Commit Graph

38887 Commits

Author SHA1 Message Date
Wei Zhou b3b9caddc1
Merge remote-tracking branch 'apache/4.22' 2026-07-07 10:19:50 +02:00
Manoj Kumar 167eb0af75
CloudStack DNS framework - Integrate PowerDNS as first plugin (#12737) 2026-07-07 09:39:15 +02:00
Josh Gordon a951ac61d0
UI: Don't set management server ID if cookie isn't set (#13404) 2026-07-06 21:13:13 +02:00
Jarek Potiuk 4beab943f2
Add draft project security threat-model document (#13293) 2026-07-06 14:51:05 +02:00
Suresh Kumar Anaparti 4262c026d0
KVM HA: Fix CheckOnHostAnswer success flag when there is no heartbeat (#13373) 2026-07-06 13:56:04 +02:00
Suresh Kumar Anaparti 9e8855a6f5
Add async job event bus publisher (#12971)
* Async event bus publishing in AsyncJobManagerImpl to reduce API thread contention

publishOnEventBus() was calling _messageBus.publish() synchronously on the
request thread, which blocks on MessageBusBase$Gate (an exclusive mutex).
JFR analysis showed this causing up to 107ms waits on Jetty request threads,
contributing to 502 errors from the upstream load balancer.

Move event bus publishing to a dedicated single-threaded executor so API
request threads are no longer blocked by Gate contention. Event ordering
is preserved by the single-threaded executor.

* Wrap async event bus publish in ManagedContextRunnable for DB connection safety

The sole subscriber (ApiServer.handleAsyncJobPublishEvent) performs DAO reads
(getUserIncludingRemoved, getAccount, findById) inside its callback.
Without ManagedContextRunnable, the EventBus thread would not have proper
TransactionLegacy lifecycle management, risking DB connection leaks.

* logger fix

* review comments

* review changes

---------

Co-authored-by: Aaron Chung <aaron_chung@apple.com>
2026-07-06 07:54:34 -03:00
dahn 7c2a8768e6
check state instead of power state on change offering for ROOT volume (#13271)
* check state instead of power state on change offering for ROOT volume

* tests

* Apply suggestions from code review

Co-authored-by: Fabricio Duarte <fabricio.duarte.jr@gmail.com>
Co-authored-by: dahn <daan.hoogland@gmail.com>

* Apply test by package private

* fixing tests

---------

Co-authored-by: Daan Hoogland <dahn@apache.org>
Co-authored-by: Fabricio Duarte <fabricio.duarte.jr@gmail.com>
2026-07-06 14:41:25 +05:30
Pearl Dsilva e63b7da74c
Update nw_rate & mc_rate to int unsigned to allow rates > 65Gbps (#13380)
* update column type

* Apply suggestion from @DaanHoogland

Co-authored-by: dahn <daan@onecht.net>

---------

Co-authored-by: Daan Hoogland <daan@onecht.net>
Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>
Co-authored-by: Wei Zhou <weizhou@apache.org>
Co-authored-by: Harikrishna <harikrishna.patnala@gmail.com>
2026-07-06 13:12:14 +05:30
Rajiv Jain 3327e1449c
CloudStack Volume support with ONTAP storage (#13053)
Co-authored-by: Jain, Rajiv <Rajiv.Jain@netapp.com>
Co-authored-by: Surya Gupta <suryag@netapp.com>
Co-authored-by: Gupta, Surya <Surya.Gupta@netapp.com>
Co-authored-by: Locharla, Sandeep <Sandeep.Locharla@netapp.com>
Co-authored-by: Srivastava, Piyush <Piyush.Srivastava@netapp.com>
2026-07-06 08:49:28 +02:00
Abhisar Sinha daa2e61eef
Fix encryption and migration not working on Shared mountpoint (#13537) 2026-07-06 08:08:04 +02:00
GaOrtiga b7d4df0a11
Add more details to VM deployment failure alert messages (#12939)
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Erik Böck <89930804+erikbocks@users.noreply.github.com>
2026-07-04 16:26:08 +02:00
Gean Jair Silva 2032bbd7f6
Addition of the status filter in the backup listing API (#13254)
Co-authored-by: gean.silva <gean.silva@scclouds.com.br>
Co-authored-by: Gean Jair Silva <89494158+GeanJS@users.noreply.github.com>
Co-authored-by: Bernardo De Marco Gonçalves <bernardomg2004@gmail.com>
2026-07-03 16:58:39 +02:00
Nicolas Vazquez 135922fa63
listHosts: add 'core' details (#13444)
* listHosts: add 'core' details

