From 4625a43672204a6a7b7d9fe0ba8d21ff21df91e7 Mon Sep 17 00:00:00 2001 From: Vishesh <8760112+vishesh92@users.noreply.github.com> Date: Mon, 29 Jun 2026 19:15:56 +0530 Subject: [PATCH 01/12] Batch NIC and VLAN reads in collectVmNetworkStatistics to reduce per-NIC DB round-trips (#13474) Co-authored-by: Aaron Chung --- .../main/java/com/cloud/dc/dao/VlanDao.java | 2 ++ .../java/com/cloud/dc/dao/VlanDaoImpl.java | 14 +++++++++- .../main/java/com/cloud/vm/dao/NicDao.java | 2 ++ .../java/com/cloud/vm/dao/NicDaoImpl.java | 15 ++++++++-- .../java/com/cloud/vm/UserVmManagerImpl.java | 28 ++++++++++++++++--- 5 files changed, 54 insertions(+), 7 deletions(-) diff --git a/engine/schema/src/main/java/com/cloud/dc/dao/VlanDao.java b/engine/schema/src/main/java/com/cloud/dc/dao/VlanDao.java index a6c267bb189..beab7ce2cd5 100644 --- a/engine/schema/src/main/java/com/cloud/dc/dao/VlanDao.java +++ b/engine/schema/src/main/java/com/cloud/dc/dao/VlanDao.java @@ -51,6 +51,8 @@ public interface VlanDao extends GenericDao { List listVlansByNetworkId(long networkId); + List listVlansByNetworkIds(List networkIds); + List listVlansByNetworkIdIncludingRemoved(long networkId); List listVlansByPhysicalNetworkId(long physicalNetworkId); diff --git a/engine/schema/src/main/java/com/cloud/dc/dao/VlanDaoImpl.java b/engine/schema/src/main/java/com/cloud/dc/dao/VlanDaoImpl.java index d9fad3cad12..5687e858877 100644 --- a/engine/schema/src/main/java/com/cloud/dc/dao/VlanDaoImpl.java +++ b/engine/schema/src/main/java/com/cloud/dc/dao/VlanDaoImpl.java @@ -20,6 +20,7 @@ import java.sql.PreparedStatement; import java.sql.ResultSet; import java.sql.SQLException; import java.util.ArrayList; +import java.util.Collections; import java.util.List; import java.util.Map; @@ -27,6 +28,7 @@ import javax.inject.Inject; import javax.naming.ConfigurationException; import com.cloud.dc.VlanDetailsVO; +import org.apache.commons.collections4.CollectionUtils; import org.apache.commons.lang3.ArrayUtils; import org.apache.commons.lang3.StringUtils; import org.springframework.stereotype.Component; @@ -134,7 +136,7 @@ public class VlanDaoImpl extends GenericDaoBase implements VlanDao ZoneTypeSearch.done(); NetworkVlanSearch = createSearchBuilder(); - NetworkVlanSearch.and("networkId", NetworkVlanSearch.entity().getNetworkId(), SearchCriteria.Op.EQ); + NetworkVlanSearch.and("networkId", NetworkVlanSearch.entity().getNetworkId(), SearchCriteria.Op.IN); NetworkVlanSearch.done(); PhysicalNetworkVlanSearch = createSearchBuilder(); @@ -392,6 +394,16 @@ public class VlanDaoImpl extends GenericDaoBase implements VlanDao return listBy(sc); } + @Override + public List listVlansByNetworkIds(List networkIds) { + if (CollectionUtils.isEmpty(networkIds)) { + return Collections.emptyList(); + } + SearchCriteria sc = NetworkVlanSearch.create(); + sc.setParameters("networkId", networkIds.toArray()); + return listBy(sc); + } + @Override public List listVlansByNetworkIdIncludingRemoved(long networkId) { SearchCriteria sc = NetworkVlanSearch.create(); sc.setParameters("networkId", networkId); diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/NicDao.java b/engine/schema/src/main/java/com/cloud/vm/dao/NicDao.java index 96a1b6e3bd1..2718127d648 100644 --- a/engine/schema/src/main/java/com/cloud/vm/dao/NicDao.java +++ b/engine/schema/src/main/java/com/cloud/vm/dao/NicDao.java @@ -97,6 +97,8 @@ public interface NicDao extends GenericDao { NicVO findByMacAddress(String macAddress, long networkId); + List listByMacAddresses(List macAddresses); + NicVO findByNetworkIdAndMacAddressIncludingRemoved(long networkId, String mac); List findNicsByIpv6GatewayIpv6CidrAndReserver(String ipv6Gateway, String ipv6Cidr, String reserverName); diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/NicDaoImpl.java b/engine/schema/src/main/java/com/cloud/vm/dao/NicDaoImpl.java index 78966a09e97..f4f3b0d6ad6 100644 --- a/engine/schema/src/main/java/com/cloud/vm/dao/NicDaoImpl.java +++ b/engine/schema/src/main/java/com/cloud/vm/dao/NicDaoImpl.java @@ -18,12 +18,13 @@ package com.cloud.vm.dao; import java.net.URI; import java.util.ArrayList; +import java.util.Collections; import java.util.List; import javax.annotation.PostConstruct; import javax.inject.Inject; -import org.apache.commons.collections.CollectionUtils; +import org.apache.commons.collections4.CollectionUtils; import org.springframework.stereotype.Component; import com.cloud.utils.db.Filter; @@ -71,7 +72,7 @@ public class NicDaoImpl extends GenericDaoBase implements NicDao { AllFieldsSearch.and("strategy", AllFieldsSearch.entity().getReservationStrategy(), Op.EQ); AllFieldsSearch.and("strategyNEQ", AllFieldsSearch.entity().getReservationStrategy(), Op.NEQ); AllFieldsSearch.and("reserverName",AllFieldsSearch.entity().getReserver(),Op.EQ); - AllFieldsSearch.and("macAddress", AllFieldsSearch.entity().getMacAddress(), Op.EQ); + AllFieldsSearch.and("macAddress", AllFieldsSearch.entity().getMacAddress(), Op.IN); AllFieldsSearch.and("deviceid", AllFieldsSearch.entity().getDeviceId(), Op.EQ); AllFieldsSearch.and("ipv6Gateway", AllFieldsSearch.entity().getIPv6Gateway(), Op.EQ); AllFieldsSearch.and("ipv6Cidr", AllFieldsSearch.entity().getIPv6Cidr(), Op.EQ); @@ -427,6 +428,16 @@ public class NicDaoImpl extends GenericDaoBase implements NicDao { return findOneBy(sc); } + @Override + public List listByMacAddresses(List macAddresses) { + if (CollectionUtils.isEmpty(macAddresses)) { + return Collections.emptyList(); + } + SearchCriteria sc = AllFieldsSearch.create(); + sc.setParameters("macAddress", macAddresses.toArray()); + return listBy(sc); + } + @Override public List findNicsByIpv6GatewayIpv6CidrAndReserver(String ipv6Gateway, String ipv6Cidr, String reserverName) { SearchCriteria sc = AllFieldsSearch.create(); diff --git a/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java b/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java index 83cce4351b2..5c9d54e1937 100644 --- a/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java +++ b/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java @@ -5195,11 +5195,31 @@ public class UserVmManagerImpl extends ManagerBase implements UserVmManager, Vir return; } + List macAddresses = new