[pve-container.git] / src / PVE / LXC / Migrate.pm

package PVE::LXC::Migrate;

use strict;
use warnings;

use File::Basename;
use File::Copy; # fixme: remove

use PVE::Cluster;
use PVE::INotify;
use PVE::Replication;
use PVE::ReplicationConfig;
use PVE::ReplicationState;
use PVE::Storage;
use PVE::Tools;

use PVE::LXC::Config;
use PVE::LXC;

use PVE::AbstractMigrate;
use base qw(PVE::AbstractMigrate);

# compared against remote end's minimum version
our $WS_TUNNEL_VERSION = 2;

sub lock_vm {
    my ($self, $vmid, $code, @param) = @_;

    return PVE::LXC::Config->lock_config($vmid, $code, @param);
}

sub prepare {
    my ($self, $vmid) = @_;

    my $online = $self->{opts}->{online};
    my $restart= $self->{opts}->{restart};
    my $remote = $self->{opts}->{remote};

    $self->{storecfg} = PVE::Storage::config();

    # test if CT exists
    my $conf = $self->{vmconf} = PVE::LXC::Config->load_config($vmid);

    PVE::LXC::Config->check_lock($conf);

    my $running = 0;
    if (PVE::LXC::check_running($vmid)) {
	die "lxc live migration is currently not implemented\n" if $online;
	die "running container can only be migrated in restart mode" if !$restart;
	$running = 1;
    }
    $self->{was_running} = $running;

    my $storages = {};
    PVE::LXC::Config->foreach_volume_full($conf, { include_unused => 1 }, sub {
	my ($ms, $mountpoint) = @_;

	my $volid = $mountpoint->{volume};
	my $type = $mountpoint->{type};

	# skip dev/bind mps when shared
	if ($type ne 'volume') {
	    if ($mountpoint->{shared}) {
		return;
	    } else {
		die "cannot migrate local $type mount point '$ms'\n";
	    }
	}

	my ($storage, $volname) = PVE::Storage::parse_volume_id($volid, 1) if $volid;
	die "can't determine assigned storage for mount point '$ms'\n" if !$storage;

	# check if storage is available on both nodes
	my $scfg = PVE::Storage::storage_check_enabled($self->{storecfg}, $storage);

	my $targetsid = $storage;

	die "content type 'rootdir' is not available on storage '$storage'\n"
	    if !$scfg->{content}->{rootdir};

	if ($scfg->{shared} && !$remote) {
	    # PVE::Storage::activate_storage checks this for non-shared storages
	    my $plugin = PVE::Storage::Plugin->lookup($scfg->{type});
	    warn "Used shared storage '$storage' is not online on source node!\n"
		if !$plugin->check_connection($storage, $scfg);
	} else {
	    # unless in restart mode because we shut the container down
	    die "unable to migrate local mount point '$volid' while CT is running"
		if $running && !$restart;

	    $targetsid = PVE::JSONSchema::map_id($self->{opts}->{storagemap}, $storage);
	}

	if (!$remote) {
	    my $target_scfg = PVE::Storage::storage_check_enabled($self->{storecfg}, $targetsid, $self->{node});

	    die "$volid: content type 'rootdir' is not available on storage '$targetsid'\n"
		if !$target_scfg->{content}->{rootdir};
	}

	$storages->{$targetsid} = 1;
    });

    # todo: test if VM uses local resources

    if ($remote) {
	# test & establish websocket connection
	my $bridges = map_bridges($conf, $self->{opts}->{bridgemap}, 1);

	my $remote = $self->{opts}->{remote};
	my $conn = $remote->{conn};

	my $log = sub {
	    my ($level, $msg) = @_;
	    $self->log($level, $msg);
	};

	my $websocket_url = "https://$conn->{host}:$conn->{port}/api2/json/nodes/$self->{node}/lxc/$remote->{vmid}/mtunnelwebsocket";
	my $url = "/nodes/$self->{node}/lxc/$remote->{vmid}/mtunnel";

	my $tunnel_params = {
	    url => $websocket_url,
	};

	my $storage_list = join(',', keys %$storages);
	my $bridge_list = join(',', keys %$bridges);

	my $req_params = {
	    storages => $storage_list,
	    bridges => $bridge_list,
	};

	my $tunnel = PVE::Tunnel::fork_websocket_tunnel($conn, $url, $req_params, $tunnel_params, $log);
	my $min_version = $tunnel->{version} - $tunnel->{age};
	$self->log('info', "local WS tunnel version: $WS_TUNNEL_VERSION");
	$self->log('info', "remote WS tunnel version: $tunnel->{version}");
	$self->log('info', "minimum required WS tunnel version: $min_version");
	die "Remote tunnel endpoint not compatible, upgrade required\n"
	    if $WS_TUNNEL_VERSION < $min_version;
	 die "Remote tunnel endpoint too old, upgrade required\n"
	    if $WS_TUNNEL_VERSION > $tunnel->{version};

	$self->log('info', "websocket tunnel started\n");
	$self->{tunnel} = $tunnel;
    } else {
	# test ssh connection
	my $cmd = [ @{$self->{rem_ssh}}, '/bin/true' ];
	eval { $self->cmd_quiet($cmd); };
	die "Can't connect to destination address using public key\n" if $@;
    }

    # in restart mode, we shutdown the container before migrating
    if ($restart && $running) {
	my $timeout = $self->{opts}->{timeout} // 180;

	$self->log('info', "shutdown CT $vmid\n");

	PVE::LXC::vm_stop($vmid, 0, $timeout);

	$running = 0;
    }

    return $running;
}

sub phase1 {
    my ($self, $vmid) = @_;

    my $remote = $self->{opts}->{remote};

    $self->log('info', "starting migration of CT $self->{vmid} to node '$self->{node}' ($self->{nodeip})");

    my $conf = $self->{vmconf};
    $conf->{lock} = 'migrate';
    PVE::LXC::Config->write_config($vmid, $conf);

    if ($self->{running}) {
	$self->log('info', "container is running - using online migration");
    }