* Include msid response and integrate core details into the base response method

Co-authored-by: abennatan <a_bennatan@apple.com>
2026-07-03 17:48:10 +05:30
Aurélien Pupier 7e84850a03
Restrict trigger push branch for GitHub Workflow (#13522)
Signed-off-by: Aurélien Pupier <apupier@ibm.com>
2026-07-02 20:50:38 +02:00
Henrique Sato 6f30b0d583
Custom login base domain using GUI whitelabel themes (#13412) 2026-07-02 20:19:31 +02:00
Bernardo De Marco Gonçalves 5c4bc486d2
Enable dynamic scaling of Kubernetes cluster offerings for KVM (#13226) 2026-07-01 17:26:57 -03:00
dahn 36fedce988
test: cleanup resources in test_deploy_vm_iso, use base class tearDown (#13136)
* test: cleanup resources in test_deploy_vm_iso and code

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Apply suggestions from code review

Co-authored-by: dahn <daan.hoogland@gmail.com>

* style and syntaxt

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Daan Hoogland <dahn@apache.org>
2026-07-01 20:30:54 +02:00
Wei Zhou 348ceaff33
kvm: get ip address of Windows vms via virsh domifaddr (#12651) 2026-07-01 20:29:54 +02:00
Wido den Hollander a97c510374
kvm: Add a configuration setting to switch between multicast and evpn VXLAN modes (#13107)
* kvm: Add a configuration setting to switch between multicast and evpn VXLAN modes

Using the 'network.vxlan.mode' setting you can switch between the multicast (default) and evpn VXLAN modes on a KVM Agent.

When nothing is configured CloudStack will default to multicast by using the modifyvxlan.sh script in the background.
If this setting is set to 'evpn' the KVM Agent will execute the 'modifyvxlan-evpn.sh' script which will configure the VXLAN
devices for EVPN (usually with FRRouting with BGP) mode.

This removes the need to manually replace a shell script on the hypervisor to switch modes.

Existing environments are not touched by this and it is safe to add this setting a an environment already using EVPN for the
VXLAN deployment.

* Add network.vxlan.mode to agent.properties

Make sure there is an example in the agent.properties file so people
can easily discover this configuration setting exists
2026-07-01 10:49:18 +02:00
Pearl Dsilva 006831daaf
UI: Prevent failure when loading network offerings when physical network has a tag (#13503)
Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>
2026-07-01 10:25:09 +02:00
Jtolelo 097a57967b
systemvm: emit IPv6 prefix block for redundant VPC VRs in radvd.conf (#13127) 2026-06-30 09:06:53 +02:00
Vishesh d2c8aa7dff
Feature: Key Management Service (KMS) (#12711)
* Add KMS framework

* integrate volume encryption with kms

* rotate keys wrapped with older versions

* allow adding kms key in deploy vm

* temp commit

* Add some tests

* fixups and some ui changes

* Change wrapping algo for pkcs

* fixups

* fix list apis

* directly create the key in the store

* Add missing license

* fixup

* Fix missing labels and label generation

* Fixup ui bug

* fixups

* Add smoke test

* Fix test failures

* fixups

* Address comments

* fix failing tests

* Address comments

* Fix pre-commit error

* fixup

* Fix failing unit tests

* fixup

* fix UI bug

* fixup createHSM in marvin library

* Fix bugs

* fix failing test

* fixup

* fixup

* fix marvin lib & tests

* fix marvin tests

* fixup

* Make HSM Profile domain scoped

* fixup
2026-06-30 10:10:41 +05:30
Robin Karlberg 1853435185
Fix RESTRICTED_TOKENS typo issue (#12709) 2026-06-29 18:22:49 -03:00
Bernardo De Marco Gonçalves 236e01aad8
Soft delete port forwarding, load balancing and firewall rules (#13015) 2026-06-29 18:21:19 -03:00
Rene Peinthor 0231e67b9d
Linstor: Add controller token auth support (#13470)
* linstor: update java-linstor to 0.7.0 to support auth token api

With Linstor 1.34.0 a new authentication mode is supported:
* Bearer token

To support that it had to be implemented in the java-linstor library
and we need to store the auth token per storage pool.
Also per default with this auth mode Linstor will run with
HTTPS enabled, so we also have to support that.

