If ‘virt-v2v -oo verify-server-certificate=false’ is used then ‘openstack --insecure’ flag is added whenever we invoke the openstack command. This turns off SSL certificate validation. The default is to verify the server certificate (which is the default of the openstack command). --- v2v/output_openstack.ml | 16 +++++++++++++++- v2v/test-v2v-o-openstack.sh | 2 ++ v2v/virt-v2v-output-openstack.pod | 8 ++++++++ v2v/virt-v2v.pod | 8 ++++++++ 4 files changed, 33 insertions(+), 1 deletion(-) diff --git a/v2v/output_openstack.ml b/v2v/output_openstack.ml index 22fac69bd..e17bead14 100644 --- a/v2v/output_openstack.ml +++ b/v2v/output_openstack.ml @@ -56,6 +56,11 @@ type os_options = { *) authentication : string list; + (* If false, use the [openstack --insecure] switch (turns off SSL + * cert validation). + *) + verify_server_certificate : bool; + (* Optional guest_id which, if present, is saved as * Cinder volume property virt_v2v_guest_id on every disk * associated with this guest. @@ -100,6 +105,7 @@ The os-* parameters and environment variables are optional. let parse_output_options options = let server_id = ref None in let dev_disk_by_id = ref None in + let verify_server_certificate = ref true in let guest_id = ref None in let authentication = ref [] in List.iter ( @@ -108,6 +114,10 @@ let parse_output_options options = server_id := Some v | "dev-disk-by-id", v -> dev_disk_by_id := Some v + | "verify-server-certificate", "" -> + verify_server_certificate := true + | "verify-server-certificate", v -> + verify_server_certificate := bool_of_string v | "guest-id", v -> guest_id := Some v | k, v -> @@ -120,9 +130,11 @@ let parse_output_options options = ) options; let server_id = !server_id in let authentication = List.rev !authentication in + let verify_server_certificate = !verify_server_certificate in let guest_id = !guest_id in let dev_disk_by_id = !dev_disk_by_id in - { server_id; authentication; guest_id; dev_disk_by_id } + { server_id; authentication; verify_server_certificate; + guest_id; dev_disk_by_id } (* UTC conversion time. *) let iso_time = @@ -140,6 +152,8 @@ class output_openstack output_conn output_password output_storage let args = ref os_options.authentication in Option.may (fun oc -> List.push_back args (sprintf "--os-auth-url=%s" oc)) output_conn; + if not os_options.verify_server_certificate then + List.push_back args "--insecure"; !args in (* The server ID (the name or UUID of the conversion appliance) can diff --git a/v2v/test-v2v-o-openstack.sh b/v2v/test-v2v-o-openstack.sh index 3a10a5475..cbdd3367c 100755 --- a/v2v/test-v2v-o-openstack.sh +++ b/v2v/test-v2v-o-openstack.sh @@ -56,6 +56,7 @@ $VG virt-v2v --debug-gc \ -o openstack -on test \ -oo server-id=test \ -oo guest-id=guestid \ + -oo verify-server-certificate=false \ -oo dev-disk-by-id=$d # Check the log of openstack commands to make sure they look reasonable. @@ -65,5 +66,6 @@ grep 'server add volume' $d/log grep 'volume set.*--bootable.*dummy-vol-id' $d/log grep 'volume set.*--property.*virt_v2v_guest_id=guestid' $d/log grep 'server remove volume' $d/log +grep -- '--insecure' $d/log rm -r $d diff --git a/v2v/virt-v2v-output-openstack.pod b/v2v/virt-v2v-output-openstack.pod index 7ea3bc75c..0e4166f5e 100644 --- a/v2v/virt-v2v-output-openstack.pod +++ b/v2v/virt-v2v-output-openstack.pod @@ -7,6 +7,7 @@ virt-v2v-output-openstack - Using virt-v2v to convert guests to OpenStack virt-v2v [-i* options] -o openstack [-oo server-id=SERVER] [-oo guest-id=GUEST] + [-oo verify-server-certificate=false] [-oo os-username=admin] [-oo os-*=*] virt-v2v [-i* options] -o glance @@ -124,6 +125,13 @@ This can be used to find disks associated with a guest, or to associate which disks are related to which guests when converting many guests. +=head2 OpenStack: Ignore server certificate + +Using I<-oo verify-server-certificate=false> you can tell the +openstack client to ignore the server certificate when connecting to +the OpenStack API endpoints. This has the same effect as passing the +I<--insecure> option to the C<openstack> command. + =head2 OpenStack: Converting a guest The final command to convert the guest, running as root, will be: diff --git a/v2v/virt-v2v.pod b/v2v/virt-v2v.pod index 3f0620bc6..651933bea 100644 --- a/v2v/virt-v2v.pod +++ b/v2v/virt-v2v.pod @@ -555,6 +555,14 @@ For I<-o openstack> (L<virt-v2v-output-openstack(1)>) only, set a guest ID which is saved on each Cinder volume in the C<virt_v2v_guest_id> volume property. +=item B<-oo verify-server-certificate> + +=item B<-oo verify-server-certificate=>C<true|false> + +For I<-o openstack> (L<virt-v2v-output-openstack(1)>) only, this can +be used to disable SSL certification validation when connecting to +OpenStack by specifying I<-oo verify-server-certificate=false>. + =item B<-oo os->*B<=>* For I<-o openstack> (L<virt-v2v-output-openstack(1)>) only, set optional -- 2.19.0.rc0