kvm: set LIBVIRTD_ARGS so libvirtd listens on Debian and Ubuntu hosts by rootnomad · Pull Request #14153 · apache/cloudstack · GitHub

Description

cloudstack-setup-agent sets up live migration on Debian and Ubuntu by writing libvirtd_opts='-l' to /etc/default/libvirtd and masking the libvirtd sockets. The libvirtd.service unit on current releases reads LIBVIRTD_ARGS from that file instead (Debian 12 and 13: ExecStart=/usr/sbin/libvirtd $LIBVIRTD_ARGS with --timeout 120 as the default), so after adding a host libvirtd runs without --listen, nothing listens on 16509/16514 and live migration fails. This also sets LIBVIRTD_ARGS="--listen", and keeps libvirtd_opts for older units that still read it.

Related: #9802 and #12374.

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)
build/CI
test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

Bug Severity

BLOCKER
Critical
Major
Minor
Trivial

Screenshots (if appropriate):

N/A

How Has This Been Tested?

Live tested on two fresh Debian 13 KVM hosts (libvirt 11.3, QEMU 10.0) added to a cluster with addHost, with NFS primary storage, and a VM live migrated between them with migrateVirtualMachine.

Before this change, right after addHost:

/etc/default/libvirtd   libvirtd_opts='-l'
libvirtd process        /usr/sbin/libvirtd --timeout 120
ports 16509/16514       nothing listening

15:51:27 GET command=migrateVirtualMachine&virtualmachineid=...&hostid=...
15:51:28 ERROR [LibvirtMigrateCommandWrapper] Can't migrate domain due to: [unable to connect to server at '<destination host>:16509': Connection refused]
15:51:28 Complete async job-1640, jobStatus: FAILED, resultCode: 530, "Failed to migrate domain"

With this change, same hosts reset to the distro defaults and added again:

/etc/default/libvirtd   libvirtd_opts='-l'
                        LIBVIRTD_ARGS="--listen"
libvirtd process        /usr/sbin/libvirtd --listen
port 16514              listening

15:58:25 GET command=migrateVirtualMachine&virtualmachineid=...&hostid=...
15:58:28 Complete async job-1653, jobStatus: SUCCEEDED

Debian 12 (libvirt 9.0) uses the same unit layout.

How did you try to break this feature and the system with this change?

Older units that read libvirtd_opts still get it. replace_or_add_line replaces an existing or commented LIBVIRTD_ARGS line, so adding a host again does not duplicate it. The RHEL and SUSE paths are unchanged.

cloudstack-setup-agent sets up live migration on Debian and Ubuntu by writing libvirtd_opts='-l' to /etc/default/libvirtd and masking the libvirtd sockets. The libvirtd.service unit on current releases reads LIBVIRTD_ARGS from that file instead (Debian 12 and 13 run "libvirtd $LIBVIRTD_ARGS" with "--timeout 120" as the default), so after adding a host libvirtd runs without --listen, nothing listens on the migration ports and live migration fails with "unable to connect to server". Also set LIBVIRTD_ARGS="--listen", and keep libvirtd_opts for older units that still read it.

code lgtm

we have not faced this issue in Trillian tests, as we have already applied it via ansible

- name: Update /etc/default/libvirtd in Ubuntu 22.04
  lineinfile:
    dest: "/etc/default/libvirtd"
    regexp: '^LIBVIRTD_ARGS=*'
    line: 'LIBVIRTD_ARGS="-l"'
  when: ansible_distribution_version is version('22.04','>=')

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 16.38%. Comparing base (8261bec) to head (e31f9a0).
⚠️ Report is 9 commits behind head on 4.20.

Additional details and impacted files

@@             Coverage Diff              @@
##               4.20   #14153      +/-   ##
============================================
- Coverage     16.38%   16.38%   -0.01%     
+ Complexity    13615    13614       -1     
============================================
  Files          5669     5669              
  Lines        501561   501561              
  Branches      60922    60922              
============================================
- Hits          82168    82167       -1     
- Misses       410185   410186       +1     
  Partials       9208     9208

Flag	Coverage Δ
uitests	4.16% <ø> (ø)
unittests	17.24% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Thanks @weizhouapache for the review. This needs a second review and a package and smoke test run. The red Simulator CI job stopped at a Maven lock timeout during the build, before any tests ran.