    $self->{volumes} = []; # list of already migrated volumes
    my $volhash = {}; # 'config', 'snapshot' or 'storage' for local volumes
    my $volhash_errors = {};
    my $abort = 0;

    my $log_error = sub {
	my ($msg, $volid) = @_;

	$volhash_errors->{$volid} = $msg if !defined($volhash_errors->{$volid});
	$abort = 1;
    };

    my $test_volid = sub {
	my ($volid, $snapname) = @_;

	return if !$volid;

	my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);

	# check if storage is available on source node
	my $scfg = PVE::Storage::storage_check_enabled($self->{storecfg}, $sid);

	my $targetsid = $sid;

	if ($scfg->{shared} && !$remote) {
	    $self->log('info', "volume '$volid' is on shared storage '$sid'")
		if !$snapname;
	    return;
	} else {
	    $targetsid = PVE::JSONSchema::map_id($self->{opts}->{storagemap}, $sid);
	}

	PVE::Storage::storage_check_enabled($self->{storecfg}, $targetsid, $self->{node})
	    if !$remote;

	my $bwlimit = $self->get_bwlimit($sid, $targetsid);

	$volhash->{$volid}->{ref} = defined($snapname) ? 'snapshot' : 'config';
	$volhash->{$volid}->{snapshots} = 1 if defined($snapname);
	$volhash->{$volid}->{targetsid} = $targetsid;
	$volhash->{$volid}->{bwlimit} = $bwlimit;

	my ($path, $owner) = PVE::Storage::path($self->{storecfg}, $volid);

	die "owned by other guest (owner = $owner)\n"
	    if !$owner || ($owner != $self->{vmid});

	if (defined($snapname)) {
	    # we cannot migrate shapshots on local storage
	    # exceptions: 'zfspool', 'btrfs'
	    if ($scfg->{type} eq 'zfspool' || $scfg->{type} eq 'btrfs') {
		return;
	    }
	    die "non-migratable snapshot exists\n";
	}
    };

    my $test_mp = sub {
	my ($ms, $mountpoint, $snapname) = @_;

	my $volid = $mountpoint->{volume};
	# already checked in prepare
	if ($mountpoint->{type} ne 'volume') {
	    $self->log('info', "ignoring shared '$mountpoint->{type}' mount point '$ms' ('$volid')")
		if !$snapname;
	    return;
	}

	eval {
	    &$test_volid($volid, $snapname);

	    die "remote migration with snapshots not supported yet\n"
		if $remote && $snapname;
	};

	&$log_error($@, $volid) if $@;
    };

    # first unused / lost volumes owned by this container
    my @sids = PVE::Storage::storage_ids($self->{storecfg});
    foreach my $storeid (@sids) {
	my $scfg = PVE::Storage::storage_config($self->{storecfg}, $storeid);
	next if $scfg->{shared} && !$remote;
	next if !PVE::Storage::storage_check_enabled($self->{storecfg}, $storeid, undef, 1);

	# get list from PVE::Storage (for unreferenced volumes)
	my $dl = PVE::Storage::vdisk_list($self->{storecfg}, $storeid, $vmid, undef, 'rootdir');

	next if @{$dl->{$storeid}} == 0;

	# check if storage is available on target node
	my $targetsid = PVE::JSONSchema::map_id($self->{opts}->{storagemap}, $storeid);
	if (!$remote) {
	    my $target_scfg = PVE::Storage::storage_check_enabled($self->{storecfg}, $targetsid, $self->{node});

	    die "content type 'rootdir' is not available on storage '$targetsid'\n"
		if !$target_scfg->{content}->{rootdir};
	}

	PVE::Storage::foreach_volid($dl, sub {
	    my ($volid, $sid, $volname) = @_;

	    $volhash->{$volid}->{ref} = 'storage';
	    $volhash->{$volid}->{targetsid} = $targetsid;
	});
    }

    # then all volumes referenced in snapshots
    foreach my $snapname (keys %{$conf->{snapshots}}) {
	&$test_volid($conf->{snapshots}->{$snapname}->{'vmstate'}, 0, undef)
	    if defined($conf->{snapshots}->{$snapname}->{'vmstate'});
	PVE::LXC::Config->foreach_volume($conf->{snapshots}->{$snapname}, $test_mp, $snapname);
    }

    # finally all current volumes
    PVE::LXC::Config->foreach_volume_full($conf, { include_unused => 1 }, $test_mp);

    # additional checks for local storage
    foreach my $volid (keys %$volhash) {
	eval {
	    my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
	    my $scfg =  PVE::Storage::storage_config($self->{storecfg}, $sid);

	    # TODO move to storage plugin layer?
	    my $migratable_storages = [
		'dir',
		'zfspool',
		'lvmthin',
		'lvm',
		'btrfs',
	    ];
	    if ($remote) {
		push @$migratable_storages, 'cifs';
		push @$migratable_storages, 'nfs';
	    }

	    die "storage type '$scfg->{type}' not supported\n"
		if !grep { $_ eq $scfg->{type} } @$migratable_storages;

	    # image is a linked clone on local storage, se we can't migrate.
	    if (my $basename = (PVE::Storage::parse_volname($self->{storecfg}, $volid))[3]) {
		die "clone of '$basename'";
	    }
	};
	&$log_error($@, $volid) if $@;
    }

    foreach my $volid (sort keys %$volhash) {
	my $ref = $volhash->{$volid}->{ref};
	if ($ref eq 'storage') {
	    $self->log('info', "found local volume '$volid' (via storage)\n");
	} elsif ($ref eq 'config') {
	    $self->log('info', "found local volume '$volid' (in current VM config)\n");
	} elsif ($ref eq 'snapshot') {
	    $self->log('info', "found local volume '$volid' (referenced by snapshot(s))\n");
	} else {
	    $self->log('info', "found local volume '$volid'\n");
	}
    }

    foreach my $volid (sort keys %$volhash_errors) {
	$self->log('warn', "can't migrate local volume '$volid': $volhash_errors->{$volid}");
    }

    if ($abort) {
	die "can't migrate CT - check log\n";
    }

    my $rep_volumes;

    my $rep_cfg = PVE::ReplicationConfig->new();

    if ($remote) {
	die "cannot remote-migrate replicated VM\n"
	    if $rep_cfg->check_for_existing_jobs($vmid, 1);
    } elsif (my $jobcfg = $rep_cfg->find_local_replication_job($vmid, $self->{node})) {
	die "can't live migrate VM with replicated volumes\n" if $self->{running};
	my $start_time = time();
	my $logfunc = sub { my ($msg) = @_;  $self->log('info', $msg); };
	$rep_volumes = PVE::Replication::run_replication(
	    'PVE::LXC::Config', $jobcfg, $start_time, $start_time, $logfunc);
    }

    my $opts = $self->{opts};
    foreach my $volid (keys %$volhash) {
	next if $rep_volumes->{$volid};
	push @{$self->{volumes}}, $volid;

