agent: enable ssl only for kvm agent (not in system vms) by weizhouapache · Pull Request #6371 · apache/cloudstack · GitHub

Description

This PR fixes the issue that template cannot be downloaded from https site in 4.17.0.0 RC2.

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

Bug Severity

BLOCKER
Critical
Major
Minor
Trivial

Screenshots (if appropriate):

How Has This Been Tested?

@blueorangutan package

@weizhouapache a Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

Packaging result: ✔️ el7 ✔️ el8 ✔️ debian ✔️ suse15. SL-JID 3383

@blueorangutan test

@nvazquez a Trillian-Jenkins test job (centos7 mgmt + kvm-centos7) has been kicked to run smoke tests

@nvazquez @weizhouapache Could this cause an issue with (a) direct download, (b) ssl enabled cpvm and ssvm. Should we attempt to fix the issue by importing or referencing the system keystore too where java/ca certs are stored and imported (for x1/letsencrypt) @Pearl1594 ?

@rohityadavcloud @nvazquez @Pearl1594
this part of code was introduced in #6200 which aims to fix an issue with direct download on KVM.
with this pr, SSL is still enabled on KVM hosts, but not in system VMs where Java process load key store realhostip.keystone (same as the behavior without #6200 )

Makes sense if this was relatively newer code.

@blueorangutan ubuntu20 kvm-ubuntu20

Verified HTTPS templates working on KVM env with this fix

The use of LIBVIRT_COMPUTING_RESOURCE or com.cloud.hypervisor.kvm.resource.LibvirtComputingResource may be misleading (for ex. what if this isn't the resource name? for example, we do support lxc etc?).

Can you simply add a check if the agent is either is in systemvm (for ex. /etc/cloudstack-release would exist) or if we're on a KVM host (check for /dev/kvm exists or libvirt running)? (Depending on what we're trying to achieve here). The other option usually is to check the resource class via some method.

What do you think @weizhouapache @nvazquez ?

@rohityadavcloud
I will move all these codes to LibvirtComputingResource which makes more sense.
I will verify the issue fixed by #6200 as well.

+1

Trillian test result (tid-4158)
Environment: kvm-centos7 (x2), Advanced Networking with Mgmt server 7
Total time taken: 36897 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr6371-t4158-kvm-centos7.zip
Smoke tests completed. 96 look OK, 0 have errors
Only failed tests results shown below:

Test	Result	Time (s)	Test File

This reverts commit b2d76ba.

This reverts commit 4525f8c.

Found UI changes, kicking a new UI QA build
@blueorangutan ui

@acs-robot a Jenkins job has been kicked to build UI QA env. I'll keep you posted as I make progress.

UI build: ✔️
Live QA URL: http://qa.cloudstack.cloud:8080/client/pr/6371 (SL-JID-1547)

@blueorangutan package

@weizhouapache a Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

0.0% Coverage
0.0% Duplication

Packaging result: ✔️ el7 ✔️ el8 ✔️ debian ✔️ suse15. SL-JID 3386

@blueorangutan test

@nvazquez a Trillian-Jenkins test job (centos7 mgmt + kvm-centos7) has been kicked to run smoke tests

tested - LGTM

LGTM

LGTM, manually tested

Trillian test result (tid-4161)
Environment: kvm-centos7 (x2), Advanced Networking with Mgmt server 7
Total time taken: 35729 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr6371-t4161-kvm-centos7.zip
Smoke tests completed. 83 look OK, 5 have errors
Only failed tests results shown below:

Test	Result	Time (s)	Test File
test_05_stop_ssvm	Error	29.77	test_ssvm.py
test_06_stop_cpvm	Error	3.00	test_ssvm.py
test_07_reboot_ssvm	Error	3.00	test_ssvm.py
test_08_reboot_cpvm	Error	3.00	test_ssvm.py
test_09_reboot_ssvm_forced	Error	3.00	test_ssvm.py
test_10_reboot_cpvm_forced	Error	3.00	test_ssvm.py
test_11_destroy_ssvm	Error	3.00	test_ssvm.py
test_12_destroy_cpvm	Error	3.00	test_ssvm.py
test_13_ss_nfs_version_on_ssvm	Error	3.00	test_ssvm.py
test_03_deploy_and_scale_kubernetes_cluster	Failure	27.97	test_kubernetes_clusters.py
test_07_deploy_kubernetes_ha_cluster	Failure	57.66	test_kubernetes_clusters.py
test_08_upgrade_kubernetes_ha_cluster	Failure	34.02	test_kubernetes_clusters.py
test_09_delete_kubernetes_ha_cluster	Failure	31.93	test_kubernetes_clusters.py
ContextSuite context=TestKubernetesCluster>:teardown	Error	116.86	test_kubernetes_clusters.py
ContextSuite context=TestPrivateVlansL2Networks>:setup	Error	836.82	test_network.py
test_hostha_enable_ha_when_host_disconected	Error	788.40	test_hostha_kvm.py
test_hostha_enable_ha_when_host_in_maintenance	Error	303.82	test_hostha_kvm.py
test_01_deploy_vm_on_specific_host	Error	1.16	test_vm_deployment_planner.py
test_04_deploy_vm_on_host_override_pod_and_cluster	Error	0.20	test_vm_deployment_planner.py

@blueorangutan test

@nvazquez a Trillian-Jenkins test job (centos7 mgmt + kvm-centos7) has been kicked to run smoke tests

Trillian test result (tid-4166)
Environment: kvm-centos7 (x2), Advanced Networking with Mgmt server 7
Total time taken: 37350 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr6371-t4166-kvm-centos7.zip
Smoke tests completed. 96 look OK, 0 have errors
Only failed tests results shown below:

