Hi Team

I am planning openstack-ansible wallaby to Xena upgrade.

Distribution: openstack-ansible

Release: Wallaby (current) ==> Xena (Planned)

I was checking the release notes of Xena and could see that there is introduction of SSL in several services with nova for live migrations one of them.

https://docs.openstack.org/releasenotes/openstack-ansible/xena.html

As per the release notes:

Nova now defaults to to using the “QEMU-native TLS” feature for live migrations, rather than the deprecated SSH method. A pre-existing PKI (Public Key Infrastructure) setup is required.
QEMU-native TLS requires all compute hosts to accept TCP connections on port 16514 and port range 49152 to 49261.
More information can be found here: https://docs.openstack.org/nova/latest/admin/secure-live-migration-with-qemu-native-tls.html

Can you please confirm what steps are required to setup this PKI before doing the upgrade or it will be taken care by internal-pki using openstack-ansible upgrade method?

Is there any option to skip this QEMU-native TLS for live-migrations and keep the orginal ssh based live-migrations?

Regards