APPLE-537: (CW 1660) Allow KVM host addition using sudoer user
This allows admins to add a KVM host using a sudoer user. This also
fails early when there is an issue with securing a KVM host on addition
than supress the information in logs.
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
diff --git a/agent/src/com/cloud/agent/Agent.java b/agent/src/com/cloud/agent/Agent.java
index 4cdc499..4634b60 100755
--- a/agent/src/com/cloud/agent/Agent.java
+++ b/agent/src/com/cloud/agent/Agent.java
@@ -616,7 +616,7 @@
_shell.setPersistentProperty(null, KeyStoreUtils.passphrasePropertyName, storedPassword);
}
- Script script = new Script(_keystoreSetupPath, 60000, s_logger);
+ Script script = new Script(true, _keystoreSetupPath, 60000, s_logger);
script.add(agentFile.getAbsolutePath());
script.add(keyStoreFile);
script.add(storedPassword);
@@ -660,7 +660,7 @@
throw new CloudRuntimeException("Unable to save received agent client and ca certificates", e);
}
- Script script = new Script(_keystoreCertImportPath, 60000, s_logger);
+ Script script = new Script(true, _keystoreCertImportPath, 60000, s_logger);
script.add(agentFile.getAbsolutePath());
script.add(keyStoreFile);
script.add(KeyStoreUtils.agentMode);
diff --git a/server/src/com/cloud/hypervisor/kvm/discoverer/LibvirtServerDiscoverer.java b/server/src/com/cloud/hypervisor/kvm/discoverer/LibvirtServerDiscoverer.java
index 79b4f38..db12708 100644
--- a/server/src/com/cloud/hypervisor/kvm/discoverer/LibvirtServerDiscoverer.java
+++ b/server/src/com/cloud/hypervisor/kvm/discoverer/LibvirtServerDiscoverer.java
@@ -61,6 +61,7 @@
import com.cloud.resource.UnableDeleteHostException;
import com.cloud.utils.PasswordGenerator;
import com.cloud.utils.StringUtils;
+import com.cloud.utils.exception.CloudRuntimeException;
import com.cloud.utils.ssh.SSHCmdHelper;
import com.trilead.ssh2.Connection;
@@ -132,8 +133,7 @@
}
if (sshConnection == null) {
- s_logger.warn("Cannot secure agent communication because ssh connection is invalid for host ip=" + agentIp);
- return;
+ throw new CloudRuntimeException("Cannot secure agent communication because ssh connection is invalid for host ip=" + agentIp);
}
Integer validityPeriod = CAManager.CertValidityPeriod.value();
@@ -142,7 +142,7 @@
}
final SSHCmdHelper.SSHCmdResult keystoreSetupResult = SSHCmdHelper.sshExecuteCmdWithResult(sshConnection,
- String.format("/usr/share/cloudstack-common/scripts/util/%s " +
+ String.format("sudo /usr/share/cloudstack-common/scripts/util/%s " +
"/etc/cloudstack/agent/agent.properties " +
"/etc/cloudstack/agent/%s " +
"%s %d " +
@@ -154,19 +154,17 @@
KeyStoreUtils.defaultCsrFile));
if (!keystoreSetupResult.isSuccess()) {
- s_logger.error("Failing, the keystore setup script failed execution on the KVM host: " + agentIp);
- return;
+ throw new CloudRuntimeException("Failed to setup keystore on the KVM host: " + agentIp);
}
final Certificate certificate = caManager.issueCertificate(keystoreSetupResult.getStdOut(), Collections.singletonList(agentHostname), Collections.singletonList(agentIp), null, null);
if (certificate == null || certificate.getClientCertificate() == null) {
- s_logger.error("Failing, the configured CA plugin failed to issue certificates for KVM host agent: " + agentIp);
- return;
+ throw new CloudRuntimeException("Failed to issue certificates for KVM host agent: " + agentIp);
}
final SetupCertificateCommand certificateCommand = new SetupCertificateCommand(certificate);
final SSHCmdHelper.SSHCmdResult setupCertResult = SSHCmdHelper.sshExecuteCmdWithResult(sshConnection,
- String.format("/usr/share/cloudstack-common/scripts/util/%s " +
+ String.format("sudo /usr/share/cloudstack-common/scripts/util/%s " +
"/etc/cloudstack/agent/agent.properties " +
"/etc/cloudstack/agent/%s %s " +
"/etc/cloudstack/agent/%s \"%s\" " +
@@ -183,8 +181,7 @@
certificateCommand.getEncodedPrivateKey()));
if (setupCertResult != null && !setupCertResult.isSuccess()) {
- s_logger.error("Failed to setup certificate in the KVM agent's keystore file, please configure manually!");
- return;
+ throw new CloudRuntimeException("Failed to setup certificate in the KVM agent's keystore file, please see logs and configure manually!");
}
if (s_logger.isDebugEnabled()) {
