Skip to content

client: don't disable TLSv1, TLSv1.1 by default that breaks VMware env#3238

Merged
borisstoyanov merged 1 commit intoapache:4.11from
shapeblue:tls-vmware-issue-fix
Mar 27, 2019
Merged

client: don't disable TLSv1, TLSv1.1 by default that breaks VMware env#3238
borisstoyanov merged 1 commit intoapache:4.11from
shapeblue:tls-vmware-issue-fix

Conversation

@yadvr
Copy link
Member

@yadvr yadvr commented Mar 26, 2019

This fixes the issue that TLSv1 and TLSv1.1 are still used by CloudStack
management server to communicate with VMware vCenter server. With the
current defaults, the setup/deployment on VMware fails. Users/admins
can however setup the security file according to their env needs to
disable TLSv1 and TLSv1.1 for server sockets (8250/agent service for
example).

Types of changes

  • Breaking change (fix or feature that would cause existing functionality to change)
  • New feature (non-breaking change which adds functionality)
  • Bug fix (non-breaking change which fixes an issue)
  • Enhancement (improves an existing feature and functionality)
  • Cleanup (Code refactoring and cleanup, that may add test cases)

This fixes the issue that TLSv1 and TLSv1.1 are still used by CloudStack
management server to communicate with VMware vCenter server. With the
current defaults, the setup/deployment on VMware fails. Users/admins
can however setup the security file according to their env needs to
disable TLSv1 and TLSv1.1 for server sockets (8250/agent service for
example).

Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
@yadvr
Copy link
Member Author

yadvr commented Mar 26, 2019

Without this fix, by default the env deployment fails for older versions of VMware such as 5.5 and 6.0 (less than up3).
@blueorangutan package

@blueorangutan
Copy link

@rhtyd a Jenkins job has been kicked to build packages. I'll keep you posted as I make progress.

Copy link
Contributor

@borisstoyanov borisstoyanov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, let's trigger vmware tests on this one

@blueorangutan
Copy link

Packaging result: ✔centos6 ✔centos7 ✔debian. JID-2648

@yadvr
Copy link
Member Author

yadvr commented Mar 26, 2019

@blueorangutan test centos7 vmware-55u3

@blueorangutan
Copy link

@rhtyd a Trillian-Jenkins test job (centos7 mgmt + vmware-55u3) has been kicked to run smoke tests

@blueorangutan
Copy link

Trillian test result (tid-3446)
Environment: vmware-55u3 (x2), Advanced Networking with Mgmt server 7
Total time taken: 34232 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr3238-t3446-vmware-55u3.zip
Intermittent failure detected: /marvin/tests/smoke/test_deploy_vm_root_resize.py
Smoke tests completed. 68 look OK, 0 have error(s)
Only failed tests results shown below:

Test Result Time (s) Test File

Copy link
Contributor

@DaanHoogland DaanHoogland left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, block dev. let's think of additional procedure for production sites

@borisstoyanov borisstoyanov merged commit c4b06ff into apache:4.11 Mar 27, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants