agent: enable ssl only for kvm agent (not in system vms) #6371

weizhouapache · 2022-05-10T18:48:02Z

Description

This PR fixes the issue that template cannot be downloaded from https site in 4.17.0.0 RC2.

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

weizhouapache · 2022-05-10T19:04:06Z

@blueorangutan package

blueorangutan · 2022-05-10T19:05:02Z

@weizhouapache a Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2022-05-10T19:45:20Z

Packaging result: ✔️ el7 ✔️ el8 ✔️ debian ✔️ suse15. SL-JID 3383

nvazquez · 2022-05-10T19:55:21Z

@blueorangutan test

blueorangutan · 2022-05-10T19:56:03Z

@nvazquez a Trillian-Jenkins test job (centos7 mgmt + kvm-centos7) has been kicked to run smoke tests

rohityadavcloud · 2022-05-10T20:02:41Z

agent/src/main/java/com/cloud/agent/AgentShell.java

+        if (!LIBVIRT_COMPUTING_RESOURCE.equalsIgnoreCase(resource)) {
+            s_logger.info("This is not a cloudstack kvm agent, ignoring");
+            return;
+        }


@nvazquez @weizhouapache Could this cause an issue with (a) direct download, (b) ssl enabled cpvm and ssvm. Should we attempt to fix the issue by importing or referencing the system keystore too where java/ca certs are stored and imported (for x1/letsencrypt) @Pearl1594 ?

@rohityadavcloud @nvazquez @Pearl1594
this part of code was introduced in #6200 which aims to fix an issue with direct download on KVM.
with this pr, SSL is still enabled on KVM hosts, but not in system VMs where Java process load key store realhostip.keystone (same as the behavior without #6200 )

Makes sense if this was relatively newer code.

weizhouapache · 2022-05-10T21:21:24Z

@blueorangutan ubuntu20 kvm-ubuntu20

nvazquez · 2022-05-11T02:35:09Z

Verified HTTPS templates working on KVM env with this fix

rohityadavcloud · 2022-05-11T05:31:45Z

agent/src/main/java/com/cloud/agent/AgentShell.java

            return;
        }
+        final String resource = getProperty(null, "resource");
+        if (!LIBVIRT_COMPUTING_RESOURCE.equalsIgnoreCase(resource)) {


The use of LIBVIRT_COMPUTING_RESOURCE or com.cloud.hypervisor.kvm.resource.LibvirtComputingResource may be misleading (for ex. what if this isn't the resource name? for example, we do support lxc etc?).

Can you simply add a check if the agent is either is in systemvm (for ex. /etc/cloudstack-release would exist) or if we're on a KVM host (check for /dev/kvm exists or libvirt running)? (Depending on what we're trying to achieve here). The other option usually is to check the resource class via some method.

What do you think @weizhouapache @nvazquez ?

@rohityadavcloud
I will move all these codes to LibvirtComputingResource which makes more sense.
I will verify the issue fixed by #6200 as well.

blueorangutan · 2022-05-11T06:33:57Z

Trillian test result (tid-4158)
Environment: kvm-centos7 (x2), Advanced Networking with Mgmt server 7
Total time taken: 36897 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr6371-t4158-kvm-centos7.zip
Smoke tests completed. 96 look OK, 0 have errors
Only failed tests results shown below:

Test	Result	Time (s)	Test File

This reverts commit b2d76ba.

This reverts commit 4525f8c.

acs-robot · 2022-05-11T09:21:38Z

Found UI changes, kicking a new UI QA build
@blueorangutan ui

blueorangutan · 2022-05-11T09:24:02Z

@acs-robot a Jenkins job has been kicked to build UI QA env. I'll keep you posted as I make progress.

