security: increase keystore setup/import timeout#3076
Conversation
This increases and uses a default 15mins timeout for VR scripts and for KVM agent increases timeout from 60s to 5mins. The timeout can specifically occur when keystore does not get enough entropy from CPU and script gets killed due to timeout. This is a very specific corner case and generally should not happen on baremetal/prod environment, but sometimes seen in nested/test environments. Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
yadvr
requested review from
GabrielBrascher,
PaulAngus,
nvazquez,
rafaelweingartner and
wido
|
@blueorangutan package |
|
@rhtyd a Jenkins job has been kicked to build packages. I'll keep you posted as I make progress. |
wido
left a comment
wido
left a comment
There was a problem hiding this comment.
I observed this as well during testing.
Changes LGTM
|
Packaging result: ✔centos6 ✔centos7 ✔debian. JID-2480 |
|
@blueorangutan test |
|
@rhtyd a Trillian-Jenkins test job (centos7 mgmt + kvm-centos7) has been kicked to run smoke tests |
nvazquez
left a comment
nvazquez
left a comment
There was a problem hiding this comment.
LGTM. Just minor suggestion/question, could these be configurable?
|
Trillian test result (tid-3244)
|
|
@nvazquez yes they can be made configurable, however it may make it slightly complex on how we propagate the settings in case of KVM agent and in case of systemvm (cpvm/ssvm). I've used a very high number to be on safe side, generally they should complete within 60s. |
This increases and uses a default 15mins timeout for VR scripts and for KVM agent increases timeout from 60s to 5mins. The timeout can specifically occur when keystore does not get enough entropy from CPU and script gets killed due to timeout. This is a very specific corner case and generally should not happen on baremetal/prod environment, but sometimes seen in nested/test environments. Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com> (cherry picked from commit 89c567a) Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
4 participants
This increases and uses a default 15mins timeout for VR scripts and for
KVM agent increases timeout from 60s to 5mins. The timeout can
specifically occur when keystore does not get enough entropy from CPU
and script gets killed due to timeout. This is a very specific corner
case and generally should not happen on baremetal/prod environment, but
sometimes seen in nested/test environments.
/cc @PaulAngus @dagsonstebo
Types of changes