)]}' { "log": [ { "commit": "1abb53924280df2ff70fd17f2f0ffe2e4183dde8", "tree": "5fdca997c64f7e2a053f48a2e17476ae5311b9d5", "parents": [ "c76c01e21a1d98fbdcb5da051d7336838873eeb0" ], "author": { "name": "prrssshhhh", "email": "prashantbhanage717@gmail.com", "time": "Wed Oct 21 20:12:46 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 21 16:42:46 2026 +0200" }, "message": "fix: skip coverage grade comment on fork PRs (#14299)" }, { "commit": "c76c01e21a1d98fbdcb5da051d7336838873eeb0", "tree": "6fbfc20a13c710362029bd2ae834c681945d8ae3", "parents": [ "98ae513689d25df8fc9fbc4182f90142378b59aa" ], "author": { "name": "Wei Zhou", "email": "weizhou@apache.org", "time": "Tue Oct 20 18:17:36 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 20 19:17:36 2026 +0300" }, "message": "network: add default isolated offering with source NAT and egress allowed by default (#14286)\n\n* network: add default isolated offering with source NAT and egress allowed by default\n\nAdds a new default network offering,\nDefaultIsolatedNetworkOfferingWithSourceNatServiceEgressAllowed: an\nisolated offering with the SourceNat service whose default egress policy\nallows traffic, so VMs on it can reach outbound networks without an\nexplicit egress rule.\n\n- NetworkOffering: declare the offering\u0027s unique name constant.\n- NetworkOrchestrator: create the offering (Availability.Optional,\n egressDefaultPolicy\u003dtrue) on zones that do not have it yet.\n- ConfigurationServerImpl: create the offering, its service map, and set\n its state to Enabled with VM autoscaling and egress-default-policy\n support during first-time setup.\n- NetworkOfferingVO: rename the egressdefaultpolicy field to\n egressDefaultPolicy and add a setter so the policy can be set before\n the offering is persisted.\n\n* network: align upgraded default egress-allowed offering with fresh install (PR 14286)\n\nThe offering created at management server startup on upgraded setups used\nthe capability-map defaults, so it had no dedicated LB, no associate public\nIP and no VM autoscaling support, and a multicast rate of 10. Set the same\nvalues as the fresh-install path in ConfigurationServerImpl.\n\n* rename to setEipAssociatePublicIp (PR 14286)\n\n* network: rename default egress allowed offering constant and disable keep-alive (PR 14286)\n\nDrop \"Default\" from the constant name so that it matches the offering name,\nand create the offering on upgraded setups with keep-alive disabled, like\nthe other default offerings and the API default.\n\n* network: address review comments on the egress allowed offering (PR 14286)\n\nRename the NetworkOfferingVO constructor parameter egressdefaultpolicy to\negressDefaultPolicy to match the field, and log the service instead of the\nwhole service map entry in the default offering trace messages." }, { "commit": "98ae513689d25df8fc9fbc4182f90142378b59aa", "tree": "4a12db8e30f5c2909c7187ddd925d5bdf6cfe0a4", "parents": [ "af9764b87a6901d4dce24c34573f5d76c0441cc4" ], "author": { "name": "Sathvika", "email": "sr73318@netapp.com", "time": "Tue Oct 20 19:14:52 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 20 15:44:52 2026 +0200" }, "message": " validates the inputs for capacity bytes in update storage pool to be positive (#14219)" }, { "commit": "af9764b87a6901d4dce24c34573f5d76c0441cc4", "tree": "dd7aa8e16dc1616075018b9558b7f500303b64cc", "parents": [ "2736abbeceb0b71c3489fbebe2139e56f15b4326" ], "author": { "name": "nvazquez", "email": "nicovazquez90@gmail.com", "time": "Mon Oct 19 19:11:32 2026 -0300" }, "committer": { "name": "nvazquez", "email": "nicovazquez90@gmail.com", "time": "Mon Oct 19 19:11:32 2026 -0300" }, "message": "Fix tests\n" }, { "commit": "2736abbeceb0b71c3489fbebe2139e56f15b4326", "tree": "f4e379f52beb21cb78607ee3efd57d3737dcc801", "parents": [ "60f88945d5ec7ad70aec387a155897dddd7c9c4a" ], "author": { "name": "nvazquez", "email": "nicovazquez90@gmail.com", "time": "Mon Oct 19 16:48:02 2026 -0300" }, "committer": { "name": "nvazquez", "email": "nicovazquez90@gmail.com", "time": "Mon Oct 19 16:49:31 2026 -0300" }, "message": "Fix build after merging 4.22\n" }, { "commit": "60f88945d5ec7ad70aec387a155897dddd7c9c4a", "tree": "8b2eea91ded5f3acea609ca8198d968e03acc3e5", "parents": [ "d3f0700e978390f65805a488a96ef9ca8e9e8070", "dfaae63a461b919ea8ee806ed1dec6acc4867ae7" ], "author": { "name": "nvazquez", "email": "nicovazquez90@gmail.com", "time": "Mon Oct 19 16:22:02 2026 -0300" }, "committer": { "name": "nvazquez", "email": "nicovazquez90@gmail.com", "time": "Mon Oct 19 16:22:02 2026 -0300" }, "message": "Merge branch \u00274.22\u0027\n" }, { "commit": "dfaae63a461b919ea8ee806ed1dec6acc4867ae7", "tree": "a59fd09bcf2a844665b341c2d352af76d90d2745", "parents": [ "99f348e0f94681a35a03fcb885af61d0c61305f2", "376c1b40174ab4b8d7f9aced5401143cbc09d587" ], "author": { "name": "nvazquez", "email": "nicovazquez90@gmail.com", "time": "Mon Oct 19 11:37:40 2026 -0300" }, "committer": { "name": "nvazquez", "email": "nicovazquez90@gmail.com", "time": "Mon Oct 19 11:37:40 2026 -0300" }, "message": "Merge branch \u00274.20\u0027 into 4.22\n" }, { "commit": "99f348e0f94681a35a03fcb885af61d0c61305f2", "tree": "48ed3a8feb277a6f706447bf8665c446a46f06ea", "parents": [ "768298a21116c27a38f98db797896a322cf832e7" ], "author": { "name": "Vishesh", "email": "8760112+vishesh92@users.noreply.github.com", "time": "Mon Oct 19 04:00:47 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Oct 18 19:30:47 2026 -0300" }, "message": "Batch network lookups per NIC in NetworkOrchestrator to eliminate N+1 queries during migration (#13354)\n\n* Batch network lookups per NIC in NetworkOrchestrator to eliminate N+1 queries during migration\n\nThree methods called _networksDao.findById(nic.getNetworkId()) per NIC in a loop:\nsetHypervisorHostname, prepareNicForMigration, prepareAllNicsForMigration.\nNow batch-loads all networks for a VM\u0027s NICs in a single WHERE id IN (...) query.\n\n- Add NetworkDao.listByIds(List\u003cLong\u003e) for batch ID lookup\n- Add getNetworkMapForNics helper returning Map\u003cLong, NetworkVO\u003e\n- Replace per-NIC findById with map lookup at 3 sites\n- Add null guard for deleted networks (pre-existing NPE risk on all 3 sites)\n- Site 2 (prepare) left unchanged — findById only on error path, not N+1\n\n* Address comments\n\n---------\n\nCo-authored-by: Aaron Chung \u003caaron_chung@apple.com\u003e" }, { "commit": "768298a21116c27a38f98db797896a322cf832e7", "tree": "71344605292f565662029d76eecf3ce4f4a6d014", "parents": [ "1e69e3a709c2e53ffeced64365453ecad6e08e3f" ], "author": { "name": "Vishesh", "email": "8760112+vishesh92@users.noreply.github.com", "time": "Mon Oct 19 04:00:06 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Oct 18 19:30:06 2026 -0300" }, "message": "Batch VM and host lookups in StorageManagerImpl to eliminate N+1 queries during cleanup and pool connect (#13353)\n\n* Batch VM and host lookups in StorageManagerImpl to eliminate N+1 queries during cleanup and pool connect\n\ncleanupStorage: replaced per-volume _vmInstanceDao.findById(vol.getInstanceId())\nwith a single batch SELECT ... WHERE id IN (...) before the loop, using a\nHashMap for O(1) lookups. Added null guard for volumes with null instanceId.\n\nconnectHostsToPool: replaced per-thread _hostDao.findById(hostId) with a\nbatch load before thread pool submission. Each thread now reads from a\npre-built HashMap instead of hitting the DB. Added null guard with warning\nlog for hosts removed between list assembly and batch read.\n\nAdded VMInstanceDao.listByIds(List\u003cLong\u003e) with empty-list guard and IN-clause\nSearchBuilder, matching the established pattern in HostDao.\n\n* Fix test failures\n\n* Address comments\n\n---------\n\nCo-authored-by: Aaron Chung \u003caaron_chung@apple.com\u003e" }, { "commit": "1e69e3a709c2e53ffeced64365453ecad6e08e3f", "tree": "6e597ffdcce04088324e4e0e712b77daf0f85aa2", "parents": [ "c7667d8c1fb8ceb4ef5ee687fd85cc84a545c275" ], "author": { "name": "Nicolas Vazquez", "email": "nicovazquez90@gmail.com", "time": "Sun Oct 18 19:29:05 2026 -0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Oct 18 19:29:05 2026 -0300" }, "message": "Allow removing VMs from instance groups (#14395)\n\n* Allow removing VMs from instance groups\n\n* Address review comments" }, { "commit": "c7667d8c1fb8ceb4ef5ee687fd85cc84a545c275", "tree": "2396f621a8d7536efdc205a88a564882274d65fe", "parents": [ "546569bf24d35ff75dcb694ba5192ebfdb829993" ], "author": { "name": "Daman Arora", "email": "61474540+Damans227@users.noreply.github.com", "time": "Fri Oct 16 02:24:07 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 16 08:24:07 2026 +0200" }, "message": "VR: fix passive ftp through the virtual router on newer system vm templates (#14330)\n\n* fix passive ftp through the virtual router on newer system vm templates\n\n* attach the ftp helper when a port forward sends another public port to port 21\n\n* only attach the ftp helper on static nat and port forwarded public ips" }, { "commit": "d3f0700e978390f65805a488a96ef9ca8e9e8070", "tree": "1b576f7f5fe9d20308896ad49cd232acf1527cde", "parents": [ "a945a7c203e95ce427b9e9954e971a3d3c9967b3" ], "author": { "name": "Andrija Panic", "email": "45762285+andrijapanicsb@users.noreply.github.com", "time": "Wed Oct 14 21:02:45 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 14 21:02:45 2026 +0200" }, "message": "Restore VMware-to-KVM migration changes from #13656 (#14256)\n\nVMware to KVM: cold (VDDK) and warm (CBT) migration into Ceph/RBD and Linstor, plus importVm adoption of existing RBD and Linstor volumes\n\nRestores #13656 (merged as 0a5bf30af3, reverted by 510d0ec378), with\nthe fixes found in review:\n\n- CBT: the per-disk checkpoint between delta cycles is now read from\n the cycle snapshot\u0027s disk backing, so each delta copies only the\n changes since the previous cycle (a5578d6f53)\n- CBT: failures of the final agent command or of recording the final\n cycle are handled through the normal cutover failure path\n (6fa7d30b47)\n- CBT: cancel and delete keep the target disks of an imported VM\n (fd1673629d)\n- importVm: load template details from the supplied template, so\n imports with the removed \"VM Import Default Template\" work again\n (port of #14195, 2a3598ad6a)\n- LINSTOR import: resource-group validation against the selected pool,\n and inspection and listing from controller metadata without\n connecting or disconnecting local DRBD resources (01058cd674);\n pagination offset/limit order (ce349d813e)\n\nFeature summary:\n- warm VMware-to-KVM migration with VDDK and Changed Block Tracking:\n persisted migration, cycle and disk records, preflight, delta cycles,\n operator cutover, cancel and cleanup; new admin APIs\n startVmwareCbtMigration, syncVmwareCbtMigration,\n cutoverVmwareCbtMigration, cancelVmwareCbtMigration,\n deleteVmwareCbtMigration, listVmwareCbtMigrations and\n checkVmwareCbtMigrationPrerequisites; UI under Tools\n- cold direct VDDK import straight into Ceph/RBD or Linstor (raw), with\n virt-v2v in-place finalization\n- adoption of existing RBD and Linstor ROOT (importVm\n importsource\u003dshared) and DATA (importVolume) volumes without copying\n- guest OS type, firmware (BIOS/UEFI, secure boot) and console defaults\n derived from the source VM configuration; static IPv4 preservation;\n Windows data disks brought online at first boot\n- database changes in the 4.23.0 to 24.0.0 upgrade path\n\nReviewed and tested: LGTM from rp- (LINSTOR maintainer) and\nalexandremattioli (tested warm CBT to QCOW2 and Ceph); Trillian smoke\ntests tid-17130 on 95fc5b5: 157 OK, 0 errors.\n\nSigned-off-by: Andrija Panic \u003candrija.panic@gmail.com\u003e" }, { "commit": "a945a7c203e95ce427b9e9954e971a3d3c9967b3", "tree": "c5d21fceefc09973f61fa47d2d01bb6c1b416860", "parents": [ "68cff975cebe11bbe47c85623a0dd356cea4b079" ], "author": { "name": "Daniel Augusto Veronezi Salvador", "email": "38945620+GutoVeronezi@users.noreply.github.com", "time": "Wed Oct 14 08:42:01 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 14 08:42:01 2026 +0100" }, "message": "Develocity integration (#14394)\n\n* Added basic Develocity integration\n\n* Added develocity access key setup to github actions (maven) workflows\n\n* Cleanup\n\n* Added licensing header to .mvn/extensions.xml\n\n* Added lincesing info and .gitignore for develocity integration\n\n* Point Develocity at develocity.apache.org\n\nSigned-off-by: Gasper Kojek \u003cgkojek@gradle.com\u003e\n\n* Bump Develocity Maven extensions and drop unused access key env\n\n- develocity-maven-extension 1.21.4 -\u003e 2.5.0\n- common-custom-user-data-maven-extension 2.0 -\u003e 2.4.0\n\nCCUD 2.4.0 targets develocity-maven-extension 2.5.0, and both are\ncompatible with the Develocity 2026.2.x server. Verified locally with\n`mvn -N validate`: both extensions load and the existing\n.mvn/develocity.xml is read and accepted unchanged.\n\nAlso drop DEVELOCITY_ACCESS_KEY from ui.yml and pre-commit.yml, which do\nnot run Maven.\n\nSigned-off-by: Gasper Kojek \u003cgkojek@gradle.com\u003e\n\n* Use the DEVELOCITY_ACCESS_KEY secret name\n\nSigned-off-by: Gasper Kojek \u003cgkojek@gradle.com\u003e\n\n* Update develocity-maven-extension version to 2.6.0\n\n* Scope DEVELOCITY_ACCESS_KEY to the Maven steps\n\nSigned-off-by: Gasper Kojek \u003cgkojek@gradle.com\u003e\n\n---------\n\nSigned-off-by: Gasper Kojek \u003cgkojek@gradle.com\u003e\nCo-authored-by: Gasper Kojek \u003cgkojek@gradle.com\u003e" }, { "commit": "546569bf24d35ff75dcb694ba5192ebfdb829993", "tree": "b36b4bca05ea5968685e8cca06c3a3f45b33c025", "parents": [ "dfff32edecfad2df9de8f3c9c606d436253c4128" ], "author": { "name": "Pearl Dsilva", "email": "pearl1594@gmail.com", "time": "Tue Oct 13 20:39:30 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 13 21:39:30 2026 -0300" }, "message": "Improve performance of listTemplates API (#13566)\n\n* Bypass logic to create template_pair from 6 tables, with fallback\n\n* added bypass logic to create template_pair from 6 tables, fallback for hard filters\n\n* Removed batching, checking against per pair\n\n* follow try-with-resources design\n\n* unit tests for the bypass logic\n\n* Fix cross-zone template lookup in listTemplates Phase 2\n\nWhen temp_zone_pair has dcId\u003d0 (cross-zone template with no\ndata_center), use IS NULL predicate instead of broken EQ/IN\nwith literal 0 which never matches NULL rows.