Repository navigation
[WIP] Debian 13 as SystemVM template and built-in template - #149
Draft
weizhouapache wants to merge 52 commits into
Draft
weizhouapache wants to merge 52 commits into
weizhouapache wants to merge 52 commits into
Conversation
* Add pre-commit hook to validate dependabot.yml https://check-jsonschema.readthedocs.io/en/stable/precommit_usage.html#check-dependabot python-jsonschema/check-jsonschema@12e6394 * Update regex for dependabot config file validation Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Rename hook for validating dependabot config Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
) * virtual router: Add route-maps to BGP peers for Routed Mode It is best practice, and mandatory in newer version of FRR, that route-maps should be applied to BGP peers. This is to prevent that mistakes can propogate through a network and cause outages. This change changes the route-maps where the VR will only accept IPv4 and IPv4 default gateways (0.0.0.0/0 and ::/0) to be sent by the upstream router to the VR. The other way around this change makes sure that FRR will not allow announcing anything else than the locally defined subnets to the upstream BGP router. * systemvm: ignore comment lines in BGP peer test configuration - Filter comment lines (starting with #) when comparing generated vs expected FRR config - Apply filtering to both generated config and expected config file - Allows keeping license headers in test fixtures while ignoring them in tests - All 11 BGP peer tests pass
* feature: instance boot group and readiness rules Feature to add the concept of instance boot group and readiness rules. Design spec: https://cwiki.apache.org/confluence/spaces/CLOUDSTACK/pages/449282465/Instance+Boot+Group+and+Readiness+Rules Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * address review comments Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * fix ui build Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * fixes Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * fix vm action warning Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * minor label fixes Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * add tests Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * fixes, address comments Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * remove unused logs Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * fixes Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * fixes and more tests Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * force stop option and smoke test Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * minor config description Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * address comments Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * address comments; consistent API description Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * fix failing test Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * address missed Copilot review Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * engine-schema: upgrade path for 4.24.0 Adds a 4.23.0 to 4.24.0 upgrade path. Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * move schema changes to 4.24, update order column name Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * remove unused rule type from presentation Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * test: fix testRestoreVirtualMachineWhenHostRemoved failure Build was failing with, 18:53:06 [ERROR] Errors: 18:53:06 [ERROR] UserVmManagerImplTest.testRestoreVirtualMachineWhenHostRemoved:1886 ? NullPointer Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * fix imports Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * add since version for api commands Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * fix Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * fixes around members and ui Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * fix ui issue on updating readiness rule Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * fix wrong reporting of the attempt count Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * address copilot review Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * prevent instancegroup vms delete/remove only for one with rules Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> --------- Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> Co-authored-by: dahn <daan@onecht.net>
- use openjdk-21-jre-headless, as openjdk-17-jre-headless is not available in Debian 13 - drop software-properties-common, which is not available in Debian 13 - configure the Docker apt repository with a keyring in /etc/apt/keyrings and a sources.list.d entry instead of apt-key and add-apt-repository; use VERSION_CODENAME from /etc/os-release instead of lsb_release - install chrony in the preseed files, as the ntp package is not available in Debian 13 - do not fail if /etc/apt/sources.list does not exist, and add the backports and security repositories in sources.list.d - disable the cloud-init units that exist, as cloud-init.service no longer exists and stopping it failed the build
