- Kimchi-devel - oVirt List Archives

Re: [Kimchi-devel] [PATCH V2][Wok 02/12] FVT: Wok level config file to have 'sectionsi required for fvt common across plugins.
by Aline Manera 19 Jul '16

19 Jul '16

On 05/30/2016 04:10 AM, archus(a)linux.vnet.ibm.com wrote: > From: Archana Singh <archus(a)linux.vnet.ibm.com> > > Wok level config file to have 'sections' required for functional verification > test common across plugins. > > Signed-off-by: Archana Singh <archus(a)linux.vnet.ibm.com> > --- > tests/fvt/config | 7 +++++++ > 1 file changed, 7 insertions(+) > create mode 100644 tests/fvt/config > > diff --git a/tests/fvt/config b/tests/fvt/config > new file mode 100644 > index 0000000..13acc0b > --- /dev/null > +++ b/tests/fvt/config > @@ -0,0 +1,7 @@ > +[Session] > +user : > +passwd : It is not good to have passwd in a text configuration file. Any other possibility on that? > +host : localhost > +port : 8001 > +logfile : wok-api-test-suite.log > +loglevel : DEBUG It is good to list the valid values. So user can proper change the configuration for his/her needs.

1 0

Re: [Kimchi-devel] [PATCH V2][Wok 01/12] FVT: Package for functional verification testcases.
by Aline Manera 19 Jul '16

19 Jul '16

Reviewed-by: Aline Manera <alinefm(a)linux.vnet.ibm.com> On 05/30/2016 04:10 AM, archus(a)linux.vnet.ibm.com wrote: > From: Archana Singh <archus(a)linux.vnet.ibm.com> > > init python file for fvt package. > > Signed-off-by: Archana Singh <archus(a)linux.vnet.ibm.com> > --- > tests/fvt/__init__.py | 18 ++++++++++++++++++ > 1 file changed, 18 insertions(+) > create mode 100644 tests/fvt/__init__.py > > diff --git a/tests/fvt/__init__.py b/tests/fvt/__init__.py > new file mode 100644 > index 0000000..9316f95 > --- /dev/null > +++ b/tests/fvt/__init__.py > @@ -0,0 +1,18 @@ > +# > +# Project Wok > +# > +# Copyright IBM Corp, 2016 > +# > +# This library is free software; you can redistribute it and/or > +# modify it under the terms of the GNU Lesser General Public > +# License as published by the Free Software Foundation; either > +# version 2.1 of the License, or (at your option) any later version. > +# > +# This library is distributed in the hope that it will be useful, > +# but WITHOUT ANY WARRANTY; without even the implied warranty of > +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU > +# Lesser General Public License for more details. > +# > +# You should have received a copy of the GNU Lesser General Public > +# License along with this library; if not, write to the Free Software > +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA

1 0

[RFC] Issue 976 - Make able Ginger's 'Virt User' profile users manage Kimchi guests.
by Paulo Ricardo Paz Vital 14 Jul '16

14 Jul '16

Current implementation of Kimchi enables only users with root access (sudo ALL) to create and manage virtual machines. Once the virtual machine is created, 'normal users' access to the guest created can be granted by changing the virtual machine permission configuration. There are two different use cases (one of them related in [1]) which 'normal' users or users with virtualization permission can be able to create and manage virtual machines. Since Ginger's User Management feature provides a schema to add users in one of fours different profiles (Regular, Regular (No shell), Virt User and Administrator) this RFC comes to propose a change in the implementation to make 'Virt User's (user added to system's kvm group) be able to: 1. create new virtual machines, based in already created templates (templates creation/edition continue only granted to admin users); and 2. use/edit guests which the user was added in guest's permission list. Any comments and suggestions are welcome. Best regards, -- Paulo Ricardo Paz Vital Linux Technology Center, IBM Systems http://www.ibm.com/linux/ltc/

2 1

[PATCH v3][Kimchi 0/6] Make Kimchi able to change guest's boot order
by Ramon Medeiros 13 Jul '16

