FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Completed config option to allow nested virtualization by bradywilkin · Pull Request #10812 · apache/cloudstack · GitHub

/ cloudstack Public

Completed config option to allow nested virtualization #10812

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bradywilkin wants to merge 1 commit into
base: 4.22
Choose a base branch
Could not load branches
Branch not found: {{ refName }}

Are you sure you want to change the base?

Some commits from the old base branch may be removed from the timeline, and old review comments may become outdated.
from
Conversation 8 Commits 1 Checks 2 Files changed
Open

Completed config option to allow nested virtualization #10812

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension .java  (3) All 1 file type selected
Viewed files
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Unified
Split
Hide whitespace
Diff view
Unified
Split
Hide whitespace
2 changes: 2 additions & 0 deletions ...rvisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java
Show comments
View file
Open in desktop
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Original file line number Diff line number Diff line change
Expand Up @@ -4846,6 +4846,8 @@ protected long getMemoryFreeInKBs(Domain dm) throws LibvirtException {
}

private boolean canBridgeFirewall(final String prvNic) {

weizhouapache May 5, 2025

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

the method in LibvirtComputingResource are executed on the kvm host (part of cloudstack-agent)
The host cannot access the database.
so, this won't work.

a feasible way is, adding a setting to agent.properties
if (getAllowNestedVMAccess())
return true; // If nested VM is allowed, then we skip call to security group and allow bypassing firewall
Comment on lines +4849 to +4850

Copilot AI May 5, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

[nitpick] Consider adding braces around the single-line if statement to enhance readability and reduce potential errors in future modifications.

Suggested change
if (getAllowNestedVMAccess())
return true; // If nested VM is allowed, then we skip call to security group and allow bypassing firewall
if (getAllowNestedVMAccess()) {
return true; // If nested VM is allowed, then we skip call to security group and allow bypassing firewall
}

Copilot uses AI. Check for mistakes.
final Script cmd = new Script(securityGroupPath, timeout, LOGGER);
cmd.add("can_bridge_firewall");
cmd.add("--privnic", prvNic);
Expand Down
7 changes: 7 additions & 0 deletions server/src/main/java/com/cloud/network/IpAddressManagerImpl.java
Show comments
View file
Open in desktop
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Original file line number Diff line number Diff line change
Expand Up @@ -329,6 +329,9 @@ public class IpAddressManagerImpl extends ManagerBase implements IpAddressManage

public static final ConfigKey<Integer> PUBLIC_IP_ADDRESS_QUARANTINE_DURATION = new ConfigKey<>("Network", Integer.class, "public.ip.address.quarantine.duration",
"0", "The duration (in minutes) for the public IP address to be quarantined when it is disassociated.", true, ConfigKey.Scope.Domain);

public static final ConfigKey<Boolean> AllowNestedVMAccess = new ConfigKey<>("Advanced", Boolean.class, "allow.nested.vm.access",

pavanaravapalli Oct 18, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

@bradywilkin
Append the new configKey "AllowNestedVMAccess" to the list returned by the getConfigKeys() method in IpAddressManagerImpl. Please refer getConfigKeys().
"false", "Allows nested VM access by bypassing security group restrictions. Use with caution.", true, ConfigKey.Scope.Global);

private Random rand = new Random(System.currentTimeMillis());

Expand Down Expand Up @@ -2453,6 +2456,10 @@ public static ConfigKey<Boolean> getSystemvmpublicipreservationmodestrictness()
return SystemVmPublicIpReservationModeStrictness;
}

public static ConfigKey<Boolean> getAllowNestedVMAccess() {
return AllowNestedVMAccess;
}

@Override
public boolean canPublicIpAddressBeAllocated(IpAddress ip, Account newOwner) {
PublicIpQuarantineVO publicIpQuarantineVO = publicIpQuarantineDao.findByPublicIpAddressId(ip.getId());
Expand Down
10 changes: 10 additions & 0 deletions server/src/test/java/com/cloud/network/IpAddressManagerTest.java
Show comments
View file
Open in desktop
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Original file line number Diff line number Diff line change
Expand Up @@ -491,4 +491,14 @@ public void checkIfIpResourceCountShouldBeUpdatedTestIpIsAssociatedToVpcAndNotDe

Assert.assertTrue(result);
}

@Test
public void testCanBridgeFirewallWithNestedVMAccessEnabled() {
// Force config to return true for AllowNestedVMAccess
Mockito.doReturn(true).when(ipAddressManager).getAllowNestedVMAccessConfig();

boolean result = ipAddressManager.canBridgeFirewall("eth0");

Assert.assertTrue("Should return true when AllowNestedVMAccess is enabled", result);
}
}
Back | FazBrowse Home | New Git URL