ArrayList<>(vmNetworkStats.size()); + for (VmNetworkStatsEntry entry : vmNetworkStats) { + macAddresses.add(entry.getMacAddress()); + } + Map nicsByMac = new HashMap<>(); + for (NicVO nic : _nicDao.listByMacAddresses(macAddresses)) { + nicsByMac.put(nic.getMacAddress(), nic); + } + + Set networkIds = new HashSet<>(); + for (NicVO nic : nicsByMac.values()) { + networkIds.add(nic.getNetworkId()); + } + Map> vlansByNetwork = new HashMap<>(); + for (VlanVO vlan : _vlanDao.listVlansByNetworkIds(new ArrayList<>(networkIds))) { + vlansByNetwork.computeIfAbsent(vlan.getNetworkId(), k -> new ArrayList<>()).add(vlan); + } + for (VmNetworkStatsEntry vmNetworkStat:vmNetworkStats) { - SearchCriteria sc_nic = _nicDao.createSearchCriteria(); - sc_nic.addAnd("macAddress", SearchCriteria.Op.EQ, vmNetworkStat.getMacAddress()); - NicVO nic = _nicDao.search(sc_nic, null).get(0); - List vlan = _vlanDao.listVlansByNetworkId(nic.getNetworkId()); + NicVO nic = nicsByMac.get(vmNetworkStat.getMacAddress()); + if (nic == null) { + logger.warn("Unable to find nic for mac " + vmNetworkStat.getMacAddress()); + continue; + } + List vlan = vlansByNetwork.get(nic.getNetworkId()); if (vlan == null || vlan.size() == 0 || vlan.get(0).getVlanType() != VlanType.DirectAttached) { break; // only get network statistics for DirectAttached network (shared networks in Basic zone and Advanced zone with/without SG) From 2ba02c1a4a3974cfddf28697cfe56d95cf5f7360 Mon Sep 17 00:00:00 2001 From: Wei Zhou Date: Mon, 29 Jun 2026 16:52:14 +0200 Subject: [PATCH 02/12] systemvm: fix VPC VPN issue when network id is bigger than 1000 on Netris (#13346) --- systemvm/debian/opt/cloud/bin/cs/CsAddress.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/systemvm/debian/opt/cloud/bin/cs/CsAddress.py b/systemvm/debian/opt/cloud/bin/cs/CsAddress.py index bde4a976e31..37ca8979edc 100755 --- a/systemvm/debian/opt/cloud/bin/cs/CsAddress.py +++ b/systemvm/debian/opt/cloud/bin/cs/CsAddress.py @@ -47,13 +47,13 @@ class CsAddress(CsDataBag): def get_guest_if_by_network_id(self): guest_interface = None - lowest_network_id = 1000 + lowest_network_id = None for interface in self.get_interfaces(): if interface.is_guest() and interface.is_added(): if not self.config.is_vpc(): return interface network_id = self.config.guestnetwork().get_network_id(interface.get_device()) - if network_id and network_id < lowest_network_id: + if network_id and (lowest_network_id is None or network_id < lowest_network_id): lowest_network_id = network_id guest_interface = interface return guest_interface From 0231e67b9d9adf1ac0b4a4bd7a9acbf654e09cbc Mon Sep 17 00:00:00 2001 From: Rene Peinthor Date: Mon, 29 Jun 2026 20:15:56 +0200 Subject: [PATCH 03/12] Linstor: Add controller token auth support (#13470) * linstor: update java-linstor to 0.7.0 to support auth token api With Linstor 1.34.0 a new authentication mode is supported: * Bearer token To support that it had to be implemented in the java-linstor library and we need to store the auth token per storage pool. Also per default with this auth mode Linstor will run with HTTPS enabled, so we also have to support that. * ui: seed default-on toggles in zone wizard while hidden StaticInputsForm.fillValue() only seeded defaults for currently-displayed fields, so a display-gated switch with checked:true bound to an undefined value and rendered as off once revealed. Seed checked switch/checkbox fields even while hidden, so the Linstor 'Allow self-signed certificate' toggle defaults on in the zone creation wizard. --- plugins/storage/volume/linstor/CHANGELOG.md | 6 + .../kvm/storage/LinstorStorageAdaptor.java | 27 ++++- .../kvm/storage/LinstorStoragePool.java | 8 +- .../LinstorPrimaryDataStoreDriverImpl.java | 41 ++++--- .../LinstorPrimaryDataStoreLifeCycleImpl.java | 40 ++++++- .../util/LinstorConfigChangeListener.java | 108 ++++++++++++++++++ .../util/LinstorConfigurationManager.java | 9 +- .../storage/datastore/util/LinstorUtil.java | 33 +++++- .../motion/LinstorDataMotionStrategy.java | 9 +- .../snapshot/LinstorVMSnapshotStrategy.java | 19 ++- .../spring-storage-volume-linstor-context.xml | 2 + pom.xml | 2 +- .../plugins/linstor/test_linstor_volumes.py | 12 ++ ui/public/locales/en.json | 4 + ui/src/views/infra/AddPrimaryStorage.vue | 19 ++- ui/src/views/infra/zone/StaticInputsForm.vue | 5 + .../infra/zone/ZoneWizardAddResources.vue | 24 +++- .../views/infra/zone/ZoneWizardLaunchZone.vue | 4 + 18 files changed, 333 insertions(+), 39 deletions(-) create mode 100644 plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorConfigChangeListener.java diff --git a/plugins/storage/volume/linstor/CHANGELOG.md b/plugins/storage/volume/linstor/CHANGELOG.md index 1a3142e8c59..070a752db04 100644 --- a/plugins/storage/volume/linstor/CHANGELOG.md +++ b/plugins/storage/volume/linstor/CHANGELOG.md @@ -24,6 +24,12 @@ All notable changes to Linstor CloudStack plugin will be documented in this file The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [2026-06-03] + +### Added + +- Support Linstor bearer token authentication (Linstor 1.34.0) and HTTPS controller connections + ## [2026-01-17] ### Added diff --git a/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/storage/LinstorStorageAdaptor.java b/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/storage/LinstorStorageAdaptor.java index 77953a32e63..848bdc60d66 100644 --- a/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/storage/LinstorStorageAdaptor.java +++ b/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/storage/LinstorStorageAdaptor.java @@ -30,6 +30,7 @@ import javax.annotation.Nonnull; import com.cloud.storage.Storage; import com.cloud.utils.exception.CloudRuntimeException; import com.cloud.utils.script.Script; +import org.apache.cloudstack.storage.datastore.util.LinstorConfigurationManager; import org.apache.cloudstack.storage.datastore.util.LinstorUtil; import org.apache.cloudstack.utils.qemu.QemuImg; import org.apache.cloudstack.utils.qemu.QemuImgException; @@ -42,7 +43,6 @@ import com.cloud.utils.storage.TemplateDownloaderUtil; import com.linbit.linstor.api.ApiClient; import com.linbit.linstor.api.ApiConsts; import com.linbit.linstor.api.ApiException; -import