13 Jul '16

Changes: v3: Update test on test_model to keep working v2: Do not manipulate xml on model Improve parameters checking at API.json Increase test cases Ramon Medeiros (6): Add function get_bootorder_node Create method to change bootorder of a guest Update documentation about bootorder on vm update Update REST API Add function to retrieve bootorder on vm lookup Add test to check bootorder API.json | 23 +++++++++++++++++++++++ docs/API.md | 1 + i18n.py | 1 + model/vms.py | 32 ++++++++++++++++++++++++++++++-- tests/test_model.py | 15 ++++++++++++++- xmlutils/bootorder.py | 19 +++++++++++++------ 6 files changed, 82 insertions(+), 9 deletions(-) -- 2.5.5

1 7

[PATCH V2] [Wok 0/2] Use system's nginx proxy service.
by pvital＠linux.vnet.ibm.com 13 Jul '16

13 Jul '16

From: Paulo Vital <pvital(a)linux.vnet.ibm.com> This patch-set works on Fedora 23, Ubuntu 16.04, Debian 8.5 and OpenSUSE 42.1 Due to issues with semanage in Fedora 24, it's not able to allow port 8001 in SELinux. A bug was opened against Fedora community to investigate this: https://bugzilla.redhat.com/show_bug.cgi?id=1355811 V2: - fixed PEP8 errors V1: This patch removes the code that executes a dedicated nginx proxy, making Wok to use the system's nginx service. This is a requirement to make Wok acceptable in community repositories. It also make sure that a Wok executed from path different than installed (from a cloned and builded source code, for example) will create a symbolic link in system's nginx config dir to the running configuration file. This patch solves part of issue #25 Paulo Vital (2): Use system's nginx proxy service. Update troubleshooting documentation docs/troubleshooting.md | 3 +- src/nginx/wok.conf.in | 95 ++++++++++++++++++++----------------------------- src/wok/config.py.in | 6 +++- src/wok/i18n.py | 2 ++ src/wok/proxy.py | 28 ++++++++------- src/wok/server.py | 6 +--- 6 files changed, 65 insertions(+), 75 deletions(-) -- 2.7.4

1 2

[PATCH v2][Kimchi 0/6] Make Kimchi able to change guest's boot order
by Ramon Medeiros 13 Jul '16

13 Jul '16

Changes: v2: Do not manipulate xml on model Improve parameters checking at API.json Increase test cases Ramon Medeiros (6): Add function get_bootorder_node Create method to change bootorder of a guest Update documentation about bootorder on vm update Update REST API Add function to retrieve bootorder on vm lookup Add test to check bootorder API.json | 23 +++++++++++++++++++++++ docs/API.md | 1 + i18n.py | 1 + model/vms.py | 32 ++++++++++++++++++++++++++++++-- tests/test_model.py | 13 +++++++++++++ xmlutils/bootorder.py | 19 +++++++++++++------ 6 files changed, 81 insertions(+), 8 deletions(-) -- 2.5.5

2 7

[PATCH] [Wok] Use system's nginx proxy service.
by pvital＠linux.vnet.ibm.com 11 Jul '16

11 Jul '16

From: Paulo Vital <pvital(a)linux.vnet.ibm.com> This patch removes the code that executes a dedicated nginx proxy, making Wok to use the system's nginx service. This is a requirement to make Wok acceptable in community repositories. It also make sure that a Wok executed from path different than installed (from a cloned and built source code, for example) will create a symbolic link in system's nginx config dir to the running configuration file. This patch solves part of issue #25 Signed-off-by: Paulo Vital <pvital(a)linux.vnet.ibm.com> --- src/nginx/wok.conf.in | 95 +++++++++++++++++++++------------------------------ src/wok/config.py.in | 6 +++- src/wok/i18n.py | 2 ++ src/wok/proxy.py | 27 +++++++++------ src/wok/server.py | 6 +--- 5 files changed, 63 insertions(+), 73 deletions(-) diff --git a/src/nginx/wok.conf.in b/src/nginx/wok.conf.in index cb05e4d..823d94d 100644 --- a/src/nginx/wok.conf.in +++ b/src/nginx/wok.conf.in @@ -22,71 +22,54 @@ # This is a template file to be used to generate a nginx # proxy config file at wokd script. -user ${user}; -worker_processes 1; +client_max_body_size ${max_body_size}k; -error_log /var/log/nginx/error.log; +# Timeout set to 10 minutes to avoid the 504 Gateway Timeout +# when Wok is processing a request. +proxy_connect_timeout 600; +proxy_send_timeout 600; +proxy_read_timeout 600; +send_timeout 600; -events { - worker_connections 1024; +map $http_upgrade $connection_upgrade { + default upgrade; + '' close; } -http { - log_format main '$remote_addr - $remote_user [$time_local] "$request" ' - '$status $body_bytes_sent "$http_referer" ' - '"$http_user_agent" "$http_x_forwarded_for"'; - - access_log /var/log/nginx/access.log main; - sendfile on; +upstream websocket { + server 127.0.0.1:${websockets_port}; +} - client_max_body_size ${max_body_size}k; +server { + listen ${host_addr}:${proxy_ssl_port} ssl; - # Timeout set to 10 minutes to avoid the 504 Gateway Timeout - # when Wok is processing a request. - proxy_connect_timeout 600; - proxy_send_timeout 600; - proxy_read_timeout 600; - send_timeout 600; + ssl_certificate ${cert_pem}; + ssl_certificate_key ${cert_key}; + ssl_protocols TLSv1.1 TLSv1.2; + ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA:@STRENGTH'; + ssl_prefer_server_ciphers on; + ssl_dhparam ${dhparams_pem}; + ssl_session_timeout ${session_timeout}m; - map $http_upgrade $connection_upgrade { - default upgrade; - '' close; - } + add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;"; + add_header X-Frame-Options DENY; + add_header X-Content-Type-Options nosniff; + add_header X-XSS-Protection "1; mode=block"; - upstream websocket { - server 127.0.0.1:${websockets_port}; + location / { + proxy_pass http://127.0.0.1:${cherrypy_port}; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_redirect http://127.0.0.1:${cherrypy_port}/ https://$host:${proxy_ssl_port}/; } - server { - listen ${host_addr}:${proxy_ssl_port} ssl; - - ssl_certificate ${cert_pem}; - ssl_certificate_key ${cert_key}; - ssl_protocols TLSv1.1 TLSv1.2; - ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA:@STRENGTH'; - ssl_prefer_server_ciphers on; - ssl_dhparam ${dhparams_pem}; - ssl_session_timeout ${session_timeout}m; - - add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;"; - add_header X-Frame-Options DENY; - add_header X-Content-Type-Options nosniff; - add_header X-XSS-Protection "1; mode=block"; - - location / { - proxy_pass http://127.0.0.1:${cherrypy_port}; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_redirect http://127.0.0.1:${cherrypy_port}/ https://$host:${proxy_ssl_port}/; - } - - location /websockify { - proxy_pass http://websocket; - proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection $connection_upgrade; - } + location /websockify { + proxy_pass