agent: enable ssl only for kvm agent (not in system vms) by weizhouapache · Pull Request #6371 · apache/cloudstack

weizhouapache · 2022-05-10T18:48:02Z

Description

This PR fixes the issue that template cannot be downloaded from https site in 4.17.0.0 RC2.

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

weizhouapache · 2022-05-10T19:04:06Z

@blueorangutan package

blueorangutan · 2022-05-10T19:05:02Z

@weizhouapache a Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2022-05-10T19:45:20Z

Packaging result: ✔️ el7 ✔️ el8 ✔️ debian ✔️ suse15. SL-JID 3383

nvazquez · 2022-05-10T19:55:21Z

@blueorangutan test

blueorangutan · 2022-05-10T19:56:03Z

@nvazquez a Trillian-Jenkins test job (centos7 mgmt + kvm-centos7) has been kicked to run smoke tests

yadvr · 2022-05-10T20:02:41Z

+ if (!LIBVIRT_COMPUTING_RESOURCE.equalsIgnoreCase(resource)) {
+ s_logger.info("This is not a cloudstack kvm agent, ignoring");
+ return;
+ }


@nvazquez @weizhouapache Could this cause an issue with (a) direct download, (b) ssl enabled cpvm and ssvm. Should we attempt to fix the issue by importing or referencing the system keystore too where java/ca certs are stored and imported (for x1/letsencrypt) @Pearl1594 ?

@rohityadavcloud @nvazquez @Pearl1594
this part of code was introduced in #6200 which aims to fix an issue with direct download on KVM.
with this pr, SSL is still enabled on KVM hosts, but not in system VMs where Java process load key store realhostip.keystone (same as the behavior without #6200 )

Makes sense if this was relatively newer code.

weizhouapache · 2022-05-10T21:21:24Z

@blueorangutan ubuntu20 kvm-ubuntu20

nvazquez · 2022-05-11T02:35:09Z

Verified HTTPS templates working on KVM env with this fix

yadvr · 2022-05-11T05:31:45Z

 return;
 }
+ final String resource = getProperty(null, "resource");
+ if (!LIBVIRT_COMPUTING_RESOURCE.equalsIgnoreCase(resource)) {


The use of LIBVIRT_COMPUTING_RESOURCE or com.cloud.hypervisor.kvm.resource.LibvirtComputingResource may be misleading (for ex. what if this isn't the resource name? for example, we do support lxc etc?).
Can you simply add a check if the agent is either is in systemvm (for ex. /etc/cloudstack-release would exist) or if we're on a KVM host (check for /dev/kvm exists or libvirt running)? (Depending on what we're trying to achieve here). The other option usually is to check the resource class via some method.
What do you think @weizhouapache @nvazquez ?

@rohityadavcloud
I will move all these codes to LibvirtComputingResource which makes more sense.
I will verify the issue fixed by #6200 as well.

blueorangutan · 2022-05-11T06:33:57Z

Trillian test result (tid-4158)
Environment: kvm-centos7 (x2), Advanced Networking with Mgmt server 7
Total time taken: 36897 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr6371-t4158-kvm-centos7.zip
Smoke tests completed. 96 look OK, 0 have errors
Only failed tests results shown below:

Test	Result	Time (s)	Test File

This reverts commit b2d76ba.

This reverts commit 4525f8c.

acs-robot · 2022-05-11T09:21:38Z

Found UI changes, kicking a new UI QA build
@blueorangutan ui

blueorangutan · 2022-05-11T09:24:02Z

@acs-robot a Jenkins job has been kicked to build UI QA env. I'll keep you posted as I make progress.