\n\n* Add filter for non-root domain-admin users\n\n---------\n\nCo-authored-by: anishadas \u003cadas33@apple.com\u003e\nCo-authored-by: Aaron Chung \u003caaron_chung@apple.com\u003e\n\n* Add @Ignore, remove logs/comments (#824)\n\nCo-authored-by: anishadas \u003cadas33@apple.com\u003e\n(cherry picked from commit f6c9fd1081f0e1d9386db08e86485b482bf064ab)\n\n* Improve BypassTemplateView config description and rename helper method\n\n* remove logger\n\n* Fix issue with listing templates when filtered on name / keyword - count is correct, but lists all templates\n\n* listTemplates bypass: honor templatetype/isvnf/forcks, EXTERNAL ready format and view-consistent showunique paging\n\nAdd templateType, isVnf and forCks to TemplateListFilter and the bypass\nWHERE clause, treat EXTERNAL like BAREMETAL for onlyReady, and tie-break\nshowunique pages on CONCAT(vt.id, \u0027_\u0027) so page boundaries match the view\npath. Update stale domainPath fallback comments and add unit tests.\n\n* address comments\n\n* honor arch, osCategory, extension, imageStore and domain/isrecursive scoping; fall back for storagePoolId\n\n---------\n\nCo-authored-by: aniishadas \u003c32420385+aniishadas@users.noreply.github.com\u003e\nCo-authored-by: anishadas \u003cadas33@apple.com\u003e\nCo-authored-by: Aaron Chung \u003caaron_chung@apple.com\u003e\nCo-authored-by: mprokopchuk \u003cmprokopchuk@apple.com\u003e\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e" }, { "commit": "dfff32edecfad2df9de8f3c9c606d436253c4128", "tree": "1b76e493434349c82fe950789dc86bf970775bac", "parents": [ "088318594973ce2283a3f2171d6ce207899515fb" ], "author": { "name": "Pearl Dsilva", "email": "pearl1594@gmail.com", "time": "Mon Oct 12 12:48:56 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 12 13:48:56 2026 -0300" }, "message": "Netris: Improvements and fixes to the Netris plugin (#13591)\n\n* Netris CloudStack Integration Enhancements\n\n* Netris - Support NAT, PF for Secondary IP\n\n* Allow PF rules to be correctly created on secondary IP of a VM on netris\n\n* unique static nat names on netris by adding public IP - handle backward compatibility\n\n---------\n\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e\n\n* Netris - Support for L2 networks\n\n* Add support for L2 networks in Netris\n\n* remove the need to add connectivity to identify netris provider, remove changes to ui and create net offering\n\n* create vpc network and use it for l2 networks\n\n* dont fail if deletion on netris doesnt succeed\n\n* remove connectivity capability\n\n* update vpc name when l2 name is updated\n\n---------\n\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e\n\n* Netris - CKS support\n\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e\n\n* Netris - Enable Global Routing Flag for NATTED Dual-Stack VPCs\n\n* Set globalRouting \u003d true, when network offering is NATTED, dual-stack\n\n* update global routing based on routing mode and ip protocol type\n\n---------\n\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e\nCo-authored-by: nvazquez \u003cnicovazquez90@gmail.com\u003e\n\n* Netris - Fix allocate vnets with the correct account ID so that release succeeds on network deletion\n\n* Fix allocate vnets with the correct account ID so that release succeeds on network deletion\n\n* add fix for vpc tiers as well\n\n* move entire vnet cleanup logic to trash from shutdown, so that it works for all network types for netris\n\n* cleanup vnets when reservation id is null\n\n---------\n\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e\n\n* Netris - Add support to include VPN service for NATTED Netris offerings\n\n* Add support to include VPN service for NATTED Netris offerings\n\n* missing changes of global routing\n\n* Remove extra space\n\n---------\n\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e\nCo-authored-by: nvazquez \u003cnicovazquez90@gmail.com\u003e\n\n* Netris - Support Redundant Virtual Routers for Netris VPC networks\n\n* Add support for redundant routers for Netris VPC networks\n\n* address comment\n\n* default null network mode to natted for netris\n\n* preventing vpc and ipam creation if already exists\n\n---------\n\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e\n\n* Netris - Enable autoscaling groups for Netris network offerings\n\n* Enable autoscaling groups for Netris network offerings\n\n* Fix UI loading for services when network mode changes for external providers and show vm autoscaling always set to true / non-editable for netris when LB is selected i.e, natted mode\n\n* Revert removed comment\n\n---------\n\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e\nCo-authored-by: nvazquez \u003cnicovazquez90@gmail.com\u003e\n\n* merge conflict\n\n* systemvm: fix VPC VPN issue when network id is bigger than 1000 on Netris\n\n* show networks for vnf nic mappings\n\n---------\n\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e\nCo-authored-by: nvazquez \u003cnicovazquez90@gmail.com\u003e\nCo-authored-by: Wei Zhou \u003cweizhou@apache.org\u003e\n\n* Add a check to prevent re-adding existing ACLs\n\n* Netris - Support NAT, PF for Secondary IP\n\n* Allow PF rules to be correctly created on secondary IP of a VM on netris\n\n* unique static nat names on netris by adding public IP - handle backward compatibility\n\n---------\n\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e\n\n* Netris - Support for L2 networks\n\n* Add support for L2 networks in Netris\n\n* remove the need to add connectivity to identify netris provider, remove changes to ui and create net offering\n\n* create vpc network and use it for l2 networks\n\n* dont fail if deletion on netris doesnt succeed\n\n* remove connectivity capability\n\n* update vpc name when l2 name is updated\n\n---------\n\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e\n\n* Netris - CKS support\n\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e\n\n* Netris - Enable Global Routing Flag for NATTED Dual-Stack VPCs\n\n* Set globalRouting \u003d true, when network offering is NATTED, dual-stack\n\n* update global routing based on routing mode and ip protocol type\n\n---------\n\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e\nCo-authored-by: nvazquez \u003cnicovazquez90@gmail.com\u003e\n\n* Netris - Fix allocate vnets with the correct account ID so that release succeeds on network deletion\n\n* Fix allocate vnets with the correct account ID so that release succeeds on network deletion\n\n* add fix for vpc tiers as well\n\n* move entire vnet cleanup logic to trash from shutdown, so that it works for all network types for netris\n\n* cleanup vnets when reservation id is null\n\n---------\n\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e\n\n* Netris - Add support to include VPN service for NATTED Netris offerings\n\n* Add support to include VPN service for NATTED Netris offerings\n\n* missing changes of global routing\n\n* Remove extra space\n\n---------\n\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e\nCo-authored-by: nvazquez \u003cnicovazquez90@gmail.com\u003e\n\n* Netris - Support Redundant Virtual Routers for Netris VPC networks\n\n* Add support for redundant routers for Netris VPC networks\n\n* address comment\n\n* default null network mode to natted for netris\n\n* preventing vpc and ipam creation if already exists\n\n---------\n\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e\n\n* Netris - Enable autoscaling groups for Netris network offerings\n\n* Enable autoscaling groups for Netris network offerings\n\n* Fix UI loading for services when network mode changes for external providers and show vm autoscaling always set to true / non-editable for netris when LB is selected i.e, natted mode\n\n* Revert removed comment\n\n---------\n\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e\nCo-authored-by: nvazquez \u003cnicovazquez90@gmail.com\u003e\n\n* merge conflict\n\n* systemvm: fix VPC VPN issue when network id is bigger than 1000 on Netris\n\n* show networks for vnf nic mappings\n\n* Add a check to prevent re-adding existing ACLs\n\n* Add a check to prevent re-adding existing ACLs\n\n* change message compare statement\n\n---------\n\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e\nCo-authored-by: nvazquez \u003cnicovazquez90@gmail.com\u003e\nCo-authored-by: Wei Zhou \u003cweizhou@apache.org\u003e\n\n* Add check for vnet name length and cleanup vpc and vnet resources on failure of creation of allocation\n\n* Netris - Support NAT, PF for Secondary IP\n\n* Allow PF rules to be correctly created on secondary IP of a VM on netris\n\n* unique static nat names on netris by adding public IP - handle backward compatibility\n\n---------\n\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e\n\n* Netris - Support for L2 networks\n\n* Add support for L2 networks in Netris\n\n* remove the need to add connectivity to identify netris provider, remove changes to ui and create net offering\n\n* create vpc network and use it for l2 networks\n\n* dont fail if deletion on netris doesnt succeed\n\n* remove connectivity capability\n\n* update vpc name when l2 name is updated\n\n---------\n\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e\n\n* Netris - CKS support\n\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e\n\n* Netris - Enable Global Routing Flag for NATTED Dual-Stack VPCs\n\n* Set globalRouting \u003d true, when network offering is NATTED, dual-stack\n\n* update global routing based on routing mode and ip protocol type\n\n---------\n\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e\nCo-authored-by: nvazquez \u003cnicovazquez90@gmail.com\u003e\n\n* Netris - Fix allocate vnets with the correct account ID so that release succeeds on network deletion\n\n* Fix allocate vnets with the correct account ID so that release succeeds on network deletion\n\n* add fix for vpc tiers as well\n\n* move entire vnet cleanup logic to trash from shutdown, so that it works for all network types for netris\n\n* cleanup vnets when reservation id is null\n\n---------\n\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e\n\n* Netris - Add support to include VPN service for NATTED Netris offerings\n\n* Add support to include VPN service for NATTED Netris offerings\n\n* missing changes of global routing\n\n* Remove extra space\n\n---------\n\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e\nCo-authored-by: nvazquez \u003cnicovazquez90@gmail.com\u003e\n\n* Netris - Support Redundant Virtual Routers for Netris VPC networks\n\n* Add support for redundant routers for Netris VPC networks\n\n* address comment\n\n* default null network mode to natted for netris\n\n* preventing vpc and ipam creation if already exists\n\n---------\n\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e\n\n* Netris - Enable autoscaling groups for Netris network offerings\n\n* Enable autoscaling groups for Netris network offerings\n\n* Fix UI loading for services when network mode changes for external providers and show vm autoscaling always set to true / non-editable for netris when LB is selected i.e, natted mode\n\n* Revert removed comment\n\n---------\n\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e\nCo-authored-by: nvazquez \u003cnicovazquez90@gmail.com\u003e\n\n* merge conflict\n\n* systemvm: fix VPC VPN issue when network id is bigger than 1000 on Netris\n\n* show networks for vnf nic mappings\n\n* Add a check to prevent re-adding existing ACLs\n\n* Add a check to prevent re-adding existing ACLs\n\n* change message compare statement\n\n* Add check for vnet name length and cleanup vpc and vnet resources on failure of creation of allocation\n\n* add name length validation to update path\n\n---------\n\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e\nCo-authored-by: nvazquez \u003cnicovazquez90@gmail.com\u003e\nCo-authored-by: Wei Zhou \u003cweizhou@apache.org\u003e\n\n* Add support to the VPC response to display if redundant routers are supported\n\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e\n\n* Hide VPN sections and prevent enabling it when service isn\u0027t enabled in the vpc offering\n\n* Hide VPN sections and prevent enabling it when service isn\u0027t enabled in the vpc offering\n\n* update\n\n---------\n\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e\n\n* Fix issue with adding external node to a CKS cluster with Netris offering\n\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e\n\n* Update upgrade path to reclaim vnets of deleted netris networks, improve log and hide add upstream route for Netris routed networks\n\n* Update upgrade path to reclaim vnets of deleted netris networks, improve log and hide add upstream route for Netris routed networks\n\n* Apply suggestions from code review\n\n* hide upstream route banner for netris networks altogether\n\n* fix migration of netris VRs and fix reclaim vnet query\n\n---------\n\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e\nCo-authored-by: Nicolas Vazquez \u003cnicovazquez90@gmail.com\u003e\n\n* Allocate IP from Netris (Provider) range when IP is not specified during associate\n\n* Allocate IP from Netris (Provider) range when IP is not specified during associate\n\n* update javadoc and method name\n\n---------\n\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e\n\n* Fix VRRP gateway IP conflict on redundant VPC routers with external network providers (Netris/NSX)\n\nCo-authored-by: Pearl Dsilva \u003cpearl1594@gmail.com\u003e\n\n* VPN: Reconfigure static nat and static route on fail over to backup VR - for redundant VPC VRs\n\n* VPN: Reconfigure static nat and static route on fail over to backup VR - for redundant VPC VRs\n\n* address comment\n\n* add stacktrace to the log\n\n---------\n\n* Fix issue with deletion of vpn connection for DualStack redundant VPCs\n\n* fix precommit ci issue\n\n* Add Netris to the range limit check (#129)\n\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e\n\n* Netris: address review comments on static NAT, L2 and offering form\n\n- Match the legacy static NAT rule only when it was created for the\n requested public IP, on both create and delete\n- Roll back the dedicated L2 VPC if vNet creation fails\n- Hide the L2 guest type for Netris in the add offering form\n- Add VPN to the external provider service map for Netris only\n- Fix the L2 offering services javadoc\n\n* Update Netris SDK version to 1.0.1\n\n* Move to the correct schema file\n\n* systemvm: bind dnsmasq and password server to router IP when external provider owns the gateway\n\n---------\n\nCo-authored-by: Pearl Dsilva \u003cpearl1954@gmail.com\u003e\nCo-authored-by: nvazquez \u003cnicovazquez90@gmail.com\u003e\nCo-authored-by: Wei Zhou \u003cweizhou@apache.org\u003e" }, { "commit": "088318594973ce2283a3f2171d6ce207899515fb", "tree": "66c4aa8502fd54bd35706f565c7dfa3e20dccf48", "parents": [ "0931cf818e6b1e620e158a97164bafbc8e31e0c8" ], "author": { "name": "MitchDrage", "email": "25337396+MitchDrage@users.noreply.github.com", "time": "Mon Oct 12 21:55:00 2026 +1100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 12 16:25:00 2026 +0530" }, "message": "Nasbackup quiesce fixes (#14305)\n\n* NAS backup: keep the schedule id on a failed backup left in Error state\n\n* NAS backup: add nas.backup.quiesce.agent.timeout for guest agent freeze and thaw\n\n* nasbackup.sh: abort the backup job before cleanup removes its destination\n\n* nasbackup.sh: always thaw after a freeze attempt and log freeze failures\n\n* nasbackup.sh: confirm a failed thaw against guest-fsfreeze-status before continuing\n\n* nasbackup.sh: only end the abort wait on a successful domjobinfo query\n\n* nasbackup.sh: retry failed job queries in the backup polling loop\n\n* NAS backup: count a backup kept in Error state in the account resource count\n\n* NAS backup: alert when cleanup fails after a failed backup" }, { "commit": "0931cf818e6b1e620e158a97164bafbc8e31e0c8", "tree": "cea084ef7f1b308731174f1c636edc0453806483", "parents": [ "1805dde42af4c6800b3a682d81c0d81d747aa775" ], "author": { "name": "David Taylor", "email": "880024+Alpha162@users.noreply.github.com", "time": "Fri Oct 09 15:00:22 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 09 11:00:22 2026 -0300" }, "message": "usage: widen usage_volume unique key to include vm_id (#13933)\n\nBackport of #13909 to 4.22, targeting 4.22.2.\n\nThis also creates the 4.22.1.0 to 4.22.2.0 upgrade path, which didn\u0027t\nexist yet: schema-42210to42220.sql, its cleanup companion, the\nUpgrade42210to42220 class, and the registration in DatabaseUpgradeChecker.\n\nThe CALLs can\u0027t go into schema-42200to42210.sql instead, because every\n4.22.1.0 install has already run that file and those are the affected\nclusters.\n\nCo-authored-by: Abhisar Sinha \u003c63767682+abh1sar@users.noreply.github.com\u003e" }, { "commit": "1805dde42af4c6800b3a682d81c0d81d747aa775", "tree": "24bfb8afd4ec68afde21b67f26201a6a797bf442", "parents": [ "437adc81dec08b2fbb6a57461126db56d1a20059" ], "author": { "name": "Brad House - Nexthop", "email": "bhouse@nexthop.ai", "time": "Fri Oct 09 09:07:56 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 09 15:07:56 2026 +0200" }, "message": "kvm: look RBD volumes up through librbd instead of refreshing the pool (#14188)\n\ngetPhysicalDisk() asks libvirt for the volume. A volume that was just\ncreated by the management server is not in this host\u0027s libvirt pool\ncache, so the lookup misses and getVolume() falls back to refreshing the\nwhole pool. Refreshing an RBD pool opens and stats every image in it, so\nthe cost grows with the number of volumes in the pool and is paid on\nevery VM start. On a pool holding 950 images that is 11.7 seconds added\nto each start, against 0.005 seconds to list the image names.\n\nLook RBD volumes up directly through librbd instead. Creating, cloning,\nresizing, copying and deleting RBD volumes in this class already use\nlibrbd directly; only the lookup went through libvirt.\n\nBecause this runs on every VM start, the connection is handled more\ncarefully than at the existing call sites:\n\n - the rados connection is shut down in a finally, so a client is not\n left for the finalizer. KVMStoragePoolManager.getPhysicalDisk retries\n a missing volume 100 times, so leaking here would mean 101 live\n librados clients for one absent volume.\n - the image is opened read only, since it is only stat\u0027ed, and so\n cannot take the exclusive lock.\n - the image is closed through a helper that does not throw, so a failed\n close cannot discard a successful lookup or hide the original error.\n - the cephx key is only set when the pool has a user. librados aborts\n the process if it is handed a null value." }, { "commit": "68cff975cebe11bbe47c85623a0dd356cea4b079", "tree": "e19e0f59891ee6ea2f804756f6bccb2f15df8c4a", "parents": [ "f03cffc19e6e055754b1a05e3359c4c75fa6854e" ], "author": { "name": "Nicolas Vazquez", "email": "nicovazquez90@gmail.com", "time": "Fri Oct 09 07:31:36 2026 -0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 09 12:31:36 2026 +0200" }, "message": "Upgrade Netris SDK version to 1.1.0 since 24.0 (#14365)" }, { "commit": "f03cffc19e6e055754b1a05e3359c4c75fa6854e", "tree": "342b9a8037161f0c808361f6e2eb373c35b600b0", "parents": [ "17294cac7a6357b8c2c9c8183eee023920e2617a" ], "author": { "name": "Abhishek Kumar", "email": "abhishek.mrt22@gmail.com", "time": "Thu Oct 08 22:12:25 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 08 13:42:25 2026 -0300" }, "message": "feature: instance boot group and readiness rules (#13907)\n\n* feature: instance boot group and readiness rules\n\nFeature to add the concept of instance boot group and readiness rules.\nDesign spec: https://cwiki.apache.org/confluence/spaces/CLOUDSTACK/pages/449282465/Instance+Boot+Group+and+Readiness+Rules\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* address review comments\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* fix ui build\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* fixes\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* fix vm action warning\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* minor label fixes\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* add tests\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* fixes, address comments\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* remove unused logs\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* fixes\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* fixes and more tests\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* force stop option and smoke test\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* minor config description\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* address comments\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* address comments; consistent API description\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* fix failing test\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* address missed Copilot review\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* engine-schema: upgrade path for 4.24.0\n\nAdds a 4.23.0 to 4.24.0 upgrade path.\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* move schema changes to 4.24, update order column name\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* remove unused rule type from presentation\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* test: fix testRestoreVirtualMachineWhenHostRemoved failure\n\nBuild was failing with,\n18:53:06 [ERROR] Errors:\n18:53:06 [ERROR] UserVmManagerImplTest.testRestoreVirtualMachineWhenHostRemoved:1886 ? NullPointer\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* fix imports\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* add since version for api commands\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* fix\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* fixes around members and ui\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* fix ui issue on updating readiness rule\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* fix wrong reporting of the attempt count\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* address copilot review\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* prevent instancegroup vms delete/remove only for one with rules\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n---------\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\nCo-authored-by: dahn \u003cdaan@onecht.net\u003e" }, { "commit": "17294cac7a6357b8c2c9c8183eee023920e2617a", "tree": "4e016873fccda190fb8915619b95b5553454a21f", "parents": [ "ed1db53815cf243eb87c10d2f135e1f10895f282" ], "author": { "name": "Manoj Kumar", "email": "manojkr.itbhu@gmail.com", "time": "Thu Oct 08 16:23:46 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 08 16:23:46 2026 +0530" }, "message": "dont show unathorized notification for prelogin (#14054)" }, { "commit": "437adc81dec08b2fbb6a57461126db56d1a20059", "tree": "5f46eaffe1d15d53476d1eba93a056abaa7acb10", "parents": [ "2974af84f22a8def8339380628d8653a4f016d3f" ], "author": { "name": "Syed Talha Ahmed Gardazi", "email": "74587660+stag7824@users.noreply.github.com", "time": "Thu Oct 08 08:33:04 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 08 09:33:04 2026 +0300" }, "message": "ui: add the missing label for the backup resource limit (#14163)\n\nThe Resource Limits tab derives each label from the resource type name\nreturned by listResourceLimits:\n\n $t(\u0027label.max\u0027 + item.resourcetypename.replace(\u0027_\u0027, \u0027\u0027))\n\nResource.ResourceType declares backup(\"backup\", 12), so the key looked up\nfor that row is label.maxbackup, which exists in no locale. en.json has\nlabel.maxbackups, a different string used by the backup schedule form for\nhow many backups to retain, and label.maxbackupstorage, which is resource\ntype 13. With fallbackLocale \u0027en\u0027 and silentTranslationWarn enabled, the\nmiss is silent and vue-i18n renders the key itself, so the row reads\n\"label.maxbackup\".\n\nThe same key is used for the tagged-limit validation message, which shows\nthe raw key for the same reason.\n\nBackup was the only one of the 17 ResourceType values without a label; the\nother 16 already resolve." }, { "commit": "ed1db53815cf243eb87c10d2f135e1f10895f282", "tree": "f21d950e4a976b9a207e8a602a45a9bbe579ccc0", "parents": [ "e6cd12392577a90e801a44d7823f34737e40574f" ], "author": { "name": "John Bampton", "email": "jbampton@users.noreply.github.com", "time": "Wed Oct 07 21:17:31 2026 +1000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 07 13:17:31 2026 +0200" }, "message": ".github: Upgrade docker/login-action to fix ASF Allowlist failure (#14276)" }, { "commit": "e6cd12392577a90e801a44d7823f34737e40574f", "tree": "fc1d06602391e1994c1a84ae801301626e46155d", "parents": [ "7ed0cec53dc5113a475808d6dbc221491ff4ae4f" ], "author": { "name": "Wido den Hollander", "email": "wido@widodh.nl", "time": "Wed Oct 07 13:08:27 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 07 13:08:27 2026 +0200" }, "message": "virtual router: Add route-maps to BGP peers for Routed Mode (#9964)\n\n* virtual router: Add route-maps to BGP peers for Routed Mode\n\nIt is best practice, and mandatory in newer version of FRR, that route-maps\nshould be applied to BGP peers. This is to prevent that mistakes can propogate\nthrough a network and cause outages.\n\nThis change changes the route-maps where the VR will only accept IPv4 and IPv4\ndefault gateways (0.0.0.0/0 and ::/0) to be sent by the upstream router to the VR.\n\nThe other way around this change makes sure that FRR will not allow announcing anything\nelse than the locally defined subnets to the upstream BGP router.\n\n* systemvm: ignore comment lines in BGP peer test configuration\n\n- Filter comment lines (starting with #) when comparing generated vs expected FRR config\n- Apply filtering to both generated config and expected config file\n- Allows keeping license headers in test fixtures while ignoring them in tests\n- All 11 BGP peer tests pass" }, { "commit": "376c1b40174ab4b8d7f9aced5401143cbc09d587", "tree": "284d3b056dd89cac87e64f3fb15e5503cd154f95", "parents": [ "5dfe75f77f3dab2271f5a00759148b0643d45b33" ], "author": { "name": "Ramgopal Nagaboina", "email": "ramgopal.nagaboina.dev@gmail.com", "time": "Wed Oct 07 02:18:41 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 07 08:18:41 2026 +0200" }, "message": "server: scope IPv6 security group member rules to the exact host (#14037)\n\n* server: scope IPv6 security group member rules to the exact host\n\nWhen a security group rule references another security group, each member VM\nshould be authorized as an exact host. The IPv4 address is correctly pinned to\na /32, but the IPv6 address was expanded to /64, opening the whole subnet the\nmember sits in rather than just that member. Pin the IPv6 member to /128 to\nmatch the IPv4 behaviour.\n\n* server: scope the Impl2 IPv6 security group member rule to the exact host" }, { "commit": "5dfe75f77f3dab2271f5a00759148b0643d45b33", "tree": "7be5d7255e32d936d765e9073f7aa22ac05d9d10", "parents": [ "b8a44e949510d8fd76fbfaf9ceea235a548b57d6" ], "author": { "name": "Manoj Kumar", "email": "manojkr.itbhu@gmail.com", "time": "Wed Oct 07 00:54:59 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 06 16:24:59 2026 -0300" }, "message": "Exclude Apache CXF dependency from kvm plugin (#13799)" }, { "commit": "2974af84f22a8def8339380628d8653a4f016d3f", "tree": "b04cfdc3dc5355708b93757d3c728806f34e283a", "parents": [ "cc2f74f5c5d567ebbc096ad6ba389da4cf78dfca" ], "author": { "name": "Daman Arora", "email": "61474540+Damans227@users.noreply.github.com", "time": "Tue Oct 06 15:21:42 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 06 16:21:42 2026 -0300" }, "message": "Make worker and API thread pool size configurable (#13565)\n\n* Make worker and API thread pool size configurable\n\nThe AsyncJobManager\u0027s API and Worker executor thread pool sizes are\ncurrently derived solely from db.cloud.maxActive (maxActive/2 and\nmaxActive*2/3 respectively). This coupling doesn\u0027t account for\nenvironments with predominantly I/O-bound workers, where threads are\nheld waiting on external responses for extended periods and higher\npool sizes may be needed independently of the DB connection count.\n\nThis adds two global config keys:\n- api.job.pool.size (default: 50)\n- work.job.pool.size (default: 50)\n\nThe actual pool size is Math.max(configured value, db-derived\ndefault), preserving existing behavior by default while allowing\noperators to increase pool sizes when workloads require it. Pool\nsizes and their derivation are logged at startup for observability.\n\n* Replace synthetic pool size tests with real configure() executor assertions\n\nThe previous unit tests for the api.job.pool.size/work.job.pool.size\nconfig keys only re-ran Math.max() on local hardcoded values, or\nchecked ConfigKey plumbing directly, without ever calling\nAsyncJobManagerImpl.configure() itself. That meant a regression in the\nactual pool-sizing logic wouldn\u0027t have been caught.\n\nThese tests now invoke configure() directly and assert on the real\ncore pool size of the created _apiJobExecutor/_workerJobExecutor via\nreflection, with @Before/@After hooks to stub db.properties and reset\nconfig/executor state between tests.