Skip to content

Commit 5b34b8f

Browse files
nvazqueznvazquez
committed
Prevent regenerating keystore and add background task to upload certificates
1 parent 54fe518 commit 5b34b8f

19 files changed

Lines changed: 606 additions & 74 deletions

File tree

‎agent/src/com/cloud/agent/Agent.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -725,7 +725,7 @@ private Answer setupDirectDownloadCertificate(SetupDirectDownloadCertificate cmd
725725
return new Answer(cmd, false, "Could not import certificate to keystore: " + KeyStoreUtils.KS_FILENAME);
726726
}
727727

728-
return new Answer(cmd, true, "Certificate " + certificateName + " imported");
728+
return new Answer(cmd, true, "Certificate alias " + certificateName + " imported");
729729
}
730730

731731
public Answer setupAgentKeystore(final SetupKeyStoreCommand cmd) {

api/src/org/apache/cloudstack/api/command/admin/direct/download/UploadTemplateDirectDownloadCertificate.java renamed to api/src/org/apache/cloudstack/api/command/admin/direct/download/UploadTemplateDirectDownloadCertificateCmd.java

Lines changed: 16 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -16,11 +16,6 @@
1616
// under the License.
1717
package org.apache.cloudstack.api.command.admin.direct.download;
1818

19-
import com.cloud.exception.ConcurrentOperationException;
20-
import com.cloud.exception.InsufficientCapacityException;
21-
import com.cloud.exception.ResourceAllocationException;
22-
import com.cloud.exception.ResourceUnavailableException;
23-
import com.cloud.exception.NetworkRuleConflictException;
2419
import org.apache.cloudstack.acl.RoleType;
2520
import org.apache.cloudstack.api.APICommand;
2621
import org.apache.cloudstack.api.ApiConstants;
@@ -29,25 +24,26 @@
2924
import org.apache.cloudstack.api.ServerApiException;
3025
import org.apache.cloudstack.api.ApiErrorCode;
3126
import org.apache.cloudstack.api.response.SuccessResponse;
27+
import org.apache.cloudstack.api.response.ZoneResponse;
3228
import org.apache.cloudstack.context.CallContext;
3329
import org.apache.cloudstack.direct.download.DirectDownloadManager;
3430
import org.apache.log4j.Logger;
3531

3632
import javax.inject.Inject;
3733

38-
@APICommand(name = UploadTemplateDirectDownloadCertificate.APINAME,
34+
@APICommand(name = UploadTemplateDirectDownloadCertificateCmd.APINAME,
3935
description = "Upload a certificate for HTTPS direct template download on KVM hosts",
4036
responseObject = SuccessResponse.class,
4137
requestHasSensitiveInfo = true,
42-
responseHasSensitiveInfo = true,
38+
responseHasSensitiveInfo = false,
4339
since = "4.11.0",
4440
authorized = {RoleType.Admin})
45-
public class UploadTemplateDirectDownloadCertificate extends BaseCmd {
41+
public class UploadTemplateDirectDownloadCertificateCmd extends BaseCmd {
4642

4743
@Inject
4844
DirectDownloadManager directDownloadManager;
4945

50-
private static final Logger LOG = Logger.getLogger(UploadTemplateDirectDownloadCertificate.class);
46+
private static final Logger LOG = Logger.getLogger(UploadTemplateDirectDownloadCertificateCmd.class);
5147
public static final String APINAME = "uploadTemplateDirectDownloadCertificate";
5248

5349
@Parameter(name = ApiConstants.CERTIFICATE, type = BaseCmd.CommandType.STRING, required = true, length = 65535,
@@ -61,16 +57,24 @@ public class UploadTemplateDirectDownloadCertificate extends BaseCmd {
6157
@Parameter(name = ApiConstants.HYPERVISOR, type = BaseCmd.CommandType.STRING, required = true, description = "Hypervisor type")
6258
private String hypervisor;
6359

60+
@Parameter(name = ApiConstants.ZONE_ID, type = CommandType.UUID, entityType = ZoneResponse.class,
61+
description = "Zone to upload certificate", required = true)
62+
private Long zoneId;
63+
6464
@Override
65-
public void execute() throws ResourceUnavailableException, InsufficientCapacityException, ServerApiException, ConcurrentOperationException, ResourceAllocationException, NetworkRuleConflictException {
65+
public void execute() {
6666
if (!hypervisor.equalsIgnoreCase("kvm")) {
6767
throw new ServerApiException(ApiErrorCode.PARAM_ERROR, "Currently supporting KVM hosts only");
6868
}
6969

