mirror of
https://github.com/apache/cloudstack.git
synced 2025-10-26 08:42:29 +01:00
This extends securing of KVM hosts to securing of libvirt on KVM
host as well for TLS enabled live VM migration. To simplify implementation
securing of host implies that both host and libvirtd processes are
secured with management server's CA plugin issued certificates.
Based on whether keystore and certificates files are available at
/etc/cloudstack/agent, the KVM agent determines whether to use TLS or
TCP based uris for live VM migration. It is also enforced that a secured
host will allow live VM migration to/from other secured host, and an
unsecured hosts will allow live VM migration to/from other unsecured
host only.
Post upgrade the KVM agent on startup will expose its security state
(secured detail is sent as true or false) to the managements server that
gets saved in host_details for the host. This host detail can be accesed
via the listHosts response, and in the UI unsecured KVM hosts will show
up with the host state of ‘unsecured’. Further, a button has been added
that allows admins to provision/renew certificates to KVM hosts and can
be used to secure any unsecured KVM host.
The `cloudstack-setup-agent` was modified to accept a new flag `-s`
which will reconfigure libvirtd with following settings:
listen_tcp=0
listen_tls=1
tcp_port="16509"
tls_port="16514"
auth_tcp="none"
auth_tls="none"
key_file = "/etc/pki/libvirt/private/serverkey.pem"
cert_file = "/etc/pki/libvirt/servercert.pem"
ca_file = "/etc/pki/CA/cacert.pem"
For a connected KVM host agent, when the certificate are
renewed/provisioned a background task is scheduled that waits until all
of the agent tasks finish after which libvirt process is restarted and
finally the agent is restarted via AgentShell.
There are no API or DB changes.
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
164 lines
5.9 KiB
Python
Executable File
164 lines
5.9 KiB
Python
Executable File
#!/usr/bin/python
|
|
# Licensed to the Apache Software Foundation (ASF) under one
|
|
# or more contributor license agreements. See the NOTICE file
|
|
# distributed with this work for additional information
|
|
# regarding copyright ownership. The ASF licenses this file
|
|
# to you under the Apache License, Version 2.0 (the
|
|
# "License"); you may not use this file except in compliance
|
|
# with the License. You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing,
|
|
# software distributed under the License is distributed on an
|
|
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
# KIND, either express or implied. See the License for the
|
|
# specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
import os
|
|
import logging
|
|
import sys
|
|
import socket
|
|
from cloudutils.cloudException import CloudRuntimeException, CloudInternalException
|
|
from cloudutils.utilities import initLoging, bash
|
|
from cloudutils.configFileOps import configFileOps
|
|
from cloudutils.globalEnv import globalEnv
|
|
from cloudutils.networkConfig import networkConfig
|
|
from cloudutils.syscfg import sysConfigFactory
|
|
from cloudutils.serviceConfig import configureLibvirtConfig
|
|
|
|
from optparse import OptionParser
|
|
|
|
def getUserInputs():
|
|
print "Welcome to the CloudStack Agent Setup:"
|
|
|
|
cfo = configFileOps("@AGENTSYSCONFDIR@/agent.properties")
|
|
oldMgt = cfo.getEntry("host")
|
|
|
|
mgtSvr = raw_input("Please input the Management Server Hostname/IP-Address:[%s]"%oldMgt)
|
|
if mgtSvr == "":
|
|
mgtSvr = oldMgt
|
|
try:
|
|
socket.getaddrinfo(mgtSvr, 443)
|
|
except:
|
|
print "Failed to resolve %s. Please input a valid hostname or IP-Address."%mgtSvr
|
|
exit(1)
|
|
|
|
oldToken = cfo.getEntry("zone")
|
|
zoneToken = raw_input("Please input the Zone Id:[%s]"%oldToken)
|
|
|
|
if zoneToken == "":
|
|
zoneToken = oldToken
|
|
|
|
oldPod = cfo.getEntry("pod")
|
|
