mlsorensen opened a new pull request, #6864:
URL: https://github.com/apache/cloudstack/pull/6864

   ### Description
   
   There are some networking setups where system VM communications are proxied 
off of the hypervisor host on which the system VM is running. For example, if 
the KVM management network is a NAT bridge, or the network plugin employs user 
mode network for system VM management interfaces, then system VM agent comms 
look as though they come form the hypervisor host. Admittedly, these 
configurations are bespoke, which is why a configuration is provided and it's 
disabled by default.
   
   In such a setup, the certificate authentication for agents fails because the 
source IP is that of the host of the system VM, rather than the system VM 
itself, and this IP is not in the connecting certificate presented. This PR 
adds a configuration value that allows the system VM cert to contain the host 
IP that the system VM is scheduled on. This allows such setups to maintain auth 
strictness on agent auth.
   ### Types of changes
   
   - [ ] Breaking change (fix or feature that would cause existing 
functionality to change)
   - [ ] New feature (non-breaking change which adds functionality)
   - [ ] Bug fix (non-breaking change which fixes an issue)
   - [x] Enhancement (improves an existing feature and functionality)
   - [ ] Cleanup (Code refactoring and cleanup, that may add test cases)
   
   ### Feature/Enhancement Scale or Bug Severity
   
   #### Feature/Enhancement Scale
   
   - [ ] Major
   - [x] Minor
   
   #### Bug Severity
   
   - [ ] BLOCKER
   - [ ] Critical
   - [ ] Major
   - [ ] Minor
   - [x] Trivial
   
   
   ### How Has This Been Tested?
   Tested this via unit tests, and in our private integration environment. When 
ca.framework.cert.systemvm.allow.host.ip is set, agent auth succeeds from 
system VMs, when unset, it fails as it did prior to this change.
   
   <!-- Please read the 
[CONTRIBUTING](https://github.com/apache/cloudstack/blob/main/CONTRIBUTING.md) 
document -->
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to