Skip to content

Replace livemigration user with libvirtadmin user #851

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
eroussy merged 5 commits into from
Feb 3, 2026
Merged

Replace livemigration user with libvirtadmin user #851

eroussy merged 5 commits into from
Feb 3, 2026

Conversation

@eroussy
Copy link
Member

@eroussy eroussy commented Jan 12, 2026

  • Rename livemigration user to libvirtadmin
  • Force the creation of the libvirtadmin user (not conditional anymore)
  • Remove the libvirt user on Debian
  • Remove the admin user from the libvirt group
  • Remove the SSH key exchange for the admin user over the cluster

Closes #846

API break:

  • libvirtadmin user is always created and always called libvirtadmin
  • livemigration_user can still be chosen when deploying VMs (default to libvirtadmin)

@eroussy eroussy marked this pull request as draft January 12, 2026 13:42
@eroussy
Copy link
Member Author

eroussy commented Jan 14, 2026 •
edited
Loading

This still needs to be tested on Yocto cluster
And it will probably be merged after #843

@eroussy eroussy force-pushed the libvirtadmin_user branch 3 times, most recently from ba41c6f to 1c5db38 Compare January 29, 2026 16:45
@eroussy eroussy marked this pull request as ready for review January 29, 2026 16:46
@eroussy eroussy requested a review from insatomcat January 29, 2026 16:46
insatomcat
insatomcat requested changes Jan 30, 2026
View reviewed changes
@insatomcat
Copy link
Member

insatomcat commented Jan 30, 2026

I'm rebasing on newer version of main, since ansible2.16 changed a lot of things and the debian CI should now be debian13.

@eroussy
configure_admin_user: remove role
b0fab1d 
This role copies the root ssh key between the cluster machines. It was
previously used for the console_vm script (now vm-mgr console command)

Administration access should not be given from one cluster machine to
another. If a machine is compromised, then they all are.

The livemigration user is configured to
- have SSH access to all the hypervisor in the cluster
- have access to the libvirt  socket.
It should be used to access the console

This commit then removes the configure_admin_user role.

Note: The livemigration user is renamed to libvirtadmin in the next
commits.

Signed-off-by: Erwann Roussy <erwann.roussy@savoirfairelinux.com>
@eroussy
physical_machine: remove libvirt user
792d63a 
This user is not used. Also remove associated tests

Also remove admin user from the libvirt group
Only the livemigration user should have access to the libvirt socket.

If necessary, an additional user could be added to the group later for
debug only. In any case, it should not be the default SEAPATH behavior.

Signed-off-by: Erwann Roussy <erwann.roussy@savoirfairelinux.com>
@eroussy
livemigration_user: force creation of libvirtadmin user
547288e 
Force the creation of a libvirtadmin user that will be used for
livemigration by default

/!\ Important notice /!\
The creation of this user is not conditionnal anymore
It is assumed that for each SEAPATH cluster, the user will be created.
The tests mimics this behavior
This was done to harmonize Debian flavor with Yocto

Signed-off-by: Erwann Roussy <erwann.roussy@savoirfairelinux.com>
@eroussy eroussy requested a review from insatomcat January 30, 2026 12:43
@eroussy
Copy link
Member Author

eroussy commented Jan 30, 2026

I'm rebasing on newer version of main, since ansible2.16 changed a lot of things and the debian CI should now be debian13.

Thanks for notifying me. But that's better to let me do the rebase in that case, because I will push changes to correct your comments.
It avoids triggering the CI two times.

( Just for information, the CI did pass on Debian 13 the first time. The rebase problem was only the commit of #855 )

@insatomcat
Copy link
Member

insatomcat commented Jan 30, 2026

ok, weird because I had the impression that the CI ran on debian12.
Can you close and reopen the PR so that it triggers the debian CI ?

@eroussy eroussy closed this Jan 30, 2026
@eroussy eroussy reopened this Jan 30, 2026
@eroussy
Copy link
Member Author

eroussy commented Jan 30, 2026

ok, weird because I had the impression that the CI ran on debian12. Can you close and reopen the PR so that it triggers the debian CI ?

Ok, may be I missed something
I let you check that the correct CI runs

@insatomcat
Copy link
Member

insatomcat commented Jan 30, 2026

ok ci is fine.
it's still missing the DCO check, otherwise LGTM

@eroussy
vm_manager: bump revision
d168076 
Includes the use of libvirtadmin as default user for VM console access.

Signed-off-by: Erwann Roussy <erwann.roussy@savoirfairelinux.com>
@eroussy
configure_libvirt: allow access to socket by default
e5801f2 
The default state should be for all users in the libvirt group to have
access to the Libvirt socket, as stated in the documentation.

Also correct a bug in the associated playbook: the distro detection
needs to be called before the role.

Signed-off-by: Erwann Roussy <erwann.roussy@savoirfairelinux.com>
@eroussy
Copy link
Member Author

eroussy commented Feb 3, 2026

@insatomcat can you approve that ?
I just bumped vm_manager after merging the change of the default user for vm-mgr console

@eroussy eroussy merged commit e410903 into seapath:main Feb 3, 2026
4 of 6 checks passed
@eroussy eroussy deleted the libvirtadmin_user branch February 3, 2026 10:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@insatomcat insatomcat insatomcat approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Too many users have access to the libvirt socket

2 participants

@eroussy @insatomcat