Terraform-provider-libvirt: Slow /dev/random device in ubuntu 18.04

[klauserber]

Version Reports:

Distro version of host:

Ubuntu 18.04

Terraform Version Report

Terraform v0.11.11
+ provider.libvirt (unversioned)
+ provider.template v1.0.0

Provider and libvirt versions

/root/.terraform.d/plugins/terraform-provider-libvirt 0.5.1
Compiled against library: libvirt 4.0.0
Using library: libvirt 4.0.0
2019/01/01 23:05:06 virError(Code=38, Domain=7, Message='Failed to connect socket to '/var/run/libvirt/libvirt-sock': No such file or directory')

---

Description of Issue/Question

Setup

provider "libvirt" {  
  uri = "PUT_YOUR_URI_HERE"
}

# We fetch the latest ubuntu release image from their mirrors
resource "libvirt_volume" "vm-vol" {
  name = "vm-vol.qcow2"
  pool = "domain-images"
  base_volume_name = "ubuntu-18.04-01.img"
  base_volume_pool = "system-images"
  format = "qcow2"
}

# Create the machine
resource "libvirt_domain" "vm" {
  name = "vm"
  memory = "512"
  vcpu = 1

  network_interface {
    network_name = "default"
  }

  console {
    type        = "pty"
    target_port = "0"
    target_type = "serial"
  }

  console {
    type        = "pty"
    target_type = "virtio"
    target_port = "1"
  }

  disk {
    volume_id = "${libvirt_volume.vm-vol.id}"
  }

}

Steps to Reproduce Issue

The boot of the VMs stuck at the line 'C) 2000-2006 Netfilter Core Team' for a random time (ca. 5-600 seconds)

[    6.080289] random: fast init done
[    6.120480] random: systemd-udevd: uninitialized urandom read (16 bytes read)
[    6.149581] random: systemd-udevd: uninitialized urandom read (16 bytes read)
[    6.157440] random: systemd-udevd: uninitialized urandom read (16 bytes read)
[    6.188110] Btrfs loaded, crc32c=crc32c-generic
[    6.309294] EXT4-fs (vda1): mounted filesystem with ordered data mode. Opts: (null)
[    6.553245] ip_tables: (C) 2000-2006 Netfilter Core Team
[  180.267583] systemd[1]: systemd 237 running in system mode. (+PAM +AUDIT +SELINUX +IMA +APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD -IDN2 +IDN -PCRE2 default-hierarchy=hybrid)

The problem ist the section for the random device in the domain xml:

  <devices>
    ...
    <rng model='virtio'>
      <backend model='random'>/dev/random</backend>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
    </rng>
  </devices>

The use of /dev/urandom fixes the issue.

I have tried to transform the xml - without success. It seems as if the provider don't generate this section.

  xml {
    xslt = "${file("${path.module}/transform-domain.xsl")}"
  }

The style sheet:

<?xml version="1.0" ?>
<xsl:stylesheet version="1.0"
                xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
  <xsl:output omit-xml-declaration="yes" indent="yes"/>
  <xsl:template match="node()|@*">
     <xsl:copy>
       <xsl:apply-templates select="node()|@*"/>
     </xsl:copy>
  </xsl:template>

  <xsl:template match="/domain/devices/rng/backend/text()">
    <xsl:value-of select="'/dev/urandom'"/>
  </xsl:template>

</xsl:stylesheet>

---

Additional Infos:

Apparmor andFirewall are disabled

[klauserber]

A solution is to install the package 'rng-tools' on the host system. It would be nice if this were documented somewhere.

[inercia]

Thanks for the feedback @klauserber. From the man page, it seem that _"When the entropy pool is empty, reads from /dev/random will block until additional environmental noise is gathered."_, while reads from /dev/urandom are non-blocking. The rng-tools _"daemon feeds data from a random number generator to the kernel's random number entropy pool"_, so I guess the blocking is because the entropy pool is empty...

Could you please submit a PR documenting these issues? Maybe we should also change the default domain definition and use /dev/urandom...

[klauserber]

Hello @inercia, I think we should changes the domain definition to use /dev/urandom as recommended here: https://libvirt.org/formatdomain.html#elementsRng . Do you agree?

I have a working solution based on v0.5.1. Just a small change in domain_def.go.

But the master branch is not work for me, because there is something wrong with the volume creation (the resulting initial volume size in the above example is much smaller and the vm don't start). Examining this at the moment...

[inercia]

_" When no file name is specified, the hypervisor default is used. For QEMU, the default is /dev/random. However, the recommended source of entropy is /dev/urandom (as it doesn't have the limitations of /dev/random)."_ Yeah, I think we should change the default value... :+1:

[MalloZup]

https://unix.stackexchange.com/questions/324209/when-to-use-dev-random-vs-dev-urandom

[abbbi]

See my branch. Doesnt change the overall default which is picked by qemu but at least allows to set the rng device via config. Defaults to /dev/urandom in config.

rng {
device = ...
}