blueorangutan · 2022-05-11T09:29:10Z

UI build: ✔️
Live QA URL: http://qa.cloudstack.cloud:8080/client/pr/6371 (SL-JID-1547)

weizhouapache · 2022-05-11T09:44:59Z

@blueorangutan package

blueorangutan · 2022-05-11T09:47:03Z

@weizhouapache a Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

sonarqubecloud · 2022-05-11T10:11:50Z

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

0.0% Coverage
0.0% Duplication

blueorangutan · 2022-05-11T10:28:04Z

Packaging result: ✔️ el7 ✔️ el8 ✔️ debian ✔️ suse15. SL-JID 3386

nvazquez · 2022-05-11T10:53:49Z

@blueorangutan test

blueorangutan · 2022-05-11T10:55:03Z

@nvazquez a Trillian-Jenkins test job (centos7 mgmt + kvm-centos7) has been kicked to run smoke tests

slavkap

tested - LGTM

Pearl1594

LGTM

nvazquez

LGTM, manually tested

blueorangutan · 2022-05-11T21:13:29Z

Trillian test result (tid-4161)
Environment: kvm-centos7 (x2), Advanced Networking with Mgmt server 7
Total time taken: 35729 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr6371-t4161-kvm-centos7.zip
Smoke tests completed. 83 look OK, 5 have errors
Only failed tests results shown below:

Test	Result	Time (s)	Test File
test_05_stop_ssvm	`Error`	29.77	test_ssvm.py
test_06_stop_cpvm	`Error`	3.00	test_ssvm.py
test_07_reboot_ssvm	`Error`	3.00	test_ssvm.py
test_08_reboot_cpvm	`Error`	3.00	test_ssvm.py
test_09_reboot_ssvm_forced	`Error`	3.00	test_ssvm.py
test_10_reboot_cpvm_forced	`Error`	3.00	test_ssvm.py
test_11_destroy_ssvm	`Error`	3.00	test_ssvm.py
test_12_destroy_cpvm	`Error`	3.00	test_ssvm.py
test_13_ss_nfs_version_on_ssvm	`Error`	3.00	test_ssvm.py
test_03_deploy_and_scale_kubernetes_cluster	`Failure`	27.97	test_kubernetes_clusters.py
test_07_deploy_kubernetes_ha_cluster	`Failure`	57.66	test_kubernetes_clusters.py
test_08_upgrade_kubernetes_ha_cluster	`Failure`	34.02	test_kubernetes_clusters.py
test_09_delete_kubernetes_ha_cluster	`Failure`	31.93	test_kubernetes_clusters.py
ContextSuite context=TestKubernetesCluster>:teardown	`Error`	116.86	test_kubernetes_clusters.py
ContextSuite context=TestPrivateVlansL2Networks>:setup	`Error`	836.82	test_network.py
test_hostha_enable_ha_when_host_disconected	`Error`	788.40	test_hostha_kvm.py
test_hostha_enable_ha_when_host_in_maintenance	`Error`	303.82	test_hostha_kvm.py
test_01_deploy_vm_on_specific_host	`Error`	1.16	test_vm_deployment_planner.py
test_04_deploy_vm_on_host_override_pod_and_cluster	`Error`	0.20	test_vm_deployment_planner.py

nvazquez · 2022-05-11T22:21:58Z

@blueorangutan test

blueorangutan · 2022-05-11T22:23:03Z

@nvazquez a Trillian-Jenkins test job (centos7 mgmt + kvm-centos7) has been kicked to run smoke tests

blueorangutan · 2022-05-12T09:05:30Z

Trillian test result (tid-4166)
Environment: kvm-centos7 (x2), Advanced Networking with Mgmt server 7
Total time taken: 37350 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr6371-t4166-kvm-centos7.zip
Smoke tests completed. 96 look OK, 0 have errors
Only failed tests results shown below:

Test	Result	Time (s)	Test File

apache#151) * agent: enable ssl only for kvm agent (not in system vms) * Revert "agent: enable ssl only for kvm agent (not in system vms)" This reverts commit b2d76ba. * Revert "KVM: Enable SSL if keystore exists (apache#6200)" This reverts commit 4525f8c. * KVM: Enable SSL if keystore exists in LibvirtComputingResource.java Co-authored-by: Wei Zhou <weizhou@apache.org>

…en enable SSL for kvm agent This was implemented in PR#6200 and apache#6371 , but broken in PR#6348

agent: enable ssl only for kvm agent (not in system vms)
b2d76ba

boring-cyborgBot added the component:agent label May 10, 2022

weizhouapache requested review from Pearl1594, nvazquez and yadvr May 10, 2022 18:49

yadvr reviewed May 10, 2022
View reviewed changes

nvazquez approved these changes May 11, 2022
View reviewed changes

nvazquez added this to the 4.17.0.0 milestone May 11, 2022

nvazquez added the type:bug label May 11, 2022

yadvr reviewed May 11, 2022
View reviewed changes

weizhouapache added 3 commits May 11, 2022 11:19

Revert "agent: enable ssl only for kvm agent (not in system vms)"
9b43ad2
This reverts commit b2d76ba.