\n\n---------\n\nCo-authored-by: Sachin R \u003c32716246+sachindoddaguni@users.noreply.github.com\u003e\nCo-authored-by: mprokopchuk \u003cmprokopchuk@apple.com\u003e" }, { "commit": "cc2f74f5c5d567ebbc096ad6ba389da4cf78dfca", "tree": "57bffadb7b8a693ca630e08e67c83520849bb5a2", "parents": [ "4e679ad8778e558952de9b3fe9b7a96d7fdfc144" ], "author": { "name": "Suresh Kumar Anaparti", "email": "sureshkumar.anaparti@gmail.com", "time": "Wed Oct 07 00:47:07 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 06 16:17:07 2026 -0300" }, "message": "Ensure compliance with storage access groups when mounting disabled storage pools (#13990)\n\n- connect to only storage pools with empty tags when access group is empty\n\nCo-authored-by: Sachin R Doddaguni \u003cs_rudrappadoddagu@apple.com\u003e" }, { "commit": "4e679ad8778e558952de9b3fe9b7a96d7fdfc144", "tree": "64cb54b0ab03cb8b340d44ec03d3aedd8d82ed56", "parents": [ "d4f5dff7311bdb6a7fb6174b8eddb705a8e0eac5" ], "author": { "name": "Suresh Kumar Anaparti", "email": "sureshkumar.anaparti@gmail.com", "time": "Wed Oct 07 00:43:34 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 06 16:13:34 2026 -0300" }, "message": "Ensure the detail value is not null when updating the vnc access details of the vms with failed migrations on host maintenance (#13492)\n\n- Fixes the Constraint error Column \u0027value\u0027 cannot be null" }, { "commit": "d4f5dff7311bdb6a7fb6174b8eddb705a8e0eac5", "tree": "0ebe019bb3f8e37a776363e5cac7509da9bc5725", "parents": [ "cdd03d78748f8f30cafbd2b7dbca65c5cb9c4041" ], "author": { "name": "Vishesh", "email": "8760112+vishesh92@users.noreply.github.com", "time": "Wed Oct 07 00:41:44 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 06 16:11:44 2026 -0300" }, "message": "Fix overly broad classpath scanning in ReflectUtil.getClassesWithAnnotation() (#13427)\n\n* Fix overly broad classpath scanning in ReflectUtil.getClassesWithAnnotation()\n\nProduction logs show a recurring WARN at startup:\n \"could not get type for name org.conscrypt.AllocatedBuffer\"\n (org.reflections.ReflectionsException / ClassNotFoundException)\n\nRoot cause: ReflectUtil.getClassesWithAnnotation() uses\nClasspathHelper.forPackage() to collect URLs to scan, but this\nreturns all classpath entries (JARs/directories), not just those\ncontaining the target package. The Reflections library then scans\nevery .class file in every JAR — including Netty\u0027s\nConscryptAlpnSslEngine$BufferAdapter which references the optional\norg.conscrypt.AllocatedBuffer type. During expandSuperTypes(),\nReflections tries Class.forName() on that type and fails because\nConscrypt is not (and need not be) on the classpath.\n\nThe fix adds a FilterBuilder that restricts bytecode scanning to\nonly classes whose fully-qualified names match the requested\npackages. This prevents Reflections from processing unrelated\nclasses (e.g., io.netty.handler.ssl.*), eliminating the warning\nand reducing startup time by skipping thousands of irrelevant\nclass files.\n\nSigned-off-by: Ganesh Maharaj Mahalingam \u003cg.mahalingam@apple.com\u003e\n\n* Add missing API command packages to ApiXmlDocWriter\u0027s classpath scan list\n\n---------\n\nSigned-off-by: Ganesh Maharaj Mahalingam \u003cg.mahalingam@apple.com\u003e\nCo-authored-by: Ganesh Maharaj Mahalingam \u003cg.mahalingam@apple.com\u003e" }, { "commit": "b8a44e949510d8fd76fbfaf9ceea235a548b57d6", "tree": "8c02547ce6c5470f6ef1c09c065e44e4e774d064", "parents": [ "4b2d387287a3d49adeef183716fb4ab0d0c1fdf3" ], "author": { "name": "sb-abhish3k", "email": "abhishek.kumar@shapeblue.com", "time": "Wed Oct 07 00:39:19 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 06 16:09:19 2026 -0300" }, "message": "lock only domains that have finite limits for checked reservation (#14169)\n\n* lock on only domains that have finite limits for checked reservation\n\n* fix domain lock set to reflect tag-\u003euntagged fallback and limit inheritance\n\nlistRowsToLockForLimitCheck previously only locked ancestor domains that\nowned an explicit finite resource_limit row for the exact tag, so it\nmissed domains that inherit a finite limit from an ancestor\u0027s row, and\ndomains that fall back to the untagged limit when no tag-specific limit\nis configured (per findCorrectResourceLimitForDomain). Either gap let\nconcurrent reservations bypass domain-level serialization.\n\nReplace the set-based approximation with an in-memory walk of the\naccount\u0027s domain chain that replicates findCorrectResourceLimitForDomain\u0027s\nnearest-row-with-fallback semantics, using bulk queries (covered by\nexisting indexes) to fetch the chain\u0027s resource_limit rows and to resolve\nthe final resource_count rows to lock.\n\n---------\n\nCo-authored-by: Mark Armstrong \u003cmarms@apple.com\u003e" }, { "commit": "cdd03d78748f8f30cafbd2b7dbca65c5cb9c4041", "tree": "9665cc033951a098c421b744e5877eb9031a3cff", "parents": [ "2e63c601fc224de20c345172d9b805ffb6bdbeac", "4b2d387287a3d49adeef183716fb4ab0d0c1fdf3" ], "author": { "name": "Daan Hoogland", "email": "dahn@apache.org", "time": "Mon Oct 05 16:27:34 2026 +0200" }, "committer": { "name": "Daan Hoogland", "email": "dahn@apache.org", "time": "Mon Oct 05 16:27:34 2026 +0200" }, "message": "Merge branch \u00274.20\u0027 into 4.22\n" }, { "commit": "7ed0cec53dc5113a475808d6dbc221491ff4ae4f", "tree": "d2ef28f6428f05eaad9b6717f8849c8812303978", "parents": [ "1a48a87587c03472feefb081cfac71b2ebd0f407" ], "author": { "name": "John Bampton", "email": "jbampton@users.noreply.github.com", "time": "Mon Oct 05 21:11:33 2026 +1000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 05 08:11:33 2026 -0300" }, "message": "Add pre-commit hook to validate dependabot.yml (#14107)\n\n* Add pre-commit hook to validate dependabot.yml\n\nhttps://check-jsonschema.readthedocs.io/en/stable/precommit_usage.html#check-dependabot\n\nhttps://github.com/python-jsonschema/check-jsonschema/commit/12e63946db2c5cfcc9030fac21c3883ba88c6ed8\n\n* Update regex for dependabot config file validation\n\nCo-authored-by: Copilot Autofix powered by AI \u003c175728472+Copilot@users.noreply.github.com\u003e\n\n* Rename hook for validating dependabot config\n\nCo-authored-by: Copilot Autofix powered by AI \u003c175728472+Copilot@users.noreply.github.com\u003e\n\n---------\n\nCo-authored-by: Copilot Autofix powered by AI \u003c175728472+Copilot@users.noreply.github.com\u003e" }, { "commit": "4b2d387287a3d49adeef183716fb4ab0d0c1fdf3", "tree": "5f04858b8cb6e189a090f2b42d019048196324ac", "parents": [ "5deb6a958df549b68232f9e7dedff8de4422e603" ], "author": { "name": "Ramgopal Nagaboina", "email": "ramgopal.nagaboina.dev@gmail.com", "time": "Thu Oct 01 10:41:33 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 01 16:41:33 2026 +0200" }, "message": "server: null-check requested IP in assignSourceNatPublicIpAddress (#14025)" }, { "commit": "5deb6a958df549b68232f9e7dedff8de4422e603", "tree": "41c8fc947a39d1fba3f9088e9d5e77a157b825dc", "parents": [ "8eeccdbb8a24ad68978a153dc929fc705a027d53" ], "author": { "name": "Manoj Kumar", "email": "manojkr.itbhu@gmail.com", "time": "Thu Oct 01 03:30:06 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 30 19:00:06 2026 -0300" }, "message": "Improve date/timestamp handling performance in GenericDaoBase and DateUtil (#13809)\n\n* Improve date/timestamp handling performance in GenericDaoBase and DateUtil\n\n* address review comment" }, { "commit": "1a48a87587c03472feefb081cfac71b2ebd0f407", "tree": "7f8d4804a8053e8b3cef09bbf1ccbc3749d1d246", "parents": [ "510d0ec3785efe3cce65ccd1247682b91f4492d0" ], "author": { "name": "John Bampton", "email": "jbampton@users.noreply.github.com", "time": "Wed Sep 30 21:59:52 2026 +1000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 30 13:59:52 2026 +0200" }, "message": "Add the ASF Allowlist check workflow (#14113)" }, { "commit": "2e63c601fc224de20c345172d9b805ffb6bdbeac", "tree": "fa6b842be82c041a00ed53301a576969a349e518", "parents": [ "a772e8d13bad6954b516dca560fd114ac003e7d1" ], "author": { "name": "Andrija Panic", "email": "45762285+andrijapanicsb@users.noreply.github.com", "time": "Wed Sep 30 11:00:46 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 30 11:00:46 2026 +0200" }, "message": "Clarify KVM import template requirement (#13126)" }, { "commit": "a772e8d13bad6954b516dca560fd114ac003e7d1", "tree": "ec7ce69fcaf8a24b35667a9aaa93a77e76150105", "parents": [ "730d11fc57fd240b7867da670f0e35169dc9e44f" ], "author": { "name": "Pearl Dsilva", "email": "pearl1594@gmail.com", "time": "Wed Sep 30 03:58:38 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 30 09:58:38 2026 +0200" }, "message": "CKS/CSI: fix PVC deletion script to avoid \u0027(standard input)\u0027 and use kubectl -o name/jsonpath (#11968)" }, { "commit": "730d11fc57fd240b7867da670f0e35169dc9e44f", "tree": "695996e779798efd82858f5fd8836954d0337f86", "parents": [ "250695ec331328e9fec08a5422d27e91fd4cdf87" ], "author": { "name": "Nicolas Vazquez", "email": "nicovazquez90@gmail.com", "time": "Wed Sep 30 03:06:26 2026 -0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 30 11:36:26 2026 +0530" }, "message": "[4.22] Fix CI Pre-commit failure (#14268)" }, { "commit": "250695ec331328e9fec08a5422d27e91fd4cdf87", "tree": "bd8d607448b80f7e8fc6da3a086681c94f5d677e", "parents": [ "31b6855b70821d24897eef237d93fcc2a22b2548" ], "author": { "name": "Suresh Kumar Anaparti", "email": "sureshkumar.anaparti@gmail.com", "time": "Tue Sep 29 18:43:57 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 29 10:13:57 2026 -0300" }, "message": "Escape snapshot names in libvirt XML (#14201)\n\nCo-authored-by: mprokopchuk \u003cmprokopchuk@apple.com\u003e" }, { "commit": "31b6855b70821d24897eef237d93fcc2a22b2548", "tree": "6bbb554b1d04a45c3f54bdfe334424d67a6ae95b", "parents": [ "51c52490c95cffc0d77a1880ca44912c25d7b18e" ], "author": { "name": "Rene Peinthor", "email": "rene.peinthor@linbit.com", "time": "Tue Sep 29 07:58:00 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 29 07:58:00 2026 +0200" }, "message": "linstor: escape dashes in the LVM volume group name of snapshot paths (#14066)\n\nDevice-mapper doubles every dash in both the volume group and the\nlogical volume name. getSnapshotPath only escaped the resource and\nsnapshot name, so on a VG like \"linstor_pool-lvm-thin\" the computed\n/dev/mapper path did not exist and backing up a snapshot to secondary\nstorage failed with \"qemu-img: Could not open\".\n\nFixes #14011" }, { "commit": "510d0ec3785efe3cce65ccd1247682b91f4492d0", "tree": "18f2156630f56d2077785d60fd69f31e9a57efbb", "parents": [ "0a5bf30af32bdea5a209f3f993cbd6a43301d0f9" ], "author": { "name": "Daan Hoogland", "email": "dahn@apache.org", "time": "Mon Sep 28 18:59:06 2026 +0200" }, "committer": { "name": "Daan Hoogland", "email": "dahn@apache.org", "time": "Mon Sep 28 18:59:06 2026 +0200" }, "message": "Revert \"VMware to KVM: cold (VDDK) and warm (CBT) migration into Ceph/RBD and Linstor, plus importVm adoption of existing RBD root volumes and Linstor root/data volumes (#13656)\"\n\nThis reverts commit 0a5bf30af32bdea5a209f3f993cbd6a43301d0f9.\n" }, { "commit": "51c52490c95cffc0d77a1880ca44912c25d7b18e", "tree": "81c5cb275a42f8b750e2ba4d86dd65482b132a4f", "parents": [ "f23766d7c33b32a30caeb2d2b04039d0c6b24f13" ], "author": { "name": "Nicolas Vazquez", "email": "nicovazquez90@gmail.com", "time": "Mon Sep 28 07:46:20 2026 -0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 28 07:46:20 2026 -0300" }, "message": "Add schema upgrade path for 4.22.2 (#14179)" }, { "commit": "0a5bf30af32bdea5a209f3f993cbd6a43301d0f9", "tree": "d3be509ec552975ff628e8f2ada6f4d46d1f109d", "parents": [ "602d9ec3e03e6350b55dd1349118ea2ccb766cca" ], "author": { "name": "Andrija Panic", "email": "45762285+andrijapanicsb@users.noreply.github.com", "time": "Thu Sep 24 13:07:45 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 24 13:07:45 2026 +0200" }, "message": "VMware to KVM: cold (VDDK) and warm (CBT) migration into Ceph/RBD and Linstor, plus importVm adoption of existing RBD root volumes and Linstor root/data volumes (#13656)\n\nSigned-off-by: Andrija Panic \u003candrija.panic@gmail.com\u003e\nCo-authored-by: dahn \u003cdaan.hoogland@gmail.com\u003e" }, { "commit": "f23766d7c33b32a30caeb2d2b04039d0c6b24f13", "tree": "a660e76b8cf0bb8b0e88c902ad07f94ba1be500f", "parents": [ "ac8d69c5c1d7d2a30b9e49e8f484a365123557d9" ], "author": { "name": "Wei Zhou", "email": "weizhou@apache.org", "time": "Thu Sep 24 12:48:18 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 24 12:48:18 2026 +0200" }, "message": "core: introduce a set of type adapters (#13624)\n\n* There is a set of TO classes with renamed fields, which makes impossible to correctly communicate between Management Servers and Agents\n\n* fix logger\n\n* Apply suggestion from Daman\n\n* Apply suggestion from Daman 2\n\n* Fix nested TO renaming, log redaction and cleanup in compat TypeAdaptors\n\nAbstractTOAdaptor built its own private Gson to run the pre-rename\nserialization step through, which meant it never honoured the\nLoggingExclusionStrategy the enclosing Gson (GsonHelper\u0027s logging\ninstance) was configured with, so fields marked @LogLevel(Off) (e.g.\nVirtualMachineTO.vncPassword) leaked in plaintext when logged. It also\nhad no adapters for the sibling compat TOs, so nested TOs (disks/nics\ninside a VirtualMachineTO, or a VirtualMachineTO inside a\nMigrateCommand) kept their new field names instead of being renamed\nfor backward compatibility with older Agents.\n\nAbstractTOAdaptor no longer owns a Gson at all: it takes one via\ninitGson(), mirroring the existing InterfaceTypeAdaptor pattern.\nGsonHelper.setDefaultGsonConfig now wires each compat adaptor\u0027s\ndelegate Gson incrementally off the same builder, snapshotting it via\nbuilder.create() right before each adaptor registers itself, so every\nadaptor\u0027s delegate carries its sibling adaptors (for correct nested\nrenaming) without ever routing back into itself and recursing\nforever. NetworkTO is now registered via registerTypeHierarchyAdapter\nsince VirtualMachineTO.nics is declared as NicTO[] (a NetworkTO\nsubclass) and was never matched by the previous exact-type\nregistration.\n\nThis also removes AbstractTOAdaptor\u0027s now-unused loggerBuilder/LOGGER\nand its duplicate copy of GsonHelper.setDefaultGsonConfig, and\nreplaces a dead null check (getAsJsonObject() never returns null) with\na real isJsonObject() check.\n\nAdded RequestTest#testCompatFieldRenamingNestedTOs covering a\nStartCommand and a MigrateCommand with nested disks/nics, asserting\nold field names appear at every nesting level on the wire and that\nvncPassword never appears in the logging serialization.\n\n* fix logger\n\n* fix build error RequestTest\n\n* fix unit test failures RequestTest.java\n\n---------\n\nCo-authored-by: mprokopchuk \u003cmprokopchuk@gmail.com\u003e\nCo-authored-by: Daman Arora \u003cdamans227@gmail.com\u003e" }, { "commit": "ac8d69c5c1d7d2a30b9e49e8f484a365123557d9", "tree": "d603f52566cd637dd61f59d25302dd5745d35bdc", "parents": [ "273b2ea32bfa24396431b9bb0df055e0ac6c1c02" ], "author": { "name": "Abhisar Sinha", "email": "63767682+abh1sar@users.noreply.github.com", "time": "Sat Sep 19 14:14:17 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Sep 19 10:44:17 2026 +0200" }, "message": "importVM improvements: RBD support, volume format, and cluster selection (#14162)\n\n* kvm: allow importVm importsource\u003dshared from an RBD pool\n\nThe CheckVolumeCommand wrapper on the KVM agent only accepted file based\npools, so importing a root disk straight from Ceph failed on the agent\nwith \"Unsupported Storage Pool\" and surfaced as \"Disk not found or is\ninvalid\" on the management server. Add RBD to the supported pool types,\ntake the virtual size from the disk libvirt resolved (qemu-img cannot\nopen a bare RBD image name), skip the QCOW2 header check for raw RBD\nimages, and build the rbd: URI when running qemu-img info, the same way\nLibvirtGetVolumesOnStorageCommandWrapper already does for\nlistVolumesForImport.