{project-full} 2.5

You can use {the-lc} {project-first} to migrate virtual machines from the following source providers to {virt} destination providers:

VMware vSphere
{rhv-full} ({rhv-short})
{osp}
Open Virtual Appliances (OVAs) that were created by VMware vSphere
Remote {virt} clusters

The release notes describe technical changes, new features and enhancements, and known issues for {project-full}.

Technical changes

This release has the following technical changes:

Migration from OpenStack moves to being a fully supported feature

In this version of {project-short}, migration using OpenStack source providers graduated from a Technology Preview feature to a fully supported feature.

Disabling FIPS

{project-short} enables migrations from vSphere source providers by not enforcing Enterprise Master Secret (EMS). This enables migrating from all vSphere versions that {project-short} supports, including migrations that do not meet 2023 FIPS requirements.

Integration of the create and update provider user interface

The user interface of the create and update providers now aligns with the look and feel of the {ocp} web console and displays up-to-date data.

Standalone UI

The old UI of {project-short} 2.3 cannot be enabled by setting feature_ui: true in ForkliftController anymore.

Support deployment on {ocp-name} 4.15

{project-short} 2.5.6 can be deployed on {ocp-name} 4.15 clusters.

New features and enhancements

This release has the following features and improvements:

Migration of OVA files from VMware vSphere

In {project-short} {project-version}, you can migrate using Open Virtual Appliance (OVA) files that were created by VMware vSphere as source providers. (MTV-336)

Note	Migration of OVA files that were not created by VMware vSphere but are compatible with vSphere might succeed. However, migration of such files is not supported by {project-short}. {project-short} supports only OVA files created by VMware vSphere.

snippet_ova_tech_preview.adoc

Migrating VMs between {ocp} clusters

In {project-short} {project-version}, you can now use Red Hat {virt} provider as a source provider and a destination provider. You can migrate VMs from the cluster that {project-short} is deployed on to another cluster, or from a remote cluster to the cluster that {project-short} is deployed on. (MTV-571)

Migration of VMs with direct LUNs from RHV

During the migration from {rhv-full} ({rhv-short}), direct Logical Units (LUNs) are detached from the source virtual machines and attached to the target virtual machines. Note that this mechanism does not work yet for Fibre Channel. (MTV-329)

Additional authentication methods for OpenStack

In addition to standard password authentication, {project-short} supports the following authentication methods: Token authentication and Application credential authentication. (MTV-539)

Validation rules for OpenStack

The validation service includes default validation rules for virtual machines from OpenStack. (MTV-508)

VDDK is now optional for VMware vSphere providers

You can now create the VMware vSphere source provider without specifying a VMware Virtual Disk Development Kit (VDDK) init image. It is strongly recommended you create a VDDK init image to accelerate migrations.

Deployment on OKE enabled

In {project-short} 2.5.3, deployment on {ocp-name} Kubernetes Engine (OKE) has been enabled. For more information, see About {ocp-name} Kubernetes Engine. (MTV-803)

Migration of VMs to destination storage classes with encrypted RBD now supported

In {project-short} 2.5.4, migration of VMs to destination storage classes that have encrypted RADOS Block Devices (RBD) volumes is now supported.

To make use of this new feature, set the value of the parameter controller_block_overhead to 1Gi, following the procedure in Configuring the MTV Operator. (MTV-851)

Known issues

This release has the following known issues:

Deleting migration plan does not remove temporary resources

Deleting a migration plan does not remove temporary resources such as importer pods, conversion pods, config maps, secrets, failed VMs and data volumes. You must archive a migration plan before deleting it to clean up the temporary resources. (BZ#2018974)

Unclear error status message for VM with no operating system

The error status message for a VM with no operating system on the Plans page of the web console does not describe the reason for the failure. (BZ#22008846)

Migration of virtual machines with encrypted partitions fails during conversion

vSphere only: Migrations from {rhv-short} and OpenStack do not fail, but the encryption key may be missing on the target {ocp} cluster.

Migration fails during precopy/cutover while performing a snapshot operation on the source VM

Warm migration from {rhv-short} fails if a snapshot operation is triggered and running on the source VM at the same time as the migration is scheduled. The migration does not wait for the snapshot operation to finish. (MTV-456)

Unable to schedule migrated VM with multiple disks to more than one storage classes of type hostPath

When migrating a VM with multiple disks to more than one storage classes of type hostPath, it might happen that a VM cannot be scheduled. Workaround: Use shared storage on the target {ocp} cluster.