	# JSONSchema and get_bandwidth_limit use kbps - storage_migrate bps
	my $bwlimit = $volhash->{$volid}->{bwlimit};
	$bwlimit = $bwlimit * 1024 if defined($bwlimit);

	my $targetsid = $volhash->{$volid}->{targetsid};

	my $new_volid = eval {
	    if ($remote) {
		my $log = sub {
		    my ($level, $msg) = @_;
		    $self->log($level, $msg);
		};

		return PVE::StorageTunnel::storage_migrate(
		    $self->{tunnel},
		    $self->{storecfg},
		    $volid,
		    $self->{vmid},
		    $remote->{vmid},
		    $volhash->{$volid},
		    $log,
		);
	    } else {
		my $storage_migrate_opts = {
		    'ratelimit_bps' => $bwlimit,
		    'insecure' => $opts->{migration_type} eq 'insecure',
		    'with_snapshots' => $volhash->{$volid}->{snapshots},
		    'allow_rename' => 1,
		};

		my $logfunc = sub { $self->log('info', $_[0]); };
		return PVE::Storage::storage_migrate(
		    $self->{storecfg},
		    $volid,
		    $self->{ssh_info},
		    $targetsid,
		    $storage_migrate_opts,
		    $logfunc,
		);
	    }
	};

	if (my $err = $@) {
	    die "storage migration for '$volid' to storage '$targetsid' failed - $err\n";
	}

	$self->{volume_map}->{$volid} = $new_volid;
	$self->log('info', "volume '$volid' is '$new_volid' on the target\n");

	eval { PVE::Storage::deactivate_volumes($self->{storecfg}, [$volid]); };
	if (my $err = $@) {
	    $self->log('warn', $err);
	}
    }

    if ($self->{running}) {
	die "implement me";
    }

    # make sure everything on (shared) storage is unmounted
    # Note: we must be 100% sure, else we get data corruption because
    # non-shared file system could be mounted twice (on shared storage)

    PVE::LXC::umount_all($vmid, $self->{storecfg}, $conf);

    #to be sure there are no active volumes
    my $vollist = PVE::LXC::Config->get_vm_volumes($conf);
    PVE::Storage::deactivate_volumes($self->{storecfg}, $vollist);

    if ($remote) {
	my $remote_conf = PVE::LXC::Config->load_config($vmid);
	PVE::LXC::Config->update_volume_ids($remote_conf, $self->{volume_map});

	my $bridges = map_bridges($remote_conf, $self->{opts}->{bridgemap});
	for my $target (keys $bridges->%*) {
	    for my $nic (keys $bridges->{$target}->%*) {
		$self->log('info', "mapped: $nic from $bridges->{$target}->{$nic} to $target");
	    }
	}
	my $conf_str = PVE::LXC::Config::write_pct_config("remote", $remote_conf);

	# TODO expose in PVE::Firewall?
	my $vm_fw_conf_path = "/etc/pve/firewall/$vmid.fw";
	my $fw_conf_str;
	$fw_conf_str = PVE::Tools::file_get_contents($vm_fw_conf_path)
	    if -e $vm_fw_conf_path;
	my $params = {
	    conf => $conf_str,
	    'firewall-config' => $fw_conf_str,
	};

	PVE::Tunnel::write_tunnel($self->{tunnel}, 10, 'config', $params);
    } else {
	# transfer replication state before moving config
	$self->transfer_replication_state() if $rep_volumes;
	PVE::LXC::Config->update_volume_ids($conf, $self->{volume_map});
	PVE::LXC::Config->write_config($vmid, $conf);
	PVE::LXC::Config->move_config_to_node($vmid, $self->{node});
	$self->switch_replication_job_target() if $rep_volumes;
    }
    $self->{conf_migrated} = 1;
}

sub phase1_cleanup {
    my ($self, $vmid, $err) = @_;

    $self->log('info', "aborting phase 1 - cleanup resources");

    if ($self->{volumes}) {
	foreach my $volid (@{$self->{volumes}}) {
	    if (my $mapped_volume = $self->{volume_map}->{$volid}) {
		$volid = $mapped_volume;
	    }
	    $self->log('err', "found stale volume copy '$volid' on node '$self->{node}'");
	    # fixme: try to remove ?
	}
    }

    if ($self->{opts}->{remote}) {
	# cleans up remote volumes
	PVE::Tunnel::finish_tunnel($self->{tunnel}, 1);
	delete $self->{tunnel};
    }
}

sub phase3 {
    my ($self, $vmid) = @_;

    my $volids = $self->{volumes};

    # handled below in final_cleanup
    return if $self->{opts}->{remote};

    # destroy local copies
    foreach my $volid (@$volids) {
	eval { PVE::Storage::vdisk_free($self->{storecfg}, $volid); };
	if (my $err = $@) {
	    $self->log('err', "removing local copy of '$volid' failed - $err");
	    $self->{errors} = 1;
	    last if $err =~ /^interrupted by signal$/;
	}
    }
}

sub final_cleanup {
    my ($self, $vmid) = @_;