\n\n* kvm: record the real image format on an imported volume\n\nimportVolume and updateImportedVolume both stamped the cluster default\nformat for the hypervisor, so a volume imported from an RBD pool was\nrecorded as QCOW2 while a natively deployed volume on the same pool is\nRAW. This affected both entry points: importVm importsource\u003dshared for a\nroot disk, and importVolume for a data disk.\n\nPass the format the hypervisor reported for the existing image, from the\ncheck answer for a root disk and from the volume listed on the pool for\na data disk, and fall back to the hypervisor default only when no format\nis reported. This also corrects a raw image imported from a file based\npool.\n\n* vm import: plan the instance inside the pod and cluster of the requested pool\n\nimportKVMInstanceFromDiskImage planned with the pod and cluster unset, so\nthe planner was free to pick any host in the zone by capacity. When it\npicked a host in a cluster that cannot see the pool the caller named, the\nvolume check ran against whichever pool that cluster does have, and the\nimport failed with \"Disk not found or is invalid\" although the image was\nfine.\n\nTake the pod and cluster from the pool the caller passed, the same way\nimportVolume already derives its host from the pool\u0027s scope\n\n* verify qemu is able to read the rbd image since check can not be done on a raw file\n\n* use computed volumeDetails in success path as well.\n\n* ui: do not call the imported disk a QCOW2 image\n\nThe import wizard for local and shared storage described the disk as a\nQCOW2 image. An image on an RBD pool is raw, and a raw image on a file\nbased pool can be imported as well, so the wording is wrong for both.\nCall it a disk image instead.\n\nOnly the English strings are changed; the other locales come from\nTransifex." }, { "commit": "273b2ea32bfa24396431b9bb0df055e0ac6c1c02", "tree": "da3a2a47fdc1fe51fab9406807be233246dc9aa0", "parents": [ "a8c8c18e56a0ba1ea2f3cbe6d6434d0b908331f5" ], "author": { "name": "Abhisar Sinha", "email": "63767682+abh1sar@users.noreply.github.com", "time": "Sat Sep 19 14:10:47 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Sep 19 10:40:47 2026 +0200" }, "message": "Fix importVM for use with dummy template (#14195)\n\nfindByID will fail for dummy template as it is stored in the deleted state." }, { "commit": "602d9ec3e03e6350b55dd1349118ea2ccb766cca", "tree": "18f2156630f56d2077785d60fd69f31e9a57efbb", "parents": [ "5812290da14c89ace139dc04d948796c823099c9" ], "author": { "name": "Abhishek Kumar", "email": "abhishek.mrt22@gmail.com", "time": "Fri Sep 18 15:48:51 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 18 07:18:51 2026 -0300" }, "message": "engine-schema: upgrade path for 24.0.0 (#14033)\n\n* engine-schema: upgrade path for 24.0.0\n\nAdds a 4.23.0 to 24.0.0 upgrade path.\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* fix CS version\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* fix upgrade unit tests for cutover\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* fix imports\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* fix template version\n\n* continue using 3 part version for sys template\n\n* fix\n\n* fix more\n\n* use security version after cutover\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* improvements and add tests\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* fix more scripts\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* address remaining comments\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* more changes\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n\n* Update versioning logic in export-templates.sh\n\nRefactor versioning logic to handle four-component metadata separately.\n\nCo-authored-by: Copilot Autofix powered by AI \u003c175728472+Copilot@users.noreply.github.com\u003e\n\n* Fix export-templates.sh syntax\n\n---------\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\nCo-authored-by: Copilot Autofix powered by AI \u003c175728472+Copilot@users.noreply.github.com\u003e\nCo-authored-by: nvazquez \u003cnicovazquez90@gmail.com\u003e" }, { "commit": "5812290da14c89ace139dc04d948796c823099c9", "tree": "31b148ed88b6b2bbf72af536702ec72934619a30", "parents": [ "27722a5dd1bcfd7e4a37813df57827dbd9d74e99", "a8c8c18e56a0ba1ea2f3cbe6d6434d0b908331f5" ], "author": { "name": "Wei Zhou", "email": "weizhou@apache.org", "time": "Thu Sep 17 14:51:01 2026 +0200" }, "committer": { "name": "Wei Zhou", "email": "weizhou@apache.org", "time": "Thu Sep 17 14:51:01 2026 +0200" }, "message": "Merge remote-tracking branch \u0027apache/4.22\u0027\n" }, { "commit": "a8c8c18e56a0ba1ea2f3cbe6d6434d0b908331f5", "tree": "f06803c7f08b4d211a4dd8057bc80d016eb49006", "parents": [ "cffa6e3603aeeca9058236e04392e3447924f14b" ], "author": { "name": "Wei Zhou", "email": "weizhou@apache.org", "time": "Thu Sep 17 11:33:31 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 17 15:03:31 2026 +0530" }, "message": "xenserver/xcpng: do not bypass secondary storage when copy volumes between pools (#13750)" }, { "commit": "cffa6e3603aeeca9058236e04392e3447924f14b", "tree": "8b72cb028b57d15b6dbbe45fa84eb55c094f613f", "parents": [ "10037c85d61f9c79e0b357aa5a4f372940ad56d2" ], "author": { "name": "Abhisar Sinha", "email": "63767682+abh1sar@users.noreply.github.com", "time": "Thu Sep 17 14:56:05 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 17 14:56:05 2026 +0530" }, "message": "backport: Incremental NAS backup support for KVM (#13074) (#13877)\n\n* feat(backup): incremental NAS backup support for KVM (#13074)\n\nImplements incremental backup support for the NAS backup provider on KVM, using QEMU dirty bitmaps and libvirt\u0027s backup-begin API. RFC: apache/cloudstack#12899.\n\nFor large VMs this reduces daily backup storage 80–95% and shortens backup windows from hours to minutes (e.g. a 500 GB VM with moderate writes goes from ~500 GB/day to ~5–15 GB/day after the initial full backup).\n\nSigned-off-by: James Peru \u003cjmsperu@gmail.com\u003e\nCo-authored-by: jmsperu \u003cjmsperu@users.noreply.github.com\u003e\nCo-authored-by: Abhisar Sinha \u003c63767682+abh1sar@users.noreply.github.com\u003e\n\n* fix checkstyle\n\n* Incremental nas backup fixes (#13571)\n\n* Avoid concurrent deletes modifying the same backup chain in parallel - Backup deletes are serialized by using a per-VM GlobalLock\nBackup delete checks if it has a live dependent backup not just a live immediate child.\n\n* Fix test failure in NasBackupProviderTest\n\n* backup: drop unused backupStatus search condition from listBackups\n\nThe backupStatus condition was carried over from main, where #13254 added a\nstatus filter to listBackups. 4.22 has neither ListBackupsCmd.getBackupStatus()\nnor a setParameters call for it, so the condition is never populated and\nSearchCriteria.getWhereClause() skips it. Dead code on this branch; the\nstatusNeq clause that hides tombstoned chain members is the one in use.\n\n* kvm: execute \"qemu-img convert\" by Script.executeCommandForExitValue\n\n* Add missing return in replaceVolumeWithBackup\n\n* make NASBackupFullEvery use NasBackupIncrementalEnabled as the parent\n\n* Address review comments: null/empty checks and restore answer guard\n\n---------\n\nSigned-off-by: James Peru \u003cjmsperu@gmail.com\u003e\nCo-authored-by: James Peru Mmbono \u003cjmsperu@gmail.com\u003e\nCo-authored-by: jmsperu \u003cjmsperu@users.noreply.github.com\u003e" }, { "commit": "27722a5dd1bcfd7e4a37813df57827dbd9d74e99", "tree": "5aa278c82e46b03dd5e107a896ac50bd8eeaf99a", "parents": [ "79189c8d6a25a7b6f161704edcc1ed79977ed030" ], "author": { "name": "calvix", "email": "rozsypalek.vaclav@gmail.com", "time": "Wed Sep 16 08:10:05 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 16 08:10:05 2026 +0200" }, "message": "storage: KVM - enable RBD/Ceph volume encryption support (#13556)\n\n* storage: enable RBD/Ceph volume encryption support (shared base)\n\nFlip StoragePoolType.RBD from EncryptionSupport.Unsupported to Hypervisor so the\nexisting encryption control plane (allocator, endpoint selector, offerings) treats\nRBD pools as encryption-capable.\n\nThe agent-side encrypted RBD create path is not implemented yet; it is delivered by\ntwo follow-up tracks (qemu-native engine\u003d\u0027qemu\u0027 and ceph-native engine\u003d\u0027librbd\u0027).\nUntil then, fail closed at the two RBD create chokepoints in LibvirtStorageAdaptor\n(createPhysicalDisk and createDiskFromTemplate) when a passphrase is present, so we\nnever silently produce a plaintext volume that the control plane believes is encrypted.\n\nNo change for existing unencrypted RBD volumes (guards only fire when a passphrase\nis set; supportsEncryption() only affects volumes that require encryption).\n\n* kvm: Ceph-native LUKS2 encryption for RBD volumes (engine\u003d\u0027librbd\u0027)\n\nImplements encrypted RBD data and root disks using librbd\u0027s native LUKS2\nencryption, decrypted at runtime by libvirt/qemu via \u003cencryption\nengine\u003d\u0027librbd\u0027\u003e. CloudStack manages the passphrase (existing model).\n\n- RbdEncryption: isolated helper wrapping `rbd encryption format luks2`,\n cephx via --id + keyfile (secret not on the command line), LUKS passphrase\n via KeyFile. Kept separate so the CLI can later be swapped for a JNA binding\n (rados-java has no rbd_encryption_format API).\n- LibvirtStorageAdaptor: create/clone the raw RBD image, then apply\n `rbd encryption format luks2`; mark the disk LUKS2 so encrypt_format\n propagates to the volume. Replaces the fail-closed guards.\n- QemuObject.EncryptFormat: add LUKS2.\n- LibvirtVMDef: render \u003cencryption format\u003d\u0027luks2\u0027 engine\u003d\u0027librbd\u0027\u003e; the\n encrypt details now carry an optional engine.\n- attach (KVMStorageProcessor) and boot (LibvirtComputingResource): set\n engine\u003d\u0027librbd\u0027 for RBD-backed encrypted volumes.\n\nNOTE: the CoW-clone-then-format path (encrypted root from an unencrypted\ntemplate) needs live-cluster validation for the parent-grow / usable-size\nbehaviour described in the Ceph image-encryption docs.\n\nBuilds: api + plugins/hypervisors/kvm (JDK11).\n\n* kvm: gate host encryption probe on librbd support for RBD\n\nhostSupportsVolumeEncryption() now advertises encryption capability if the\nhost supports EITHER qemu-native LUKS (qemu-img LUKS + cryptsetup) OR librbd\nnative encryption (rbd CLI with the encryption subcommand). Previously a\nCeph-only host that lacked cryptsetup would not advertise encryption even\nthough librbd can encrypt RBD volumes.\n\nSplit into hostSupportsQemuNativeVolumeEncryption() and\nhostSupportsRbdVolumeEncryption(); kept HOST_VOLUME_ENCRYPTION as the single\nhost-wide flag (documented limitation: not per-pool).\n\n* kvm: resize support for librbd-encrypted RBD volumes (#5)\n\nEncrypted RBD volumes are encrypted natively by librbd and must be resized\nwith `rbd resize --encryption-passphrase-file` so librbd grows the encrypted\npayload and keeps the LUKS header consistent. The existing encrypted-resize\npath (resizeEncryptedQcowFile) uses qemu-img --object secret, which is for\nqemu-native LUKS and does not fit the librbd LUKS2 layout.\n\n- RbdEncryption.resize(): new `rbd resize` wrapper (cephx via --id + keyfile,\n passphrase via KeyFile, optional --allow-shrink).\n- LibvirtResizeVolumeCommandWrapper: detect encrypted RBD and route to the rbd\n resize path, bypassing the libvirt v.resize and qemu-img paths.\n\nSnapshot/revert, RBD\u003c-\u003eRBD copy, and migration of encrypted RBD volumes need\nno code changes: they operate on the raw (LUKS-containing) image at the block\nlevel, and the destination passphrase secret is already created engine-agnostic\nin LibvirtPrepareForMigrationCommandWrapper. These still require live validation.\n\nBuilds: plugins/hypervisors/kvm (JDK11).\n\n* kvm: route online resize of encrypted RBD through virsh blockresize\n\nFor a running VM, an librbd-encrypted RBD volume must be resized in-band by\nqemu/librbd, not out-of-band by the rbd CLI. Gate the CLI rbd-resize path on\n!vmIsRunning so:\n - offline -\u003e `rbd resize --encryption-passphrase-file` (librbd-aware), and\n - online -\u003e existing NOTIFYONLY path -\u003e virsh blockresize, where qemu\u0027s\n block_resize delegates to librbd to grow the encrypted payload and notify\n the guest in one step (no passphrase needed; qemu holds the secret).\n\nThis avoids notify-less out-of-band growth and qemu/librbd size divergence\nwhile the image is open. Online behaviour still needs live validation that\nblockresize resizes the encrypted payload for engine\u003d\u0027librbd\u0027 disks.\n\n* kvm: encrypted RBD root disks (thin CoW clone + full-copy fallback)\n\nRoot disks could not be encrypted: cloning a plaintext template and then\n`rbd encryption format`ing the clone leaves the inherited OS data unreadable\n(the LUKS header offsets it), so the guest could not mount root.\n\nFix, in createDiskFromTemplateOnRBD, with two paths:\n- Option A (same-cluster cached RBD template): grow the template base to\n reserve LUKS2 header space, snapshot+protect it (cloudstack-base-snap-luks),\n clone from it, apply the LUKS2 header, resize the clone to the requested\n size. Inherited template data stays readable through the clone\u0027s encryption\n and the clone is a thin CoW image (only the header is written).\n- Option B (first-use / non-RBD template): create an empty image, apply a\n LUKS2 header, then import the template THROUGH the encryption layer via\n RbdEncryption.importTemplate (qemu-img convert -n into encrypt.key-secret).\n Correct but a full copy.\n\nValidated end-to-end on Ubuntu 26.04 / libvirt 12.0.0: both boot; A is thin\n(3.5 GiB provisioned, ~120 MiB used); LUKS2 verified at rest on Ceph.\n\n* kvm: harden and align librbd-encrypted RBD volume code\n\nReview pass over the librbd LUKS2 encryption feature to fix latent issues\nand bring it in line with CloudStack conventions:\n\n- RbdEncryption: reject empty/null passphrase with a clear error; round\n rbd --size up to MiB so a non-aligned request never shrinks the volume\n below what was asked for; create the temporary cephx conf/keyring 0600\n explicitly instead of relying on the umask.\n- LibvirtStorageAdaptor: close Rados/IoCTX/RbdImage in a finally block on\n the encrypted-root paths (mirrors deleteVolume) so handles are not\n leaked on exceptions; use parameterized log messages instead of string\n concatenation; extract the encrypted-root Option A/B logic into\n createEncryptedRootCoWClone / createEncryptedRootFullCopy.