On Fri, 2015-04-17 at 11:30 +0100, Daniel P. Berrange wrote:
> On Thu, Apr 16, 2015 at 04:46:10PM +0200, Martin Kletzander wrote:
> > *** BLURB ***
> >
> > ...
> >
> > Just kidding :)
> >
> > Sooo... After very very VERY long time, here's a draft of an admin
> > interface that is supposed to open up new possibilities to be done on
> > a live daemon. The aim here is to create some first inches of that
> > API in order to open up the possibility of new API function creation
> > to more people.
> >
> > I already spent so much time explaining so much of that that I don't
> > know what else to point at in here. Maybe the fact that last three
> > patches are just an example on how this might work. Of course there
> > won't be any functions like listClientIDs with the need of getting
> > each client info by another API. There's going to be
> > e.g. virAdmClientInfo and virAdmGetClients() will return the list of
> > them, etc. Long story short, let's not repeat past mistakes ;)
> >
> > With all that said, feel free to hate, love, comment or just try out
> > compiling this series and let me know how many things I've missed and
> > screwed up (hopefully zero).
>
> Broadly speaking I think this all looks like pretty good approach
> to me. We should probably think about exactly which API we want
> to target for inclusion in the first release.
>
> Perhaps the ability to change the logging filters & outputs would
> be the most useful one, as its something people often want to have
> in the production deployments where restarting libvirtd is not an
> option.
How about reloading the server TLS certificates?
virNetTLSContextNew() contains the comment:
/* Generate Diffie Hellman parameters - for use with DHE
* kx algorithms. These should be discarded and regenerated
* once a day, once a week or once a month. Depending on the
* security requirements.
*/
If I understand correctly, currently one must restart libvirtd to pickup
new certificates? I wondered whether Martin's patch 4/15 -- multiple
NetSubServers -- would allow introduction of a new cert on a new
SubServer w/o restarting libvirtd? E.g., to allow long running
migration, blockcopy or other jobs to complete on existing connections
before destroying them.
If that would be possible, I think would would also be useful for early
inclusion for people considering ephemeral certificates.
Regards,
Lee
>
> Regards,
> Daniel
--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list