* ui: seed default-on toggles in zone wizard while hidden

StaticInputsForm.fillValue() only seeded defaults for currently-displayed
fields, so a display-gated switch with checked:true bound to an undefined
value and rendered as off once revealed. Seed checked switch/checkbox
fields even while hidden, so the Linstor 'Allow self-signed certificate'
toggle defaults on in the zone creation wizard.
2026-06-29 20:15:56 +02:00
Wei Zhou 2ba02c1a4a
systemvm: fix VPC VPN issue when network id is bigger than 1000 on Netris (#13346) 2026-06-29 16:52:14 +02:00
Vishesh 4625a43672
Batch NIC and VLAN reads in collectVmNetworkStatistics to reduce per-NIC DB round-trips (#13474)
Co-authored-by: Aaron Chung <aaron_chung@apple.com>
2026-06-29 15:45:56 +02:00
Daan Hoogland fb5e24fa08 Merge branch '4.22' 2026-06-29 15:42:25 +02:00
Daan Hoogland d5101b0c90 Merge branch '4.20' into 4.22 2026-06-29 15:33:26 +02:00
Daman Arora 5ed4894e97
storage: Add config keys for controlling public/private template secondary storage replica counts (#12877)
Adds two new operator-level configuration keys to control the number of secondary storage copies made for public and private templates, decoupling replica count from template visibility.

- secstorage.public.template.copy.max (default: 0 = all stores, preserving existing behavior)
- secstorage.private.template.copy.max (default: 1, preserving existing behavior)
2026-06-29 08:14:27 +02:00
Wei Zhou 06aebb63ee
Update .asf.yaml: remove protected_branches 2026-06-26 08:38:48 +02:00
Suresh Kumar Anaparti f49ab6b394
API rule regex optimization (#13109)
Co-authored-by: Aaron Chung <aaron_chung@apple.com>
2026-06-25 17:18:05 +02:00
Vishesh 82986f6cff
Refactors VM Schedule to make it more generic & add option to schedule min & max for autoscaling groups (#13148)
* refactor vmschedule to make it more generic and add new commands for it

* fixup

* update marvin tests to use the new APIs

* Update UI to use new APIs

* minor fixups

* Add support scheduling min & max for autoscaling groups

* Add marvin test for ASG

* fixup

* fixup

* fixup

* Fixup
2026-06-24 17:11:16 +05:30
Daman Arora ea6cbada9b
Multiple CD-ROM / ISO Support Per VM (#13101)
* pre-allocate a second empty cdrom slot at boot (hardcoded)

* drive cdrom slot count via vm.cdrom.max.count ConfigKey

* add vm_iso_map table + VO/DAO

* persist multi-ISO state via vm_iso_map

* carry target cdrom slot through AttachCommand to KVM agent

* enforce per-VM cdrom cap, clamp to hypervisor max

* make detachIso accepts an ISO id

* expose attached ISOs as isos[] in listVirtualMachines response

* extract CDROM_PRIMARY_DEVICE_SEQ constant

* unit tests for cdrom slot allocation logic

* implement multi-ISO attachment and detachment for VMs with enhanced validation

* implement multi-ISO display in InstanceTab with computed property for attached ISOs

* add warning alert for max CDROM selections and enhance global capacity fetching

* enhance ISO attachment validation to handle multiple ISOs and prevent duplicates

* refactor ISO attachment logic for detachment and validation

* add unit tests for ISO detachment resolution and validation logic

* add mock for VmIsoMapDao in UserVmJoinDaoImplTest and set lenient behavior for listByVmId

* refactor ISO attachment logic and enhance UI for multi-CDROM management

* refactor ISO attachment methods to use VM ID and improve parameter handling

* remove unnecessary mock for VM ISO mapping in TemplateManagerImplTest

* add 'since' attribute to ISO detach command parameter description

* scope vm.cdrom.max.count to cluster

* add support for configurable CD-ROM count per VM and improve handling in TemplateManager

* add HostDetailsDao mock to UserVmJoinDaoImplTest

* fix: handle null poolId when loading attached ISO slots in prepareIsoForVmProfile

* implement listByIsoId method in VmIsoMapDao and update TemplateManagerImpl for ISO deletion checks

* improve logging messages for ISO deletion checks

* add unit tests for CD-ROM handling and enforce limits in TemplateManager

* refactor: update configuration value handling and improve notification logic

* refactor: rename CD-ROM references to ISO and update related logic

* refactor: enhance effective CD-ROM max count logic to handle missing host IDs and improve cluster ID retrieval

