Repository navigation
kvm: reload VNC TLS certificate on running VMs after cert renewal - #14151
weizhouapache wants to merge 6 commits into
Conversation
|
@blueorangutan package |
|
@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress. |
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## 4.20 #14151 +/- ##
============================================
+ Coverage 16.41% 16.42% +0.01%
- Complexity 13657 13666 +9
============================================
Files 5669 5669
Lines 501628 501675 +47
Branches 60942 60946 +4
============================================
+ Hits 82336 82403 +67
+ Misses 410064 410040 -24
- Partials 9228 9232 +4
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
Packaging result [SF]: ✖️ el8 ✖️ el9 ✖️ debian ✖️ suse15. SL-JID 19219 |
|
@blueorangutan package |
|
@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress. |
|
@blueorangutan package |
|
@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress. |
|
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 19220 |
|
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 19221 |
winterhazel
left a comment
winterhazel
left a comment
There was a problem hiding this comment.
Code looks good. This is very interesting.
|
|
||
| @Override | ||
| public Answer execute(final PostCertificateRenewalCommand command, final LibvirtComputingResource serverResource) { | ||
| logger.info("Restarting libvirt after certificate provisioning/renewal"); |
There was a problem hiding this comment.
Can we move this log inside restartLibvirtd?
|
@weizhouapache do we need any additional changes for force certificate reprovisioning when we forward merge this? |
good catch @vishesh92 |
@vishesh92 |
|
@blueorangutan package |
|
@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress. |
|
Packaging result [SF]: ✖️ el8 ✖️ el9 ✖️ debian ✖️ suse15. SL-JID 19433 |
Fixes VM console access breaking after the VNC certificate expires and is renewed (issue #9718). On KVM, the VNC TLS certificate is the host's agent certificate, applied host-wide via libvirtd's vnc_tls_x509_cert_dir setting. Restarting libvirtd after a renewal does not affect VMs already running, since QEMU only loads that certificate once, at VM start. Extend the existing PostCertificateRenewalCommand handling to, after restarting libvirtd, reload the VNC TLS certificate live on every currently running VM via the QMP display-reload command (added in QEMU 6.0, commit 9cc07651655ee86eca41059f5ead8c4e5607c734), sent through libvirt's qemu-monitor-command passthrough for compatibility with older libvirt. Hosts running QEMU < 6.0 are detected and skipped with a warning, keeping the previous stop/start-or-migrate behavior.
…path) Only attempt VNC TLS certificate reload on VMs that actually have VNC TLS enabled (auth method starts with vencrypt+x509) in the agent-based certificate provisioning path. This avoids unnecessary QMP commands on VMs without TLS-enabled VNC. Adds isVncTlsEnabled() helper method that queries VNC status via qemu-monitor-command and checks if TLS auth is in use before attempting display-reload. The method: - Issues a query-vnc QMP command to get VNC configuration - Checks if the auth field contains "vencrypt+x509" - Returns false if VNC is not configured with TLS or if query fails - Tolerates per-VM query failures without blocking the overall reload process This optimization is important because: - Not all VMs have VNC TLS enabled (some may use none, vnc, or other auth) - Unnecessary QMP commands can slow down certificate renewal on hosts with many VMs - Query failures on one VM should not prevent reloading on other VMs
- Mock query-vnc response to properly test VNC TLS status checks - Use correct vencrypt+x509+vnc/none/vnc auth formats from real QEMU - Add test case for skipping reload when VNC TLS is disabled (auth=vnc) - Verify reload happens for vencrypt+x509+vnc and vencrypt+x509+none - Verify only query-vnc is called for non-TLS VMs
a203ab8 to
a4513c1
Compare
|
This branch has not been deployed
5 participants
Description
This PR fixes VM console access breaking after the VNC certificate expires and is renewed (issue #9718). On KVM, the VNC TLS certificate is the host's agent certificate, applied host-wide via libvirtd's vnc_tls_x509_cert_dir setting. Restarting libvirtd after a renewal does not affect VMs already running, since QEMU only loads that certificate once, at VM start.
Extend the existing PostCertificateRenewalCommand handling to, after restarting libvirtd, reload the VNC TLS certificate live on every currently running VM via the QMP display-reload command (added in QEMU 6.0, commit 9cc07651655ee86eca41059f5ead8c4e5607c734), sent through libvirt's qemu-monitor-command passthrough for compatibility with older libvirt. Hosts running QEMU < 6.0 are detected and skipped with a warning, keeping the previous stop/start-or-migrate behavior.
Types of changes
Feature/Enhancement Scale or Bug Severity
Feature/Enhancement Scale
Bug Severity
Screenshots (if appropriate):
How Has This Been Tested?
How did you try to break this feature and the system with this change?