How to create KVM guest with SPICE graphics but TLS disabled using virt-install?

Question

I am using virt-install (see below) to create a guest. All seems fine up to the point where it complains about auto-allocation of the SPICE TLS port.

Here's what I am running and the full output:

# sudo virt-install --name vmname --ram 1024 --os-type=linux --os-variant=ubuntutrusty --disk path=/data/vm/vmname_sda.qcow2,bus=virtio,size=10,sparse=false --noautoconsole --console pty,target_type=virtio --accelerate --hvm --network=network:default --graphics spice,port=20001,listen=127.0.0.1

Starting install...
Retrieving file MANIFEST...                                                                                  | 2.1 kB     00:00 ...
Retrieving file MANIFEST...                                                                                  | 2.1 kB     00:00 ...
Retrieving file linux...                                                                                     |  11 MB     00:00 ...
Retrieving file initrd.gz...                                                                                 |  41 MB     00:00 ...
ERROR    unsupported configuration: Auto allocation of spice TLS port requested but spice TLS is disabled in qemu.conf
Domain installation does not appear to have been successful.
If it was, you can restart your domain by running:
  virsh --connect qemu:///system start vmname
otherwise, please restart your installation.

The error is:

ERROR unsupported configuration: Auto allocation of spice TLS port requested but spice TLS is disabled in qemu.conf

and indeed in my /etc/libvirt/qemu.conf I have:

spice_tls = 0

(and intentionally so).

So how can I create a KVM guest using the SPICE protocol for graphics, but with TLS disabled?

I doubt it is of relevance, but the reason I want to disable TLS is because I am tunneling the connection to SPICE via SSH already. No need for an extra layer of encryption.

---

The host system is Ubuntu 14.04.1. Package versions are:

• virtinst: 0.600.4-3ubuntu2
• qemu-kvm: 2.0.0+dfsg-2ubuntu1.2

(all up to date as far as apt-get is concerned)

Answer 1

Okay, I worked around it on my own. In the option:

--graphics spice,port=20001,listen=127.0.0.1

remove the port parameter such that it becomes:

--graphics spice,listen=127.0.0.1

You need to configure the <graphics /> element in the libvirt XML configuration file then. My invocation of virt-install gave me this:

<graphics type='spice' autoport='yes' listen='127.0.0.1'>
  <listen type='address' address='127.0.0.1'/>
</graphics>

There is one caveat. I finished the installation while SPICE was still connected to the default auto-connected port (5900 in my case). If you shut down the guest prior to finishing the installation the whole process initiated by virt-install will be interrupted.

In order to change it one should shut down the guest and the edit the XML to something like the following, using virsh edit vmname (where vmname should be replaced with your name):

<graphics type='spice' autoport='no' port='20001' listen='127.0.0.1'>
  <listen type='address' address='127.0.0.1'/>
</graphics>

Possible workaround for "port in use" conflicts. Use any of the local net addresses other than 127.0.0.1 from 127.0.0.0/24, e.g. 127.0.0.2 etc to listen on.

NOTE: If someone can come up with a better (i.e. actual) solution, I'll accept that other answer. This writeup is mostly for others that may run into the same issue.

Answer 2

When the convenient arguments to virt-install fail, it is possible to instead manually craft the xml using XPath syntax.

Replacing --graphics "spice,port=20001,defaultMode=insecure,autoport=no" with these five argument pairs was a successful workaround for me:

    --xml 'xpath.delete=./devices/graphics' \
    --xml './devices/graphics/@defaultMode=insecure' \
    --xml './devices/graphics/@autoport=no' \
    --xml './devices/graphics/@type=spice' \
    --xml "./devices/graphics/@port=20001"

Those of us who are curious of the generated xml may add the --print-xml option.

Answer 3

the solution is to tell kvm/virt to use as default an insecure connection.

<graphics type='spice' autoport='yes' listen='0.0.0.0' defaultMode='insecure'>
  <listen type='address' address='0.0.0.0'/>
</graphics>

Set the defaultMode to insecure and you can use even autoport='yes' and everything is fine.

One hint, when you search the port, you have to use domdisplay:

[root@kvm repo]# virsh domdisplay --domain openshift1
spice://localhost:5900

I don't know if this is a bug or correct behavior, but the output of virsh domdisplay --domain openshift1 shows localhost instead of 0.0.0.0. But you can connect from external with the server-ip/dns to your guest vm's. Be sure the firewall let you connect to these ports and even kvm/virt does listen to 0.0.0.0 like shown above.

Answer 4

If this helps...

listen=0.0.0.0,  <-- listen on any interface
port=5962, <-- specify non-secure port
tlsport=,  <-- do not request TLS
defaultMode='insecure'  <-- allow insecure

virt-install \
...
    --graphics spice,listen=0.0.0.0,port=5962,tlsport=,defaultMode='insecure' \
...

Resulting XML:

    <graphics type='spice' port='5962' autoport='no' listen='0.0.0.0' defaultMode='insecure'>
      <listen type='address' address='0.0.0.0'/>
      <image compression='off'/>
    </graphics>