    $self->log('info', "start final cleanup");

    if (!$self->{conf_migrated}) {
	eval { PVE::LXC::Config->remove_lock($vmid, 'migrate'); };
	if (my $err = $@) {
	    $self->log('err', $err);
	}
	# in restart mode, we start the container on the source node on migration error
	if ($self->{opts}->{restart} && $self->{was_running}) {
	    $self->log('info', "start container on source node");
	    my $skiplock = 1;
	    PVE::LXC::vm_start($vmid, $self->{vmconf}, $skiplock);
	}
    } elsif ($self->{opts}->{remote}) {
	eval { PVE::Tunnel::write_tunnel($self->{tunnel}, 10, 'unlock') };
	$self->log('err', "Failed to clear migrate lock - $@\n") if $@;

	if ($self->{opts}->{restart} && $self->{was_running}) {
	    $self->log('info', "start container on target node");
	    PVE::Tunnel::write_tunnel($self->{tunnel}, 60, 'start');
	}
	if ($self->{opts}->{delete}) {
	    PVE::LXC::destroy_lxc_container(
		PVE::Storage::config(),
		$vmid,
		PVE::LXC::Config->load_config($vmid),
		undef,
		0,
	    );
	}
	PVE::Tunnel::finish_tunnel($self->{tunnel});
    } else {
	my $cmd = [ @{$self->{rem_ssh}}, 'pct', 'unlock', $vmid ];
	$self->cmd_logerr($cmd, errmsg => "failed to clear migrate lock");

	# in restart mode, we start the container on the target node after migration
	if ($self->{opts}->{restart} && $self->{was_running}) {
	    $self->log('info', "start container on target node");
	    my $cmd = [ @{$self->{rem_ssh}}, 'pct', 'start', $vmid];
	    $self->cmd($cmd);
	}
    }
}

sub map_bridges {
    my ($conf, $map, $scan_only) = @_;

    my $bridges = {};

    foreach my $opt (keys %$conf) {
	next if $opt !~ m/^net\d+$/;

	next if !$conf->{$opt};
	my $d = PVE::LXC::Config->parse_lxc_network($conf->{$opt});
	next if !$d || !$d->{bridge};

	my $target_bridge = PVE::JSONSchema::map_id($map, $d->{bridge});
	$bridges->{$target_bridge}->{$opt} = $d->{bridge};

	next if $scan_only;

	$d->{bridge} = $target_bridge;
	$conf->{$opt} = PVE::LXC::Config->print_lxc_network($d);
    }