* Added basic Develocity integration * Added develocity access key setup to github actions (maven) workflows * Cleanup * Added licensing header to .mvn/extensions.xml * Added lincesing info and .gitignore for develocity integration * Point Develocity at develocity.apache.org Signed-off-by: Gasper Kojek <gkojek@gradle.com> * Bump Develocity Maven extensions and drop unused access key env - develocity-maven-extension 1.21.4 -> 2.5.0 - common-custom-user-data-maven-extension 2.0 -> 2.4.0 CCUD 2.4.0 targets develocity-maven-extension 2.5.0, and both are compatible with the Develocity 2026.2.x server. Verified locally with `mvn -N validate`: both extensions load and the existing .mvn/develocity.xml is read and accepted unchanged. Also drop DEVELOCITY_ACCESS_KEY from ui.yml and pre-commit.yml, which do not run Maven. Signed-off-by: Gasper Kojek <gkojek@gradle.com> * Use the DEVELOCITY_ACCESS_KEY secret name Signed-off-by: Gasper Kojek <gkojek@gradle.com> * Update develocity-maven-extension version to 2.6.0 * Scope DEVELOCITY_ACCESS_KEY to the Maven steps Signed-off-by: Gasper Kojek <gkojek@gradle.com> --------- Signed-off-by: Gasper Kojek <gkojek@gradle.com> Co-authored-by: Gasper Kojek <gkojek@gradle.com>
VMware to KVM: cold (VDDK) and warm (CBT) migration into Ceph/RBD and Linstor, plus importVm adoption of existing RBD and Linstor volumes Restores apache#13656 (merged as 0a5bf30, reverted by 510d0ec), with the fixes found in review: - CBT: the per-disk checkpoint between delta cycles is now read from the cycle snapshot's disk backing, so each delta copies only the changes since the previous cycle (a5578d6) - CBT: failures of the final agent command or of recording the final cycle are handled through the normal cutover failure path (6fa7d30) - CBT: cancel and delete keep the target disks of an imported VM (fd16736) - importVm: load template details from the supplied template, so imports with the removed "VM Import Default Template" work again (port of apache#14195, 2a3598a) - LINSTOR import: resource-group validation against the selected pool, and inspection and listing from controller metadata without connecting or disconnecting local DRBD resources (01058cd); pagination offset/limit order (ce349d8) Feature summary: - warm VMware-to-KVM migration with VDDK and Changed Block Tracking: persisted migration, cycle and disk records, preflight, delta cycles, operator cutover, cancel and cleanup; new admin APIs startVmwareCbtMigration, syncVmwareCbtMigration, cutoverVmwareCbtMigration, cancelVmwareCbtMigration, deleteVmwareCbtMigration, listVmwareCbtMigrations and checkVmwareCbtMigrationPrerequisites; UI under Tools - cold direct VDDK import straight into Ceph/RBD or Linstor (raw), with virt-v2v in-place finalization - adoption of existing RBD and Linstor ROOT (importVm importsource=shared) and DATA (importVolume) volumes without copying - guest OS type, firmware (BIOS/UEFI, secure boot) and console defaults derived from the source VM configuration; static IPv4 preservation; Windows data disks brought online at first boot - database changes in the 4.23.0 to 24.0.0 upgrade path Reviewed and tested: LGTM from rp- (LINSTOR maintainer) and alexandremattioli (tested warm CBT to QCOW2 and Ceph); Trillian smoke tests tid-17130 on 95fc5b5: 157 OK, 0 errors. Signed-off-by: Andrija Panic <andrija.panic@gmail.com>
For 24.x and later the systemvm templates are published in a directory named after the major version, with the major.minor version in the file names (24/systemvmtemplate-24.0-x86_64-kvm.qcow2.bz2), instead of major.minor and major.minor.patch (4.22/systemvmtemplate-4.22.0-...).
… script For 24.x and later, templateConfig.sh generates metadata.ini with the templates in the directory named after the major version and with major.minor in the file and template names (24/systemvmtemplate-24.0-..., systemvm-kvm-24.0-x86_64), so that the checksums are found in sha512sum.txt. The version in metadata.ini is unchanged (24.0.0). export-templates.sh uses major.minor for the template file names too. Legacy (4.x) behavior is unchanged. Tests are updated and extended.
- templates.sql: use the patched Debian 13 images (20261017-2634) from http://10.0.34.8/templates/debian-13-genericcloud-amd64/ for the KVM, XenServer (vhd.bz2) and VMware (ova) templates, with their SHA-512 checksums - scripts/util/build-acs-image.sh: new script to patch, shrink and convert a cloud image (qcow2) to VHD, OVA and XenServer VHD for CloudStack, and to create SHA512SUMS - schema-21to22.sql, schema-2214to30.sql: remove the inserts of the old CentOS 5 builtin templates (ids 4, 7 and 5)
…n 12 (64-bit) templates.sql cannot reference the 'Debian GNU/Linux 12 (64-bit)' guest OS because it is only added by a later upgrade script with an auto-generated id. Update the guest_os_id of the built-in Debian 13 templates (KVM, XenServer, VMware) in the 4.23.0.0 to 4.24.0.0 upgrade, looking the guest OS up by name. Also rename the VMware built-in template to debian13-x86_64-vmware to match the KVM and XenServer names, and drop the 4.3 upgrade statement that forced the XenServer built-in template back to guest OS 142.
…exist iproute2 in Debian 13 does not install /etc/iproute2/rt_tables anymore, so adding the route table of a nic failed with FileNotFoundError when the VR was configured. Create the file in bootstrap, for all the systemvm types, from /etc/iptables/rt_tables_init, or from /usr/share/iproute2/rt_tables if it does not exist. Remove the copy from default.sh.
get_suitable_test_template now returns the shared public test template (tiny-kvm on KVM), registered by the admin only when it is missing, and falls back to the built-in template. It was already doing this for XenServer. The hypervisor argument is optional and is detected from the hosts when not given. Tests that only need a small guest now use it instead of the built-in template, and test_ipv4_routing, test_snapshots and test_restore_vm no longer register their own copy of the tiny template. Tests that depend on the built-in template are not changed, for example test_deploy_vm_root_resize (needs a template of at least 1 GiB), test_templates, test_sharedfs_lifecycle and test_vm_autoscaling.