podId = raw_input("Please input the Pod Id:[%s]"%oldPod)
|
|
|
|
if podId == "":
|
|
podId = oldToken
|
|
|
|
oldCluster = cfo.getEntry("cluster")
|
|
clusterId = raw_input("Please input the Cluster Id:[%s]"%oldCluster)
|
|
if clusterId == "":
|
|
clusterId = oldCluster
|
|
|
|
oldHypervisor = cfo.getEntry("hypervisor")
|
|
if oldHypervisor == "":
|
|
oldHypervisor = "kvm"
|
|
|
|
hypervisor = raw_input("Please input the Hypervisor type kvm/lxc:[%s]"%oldHypervisor)
|
|
if hypervisor == "":
|
|
hypervisor = oldHypervisor
|
|
|
|
try:
|
|
defaultNic = networkConfig.getDefaultNetwork()
|
|
except:
|
|
print "Failed to get default route. Please configure your network to have a default route"
|
|
exit(1)
|
|
|
|
defNic = defaultNic.name
|
|
network = raw_input("Please choose which network used to create VM:[%s]"%defNic)
|
|
if network == "":
|
|
if defNic == "":
|
|
print "You need to specifiy one of Nic or bridge on your system"
|
|
exit(1)
|
|
elif network == "":
|
|
network = defNic
|
|
|
|
return [mgtSvr, zoneToken, network, podId, clusterId, hypervisor]
|
|
|
|
if __name__ == '__main__':
|
|
initLoging("@AGENTLOGDIR@/setup.log")
|
|
glbEnv = globalEnv()
|
|
|
|
glbEnv.mode = "Agent"
|
|
glbEnv.agentMode = "Agent"
|
|
parser = OptionParser()
|
|
parser.add_option("-a", action="store_true", dest="auto", help="auto mode")
|
|
parser.add_option("-m", "--host", dest="mgt", help="Management server hostname or IP-Address")
|
|
parser.add_option("-z", "--zone", dest="zone", help="zone id")
|
|
parser.add_option("-p", "--pod", dest="pod", help="pod id")
|
|
parser.add_option("-c", "--cluster", dest="cluster", help="cluster id")
|
|
parser.add_option("-t", "--hypervisor", default="kvm", dest="hypervisor", help="hypervisor type")
|
|
parser.add_option("-g", "--guid", dest="guid", help="guid")
|
|
parser.add_option("-s", action="store_true", default=False, dest="secure", help="Secure and enable TLS for libvirtd")
|
|
parser.add_option("--pubNic", dest="pubNic", help="Public traffic interface")
|
|
parser.add_option("--prvNic", dest="prvNic", help="Private traffic interface")
|
|
parser.add_option("--guestNic", dest="guestNic", help="Guest traffic interface")
|
|
|
|
old_config = configFileOps("@AGENTSYSCONFDIR@/agent.properties")
|
|
bridgeType = old_config.getEntry("network.bridge.type").lower()
|
|
if bridgeType:
|
|
glbEnv.bridgeType = bridgeType
|
|
|
|
(options, args) = parser.parse_args()
|
|
|
|
if not options.auto and options.secure:
|
|
configureLibvirtConfig(True)
|
|
print "Libvirtd with TLS configured"
|
|
sys.exit(0)
|
|
|
|
if options.auto is None:
|
|
userInputs = getUserInputs()
|
|
glbEnv.mgtSvr = userInputs[0]
|
|
glbEnv.zone = userInputs[1]
|
|
glbEnv.defaultNic = userInputs[2]
|
|
glbEnv.pod = userInputs[3]
|
|
glbEnv.cluster = userInputs[4]
|
|
glbEnv.hypervisor = userInputs[5]
|
|
#generate UUID
|
|
glbEnv.uuid = old_config.getEntry("guid")
|
|
if glbEnv.uuid == "":
|
|
glbEnv.uuid = bash("uuidgen").getStdout()
|
|
else:
|
|
for para, value in options.__dict__.items():
|
|
if value is None:
|
|
print "Missing operand:%s"%para
|
|
print "Try %s --help for more information"%sys.argv[0]
|
|
sys.exit(1)
|
|
|
|
glbEnv.uuid = options.guid
|
|
glbEnv.mgtSvr = options.mgt
|
|
glbEnv.zone = options.zone
|
|
glbEnv.pod = options.pod
|
|
glbEnv.cluster = options.cluster
|
|
glbEnv.hypervisor = options.hypervisor
|
|
glbEnv.nics.append(options.prvNic)
|
|
glbEnv.nics.append(options.pubNic)
|
|
glbEnv.nics.append(options.guestNic)
|
|
|
|
glbEnv.secure = options.secure
|
|
|
|
print "Starting to configure your system:"
|
|
syscfg = sysConfigFactory.getSysConfigFactory(glbEnv)
|
|
try:
|
|
syscfg.config()
|
|
print "CloudStack Agent setup is done!"
|
|
except (CloudRuntimeException,CloudInternalException), e:
|
|
print e
|
|
print "Try to restore your system:"
|
|
try:
|
|
syscfg.restore()
|
|
except:
|
|
pass
|