    return $bridges;
}

1;
Commit	Line	Data
6f42807e DM	1	package PVE::LXC::Migrate;
	2
	3	use strict;
	4	use warnings;
88685441	5
6f42807e DM	6	use File::Basename;
6f42807e DM	7	use File::Copy; # fixme: remove
88685441	8
6f42807e	9	use PVE::Cluster;
88685441 TL	10	use PVE::INotify;
	11	use PVE::Replication;
	12	use PVE::ReplicationConfig;
	13	use PVE::ReplicationState;
6f42807e	14	use PVE::Storage;
88685441 TL	15	use PVE::Tools;
88685441 TL	16
8d66edee	17	use PVE::LXC::Config;
6f42807e DM	18	use PVE::LXC;
6f42807e DM	19
88685441	20	use PVE::AbstractMigrate;
6f42807e DM	21	use base qw(PVE::AbstractMigrate);
6f42807e DM	22
0e0958a5 FG	23	# compared against remote end's minimum version
	24	our $WS_TUNNEL_VERSION = 2;
	25
6f42807e DM	26	sub lock_vm {
	27	my ($self, $vmid, $code, @param) = @_;
	28
67afe46e	29	return PVE::LXC::Config->lock_config($vmid, $code, @param);
6f42807e DM	30	}
	31
	32	sub prepare {
	33	my ($self, $vmid) = @_;
	34
	35	my $online = $self->{opts}->{online};
a7cedb73	36	my $restart= $self->{opts}->{restart};
0e0958a5	37	my $remote = $self->{opts}->{remote};
6f42807e DM	38
	39	$self->{storecfg} = PVE::Storage::config();
	40
1cd1fa12	41	# test if CT exists
67afe46e	42	my $conf = $self->{vmconf} = PVE::LXC::Config->load_config($vmid);
6f42807e	43
67afe46e	44	PVE::LXC::Config->check_lock($conf);
6f42807e DM	45
	46	my $running = 0;
	47	if (PVE::LXC::check_running($vmid)) {
a7cedb73 DC	48	die "lxc live migration is currently not implemented\n" if $online;
a7cedb73 DC	49	die "running container can only be migrated in restart mode" if !$restart;
6f42807e DM	50	$running = 1;
6f42807e DM	51	}
a7cedb73	52	$self->{was_running} = $running;
6f42807e	53
0e0958a5	54	my $storages = {};
2334b15d	55	PVE::LXC::Config->foreach_volume_full($conf, { include_unused => 1 }, sub {
6f42807e DM	56	my ($ms, $mountpoint) = @_;
	57
	58	my $volid = $mountpoint->{volume};
552e168f	59	my $type = $mountpoint->{type};
9746c095	60
154b1295	61	# skip dev/bind mps when shared
552e168f	62	if ($type ne 'volume') {
552e168f FG	63	if ($mountpoint->{shared}) {
	64	return;
	65	} else {
	66	die "cannot migrate local $type mount point '$ms'\n";
	67	}
9746c095	68	}
552e168f	69
6f42807e	70	my ($storage, $volname) = PVE::Storage::parse_volume_id($volid, 1) if $volid;
235dbdf3	71	die "can't determine assigned storage for mount point '$ms'\n" if !$storage;
6f42807e DM	72
6f42807e DM	73	# check if storage is available on both nodes
a1c27f86	74	my $scfg = PVE::Storage::storage_check_enabled($self->{storecfg}, $storage);
e90ddc4c FG	75
e90ddc4c FG	76	my $targetsid = $storage;
6f42807e	77
b2f00a89 FE	78	die "content type 'rootdir' is not available on storage '$storage'\n"
b2f00a89 FE	79	if !$scfg->{content}->{rootdir};
20ab40f3	80
0e0958a5	81	if ($scfg->{shared} && !$remote) {
20ab40f3 FG	82	# PVE::Storage::activate_storage checks this for non-shared storages
	83	my $plugin = PVE::Storage::Plugin->lookup($scfg->{type});
	84	warn "Used shared storage '$storage' is not online on source node!\n"
	85	if !$plugin->check_connection($storage, $scfg);
	86	} else {
a7cedb73	87	# unless in restart mode because we shut the container down
235dbdf3	88	die "unable to migrate local mount point '$volid' while CT is running"
a7cedb73	89	if $running && !$restart;
e90ddc4c FG	90
e90ddc4c FG	91	$targetsid = PVE::JSONSchema::map_id($self->{opts}->{storagemap}, $storage);
20ab40f3	92	}
6f42807e	93
0e0958a5 FG	94	if (!$remote) {
	95	my $target_scfg = PVE::Storage::storage_check_enabled($self->{storecfg}, $targetsid, $self->{node});
	96
	97	die "$volid: content type 'rootdir' is not available on storage '$targetsid'\n"
	98	if !$target_scfg->{content}->{rootdir};
	99	}
e90ddc4c	100
0e0958a5	101	$storages->{$targetsid} = 1;
6f42807e DM	102	});
6f42807e DM	103
6f42807e DM	104	# todo: test if VM uses local resources
6f42807e DM	105
0e0958a5 FG	106	if ($remote) {
	107	# test & establish websocket connection
	108	my $bridges = map_bridges($conf, $self->{opts}->{bridgemap}, 1);
	109
	110	my $remote = $self->{opts}->{remote};
	111	my $conn = $remote->{conn};
	112
	113	my $log = sub {
	114	my ($level, $msg) = @_;
	115	$self->log($level, $msg);
	116	};
	117
	118	my $websocket_url = "https://$conn->{host}:$conn->{port}/api2/json/nodes/$self->{node}/lxc/$remote->{vmid}/mtunnelwebsocket";
	119	my $url = "/nodes/$self->{node}/lxc/$remote->{vmid}/mtunnel";
	120
	121	my $tunnel_params = {
	122	url => $websocket_url,
	123	};
	124
	125	my $storage_list = join(',', keys %$storages);
	126	my $bridge_list = join(',', keys %$bridges);
	127
	128	my $req_params = {
	129	storages => $storage_list,
	130	bridges => $bridge_list,
	131	};
	132
	133	my $tunnel = PVE::Tunnel::fork_websocket_tunnel($conn, $url, $req_params, $tunnel_params, $log);
	134	my $min_version = $tunnel->{version} - $tunnel->{age};
	135	$self->log('info', "local WS tunnel version: $WS_TUNNEL_VERSION");
	136	$self->log('info', "remote WS tunnel version: $tunnel->{version}");
	137	$self->log('info', "minimum required WS tunnel version: $min_version");
	138	die "Remote tunnel endpoint not compatible, upgrade required\n"
	139	if $WS_TUNNEL_VERSION < $min_version;
	140	die "Remote tunnel endpoint too old, upgrade required\n"
	141	if $WS_TUNNEL_VERSION > $tunnel->{version};
	142