70-
SuccessResponse response = new SuccessResponse(getCommandName());
70+
if (name.equalsIgnoreCase("cloud")) {
71+
throw new ServerApiException(ApiErrorCode.PARAM_ERROR, "Please provide a different alias name for the certificate");
72+
}
73+
7174
try {
7275
LOG.debug("Uploading certificate " + name + " to agents for Direct Download");
73-
boolean result = directDownloadManager.uploadCertificateToHosts(certificate, name, hypervisor);
76+
boolean result = directDownloadManager.uploadCertificateToHosts(certificate, name, hypervisor, zoneId);
77+
SuccessResponse response = new SuccessResponse(getCommandName());
7478
response.setSuccess(result);
7579
setResponseObject(response);
7680
} catch (Exception e) {

‎api/src/org/apache/cloudstack/direct/download/DirectDownloadCertificate.java‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
// Licensed to the Apache Software Foundation (ASF) under one
2+
// or more contributor license agreements. See the NOTICE file
3+
// distributed with this work for additional information
4+
// regarding copyright ownership. The ASF licenses this file
5+
// to you under the Apache License, Version 2.0 (the
6+
// "License"); you may not use this file except in compliance
7+
// with the License. You may obtain a copy of the License at
8+
//
9+
// http://www.apache.org/licenses/LICENSE-2.0
10+
//
11+
// Unless required by applicable law or agreed to in writing,
12+
// software distributed under the License is distributed on an
13+
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
// KIND, either express or implied. See the License for the
15+
// specific language governing permissions and limitations
16+
// under the License.
17+
package org.apache.cloudstack.direct.download;
18+
19+
import com.cloud.hypervisor.Hypervisor;
20+
import org.apache.cloudstack.api.Identity;
21+
import org.apache.cloudstack.api.InternalIdentity;
22+
23+
public interface DirectDownloadCertificate extends InternalIdentity, Identity {
24+
25+
String getCertificate();
26+
String getAlias();
27+
Hypervisor.HypervisorType getHypervisorType();
28+
29+
}

‎api/src/org/apache/cloudstack/direct/download/DirectDownloadManager.java‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,14 @@
1919

2020
import com.cloud.utils.component.PluggableService;
2121
import org.apache.cloudstack.framework.agent.direct.download.DirectDownloadService;
22+
import org.apache.cloudstack.framework.config.ConfigKey;
23+
import org.apache.cloudstack.framework.config.Configurable;
2224

23-
public interface DirectDownloadManager extends DirectDownloadService, PluggableService {
25+
public interface DirectDownloadManager extends DirectDownloadService, PluggableService, Configurable {
2426

27+
ConfigKey<Long> DirectDownloadCertificateUploadInterval = new ConfigKey<>("Advanced", Long.class,
28+
"direct.download.certificate.background.task.interval",
29+
"24",
30+
"The Direct Download framework background interval in hours.",
31+
true);
2532
}

‎engine/schema/resources/META-INF/cloudstack/core/spring-engine-schema-core-daos-context.xml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -356,4 +356,6 @@
356356
<bean id="outOfBandManagementDaoImpl" class="org.apache.cloudstack.outofbandmanagement.dao.OutOfBandManagementDaoImpl" />
357357
<bean id="GuestOsDetailsDaoImpl" class="org.apache.cloudstack.resourcedetail.dao.GuestOsDetailsDaoImpl" />
358358
<bean id="annotationDaoImpl" class="org.apache.cloudstack.annotation.dao.AnnotationDaoImpl" />
359+
<bean id="directDownloadCertificateDaoImpl" class="org.apache.cloudstack.direct.download.DirectDownloadCertificateDaoImpl" />
360+
<bean id="directDownloadCertificateHostMapDaoImpl" class="org.apache.cloudstack.direct.download.DirectDownloadCertificateHostMapDaoImpl" />
359361
</beans>