Revert "KVM: Enable SSL if keystore exists (apache#6200)"
a16b46e
This reverts commit 4525f8c.

KVM: Enable SSL if keystore exists in LibvirtComputingResource.java
1b29eb9

boring-cyborgBot added the component:kvm label May 11, 2022

weizhouapache requested a review from nvazquez May 11, 2022 09:57

slavkap approved these changes May 11, 2022
View reviewed changes

Pearl1594 approved these changes May 11, 2022
View reviewed changes

weizhouapache closed this May 11, 2022

weizhouapache reopened this May 11, 2022

nvazquez approved these changes May 11, 2022
View reviewed changes

nvazquez merged commit 8f39a04 into apache:mainMay 12, 2022

nvazquez mentioned this pull request May 23, 2022
bug: fail to download a template from https #6406
Closed

weizhouapache deleted the 4.17-fix-ssvm-ssl branch December 9, 2022 10:07

weizhouapache added a commit to weizhouapache/cloudstack that referenced this pull request Aug 30, 2023
kvm: fix error 'Failed to find passphrase for keystore: cloud.jks' wh…
5f312b2
…en enable SSL for kvm agent This was implemented in PR#6200 and apache#6371 , but broken in PR#6348

weizhouapache mentioned this pull request Aug 30, 2023
kvm: fix error when enable SSL for kvm agent #7923
Merged
12 tasks

DaanHoogland pushed a commit to weizhouapache/cloudstack that referenced this pull request Oct 18, 2023
kvm: fix error 'Failed to find passphrase for keystore: cloud.jks' wh…
26702b8
…en enable SSL for kvm agent This was implemented in PR#6200 and apache#6371 , but broken in PR#6348

Uh oh!

Conversation

weizhouapache commented May 10, 2022

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

Uh oh!

weizhouapache commented May 10, 2022

Uh oh!

blueorangutan commented May 10, 2022

Uh oh!

blueorangutan commented May 10, 2022

Uh oh!

nvazquez commented May 10, 2022

Uh oh!

blueorangutan commented May 10, 2022

Uh oh!

yadvrMay 10, 2022

Choose a reason for hiding this comment

Uh oh!

weizhouapacheMay 10, 2022• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yadvrMay 11, 2022

Choose a reason for hiding this comment

Uh oh!

weizhouapache commented May 10, 2022

Uh oh!

nvazquez commented May 11, 2022

Uh oh!

yadvrMay 11, 2022

Choose a reason for hiding this comment

Uh oh!

weizhouapacheMay 11, 2022

Choose a reason for hiding this comment

Uh oh!

nvazquezMay 11, 2022

Choose a reason for hiding this comment

Uh oh!

blueorangutan commented May 11, 2022

Uh oh!

acs-robot commented May 11, 2022

Uh oh!

blueorangutan commented May 11, 2022

Uh oh!

blueorangutan commented May 11, 2022

Uh oh!

weizhouapache commented May 11, 2022

Uh oh!

blueorangutan commented May 11, 2022

Uh oh!

sonarqubecloudBot commented May 11, 2022

Uh oh!

blueorangutan commented May 11, 2022

Uh oh!

nvazquez commented May 11, 2022

Uh oh!

blueorangutan commented May 11, 2022

Uh oh!

slavkap left a comment

Choose a reason for hiding this comment

Uh oh!

Pearl1594 left a comment

Choose a reason for hiding this comment

Uh oh!

nvazquez left a comment

Choose a reason for hiding this comment

Uh oh!

blueorangutan commented May 11, 2022

Uh oh!

nvazquez commented May 11, 2022

Uh oh!

blueorangutan commented May 11, 2022

Uh oh!

blueorangutan commented May 12, 2022

weizhouapacheMay 10, 2022•
edited
Loading