http://websocket; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; } - ${http_config} } + +${http_config} diff --git a/src/wok/config.py.in b/src/wok/config.py.in index 1ca6f73..d0bca9b 100644 --- a/src/wok/config.py.in +++ b/src/wok/config.py.in @@ -76,9 +76,10 @@ class Paths(object): self.prefix = self.get_prefix() self.installed = (self.prefix == '@pkgdatadir@') self.ui_dir = self.add_prefix('ui') + self.sys_nginx_conf_dir = '@sysconfdir@/nginx/conf.d' if self.installed: - self.nginx_conf_dir = '@sysconfdir@/nginx/conf.d' + self.nginx_conf_dir = self.sys_nginx_conf_dir self.state_dir = '@localstatedir@/lib/wok' self.log_dir = '@localstatedir@/log/wok' self.conf_dir = '@sysconfdir@/wok' @@ -119,6 +120,9 @@ class Paths(object): def get_template_path(self, resource): return os.path.join(self.ui_dir, 'pages/%s.tmpl' % resource) + def is_wok_installed(self): + return self.installed + paths = Paths() diff --git a/src/wok/i18n.py b/src/wok/i18n.py index d6cb17c..33107ee 100644 --- a/src/wok/i18n.py +++ b/src/wok/i18n.py @@ -55,6 +55,8 @@ messages = { "WOKUTILS0004E": _("Invalid data value '%(value)s'"), "WOKUTILS0005E": _("Invalid data unit '%(unit)s'"), + "WOKPROXY0001E": _("Unable to (re)start system's nginx.service. Details: '%(error)s'"), + # These messages (ending with L) are for user log purposes "WOKCOL0001L": _("Request made on collection"), "WOKRES0001L": _("Request made on resource"), diff --git a/src/wok/proxy.py b/src/wok/proxy.py index a74e88a..ab959e1 100644 --- a/src/wok/proxy.py +++ b/src/wok/proxy.py @@ -31,6 +31,8 @@ from string import Template from wok import sslcert from wok.config import paths +from wok.exception import OperationFailed +from wok.utils import run_command HTTP_CONFIG = """ @@ -110,18 +112,21 @@ def _create_proxy_config(options): config_file.write(data) config_file.close() + # If not running from the installed path (from a cloned and builded source + # code), create a symbolic link in system's dir to prevent errors on read + # SSL certifications. + if not paths.is_wok_installed(): + dst = os.path.join(paths.sys_nginx_conf_dir, "wok.conf") + if os.path.isfile(dst): + os.remove(dst) + os.symlink(os.path.join(nginx_config_dir, "wok.conf"), dst) + def start_proxy(options): """Start nginx reverse proxy.""" _create_proxy_config(options) - nginx_config_dir = paths.nginx_conf_dir - config_file = "%s/wok.conf" % nginx_config_dir - cmd = ['nginx', '-c', config_file] - subprocess.call(cmd) - - -def terminate_proxy(): - """Stop nginx process.""" - config_file = "%s/wok.conf" % paths.nginx_conf_dir - term_proxy_cmd = ['nginx', '-s', 'stop', '-c', config_file] - subprocess.call(term_proxy_cmd) + # Restart system's nginx service to reload wok configuration + cmd = ['systemctl', 'restart', 'nginx.service'] + output, error, retcode = run_command(cmd, silent=True) + if retcode != 0: + raise OperationFailed('WOKPROXY0001E', {'error': error}) diff --git a/src/wok/server.py b/src/wok/server.py index 8a02596..b1185e3 100644 --- a/src/wok/server.py +++ b/src/wok/server.py @@ -33,7 +33,7 @@ from wok.config import config as configParser from wok.config import paths, PluginConfig, WokConfig from wok.control import sub_nodes from wok.model import model -from wok.proxy import start_proxy, terminate_proxy +from wok.proxy import start_proxy from wok.reqlogger import RequestLogger from wok.root import WokRoot from wok.safewatchedfilehandler import SafeWatchedFileHandler @@ -180,10 +180,6 @@ class Server(object): self.app = cherrypy.tree.mount(WokRoot(model_instance, dev_env), config=self.configObj) self._load_plugins(options) - - # Terminate proxy when cherrypy server is terminated - cherrypy.engine.subscribe('exit', terminate_proxy) - cherrypy.lib.sessions.init() def _load_plugins(self, options): -- 2.7.4