‎engine/schema/resources/META-INF/db/schema-41110to41120.sql‎

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,4 +27,28 @@ INSERT IGNORE INTO `cloud`.`guest_os_hypervisor` (uuid,hypervisor_type, hypervis
2727
ALTER TABLE `cloud`.`user_vm_clone_setting`
2828
ADD COLUMN `id` BIGINT(20) UNSIGNED NOT NULL AUTO_INCREMENT FIRST,
2929
DROP PRIMARY KEY,
30-
ADD PRIMARY KEY (`id`);
30+
ADD PRIMARY KEY (`id`);
31+
32+
CREATE TABLE `cloud`.`direct_download_certificate` (
33+
`id` bigint(20) unsigned NOT NULL AUTO_INCREMENT,
34+
`uuid` varchar(40) NOT NULL,
35+
`alias` varchar(255) NOT NULL,
36+
`certificate` text NOT NULL,
37+
`hypervisor_type` varchar(45) NOT NULL,
38+
`zone_id` bigint(20) unsigned NOT NULL,
39+
PRIMARY KEY (`id`),
40+
KEY `i_direct_download_certificate_alias` (`alias`),
41+
KEY `fk_direct_download_certificate__zone_id` (`zone_id`),
42+
CONSTRAINT `fk_direct_download_certificate__zone_id` FOREIGN KEY (`zone_id`) REFERENCES `data_center` (`id`) ON DELETE CASCADE
43+
) ENGINE=InnoDB DEFAULT CHARSET=utf8;
44+
45+
CREATE TABLE `cloud`.`direct_download_certificate_host_map` (
46+
`id` bigint(20) unsigned NOT NULL AUTO_INCREMENT,
47+
`certificate_id` bigint(20) unsigned NOT NULL,
48+
`host_id` bigint(20) unsigned NOT NULL,
49+
PRIMARY KEY (`id`),
50+
KEY `fk_direct_download_certificate_host_map__host_id` (`host_id`),
51+
KEY `fk_direct_download_certificate_host_map__certificate_id` (`certificate_id`),
52+
CONSTRAINT `fk_direct_download_certificate_host_map__host_id` FOREIGN KEY (`host_id`) REFERENCES `host` (`id`) ON DELETE CASCADE,
53+
CONSTRAINT `fk_direct_download_certificate_host_map__certificate_id` FOREIGN KEY (`certificate_id`) REFERENCES `direct_download_certificate` (`id`) ON DELETE CASCADE
54+
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

‎engine/schema/src/com/cloud/host/dao/HostDao.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -107,4 +107,6 @@ public interface HostDao extends GenericDao<HostVO, Long>, StateDao<Status, Stat
107107
* Side note: this method is currently only used in XenServerGuru; therefore, it was designed to meet XenServer deployment scenarios requirements.
108108
*/
109109
HostVO findHostInZoneToExecuteCommand(long zoneId, HypervisorType hypervisorType);
110+
111+
List<HostVO> listAllHostsUpByZoneAndHypervisor(long zoneId, HypervisorType hypervisorType);
110112
}

‎engine/schema/src/com/cloud/host/dao/HostDaoImpl.java‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
import java.util.Map;
2727
import java.util.Objects;
2828
import java.util.TimeZone;
29+
import java.util.stream.Collectors;
2930

3031
import javax.annotation.PostConstruct;
3132
import javax.inject.Inject;
@@ -1192,6 +1193,15 @@ public HostVO findHostInZoneToExecuteCommand(long zoneId, HypervisorType hypervi
11921193
}
11931194
}
11941195

1196+
@Override
1197+
public List<HostVO> listAllHostsUpByZoneAndHypervisor(long zoneId, HypervisorType hypervisorType) {
1198+
return listByDataCenterIdAndHypervisorType(zoneId, hypervisorType)
1199+
.stream()
1200+
.filter(x -> x.getStatus().equals(Status.Up) &&
1201+
x.getType() == Host.Type.Routing)
1202+
.collect(Collectors.toList());
1203+
}
1204+
11951205
private ResultSet executeSqlGetResultsetForMethodFindHostInZoneToExecuteCommand(HypervisorType hypervisorType, long zoneId, TransactionLegacy tx, String sql) throws SQLException {
11961206
PreparedStatement pstmt = tx.prepareAutoCloseStatement(sql);
11971207
pstmt.setString(1, Objects.toString(hypervisorType));