com.linbit.linstor.api.Configuration; import com.linbit.linstor.api.DevelopersApi; import com.linbit.linstor.api.model.ApiCallRc; import com.linbit.linstor.api.model.ApiCallRcList; @@ -72,8 +72,17 @@ public class LinstorStorageAdaptor implements StorageAdaptor { private final String localNodeName; private DevelopersApi getLinstorAPI(KVMStoragePool pool) { - ApiClient client = Configuration.getDefaultApiClient(); + // Use a fresh client per pool so a self-signed/insecure pool can't weaken the TLS settings + // of another pool sharing this agent. + ApiClient client = new ApiClient(); client.setBasePath(pool.getSourceHost()); + // The agent has no access to the per-pool API token config; fall back to the auth.json file + // on the host (/var/lib/linstor.d/auth.json), or stay unauthenticated if it is absent. + client.setAccessTokenWithFallback(null); + if (pool instanceof LinstorStoragePool && ((LinstorStoragePool) pool).isInsecureSsl()) { + client.setInsecureSsl(); + } + client.discoverHttps(); return new DevelopersApi(client); } @@ -166,7 +175,16 @@ public class LinstorStorageAdaptor implements StorageAdaptor { Storage.StoragePoolType type, Map details, boolean isPrimaryStorage) { logger.debug("Linstor createStoragePool: name: '{}', host: '{}', path: {}, userinfo: {}", name, host, path, userInfo); - LinstorStoragePool storagePool = new LinstorStoragePool(name, host, port, userInfo, type, this); + // The management server ships the per-pool config in the details map; the controller TLS + // verification can be disabled here for self-signed certificates. The ConfigKey default is only + // applied on the management server (via valueIn()) and is NOT shipped in the details, so when the + // detail is absent we must fall back to that default here too - otherwise a pool without an + // explicit setting would verify the certificate on the agent while the MS thinks it is disabled. + final String insecureSslDetail = details != null ? details.get(LinstorConfigurationManager.InsecureSsl.key()) : null; + boolean insecureSsl = insecureSslDetail != null + ? Boolean.parseBoolean(insecureSslDetail) + : Boolean.parseBoolean(LinstorConfigurationManager.InsecureSsl.defaultValue()); + LinstorStoragePool storagePool = new LinstorStoragePool(name, host, port, userInfo, type, this, insecureSsl); MapStorageUuidToStoragePool.put(name, storagePool); @@ -742,7 +760,8 @@ public class LinstorStorageAdaptor implements StorageAdaptor { public long getCapacity(LinstorStoragePool pool) { final String rscGroupName = pool.getResourceGroup(); - return LinstorUtil.getCapacityBytes(pool.getSourceHost(), rscGroupName); + // Agent side: no per-pool token config; fall back to the host's auth.json (or unauthenticated). + return LinstorUtil.getCapacityBytes(pool.getSourceHost(), rscGroupName, null, pool.isInsecureSsl()); } public long getAvailable(LinstorStoragePool pool) { diff --git a/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/storage/LinstorStoragePool.java b/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/storage/LinstorStoragePool.java index 1bcfaa4ebf7..8a02560fd46 100644 --- a/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/storage/LinstorStoragePool.java +++ b/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/storage/LinstorStoragePool.java @@ -46,16 +46,18 @@ public class LinstorStoragePool implements KVMStoragePool { private final Storage.StoragePoolType _storagePoolType; private final StorageAdaptor _storageAdaptor; private final String _resourceGroup; + private final boolean _insecureSsl; private final String localNodeName; public LinstorStoragePool(String uuid, String host, int port, String resourceGroup, - Storage.StoragePoolType storagePoolType, StorageAdaptor storageAdaptor) { + Storage.StoragePoolType storagePoolType, StorageAdaptor storageAdaptor, boolean insecureSsl) { _uuid = uuid; _sourceHost = host; _sourcePort = port; _storagePoolType = storagePoolType; _storageAdaptor = storageAdaptor; _resourceGroup = resourceGroup; + _insecureSsl = insecureSsl; localNodeName = getHostname(); } @@ -213,6 +215,10 @@ public class LinstorStoragePool implements KVMStoragePool { return _resourceGroup; } + public boolean isInsecureSsl() { + return _insecureSsl; + } + @Override public boolean isPoolSupportHA() { return true; diff --git a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/driver/LinstorPrimaryDataStoreDriverImpl.java b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/driver/LinstorPrimaryDataStoreDriverImpl.java index 3f06bee8ac8..672731fd07c 100644 --- a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/driver/LinstorPrimaryDataStoreDriverImpl.java +++ b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/driver/LinstorPrimaryDataStoreDriverImpl.java @@ -31,6 +31,7 @@ import com.linbit.linstor.api.model.ResourceMakeAvailable; import com.linbit.linstor.api.model.ResourceWithVolumes; import com.linbit.linstor.api.model.Snapshot; import com.linbit.linstor.api.model.SnapshotRestore; +import com.linbit.linstor.api.model.SnapshotRollback; import com.linbit.linstor.api.model.VolumeDefinitionModify; import javax.annotation.Nonnull; @@ -214,9 +215,15 @@ public class LinstorPrimaryDataStoreDriverImpl implements PrimaryDataStoreDriver return LinstorUtil.RSC_PREFIX + snapshotUuid; } + private DevelopersApi getLinstorAPI(StoragePool pool) { + return LinstorUtil.getLinstorAPI(pool.getHostAddress(), + LinstorConfigurationManager.ApiToken.valueIn(pool.getId()), + Boolean.TRUE.equals(LinstorConfigurationManager.InsecureSsl.valueIn(pool.getId()))); + } + private void deleteResourceDefinition(StoragePoolVO storagePoolVO, String rscDefName) { - DevelopersApi linstorApi = LinstorUtil.getLinstorAPI(storagePoolVO.getHostAddress()); + DevelopersApi linstorApi = getLinstorAPI(storagePoolVO); try { @@ -240,7 +247,7 @@ public class LinstorPrimaryDataStoreDriverImpl implements PrimaryDataStoreDriver private void deleteSnapshot(@Nonnull DataStore dataStore, @Nonnull String rscDefName, @Nonnull String snapshotName) { StoragePoolVO storagePool = _storagePoolDao.findById(dataStore.getId()); - DevelopersApi linstorApi = LinstorUtil.getLinstorAPI(storagePool.getHostAddress()); + DevelopersApi linstorApi = getLinstorAPI(storagePool); try { @@ -411,7 +418,7 @@ public class LinstorPrimaryDataStoreDriverImpl implements PrimaryDataStoreDriver } final String rscName = LinstorUtil.RSC_PREFIX + volumeInfo.getUuid(); - final DevelopersApi linstorApi = LinstorUtil.getLinstorAPI(storagePoolVO.getHostAddress()); + final DevelopersApi linstorApi = getLinstorAPI(storagePoolVO); try { ResourceDefinition templateRD = LinstorUtil.findResourceDefinition( @@ -474,7 +481,7 @@ public class LinstorPrimaryDataStoreDriverImpl implements PrimaryDataStoreDriver private String createResourceFromSnapshot(long csSnapshotId, String rscName, StoragePoolVO storagePoolVO) { final String rscGrp = LinstorUtil.getRscGrp(storagePoolVO); - final DevelopersApi linstorApi = LinstorUtil.getLinstorAPI(storagePoolVO.getHostAddress()); + final DevelopersApi linstorApi = getLinstorAPI(storagePoolVO); SnapshotVO snapshotVO = _snapshotDao.findById(csSnapshotId); String snapName = LinstorUtil.RSC_PREFIX + snapshotVO.getUuid(); @@ -672,14 +679,14 @@ public class LinstorPrimaryDataStoreDriverImpl implements PrimaryDataStoreDriver private String doRevertSnapshot(final SnapshotInfo snapshot, final VolumeInfo volumeInfo) { final StoragePool pool = (StoragePool) volumeInfo.getDataStore(); - final DevelopersApi linstorApi = LinstorUtil.getLinstorAPI(pool.getHostAddress()); + final DevelopersApi linstorApi = getLinstorAPI(pool); final String rscName = LinstorUtil.RSC_PREFIX + volumeInfo.getPath(); String resultMsg; try { if (snapshot.getDataStore().getRole() == DataStoreRole.Primary) { final String snapName = LinstorUtil.RSC_PREFIX + snapshot.getUuid(); - ApiCallRcList answers = linstorApi.resourceSnapshotRollback(rscName, snapName); + ApiCallRcList answers = linstorApi.resourceSnapshotRollback(rscName, snapName, new SnapshotRollback()); resultMsg = checkLinstorAnswers(answers); } else if (snapshot.getDataStore().getRole() == DataStoreRole.Image) { resultMsg = revertSnapshotFromImageStore(snapshot, volumeInfo, linstorApi, rscName); @@ -913,7 +920,7 @@ public class LinstorPrimaryDataStoreDriverImpl implements PrimaryDataStoreDriver private Answer copyTemplate(DataObject srcData, DataObject dstData) { TemplateInfo tInfo = (TemplateInfo) dstData; final StoragePoolVO pool = _storagePoolDao.findById(dstData.getDataStore().getId()); - final DevelopersApi api = LinstorUtil.getLinstorAPI(pool.getHostAddress()); + final DevelopersApi api = getLinstorAPI(pool); final String rscName = LinstorUtil.RSC_PREFIX + dstData.getUuid(); boolean newCreated = LinstorUtil.createResourceBase( LinstorUtil.RSC_PREFIX + dstData.getUuid(), @@ -961,7 +968,7 @@ public class LinstorPrimaryDataStoreDriverImpl implements PrimaryDataStoreDriver private Answer copyVolume(DataObject srcData, DataObject dstData) { VolumeInfo srcVolInfo = (VolumeInfo) srcData; final StoragePoolVO pool = _storagePoolDao.findById(srcVolInfo.getDataStore().getId()); - final DevelopersApi api = LinstorUtil.getLinstorAPI(pool.getHostAddress()); + final DevelopersApi api = getLinstorAPI(pool); final String rscName = LinstorUtil.RSC_PREFIX + srcVolInfo.getPath(); VolumeObjectTO to = (VolumeObjectTO) srcVolInfo.getTO(); @@ -1066,7 +1073,7 @@ public class LinstorPrimaryDataStoreDriverImpl implements PrimaryDataStoreDriver SnapshotObject snapshotObject = (SnapshotObject)srcData; Boolean snapshotFullBackup = snapshotObject.getFullBackup(); final StoragePoolVO pool = _storagePoolDao.findById(srcData.getDataStore().getId()); - final DevelopersApi api = LinstorUtil.getLinstorAPI(pool.getHostAddress()); + final DevelopersApi api = getLinstorAPI(pool); boolean fullSnapshot = true; if (snapshotFullBackup != null) { fullSnapshot = snapshotFullBackup; @@ -1147,7 +1154,7 @@ public class LinstorPrimaryDataStoreDriverImpl implements PrimaryDataStoreDriver { final VolumeObject vol = (VolumeObject) data; final StoragePoolVO pool = _storagePoolDao.findById(data.getDataStore().getId()); - final DevelopersApi api = LinstorUtil.getLinstorAPI(pool.getHostAddress()); + final DevelopersApi api = getLinstorAPI(pool); final ResizeVolumePayload resizeParameter = (ResizeVolumePayload) vol.getpayload(); final String rscName = LinstorUtil.RSC_PREFIX + vol.getPath(); @@ -1221,7 +1228,7 @@ public class LinstorPrimaryDataStoreDriverImpl implements PrimaryDataStoreDriver long storagePoolId = volumeVO.getPoolId(); final StoragePoolVO storagePool = _storagePoolDao.findById(storagePoolId); - final DevelopersApi api = LinstorUtil.getLinstorAPI(storagePool.getHostAddress()); + final DevelopersApi api = getLinstorAPI(storagePool); final String rscName = LinstorUtil.RSC_PREFIX + volumeVO.getPath(); Snapshot snapshot = new Snapshot(); @@ -1265,7 +1272,9 @@ public class LinstorPrimaryDataStoreDriverImpl implements PrimaryDataStoreDriver @Override public Pair getStorageStats(StoragePool storagePool) { logger.debug(String.format("Requesting storage stats: %s", storagePool)); - return LinstorUtil.getStorageStats(storagePool.getHostAddress(), LinstorUtil.getRscGrp(storagePool)); + return LinstorUtil.getStorageStats(storagePool.getHostAddress(), LinstorUtil.getRscGrp(storagePool), + LinstorConfigurationManager.ApiToken.valueIn(storagePool.getId()), + Boolean.TRUE.equals(LinstorConfigurationManager.InsecureSsl.valueIn(storagePool.getId()))); } @Override @@ -1277,8 +1286,8 @@ public class LinstorPrimaryDataStoreDriverImpl implements PrimaryDataStoreDriver * Updates the cache map containing current allocated size data. * @param linstorAddr Linstor cluster api address */ - private void fillVolumeStatsCache(String linstorAddr) { - final DevelopersApi api = LinstorUtil.getLinstorAPI(linstorAddr); + private void fillVolumeStatsCache(String linstorAddr, String apiToken, boolean insecureSsl) { + final DevelopersApi api = LinstorUtil.getLinstorAPI(linstorAddr, apiToken, insecureSsl); try { logger.trace("Start volume stats cache update for " + linstorAddr); List resources = api.viewResources( @@ -1327,7 +1336,9 @@ public class LinstorPrimaryDataStoreDriverImpl implements PrimaryDataStoreDriver long invalidateCacheTime = volumeStatsLastUpdate.getOrDefault(storagePool.getHostAddress(), 0L) + LinstorConfigurationManager.VolumeStatsCacheTime.value() * 1000; if (invalidateCacheTime < System.currentTimeMillis()) { - fillVolumeStatsCache(storagePool.getHostAddress()); + fillVolumeStatsCache(storagePool.getHostAddress(), + LinstorConfigurationManager.ApiToken.valueIn(storagePool.getId()), + Boolean.TRUE.equals(LinstorConfigurationManager.InsecureSsl.valueIn(storagePool.getId()))); } String volumeKey = linstorAddr + "/" + LinstorUtil.RSC_PREFIX + volumeId; Pair sizePair = volumeStats.get(volumeKey); diff --git a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/lifecycle/LinstorPrimaryDataStoreLifeCycleImpl.java b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/lifecycle/LinstorPrimaryDataStoreLifeCycleImpl.java index fa9c1b71ff3..7c1330b9088 100644 --- a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/lifecycle/LinstorPrimaryDataStoreLifeCycleImpl.java +++ b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/lifecycle/LinstorPrimaryDataStoreLifeCycleImpl.java @@ -40,6 +40,7 @@ import com.cloud.storage.StorageManager; import com.cloud.storage.StoragePool; import com.cloud.storage.StoragePoolAutomation; import com.cloud.storage.dao.StoragePoolAndAccessGroupMapDao; +import com.cloud.utils.crypt.DBEncryptionUtil; import com.cloud.utils.exception.CloudRuntimeException; import org.apache.cloudstack.engine.subsystem.api.storage.ClusterScope; import org.apache.cloudstack.engine.subsystem.api.storage.DataStore; @@ -49,9 +50,12 @@ import org.apache.cloudstack.engine.subsystem.api.storage.PrimaryDataStoreLifeCy import org.apache.cloudstack.engine.subsystem.api.storage.PrimaryDataStoreParameters; import org.apache.cloudstack.engine.subsystem.api.storage.ZoneScope; import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao; +import org.apache.cloudstack.storage.datastore.db.StoragePoolDetailsDao; import org.apache.cloudstack.storage.datastore.db.StoragePoolVO; +import org.apache.cloudstack.storage.datastore.util.LinstorConfigurationManager; import org.apache.cloudstack.storage.datastore.util.LinstorUtil; import org.apache.cloudstack.storage.volume.datastore.PrimaryDataStoreHelper; +import org.apache.commons.lang3.StringUtils; public class LinstorPrimaryDataStoreLifeCycleImpl extends BasePrimaryDataStoreLifeCycleImpl implements PrimaryDataStoreLifeCycle { @Inject @@ -65,6 +69,8 @@ public class LinstorPrimaryDataStoreLifeCycleImpl extends BasePrimaryDataStoreLi @Inject PrimaryDataStoreHelper dataStoreHelper; @Inject + private StoragePoolDetailsDao storagePoolDetailsDao; + @Inject private StoragePoolAutomation storagePoolAutomation; @Inject private CapacityManager _capacityMgr; @@ -122,7 +128,15 @@ public class LinstorPrimaryDataStoreLifeCycleImpl extends BasePrimaryDataStoreLi } } - if (!url.contains("://")) { + // The linstor client accepts the "linstor://" (HTTP, default port 3370) and "linstor+ssl://" + // (HTTPS, default port 3371) scheme aliases, but java.net.URL only understands http/https. + // Normalize the aliases so the URL parses and is stored in a scheme the client connects with. + final String lowerUrl = url.toLowerCase(); + if (lowerUrl.startsWith("linstor+ssl://")) { + url = "https://" + url.substring("linstor+ssl://".length()); + } else if (lowerUrl.startsWith("linstor://")) { + url = "http://" + url.substring("linstor://".length()); + } else if (!url.contains("://")) { url = "http://" + url; } @@ -146,7 +160,18 @@ public class LinstorPrimaryDataStoreLifeCycleImpl extends BasePrimaryDataStoreLi throw new IllegalArgumentException("Linstor controller URL is not valid: " + e); } - long capacityBytes = LinstorUtil.getCapacityBytes(url, resourceGroup); + // The per-pool token config does not exist yet at creation time, so the token (when the + // controller requires one) may be supplied directly in the add-pool details. Pull it out of + // the details map so it is not persisted in clear text by the generic details handling, use it + // for the initial capacity probe, and store it (encrypted) as the per-pool config once the pool + // exists (below). When no token is given we fall back to the management server's auth.json (or + // an unauthenticated controller). The self-signed/insecure TLS flag is read the same way. + final String apiToken = details != null ? details.remove(LinstorConfigurationManager.ApiToken.key()) : null; + final String insecureSslDetail = details != null ? details.get(LinstorConfigurationManager.InsecureSsl.key()) : null; + final boolean insecureSsl = insecureSslDetail != null + ? Boolean.parseBoolean(insecureSslDetail) + : Boolean.parseBoolean(LinstorConfigurationManager.InsecureSsl.defaultValue()); + long capacityBytes = LinstorUtil.getCapacityBytes(url, resourceGroup, apiToken, insecureSsl); if (capacityBytes <= 0) { throw new IllegalArgumentException("'capacityBytes' must be present and greater than 0."); } @@ -173,7 +198,16 @@ public class LinstorPrimaryDataStoreLifeCycleImpl extends BasePrimaryDataStoreLi parameters.setDetails(details); parameters.setUserInfo(resourceGroup); - return dataStoreHelper.createPrimaryDataStore(parameters); + DataStore dataStore = dataStoreHelper.createPrimaryDataStore(parameters); + + if (dataStore != null && StringUtils.isNotEmpty(apiToken)) { + // lin.auth.apitoken is a "Secure" config, so its value must be stored encrypted for + // ConfigKey.valueIn() to be able to decrypt it on read. + storagePoolDetailsDao.addDetail(dataStore.getId(), + LinstorConfigurationManager.ApiToken.key(), DBEncryptionUtil.encrypt(apiToken), false); + } + + return dataStore; } protected boolean createStoragePool(Host host, StoragePool pool) { diff --git a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorConfigChangeListener.java b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorConfigChangeListener.java new file mode 100644 index 00000000000..cec3fb68ea9 --- /dev/null +++ b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorConfigChangeListener.java @@ -0,0 +1,108 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. +package org.apache.cloudstack.storage.datastore.util; + +import java.util.Collections; +import java.util.Map; + +import javax.inject.Inject; +import javax.naming.ConfigurationException; + +import org.apache.cloudstack.framework.config.ConfigKey; +import org.apache.cloudstack.framework.messagebus.MessageBus; +import