blueorangutan · 2022-05-11T09:29:10Z

UI build: ✔️
Live QA URL: http://qa.cloudstack.cloud:8080/client/pr/6371 (SL-JID-1547)

weizhouapache · 2022-05-11T09:44:59Z

@blueorangutan package

blueorangutan · 2022-05-11T09:47:03Z

@weizhouapache a Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

sonarqubecloud · 2022-05-11T10:11:50Z

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

0.0% Coverage
0.0% Duplication

blueorangutan · 2022-05-11T10:28:04Z

Packaging result: ✔️ el7 ✔️ el8 ✔️ debian ✔️ suse15. SL-JID 3386

nvazquez · 2022-05-11T10:53:49Z

@blueorangutan test

blueorangutan · 2022-05-11T10:55:03Z

@nvazquez a Trillian-Jenkins test job (centos7 mgmt + kvm-centos7) has been kicked to run smoke tests

slavkap

tested - LGTM

Pearl1594

LGTM

nvazquez

LGTM, manually tested

blueorangutan · 2022-05-11T21:13:29Z

Trillian test result (tid-4161)
Environment: kvm-centos7 (x2), Advanced Networking with Mgmt server 7
Total time taken: 35729 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr6371-t4161-kvm-centos7.zip
Smoke tests completed. 83 look OK, 5 have errors
Only failed tests results shown below:

Test	Result	Time (s)	Test File
test_05_stop_ssvm	`Error`	29.77	test_ssvm.py
test_06_stop_cpvm	`Error`	3.00	test_ssvm.py
test_07_reboot_ssvm	`Error`	3.00	test_ssvm.py
test_08_reboot_cpvm	`Error`	3.00	test_ssvm.py
test_09_reboot_ssvm_forced	`Error`	3.00	test_ssvm.py
test_10_reboot_cpvm_forced	`Error`	3.00	test_ssvm.py
test_11_destroy_ssvm	`Error`	3.00	test_ssvm.py
test_12_destroy_cpvm	`Error`	3.00	test_ssvm.py
test_13_ss_nfs_version_on_ssvm	`Error`	3.00	test_ssvm.py
test_03_deploy_and_scale_kubernetes_cluster	`Failure`	27.97	test_kubernetes_clusters.py
test_07_deploy_kubernetes_ha_cluster	`Failure`	57.66	test_kubernetes_clusters.py
test_08_upgrade_kubernetes_ha_cluster	`Failure`	34.02	test_kubernetes_clusters.py
test_09_delete_kubernetes_ha_cluster	`Failure`	31.93	test_kubernetes_clusters.py
ContextSuite context=TestKubernetesCluster>:teardown	`Error`	116.86	test_kubernetes_clusters.py
ContextSuite context=TestPrivateVlansL2Networks>:setup	`Error`	836.82	test_network.py
test_hostha_enable_ha_when_host_disconected	`Error`	788.40	test_hostha_kvm.py
test_hostha_enable_ha_when_host_in_maintenance	`Error`	303.82	test_hostha_kvm.py
test_01_deploy_vm_on_specific_host	`Error`	1.16	test_vm_deployment_planner.py
test_04_deploy_vm_on_host_override_pod_and_cluster	`Error`	0.20	test_vm_deployment_planner.py

nvazquez · 2022-05-11T22:21:58Z

@blueorangutan test

blueorangutan · 2022-05-11T22:23:03Z

@nvazquez a Trillian-Jenkins test job (centos7 mgmt + kvm-centos7) has been kicked to run smoke tests

blueorangutan · 2022-05-12T09:05:30Z

Trillian test result (tid-4166)
Environment: kvm-centos7 (x2), Advanced Networking with Mgmt server 7
Total time taken: 37350 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr6371-t4166-kvm-centos7.zip
Smoke tests completed. 96 look OK, 0 have errors
Only failed tests results shown below:

Test	Result	Time (s)	Test File

apache#151) * agent: enable ssl only for kvm agent (not in system vms) * Revert "agent: enable ssl only for kvm agent (not in system vms)" This reverts commit b2d76ba. * Revert "KVM: Enable SSL if keystore exists (apache#6200)" This reverts commit 4525f8c. * KVM: Enable SSL if keystore exists in LibvirtComputingResource.java Co-authored-by: Wei Zhou <weizhou@apache.org>

…en enable SSL for kvm agent This was implemented in PR#6200 and apache#6371 , but broken in PR#6348

agent: enable ssl only for kvm agent (not in system vms)

b2d76ba

boring-cyborg bot added the component:agent label May 10, 2022

weizhouapache requested review from Pearl1594, nvazquez and rohityadavcloud May 10, 2022 18:49

rohityadavcloud reviewed May 10, 2022

View reviewed changes

nvazquez approved these changes May 11, 2022

View reviewed changes

nvazquez added this to the 4.17.0.0 milestone May 11, 2022

nvazquez added the type:bug label May 11, 2022

rohityadavcloud reviewed May 11, 2022

View reviewed changes

weizhouapache added 3 commits May 11, 2022 11:19

Revert "agent: enable ssl only for kvm agent (not in system vms)"

9b43ad2

This reverts commit b2d76ba.

