus-queries.adoc#virt-live-migration-metrics_virt-prometheus-queries[Prometheus queries for live migration]
5260
* xref:../../virt/nodes/virt-node-maintenance.adoc#run-strategies[VM run strategies]
5361
* xref:../../virt/nodes/virt-node-maintenance.adoc#eviction-strategies[VM and cluster eviction strategies]

‎virt/live_migration/virt-initiating-live-migration.adoc

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,4 +27,10 @@ include::modules/virt-initiating-vm-migration-cli.adoc[leveloffset=+2]
2727

2828
include::modules/virt-canceling-vm-migration-web.adoc[leveloffset=+2]
2929

30-
include::modules/virt-canceling-vm-migration-cli.adoc[leveloffset=+2]
30+
include::modules/virt-canceling-vm-migration-cli.adoc[leveloffset=+2]
31+
32+
[role="_additional-resources"]
33+
[id="additional-resources_{context}"]
34+
== Additional resources
35+
36+
* xref:../../virt/live_migration/virt-about-live-migration.adoc#virt-about-live-migration-permissions_virt-about-live-migration[About live migration permissions]

0 commit comments

Comments
 (0)