teapot questions by xen + iscsi

Question

Xen

I plan to install the Xen platform on an enterprise scale and I just can’t figure out the issue of placing virtual machines on iscsi disks.

Available: boxed SAN (Synology rackstation), on board raid5, LVM, iscsi-target.
Planned: Xen (xensource) on debian.
In DomU, I assume that two partitions are enough for everyone ( sda1: /, /boot, /usr; sda2: /var, /tmp)

1. How to give iscsi luns as disks to virtual machines?
Do I need to connect them all to Dom0 and only then provide them to domains as physical disks,
or is there some way to give them directly ( hypothetically like disk = [ 'iscsi: path,sda1,w' ] )

2. How will such network partitions be resized?
According to howto, you need to: unmount the iscsi disk; resize it to SAN; re-login target; resize the file.
Unmounting the disk means the need to shut down the virtual machine. Is it possible to do without it?

3. Maybe it makes sense to add another LVM layer on top of iscsi in Dom0?
Will LVM see the change in iscsi-PV itself, or does it need to be kicked in a special way?

And also:
how kosher is it to plant useful services in Dom0, in addition to xend?
I would like to consolidate dhcp, vpn, nagios, log server, web admin panels of the entire zoo there.

Answer 1

I can't tell you about iscsi, but about the second part:
There should be nothing in Dom0. For the paranoid - and IP-addresses too.
This is due to security, the more demons, the higher the probability of hacking. And hacking Dom0 == hacking all domUs.

Answer 2

Nothing is done on its own. Regular (for XCP, for example) is the option with LVM over an iSCSI disk. But you need to be prepared for problems with clustering (because LVM cannot run on two hosts at the same time with one disk). Then, either CLVM, or a manual decision "who is the master today." Technically, the disk can be resized during migration (that is, migrating to the host where the initiator is connected after the LUN size has been increased).
In dom0, it is not kosher to put anything other than administration. A VPN and a log server are definitely out of place there. It is necessary - make a separate management virtual machine. dom0 should only do what is impossible or very expensive to do on virtual machines. The same dhcp can perfectly be distributed from a miniature virtual machine plugged into the network to the right clients (well, or vice versa).