Unable to move VMs since upgrading to Ganeti 3.1.0~rc2-3 on Debian

[Steffen Zieger]

Hey there,

I'm having a weird issue, since upgrading to Ganeti 3.1.0, initially on Debian Bookworm, and, just to be sure it's not because of any libraries, on Debian Trixie.
The whole cluster is now on Debian Trixie, but the error stayed the same (sadly).

Whenever I'm trying to move an instance, it fails with the following error:

Instance redmine1 will be moved. This requires a shutdown of the
instance. Continue?
y/[n]/?: y
Tue Mar  3 16:37:59 2026  - INFO: Shutting down instance redmine1.oberheld.de on source node gnt16.example.com
Tue Mar  3 16:38:07 2026 Exporting disk/0 from gnt16.example.com to gnt17.example.com
Tue Mar  3 16:38:10 2026 disk/0 is now listening, starting export
Tue Mar  3 16:38:13 2026  - WARNING: import 'import-disk0-2026-03-03_16_38_07-jr2ja1oh' on gnt17.example.com failed: Exited with status 1
Tue Mar  3 16:38:13 2026 disk/0 failed to receive data: Exited with status 1 (recent output: socat: W OpenSSL: Warning: this implementation does not check C
RLs\n0+0 records in\n0+0 records out\n0 bytes copied, 4.18511 s, 0.0 kB/s)
Tue Mar  3 16:38:13 2026  - WARNING: Aborting export 'export-disk0-2026-03-03_16_38_12-nc23pg8x' on 201a4289-2d4a-4354-b938-60071367046a
Tue Mar  3 16:38:13 2026  - WARNING: export 'export-disk0-2026-03-03_16_38_12-nc23pg8x' on gnt16.example.com failed: Exited with status 1
Tue Mar  3 16:38:13 2026 disk/0 failed to send data: Exited with status 1 (recent output: socat: W OpenSSL: Warning: this implementation does not check CRLs
\nsocat: E certificate is valid but its commonName does not match hostname "gnt17.example.com")
Tue Mar  3 16:38:13 2026  - WARNING: Some disks failed to copy, aborting
Failure: command execution error:
Errors during disk copy: Failed to transfer instance data

I've stumbled upon https://github.com/ganeti/ganeti/pull/1699/changes which sounds like as if it's fixing the issue, but this change is there and it's still not working.

I'm using a separate replication network. Maybe it's related to that?

Anybody else ran into this issue and found a fix?

Best,

saz

--

Steffen Zieger
Teamleiter Infrastruktur
Ströer Online Marketing
Rotebühlstraße 50, 70178 Stuttgart
E-Mail: steffen...@stroeer-online-marketing.de
Fon: (0711) 128 501 666

RegioHelden GmbH | https://stroeer-online-marketing.de
Sitz der Gesellschaft: Stuttgart
Registergericht: Amtsgericht Stuttgart, HRB 733189
Geschäftsführer: Dr. Andreas Müller-Leydig, Christoph Kreuzer

Datenschutz Pflichtinformationen gemäß Artikel 12 ff. DSGVO zur Verarbeitung personenbezogener Daten entnehmen Sie bitte unserer Datenschutzerklärung unter https://stroeer-online-marketing.de/dsgvo

[Sascha Lucas]

Hi Steffen,

On Tue, 3 Mar 2026, 'Steffen Zieger' via ganeti wrote:

> I'm having a weird issue, since upgrading to Ganeti 3.1.0, initially on
> Debian Bookworm, and, just to be sure it's not because of any libraries, on
> Debian Trixie.
> The whole cluster is now on Debian Trixie, but the error stayed the same
> (sadly).

Also sadly our Debian Maintainer contact becomes inactive and Debian only
has Ganeti-3.1.0~rc2, instead of 3.1.0.

> Whenever I'm trying to move an instance, it fails with the following error:

...

> I've stumbled upon https://github.com/ganeti/ganeti/pull/1699/changes which
> sounds like as if it's fixing the issue, but this change is there and it's
> still not working.

Please try to apply https://github.com/ganeti/ganeti/pull/1840.patch. It
was initially discovered to solve `gnt-backup`, but might also fix
`gnt-instance move`.

Don't forget to restart Ganeti service after editing python code.

HTH, Sascha.

[Rudolph Bott]

Hi Steffen,

could you post (sanitized) log output from the ganeti node daemon on the affected Ganeti node?

Cheers,

Rudi

--
You received this message because you are subscribed to the Google Groups "ganeti" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ganeti+un...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/ganeti/CAEqg01YExqSh5zKJT3vJ_wyOVUaQKDVA2_Y2j7FOLm6mHeuMXg%40mail.gmail.com.

--

 Rudolph Bott - bo...@sipgate.de

 Telefon: +49 (0)211-63 55 55-55

 Telefax: +49 (0)211-63 55 55-22

 sipgate GmbH - Gladbacher Str. 74 - 40219 Düsseldorf

 HRB Düsseldorf 39841 - Geschäftsführer: Thilo Salmon, Tim Mois

 Steuernummer: 106/5724/7147, Umsatzsteuer-ID: DE219349391

 www.sipgate.de - www.sipgate.co.uk

[Rudolph Bott]

Hi Sascha,

Am Di., 3. März 2026 um 22:38 Uhr schrieb 'Sascha Lucas' via ganeti <gan...@googlegroups.com>:

Also sadly our Debian Maintainer contact becomes inactive and Debian only
has Ganeti-3.1.0~rc2, instead of 3.1.0.

Ganeti 3.1.0-stable is on its way (slowly). It is currently stuck "behind" a Haskell transition in Debian Sid: https://release.debian.org/transitions/html/haskell.html

 

Cheers,

Rudi

[Steffen Zieger]

On Tue, 3 Mar 2026 at 22:38, 'Sascha Lucas' via ganeti <gan...@googlegroups.com> wrote:

Hi Steffen,

Hi Sascha,

 

Please try to apply https://github.com/ganeti/ganeti/pull/1840.patch. It
was initially discovered to solve `gnt-backup`, but might also fix
`gnt-instance move`.

Indeed, this fixes the issue I'm seeing.

As far as I can see, this patch is already part of Ganeti 3.1.0, so it's just a matter of time,

until the fixed version is available in Debian. Nice!

Thanks for the quick help!

Is this expected? I think socat should use proper TLS with valid certificates,

but maybe I'm missing some part here and verification happens earlier or through another method.

@Rudolph: I can still send logs, but even with debug enabled, there wasn't anything useful.

HAND,

saz

[Rudolph Bott]

Hi Steffen,

Am Mi., 4. März 2026 um 10:53 Uhr schrieb 'Steffen Zieger' via ganeti <gan...@googlegroups.com>:

Indeed, this fixes the issue I'm seeing.

Good to hear and good catch Sascha!

 

Is this expected? I think socat should use proper TLS with valid certificates,

but maybe I'm missing some part here and verification happens earlier or through another method.

I guess it is safe to say that Ganeti does not live up to today's standards in the way it uses certificates. There is definitely room for improvement :-)

 

@Rudolph: I can still send logs, but even with debug enabled, there wasn't anything useful.

No worries - since it is solved anyways, there is no need for further logs :-)

Cheers,

Rudi