Revert "KVM: Enable SSL if keystore exists (apache#6200)"

a16b46e

This reverts commit 4525f8c.

KVM: Enable SSL if keystore exists in LibvirtComputingResource.java

1b29eb9

boring-cyborg bot added the component:kvm label May 11, 2022

weizhouapache requested a review from nvazquez May 11, 2022 09:57

slavkap approved these changes May 11, 2022

View reviewed changes

Pearl1594 approved these changes May 11, 2022

View reviewed changes

weizhouapache closed this May 11, 2022

weizhouapache reopened this May 11, 2022

nvazquez approved these changes May 11, 2022

View reviewed changes

nvazquez merged commit 8f39a04 into apache:main May 12, 2022

nvazquez mentioned this pull request May 23, 2022

bug: fail to download a template from https #6406

Closed

weizhouapache deleted the 4.17-fix-ssvm-ssl branch December 9, 2022 10:07

weizhouapache added a commit to weizhouapache/cloudstack that referenced this pull request Aug 30, 2023

kvm: fix error 'Failed to find passphrase for keystore: cloud.jks' wh…

5f312b2

…en enable SSL for kvm agent This was implemented in PR#6200 and apache#6371 , but broken in PR#6348

weizhouapache mentioned this pull request Aug 30, 2023

kvm: fix error when enable SSL for kvm agent #7923

Merged

12 tasks

DaanHoogland pushed a commit to weizhouapache/cloudstack that referenced this pull request Oct 18, 2023

kvm: fix error 'Failed to find passphrase for keystore: cloud.jks' wh…

26702b8

…en enable SSL for kvm agent This was implemented in PR#6200 and apache#6371 , but broken in PR#6348

agent: enable ssl only for kvm agent (not in system vms) #6371

agent: enable ssl only for kvm agent (not in system vms) #6371

Uh oh!

Conversation

weizhouapache commented May 10, 2022

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

Uh oh!

weizhouapache commented May 10, 2022

Uh oh!

blueorangutan commented May 10, 2022

Uh oh!

blueorangutan commented May 10, 2022

Uh oh!

nvazquez commented May 10, 2022

Uh oh!

blueorangutan commented May 10, 2022

Uh oh!

rohityadavcloud May 10, 2022

Choose a reason for hiding this comment

Uh oh!

weizhouapache May 10, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rohityadavcloud May 11, 2022

Choose a reason for hiding this comment

Uh oh!

weizhouapache commented May 10, 2022

Uh oh!

nvazquez commented May 11, 2022

Uh oh!

rohityadavcloud May 11, 2022

Choose a reason for hiding this comment

Uh oh!

weizhouapache May 11, 2022

Choose a reason for hiding this comment

Uh oh!

nvazquez May 11, 2022

Choose a reason for hiding this comment

Uh oh!

blueorangutan commented May 11, 2022

Uh oh!

acs-robot commented May 11, 2022

Uh oh!

blueorangutan commented May 11, 2022

Uh oh!

blueorangutan commented May 11, 2022

Uh oh!

weizhouapache commented May 11, 2022

Uh oh!

blueorangutan commented May 11, 2022

Uh oh!

sonarqubecloud bot commented May 11, 2022

Uh oh!

blueorangutan commented May 11, 2022

Uh oh!

nvazquez commented May 11, 2022

Uh oh!

blueorangutan commented May 11, 2022

Uh oh!

slavkap left a comment

Choose a reason for hiding this comment

Uh oh!

Pearl1594 left a comment

Choose a reason for hiding this comment

Uh oh!

nvazquez left a comment

Choose a reason for hiding this comment

Uh oh!

blueorangutan commented May 11, 2022

Uh oh!

nvazquez commented May 11, 2022

Uh oh!

blueorangutan commented May 11, 2022

weizhouapache May 10, 2022 •

edited

Loading