* refactor: enhance effective CD-ROM max count logic to handle misconfigurations during VM boot

* refactor: enhance effective CD-ROM max count logic to retrieve host ID from candidates based on hypervisor type

* refactor: enhance host ID retrieval logic for VMs based on hypervisor type

* feat: add bootable ISO flag to AttachedIsoResponse and update UI to display it

* refactor: simplify effectiveMaxCdroms method and improve logging for CD-ROM capacity

* test: update AttachedIsoResponseTest to include bootable flag in constructor tests

* feat: include bootable flag in AttachedIsoResponse for user VMs

* feat: enhance CD-ROM management by defining empty slots for user VMs
2026-06-24 16:38:26 +05:30
Suresh Kumar Anaparti 21e4475d96
Optimize the DB updates to use bulk UPDATE instead of row-level locks. (#13349)
Co-authored-by: Aaron Chung <aaron_chung@apple.com>
2026-06-23 16:41:19 +02:00
Joël c2c855b9b1
Add keycloak OAuth provider (#13033) 2026-06-23 14:02:00 +02:00
Bernardo De Marco Gonçalves 8ef036e717
UI for API Key Pair Management (#13225)
Co-authored-by: Fabricio Duarte <fabricio.duarte.jr@gmail.com>
2026-06-22 19:13:36 -03:00
Wei Zhou 288f9a9fd7
framework/spring: throw RuntimeException when fail to start or load a module (#13186) 2026-06-22 08:22:27 +02:00
dependabot[bot] ce2d890e38
Bump the github-actions-dependencies group across 1 directory with 5 updates (#13396)
Bumps the github-actions-dependencies group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `6.0.2` | `6.0.3` |
| [github/codeql-action](https://github.com/github/codeql-action) | `4.35.5` | `4.36.2` |
| [github/gh-aw-actions](https://github.com/github/gh-aw-actions) | `0.76.1` | `0.79.8` |
| [docker/login-action](https://github.com/docker/login-action) | `4.1.0` | `4.2.0` |
| [eps1lon/actions-label-merge-conflict](https://github.com/eps1lon/actions-label-merge-conflict) | `3.0.3` | `3.1.0` |

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-19 10:17:37 +02:00
The Apache Software Foundation 4ea2645b3e
[INFRA] Set up default rulesets for default and release branches (#13169) 2026-06-19 10:09:12 +02:00
Vishesh 6227525c84
Optimize UsageJobDaoImpl.updateJobSuccess to use direct UPDATE instead of row-level lock (#13160)
Co-authored-by: Aaron Chung <aaron_chung@apple.com>
2026-06-18 10:42:51 -03:00
Pearl Dsilva 5ad7daf610
Add code coverage grading workflow (#13140)
Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>
2026-06-18 11:48:56 +02:00
dahn dde6eec7ed
Update .asf.yaml (#13438) 2026-06-18 11:46:58 +02:00
Suresh Kumar Anaparti 95d0aed9f5
Additional metrics for virtual machine orchestration (#13141)
Signed-off-by: Alakesh Haloi <a_haloi@apple.com>
Co-authored-by: Alakesh Haloi <a_haloi@apple.com>
Co-authored-by: Tanisha Ghai <tghai@apple.com>
2026-06-18 09:19:24 +02:00
Suresh Kumar Anaparti aef91ae324
Add OpenTelemetry tracing instrumentation to API layer (#13132)
Co-authored-by: tmckeon <tmckeon@apple.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-06-18 08:47:35 +02:00
Pearl Dsilva e689c02b68
UI: Allow selecting network for VNF nics if template is a non deploy-as-is template (#13423)
* Allow selecting network for VNF nics if template nics > 0 and is a non-deploy as is template

* delpoy as is param not required

---------

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>
2026-06-18 08:28:44 +02:00
Vishesh 957bfbb1cd
Replace issue triage agent with githubnext/agentics daily issue triage (#13434) 2026-06-17 20:15:03 +02:00
Erik Böck 02bb5de4de
Addition of description field for NIC's secondary IP addresses (#12864)
* Addition of description field for NIC's secondary IP addresses

* Address copilot's review

* Add newline at the end of file

Co-authored-by: dahn <daan.hoogland@gmail.com>

* Address Wei's label changes

* Remove colon from label

* Apply suggestions from code review

Co-authored-by: Bernardo De Marco Gonçalves <bernardomg2004@gmail.com>

* Fix missing newline at end of SQL file

---------

Co-authored-by: dahn <daan.hoogland@gmail.com>
Co-authored-by: Bernardo De Marco Gonçalves <bernardomg2004@gmail.com>
2026-06-17 13:41:02 -03:00
Pearl Dsilva ce9793c0be
CLVM enhancements and fixes (#12617)
This PR enhances the existing CLVM implementation which was based on the deprecated CLVM technology which was based on corosync/pacemaker. With RHEL 7 having reached EOL, CLVM seems to be broken. CLVM supports RAW volumes on LVM , where as CLVM_NG support QCOW2 on LVM.