…again TestSnapshotStandaloneBackup takes a snapshot, expunges the VM and then deletes its template, to test the snapshot without its template. It needs its own template, so it cannot use the shared public test template.
cloud-init 25.1 and later (Debian 13) does not have cloud-init.service anymore. cloud-init-main is a single process which runs all the stages, and cloud-init-local, cloud-init-network, cloud-config and cloud-final hand over to it. "systemctl start cloud-init" failed, and the other two units were started without cloud-init-main, so the user data of the shared filesystem VMs and of the CKS nodes was never run. Add start_cloud_init and stop_cloud_init to common.sh and use them in sharedfsvm.sh and cksnode.sh. The old units are still used if cloud-init-main does not exist.
The ntp package does not exist in Debian 13. On Debian 12 it was a transitional package for ntpsec, and setup_ntp in common.sh configures the NTP servers in /etc/ntpsec/ntp.conf and enables the ntp service, which is an alias of ntpsec.service. With chrony, the custom NTP servers of the console proxy and secondary storage VMs were not applied.
The cgi module was removed in Python 3.13, which is used by Debian 13, so cloud-password-server failed to start with "No module named 'cgi'", and the VMs could not get their passwords. Parse the POST of savepassword.sh (multipart/form-data, sent by curl -F) with the email package instead of cgi.FieldStorage, and also accept application/x-www-form-urlencoded. Add unit tests, including a request sent by curl.
The test creates an IPv6 firewall rule with a random ICMPv6 type and code, and expects "icmpv6 code <name>" in "nft list chain". nftables 1.1.3 (Debian 13) prints the code name only for some ICMPv6 types and the number for the others, for example "icmpv6 type ind-neighbor-advert icmpv6 code 4", so the test failed depending on the random type and code. Accept both the code name and the code number.
The test creates an egress network ACL rule with a random ICMPv6 type and code, and expects "icmpv6 code <name>" in "nft list chain". nftables 1.1.3 (Debian 13) prints the code name only for some ICMPv6 types and the number for the others, for example "icmpv6 type nd-neighbor-solicit icmpv6 code 0", so the test failed depending on the random type and code. Accept both the code name and the code number, like test_network_ipv6.
The Debian 13 cloud image has no NFS client, so mounting an NFS share in the guest fails with "NFS: mount program didn't pass remote address". The shared file system smoke test mounts the share in the guest. Install nfs-common with the other guest packages.
Moving the smoke tests to the shared tiny-kvm template broke the tests that need more from the guest. Run these on the Debian 13 built-in template, taken with get_template on every hypervisor. - test_attach_multiple_volumes, test_volumes: they detach data disks from a running VM, which the tiny-kvm guest never releases. - test_backup_recovery_nas, test_backup_recovery_kboss: they create a VM from a backup and expect the files written in the guest to be in it. - test_primary_storage: it puts a primary storage with running VMs in maintenance, which needs a guest that shuts down on request. - test_volumes: use the 512 MiB big offering, as the Debian 13 guest does not boot with the 128 MiB tiny or the 256 MiB small offering. - test_vm_autoscaling: the scale up condition needs at least 1 percent CPU, and an idle Debian 13 VM uses about 0.4 percent. Start a CPU loop from the template user data.
… templates The images were rebuilt with the nfs-common package installed. The URLs are unchanged, so the KVM, XenServer and VMware templates get the checksums of the new files.
…n templates The images are built from the Debian 13 genericcloud image of 20261021-2638 with the nfs-common package installed. Update the URLs and the SHA-512 checksums of the KVM, XenServer and VMware templates.
The template build disables cloud-init with /etc/cloud/cloud-init.disabled. The units of cloud-init 25.1 (Debian 13) are skipped by systemd while that file exists, so start_cloud_init did nothing: the user data of the shared filesystem VM and the CKS nodes never ran, NFS was never started and the mount of the shared filesystem got 'Connection refused'. Remove the file (and the marker written by the generator at boot) and reload systemd so that the cloud-init generator runs again, and create the file again in stop_cloud_init.
The tests write a file in the guest and take a live backup a few seconds later. The backup is not quiesced, so a file that was not flushed yet can be missing from the backup. The guest root filesystem commits its journal about every 5 seconds, which is also the wait before the backup. Run sync after each touch, so that the file is on the disk before the backup starts.