org.apache.cloudstack.framework.messagebus.MessageSubscriber; +import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao; +import org.apache.cloudstack.storage.datastore.db.StoragePoolVO; +import org.apache.logging.log4j.LogManager; +import org.apache.logging.log4j.Logger; + +import com.cloud.event.EventTypes; +import com.cloud.host.Host; +import com.cloud.host.dao.HostDao; +import com.cloud.storage.Storage; +import com.cloud.storage.StorageManager; +import com.cloud.storage.dao.StoragePoolHostDao; +import com.cloud.utils.Ternary; +import com.cloud.utils.component.ManagerBase; + +/** + * Management-server only component. Per-pool Linstor settings that the agent needs (the insecure-TLS + * flag) are delivered to the agent inside the storage pool details of a ModifyStoragePoolCommand and + * then cached in the agent's LinstorStoragePool. A dynamic {@code updateConfiguration} only updates the + * database and the management server's own config cache; it does not refresh the agent. This listener + * reacts to such changes and re-pushes the pool details to every connected host so the cached pool is + * rebuilt with the new value, without requiring a host reconnect. + */ +public class LinstorConfigChangeListener extends ManagerBase { + protected Logger logger = LogManager.getLogger(getClass()); + + @Inject + private MessageBus messageBus; + @Inject + private PrimaryDataStoreDao primaryDataStoreDao; + @Inject + private StoragePoolHostDao storagePoolHostDao; + @Inject + private HostDao hostDao; + @Inject + private StorageManager storageManager; + + @Override + public boolean configure(String name, Map params) throws ConfigurationException { + super.configure(name, params); + messageBus.subscribe(EventTypes.EVENT_CONFIGURATION_VALUE_EDIT, new ConfigValueChangeSubscriber()); + return true; + } + + private final class ConfigValueChangeSubscriber implements MessageSubscriber { + @Override + @SuppressWarnings("unchecked") + public void onPublishMessage(String senderAddress, String subject, Object args) { + if (!(args instanceof Ternary)) { + return; + } + final Ternary updated = (Ternary) args; + // Only the per-pool insecure-TLS flag has to reach the agent; the API token is read from + // the agent's local auth.json, so it never needs a re-push. + if (ConfigKey.Scope.StoragePool != updated.second() + || !LinstorConfigurationManager.InsecureSsl.key().equals(updated.first())) { + return; + } + + final Long poolId = updated.third(); + final StoragePoolVO pool = primaryDataStoreDao.findById(poolId); + if (pool == null || pool.getPoolType() != Storage.StoragePoolType.Linstor) { + return; + } + + logger.debug("Linstor: {} changed for storage pool {}, re-pushing pool details to connected hosts", + updated.first(), poolId); + for (Long hostId : storagePoolHostDao.findHostsConnectedToPools(Collections.singletonList(poolId))) { + final Host host = hostDao.findById(hostId); + if (host == null) { + continue; + } + try { + storageManager.connectHostToSharedPool(host, poolId); + logger.debug("Linstor: re-pushed pool {} details to host {}", poolId, hostId); + } catch (Exception e) { + logger.warn("Linstor: failed to re-push pool {} details to host {}", poolId, hostId, e); + } + } + } + } +} diff --git a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorConfigurationManager.java b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorConfigurationManager.java index 85a0804dbab..0292eef64a5 100644 --- a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorConfigurationManager.java +++ b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorConfigurationManager.java @@ -29,8 +29,15 @@ public class LinstorConfigurationManager implements Configurable "Cache time of volume stats for Linstor volumes. 0 to disable volume stats", false); + public static final ConfigKey ApiToken = new ConfigKey<>(String.class, "lin.auth.apitoken", "Secure", "", + "API token used to authenticate on the Controller", true, ConfigKey.Scope.StoragePool, null); + + public static final ConfigKey InsecureSsl = new ConfigKey<>(Boolean.class, "lin.ssl.insecure", "Advanced", "true", + "Allow self-signed/untrusted TLS certificates from the Linstor controller (disables certificate and hostname verification)", + true, ConfigKey.Scope.StoragePool, null); + public static final ConfigKey[] CONFIG_KEYS = new ConfigKey[] { - BackupSnapshots, VolumeStatsCacheTime + ApiToken, BackupSnapshots, InsecureSsl, VolumeStatsCacheTime }; @Override diff --git a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorUtil.java b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorUtil.java index 7c45493dddc..67c070f84eb 100644 --- a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorUtil.java +++ b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorUtil.java @@ -51,6 +51,7 @@ import java.util.Optional; import java.util.stream.Collectors; import com.cloud.hypervisor.kvm.storage.KVMStoragePool; +import com.cloud.hypervisor.kvm.storage.LinstorStoragePool; import com.cloud.utils.Pair; import com.cloud.utils.exception.CloudRuntimeException; import org.apache.cloudstack.engine.subsystem.api.storage.VolumeInfo; @@ -78,8 +79,25 @@ public class LinstorUtil { public static final String CLUSTER_DEFAULT_MAX_IOPS = "clusterDefaultMaxIops"; public static DevelopersApi getLinstorAPI(String linstorUrl) { + return getLinstorAPI(linstorUrl, null, false); + } + + public static DevelopersApi getLinstorAPI(String linstorUrl, String apiToken) { + return getLinstorAPI(linstorUrl, apiToken, false); + } + + public static DevelopersApi getLinstorAPI(String linstorUrl, String apiToken, boolean insecureSsl) { ApiClient client = new ApiClient(); client.setBasePath(linstorUrl); + // An explicit (non-empty) token wins; otherwise the client falls back to the auth.json file + // on the local host (used on the agent side). No token at all -> unauthenticated controller. + client.setAccessTokenWithFallback(apiToken); + // Trust self-signed/untrusted controller certificates when explicitly allowed (rebuilds the + // http client, so set this before discovering HTTPS). + if (insecureSsl) { + client.setInsecureSsl(); + } + client.discoverHttps(); return new DevelopersApi(client); } @@ -224,8 +242,8 @@ public class LinstorUtil { ); } - public static long getCapacityBytes(String linstorUrl, String rscGroupName) { - DevelopersApi linstorApi = getLinstorAPI(linstorUrl); + public static long getCapacityBytes(String linstorUrl, String rscGroupName, String apiToken, boolean insecureSsl) { + DevelopersApi linstorApi = getLinstorAPI(linstorUrl, apiToken, insecureSsl); try { List storagePools = getRscGroupStoragePools(linstorApi, rscGroupName); @@ -239,8 +257,8 @@ public class LinstorUtil { } } - public static Pair getStorageStats(String linstorUrl, String rscGroupName) { - DevelopersApi linstorApi = getLinstorAPI(linstorUrl); + public static Pair getStorageStats(String linstorUrl, String rscGroupName, String apiToken, boolean insecureSsl) { + DevelopersApi linstorApi = getLinstorAPI(linstorUrl, apiToken, insecureSsl); try { List storagePools = LinstorUtil.getRscGroupStoragePools(linstorApi, rscGroupName); @@ -505,7 +523,8 @@ public class LinstorUtil { * @return true if all resources are on a provider with zeroed blocks. */ public static boolean resourceSupportZeroBlocks(KVMStoragePool pool, String resName) { - final DevelopersApi api = getLinstorAPI(pool.getSourceHost()); + final boolean insecureSsl = pool instanceof LinstorStoragePool && ((LinstorStoragePool) pool).isInsecureSsl(); + final DevelopersApi api = getLinstorAPI(pool.getSourceHost(), null, insecureSsl); try { List resWithVols = api.viewResources( Collections.emptyList(), @@ -760,7 +779,9 @@ public class LinstorUtil { public static String createResource(VolumeInfo vol, StoragePoolVO storagePoolVO, PrimaryDataStoreDao primaryDataStoreDao, boolean exactSize) { - DevelopersApi linstorApi = LinstorUtil.getLinstorAPI(storagePoolVO.getHostAddress()); + DevelopersApi linstorApi = LinstorUtil.getLinstorAPI(storagePoolVO.getHostAddress(), + LinstorConfigurationManager.ApiToken.valueIn(storagePoolVO.getId()), + Boolean.TRUE.equals(LinstorConfigurationManager.InsecureSsl.valueIn(storagePoolVO.getId()))); final String rscGrp = getRscGrp(storagePoolVO); final String rscName = LinstorUtil.RSC_PREFIX + vol.getUuid(); diff --git a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/motion/LinstorDataMotionStrategy.java b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/motion/LinstorDataMotionStrategy.java index cab2820f09a..f64837e4832 100644 --- a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/motion/LinstorDataMotionStrategy.java +++ b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/motion/LinstorDataMotionStrategy.java @@ -70,6 +70,7 @@ import org.apache.cloudstack.storage.command.CopyCmdAnswer; import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao; import org.apache.cloudstack.storage.datastore.db.SnapshotDataStoreDao; import org.apache.cloudstack.storage.datastore.db.StoragePoolVO; +import org.apache.cloudstack.storage.datastore.util.LinstorConfigurationManager; import org.apache.cloudstack.storage.datastore.util.LinstorUtil; import org.apache.commons.collections.CollectionUtils; import org.apache.commons.collections.MapUtils; @@ -170,7 +171,9 @@ public class LinstorDataMotionStrategy implements DataMotionStrategy { private void removeExactSizeProperty(VolumeInfo volumeInfo) { StoragePoolVO destStoragePool = _storagePool.findById(volumeInfo.getDataStore().getId()); - DevelopersApi api = LinstorUtil.getLinstorAPI(destStoragePool.getHostAddress()); + DevelopersApi api = LinstorUtil.getLinstorAPI(destStoragePool.getHostAddress(), + LinstorConfigurationManager.ApiToken.valueIn(destStoragePool.getId()), + Boolean.TRUE.equals(LinstorConfigurationManager.InsecureSsl.valueIn(destStoragePool.getId()))); ResourceDefinitionModify rdm = new ResourceDefinitionModify(); rdm.setDeleteProps(Collections.singletonList(LinstorUtil.LIN_PROP_DRBDOPT_EXACT_SIZE)); @@ -290,7 +293,9 @@ public class LinstorDataMotionStrategy implements DataMotionStrategy { private boolean needsExactSizeProp(VolumeInfo srcVolumeInfo) { StoragePoolVO srcStoragePool = _storagePool.findById(srcVolumeInfo.getDataStore().getId()); if (srcStoragePool.getPoolType() == Storage.StoragePoolType.Linstor) { - DevelopersApi api = LinstorUtil.getLinstorAPI(srcStoragePool.getHostAddress()); + DevelopersApi api = LinstorUtil.getLinstorAPI(srcStoragePool.getHostAddress(), + LinstorConfigurationManager.ApiToken.valueIn(srcStoragePool.getId()), + Boolean.TRUE.equals(LinstorConfigurationManager.InsecureSsl.valueIn(srcStoragePool.getId()))); String rscName = LinstorUtil.RSC_PREFIX + srcVolumeInfo.getPath(); try { diff --git a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/snapshot/LinstorVMSnapshotStrategy.java b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/snapshot/LinstorVMSnapshotStrategy.java index 4e4c882ae80..d0f82484694 100644 --- a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/snapshot/LinstorVMSnapshotStrategy.java +++ b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/snapshot/LinstorVMSnapshotStrategy.java @@ -23,6 +23,7 @@ import com.linbit.linstor.api.DevelopersApi; import com.linbit.linstor.api.model.ApiCallRcList; import com.linbit.linstor.api.model.CreateMultiSnapshotRequest; import com.linbit.linstor.api.model.Snapshot; +import com.linbit.linstor.api.model.SnapshotRollback; import javax.inject.Inject; @@ -49,6 +50,7 @@ import com.cloud.vm.snapshot.dao.VMSnapshotDao; import org.apache.cloudstack.engine.subsystem.api.storage.StrategyPriority; import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao; import org.apache.cloudstack.storage.datastore.db.StoragePoolVO; +import org.apache.cloudstack.storage.datastore.util.LinstorConfigurationManager; import org.apache.cloudstack.storage.datastore.util.LinstorUtil; import org.apache.cloudstack.storage.to.VolumeObjectTO; import org.apache.cloudstack.storage.vmsnapshot.DefaultVMSnapshotStrategy; @@ -137,7 +139,10 @@ public class LinstorVMSnapshotStrategy extends DefaultVMSnapshotStrategy { try { final List volumeTOs = _vmSnapshotHelper.getVolumeTOList(userVm.getId()); final StoragePoolVO storagePool = _storagePoolDao.findById(volumeTOs.get(0).getPoolId()); - final DevelopersApi api = LinstorUtil.getLinstorAPI(storagePool.getHostAddress()); + final DevelopersApi api = LinstorUtil.getLinstorAPI( + storagePool.getHostAddress(), + LinstorConfigurationManager.ApiToken.valueIn(storagePool.getId()), + Boolean.TRUE.equals(LinstorConfigurationManager.InsecureSsl.valueIn(storagePool.getId()))); long prev_chain_size = 0; long virtual_size = 0; @@ -235,7 +240,10 @@ public class LinstorVMSnapshotStrategy extends DefaultVMSnapshotStrategy { List volumeTOs = _vmSnapshotHelper.getVolumeTOList(vmSnapshot.getVmId()); final StoragePoolVO storagePool = _storagePoolDao.findById(volumeTOs.get(0).getPoolId()); - final DevelopersApi api = LinstorUtil.getLinstorAPI(storagePool.getHostAddress()); + final DevelopersApi api = LinstorUtil.getLinstorAPI( + storagePool.getHostAddress(), + LinstorConfigurationManager.ApiToken.valueIn(storagePool.getId()), + Boolean.TRUE.equals(LinstorConfigurationManager.InsecureSsl.valueIn(storagePool.getId()))); final String snapshotName = vmSnapshotVO.getName(); final List failedToDelete = new ArrayList<>(); @@ -272,7 +280,7 @@ public class LinstorVMSnapshotStrategy extends DefaultVMSnapshotStrategy { private String linstorRevertSnapshot(final DevelopersApi api, final String rscName, final String snapshotName) { String resultMsg = null; try { - ApiCallRcList answers = api.resourceSnapshotRollback(rscName, snapshotName); + ApiCallRcList answers = api.resourceSnapshotRollback(rscName, snapshotName, new SnapshotRollback()); if (answers.hasError()) { resultMsg = LinstorUtil.getBestErrorMessage(answers); } @@ -289,7 +297,10 @@ public class LinstorVMSnapshotStrategy extends DefaultVMSnapshotStrategy { List volumeTOs = _vmSnapshotHelper.getVolumeTOList(userVmId); final StoragePoolVO storagePool = _storagePoolDao.findById(volumeTOs.get(0).getPoolId()); - final DevelopersApi api = LinstorUtil.getLinstorAPI(storagePool.getHostAddress()); + final DevelopersApi api = LinstorUtil.getLinstorAPI( + storagePool.getHostAddress(), + LinstorConfigurationManager.ApiToken.valueIn(storagePool.getId()), + Boolean.TRUE.equals(LinstorConfigurationManager.InsecureSsl.valueIn(storagePool.getId()))); final String snapshotName = vmSnapshotVO.getName(); for (VolumeObjectTO volumeObjectTO : volumeTOs) { diff --git a/plugins/storage/volume/linstor/src/main/resources/META-INF/cloudstack/storage-volume-linstor/spring-storage-volume-linstor-context.xml b/plugins/storage/volume/linstor/src/main/resources/META-INF/cloudstack/storage-volume-linstor/spring-storage-volume-linstor-context.xml index 88d1051c71e..ff46be9352a 100644 --- a/plugins/storage/volume/linstor/src/main/resources/META-INF/cloudstack/storage-volume-linstor/spring-storage-volume-linstor-context.xml +++ b/plugins/storage/volume/linstor/src/main/resources/META-INF/cloudstack/storage-volume-linstor/spring-storage-volume-linstor-context.xml @@ -33,6 +33,8 @@ class="org.apache.cloudstack.storage.snapshot.LinstorVMSnapshotStrategy" /> + diff --git a/pom.xml b/pom.xml index 8392a099b57..1c7ae233d78 100644 --- a/pom.xml +++ b/pom.xml @@ -173,7 +173,7 @@ 10.1 2.6.6 0.6.0 - 0.6.1 + 0.7.0 0.10.2 3.4.4_1 4.0.1 diff --git a/test/integration/plugins/linstor/test_linstor_volumes.py b/test/integration/plugins/linstor/test_linstor_volumes.py index e0ba15a0499..c2c220bfe9e 100644 --- a/test/integration/plugins/linstor/test_linstor_volumes.py +++ b/test/integration/plugins/linstor/test_linstor_volumes.py @@ -16,6 +16,7 @@ # under the License. import logging +import os import random import time import socket @@ -283,6 +284,17 @@ class TestLinstorVolumes(cloudstackTestCase): cls.testdata = TestData(first_host.ipaddress).testdata + # Registering a Linstor pool makes the management server read the resource-group capacity from + # the controller. If the controller enforces authentication, that call needs an API token, + # supplied as the 'lin.auth.apitoken' add-pool detail. Provide it via LINSTOR_API_TOKEN so it is + # never hard-coded; leave it unset for an unauthenticated controller. + api_token = os.environ.get("LINSTOR_API_TOKEN") + if api_token: + for storage_key in (TestData.primaryStorage, + TestData.primaryStorageSameInstance, + TestData.primaryStorageDistinctInstance): + cls.testdata[storage_key]["details"]["lin.auth.apitoken"] = api_token + # Get Resources from Cloud Infrastructure cls.zone = get_zone(cls.apiClient, zone_id=cls.testdata[TestData.zoneId]) cls.cluster = list_clusters(cls.apiClient)[0] diff --git a/ui/public/locales/en.json b/ui/public/locales/en.json index fe3678c9f37..18b76f102d4 100644 --- a/ui/public/locales/en.json +++ b/ui/public/locales/en.json @@ -2164,6 +2164,8 @@ "label.routeripv6": "IPv6 address for the VR in this Network.", "label.routing.firewall": "IPv4 Routing Firewall", "label.resourcegroup": "Resource group", +"label.linstor.apitoken": "Controller API token", +"label.linstor.ssl.insecure": "Allow self-signed certificate", "label.routingmode": "Routing mode", "label.routing.policy": "Routing policy", "label.routing.policy.terms": "Routing policy terms", @@ -3625,6 +3627,8 @@ "message.launch.zone.hint": "Configure Network components and traffic including IP addresses.", "message.license.agreements.not.accepted": "License agreements not accepted.", "message.linstor.resourcegroup.description": "Linstor resource group to use for primary storage.", +"message.linstor.apitoken.description": "API token used to authenticate against the Linstor controller. Leave empty to use an auth.json file on the management server and hosts, or for an unauthenticated controller.", +"message.linstor.ssl.insecure.description": "Trust self-signed/untrusted TLS certificates from the Linstor controller (disables certificate and hostname verification).", "message.list.zone.vmware.datacenter.empty": "No VMware Datacenter exists in the selected Zone", "message.list.zone.vmware.hosts.empty": "No EXSi hosts were found in the selected Datacenter.\nAre the entered credentials correct?\n", "message.listnsp.not.return.providerid": "error: listNetworkServiceProviders API doesn't return VirtualRouter provider ID.", diff --git a/ui/src/views/infra/AddPrimaryStorage.vue b/ui/src/views/infra/AddPrimaryStorage.vue index d46396bbb3a..a67c61ff424 100644 --- a/ui/src/views/infra/AddPrimaryStorage.vue +++ b/ui/src/views/infra/AddPrimaryStorage.vue @@ -406,6 +406,18 @@ + + + + + + + +