\n- RbdEncryption: use an instance logger (matching the plugin convention)\n and split argv construction into build{Format,Resize,Convert}Script so\n the generated commands can be unit-tested.\n\n* kvm: add RbdEncryption unit tests\n\nAssert the rbd/qemu-img argv built for format, resize and\nconvert-through-encryption (RBD and file sources), and that empty/null\npassphrases are rejected. Command construction is verified without a\nlive Ceph cluster.\n\n* kvm: refuse encrypted RBD hot-plug on libvirt \u003c 10.1.0\n\nlibvirt 10.0.0 has an object apply-order bug (fixed in 10.1.0) that breaks\nhot-plug of an encrypted rbd blockdev: on attach the disk is opened before its\nLUKS secret object is defined, so the attach fails with \"No secret with id\n\u0027...-format-encryption-secret0\u0027\". Booting a VM from an encrypted RBD disk is\nunaffected (the QEMU command line resolves all -object before -blockdev).\n\nRefuse the attach up front with a clear error (mirroring the existing\nopenvswitch/io_uring libvirt-version gates) instead of letting libvirt fail\nopaquely. Only the RBD hot-plug path is gated; boot/root/detach are untouched.\n\n* docs: add PendingReleaseNotes entry for librbd-encrypted RBD volumes\n\n* kvm: route the encrypted RBD template import through QemuImg\n\nRbdEncryption built its own \u0027qemu-img convert\u0027 command line, which\nduplicated qemu-img knowledge outside of QemuImg. QemuImg could only\nwrite to a plain filename destination, so importing a template through\nthe librbd encryption layer was not expressible with it.\n\nQemuImg now supports a destination described by image options\n(--target-image-opts, with -n implied since such a target always exists\nalready), exposed as convertIntoExistingTarget(). QemuImageOptions can\nrender its parameters under either image-opts flag.\n\nRbdEncryption.importTemplate now composes QemuImageOptions and a\nQemuObject secret and delegates to QemuImg; its hand-built convert\nscript is removed. The rbd CLI calls (encryption format, resize,\nsupport probe) stay, as qemu-img cannot perform them.\n\nNo functional change to the generated command.\n\n* kvm: use readable variable names in the encrypted RBD root helpers\n\nReview feedback: single-letter and abbreviated names are hard to read.\nRenamed in the two methods added by this PR only (renaming the rest of\nthe class is out of scope here): r -\u003e radosConnection, io -\u003e ioContext,\nrbd -\u003e rbdClient, base -\u003e templateImage, s -\u003e snapshotInfo, encSnap -\u003e\nluksReservedSnapshotName, haveEncSnap -\u003e luksSnapshotExists, createSize\n-\u003e imageSizeWithLuksHeader, srcIsRbd -\u003e sourceIsRbdPool.\n\nNo functional change.\n\n* server, kvm: report and require RBD volume encryption separately\n\nReview feedback: distinguish the two volume encryption mechanisms\ninstead of advertising them under one host flag.\n\nhost.volume.encryption goes back to meaning qemu-native LUKS only\n(qemu-img LUKS + cryptsetup), as it did before this PR, and hosts now\nadditionally report host.volume.encryption.rbd for librbd encryption\n(rbd encryption format).\n\nThe deployment planner requires the flag matching the pool type of each\nencrypted volume - librbd for volumes on RBD pools, qemu-native for any\nother pool type - at all three places it validated encryption support\nbefore. The pool is taken from the pools proposed alongside the host\nwhen present, so first deployments are matched accurately too; an\nencrypted volume with no pool yet accepts either mechanism and the\nstorage pool allocator picks a pool the host can serve.\n\nThis also stops a host whose librbd is too old for \u0027rbd encryption\nformat\u0027 from being selected for encrypted RBD volumes; it previously\nadvertised encryption through the qemu stack and the VM failed to\nstart.\n\n---------\n\nCo-authored-by: Václav Rozsypálek \u003cvaclav.rozsypalek@master.cz\u003e\nCo-authored-by: calvix \u003c7136358+calvix@users.noreply.github.com\u003e" }, { "commit": "79189c8d6a25a7b6f161704edcc1ed79977ed030", "tree": "833f1912a4811190ca572e87a4eb5bf6fccc6b93", "parents": [ "dc0ba1cba7475f2c5e0d6346a0e974549c35f00e" ], "author": { "name": "Wei Zhou", "email": "weizhou@apache.org", "time": "Tue Sep 15 13:46:07 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 15 13:46:07 2026 +0200" }, "message": "backup: remove the powered-off precondition for all backup providers (#14094)" }, { "commit": "10037c85d61f9c79e0b357aa5a4f372940ad56d2", "tree": "c233225024e3e225b7c242b6a1b9b7f2c950a157", "parents": [ "e38b7a724b1505d6052d1bc24cedca4601b60f48" ], "author": { "name": "Abhisar Sinha", "email": "63767682+abh1sar@users.noreply.github.com", "time": "Tue Sep 15 11:34:51 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 15 08:04:51 2026 +0200" }, "message": "Nas backup: Fix mount/unmount error handling and timeout in LibvirtRestoreBackupCommandWrapper (#14006)\n\n* kvm: detect mount failures and honour the configured timeouts on backup restore\n\nScript.executeCommand returns null when the command fails, it does not throw,\nso the try/catch around the mount and umount of the backup repository could\nnever fire and the return value was discarded. A repository that fails to mount\nwas therefore treated as mounted, and the restore carried on against an empty\ndirectory until it failed later with a misleading \"backup file not found\". A\nfailed umount was ignored the same way, leaking the mount. Both now go through\nexecuteCommandForExitValue and check the exit value.\n\nThe same refactor also dropped the timeouts. mountTimeout was still passed into\nmountBackupDirectory but never used, and the rsync of the volume lost the\ncommand timeout, so both fell back to the one hour default in Script instead of\nthe configured values. An unresponsive repository could hold a restore up for\nan hour rather than failing after nas.backup.restore.mount.timeout seconds.\n\n* kvm: clean up after a failed mount and bound the unmount of a backup repository\n\nThe directory created for the mount is removed by the caller in a finally block,\nbut that block is only reached once the mount has succeeded, so a repository\nthat cannot be mounted left an empty directory behind on every attempt. It is\nnow removed before the failure is reported, best effort and logged if it cannot\nbe.\n\nThe unmount ran without a timeout and so fell back to the one hour default in\nScript. Unmounting a repository that has become unreachable blocks as easily as\nmounting one, and this runs in the cleanup path of a restore, so it is now\nbounded by the configured mount timeout like the mount itself." }, { "commit": "e38b7a724b1505d6052d1bc24cedca4601b60f48", "tree": "46d84e3aa54b631e49bb662c3e85e704ce719a48", "parents": [ "a01fb0be34b2774d8fb7853703b36364444398e4" ], "author": { "name": "Brad House - Nexthop", "email": "bhouse@nexthop.ai", "time": "Mon Sep 14 04:38:11 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 14 10:38:11 2026 +0200" }, "message": "kvm: apply rbd_default_data_pool when creating volumes from templates on RBD (#13361)\n\nRBD erasure-coded pool support (#9808) added handling of the\nrbd_default_data_pool storage-pool detail to RBDStringBuilder (qemu-img\npath) and to createPhysicalDisk (blank volumes), but not to\ncreateDiskFromTemplateOnRBD. As a result, ROOT volumes created from a\ntemplate via rados-java rbd.clone()/rbd.create() are created without a\ndata pool: all of their data objects land in the (replicated) metadata\npool instead of the erasure-coded data pool, defeating the point of EC\nand consuming ~3x raw space.\n\nSet rbd_default_data_pool on the Rados connection (before connect) in\nboth the same-cluster clone/copy branch and the cross-cluster copy\nbranch of createDiskFromTemplateOnRBD, using the destination pool\u0027s\ndetail. librbd then honors it as the default data pool when the new\nimage is created, so template-derived volumes get data_pool set, the\nsame way blank volumes already do." }, { "commit": "8eeccdbb8a24ad68978a153dc929fc705a027d53", "tree": "9a5c34b5a32d66dc31c759fa06350b197f5bcafa", "parents": [ "8261beca2fb4415015450f78fbf24c6c679abce3" ], "author": { "name": "dahn", "email": "daan@onecht.net", "time": "Mon Sep 14 10:34:23 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 14 14:04:23 2026 +0530" }, "message": "UI: don’t continue with session with an expired userid (#13969)" }, { "commit": "a01fb0be34b2774d8fb7853703b36364444398e4", "tree": "22fd4fb76f826dcdacd5637ae7dae356dcd4bb39", "parents": [ "2e450cbddf3de727991e7837ccb2562642df0c49" ], "author": { "name": "Wei Zhou", "email": "weizhou@apache.org", "time": "Mon Sep 14 08:05:13 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 14 08:05:13 2026 +0200" }, "message": "server: copy template details to vm instance details when import VM (#12793)" }, { "commit": "2e450cbddf3de727991e7837ccb2562642df0c49", "tree": "b8e855f20de0b1e076e3820e44eee4aabb1719fc", "parents": [ "9030443eac555c26b06bbf8e82249f2aac385fcc" ], "author": { "name": "Wei Zhou", "email": "weizhou@apache.org", "time": "Mon Jul 13 09:40:20 2026 +0200" }, "committer": { "name": "Wei Zhou", "email": "weizhou@apache.org", "time": "Sat Sep 12 10:47:01 2026 +0200" }, "message": "marvin: use pycryptodome instead of PyCrypt (#13594)" }, { "commit": "dc0ba1cba7475f2c5e0d6346a0e974549c35f00e", "tree": "47d57e4f0f83fd569f2a0fea33ce9933f05ed17f", "parents": [ "72014a0221ca825429ab8a15e8bbdc70898d972d" ], "author": { "name": "Brad", "email": "100990646+Dogface2k@users.noreply.github.com", "time": "Fri Sep 11 21:05:07 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 11 22:05:07 2026 +0200" }, "message": "Packaging: accept normalized Marvin archive names (#13793)\n\n* packaging: accept normalized Marvin archive name\n\n* packaging: accept normalized Marvin archives in RPMs\n\nUse [Mm]arvin-*.tar.gz when copying, listing and installing the\nMarvin archive in the EL8 and SUSE15 RPM specs. Keep legacy\nuppercase archive names supported.\n\nTighten the Debian manifest to the same version-delimited pattern." }, { "commit": "9030443eac555c26b06bbf8e82249f2aac385fcc", "tree": "e6eb543ff30ae890afe707d425d7225b294c12a7", "parents": [ "90180340814caff147b5a8efbda2641877eafe83" ], "author": { "name": "Abhisar Sinha", "email": "63767682+abh1sar@users.noreply.github.com", "time": "Fri Sep 11 20:14:32 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 11 17:44:32 2026 +0300" }, "message": "SharedFS: fix NPE when accessing systemvm templates for unsupported hypervisors (#13930)\n\n* fix NPE when accessing systemvm templates for unsupported hypervisors in deploySharedFSVM()\n\n* systemvm -\u003e SystemVM\n\nCo-authored-by: Copilot Autofix powered by AI \u003c175728472+Copilot@users.noreply.github.com\u003e\n\n* Add unit test for skip-hypervisor-without-template fix in deploySharedFSVM()\n\n* sharedfs: drop duplicate skip-hypervisor test after 4.22 merge\n\n---------\n\nCo-authored-by: Copilot Autofix powered by AI \u003c175728472+Copilot@users.noreply.github.com\u003e" }, { "commit": "8261beca2fb4415015450f78fbf24c6c679abce3", "tree": "267dfb0052d7f7bc40da03577b7ea64485cb9844", "parents": [ "a4d3c664823f428abc1ca402772861e937928345" ], "author": { "name": "Abhishek Kumar", "email": "abhishek.mrt22@gmail.com", "time": "Fri Sep 11 16:08:56 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 11 16:08:56 2026 +0530" }, "message": "ui: fix info card showing invalid template, iso link (#13199)\n\nTemplate/ISO for a VM could be in deleted state therefore links should not be shown for them in the VM info-card.\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e" }, { "commit": "a4d3c664823f428abc1ca402772861e937928345", "tree": "832685f9834c5198fe0a3e077f70922355ff3a7a", "parents": [ "b93f603d315ceeadf3bba375e1f28bb3a3695a6c" ], "author": { "name": "James Peru Mmbono", "email": "jmsperu@gmail.com", "time": "Fri Sep 11 12:51:00 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 11 15:21:00 2026 +0530" }, "message": "KVM: assign the hot-plugged NIC the next PCI slot above existing NICs (monotonic interface naming) (#12826)\n\n* KVM: assign explicit PCI slot when hot-plugging NIC to ensure sequential naming\n\nWhen hot-plugging a NIC to a running VM, libvirt auto-assigns the next\nfree PCI slot. Since non-NIC devices (virtio-serial, disk, balloon,\nwatchdog) occupy slots immediately after existing NICs, the hot-plugged\nNIC gets a much higher slot number (e.g. 0x09 instead of 0x05), causing\nthe guest to see non-sequential interface names (ens9 instead of ens5).\n\nThis fix queries the domain XML to find all used PCI slots and assigns\nthe next free slot after the highest existing NIC slot. This matches\nthe approach already used by LibvirtReplugNicCommandWrapper which\npreserves PCI slots during re-plug operations.\n\nFixes #12825\n\nCo-Authored-By: Claude Opus 4.6 \u003cnoreply@anthropic.com\u003e\n\n* fix(kvm): NPE in PlugNic when libvirt domain XML is unavailable\n\nLibvirtPlugNicCommandWrapper.findNextAvailablePciSlot calls\nvm.getXMLDesc(0) and pipes the result straight into Pattern.matcher,\nwhich NPEs if libvirt returned null (or, in the\nLibvirtComputingResourceTest.testPlugNicCommandNoMatchMack unit test,\nwhen the Domain mock isn\u0027t stubbed for getXMLDesc). Reported by\n@DaanHoogland after the SL packaging run on #12826.\n\nDefensive null check returns null from findNextAvailablePciSlot when\nthe domain XML can\u0027t be parsed, which falls through to libvirt\u0027s\nauto-assignment of the PCI slot — same behaviour as before this PR\nwhen nextSlot is null.\n\nAlso stubs Domain.getXMLDesc(0) in testPlugNicCommandNoMatchMack with\na minimal \u003cdomain\u003e XML that exercises the parser path (rather than\njust relying on the null-fallback), so the test continues to cover\nthe happy path of the new logic.\n\n* address review (#12826): parse PCI addresses with an XML parser, split slot selection into helpers, add unit tests\n\n- getUsedPciSlots() parses the domain XML with the safer DocumentBuilderFactory\n and only considers \u003caddress type\u003d\u0027pci\u0027\u003e elements, replacing the regex.\n- getHighestNicSlot() and getFirstFreeSlotAbove() are separate methods.\n- The javadoc now states the guarantee precisely: deterministic and monotonic\n after the last NIC, not contiguous when other devices sit in between.\n- LibvirtPlugNicCommandWrapperTest covers parsing, selection and the fallbacks.