‎engine/schema/src/org/apache/cloudstack/direct/download/DirectDownloadCertificateDao.java‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
// Licensed to the Apache Software Foundation (ASF) under one
2+
// or more contributor license agreements. See the NOTICE file
3+
// distributed with this work for additional information
4+
// regarding copyright ownership. The ASF licenses this file
5+
// to you under the Apache License, Version 2.0 (the
6+
// "License"); you may not use this file except in compliance
7+
// with the License. You may obtain a copy of the License at
8+
//
9+
// http://www.apache.org/licenses/LICENSE-2.0
10+
//
11+
// Unless required by applicable law or agreed to in writing,
12+
// software distributed under the License is distributed on an
13+
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
// KIND, either express or implied. See the License for the
15+
// specific language governing permissions and limitations
16+
// under the License.
17+
package org.apache.cloudstack.direct.download;
18+
19+
import com.cloud.hypervisor.Hypervisor;
20+
import com.cloud.utils.db.GenericDao;
21+
22+
import java.util.List;
23+
24+
public interface DirectDownloadCertificateDao extends GenericDao<DirectDownloadCertificateVO, Long> {
25+
DirectDownloadCertificateVO findByAlias(String alias);
26+
List<DirectDownloadCertificateVO> listByHypervisorType(Hypervisor.HypervisorType hypervisorType);
27+
List<DirectDownloadCertificateVO> listByZone(long zoneId);
28+
}

‎engine/schema/src/org/apache/cloudstack/direct/download/DirectDownloadCertificateDaoImpl.java‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
// Licensed to the Apache Software Foundation (ASF) under one
2+
// or more contributor license agreements. See the NOTICE file
3+
// distributed with this work for additional information
4+
// regarding copyright ownership. The ASF licenses this file
5+
// to you under the Apache License, Version 2.0 (the
6+
// "License"); you may not use this file except in compliance
7+
// with the License. You may obtain a copy of the License at
8+
//
9+
// http://www.apache.org/licenses/LICENSE-2.0
10+
//
11+
// Unless required by applicable law or agreed to in writing,
12+
// software distributed under the License is distributed on an
13+
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
// KIND, either express or implied. See the License for the
15+
// specific language governing permissions and limitations
16+
// under the License.
17+
package org.apache.cloudstack.direct.download;
18+
19+
import com.cloud.hypervisor.Hypervisor;
20+
import com.cloud.utils.db.GenericDaoBase;
21+
import com.cloud.utils.db.SearchBuilder;
22+
import com.cloud.utils.db.SearchCriteria;
23+
24+
import java.util.List;
25+
26+
public class DirectDownloadCertificateDaoImpl extends GenericDaoBase<DirectDownloadCertificateVO, Long> implements DirectDownloadCertificateDao {
27+
28+
private final SearchBuilder<DirectDownloadCertificateVO> certificateSearchBuilder;
29+
30+
public DirectDownloadCertificateDaoImpl() {
31+
certificateSearchBuilder = createSearchBuilder();
32+
certificateSearchBuilder.and("alias", certificateSearchBuilder.entity().getAlias(), SearchCriteria.Op.EQ);
33+
certificateSearchBuilder.and("hypervisor_type", certificateSearchBuilder.entity().getHypervisorType(), SearchCriteria.Op.EQ);
34+
certificateSearchBuilder.and("zone_id", certificateSearchBuilder.entity().getZoneId(), SearchCriteria.Op.EQ);
35+
certificateSearchBuilder.done();
36+
}
37+
38+
@Override
39+
public DirectDownloadCertificateVO findByAlias(String alias) {
40+
SearchCriteria<DirectDownloadCertificateVO> sc = certificateSearchBuilder.create();
41+
sc.setParameters("alias", alias);
42+
return findOneBy(sc);
43+
}
44+
45+
@Override
46+
public List<DirectDownloadCertificateVO> listByHypervisorType(Hypervisor.HypervisorType hypervisorType) {
47+
SearchCriteria<DirectDownloadCertificateVO> sc = certificateSearchBuilder.create();
48+
sc.setParameters("hypervisor_type", hypervisorType);
49+
return listBy(sc);
50+
}
51+
52+
@Override
53+
public List<DirectDownloadCertificateVO> listByZone(long zoneId) {
54+
SearchCriteria<DirectDownloadCertificateVO> sc = certificateSearchBuilder.create();
55+
sc.setParameters("zone_id", zoneId);
56+
return listBy(sc);
57+
}
58+
}

0 commit comments

Comments
 (0)