Implementing secure and efficient migration practices is essential for production environments. This chapter covers comprehensive best practices for plan management, provider security, query optimization, and secure operations derived from real-world deployment experience and security requirements.
Overview: Operational Excellence Framework
Best Practices Philosophy
Effective kubectl-mtv operations balance several key principles:
Security by Default: Implement least-privilege access, secure authentication, and encrypted communications
# 1. Single VM Test Plan
kubectl mtv create plan --name test-single \--source test-provider \--target test-cluster \--vms"small-test-vm"\--target-namespace test-migrations \--migration-type cold
# 2. Small Batch Test Plan
kubectl mtv create plan --name test-batch \--source test-provider \--target test-cluster \--vms"test-vm-01,test-vm-02,test-vm-03"\--target-namespace test-migrations \--migration-type warm
# 3. Production Pilot Plan
kubectl mtv create plan --name pilot-production \--source prod-provider \--target prod-cluster \--vms"non-critical-app-01"\--target-namespace production-pilot \--migration-type warm \--convertor-node-selector"migration=true"# 4. Full Production Plan (after validation)
kubectl mtv create plan --name production-migration \--source prod-provider \--target prod-cluster \--vms @validated-production-vms.yaml \--target-namespace production \--migration-type warm \--network-mapping prod-network-map \--storage-mapping prod-storage-map \--pre-hook production-backup-hook \--post-hook production-validation-hook
Test Plan Validation
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
# Validate plan configuration before execution
kubectl mtv describe plan --name test-plan --with-vms# Check resource availability
kubectl describe nodes | grep-A5"Allocatable"# Verify mapping configurations
kubectl mtv describe mapping network --name test-network-map
kubectl mtv describe mapping storage --name test-storage-map
# Test provider connectivity
kubectl mtv get inventory vms --provider test-provider -v=2
# Validate target namespace and permissions
kubectl auth can-i create vm -n test-migrations
# Production warm migration with strategic scheduling
kubectl mtv create plan --name production-warm \--source vsphere-prod \--target openshift-prod \--migration-type warm \--vms @production-vms.yaml \--target-namespace production \--convertor-node-selector"migration-worker=true,performance=high"\--convertor-affinity"REQUIRE nodes(storage=nvme) on node"\--target-affinity"PREFER nodes(production=true) on zone"\--network-mapping production-network \--storage-mapping production-storage
# Start with cutover scheduled for maintenance window
kubectl mtv start plan --name production-warm \--cutover"$(date-d'next Sunday 2:00 AM'--iso-8601=seconds)"# Monitor warm migration progress
kubectl mtv get plan --name production-warm --watch# Adjust cutover if needed
kubectl mtv cutover plan --name production-warm \--cutover"$(date-d'+30 minutes'--iso-8601=seconds)"
Warm Migration Benefits
Reduced Downtime: Pre-copy phase minimizes service interruption
Validation Window: Time to verify data transfer before cutover
Rollback Capability: Source VM remains available until cutover completion
Performance Optimization: Multiple attempts to optimize transfer speed
Archiving and Lifecycle Management
Strategic Plan Archival
1
2
3
4
5
6
7
8
9
10
11
12
13
# Archive completed migrations for audit trail
kubectl mtv archive plan --name completed-q1-migration
kubectl mtv archive plan --name successful-pilot-test
# Bulk archive old completed plansfor plan in$(kubectl mtv get plans --output json | jq -r'.items[] | select(.status.phase == "Succeeded" and (.metadata.creationTimestamp | fromdateiso8601) < (now - 90*24*3600)) | .metadata.name');do
echo"Archiving old plan: $plan"
kubectl mtv archive plan --name"$plan"done# Maintain active plans, archive obsolete ones
kubectl mtv get plans | grep-E"(Failed|Cancelled)" | awk'{print $1}' | \
xargs -I{} kubectl mtv archive plan --name{}
Plan Template Management
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
# Create reusable plan templates
kubectl mtv create plan --name template-web-tier \--source vsphere-template \--migration-type warm \--target-namespace web-applications \--convertor-node-selector"workload=web"\--target-affinity"PREFER pods(tier=web) on zone"\--network-mapping web-network-map \--storage-mapping web-storage-map \--vms placeholder-vm
# Archive template for reuse
kubectl mtv archive plan --name template-web-tier
# Clone template for actual use
kubectl mtv unarchive plan --name template-web-tier
kubectl mtv patch plan --plan-name template-web-tier \--description"Q2 2024 web tier migration"\--vms"web-01,web-02,web-03"
Provider Security
Credentials Management
Secure Provider Creation
