Enable live-migration NBD TLS

[olliewalsh]

MUST set live_migration_uri as it's already set to qemu+ssh://... in the 01 nova conf file

Disable post-copy when NBD TLS is enabled until
https://issues.redhat.com/browse/LIBVIRT-1113 is resolved.

Fix qemu cert path and permissions. Qemu is expecting the ca cert to be in a single dir and root:qemu 0640.
https://docs.openstack.org/nova/latest/admin/secure-live-migration-with-qemu-native-tls.html#other-tls-environment-related-checks-on-compute-nodes

Related: OSPRH-6173
Depends-On: openstack-k8s-operators/install_yamls#804
Depends-On: openstack-k8s-operators/dataplane-operator#827

[olliewalsh]

Live-migration with NBD TLS is working with these changes, first migration failed with what looks like a nova bug:

sh-5.1$ openstack server migration list
+----+--------------------------------------+-------------------------------------+-------------------------------------+-------------------------------------+-------------------------------------+-----------+-----------+--------------------------------------+------------+------------+----------------+----------------------------+----------------------------+
| Id | UUID                                 | Source Node                         | Dest Node                           | Source Compute                      | Dest Compute                        | Dest Host | Status    | Server UUID                          | Old Flavor | New Flavor | Type           | Created At                 | Updated At                 |
+----+--------------------------------------+-------------------------------------+-------------------------------------+-------------------------------------+-------------------------------------+-----------+-----------+--------------------------------------+------------+------------+----------------+----------------------------+----------------------------+
|  3 | 924aad99-c862-4a0d-b9fa-fa70919f2556 | edpm-compute-1.ctlplane.example.com | edpm-compute-0.ctlplane.example.com | edpm-compute-1.ctlplane.example.com | edpm-compute-0.ctlplane.example.com | None      | completed | 84488727-df3f-46dc-9a68-aef049acb2c5 |          1 |          1 | live-migration | 2024-04-16T01:10:12.000000 | 2024-04-16T01:10:28.000000 |
|  2 | 13597919-5938-4991-bb54-1a7d51738896 | edpm-compute-0.ctlplane.example.com | edpm-compute-1.ctlplane.example.com | edpm-compute-0.ctlplane.example.com | edpm-compute-1.ctlplane.example.com | None      | completed | 84488727-df3f-46dc-9a68-aef049acb2c5 |          1 |          1 | live-migration | 2024-04-16T01:07:14.000000 | 2024-04-16T01:07:28.000000 |
|  1 | 144974c7-c910-4efc-b52d-df9133014c3f | edpm-compute-0.ctlplane.example.com | edpm-compute-1.ctlplane.example.com | edpm-compute-0.ctlplane.example.com | edpm-compute-1.ctlplane.example.com | None      | failed    | 84488727-df3f-46dc-9a68-aef049acb2c5 |          1 |          1 | live-migration | 2024-04-16T01:01:06.000000 | 2024-04-16T01:01:14.000000 |
+----+--------------------------------------+-------------------------------------+-------------------------------------+-------------------------------------+-------------------------------------+-----------+-----------+--------------------------------------+------------+------------+----------------+----------------------------+----------------------------+

Raised https://bugs.launchpad.net/nova/+bug/2061701 for the nova issue

[olliewalsh]

Tempest live migration test passing https://logserver.rdoproject.org/36/736/20943694ebd04eb822d529cf8a2a7c1cf3d86866/github-check/openstack-operator-tempest-multinode/dbb1a45/controller/ci-framework-data/tests/tempest/tempest/stestr_results.html

[stuggi]

/lgtm

[bshephar]

Let's make sure we capture this with a QE job as well. Particularly while we have that FIXME libvirt issue open.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bshephar, olliewalsh, stuggi

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [bshephar,olliewalsh,stuggi]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[SeanMooney]

+1 we had talks about replaceing this with the URI during the ptg last week so I'm glad to see this included here