Non-supported guest operating systems in warm migrations

Warm migrations and migrations to remote {ocp} clusters from vSphere do not support all types of guest operating systems that are supported in cold migrations to the local {ocp} cluster. This is a consequence of using RHEL 8 in the former case and RHEL 9 in the latter case.
See Converting virtual machines from other hypervisors to KVM with virt-v2v in RHEL 7, RHEL 8, and RHEL 9 for the list of supported guest operating systems.

VMs from vSphere with RHEL 9 guest operating system can start with network interfaces that are down

When migrating VMs that are installed with RHEL 9 as guest operating system from vSphere, the network interfaces of the VMs could be disabled when they start in {ocp-name} Virtualization. (MTV-491)

Import OVA: ConnectionTestFailed message appears when adding OVA provider

When adding an OVA provider, the error message ConnectionTestFailed can appear, although the provider is created successfully. If the message does not disappear after a few minutes and the provider status does not move to Ready, this means that the ova server pod creation has failed. (MTV-671)

Left over ovirtvolumepopulator from failed migration causes plan to stay indefinitely in CopyDisks phase

An outdated ovirtvolumepopulator in the namespace, left over from an earlier failed migration, stops a new plan of the same VM when it transitions to CopyDisks phase. The plan remains in that phase indefinitely. (MTV-929)

Unclear error message when Forklift fails to build a PVC

The migration fails to build the Persistent Volume Claim (PVC) if the destination storage class does not have a configured storage profile. The forklift-controller raises an error message without a clear reason for failing to create a PVC. (MTV-928)

For a complete list of all known issues in this release, see the list of Known Issues in Jira.

Resolved issues

This release has the following resolved issues:

Flaw was found in jsrsasign package which is vulnerable to Observable Discrepancy

Versions of the package jsrsasign before 11.0.0, used in earlier releases of {project-short}, are vulnerable to Observable Discrepancy in the RSA PKCS1.5 or RSA-OAEP decryption process. This discrepancy means an attacker could decrypt ciphertexts by exploiting this vulnerability. However, exploiting this vulnerability requires the attacker to have access to a large number of ciphertexts encrypted with the same key. This issue has been resolved in {project-short} 2.5.5 by upgrading the package jsrasign to version 11.0.0.

For more information, see CVE-2024-21484.

Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

A flaw was found in handling multiplexed streams in the HTTP/2 protocol. In previous releases of {project-short}, the HTTP/2 protocol allowed a denial of service (server resource consumption) because request cancellation could reset multiple streams quickly. The server had to set up and tear down the streams while not hitting any server-side limit for the maximum number of active streams per connection, which resulted in a denial of service due to server resource consumption.

This issue has been resolved in {project-short} 2.5.2. It is advised to update to this version of MTV or later.

For more information, see CVE-2023-44487 (Rapid Reset Attack) and CVE-2023-39325 (Rapid Reset Attack).

Gin Web Framework does not properly sanitize filename parameter of Context.FileAttachment function

A flaw was found in the Gin-Gonic Gin Web Framework, used by {project-short}. The filename parameter of the Context.FileAttachment function was not properly sanitized. This flaw in the package could allow a remote attacker to bypass security restrictions caused by improper input validation by the filename parameter of the Context.FileAttachment function. A maliciously created filename could cause the Content-Disposition header to be sent with an unexpected filename value, or otherwise modify the Content-Disposition header.

This issue has been resolved in {project-short} 2.5.2. It is advised to update to this version of {project-short} or later.

For more information, see CVE-2023-29401 (Gin-Gonic Gin Web Framework) and CVE-2023-26125.

CVE-2023-26144: mtv-console-plugin-container: graphql: Insufficient checks in the OverlappingFieldsCanBeMergedRule.ts

A flaw was found in the package GraphQL from 16.3.0 and before 16.8.1. This flaw means {project-short} versions before {project-short} 2.5.2 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This issue may allow an attacker to degrade system performance. (MTV-712)

This issue has been resolved in {project-short} 2.5.2. It is advised to update to this version of {project-short} or later.

For more information, see CVE-2023-26144.

CVE-2023-45142: Memory leak found in the otelhttp handler of open-telemetry

A flaw was found in otelhttp handler of OpenTelemetry-Go. This flaw means {project-short} versions before {project-short} 2.5.3 are vulnerable to a memory leak caused by http.user_agent and http.method having unbound cardinality, which could allow a remote, unauthenticated attacker to exhaust the server’s memory by sending many malicious requests, affecting the availability. (MTV-795)