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
# Use strong authentication credentials
kubectl mtv create provider --name secure-vsphere \--type vsphere \--url https://vcenter.secure.com/sdk \--username"migration_service@secure.local"\--password"$(openssl rand -base64 32)"\--cacert @/secure/certificates/vcenter-ca.crt \--vddk-init-image registry.secure.com/vddk:8.0.2
# Verify certificate validation is enabled
kubectl mtv describe provider --name secure-vsphere | grep-i"skip.*tls\|insecure"# Rotate credentials regularly
kubectl mtv patch provider --name secure-vsphere \--password"$(openssl rand -base64 32)"
# Use specific filters instead of broad queries# Good: Specific criteria
kubectl mtv get inventory vms --provider vsphere-prod \--query"where powerState = 'poweredOn' and memory.size > 8192 and name like 'prod-%'"# Avoid: Broad unfiltered queries# kubectl mtv get inventory vms --provider vsphere-prod # Returns everything# Good: Targeted network queries
kubectl mtv get inventory networks --provider vsphere-prod \--query"where name ~= '.*production.*' and type != 'dvPortGroup'"# Good: Storage queries with size filters
kubectl mtv get inventory storages --provider vsphere-prod \--query"where capacity > 1073741824 and type = 'VMFS'"# > 1GB
Index-Friendly Query Patterns
1
2
3
4
5
6
7
8
9
10
11
# Use exact matches when possible (more efficient)
kubectl mtv get inventory vms --provider vsphere-prod \--query"where name = 'specific-vm-name'"# Use LIKE with anchored patterns
kubectl mtv get inventory vms --provider vsphere-prod \--query"where name like 'prod-web-%'"# Anchored prefix# Combine filters efficiently
kubectl mtv get inventory vms --provider vsphere-prod \--query"where powerState = 'poweredOn' and guestOS like 'linux%' and memory.size between 4096 and 16384"
Query Result Management
Efficient Result Processing
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
# Export large queries to files for processing
kubectl mtv get inventory vms --provider large-provider \--query"where tags.category = 'production'"\--output planvms > production-vms.yaml
# Use pagination for massive datasets
kubectl mtv get inventory vms --provider huge-provider \--query"where name ~= '^[a-m].*'"# First half alphabetically
kubectl mtv get inventory vms --provider huge-provider \--query"where name ~= '^[n-z].*'"# Second half# Process results in manageable chunksfor prefix in{a..z};do
kubectl mtv get inventory vms --provider large-provider \--query"where name like '${prefix}%'"\--output planvms >"vms-${prefix}.yaml"done
# Restrict migration namespace network accessapiVersion:networking.k8s.io/v1kind:NetworkPolicymetadata:name:migration-network-policynamespace:migrationsspec:podSelector:{}policyTypes:-Ingress-Egressingress:-from:-namespaceSelector:matchLabels:name:migration-adminegress:-to:-namespaceSelector:matchLabels:name:openshift-mtv-to:[]ports:-protocol:TCPport:443# HTTPS for provider APIs-protocol:TCPport:6443# Kubernetes API
Secure Communication
1
2
3
4
5
6
7
8
# Ensure all provider communications use TLS
kubectl mtv get providers --output yaml | grep-B5-A5"insecureSkipTLS: true"||echo"All providers use TLS"# Verify certificate validationfor provider in$(kubectl mtv get providers --outputjsonpath='{.items[*].metadata.name}');do
echo"Provider: $provider"
kubectl mtv describe provider --name"$provider" | grep-i"certificate\|tls\|insecure"done
Data Protection
Encryption and Key Management
1
2
3
4
5
6
7
8
9
10
11
12
13
14
# Use encrypted secrets for provider credentials
kubectl create secret generic secure-provider-creds \--from-literal=username=encrypted_user \--from-literal=password="$(gpg --symmetric--armor--cipher-algo AES256 <<<'actual-password')"\-n migrations
# Label secrets for encryption compliance
kubectl label secret secure-provider-creds \encryption=required \compliance=sox \
data-classification=confidential
# Verify secret encryption at rest
kubectl get secrets -o yaml | grep-A5-B5"encryption"
# Resource quota for migration namespaceapiVersion:v1kind:ResourceQuotametadata:name:migration-quotanamespace:migrationsspec:hard:requests.cpu:"20"requests.memory:64Gilimits.cpu:"40"limits.memory:128Gipersistentvolumeclaims:"50"secrets:"20"---# Limit range for migration podsapiVersion:v1kind:LimitRangemetadata:name:migration-limitsnamespace:migrationsspec:limits:-type:Podmax:cpu:"8"memory:16Gidefault:cpu:"2"memory:4GidefaultRequest:cpu:"1"memory:2Gi
Secure Convertor Pod Configuration
1
2
3
4
5
6
7
8
9
# Create convertor pods with security context
kubectl mtv create plan --name secure-migration \--source vsphere-secure \--convertor-node-selector"security=restricted,taint=dedicated"\--convertor-labels"security-context=restricted,compliance=required"\--vms @secure-vms.yaml
# Verify convertor security configuration
kubectl describe pod convertor-pod | grep-A10"Security Context"