	143	$self->log('info', "websocket tunnel started\n");
	144	$self->{tunnel} = $tunnel;
	145	} else {
	146	# test ssh connection
	147	my $cmd = [ @{$self->{rem_ssh}}, '/bin/true' ];
	148	eval { $self->cmd_quiet($cmd); };
	149	die "Can't connect to destination address using public key\n" if $@;
	150	}
6f42807e	151
a7cedb73 DC	152	# in restart mode, we shutdown the container before migrating
	153	if ($restart && $running) {
	154	my $timeout = $self->{opts}->{timeout} // 180;
	155
	156	$self->log('info', "shutdown CT $vmid\n");
	157
b1bad293	158	PVE::LXC::vm_stop($vmid, 0, $timeout);
a7cedb73 DC	159
	160	$running = 0;
	161	}
	162
6f42807e DM	163	return $running;
	164	}
	165
	166	sub phase1 {
	167	my ($self, $vmid) = @_;
	168
0e0958a5 FG	169	my $remote = $self->{opts}->{remote};
0e0958a5 FG	170
6f42807e DM	171	$self->log('info', "starting migration of CT $self->{vmid} to node '$self->{node}' ($self->{nodeip})");
	172
	173	my $conf = $self->{vmconf};
	174	$conf->{lock} = 'migrate';
67afe46e	175	PVE::LXC::Config->write_config($vmid, $conf);
6f42807e DM	176
	177	if ($self->{running}) {
	178	$self->log('info', "container is running - using online migration");
	179	}
	180
3c5dabe1	181	$self->{volumes} = []; # list of already migrated volumes
f503617b	182	my $volhash = {}; # 'config', 'snapshot' or 'storage' for local volumes
33deb76c FG	183	my $volhash_errors = {};
	184	my $abort = 0;
	185
	186	my $log_error = sub {
	187	my ($msg, $volid) = @_;
	188
	189	$volhash_errors->{$volid} = $msg if !defined($volhash_errors->{$volid});
	190	$abort = 1;
	191	};
6f42807e	192
3c5dabe1 FG	193	my $test_volid = sub {
3c5dabe1 FG	194	my ($volid, $snapname) = @_;
6f42807e	195
3c5dabe1 FG	196	return if !$volid;
	197
	198	my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
	199
e90ddc4c	200	# check if storage is available on source node
a1c27f86	201	my $scfg = PVE::Storage::storage_check_enabled($self->{storecfg}, $sid);
e90ddc4c FG	202
e90ddc4c FG	203	my $targetsid = $sid;
3c5dabe1	204
0e0958a5	205	if ($scfg->{shared} && !$remote) {
33deb76c FG	206	$self->log('info', "volume '$volid' is on shared storage '$sid'")
	207	if !$snapname;
	208	return;
e90ddc4c FG	209	} else {
e90ddc4c FG	210	$targetsid = PVE::JSONSchema::map_id($self->{opts}->{storagemap}, $sid);
33deb76c	211	}
3c5dabe1	212
0e0958a5 FG	213	PVE::Storage::storage_check_enabled($self->{storecfg}, $targetsid, $self->{node})
0e0958a5 FG	214	if !$remote;
e90ddc4c FG	215
	216	my $bwlimit = $self->get_bwlimit($sid, $targetsid);
	217
0aa2d2a2	218	$volhash->{$volid}->{ref} = defined($snapname) ? 'snapshot' : 'config';
7121bd69	219	$volhash->{$volid}->{snapshots} = 1 if defined($snapname);
e90ddc4c FG	220	$volhash->{$volid}->{targetsid} = $targetsid;
e90ddc4c FG	221	$volhash->{$volid}->{bwlimit} = $bwlimit;
f503617b	222
3c5dabe1 FG	223	my ($path, $owner) = PVE::Storage::path($self->{storecfg}, $volid);
3c5dabe1 FG	224
33deb76c	225	die "owned by other guest (owner = $owner)\n"
3c5dabe1	226	if !$owner \|\| ($owner != $self->{vmid});
9746c095	227
3c5dabe1 FG	228	if (defined($snapname)) {
3c5dabe1 FG	229	# we cannot migrate shapshots on local storage
026ff6fa WB	230	# exceptions: 'zfspool', 'btrfs'
026ff6fa WB	231	if ($scfg->{type} eq 'zfspool' \|\| $scfg->{type} eq 'btrfs') {
3c5dabe1 FG	232	return;
3c5dabe1 FG	233	}
33deb76c	234	die "non-migratable snapshot exists\n";
3c5dabe1 FG	235	}
	236	};
	237
	238	my $test_mp = sub {
	239	my ($ms, $mountpoint, $snapname) = @_;
	240
	241	my $volid = $mountpoint->{volume};
9746c095 FG	242	# already checked in prepare
9746c095 FG	243	if ($mountpoint->{type} ne 'volume') {
552e168f	244	$self->log('info', "ignoring shared '$mountpoint->{type}' mount point '$ms' ('$volid')")
3c5dabe1	245	if !$snapname;
9746c095 FG	246	return;
	247	}
	248
33deb76c FG	249	eval {
33deb76c FG	250	&$test_volid($volid, $snapname);
0e0958a5 FG	251
	252	die "remote migration with snapshots not supported yet\n"
	253	if $remote && $snapname;
33deb76c	254	};
6f42807e	255
33deb76c	256	&$log_error($@, $volid) if $@;
3c5dabe1 FG	257	};
3c5dabe1 FG	258
1c5f78ef	259	# first unused / lost volumes owned by this container
3c5dabe1 FG	260	my @sids = PVE::Storage::storage_ids($self->{storecfg});
	261	foreach my $storeid (@sids) {
	262	my $scfg = PVE::Storage::storage_config($self->{storecfg}, $storeid);
0e0958a5	263	next if $scfg->{shared} && !$remote;
3c5dabe1 FG	264	next if !PVE::Storage::storage_check_enabled($self->{storecfg}, $storeid, undef, 1);
3c5dabe1 FG	265
2334b15d	266	# get list from PVE::Storage (for unreferenced volumes)
b2f00a89	267	my $dl = PVE::Storage::vdisk_list($self->{storecfg}, $storeid, $vmid, undef, 'rootdir');
3c5dabe1 FG	268
	269	next if @{$dl->{$storeid}} == 0;
	270
	271	# check if storage is available on target node
e90ddc4c	272	my $targetsid = PVE::JSONSchema::map_id($self->{opts}->{storagemap}, $storeid);
0e0958a5 FG	273	if (!$remote) {
0e0958a5 FG	274	my $target_scfg = PVE::Storage::storage_check_enabled($self->{storecfg}, $targetsid, $self->{node});
3c5dabe1	275
0e0958a5 FG	276	die "content type 'rootdir' is not available on storage '$targetsid'\n"
	277	if !$target_scfg->{content}->{rootdir};
	278	}
b2f00a89	279
3c5dabe1 FG	280	PVE::Storage::foreach_volid($dl, sub {
	281	my ($volid, $sid, $volname) = @_;
	282