An error answer, like the timeout when the secondary storage VM disconnects during a download, has no install path. The download callback wrote it to the template_store_ref entry anyway, so the install path became null and the next download of the template went to a directory named "null". Only update the install path when the answer has one.
Set deploy_as_is on the built-in Debian 13 VMware template in the 4.23.0.0 to 24.0.0 upgrade, so that VMs take the NIC and disk controller of the OVA (vmxnet3, pvscsi). Without it CloudStack uses an e1000 NIC, which the Debian cloud kernel has no driver for, and the VM gets no network.
…' into debian13-systemvm-builtin-templates
The sshd drop-in only sets PermitRootLogin yes now, and it is named 40-root-login.conf. PasswordAuthentication is left to the default of the image instead of being forced to yes.
…are template The guest kernel has no driver for the default e1000 NIC, so set the nicAdapter (Vmxnet3) and rootDiskController (pvscsi) details of the template instead of deploying it as is, which would prevent resizing the root disk.
…he tiny template on VMware VirtualMachine.create adds a cloud-init userdata to the VMs deployed from a built-in template, to allow ssh login with the root password, as the template disables it, so the tests can reach the VMs on any template. get_suitable_test_template returns the tiny template on VMware too, and test_update_security_group uses it.
…-2643) Download the images from 10.0.34.8 and update the checksums.
Member
|
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✖️ debian ✖️ suse15. SL-JID 19776 |
Member
|
[SF] Trillian Build Failed (tid-158) |
init.sh runs before dbus is started on a slow boot, e.g. on XenServer, so hostnamectl fails and the hostname stays 'systemvm'. The agent then registers the system VM with that name and its agent state is not shown.
Member
|
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✖️ suse15. SL-JID 19796 |
Member
|
[SF] Trillian test result (tid-155)
|
Member
|
[SF] Trillian test result (tid-156)
|
The check for a built-in template listed the template with the filter 'all', which fails for an ISO (incorrect format) and for a non-admin user. Use the filter 'executable' and consider the template as not built-in on any error.
Member
|
[SF] Trillian test result (tid-157)
|
* test: fix smoke test failures on xen/vmware * test: sleep 10 seconds before attaching volume in test_events_resource.py * test: add more time.sleep(10) * test: add more time.sleep(10) in test_vm_strict_host_tags.py * test: fix test_usage.py * test: move time.sleep(10) in test_host_maintenance.py * VMware: fix import DC * test: retry domain deletion in tearDown of test_deploy_vms_in_parallel.py * test: fix tests failures caused by others in drs and host maintenance
Member
|
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 19810 |
Member
|
[SF] Trillian test result (tid-159)
|
…mages The XenServer/XCP-ng guest agent is needed to attach volumes to a running VM (PV drivers are not detected without it). The packages are downloaded from the GitHub release on the build host. On Debian the deb provides the xenstore tools, so xenstore-utils and libxenstore4 are no longer installed.
cloud-init applies set-passwords and ssh (the public keys of the instance) once per instance, so the password and the SSH key pair reset in CloudStack are not applied when the VM is started again. Set both modules to always in cloud.cfg. The ssh module deletes and regenerates the host keys whenever it runs, so set ssh_deletekeys to false to keep them across the boots.
… are detected XenServer and XCP-ng refuse to hot-attach or hot-detach a volume until the guest tools report in, which is about 45 seconds after the start of a Debian 13 guest. The tests attach a volume right after the VM is Running or restarted, so retry for up to 3 minutes when the error is about the PV drivers.
The Debian 13 built-in template does not boot with the 128 MiB of the tiny offering, so the volume cannot be attached to the VM.
Use 512 MiB and 1024 MiB service offerings, as the guest does not have enough memory with 256 MiB when the dynamic scaling is enabled. Check the open-vm-tools service too, as the guest does not have the vmware-tools service, so all the tests were skipped on VMware.
The images are rebuilt with the changes of build-acs-image.sh: set-passwords and ssh run on every boot, and xe-guest-utilities is installed.
Member
|
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 19837 |
Member
Author
|
Member
|
[SF] Trillian Build Failed (tid-163) |
Member
|
[SF] Trillian Build Failed (tid-161) |
Member
|
[SF] Trillian Build Failed (tid-164) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR combines
apache#12912
apache#14493
Types of changes
Feature/Enhancement Scale or Bug Severity
Feature/Enhancement Scale
Bug Severity
Screenshots (if appropriate):
How Has This Been Tested?
How did you try to break this feature and the system with this change?