4 5

[PATCH v2] [Kimchi 0/9] Virt-Viewer launcher backend
by dhbarboza82＠gmail.com 08 Jul '16

08 Jul '16

From: Daniel Henrique Barboza <danielhb(a)linux.vnet.ibm.com> v2: - fixed typo and capital letters in i18n.py - fixed 'double dict' error in virtviewer module - added tests with virtual machine containing utf-8 characters This patch set adds the Virt-Viewer launcher backend to Kimchi. This feature consists of a new resource located in: **URI:** /plugins/kimchi/vms/*:name*/snapshots/current that retrieves a download link to a .vv file to be used by a Virt-Viewer compatible desktop app to connect to the remote virtual machine. This backend takes cares of handling firewall rules to allow the connection to be succesfull. Note that no firewall port will be opened unless a download is made - if the user decides to use noVNC or spice-html5 instead Kimchi will not touch the host firewall. Example: [danielhb@arthas kimchi]$ curl -u root -H "Content-Type: application/json" -H "Accept: application/json" -X GET "http://localhost:8010/plugins/kimchi/vms/OpenSUSE-Leap-42.1/virtviewerfile" Enter host password for user 'root': [virt-viewer] type=vnc host=localhost port=5904 After this call, port 5904 was opened in the host to allow for a virt-viewer connection. When shutting down the virtual machine or WoK, a cleanup is made to close any ports left opened. Daniel Henrique Barboza (9): Virt-Viewer launcher: docs and i18n changes Virt-Viewer launcher: Makefile and config changes Virt-Viewer launcher: control/vms.py and model/vms.py changes Virt-Viewer launcher: virtviewerfile module Virt-Viewer launcher: test changes Virt-Viewer launcher: adding FirewallManager class Virt-Viewer launcher: test changes for firewall manager Virt-Viewer launcher: libvirt events to control firewall Virt-Viewer launcher: changes after adding libvirt event listening Makefile.am | 2 + config.py.in | 10 ++- control/vms.py | 12 +++ docs/API.md | 6 ++ i18n.py | 2 + model/virtviewerfile.py | 234 ++++++++++++++++++++++++++++++++++++++++++++++++ model/vms.py | 9 +- tests/test_config.py.in | 6 ++ tests/test_model.py | 228 +++++++++++++++++++++++++++++++++++++++++++++- 9 files changed, 503 insertions(+), 6 deletions(-) create mode 100644 model/virtviewerfile.py -- 2.5.5

5 14

Plans for next releases (Wok 2.3 and Kimchi 2.3)
by Aline Manera 08 Jul '16

08 Jul '16

Hi all, Below are the links for the plans for the next release: Wok: https://github.com/kimchi-project/wok/milestone/5 Kimchi: https://github.com/kimchi-project/kimchi/milestone/22 Feel free to take any unassigned task but make sure to add a comment you are work on it so I can proper assign it to you later. Also, more and more ideas and suggestions are welcome. You can send it directly to the ML or open an issue on github. Regards, Aline Manera

1 0

[PATCH] [Kimchi 0/9] Virt-Viewer launcher backend
by dhbarboza82＠gmail.com 08 Jul '16

08 Jul '16

From: Daniel Henrique Barboza <danielhb(a)linux.vnet.ibm.com> This patch set adds the Virt-Viewer launcher backend to Kimchi. This feature consists of a new resource located in: **URI:** /plugins/kimchi/vms/*:name*/snapshots/current that retrieves a download link to a .vv file to be used by a Virt-Viewer compatible desktop app to connect to the remote virtual machine. This backend takes cares of handling firewall rules to allow the connection to be succesfull. Note that no firewall port will be opened unless a download is made - if the user decides to use noVNC or spice-html5 instead Kimchi will not touch the host firewall. Example: [danielhb@arthas kimchi]$ curl -u root -H "Content-Type: application/json" -H "Accept: application/json" -X GET "http://localhost:8010/plugins/kimchi/vms/OpenSUSE-Leap-42.1/virtviewerfile" Enter host password for user 'root': [virt-viewer] type=vnc host=localhost port=5904 After this call, port 5904 was opened in the host to allow for a virt-viewer connection. When shutting down the virtual machine or WoK, a cleanup is made to close any ports left opened. Daniel Henrique Barboza (9): Virt-Viewer launcher: docs and i18n changes Virt-Viewer launcher: Makefile and config changes Virt-Viewer launcher: control/vms.py and model/vms.py changes Virt-Viewer launcher: virtviewerfile module Virt-Viewer launcher: test changes Virt-Viewer launcher: adding FirewallManager class Virt-Viewer launcher: test changes for firewall manager Virt-Viewer launcher: libvirt events to control firewall Virt-Viewer launcher: changes after adding libvirt event listening Makefile.am | 2 + config.py.in | 10 ++- control/vms.py | 12 +++ docs/API.md | 6 ++ i18n.py | 2 + model/virtviewerfile.py | 234 ++++++++++++++++++++++++++++++++++++++++++++++++ model/vms.py | 9 +- tests/test_config.py.in | 6 ++ tests/test_model.py | 219 +++++++++++++++++++++++++++++++++++++++++++- 9 files changed, 494 insertions(+), 6 deletions(-) create mode 100644 model/virtviewerfile.py -- 2.5.5

3 19