\n\nSigned-off-by: James Peru \u003cjmsperu@gmail.com\u003e\n\n---------\n\nSigned-off-by: James Peru \u003cjmsperu@gmail.com\u003e\nCo-authored-by: James Peru \u003cjamesperu@Jamess-Mac-mini.local\u003e\nCo-authored-by: Claude Opus 4.6 \u003cnoreply@anthropic.com\u003e\nCo-authored-by: jmsperu \u003cjmsperu@users.noreply.github.com\u003e" }, { "commit": "90180340814caff147b5a8efbda2641877eafe83", "tree": "8393ce0bb9e7b8c198efd7b6352aabc86dc5c10d", "parents": [ "b9a5977a2bbafd5ed178ae392c129a0cdc4930f6" ], "author": { "name": "John Bampton", "email": "jbampton@users.noreply.github.com", "time": "Fri Sep 11 17:35:59 2026 +1000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 11 13:05:59 2026 +0530" }, "message": "Add basic `.editorconfig` file to help maintain consistent coding styles (#7562)\n\n* Add basic `.editorconfig` file to help maintain consistent coding styles" }, { "commit": "72014a0221ca825429ab8a15e8bbdc70898d972d", "tree": "e6c5891d248d62e30c387cc242b8d2c657429969", "parents": [ "4ce5291f7090768b89fda619c1403fd772c6c357" ], "author": { "name": "Pearl Dsilva", "email": "pearl1594@gmail.com", "time": "Thu Sep 10 13:51:42 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 10 19:51:42 2026 +0200" }, "message": "Fix KvmFileBasedStorageVmSnapshotStrategy unit test failures (#14135)" }, { "commit": "b9a5977a2bbafd5ed178ae392c129a0cdc4930f6", "tree": "f65f0a5eeb56c65afff948c709c218f0e787cbae", "parents": [ "d0d49bc864ad2558671552d6f526a1137cba5aea" ], "author": { "name": "water", "email": "672684719@qq.com", "time": "Thu Sep 10 23:06:07 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 10 17:06:07 2026 +0200" }, "message": "fix: use auth_client_required instead of removed auth_supported for RBD (#13991)\n\nCeph Tentacle 20.2.4 removed the legacy `auth_supported` librados option.\nCloudStack builds RBD connection strings with `auth_supported\u003dcephx`/`none`,\nso every RBD operation through the KVM agent fails with\n\"failed to set RADOS option: auth_supported\".\n\nSwitch the RBD string builder to `auth_client_required`, the modern option\nused by the qemu rbd driver and accepted by current Ceph releases.\n\nCo-authored-by: Wei Zhou \u003cweizhou@apache.org\u003e" }, { "commit": "4ce5291f7090768b89fda619c1403fd772c6c357", "tree": "f96b34d8fe14ec38725ff2a1081cc3d17081fe9c", "parents": [ "7516e532f978bdde89024ab5c2a42acccaac6533", "d0d49bc864ad2558671552d6f526a1137cba5aea" ], "author": { "name": "João Jandre", "email": "48719461+JoaoJandre@users.noreply.github.com", "time": "Thu Sep 10 11:11:08 2026 -0300" }, "committer": { "name": "João Jandre", "email": "48719461+JoaoJandre@users.noreply.github.com", "time": "Thu Sep 10 11:11:08 2026 -0300" }, "message": "Merge branch \u00274.22\u0027\n" }, { "commit": "d0d49bc864ad2558671552d6f526a1137cba5aea", "tree": "c9e60285335b346e458e512f62d2a38bec2f278b", "parents": [ "02da97d172c422f5e9519e5e0a9ad16fb5302e12" ], "author": { "name": "Abhishek Kumar", "email": "abhishek.mrt22@gmail.com", "time": "Thu Sep 10 18:12:27 2026 +0530" }, "committer": { "name": "Abhishek Kumar", "email": "abhishek.mrt22@gmail.com", "time": "Thu Sep 10 18:12:27 2026 +0530" }, "message": "ui: fix build\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e\n" }, { "commit": "02da97d172c422f5e9519e5e0a9ad16fb5302e12", "tree": "0dbe04c540236313306a83414a871b2f3fd53d32", "parents": [ "17098c15eb322220a9fde12b8156f3aa1c195641", "b93f603d315ceeadf3bba375e1f28bb3a3695a6c" ], "author": { "name": "Abhishek Kumar", "email": "abhishek.mrt22@gmail.com", "time": "Thu Sep 10 17:04:00 2026 +0530" }, "committer": { "name": "Abhishek Kumar", "email": "abhishek.mrt22@gmail.com", "time": "Thu Sep 10 17:04:00 2026 +0530" }, "message": "Merge remote-tracking branch \u0027apache/4.20\u0027 into 4.22\n" }, { "commit": "7516e532f978bdde89024ab5c2a42acccaac6533", "tree": "45cd1379c516f867d92350a829b69568c54b5971", "parents": [ "8afd1148a2b4cde3d59406ddf936c876016f7f97" ], "author": { "name": "John Bampton", "email": "jbampton@users.noreply.github.com", "time": "Thu Sep 10 21:33:45 2026 +1000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 10 13:33:45 2026 +0200" }, "message": "Add the pre-commit ecosystem to Dependabot (#14110)" }, { "commit": "8afd1148a2b4cde3d59406ddf936c876016f7f97", "tree": "d7c12fccccf9fd52302e6cd0a777e0328c65cc55", "parents": [ "e0f3006764d00f18a59945861b50bf55d01f64eb" ], "author": { "name": "dahn", "email": "daan@onecht.net", "time": "Thu Sep 10 12:02:44 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 10 12:02:44 2026 +0200" }, "message": "Revert \"Network: default egress policy Allow for Isolated networks on fresh i…\" (#14116)\n\nThis reverts commit e0f3006764d00f18a59945861b50bf55d01f64eb." }, { "commit": "17098c15eb322220a9fde12b8156f3aa1c195641", "tree": "ce6e0088522f6c422f3ef79c95461ce569c575ad", "parents": [ "af8691c6a95ffa67e7da37f4aa9b8c7da1bf83db" ], "author": { "name": "Guillem", "email": "guillemtanya@gmail.com", "time": "Thu Sep 10 11:56:22 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 10 06:56:22 2026 -0300" }, "message": "Fix lscpu speed checking order (#12190)" }, { "commit": "af8691c6a95ffa67e7da37f4aa9b8c7da1bf83db", "tree": "62ba50d082fbdb4e3902b791068265a2823286c7", "parents": [ "c467686e4b929234c40f61cc191ab8a41dc889f1" ], "author": { "name": "Wei Zhou", "email": "weizhou@apache.org", "time": "Thu Sep 10 11:21:27 2026 +0200" }, "committer": { "name": "Wei Zhou", "email": "weizhou@apache.org", "time": "Thu Sep 10 11:21:27 2026 +0200" }, "message": "Routed: get vm network statistics on Routed network (#13105)\n\n* Routed: get vm network statistics on Routed network\n\n* Potential fix for pull request finding\n\n* Create method isNetworkEligibleForNetworkStats and add unit tests\n" }, { "commit": "c467686e4b929234c40f61cc191ab8a41dc889f1", "tree": "0eb09019b75e07b51c92b492e1ae450e358ce107", "parents": [ "10d3e115122e4e253c098ce30a76b0bf0ab0c689" ], "author": { "name": "Nicolas Vazquez", "email": "nicovazquez90@gmail.com", "time": "Thu Sep 10 04:11:40 2026 -0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 10 12:41:40 2026 +0530" }, "message": "[ConsoleProxy] Performance fixes on concurrency and closing console sessions sockets and introduce reconnection window for console sessions (#13683)\n\n* Add lock and synchronize allowed sessions\n\n* Fix closing connections to VNC ports on console close\n\n* Add reconnection grant window to prevent network connectivity issues after acquiring a session\n\n* Introduce zone setting to control the reconnection window for console sessions" }, { "commit": "b93f603d315ceeadf3bba375e1f28bb3a3695a6c", "tree": "467f1bdc270632864c36838f0417ebdc905c427d", "parents": [ "6e4413d59b771d770dca6aa74d4454016b65f720" ], "author": { "name": "Ramgopal Nagaboina", "email": "ramgopal.nagaboina.dev@gmail.com", "time": "Thu Sep 10 03:11:28 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 10 12:41:28 2026 +0530" }, "message": "api: fix inverted value comparison in ImageStoreDetailResponse.equals (#14023)\n\nequals() returned false when the two responses had the SAME value and true\nwhen the values DIFFERED (the value branch was inverted):\n\n else if (this.getValue().equals(other.getValue()))\n return false;\n\nSo two identical details were treated as unequal and two details differing\nonly by value were treated as equal, corrupting any Set/Map/dedup keyed on\nImageStoreDetailResponse. It also NPEd when value was null.\n\nCompare with !Objects.equals(getValue(), other.getValue()), which restores\nthe correct result and is null-safe.\n\nAdds tests for equal name+value, differing value, and differing name." }, { "commit": "e0f3006764d00f18a59945861b50bf55d01f64eb", "tree": "5957bc966368d5e4dad0f8db997520f52fed5b57", "parents": [ "76b285bcd6d1561f3ea62a6e6e0f3740e1fe5e22" ], "author": { "name": "Andrija Panic", "email": "45762285+andrijapanicsb@users.noreply.github.com", "time": "Thu Sep 10 09:05:38 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 10 09:05:38 2026 +0200" }, "message": "Network: default egress policy Allow for Isolated networks on fresh installations (#13684)" }, { "commit": "76b285bcd6d1561f3ea62a6e6e0f3740e1fe5e22", "tree": "d7c12fccccf9fd52302e6cd0a777e0328c65cc55", "parents": [ "036493fd0149f8b3e639685be338ca5af2c6f1bd" ], "author": { "name": "Saurabh Kushwaha", "email": "126544940+saurabhkushwaha438@users.noreply.github.com", "time": "Thu Sep 10 11:19:54 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 10 11:19:54 2026 +0530" }, "message": "ui: implement event auto-suggestion in webhook filter tab (#13227)" }, { "commit": "6e4413d59b771d770dca6aa74d4454016b65f720", "tree": "4f485493cfeec943108b185ed63dc89998c70554", "parents": [ "1f761f0853afdcc23793c3e879f95c206c54b22e" ], "author": { "name": "Ramgopal Nagaboina", "email": "ramgopal.nagaboina.dev@gmail.com", "time": "Wed Sep 09 13:38:51 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 09 19:38:51 2026 +0200" }, "message": "engine: do not stall the host command queue on a failed send in AgentAttache.sendNext (#14040)" }, { "commit": "1f761f0853afdcc23793c3e879f95c206c54b22e", "tree": "45bf2dbc8100c35ea6405a24c819bd04fb745d91", "parents": [ "9c8bdf358432753be10346853c2ef183c5a9ad86" ], "author": { "name": "Vishesh", "email": "8760112+vishesh92@users.noreply.github.com", "time": "Wed Sep 09 22:31:44 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 09 19:01:44 2026 +0200" }, "message": "Update pmd config to make it pmd 7 compatible (#13168)" }, { "commit": "036493fd0149f8b3e639685be338ca5af2c6f1bd", "tree": "7c8d74582be311bead38a7ca07aec09e324153ab", "parents": [ "c77e16a7feb6816e07f624b068c67835db23b98f" ], "author": { "name": "dahn", "email": "daan@onecht.net", "time": "Wed Sep 09 18:28:58 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 09 18:28:58 2026 +0200" }, "message": "Fix backup type parameter version number in ListBackupsCmd (#14078)" }, { "commit": "10d3e115122e4e253c098ce30a76b0bf0ab0c689", "tree": "fc54021820799ca66cbce2a88cc7c01ae7f2ffa3", "parents": [ "a9b2f333d13186adb6ffaf4183eab2134952ce05" ], "author": { "name": "Kunal Behbudzade", "email": "121988281+Kunalbehbud@users.noreply.github.com", "time": "Wed Sep 09 17:25:48 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 09 16:25:48 2026 +0200" }, "message": "KVM: fix UEFI disk-only instance snapshot NVRAM handling (#13020)\n\nSigned-off-by: kunal.behbudzade \u003ckunal.behbudzade@btsgrp.com\u003e\nCo-authored-by: kunal.behbudzade \u003ckunal.behbudzade@btsgrp.com\u003e" }, { "commit": "c77e16a7feb6816e07f624b068c67835db23b98f", "tree": "4bd1becd48f15405647edca3077996cbf0c7c783", "parents": [ "cddd2c6e57b85396b9836cc222f34fa285218b5a" ], "author": { "name": "Manoj Kumar", "email": "manojkr.itbhu@gmail.com", "time": "Wed Sep 09 18:42:55 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 09 15:12:55 2026 +0200" }, "message": "update comments and exception related to kvm.snapshot.enabled configuration (#13733)" }, { "commit": "9c8bdf358432753be10346853c2ef183c5a9ad86", "tree": "7e5f826bb062293e33bb9599afdb64fdcba3254d", "parents": [ "245bbd9fe646b1489010ef065d94d62a183f1acd" ], "author": { "name": "Ramgopal Nagaboina", "email": "ramgopal.nagaboina.dev@gmail.com", "time": "Wed Sep 09 08:09:47 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 09 17:39:47 2026 +0530" }, "message": "config: persist config subgroups with their name and group id (#14050)\n\ncreateOrupdateConfigObject created a missing configuration subgroup with the\nno-arg ConfigurationSubGroupVO constructor, so the row was written with a null\nname and null group_id. Because the name stayed null, the next\nfindByNameAndGroup lookup missed again and inserted another null row on every\nmanagement-server restart. Build the subgroup with its name and precedence and\nset its group id, matching the sibling configuration-group branch." }, { "commit": "cddd2c6e57b85396b9836cc222f34fa285218b5a", "tree": "3b12ab9ccc18ada7e0172afb91a138b86684e8d2", "parents": [ "068d393d0120189ad4220594d9503df04a091076" ], "author": { "name": "Dheeraj Bansal", "email": "dheerajbansal387@gmail.com", "time": "Wed Sep 09 17:06:12 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 09 17:06:12 2026 +0530" }, "message": "Add timestamps to management, server and agent .err logs (#12967)\n\n* Add timestamps to management, server and agent .err logs\n\n* Add timestamps to stderr console logs for agent, management and API server\n\n* usage: add timestamped stderr console logging\n\n* WIP: console proxy timeout changes\n\n* Clean up whitespace in log4j config files" }, { "commit": "068d393d0120189ad4220594d9503df04a091076", "tree": "468da60d8578f91a72c4ff6e33dc5d05fa7200b8", "parents": [ "bd35fb6f4b349fc71303e15ff748545f36ede78f" ], "author": { "name": "dahn", "email": "daan@onecht.net", "time": "Wed Sep 09 12:34:08 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 09 12:34:08 2026 +0200" }, "message": "allow update of ldap linked account (#13949)\n\nCo-authored-by: Daan Hoogland \u003cdahn@apache.org\u003e" }, { "commit": "a9b2f333d13186adb6ffaf4183eab2134952ce05", "tree": "8523bfbfb9fe80e578dfd21b20c5fd004d12da67", "parents": [ "c7f2efad719cf577806428bcc13628cacbf6842c" ], "author": { "name": "Fabricio Duarte", "email": "fabricio.duarte.jr@gmail.com", "time": "Wed Sep 09 07:33:53 2026 -0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 09 16:03:53 2026 +0530" }, "message": "ui: filter accessible pools on live migration with storage wizard (#14064)\n\nThe \"Migrate instance to another host\" wizard lets an operator pick a destination host and, optionally, a destination\nprimary storage. Today the storage list is not filtered by the selected host, so it offers primary storages the host cannot reach. This filters that list down to the storages actually accessible to the selected host." }, { "commit": "c7f2efad719cf577806428bcc13628cacbf6842c", "tree": "7e485440e14fa190180107dee26dfa64da042281", "parents": [ "74e7105c9a57bd61e394722f09030401ed645021" ], "author": { "name": "Abhisar Sinha", "email": "63767682+abh1sar@users.noreply.github.com", "time": "Wed Sep 09 15:14:49 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 09 11:44:49 2026 +0200" }, "message": "kvm: fix restore-and-attach of a backed up volume (#14007)\n\nRestoring a volume from a backup and attaching it to a VM has been broken\nsince the restore commands were changed to run without a shell, in three\nindependent ways.\n\ngetDeviceToAttachDisk pipes virsh domblklist through awk, but passes the awk\nprogram still wrapped in the single quotes a shell would have stripped. Run\ndirectly, awk fails with \"invalid char\" and returns nothing, so the device\nname is empty and charAt throws StringIndexOutOfBoundsException before any\nattach is attempted. This affects every storage type. The exit value was also\nnever checked, and the output not trimmed, so even a working awk would leave\nthe trailing line separator and increment that instead of the device letter.\n\nThe RBD branch passes the literal string \"\u003c\u003cEOF%sEOF\" as a virsh argument. The\nplaceholder is never substituted with the disk XML, and a here-document cannot\nwork without a shell, so virsh is handed a bogus argument and fails. The XML is\nnow written to a temporary file that virsh reads.