@blueorangutan package

clgtm

@DaanHoogland a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

@weizhouapache mentioned, a smoke test run would not prove anything here as the ansible example he gave is in place. Would be nioce if someone else could test it.

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 19805

a smoke test run would not prove anything here as the ansible example he gave is in place. Would be nice if someone else could test it.

Good call @DaanHoogland, did exactly that on a Debian 12 (bookworm) KVM host without the ansible workaround.

On stock Debian systemd, libvirtd.service runs ExecStart=/usr/sbin/libvirtd $LIBVIRTD_ARGS sourced from /etc/default/libvirtd, with libvirtd.socket masked. So only LIBVIRTD_ARGS takes effect and libvirtd_opts is ignored by systemd.

Before the fix (old code sets libvirtd_opts='-l' only): libvirtd starts with empty args and does not listen, nothing on the migration port.
After the fix (adds LIBVIRTD_ARGS="--listen"): libvirtd listens.

These hosts have listen_tls=1, so it binds 16514 rather than 16509, but it's the same mechanism. Host restored afterwards. So on a Debian/Ubuntu host without that ansible workaround, this is the line that actually gets libvirtd listening for live migration.

@rootnomad , could you submit an ICLA with the ASF? you are contributing a lot of code in a short time, which is very much appreciated. Submitting an ICLA would help with legal matters a lot.

@rootnomad , could you submit an ICLA with the ASF? you are contributing a lot of code in a short time, which is very much appreciated. Submitting an ICLA would help with legal matters a lot.

Thanks @DaanHoogland , that genuinely means a lot. Happy to, I'll get the ICLA filed with the ASF.

@blueorangutan test

@nvazquez a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

[SF] Trillian Build Failed (tid-17521)

rootnomad mentioned this pull request Sep 11, 2026

Support Debian 13 (trixie) #12374

Open

weizhouapache approved these changes Sep 12, 2026

View reviewed changes

bernardodemarco self-requested a review September 14, 2026 12:42

DaanHoogland approved these changes Oct 28, 2026

View reviewed changes

DaanHoogland added the status:ready-for-merge label Oct 30, 2026

kvm: set LIBVIRTD_ARGS so libvirtd listens on Debian and Ubuntu hosts by rootnomad · Pull Request #14153 · apache/cloudstack · GitHub

Repository navigation

kvm: set LIBVIRTD_ARGS so libvirtd listens on Debian and Ubuntu hosts - #14153

kvm: set LIBVIRTD_ARGS so libvirtd listens on Debian and Ubuntu hosts#14153rootnomad wants to merge 1 commit intoapache:4.20apache/cloudstack:4.20from rootnomad:fix/kvm-libvirtd-listen-argsrootnomad/cloudstack:fix/kvm-libvirtd-listen-argsCopy head branch name to clipboard

Conversation

rootnomad commented Sep 11, 2026

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

Uh oh!

weizhouapache left a comment

Choose a reason for hiding this comment

Uh oh!

codecov Bot commented Sep 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

rootnomad commented Sep 15, 2026

Uh oh!

DaanHoogland commented Oct 28, 2026

Uh oh!

DaanHoogland left a comment

Choose a reason for hiding this comment

Uh oh!

blueorangutan commented Oct 28, 2026

Uh oh!

DaanHoogland commented Oct 28, 2026

Uh oh!

blueorangutan commented Oct 28, 2026

Uh oh!

rootnomad commented Oct 28, 2026

Uh oh!

DaanHoogland commented Oct 29, 2026

Uh oh!

rootnomad commented Oct 29, 2026

Uh oh!

nvazquez commented Nov 9, 2026

Uh oh!

blueorangutan commented Nov 9, 2026

Uh oh!

blueorangutan commented Nov 9, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

kvm: set LIBVIRTD_ARGS so libvirtd listens on Debian and Ubuntu hosts#14153
rootnomad wants to merge 1 commit into
apache:4.20from
rootnomad:fix/kvm-libvirtd-listen-args

codecov Bot commented Sep 12, 2026 •
edited
Loading