etan39
/
cloudstack
mirror of https://github.com/apache/cloudstack.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

APPLE-537: (CW 1660) Allow KVM host addition using sudoer user 

This allows admins to add a KVM host using a sudoer user. This also
fails early when there is an issue with securing a KVM host on addition
than supress the information in logs.

Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
This commit is contained in:
Rohit Yadav 2018-02-26 10:20:37 +01:00
parent 4e3f7e17b8
commit 1c1fc32f47
2 changed files with 9 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
agent/src/com/cloud/agent/Agent.java
View File

@ -616,7 +616,7 @@ public class Agent implements HandlerFactory, IAgentControl {
_shell.setPersistentProperty(null, KeyStoreUtils.passphrasePropertyName, storedPassword);
}
Script script = new Script(_keystoreSetupPath, 60000, s_logger);
Script script = new Script(true, _keystoreSetupPath, 60000, s_logger);
script.add(agentFile.getAbsolutePath());
script.add(keyStoreFile);
script.add(storedPassword);
@ -660,7 +660,7 @@ public class Agent implements HandlerFactory, IAgentControl {
throw new CloudRuntimeException("Unable to save received agent client and ca certificates", e);
}
Script script = new Script(_keystoreCertImportPath, 60000, s_logger);
Script script = new Script(true, _keystoreCertImportPath, 60000, s_logger);
script.add(agentFile.getAbsolutePath());
script.add(keyStoreFile);
script.add(KeyStoreUtils.agentMode);

17
server/src/com/cloud/hypervisor/kvm/discoverer/LibvirtServerDiscoverer.java
View File

@ -61,6 +61,7 @@ import com.cloud.resource.ServerResource;
import com.cloud.resource.UnableDeleteHostException;
import com.cloud.utils.PasswordGenerator;
import com.cloud.utils.StringUtils;
import com.cloud.utils.exception.CloudRuntimeException;
import com.cloud.utils.ssh.SSHCmdHelper;
import com.trilead.ssh2.Connection;
@ -132,8 +133,7 @@ public abstract class LibvirtServerDiscoverer extends DiscovererBase implements
}
if (sshConnection == null) {
s_logger.warn("Cannot secure agent communication because ssh connection is invalid for host ip=" + agentIp);
return;
throw new CloudRuntimeException("Cannot secure agent communication because ssh connection is invalid for host ip=" + agentIp);
}
Integer validityPeriod = CAManager.CertValidityPeriod.value();
@ -142,7 +142,7 @@ public abstract class LibvirtServerDiscoverer extends DiscovererBase implements
}
final SSHCmdHelper.SSHCmdResult keystoreSetupResult = SSHCmdHelper.sshExecuteCmdWithResult(sshConnection,
String.format("/usr/share/cloudstack-common/scripts/util/%s " +
String.format("sudo /usr/share/cloudstack-common/scripts/util/%s " +
"/etc/cloudstack/agent/agent.properties " +
"/etc/cloudstack/agent/%s " +
"%s %d " +
@ -154,19 +154,17 @@ public abstract class LibvirtServerDiscoverer extends DiscovererBase implements
KeyStoreUtils.defaultCsrFile));
if (!keystoreSetupResult.isSuccess()) {
s_logger.error("Failing, the keystore setup script failed execution on the KVM host: " + agentIp);
return;
throw new CloudRuntimeException("Failed to setup keystore on the KVM host: " + agentIp);
}
final Certificate certificate = caManager.issueCertificate(keystoreSetupResult.getStdOut(), Collections.singletonList(agentHostname), Collections.singletonList(agentIp), null, null);
if (certificate == null || certificate.getClientCertificate() == null) {
s_logger.error("Failing, the configured CA plugin failed to issue certificates for KVM host agent: " + agentIp);
return;
throw new CloudRuntimeException("Failed to issue certificates for KVM host agent: " + agentIp);
}
final SetupCertificateCommand certificateCommand = new SetupCertificateCommand(certificate);
final SSHCmdHelper.SSHCmdResult setupCertResult = SSHCmdHelper.sshExecuteCmdWithResult(sshConnection,
String.format("/usr/share/cloudstack-common/scripts/util/%s " +
String.format("sudo /usr/share/cloudstack-common/scripts/util/%s " +
"/etc/cloudstack/agent/agent.properties " +
"/etc/cloudstack/agent/%s %s " +
"/etc/cloudstack/agent/%s \"%s\" " +
@ -183,8 +181,7 @@ public abstract class LibvirtServerDiscoverer extends DiscovererBase implements
certificateCommand.getEncodedPrivateKey()));
if (setupCertResult != null && !setupCertResult.isSuccess()) {
s_logger.error("Failed to setup certificate in the KVM agent's keystore file, please configure manually!");
return;
throw new CloudRuntimeException("Failed to setup certificate in the KVM agent's keystore file, please see logs and configure manually!");
}
if (s_logger.isDebugEnabled()) {