\n\nThe Linstor branch declares \"--subdriver qcow2\", inverting the previous\nbehaviour where Linstor got a raw attach and every other pool got qcow2. A\nLinstor volume is a raw DRBD block device, so libvirt rejects it with \"Image is\nnot in qcow2 format\". The condition is restored, along with the \"--driver qemu\"\nthat was dropped." }, { "commit": "bd35fb6f4b349fc71303e15ff748545f36ede78f", "tree": "42b038ff534a89a59293591790d961cc4c102357", "parents": [ "d87c8049aae4be06e33ded7cf2dd6e61db0eea5b" ], "author": { "name": "Andrija Panic", "email": "45762285+andrijapanicsb@users.noreply.github.com", "time": "Wed Sep 09 11:01:42 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 09 14:31:42 2026 +0530" }, "message": "KVM: default x86 guests to vga video model when none is configured (#13807)\n\nWithout an explicit video model (vm.video.hardware agent property or\nvideo.hardware VM detail), CloudStack emits no \u003cvideo\u003e element and libvirt\ndefaults x86 guests to cirrus, which is deprecated in QEMU and renders a\nblank console on Windows Server 2025 Core guests. Default unconfigured x86\nguests to vga with 32 MiB of VRAM instead. Explicit VM details and agent\nproperties keep precedence; non-x86 guests (aarch64, s390x) are unchanged.\n\nFixes #13806" }, { "commit": "245bbd9fe646b1489010ef065d94d62a183f1acd", "tree": "96cb38929c76454da680e85111b49edd521a45c9", "parents": [ "215ef984993509bbb068f52c24b446be708c8dba" ], "author": { "name": "Ramgopal Nagaboina", "email": "ramgopal.nagaboina.dev@gmail.com", "time": "Wed Sep 09 04:35:24 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 09 10:35:24 2026 +0200" }, "message": "server: null-check public IP before the DNS/Source NAT guard in createPublicLoadBalancerRule (#14027)\n\ncreatePublicLoadBalancerRule resolved ipVO only when an ipAddrId was supplied,\nthen at the port-53 check did (srcPortStart \u003d\u003d DNS_PORT \u0026\u0026 ipVO.isSourceNat()).\nFor an elastic-LB rule created without an explicit IP (ipAddrId \u003d\u003d null) the\nsystem IP is allocated later, so ipVO was still null and creating a rule on\nport 53 threw a NullPointerException. The ipVO \u003d\u003d null validation only runs\nfurther down.\n\nGuard the check with ipVO !\u003d null so the DNS/Source NAT conflict test is\nskipped when there is no IP yet; the flow then reaches the existing\ncan\u0027t-find-source-IP parameter error.\n\nAdds a regression test creating a port-53 rule with a null ipAddrId\n(NullPointerException before the fix)." }, { "commit": "215ef984993509bbb068f52c24b446be708c8dba", "tree": "fda4f26ffceb4ad5fb531fd320f11c93aca1e6ec", "parents": [ "223351c7a59ec9509b25a6122340abcb8cbbd451" ], "author": { "name": "Pearl Dsilva", "email": "pearl1594@gmail.com", "time": "Wed Sep 09 00:53:26 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 09 10:23:26 2026 +0530" }, "message": "Allow cleaning up of networks stuck in Implementing state (#12409)\n\n* Allow cleaning up of networks stuck in Implementing state\n\n* extract code" }, { "commit": "74e7105c9a57bd61e394722f09030401ed645021", "tree": "6017bd5155762eae143ac78b3e9e7ed02666e36f", "parents": [ "f493d993dbf786a06f13222ff37ecce69a6cc8e5" ], "author": { "name": "Brad", "email": "100990646+Dogface2k@users.noreply.github.com", "time": "Tue Sep 08 20:20:52 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 08 15:20:52 2026 -0400" }, "message": "ui: show selected template hypervisor in deploy form (#13813)" }, { "commit": "223351c7a59ec9509b25a6122340abcb8cbbd451", "tree": "67c9a9fe26287998645bc50f4cc99cf2dd67a8fa", "parents": [ "bbf8c1a05cabe14c75fe73b4bc5feb20aedbfccb" ], "author": { "name": "Erik Böck", "email": "89930804+erikbocks@users.noreply.github.com", "time": "Tue Sep 08 10:30:44 2026 -0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 08 16:30:44 2026 +0300" }, "message": "Add VR\u0027s system offering to network listing (#12862)\n\n* Add VR system offering to network offerings listing\n\n* Change method to display order column as the last one\n\n* Remove VR\u0027s service offering id and name from non-admin users\n\n* Removal of domain column and addition of Egress default policy column\n\n* Revert domain removal" }, { "commit": "d87c8049aae4be06e33ded7cf2dd6e61db0eea5b", "tree": "5ba2465e5a1b483600cdccb80ea988590e7a32c2", "parents": [ "5c97979d458f23f608f120011d727474a4f9abf6" ], "author": { "name": "Wido den Hollander", "email": "wido@widodh.nl", "time": "Tue Sep 08 14:12:47 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 08 14:12:47 2026 +0200" }, "message": "kvm: let libvirt remove RBD snapshots on volume delete (#13763)\n\nLibvirtStorageAdaptor#deletePhysicalDisk manually connected to Ceph via\nlibrados/librbd to unprotect and remove every snapshot of an RBD image\nbefore asking libvirt to delete the volume. libvirt\u0027s RBD storage\nbackend has supported VIR_STORAGE_VOL_DELETE_WITH_SNAPSHOTS since\n1.2.20, which does the same unprotect/remove internally. Pass that\nflag instead and drop the manual cleanup." }, { "commit": "f493d993dbf786a06f13222ff37ecce69a6cc8e5", "tree": "171ee1219547e467274805bd6f41bad929c44f0f", "parents": [ "c860e0c214e6377399c3d4b9c64798286df360d9" ], "author": { "name": "Brad", "email": "100990646+Dogface2k@users.noreply.github.com", "time": "Tue Sep 08 13:12:26 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 08 14:12:26 2026 +0200" }, "message": "sharedfs: skip hypervisors without system templates (#13830)" }, { "commit": "c860e0c214e6377399c3d4b9c64798286df360d9", "tree": "464e06a7a02959080492fd9c6e7459561e6dcbba", "parents": [ "cdbda0ae158fd9cdee6850f61f5b943bccdb1f26" ], "author": { "name": "calvix", "email": "rozsypalek.vaclav@gmail.com", "time": "Tue Sep 08 14:12:07 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 08 14:12:07 2026 +0200" }, "message": "kvm: fix RBD exclusive-lock leak that breaks revertSnapshot on Ceph (#13835)\n\n* kvm: fix RBD exclusive-lock leak that breaks revertSnapshot on Ceph\n\ntakeRbdVolumeSnapshotOfStoppedVm() called image.snapCreate(snapshotName)\ntwice. The first call creates the RBD snapshot, the second one always\nthrows RbdException (\"Failed to create snapshot \u003cuuid\u003e\") because the\nsnapshot already exists.\n\nThe duplicate is a merge artifact: 30d306622a9 (\"Merge branch \u00274.20\u0027 into\n4.22\") resolved a conflict by keeping the call from both sides - each\nparent had exactly one.\n\nBecause there was no finally block, that exception skipped rbd.close(image)\nand r.ioCtxDestroy(io), so the agent kept the image open and held its RBD\nexclusive-lock indefinitely. The exception is only logged, so the snapshot\njob still reported success and the fault stayed invisible.\n\nConsequences observed on a KVM + Ceph/RBD cluster:\n\n- revertSnapshot fails with \"com.ceph.rbd.RbdException: Failed to rollback\n snapshot \u003cuuid\u003e\". librbd returns EROFS because a live peer holds the\n exclusive-lock; \u0027rbd snap rollback\u0027 only succeeds once that client dies\n and librbd can break the lock, which makes the failure look intermittent.\n- getRbdSnapshotSize() is never reached, so every snapshot is reported with\n physical size 0 when snapshot.backup.to.secondary is false.\n- The leaked watchers keep the image busy, so \u0027rbd rm\u0027 fails and the volume\n cannot be expunged - it stays stuck in state Destroy.\n\nNote the method also runs for RUNNING VMs: createSnapshot() branches on\n\"RUNNING \u0026\u0026 !primaryPool.isExternalSnapshot()\", and RBD is an\nexternal-snapshot pool, so every RBD volume snapshot took this path.\n\nRemove the duplicated call and move the image/IO-context cleanup into a\nfinally block so the lock is released even if the snapshot itself fails.\n\n* kvm: release RBD handles on every path when cloning a volume from a snapshot\n\ncreateRBDvolumeFromRBDSnapshot() closed the source image, the cloned image\nand the RADOS IO context only on the success path, and called snapUnprotect()\nonly there too. Two paths escaped that cleanup:\n\n- the early \"Could not find snapshot ... on RBD\" return, and\n- any RadosException/RbdException from clone(), resize() or flatten(), which\n is caught and turned into a null disk.\n\nBoth leave the images open, so this client keeps the RBD exclusive-lock. That\nlater makes \u0027rbd snap rollback\u0027 (revertSnapshot) fail with EROFS from another\nhost, and keeps the image busy so \u0027rbd rm\u0027 cannot remove it - the volume then\nstays stuck in state Destroy.\n\nThe failure paths after snapProtect() are worse: the snapshot stays protected,\nand a protected snapshot can be deleted neither on its own nor together with\nits volume.\n\nMove the cleanup into a finally block, tracking whether the snapshot was\nactually protected so it is unprotected exactly when it needs to be. Failures\nduring cleanup are logged and never mask the original outcome; a failed\nsnapUnprotect is logged at ERROR since it needs manual intervention.\n\nThis is the same class of defect as the leak fixed in\ntakeRbdVolumeSnapshotOfStoppedVm(); no behaviour changes on the success path.\n\n* kvm: add regression tests for the RBD snapshot handle leak\n\nTwo tests around takeRbdVolumeSnapshotOfStoppedVm, using the MockedConstruction\npattern already used in this test class (the Rbd instance is created inside the\nmethod under test, so it cannot be injected):\n\n- createsSnapshotExactlyOnce guards the duplicated snapCreate call from coming\n back, and checks the image and IO context are released.\n- releasesHandlesWhenSnapshotFails makes snapCreate throw and asserts the image\n is still closed and the IO context destroyed, so a future failure cannot leak\n the RBD exclusive-lock again.\n\ntakeRbdVolumeSnapshotOfStoppedVm, radosConnect and getRbdSnapshotSize widened\nfrom private to protected so the test can stub the Ceph interactions.\n\n* kvm: extract RBD handle teardown into null-safe helper methods\n\nAddress review feedback: the nested try-catch teardown blocks in the\nfinally clauses of takeRbdVolumeSnapshotOfStoppedVm and\ncreateRBDvolumeFromRBDSnapshot are extracted into two reusable,\nnull-safe helpers that log but never throw:\n\n- closeRbdImage (3 call sites)\n- destroyRadosIoCtx (2 call sites)\n\nNo behavior change.\n\n* kvm: extract RBD snapshot unprotect into a helper method\n\nFollow-up to the teardown helpers: the snapUnprotect block in the\nfinally clause of createRBDvolumeFromRBDSnapshot moves into a\nnever-throwing unprotectRbdSnapshot helper, so the finally clause is\nnow free of inline try-catch constructions entirely.\n\nNo behavior change.\n\n---------\n\nCo-authored-by: calvix \u003c7136358+calvix@users.noreply.github.com\u003e" }, { "commit": "5c97979d458f23f608f120011d727474a4f9abf6", "tree": "aca8f1ba6d94dcf4ba9745f5ecebbd00d40e455f", "parents": [ "a53c5ae2404b2bc78f65534ada3f421024af94aa" ], "author": { "name": "Abhishek Kumar", "email": "abhishek.mrt22@gmail.com", "time": "Tue Sep 08 17:35:54 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 08 14:05:54 2026 +0200" }, "message": "ui: show related settings when (main) config value is changed (#13965)\n\nSigned-off-by: Abhishek Kumar \u003cabhishek.mrt22@gmail.com\u003e" }, { "commit": "a53c5ae2404b2bc78f65534ada3f421024af94aa", "tree": "5e4a627d4230763daac1c609b640d5493eedd0b7", "parents": [ "92946e1e6d6ab1693ca0685329f072a320bc4158" ], "author": { "name": "Ramgopal Nagaboina", "email": "ramgopal.nagaboina.dev@gmail.com", "time": "Tue Sep 08 07:57:44 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 08 13:57:44 2026 +0200" }, "message": "server: treat a zero-capacity storage pool as full (#14052)" }, { "commit": "bbf8c1a05cabe14c75fe73b4bc5feb20aedbfccb", "tree": "35d0976a12345cfab40aaa320831cf479906bdd9", "parents": [ "6a2e033322b12bfdb374d1fe01a833b040fe5859" ], "author": { "name": "Ramgopal Nagaboina", "email": "ramgopal.nagaboina.dev@gmail.com", "time": "Tue Sep 08 07:56:03 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 08 13:56:03 2026 +0200" }, "message": "server: do not NPE when a VPN provider returns no per-user result (#14047)" }, { "commit": "92946e1e6d6ab1693ca0685329f072a320bc4158", "tree": "7a6a870e40a59f1da0492c93ee8f13465c16f7e4", "parents": [ "53d6516bcc91e04d7c4af4cedeeb775d883c96fd" ], "author": { "name": "James Peru Mmbono", "email": "jmsperu@gmail.com", "time": "Tue Sep 08 14:29:01 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 08 13:29:01 2026 +0200" }, "message": "improve test to read and set nas.backup.incremental.enabled for the test zone (#13960)" }, { "commit": "cdbda0ae158fd9cdee6850f61f5b943bccdb1f26", "tree": "61ef72d49bf0953e247cebbd8d837be7b47af76b", "parents": [ "f725211250a73f6d79943b88d2ddd15636021945" ], "author": { "name": "Ayush Sinha", "email": "ayushsinha3199@gmail.com", "time": "Tue Sep 08 16:32:05 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 08 16:32:05 2026 +0530" }, "message": "engine: key removeNic work job lookup on nic uuid to fix concurrent removal race (#13700)\n\nremoveNicFromVmThroughJobQueue looked up pending work jobs by\n(vmType, vmId, commandName) only, so the nic was not part of the dedup\nkey. A second removeNicFromVirtualMachine request for a different nic on\nthe same vm matched the first still-pending VmWorkRemoveNicFromVm job and\njoined it instead of submitting its own. That job removes only the nic it\nwas created for, yet both callers wait on the same job id and both receive\nits success, leaving the second nic silently attached while its API call\nreports success.\n\nMake the nic uuid part of the lookup key, mirroring\naddVmToNetworkThroughJobQueue which was fixed the same way in #5658:\n\n - look up pending jobs with the 4-arg\n listPendingWorkJobs(Instance, vmId, cmd, nic.getUuid())\n - fail fast with CloudRuntimeException if more than one job matches\n - stamp new jobs with setSecondaryObjectIdentifier(nic.getUuid())\n before submitting\n\nGenuine duplicates, two requests for the same nic, still dedup as before.\nAdds three regression tests to VirtualMachineManagerImplTest covering the\ncross-nic race, same-nic dedup, and the multiple-pending-jobs guard.\n\nFixes: #13699\nGenerated-by: Claude Code (Anthropic)\n\nSigned-off-by: Ayush Sinha \u003cayushsinha3199@gmail.com\u003e" }, { "commit": "6a2e033322b12bfdb374d1fe01a833b040fe5859", "tree": "229137bd08a630728921d5869e5c09ccd7f029b3", "parents": [ "3a797993f3a117940c23d821af533b7b726c6b8b" ], "author": { "name": "Ramgopal Nagaboina", "email": "ramgopal.nagaboina.dev@gmail.com", "time": "Tue Sep 08 06:49:34 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 08 12:49:34 2026 +0200" }, "message": "apply the restored volume max IOPS to the max IOPS field (#14024)" } ], "next": "53d6516bcc91e04d7c4af4cedeeb775d883c96fd" }