0aa2d2a2	283	$volhash->{$volid}->{ref} = 'storage';
b9d0dcb4	284	$volhash->{$volid}->{targetsid} = $targetsid;
3c5dabe1 FG	285	});
	286	}
	287
1c5f78ef FG	288	# then all volumes referenced in snapshots
	289	foreach my $snapname (keys %{$conf->{snapshots}}) {
	290	&$test_volid($conf->{snapshots}->{$snapname}->{'vmstate'}, 0, undef)
	291	if defined($conf->{snapshots}->{$snapname}->{'vmstate'});
015740e6	292	PVE::LXC::Config->foreach_volume($conf->{snapshots}->{$snapname}, $test_mp, $snapname);
1c5f78ef FG	293	}
1c5f78ef FG	294
2334b15d FE	295	# finally all current volumes
2334b15d FE	296	PVE::LXC::Config->foreach_volume_full($conf, { include_unused => 1 }, $test_mp);
1c5f78ef	297
3c5dabe1 FG	298	# additional checks for local storage
3c5dabe1 FG	299	foreach my $volid (keys %$volhash) {
33deb76c FG	300	eval {
	301	my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
	302	my $scfg = PVE::Storage::storage_config($self->{storecfg}, $sid);
3c5dabe1	303
0e0958a5 FG	304	# TODO move to storage plugin layer?
	305	my $migratable_storages = [
	306	'dir',
	307	'zfspool',
	308	'lvmthin',
	309	'lvm',
	310	'btrfs',
	311	];
	312	if ($remote) {
	313	push @$migratable_storages, 'cifs';
	314	push @$migratable_storages, 'nfs';
	315	}
3c5dabe1	316
33deb76c	317	die "storage type '$scfg->{type}' not supported\n"
0e0958a5	318	if !grep { $_ eq $scfg->{type} } @$migratable_storages;
3c5dabe1	319
33deb76c FG	320	# image is a linked clone on local storage, se we can't migrate.
	321	if (my $basename = (PVE::Storage::parse_volname($self->{storecfg}, $volid))[3]) {
	322	die "clone of '$basename'";
	323	}
	324	};
	325	&$log_error($@, $volid) if $@;
3c5dabe1 FG	326	}
3c5dabe1 FG	327
f503617b	328	foreach my $volid (sort keys %$volhash) {
0aa2d2a2 WB	329	my $ref = $volhash->{$volid}->{ref};
0aa2d2a2 WB	330	if ($ref eq 'storage') {
f503617b	331	$self->log('info', "found local volume '$volid' (via storage)\n");
0aa2d2a2	332	} elsif ($ref eq 'config') {
f503617b	333	$self->log('info', "found local volume '$volid' (in current VM config)\n");
0aa2d2a2	334	} elsif ($ref eq 'snapshot') {
f503617b FG	335	$self->log('info', "found local volume '$volid' (referenced by snapshot(s))\n");
	336	} else {
	337	$self->log('info', "found local volume '$volid'\n");
	338	}
	339	}
	340
33deb76c FG	341	foreach my $volid (sort keys %$volhash_errors) {
	342	$self->log('warn', "can't migrate local volume '$volid': $volhash_errors->{$volid}");
	343	}
	344
	345	if ($abort) {
	346	die "can't migrate CT - check log\n";
	347	}
	348
3efa5e3d DM	349	my $rep_volumes;
	350
	351	my $rep_cfg = PVE::ReplicationConfig->new();
	352
0e0958a5 FG	353	if ($remote) {
	354	die "cannot remote-migrate replicated VM\n"
	355	if $rep_cfg->check_for_existing_jobs($vmid, 1);
	356	} elsif (my $jobcfg = $rep_cfg->find_local_replication_job($vmid, $self->{node})) {
3efa5e3d DM	357	die "can't live migrate VM with replicated volumes\n" if $self->{running};
	358	my $start_time = time();
	359	my $logfunc = sub { my ($msg) = @_; $self->log('info', $msg); };
	360	$rep_volumes = PVE::Replication::run_replication(
	361	'PVE::LXC::Config', $jobcfg, $start_time, $start_time, $logfunc);
	362	}
	363
1159329a	364	my $opts = $self->{opts};
3c5dabe1	365	foreach my $volid (keys %$volhash) {
3efa5e3d	366	next if $rep_volumes->{$volid};
3c5dabe1	367	push @{$self->{volumes}}, $volid;
e90ddc4c	368
1159329a	369	# JSONSchema and get_bandwidth_limit use kbps - storage_migrate bps
e90ddc4c	370	my $bwlimit = $volhash->{$volid}->{bwlimit};
1159329a SI	371	$bwlimit = $bwlimit * 1024 if defined($bwlimit);
1159329a SI	372
e90ddc4c FG	373	my $targetsid = $volhash->{$volid}->{targetsid};
	374
	375	my $new_volid = eval {
0e0958a5 FG	376	if ($remote) {
	377	my $log = sub {
	378	my ($level, $msg) = @_;
	379	$self->log($level, $msg);
	380	};
	381
	382	return PVE::StorageTunnel::storage_migrate(
	383	$self->{tunnel},
	384	$self->{storecfg},
	385	$volid,
	386	$self->{vmid},
	387	$remote->{vmid},
	388	$volhash->{$volid},
	389	$log,
	390	);
	391	} else {
	392	my $storage_migrate_opts = {
	393	'ratelimit_bps' => $bwlimit,
	394	'insecure' => $opts->{migration_type} eq 'insecure',
	395	'with_snapshots' => $volhash->{$volid}->{snapshots},
	396	'allow_rename' => 1,
	397	};
	398
	399	my $logfunc = sub { $self->log('info', $_[0]); };
	400	return PVE::Storage::storage_migrate(
	401	$self->{storecfg},
	402	$volid,
	403	$self->{ssh_info},
	404	$targetsid,
	405	$storage_migrate_opts,
	406	$logfunc,
	407	);
	408	}
1d26bb86 FE	409	};
1d26bb86 FE	410
d79b051a	411	if (my $err = $@) {
e90ddc4c	412	die "storage migration for '$volid' to storage '$targetsid' failed - $err\n";
d79b051a	413	}
1e5f5da7	414
e90ddc4c FG	415	$self->{volume_map}->{$volid} = $new_volid;
	416	$self->log('info', "volume '$volid' is '$new_volid' on the target\n");
	417
1e5f5da7 FE	418	eval { PVE::Storage::deactivate_volumes($self->{storecfg}, [$volid]); };
	419	if (my $err = $@) {
	420	$self->log('warn', $err);
	421	}
3c5dabe1	422	}
6f42807e	423
6f42807e DM	424	if ($self->{running}) {
	425	die "implement me";
	426	}
	427
	428	# make sure everything on (shared) storage is unmounted
	429	# Note: we must be 100% sure, else we get data corruption because
	430	# non-shared file system could be mounted twice (on shared storage)
	431
