Copilot commented on code in PR #13884:
URL: https://github.com/apache/cloudstack/pull/13884#discussion_r3957179710
##########
engine/api/src/main/java/org/apache/cloudstack/engine/orchestration/service/NetworkOrchestrationService.java:
##########
@@ -138,6 +138,23 @@ public interface NetworkOrchestrationService {
ConfigKey<Integer> VmNetworkThrottlingRate = new
ConfigKey<Integer>("Network", Integer.class, "vm.network.throttling.rate",
"200",
"Default data transfer rate in megabits per second allowed in User
vm's default network.", true, ConfigKey.Scope.Zone);
+ ConfigKey<String> NetworkLBHaproxyStatsVisbility = new
ConfigKey<>("Network", String.class,
+ "network.loadbalancer.haproxy.stats.visibility", "global",
+ "Load Balancer(haproxy) stats visibility, the value can be one of
the following six parameters :
global,guest-network,link-local,disabled,all,default",
+ true, ConfigKey.Kind.Select,
"global,guest-network,link-local,disabled,all,default");
+
+ ConfigKey<String> NetworkLBHaproxyStatsUri = new ConfigKey<>("Network",
String.class,
+ "network.loadbalancer.haproxy.stats.uri", "/admin?stats",
+ "Load Balancer(haproxy) uri.", true);
+
+ ConfigKey<String> NetworkLBHaproxyStatsAuth = new ConfigKey<>("Secure",
String.class,
+ "network.loadbalancer.haproxy.stats.auth", "admin1:AdMiN123",
+ "Load Balancer(haproxy) authentication string in the format
username:password", true);
Review Comment:
The default value hard-codes credentials (\"admin1:AdMiN123\") for HAProxy
stats auth. This is an insecure default and risks exposing a known
username/password in deployments that don’t override it. Set the default to
null/empty and require explicit configuration (or generate a random secret at
first startup) while keeping the key marked as Secure.
##########
engine/storage/snapshot/src/main/java/org/apache/cloudstack/storage/snapshot/SnapshotServiceImpl.java:
##########
@@ -188,12 +188,8 @@ public RevertSnapshotContext(AsyncCompletionCallback<T>
callback, SnapshotInfo s
private String generateCopyUrlBase(String hostname, String dir) {
String scheme = "http";
- boolean _sslCopy = false;
- String sslCfg =
_configDao.getValue(Config.SecStorageEncryptCopy.toString());
+ boolean _sslCopy =
SecondaryStorageVmManager.SecStorageEncryptCopy.value();
String _ssvmUrlDomain =
_configDao.getValue("secstorage.ssl.cert.domain");
Review Comment:
This method partially migrated to typed config
(`SecStorageEncryptCopy.value()`) but still reads the SSL cert domain via a raw
string key. Since this PR is standardizing config handling, prefer
`SecondaryStorageVmManager.SecStorageSecureCopyCert.value()` (as done
elsewhere) to keep configuration access consistent and centralized.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
