---
title: About Migration Toolkit for Virtualization (MTV) providers
---

# About Migration Toolkit for Virtualization (MTV) providers {#virt-about-mtv-providers}

To migrate a virtual machine (VM) across OpenShift Container Platform clusters, you must configure an OpenShift Container Platform provider for each cluster that you are including in the migration. If MTV is already installed on a cluster, a local provider already exists.

## Configuring the root certificate authority for providers {#virt-configuring-root-ca-for-providers_virt-about-mtv-providers}

You must configure an OpenShift Container Platform provider for each cluster that you are including in a migration, and each provider requires a certificate authority (CA) for the cluster. Configure the root CA for the entire cluster to avoid CA expiration, which causes the provider to fail.

**Procedure**

1. Run the following command against the cluster for which you are creating the provider:

   ```terminal
   $ oc get cm kube-root-ca.crt -o=jsonpath={.data.ca\\.crt}
   ```
2. Copy the printed certificate.
3. In the Migration Toolkit for Virtualization (MTV) web console, create a provider and select **OpenShift Virtualization**.
4. Paste the certificate into the **CA certificate** field, as shown in the following example:

   ```terminal
   -----BEGIN CERTIFICATE-----
   <CA_certificate_content>
   -----END CERTIFICATE-----
   ```

## Creating the long-lived service account and token to use with MTV providers {#virt-creating-long-lived-account-and-token_virt-about-mtv-providers}

When you register an OpenShift Virtualization provider in the Migration Toolkit for Virtualization (MTV) web console, you must create a service account and cluster role binding, which gives MTV persistent permissions to read and create virtual machine resources during migration.

**Procedure**

1. Create the cluster role as shown in the following example:

   ```yaml
   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRole
   metadata:
     name: live-migration-role
   rules:
     - apiGroups:
         - forklift.konveyor.io
       resources:
         - '*'
       verbs:
         - get
         - list
         - watch
     - apiGroups:
         - ""
       resources:
         - secrets
         - namespaces
         - configmaps
         - persistentvolumes
         - persistentvolumeclaims
       verbs:
         - get
         - list
         - watch
         - create
         - update
         - patch
         - delete
     - apiGroups:
         - k8s.cni.cncf.io
       resources:
         - network-attachment-definitions
       verbs:
         - get
         - list
         - watch
     - apiGroups:
         - storage.k8s.io
       resources:
         - storageclasses
       verbs:
         - get
         - list
         - watch
     - apiGroups:
         - kubevirt.io
       resources:
         - virtualmachines
         - virtualmachines/finalizers
         - virtualmachineinstancemigrations
       verbs:
         - get
         - list
         - watch
         - create
         - update
         - patch
         - delete
     - apiGroups:
         - kubevirt.io
       resources:
         - kubevirts
         - virtualmachineinstances
       verbs:
         - get
         - list
         - watch
     - apiGroups:
         - cdi.kubevirt.io
       resources:
         - datavolumes
         - datavolumes/finalizers
       verbs:
         - get
         - list
         - watch
         - create
         - update
         - patch
         - delete
     - apiGroups:
         - apps
       resources:
         - deployments
       verbs:
         - get
         - list
         - watch
         - create
         - update
         - patch
         - delete
     - apiGroups:
         - instancetype.kubevirt.io
       resources:
         - virtualmachineclusterpreferences
         - virtualmachineclusterinstancetypes
       verbs:
         - get
         - list
         - watch
     - apiGroups:
         - instancetype.kubevirt.io
       resources:
         - virtualmachinepreferences
         - virtualmachineinstancetypes
       verbs:
         - get
         - list
         - watch
         - create
         - update
         - patch
         - delete
   ```
2. Create the cluster role by running the following command:

   ```terminal
   $ oc create -f <filename>.yaml
   ```
3. Create a service account by running the following command:

   ```terminal
   $ oc create serviceaccount <service_account_name> -n <service_account_namespace>
   ```
4. Create a cluster role binding that links the service account to the cluster role, by running the following command:

   ```terminal
   $ oc create clusterrolebinding <service_account_name> --clusterrole=<cluster_role_name> --serviceaccount=<service_account_namespace>:<service_account_name>
   ```
5. Create a secret to hold the token by saving the following manifest as a YAML file:

   ```yaml
   apiVersion: v1
   kind: Secret
   metadata:
     name: <name_of_secret>
     namespace: <namespace_for_service_account>
     annotations:
       kubernetes.io/service-account.name: <service_account_name>
   type: kubernetes.io/service-account-token
   ```
6. Apply the manifest by running the following command:

   ```terminal
   $ oc apply -f <filename>.yaml
   ```
7. After the secret is populated, run the following command to get the service account bearer token:

   ```terminal
   $ TOKEN_BASE64=$(oc get secret "<name_of_secret>" -n "<namespace_bound_to_service_account>" -o jsonpath='{.data.token}')
     TOKEN=$(echo "$TOKEN_BASE64" | base64 --decode)
     echo "$TOKEN"
   ```
8. Copy the printed token.
9. In the Migration Toolkit for Virtualization (MTV) web console, when you create a provider and select **OpenShift Virtualization**, paste the token into the **Service account bearer token** field.

**Additional resources**
{._additional-resources}

- [Adding a Red Hat OpenShift Virtualization source provider](https://docs.redhat.com/en/documentation/migration_toolkit_for_virtualization/2.9/html-single/installing_and_using_the_migration_toolkit_for_virtualization/index#adding-source-provider_cnv)
- [Adding an OpenShift Virtualization destination provider](https://docs.redhat.com/en/documentation/migration_toolkit_for_virtualization/2.9/html-single/installing_and_using_the_migration_toolkit_for_virtualization/index#adding-source-provider_dest_cnv)