	432	PVE::LXC::umount_all($vmid, $self->{storecfg}, $conf);
	433
c9bc5018	434	#to be sure there are no active volumes
d250604f	435	my $vollist = PVE::LXC::Config->get_vm_volumes($conf);
c9bc5018 WL	436	PVE::Storage::deactivate_volumes($self->{storecfg}, $vollist);
c9bc5018 WL	437
0e0958a5 FG	438	if ($remote) {
	439	my $remote_conf = PVE::LXC::Config->load_config($vmid);
	440	PVE::LXC::Config->update_volume_ids($remote_conf, $self->{volume_map});
	441
	442	my $bridges = map_bridges($remote_conf, $self->{opts}->{bridgemap});
	443	for my $target (keys $bridges->%*) {
	444	for my $nic (keys $bridges->{$target}->%*) {
	445	$self->log('info', "mapped: $nic from $bridges->{$target}->{$nic} to $target");
	446	}
	447	}
	448	my $conf_str = PVE::LXC::Config::write_pct_config("remote", $remote_conf);
	449
	450	# TODO expose in PVE::Firewall?
	451	my $vm_fw_conf_path = "/etc/pve/firewall/$vmid.fw";
	452	my $fw_conf_str;
	453	$fw_conf_str = PVE::Tools::file_get_contents($vm_fw_conf_path)
	454	if -e $vm_fw_conf_path;
	455	my $params = {
	456	conf => $conf_str,
	457	'firewall-config' => $fw_conf_str,
	458	};
	459
	460	PVE::Tunnel::write_tunnel($self->{tunnel}, 10, 'config', $params);
	461	} else {
	462	# transfer replication state before moving config
	463	$self->transfer_replication_state() if $rep_volumes;
	464	PVE::LXC::Config->update_volume_ids($conf, $self->{volume_map});
	465	PVE::LXC::Config->write_config($vmid, $conf);
	466	PVE::LXC::Config->move_config_to_node($vmid, $self->{node});
	467	$self->switch_replication_job_target() if $rep_volumes;
	468	}
1d1c1b4f	469	$self->{conf_migrated} = 1;
6f42807e DM	470	}
	471
	472	sub phase1_cleanup {
	473	my ($self, $vmid, $err) = @_;
	474
	475	$self->log('info', "aborting phase 1 - cleanup resources");
	476
	477	if ($self->{volumes}) {
	478	foreach my $volid (@{$self->{volumes}}) {
800f454d FG	479	if (my $mapped_volume = $self->{volume_map}->{$volid}) {
	480	$volid = $mapped_volume;
	481	}
6f42807e DM	482	$self->log('err', "found stale volume copy '$volid' on node '$self->{node}'");
	483	# fixme: try to remove ?
	484	}
	485	}
0e0958a5 FG	486
	487	if ($self->{opts}->{remote}) {
	488	# cleans up remote volumes
	489	PVE::Tunnel::finish_tunnel($self->{tunnel}, 1);
	490	delete $self->{tunnel};
	491	}
6f42807e DM	492	}
	493
	494	sub phase3 {
	495	my ($self, $vmid) = @_;
	496
	497	my $volids = $self->{volumes};
	498
0e0958a5 FG	499	# handled below in final_cleanup
	500	return if $self->{opts}->{remote};
	501
6f42807e DM	502	# destroy local copies
6f42807e DM	503	foreach my $volid (@$volids) {
8fdd1fc8 DM	504	eval { PVE::Storage::vdisk_free($self->{storecfg}, $volid); };
	505	if (my $err = $@) {
	506	$self->log('err', "removing local copy of '$volid' failed - $err");
	507	$self->{errors} = 1;
	508	last if $err =~ /^interrupted by signal$/;
6f42807e DM	509	}
	510	}
	511	}
	512
	513	sub final_cleanup {
	514	my ($self, $vmid) = @_;
	515
	516	$self->log('info', "start final cleanup");
	517
1d1c1b4f	518	if (!$self->{conf_migrated}) {
dd3bcfb2	519	eval { PVE::LXC::Config->remove_lock($vmid, 'migrate'); };
1d1c1b4f WL	520	if (my $err = $@) {
	521	$self->log('err', $err);
	522	}
675b1f96	523	# in restart mode, we start the container on the source node on migration error
6725e93c AA	524	if ($self->{opts}->{restart} && $self->{was_running}) {
	525	$self->log('info', "start container on source node");
	526	my $skiplock = 1;
	527	PVE::LXC::vm_start($vmid, $self->{vmconf}, $skiplock);
	528	}
0e0958a5 FG	529	} elsif ($self->{opts}->{remote}) {
	530	eval { PVE::Tunnel::write_tunnel($self->{tunnel}, 10, 'unlock') };
	531	$self->log('err', "Failed to clear migrate lock - $@\n") if $@;
	532
	533	if ($self->{opts}->{restart} && $self->{was_running}) {
	534	$self->log('info', "start container on target node");
	535	PVE::Tunnel::write_tunnel($self->{tunnel}, 60, 'start');
	536	}
	537	if ($self->{opts}->{delete}) {
	538	PVE::LXC::destroy_lxc_container(
	539	PVE::Storage::config(),
	540	$vmid,
	541	PVE::LXC::Config->load_config($vmid),
	542	undef,
	543	0,
	544	);
	545	}
	546	PVE::Tunnel::finish_tunnel($self->{tunnel});
1d1c1b4f WL	547	} else {
1d1c1b4f WL	548	my $cmd = [ @{$self->{rem_ssh}}, 'pct', 'unlock', $vmid ];
ee8d9207 FG	549	$self->cmd_logerr($cmd, errmsg => "failed to clear migrate lock");
ee8d9207 FG	550
675b1f96	551	# in restart mode, we start the container on the target node after migration
ee8d9207 FG	552	if ($self->{opts}->{restart} && $self->{was_running}) {
	553	$self->log('info', "start container on target node");
	554	my $cmd = [ @{$self->{rem_ssh}}, 'pct', 'start', $vmid];
	555	$self->cmd($cmd);
	556	}
6f42807e	557	}
0e0958a5 FG	558	}
	559
	560	sub map_bridges {
	561	my ($conf, $map, $scan_only) = @_;
	562
	563	my $bridges = {};
	564
	565	foreach my $opt (keys %$conf) {
	566	next if $opt !~ m/^net\d+$/;
	567
	568	next if !$conf->{$opt};
	569	my $d = PVE::LXC::Config->parse_lxc_network($conf->{$opt});
	570	next if !$d \|\| !$d->{bridge};
	571
	572	my $target_bridge = PVE::JSONSchema::map_id($map, $d->{bridge});
	573	$bridges->{$target_bridge}->{$opt} = $d->{bridge};
	574
	575	next if $scan_only;
	576
	577	$d->{bridge} = $target_bridge;
	578	$conf->{$opt} = PVE::LXC::Config->print_lxc_network($d);
	579	}
a7cedb73	580
0e0958a5	581	return $bridges;
6f42807e DM	582	}
	583
	584	1;