Test	Result	Time (s)	Test File

apache#151) * agent: enable ssl only for kvm agent (not in system vms) * Revert "agent: enable ssl only for kvm agent (not in system vms)" This reverts commit b2d76ba. * Revert "KVM: Enable SSL if keystore exists (apache#6200)" This reverts commit 4525f8c. * KVM: Enable SSL if keystore exists in LibvirtComputingResource.java Co-authored-by: Wei Zhou <weizhou@apache.org>

…en enable SSL for kvm agent This was implemented in PR#6200 and apache#6371 , but broken in PR#6348

agent: enable ssl only for kvm agent (not in system vms)

b2d76ba

boring-cyborg Bot added the component:agent label May 10, 2022

weizhouapache requested review from Pearl1594, nvazquez and yadvr May 10, 2022 18:49

yadvr reviewed May 10, 2022

View reviewed changes

nvazquez approved these changes May 11, 2022

View reviewed changes

nvazquez added this to the 4.17.0.0 milestone May 11, 2022

nvazquez added the type:bug label May 11, 2022

yadvr reviewed May 11, 2022

View reviewed changes

weizhouapache added 3 commits May 11, 2022 11:19

Revert "agent: enable ssl only for kvm agent (not in system vms)"

9b43ad2

This reverts commit b2d76ba.

Revert "KVM: Enable SSL if keystore exists (apache#6200 )"

a16b46e

This reverts commit 4525f8c.

KVM: Enable SSL if keystore exists in LibvirtComputingResource.java

1b29eb9

boring-cyborg Bot added the component:kvm label May 11, 2022

weizhouapache requested a review from nvazquez May 11, 2022 09:57

slavkap approved these changes May 11, 2022

View reviewed changes

Pearl1594 approved these changes May 11, 2022

View reviewed changes

weizhouapache closed this May 11, 2022

weizhouapache reopened this May 11, 2022

nvazquez approved these changes May 11, 2022

View reviewed changes

nvazquez merged commit 8f39a04 into apache:main May 12, 2022

nvazquez mentioned this pull request May 23, 2022

bug: fail to download a template from https #6406

Closed

weizhouapache deleted the 4.17-fix-ssvm-ssl branch December 9, 2022 10:07

weizhouapache added a commit to weizhouapache/cloudstack that referenced this pull request Aug 30, 2023

kvm: fix error 'Failed to find passphrase for keystore: cloud.jks' wh…

5f312b2

…en enable SSL for kvm agent This was implemented in PR#6200 and apache#6371 , but broken in PR#6348

weizhouapache mentioned this pull request Aug 30, 2023

kvm: fix error when enable SSL for kvm agent #7923

Merged

12 tasks

DaanHoogland pushed a commit to weizhouapache/cloudstack that referenced this pull request Oct 18, 2023

kvm: fix error 'Failed to find passphrase for keystore: cloud.jks' wh…

26702b8

…en enable SSL for kvm agent This was implemented in PR#6200 and apache#6371 , but broken in PR#6348

+                      if (!LIBVIRT_COMPUTING_RESOURCE.equalsIgnoreCase(resource)) {
+                          s_logger.info("This is not a cloudstack kvm agent, ignoring");
+                          return;
+                      }

agent: enable ssl only for kvm agent (not in system vms) by weizhouapache · Pull Request #6371 · apache/cloudstack · GitHub

agent: enable ssl only for kvm agent (not in system vms) - #6371

agent: enable ssl only for kvm agent (not in system vms)#6371nvazquez merged 4 commits intoapache:mainapache/cloudstack:mainfrom weizhouapache:4.17-fix-ssvm-sslweizhouapache/cloudstack:4.17-fix-ssvm-sslCopy head branch name to clipboard

Conversation

weizhouapache commented May 10, 2022

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

Uh oh!

weizhouapache commented May 10, 2022

Uh oh!

blueorangutan commented May 10, 2022

Uh oh!

blueorangutan commented May 10, 2022

Uh oh!

nvazquez commented May 10, 2022

Uh oh!

blueorangutan commented May 10, 2022

Uh oh!

yadvr May 10, 2022

Choose a reason for hiding this comment

Uh oh!

weizhouapache May 10, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yadvr May 11, 2022

Choose a reason for hiding this comment

Uh oh!

weizhouapache commented May 10, 2022

Uh oh!

nvazquez commented May 11, 2022

Uh oh!

yadvr May 11, 2022

Choose a reason for hiding this comment

Uh oh!

weizhouapache May 11, 2022

Choose a reason for hiding this comment

Uh oh!

nvazquez May 11, 2022

Choose a reason for hiding this comment

Uh oh!

blueorangutan commented May 11, 2022

Uh oh!

acs-robot commented May 11, 2022

Uh oh!

blueorangutan commented May 11, 2022

Uh oh!

blueorangutan commented May 11, 2022

Uh oh!

weizhouapache commented May 11, 2022

Uh oh!

blueorangutan commented May 11, 2022

Uh oh!

sonarqubecloud Bot commented May 11, 2022

Uh oh!

blueorangutan commented May 11, 2022

Uh oh!

nvazquez commented May 11, 2022

Uh oh!

blueorangutan commented May 11, 2022

Uh oh!

slavkap left a comment

Choose a reason for hiding this comment

Uh oh!

Pearl1594 left a comment

Choose a reason for hiding this comment

Uh oh!

nvazquez left a comment

Choose a reason for hiding this comment

Uh oh!

blueorangutan commented May 11, 2022

Uh oh!

nvazquez commented May 11, 2022

Uh oh!

blueorangutan commented May 11, 2022

agent: enable ssl only for kvm agent (not in system vms)#6371
nvazquez merged 4 commits into
apache:mainfrom
weizhouapache:4.17-fix-ssvm-ssl

weizhouapache May 10, 2022 •
edited
Loading