Further details: https://cwiki.apache.org/confluence/display/CLOUDSTACK/Modernized+CLVM%3A+Enhancements+and+CLVM_NG+support

NOTE: On testing - it was identified that incremental snapshots for clvm-ng do not work as expected. As of now it's been removed from scope. So, CLVM and CLVM_NG would only support full snapshots.


* add support for proper cleanup of snapshots and prevent vol snapshot of running vm

* remove snap vol restriction for sunning vms

* refactor clvm code

* add support for live migration

* add support for migrating lvm lock

* clvm deletion called explicitly

* made necessary changes to allow migration of lock and deletion of detached volumes

* fix create vol from snap and attach

* add support to revert snapshot for clvm

* add support to revert snapshot for clvm

* make zero fill configurable

* make setting non-dynamic & fix test

* fix locking at vol/vm creation

* fix revert snapshot format type and handle revert snapshot functionality for clvm

* 1. Create clvmlockmanager and move common code \n
2. handle attaching volumes to stopped VMs \n
3. Handle lock transfer when VM is started on another host

* add license

* remove command/answer classes from sonar coverage check

* add support for new gen clvm with template (qcow2) backing

* Add support for clvm_ng - which allows qcow2 on block storage , linked clones, etc

* fix test and use physical size + 50% of virtual size for backing file, while virtual size + pe for disk

* migrate clvm volumes as full clone and allow migration from clvm to nfs

* fix clvm_ng to nfs migration, and handle overhead calc

* support live migration from clvm_ng to nfs and vice-versa

* add support to migrate to and from clvm to nfs

* fix creation of volume on destination host during migration to clvm/clvm-ng

* support live vm migration between clvm -> clvm-ng (vice-versa), nfs -> clvm (vice-versa) and nfs->clvm-ng (vice-versa)

* add unit tests for clvm/clvm_ng operations

* Add support for incremental volume snapshots for clvm_ng

* prevent snapshot backup for incremental clvm_ng snaps, fix build failure, add unit tests

* fix lockhost on creation of volumes from snap and fix bitmap issue when migrating a vol with incremental snap

* restrict pre and post migration commands to only kvm hosts where vm has CLVM/CLVM-NG volumes

* evist lock tracking - use lvs command to get lock host than DB

* add test for pre/post migration

* Create a CLVM storage adaptor

* update existing clvm get stats method

* fix precommit check failure

* Apply suggestions from code review

Co-authored-by: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>

* Apply suggestions from code review

Co-authored-by: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>

* improve lock host retrieval logic and quicker retrival using db host as first check point and then fanning out

* add proper support for resizing of clvm_ng which calculated PE correctly for qcow2 metadata

* fallback to full snapshots for clvm-ng - incremental not supported in 4.23

* expunge volume detail of lock host on vm expunge

* if vmmigration with volume is done to the same clvm volume group, then dont do data transfer, just lock transfer and vm

* add clvm pools with deterministic uuid , so as to prevent adding the same pool twic

* added a small improvement to factor in a senario when lv is inactive on all hosts, could happen in storage outage issue

* address comment - extract common code for endpoint identification if clvm pool type

* Address comments - add early return guard to reduce indentation

* minor improvement - when migrating vm with volumes, if there's a failures, change the clvm vols to exclusive on source from shared, and on success, change dest vol to exclusive only for cross-pool migration

* cleanup unused code and tests for incremental snaps for clvmng and other cleanups

* allow storage browser to list lv in clvm, fix clvm shrink, overprovisioning factor isnt used for clvm pools - so set it to 1 and prevented display of provisioning type for clvm

* no need to have locktransfercommand to execute in sequence

* increase lv cmd timeouts to consider cluster load

---------

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>
Co-authored-by: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>
2026-06-16 16:16:51 +05:30
dahn ac6c1c800d
Add bhouse-nexthop to contributors list (#13420) 2026-06-16 09:48:51 +02:00